PornBits News- Uploading restrictions

[Achelous]

Hello everyone,

Sorry to inconvenience you all, but I assure it's for a good cause. As some of you have noticed, there's been a rash of malware spreading on this site lately. While we've been keeping an eye on things and trying to remove malicious torrents as quickly as we can, it's a case of playing whack-a-mole. For a long time we've wanted to allow all users to share their content. Now, it's proving to be too problematic. We hope this is only a temporary solution but we have decided to restrict upload privileges to only Uploader class (plus, of course, staff). If you have uploaded torrents before and would like to continue to do so, please contact G*******, s*****, or myself and we can grant you permissions.

I'm working with anti-malware providers to ensure that this malware will be detected and removable before further damage can be done.

What you need to know:
The malware targets Win32 (Windows) only
The malware typically comes in ~2MB .exe files and there are several variants with different behaviors
The malicious torrents typically contain only one .rar file, housing the malware + other files to make it appear legit
Can be disguised as part of a game's main executable file, or as a video (still a .exe file, but uses the VLC media player icon to make the user assume it is a video)
In almost every case, the malicious torrent is the first time that user has ever uploaded
When executed, the malware attempts to check whether it is running inside common virtual machine environments (such as VMware, Wine, VirtualBox, etc.) or debuggers (OllyDbg, Ida, etc.) -- almost certainly in attempt to prevent us from inspecting it further.
Some of the variants attempt to contact (but may not be limited to) 91.211.250.105 upon execution


If infected:
It attempts to steal saved passwords, cookies, autofill forms, Skype history etc.
Steals wallet.dat files (typically cryptocoin wallets), desktop files
Sends a list of installed programs, currently running processes, and details about you and your computer off to the server mentioned above
Some variants *may* attempt to install the Hermes ransomware


As more details are available, we will be sure to keep you updated.