40629
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
Everyone and their Grandmother has been HOUNDING ME about this "GTA VI leak" which is circulating on torrent websites. I also saw TONS of terrible, absolutely atrocious, "reverse engineering" write-ups which are 100% AI slop or people who have no idea how to bonk goop with a stick.
Thankfully, stinky nerds came to my rescue and torrented the fake GTA VI so I could bonk it with a stick. Previous "write-ups" on social media ARE WRONG.
> gta vi "leak"
> download from ChlorideCull
> look inside
> tons of files
> junks DOI files
> "compress.libs"
> decoy file, Rockstar Games launcher
> other random junk
> setup.libs
> SHA256: 370efaa710945ece0e8b3b30a26b97ba8e56f0812d5014f512cab71c074a2e62
> password protected SFX installer
> lolwtf?
> "SetupGTAVI.exe"
> 1.05gb
> SHA256: 23a7d2ccfa91c2bb48eec6487a71f87b961d4c86f400cd60b1a9babcbe38849a
> artificially inflated with junk
> self-packed encapsulated payload
> jumps to payload far af away from base
> extracts VB6 DLL
> runs secondary stage VB6 DLL in-memory
> VB6 DLL runs various LOLBIN stuff
> executes setup.libs with super-secret password
> "pro defend 6"
> password somewhere in the 1gb file
> found by EricParker having to emulate 1gb file
> RIP da homie Eric fr
> setup.libs is tertiary payload
> setup.libs drops a bunch of files
> drops stage 4 binary, c.vbs
> drops stage 5 binary, c.bat
> both heavily obfuscated
> copies files to C:\Intel directory (fake directory)
> does over 9000 LOLBIN commands
> tries to kill any known AV known to man
> changes power settings so PC cant enter sleep mode
> disables telemetry on the computer
> disables copilot
> ??? wtf is bro doing lmfao
> disables phishing filter
> disables AI analysis
> disables windows suggestions
> ??? are they trying to help me now?
> disables error reporting
> disables more windows features
> extracts stage 6 payload, s.rar
> SHA256: 95930b47664a923a7317f7291a7678d01cdb392b78145fbcda6cd90c8f1b3a44
> super secret password: xUxVtsFFYjX7gL57LESCCBSfNsy5zqoT1fjf8iDFpdjEvjipPJzVNmhsWQ
> tired of following this binary down execution stack
> stage 7 binary, stage 8 binary doing stuff
> really tired of this payload
> another password for some other archive: dXbmLPhGBoZ0JIDsfsEG9u05nV3rPPLgDuO4lQQSAEfPd4UjObQnBj
> stage 9 payload
> Quasar RAT
> SHA256: e87b8c1997a8fca26dd408ccd7f186748821c49a3cb508984c7b46759cf2f592
> bonk with stick
C2s:
s21(.)my03(.)com:23140
s22(.)zzux(.)com:23140
strawenlike(.)mrbasic(.)com:23140 oldbooksdbkts(.)my03(.)com:23140
wormbookhgs(.)duckdns(.)org:23140 tencntsrv(.)cbu(.)net:23140
More technical for non-nerds: multi-staged payload, goes through 9 or 10 stages, to ultimately deliver QuasarRAT. It begins from an inflated binary which self-extracts a LZMA compressed VB6 DLL (stage 2). The VB6 in-memory modules launches a tertiary stager present with the masqueraded leak (setup.libs). The Tertiary stager is an SFX installer, password protected, which relies on a successfully IPC from the VB6 DLL secondary stager to pass "pro defend 6". The SFX installer copies data to a masqueraded Intel directory and executes a heavily obfuscated .VBS, which executes a heavily obfuscated .BAT, which performs a series of commands which extract from various .rar files present inside the SFX tertiary payload. The .rar files are additional stages responsible for disabling anti-malware software, disabling Windows telemetry, and anything which could tamper with the final payload. The final payload is a password protected .rar file which contains an artificially inflated .NET binary (QuasarRAT) which exfiltrates sensitive binaries to multiple C2 addresses and allows remote access to the machine.
When you have malware on your computer, and you let your anti-virus remove it, this is who you're hurting. Happy now? Don't remove the malware. Malware is good
Читать полностью…
I mean, it was kind of interesting for a second? He's using ESENT, the Microsoft database thingie, I haven't seen that in awhile, people usually use like SQLite or a goofy text file. He pulls update query stuff from his TMOG domain, updates are from a shrimple JSON file listing
I see his licensing stuff with Ed25519 verification and the fields for it... I see the update functionality, the speed test functionality...
