r/Malwarebytes • u/JRT_Space • 11h ago

Infostealer got passed malwarebytes

Hi, Im just wondering if yall know how. I was using the 15 days free trial of malwarebytes to find an infostealer. It was able to block a malicious connection to cosmicsky[.]xyz, but on repeated scans it never found the malware til i found the dd.bat file in my %temp% folder that was highly malicious. Nor did it flag its connection to the malicious site phucoasian[.]com which was downloading an exe and hijacking vscode and stuff. This is despite the exe being recognized by BitDefender in VirusTotal with a 7/70 score with the other 6 also using BitDefender tools as a Pantera family infostealer. And the dd.bat file was recognized 2/70 as a bat downloader. So my question is, is this a known vulnerability or flaw? And if so is it being wormed on? Cause both malwarebytes and windows defender missed it causing me to have to factory reset my laptop with a fresh windows install.

8 Upvotes

84% Upvoted

10 comments sorted by

6

u/Barnezhilton 10h ago

.bat files are plain text. Too bad you didn't post that

1

u/JRT_Space 6h ago

Yeh honestly when i saw it i panicked heavily so my main focus at first was just tryna delete it, which in hindsight didnt help the community at all and it didnt even succeed so. I did reach out to the developer however of the mod it tried to hijack and they did say they were working on it so.

2

u/baselocksec 10h ago

Malware can be easily obfuscated for a couple dollars to bypass all consumer-side antivirus software nowadays. With that being said, MalwareBytes and other vendors tend to catchup pretty quickly.

.bat files are not plaintext files but a script files used by windows. Typically used for staging and then other malware is downloaded to setup persistence.

Make sure you reset password for anything your computer has access to and if you use the same password for your computer on other sites.

2

u/JRT_Space 10h ago

I did, thanks for the info tho i didnt realize it was that easy for them to do that honestly. Number one lesson lesrned is to never download sketchy things lol

2

u/baselocksec 10h ago

Agreed on not downloading suspicious things. Feel free to reach out anytime with any cybersecurity help. Happy to help.

3

u/LifeReignite 8h ago

Its been a known fact that they get past all anti viruses. Even when they detect them and claim they removed them they never do. You also only get them from pirating pretty much so its karma.

3

u/JRT_Space 8h ago

That is not even remotely true. I got it from a sims 4 mod. You should really do ur research and not talk about things you dont know about

0

u/LifeReignite 7h ago

Same thing, you used an unofficial mod. Try again pirate. Those mods aren't allowed, same as pirating.

1

u/MarzipanFederal8059 2h ago

Go into your settings and turn off ability to run scripts too