Www bittorrent ru utorrent#
Www bittorrent ru tv#

Once executed, this file will download and execute the actual torrent file from b-torru/dl.php via HTTPS.

Www bittorrent ru utorrent#

Additionally, the executable makes use of an icon for the popular uTorrent BitTorrent client. Once unzipped, the following file would be presented to the user:Īs you can see, the attackers are also making use of double file extensions to further attempt to trick the user into believing this file is a legitimate torrent. Using Figure 2 as the example, should the user download the torrent file, they will be presented with the following: Once unzipped, an executable of the same name is presented to this user. When a user attempts to download the torrent file, they are instead presented with a compressed file with the corresponding name. The most interesting event occurs when a user attempts to download the torrent file associated with the files advertised.įigure 2 File download options from b-torru When a user attempts to download one of the files presented from this website, they are guided to download the file directly via ubar-proru, which is a Russian program designed for searching, downloading, or playing files from the Internet. Based on data provided by this Russian BitTorrent site, over 275,000 unique torrent files are hosted.įigure 1 Translated view of b-torru from Russian to English

Www bittorrent ru tv#

The list includes games, operating systems, software, books, magazines, audiobooks, TV shows, and movies.

The attack begins when a user navigates to b-torru, which provides BitTorrent files for users that in turn allow them to download any number of items. In fact, the operator behind this attack makes specific attempts to ensure that the end user doesn’t realize that malware has been loaded on his or her machine. Like many similar operations, the cryptocurrency miners are delivered without the user’s knowledge. This particular Russian BitTorrent site, b-torru, has been active since July 2017, and has been observed bundling malware with legitimate files served to its users since September 2017. The latest identified threat comes in the form of a Russian BitTorrent site that is covertly distributing malware, primarily mining the Monero cryptocurrency, to its users. As 2018 begins, we’ve witnessed an increased trend in cryptocurrency miners.