Nothing really sticks out. I see the usage of COM for AUMID stuff... and a shit load of C++ goop.
Nothing in it really sticks out. It isn't malware. It isn't anything super-duper crazy. It does exactly as described.
Okay, now I must go back to other goop
Thank you to everyone who has sent me the magnet link for what they suspect to be a masqueraded GTA VI malware payload.
I won't have time today to bonk it with a stick. It is Saturday. I will primarily be outside with my family doing things. I am currently sitting in a parking lot while my family fights for food in the wilderness (the grocery store, it's super busy for some reason).
Later this evening, realistically like, 10pm or later EST, I will take a look at it and see what it's doing, unless one of my peers decides to bonk it with a stick first.
I would like to note however that this isn't a surprising malware idea. Threat Actors are quick to weaponize anything which is trendy or will grab attention. Malware frequently masquerades as video game leaks, movie releases, music releases, political news, ... basically anything that people in large quantities would be interested in.
Anyway, smell ya later NERDS
Nah this is a real image circulating online from Facebook. The Albany, Georgia Police Department did actually post this asking for the publics assistance.
But, it's so stupid it's worth memeing. It unironically costs the Police Department more money to even make this post on social media and do an investigation than simply saying "sorry dawg" to whoever dropped $30 out of their pocket.
I'll literally give the police department $30 so they fuck off and leave this old guy alone. Who hasn't found money on the ground and said "oh whoa cool" and went on about their business?
Fucking goofy bro lmfao
Hi
It's that time again where I push more malware analysis papers and malware payloads to VXUG. I've pushed over 200,000 malwares.
I was hoping to do so over a week ago, but I was preoccupied doing family stuff. I apologize for the delays and slowness lately, it's been an eventful summer and my family makes me do something called "going outside".
I have lots of stuff cooking, but when I will have the opportunity to do more if difficult determine.
Thank you for the love and support. I love you. Please take this malware and show your friends and family, they'll think it is cool and badass.
Pic unrelated
https://vx-underground.org/Updates
Chat, let me keep you up-to-date on what the STREETS are saying about the GTA leaks (by the streets I mean stinky internet nerds)
Basically, over 9,000 stinky nerds are swarming the people leaking the content, for various reasons, with the primary motivating factor being to get a copy of the GTA VI image (the game itself).
GTA V modders (and cheaters) have been particularly ruthless, going to great lengths to find out who these people are and how they got GTA VI.
On the other side of the spectrum, stinky cryptocurrency nerds are diving head first into the Mr.Leek cryptocurrency stuff. I don't deal with cryptocurrency, so I'm not going to pretend to understand like I know what the fuck is going on over there. They are curious on the financial motivations.
On the other, other side of the spectrum, we've got stinky pseudo-journalists, or journalists in general, I don't know, also trying to determine who Mr.Leek is. They want to know because they want the story, the fame, the 200 bajillion updoots on X.
I can assert with a HIGH DEGREE of certainty that the GTA V Modders are IN DEEP. They're in so deep, Mr.Leek is beginning to become uncomfortable.
Potatoe Soup on Tacos, and Jimothy on Tuesday, don't even trip, dawg. I see "you"
Yeah, so pretty much everyone and their Grandmother is still discussing this GTA VI leak and/or compromise.
Unsurprisingly, the game leaks have also generated a great deal of speculation. Grand Theft Auto is a gigantic franchise, Rockstar is a multi-billion dollar company, and their newest release into their franchise will probably be another banger.
My educated guess, based off of everything I've seen online, is that this is the result of information stealing malware. My reasoning for this is that several people online have noted that some Rockstar employees appear to have accidentally detonated malware on their computers which subsequently exfiltrated their sensitive usernames, passwords, and web sessions.
A Threat Actor getting access to sensitive corporate data, as a result of an employee infecting themselves with malware on their personal devices, is a tale as old as time itself.
This sort of threat to organizations however is typically not targeted. While it is possible "Mr. Leek" intentionally targeted Rockstar employees (spearphishing), I believe this to be unlikely. Based off of the malware logs others have shared, I believe a Threat Actor began their typical malware campaign, to steal peoples credentials, credit-cards, cryptocurrencies, etc, and by the grace of God inadvertently infected an employee at Rockstar games.
