• Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg
  • Delicious

Anti-Malware Laboratory

Yet Another Malware Blog

About

An informal blog from your friendly neighborhood software security humans.

Blog Archive

  • ▼  2015 (5)
    • ►  October (1)
    • ►  August (2)
    • ▼  May (1)
      • [BE CAUTIOUS] Dragon Ball Z: Resurrection of F MA...
    • ►  March (1)
  • ►  2014 (8)
    • ►  October (1)
    • ►  July (1)
    • ►  June (1)
    • ►  May (4)
    • ►  April (1)
  • ►  2013 (12)
    • ►  December (3)
    • ►  November (5)
    • ►  August (2)
    • ►  March (2)
  • ►  2012 (35)
    • ►  April (4)
    • ►  March (12)
    • ►  February (17)
    • ►  January (2)

Categories

adobe (1) android (10) android february (1) baksmali (1) Black Hole (2) crimepack (1) disassembler (1) exploit (3) Exploits (4) Fakeav Winrar sfx (1) Fishbowl (1) flash (1) gift certificates (1) Google Authenticator (1) google play (1) hcp (1) java (1) Malware (5) mdac (1) Mobile (24) NSA Mobility Program (1) obfuscated script (1) pdf (1) Reversing (2) rhino (1) skype (1) smali (1) spam (1) test (1) Unpacking (1) vouchers (1) vulnerability (3)

Popular Posts

  • Bank of America spam: An Analysis
    An email claiming to be from Bank of America lures users to open an attachment that shows how to open secure emails from the bank. The mess...
  • [BE CAUTIOUS] Dragon Ball Z: Resurrection of F MALWARE and SCAM
    Be wary of downloading movies in torrent sites.  Executables can also be executed with a file size as huge as a gigabyte...
  • Unpacking MFC Compiled CryptoWall Malware
    Unpacking MFC Compiled CryptoWall Malware Introduction First and foremost, this article does not intend to analyze what CryptoWall malw...

Visitors to this blog

Wednesday, May 20, 2015

[BE CAUTIOUS] Dragon Ball Z: Resurrection of F MALWARE and SCAM

Posted on Wednesday, May 20, 2015 by Red Horse | 4 comments


















Be wary of downloading movies in torrent sites.  Executables can also be executed with a file size as huge as a gigabyte.  

A recent Dragon Ball Z movie from Japan was released entitled Dragon Ball Z: Resurrection 'F'  has been making rounds as of this writing.  References at: http://en.wikipedia.org/wiki/Dragon_Ball_Z:_Resurrection_%27F%27

Searching torrents for this movie shows a small number of seeds.




Let's check the top seeded torrent's Trackers.



Domains points to a .coppersurfer.tk, demonii.com, and tfile.me.

Here's the interesting part.



Notice the .exe file name extension instead of .avi or .mkv or the like.

All 6 torrents shown from the top points to downloading a .exe file.  Could be a malware.  The downloaded executable has an md5 of e62607261e5138d76497e3ccc092e20b.  It is an NSIS compiled SFX.

But while downloading it, here's another one but rather a scam.  Googling for this movie's torrent would usually end up with something like this page.



Following the piratetorrents.net link directs to this page.



Downloading the torrent and leeching it shows these files to be downloaded.



The movie is RAR compressed and is password protected.  Along with the whole package is a README.txt that contains.


Going to the link where the password is redirects to this site.



A very obvious scam.  Didn't bother continuing to all that scam process.


Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest
Newer Post Older Post Home

4 comments:

  1. UnknownJuly 6, 2015 at 7:37 PM

    This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
      Reply
  2. UnknownAugust 10, 2015 at 10:01 PM

    This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
      Reply
  3. Princess CelestiaJanuary 30, 2016 at 9:55 PM

    This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
      Reply
  4. vurucuMarch 12, 2019 at 5:29 AM

    This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
      Reply
Add comment
Load more...

Subscribe to: Post Comments (Atom)
volute-glacial
volute-glacial
volute-glacial
volute-glacial
Copyright © Anti-Malware Laboratory | Powered by Blogger
Design by Fabthemes | Blogger Template by NewBloggerThemes.com