News for hackers. Stuff that matters.

A comment on New Brazilian Banking Trojan Uses Windows PowerShell Utility. Parent comment

Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility by nacos on Saturday August 20, 2016 @12:04PM (#12327138)
As a "corporate" sysadmin using Powershell everyday, I was always surprised that PS is not so used in the malware industry.

By the way, I find that this article[0] linked in the original post is much more interesting if you want to know more about how brazilian malwares work (BHO injection, 2FA bypass, etc.)

[0] https://securelist.com/blog/research/74325/the-evolution-of-...

[ Parent | on HN ]
Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility by user5994461 on Saturday August 20, 2016 @04:40PM (#12328222)
It took a while for powershell to be installed on most computers. It's still certainly missing on many computers (i.e. the oldest and most vulnerable).

I actually don't know whether it is installed as default in the latest Microsoft OS and patches.

That and the very easy way to analyse/reverse engineer scripts don't make a great candidate for malware.

Anyway, the windows shell is enough for trivial scripts, and one might as well write software in a real programming language for the rest.

[ Parent | on HN ]
Re:New Brazilian Banking Trojan Uses Windows PowerShell Utility by contextfree on Sunday August 21, 2016 @12:25AM (#12329363)
It's been installed by default since Windows 7 and PS v2. The only version that wasn't installed by default with a Windows release was PS v1 (introduced at the same time as Vista).
[ Parent | on HN ]