+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: { Community Alert } Bitcoin investors being targetted with Orcus (/Thread-Community-Alert-Bitcoin-investors-being-targetted-with-Orcus)
{ Community Alert } Bitcoin investors being targetted with Orcus - S3xySmurf - 12-09-2017
Fortinet or more specifically Floser Bacurio and Joie Salvio have uncovered a little hacking spree targeting Bitcoin investors.
It comes in the form of an email masquerading as bitcointalk.org and uses a simple but effective .vbs script which contains what looks like a jpeg but is really disguised PE file which turns out to be a backdoored version of TTJ- Inventory System, first look at the decompiled source shows that it unpacks another bit of data and using hardcoded keys unpacks it and runs it directly in memory.
It's a pretty horrible way to spread because to me it's so dirty but non the less it's obviously doing the job its supposed too.
See the full post here https://blog.fortinet.com/2017/12/07/a-peculiar-case-of-orcus-rat-targeting-bitcoin-investors
hxxps://bltcointalk.com/ here's the URL they are using, can you spot the difference?
RE: { Community Alert } Bitcoin investors being targetted with Orcus - mothered - 12-09-2017
Seems very Impressive.
The article Is quite In depth, so I've bookmarked It for later analysis.
(12-09-2017, 09:19 AM)S3xySmurf Wrote: hxxps://bltcointalk.com/ here's the URL they are using, can you spot the difference?
Spoiler:
bltcointalk.com = b(L)tcointalk.com