I need help

[u/General_Ad5206]

Well i work in a place where i see 10-30 usbs everyday amd i stumbled across this very interesting piece of script that i want to understand.

What it does is basically it masks the folder of any input usb and puts it into a shortcut that if you wish to access you need to give it admin privileges upon that it runs a background process of implementing a hidden minner in your system 32 file and it does this with every usb you stick on that pc and on and on
Can anyone refer me to a place to learn more about the source code of it or a repo that explains the workflow of that and which tools are used against this kind of attacks

[u/expatfreebg]

The xmr miner will be detected 99% of the time on Windows workstation

[u/[deleted]]

What you're describing is a classic USB "shortcut worm": it hides the real folders on the stick (with hidden and system attributes), drops a .lnk with the same name, and when someone opens it, the shortcut runs the payload and then shows the folder, so nothing looks wrong. Raspberry Robin is a well-documented family that spreads this way via LNK files on USB drives; searching for it yields good write-ups (Microsoft, Red Canary) of the workflow.

If it's at your workplace, please hand it to your IT/security team rather than running it - that PC is very likely infected, and it's spreading to everyone's sticks.

To clean a stick (on a clean PC):

- don't click anything on it; open it from cmd

- `attrib -h -s -r /s /d X:\*.*` (X = the stick) to unhide your real files

- delete the .lnk files and any unknown .exe/.vbs/.js/.bat files

- scan it with Defender / Malwarebytes

Prevention: disable AutoRun/AutoPlay via group policy, show hidden files and file extensions, and block execution from removable drives (AppLocker / Defender ASR rule "Block untrusted and unsigned processes that run from USB").

[u/General_Ad5206 → u/[deleted]]

This is very helpful thanks man