Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility
by Arnavion on Saturday August 20, 2016 @11:35AM
(#12327014)
Yes. It seems the user executes an attachment that's a PIF file (a type of shortcut file) that writes out a PS script to the temp directory and executes powershell.exe to run it. The point of highlighting PS in the article appears to be that previous distribution of this malware used a different mechanism, not anything wrong with PS itself.
[ Parent
| on HN ]
Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility
by nacos on Saturday August 20, 2016 @12:04PM
(#12327138)
As a "corporate" sysadmin using Powershell everyday, I was always surprised that PS is not so used in the malware industry.
By the way, I find that this article[0] linked in the original post is much more interesting if you want to know more about how brazilian malwares work (BHO injection, 2FA bypass, etc.)
[0] https://securelist.com/blog/research/74325/the-evolution-of-...
Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility
by user5994461 on Saturday August 20, 2016 @04:40PM
(#12328222)
It took a while for powershell to be installed on most computers. It's still certainly missing on many computers (i.e. the oldest and most vulnerable).
I actually don't know whether it is installed as default in the latest Microsoft OS and patches.
That and the very easy way to analyse/reverse engineer scripts don't make a great candidate for malware.
Anyway, the windows shell is enough for trivial scripts, and one might as well write software in a real programming language for the rest.
Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility
by contextfree on Sunday August 21, 2016 @12:25AM
(#12329363)
It's been installed by default since Windows 7 and PS v2. The only version that wasn't installed by default with a Windows release was PS v1 (introduced at the same time as Vista).