2 ms·

It's not clear from the article (or maybe I'm missing it) but this isn't a vulnerability with PS right? The article would be the same if it "New Brazilian Banki

It's not clear from the article (or maybe I'm missing it) but this isn't a vulnerability with PS right? The article would be the same if it "New Brazilian Banking Trojan Uses PHP", it's just a language/style that is new not what it is doing or how it's doing it AFAICT.

Arnavion 10y ago
Yes. It seems the user executes an attachment that's a PIF file (a type of shortcut file) that writes out a PS script to the temp directory and executes powershell.exe to run it. The point of highlighting PS in the article appears to be that previous distribution of this malware used a different mechanism, not anything wrong with PS itself.
- nacos 10y ago
  As a "corporate" sysadmin using Powershell everyday, I was always surprised that PS is not so used in the malware industry. By the way, I find that this article[0] linked in the original post is much more interesting if you want to know more about how brazilian malwares work (BHO injection, 2FA bypass, etc.) [0] https://securelist.com/blog/research/74325/the-evolution-of-brazilian-malware/ https://securelist.com/blog/research/74325/the-evolution-of-...
  - user5994461 10y ago
    It took a while for powershell to be installed on most computers. It's still certainly missing on many computers (i.e. the oldest and most vulnerable). I actually don't know whether it is installed as default in the latest Microsoft OS and patches. That and the very easy way to analyse/reverse engineer scripts don't make a great candidate for malware. Anyway, the windows shell is enough for trivial scripts, and one might as well write software in a real programming language for the rest.
    - contextfree 10y ago
      It's been installed by default since Windows 7 and PS v2. The only version that wasn't installed by default with a Windows release was PS v1 (introduced at the same time as Vista).
ygra 10y ago
Yep. There's nothing about PowerShell in particular that enables this attack apart from being able to execute code. Granted, it can do a bit more with the system than cmd could, but that's about it.

Arnavion 10y ago

Yes. It seems the user executes an attachment that's a PIF file (a type of shortcut file) that writes out a PS script to the temp directory and executes powershell.exe to run it. The point of highlighting PS in the article appears to be that previous distribution of this malware used a different mechanism, not anything wrong with PS itself.

nacos 10y ago
As a "corporate" sysadmin using Powershell everyday, I was always surprised that PS is not so used in the malware industry. By the way, I find that this article[0] linked in the original post is much more interesting if you want to know more about how brazilian malwares work (BHO injection, 2FA bypass, etc.) [0] https://securelist.com/blog/research/74325/the-evolution-of-brazilian-malware/ https://securelist.com/blog/research/74325/the-evolution-of-...
- user5994461 10y ago
  It took a while for powershell to be installed on most computers. It's still certainly missing on many computers (i.e. the oldest and most vulnerable). I actually don't know whether it is installed as default in the latest Microsoft OS and patches. That and the very easy way to analyse/reverse engineer scripts don't make a great candidate for malware. Anyway, the windows shell is enough for trivial scripts, and one might as well write software in a real programming language for the rest.
  - contextfree 10y ago
    It's been installed by default since Windows 7 and PS v2. The only version that wasn't installed by default with a Windows release was PS v1 (introduced at the same time as Vista).

ygra 10y ago

Yep. There's nothing about PowerShell in particular that enables this attack apart from being able to execute code. Granted, it can do a bit more with the system than cmd could, but that's about it.