Cybercriminals Use Malicious Memes That Communicate with Malware

Re:Cybercriminals Use Malicious Memes That Communicate with ... by throw12311112 on Tuesday December 18, 2018 @06:11AM (#18705741)

Can anyone elaborate how this code is actually executed?

If I download one of these images, which appears to embed CSharp Winform code, how does it actually run within the system?

I suppose it couldn't unless taking advantage of some other exploit along the way. And if that is the case, this article is perhaps a little incomplete.

[ Parent | on HN ]

Re:Cybercriminals Use Malicious Memes That Communicate with ... by jwilk on Tuesday December 18, 2018 @06:43AM (#18705852)

From the article:

The memes contain an embedded command that is parsed by the malware after it’s downloaded from the malicious Twitter account onto the victim’s machine, acting as a C&C service for the already-placed malware. It should be noted that the malware was not downloaded from Twitter and that we did not observe what specific mechanism was used to deliver the malware to its victims.

[ Parent | on HN ]

Re:Cybercriminals Use Malicious Memes That Communicate with ... by elorant on Tuesday December 18, 2018 @09:02AM (#18706407)

It's not the images that are executed. The images are used to pass commands to malware that's already installed on a machine.

[ Parent | on HN ]