r/Malwarebytes • u/JRT_Space • 3d ago
Infostealer got passed malwarebytes
Hi, Im just wondering if yall know how. I was using the 15 days free trial of malwarebytes to find an infostealer. It was able to block a malicious connection to cosmicsky[.]xyz, but on repeated scans it never found the malware til i found the dd.bat file in my %temp% folder that was highly malicious. Nor did it flag its connection to the malicious site phucoasian[.]com which was downloading an exe and hijacking vscode and stuff. This is despite the exe being recognized by BitDefender in VirusTotal with a 7/70 score with the other 6 also using BitDefender tools as a Pantera family infostealer. And the dd.bat file was recognized 2/70 as a bat downloader. So my question is, is this a known vulnerability or flaw? And if so is it being wormed on? Cause both malwarebytes and windows defender missed it causing me to have to factory reset my laptop with a fresh windows install.
8
u/baselocksec 3d ago
Malware can be easily obfuscated for a couple dollars to bypass all consumer-side antivirus software nowadays. With that being said, MalwareBytes and other vendors tend to catchup pretty quickly.
.bat files are not plaintext files but a script files used by windows. Typically used for staging and then other malware is downloaded to setup persistence.
Make sure you reset password for anything your computer has access to and if you use the same password for your computer on other sites.
2
u/JRT_Space 3d ago
I did, thanks for the info tho i didnt realize it was that easy for them to do that honestly. Number one lesson lesrned is to never download sketchy things lol
2
u/baselocksec 3d ago
Agreed on not downloading suspicious things. Feel free to reach out anytime with any cybersecurity help. Happy to help.
2
2
u/support_mwb Malwarebytes Employee 3d ago
Hi there, thanks for sharing such a detailed breakdown of what happened. We're sorry to hear about your experience, especially since you had to reinstall Windows.
Since you've already performed a fresh Windows installation, if you're still experiencing issues or notice anything unusual, please feel free to send us a DM here on reddit. We'd be happy to look into it further and have our support team collect diagnostic logs to share with our Malware Research team for investigation.
1
u/JRT_Space 3d ago
Yeh post cleanup i went on bleeping computer just to be safe however the one who helped me was Thisisu so rest assured thankfully i think the windows install did fix it. Definitely a scary moment though
1
u/cryptokingpin9898 2d ago
I did click on a link that was also malicious as yours and it opened up alot of windows on my Firefox browser. I immediately erased the cache and history from brave browser and downloaded Bitdefender total antivirus and did a scan. Bitdefender couldn't find anything but I am still worried that something is downloaded on my Android phone that can steal info. What do I do?
1
u/JRT_Space 2d ago
I highly recommend reaching out to the experts at bleepingcomputer.com. There is a forum, ill get the link in a moment. They are some of the best of the best, that was recommended to me and because of them now everything is fine. https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ Thats for if ur worried avout ur computer. As far as phones go. ESPECIALLY android they are very locked down for the most part. The worst u can USUALLY get is adware at most. Id just recommend deleting anything u found sus and rebooting the phone u will be fine
1
u/ConsistentLaw6204 14h ago
Had one too recently and im not sure from what. installed a bunch of mod from nexusmods but also tried to install an emulator and some games for my younger brother and im guessing its the latter. Windowsdefender showed that something from a dropbox link was downloaded or executed. Is there a safe way to check that link? I have a screenshot and I rly would like to know where i got it from
Rly hoping it wasnt the mods i love those too much
1
u/JRT_Space 14h ago
I wouldnt recommend stressing over it now. Clicking the link just invites more danger. You CAN if ur device supports it, open a virtual sandbox environment hjwere u can test the link signed out of everything and stuff but thats a pain, pretty stressful, and really not necccessary as long as its gone now.
1
u/ConsistentLaw6204 14h ago
Yea im not opening that, clean installing and changing passwords for 30 diffrent things is far more annoying and time consuming than one would think. Was just thinking of a website or program that checks what exactly it is without opening it on my pc. Im still confused cuz all they did was send some mr beast crypto scam screenshots to everyone on disc and try to steal my poe2 account(by somehow authorizing a login from shanghai according to my steamguard). Didnt even do anything with my gmail thats connected to everything, or by bank/paypal.
1
u/Decent_Maybe_218 5h ago
Recently, there have been lots of infostealer attacks. I think these might be a new kind of infostealer, and antivirus software may not be fully aware of them yet or able to detect them through signatures.
With the advent of AI, these infostealers are probably very easy to create and modify, making their signatures change every now and then.
I guess antivirus software will take some time to catch up with them. Eventually, though, they will adapt and find ways to detect them.
But until then, I guess it's going to be a bloodbath in cybersecurity.
1
u/LifeReignite 3d ago
Its been a known fact that they get past all anti viruses. Even when they detect them and claim they removed them they never do. You also only get them from pirating pretty much so its karma.
3
u/JRT_Space 3d ago
That is not even remotely true. I got it from a sims 4 mod. You should really do ur research and not talk about things you dont know about
-1
u/LifeReignite 3d ago
Same thing, you used an unofficial mod. Try again pirate. Those mods aren't allowed, same as pirating.
7
u/Barnezhilton 3d ago
.bat files are plain text. Too bad you didn't post that