Fake Movie Torrent Delivers Agent Tesla Through Layered PowerShell Chain
Summary
Bitdefender researchers detail a fake One Battle After Another torrent that uses hidden scripts, disguised archives and scheduled-task persistence to deliver Agent Tesla to Windows systems, with its final payload executed in memory.
Key points
- The fake torrent masquerades as the film One Battle After Another and contains a shortcut that launches malicious code hidden in subtitle lines.
- PowerShell scripts decrypt and unpack multiple stages from files disguised as a video, image and subtitle.
- A scheduled task named RealtekDiagnostics provides persistence and runs under the current user account.
- The final Agent Tesla payload executes in memory and establishes command-and-control capabilities.
- Researchers confirmed the malware’s communication routines but did not identify its remote server because they did not attempt an external connection.
- The article says the torrent had thousands of seeders and leechers, but the number of downloads or infections is unknown.
Article Details
- Attack Vectors
- A fake torrent for One Battle After Another delivers a movie-looking archive containing a shortcut, subtitle file, and disguised image/archive files.
- Opening CD.lnk executes batch code hidden in lines 100–103 of Part2.subtitles.srt, which launches successive hidden PowerShell stages.
- The chain decrypts embedded data, extracts files from disguised archives, decodes payload data from Photo.jpg, and ultimately runs the Agent Tesla payload entirely in memory.
- A hidden Task Scheduler task named RealtekDiagnostics, triggered shortly after creation or at logon, runs RealtekCodec.bat to maintain persistence.
- Defensive Notes
- Treat movie torrents and multimedia files from untrusted sources as potentially malicious; the article describes executable batch code embedded in a subtitle file and archives disguised as video or image files.
- Investigate unexpected hidden PowerShell activity, the RealtekDiagnostics scheduled task, and suspicious files or scripts in the reported Microsoft.Diagnostics and Microsoft.WindowsSoundDiagnostics Cache paths.
- The article reports that Bitdefender security solutions detected and protected against the threat, but provides no specific defensive configuration or detection signature.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe chain hides batch code in subtitle lines and uses encrypted or encoded data in subtitle and image/archive files.T1053.005 · Scheduled TaskThe malware creates a hidden scheduled task named RealtekDiagnostics, triggered shortly after creation or at logon, to run RealtekCodec.bat.T1059.001 · PowerShellMultiple hidden PowerShell stages decrypt, unpack, decode, and execute the payload.T1059.003 · Windows Command ShellThe shortcut invokes cmd.exe to extract and execute batch code embedded in the subtitle file.T1204.002 · Malicious FileThe infection begins when a user opens the delivered CD.lnk shortcut, which launches the malicious command chain.T1620 · Reflective Code LoadingThe decoded final binary executes entirely in memory, with no file written to disk at that stage.
People
Malware
Agent TeslaFake Leonardo DiCaprio Movie Torrent Drops Agent Tesla Through Layered PowerShell ChainLumma StealerFor example, Mission: Impossible – The Final Reckoning was used to spread the Lumma Stealer, which targets passwords, cookies, crypto wallets, credentials from remote desktop tools, and more.
Vendors
Products
7-ZipDepending on the tools available, it uses Expand-Archive, WinRAR, 7-Zip or Bandizip, if found:BandizipDepending on the tools available, it uses Expand-Archive, WinRAR, 7-Zip or Bandizip, if found:Microsoft Windowsmalware is designed with a single purpose: to provide attackers with unfettered access to the victim's Windows computer. Once they have a foothold, criminals can access the computer remotely and steal financial andWindows DefenderChecks if Windows Defender is active.WinRARDepending on the tools available, it uses Expand-Archive, WinRAR, 7-Zip or Bandizip, if found:
Tools
CMDThe attacker uses several legitimate Windows utilities (CMD, PowerShell, and Task Scheduler) to unpack multiple layers of encrypted data.PowerShellFake Leonardo DiCaprio Movie Torrent Drops Agent Tesla Through Layered PowerShell ChainTask SchedulerThe attacker uses several legitimate Windows utilities (CMD, PowerShell, and Task Scheduler) to unpack multiple layers of encrypted data.