Careful. Load Leonardo DiCaprio's movie.
Load Leonardo DiCaprio's movie from Torrent malware agent Tesla.
Leonardo DiCaprio's movies are always reputed to be quality movies worth watching. This award star's masterful performance has made the movie available to fans and audiences from cinemas to authentic media to bootleg downloads, but it's like a bootleg fan has a big deal.
According to a report by the website Cyber Security News, a new campaign of hackers to spread malware based on the reputation of Leonardo DiCarrio's new film, One Battle After Another (One Battle After Another), claimed to be a bootleg movie file that was released to everyone before the licensed version of the movie was released. Those who downloaded it would have the movie in their possession before anyone else through the Torrent file sharing site, but the movie file was fake with Agent Tesla malware, a remote access type of malware to the victim's machine, or RAT (Remote Access Trojan). Aim to attack users of the Windows operating system.
In spreading the malware, after the victim has successfully downloaded a set of fake movie files from Torrent, there are several files in the downloaded folder, usually not unnoticed. Among them, there is a file called CD.lnk, which pretends to be a movie playback file, but after the victim clicks it, it will lead to a command to read the PowerShell script hidden in the subtitle file called Part2.subtitles.srt. Hiding the code is also known as intelligent, because it is not just inside the file. Scripps malware, but the subtitles of the movie actually contained them, making the victim indifferent.
After the script is completed, it will extract and decode another code hidden in the same caption file using the AES decoding algorithm. This will lead to the creation of five PowerShell script files, placed in a folder called C: UsersAppDataLocalMicrosoftDiagnostics. Each script will perform different functions.
The 1st will act to decompress a compressed file disguised as a movie file called One Battle After Another .m2ts by using software to compress and decompress whatever files can be obtained on the machine, whether it's WinRAR, 7-Zip, or Bandizip.
The second will provide persistence on the system for malware (Persistence) by creating a task schedule with a task called RealtekDiagnostics, disguised as a tool for monitoring Realtek's voice. This will allow the malware to be relaunched at any time after the machine is rebooted.
Others will act to decompress data from image files such as Photo.jpg and Cover.jpg, which will decompress the hidden data and make up the final malware file (Payload).
Finally, it runs the last group of Payload files from the script. It runs directly on Memory to bypass it and then contacts the C2 or Command and Control server. This malware Agent Tesla, in addition to having the ability to steal passwords, also has the ability to convert the machine into a zombie machine to attack other, larger systems that are the main target of hackers. Not only that, this malware can be used as an intermediary to install other malware on the victim's machine.
# Welcome 2026 # Take care of yourself # Open budget # Includes IT matters # Trending