Threat Actors are opportunists. Upon seeing he had infected a Rockstar Games employee, which would grant them access to insider information at Rockstar, I believe this person immediately seized the moment to profit off of it (or gain notoriety).
It's important to note that I could be wrong in my assessment. I am coming to this conclusion off of one angle, it is not outside the realm of possibility this was spearphishing, ... or something even sillier like an exposed bucket, or something. None of it would really surprise me, mistakes happen, organizations are compromised daily, and when you're a company as large as Rockstar you have a massive target on your back.
Pic unrelated
Rockstar Games right now trying to find out who is leaking the GTA VI footage (the secretary is terrified)
Читать полностью…
> "How do I remove this virus from my computer?"
Why would you remove it?
Shout out to whoever in San Francisco, California, just stole my credit card.
If I had to guess, someone probably swiped my credit card number off an ATM skimmer.
I'm a little disappointed you used my stolen credit card number to get a haircut. It was a $37 haircut. If you're going to commit identity theft, do something cool and badass like buy an air hockey table or something.
Now I'm going to cancel this card, get my money back, the nice person who cut your hair is going to lose money, and you don't even have an air hockey table.
You suck at identity theft bro, go big or go home
I made some typos, I meant to say "more technical for nerds", and when I copied the C2 addresses for ILSpy I messed up the formatting.
This was actually a kind of annoying payload to reverse because everything was so absurdly bloated and filled with junk.
Anyway, that's what the GTA VI "leak" does. It'll steal your passwords, allow some nerd remote access to your machine, and disables a bunch of stuff.
If you're going to distribute malware, at least have the common courtesy to do it in a manner which allows EVERYONE to get the malware.
Last time on Dragon Ball Z: I got over 9,000 DMs about a GTA VI video game leak circulating on torrent sites. Truthfully, I'm not up to date on the Take-Two and/or Rockstar Games Leeky boi lore, however I know the base game has NOT been leaked. Hence, we can conclude this is NOT the real GTA VI and this is almost certainly malware.
Unfortunately, this "totally legit" GTA VI "game" is an artificially inflated .ISO file, it is 133GB and only has five seeders. It would take me ages to download this file. I'm not going to try to download this .ISO file, patiently wait, watch it stall 56 times, and then get bummed out when it dies.
Please, if you're going to masquerade as GTA VI, make the malware easier to download. I am NOT waiting 42 hours for your malware payload
Dear Scammers Located Outside the United States,
If you want to social engineer someone, do not use the word "kindly". We've told you this like, a bajillion schmschmillion times, but seriously, when we read, "Do the needful, kindly open the application", it fucking STINKS of scam especially when you sign it something like, "Sincerely, Robert McNeal, Houston Texas"
Dawg, there is no stinky Texan, burning alive in the summer heat, drunk driving in a lifted truck with a "Jesus Saves" tattoo, named Robert McNeal saying "Do the needful, kindly do ____"
Just use ChatGPT bro, I don't know man, but it stinks and it's not fooling anyone
Pic possibly related
> SCHMEEELY LOOK AT DAVE PLUMMERS TASK MANAGER TMOG
> sort of free time
> ok
> download
> look inside
> not malware
> be me
> off beep boop machine for a bit
> get back on beep boop machine
> check news
> leaks, extortion, crypto theft
> cybercrime rampant
> internet drama all over the place
> 22% DECREASE in silly pictures of cats
Some group told people I have the GTA VI game, or something, and told people to DM me for a chance to get GTA VI? I think?
They also said I was their business partner?
I don't understand what's going on.
But I am receiving a lot of DMs online about it.
I'm not sure if this is a troll, or meme, or a coordinated harassment campaign, but this is a very odd start to my Saturday. I am extremely confused.
BREAKING🚨
AN ELDERLY MAN FOUND $30 ON THE GROUND AND DID NOT RETURN IT.
HE IS EXTREMELY DANGEROUS.
THE POLICE OF THE ALBANY GEORGIA POLICE DEPARTMENT ARE WARNING THE PUBLIC OF THIS DANGEROUS CRIMINAL
THEY WILL SPEND THOUSANDS OF TAX DOLLARS TO GET THAT $30 BACK
Setting up a malware stand on the side of the road.
Windows Malware for ¢25
Linux Malware for ¢50
Cat picture ¢35
I have lots of stuff cooking, but when I will have the opportunity to do more is difficult to determine***
Proof I don't use stupid sissy AI, I make dumb typos and look brain dead like a CHAD (please don't bully me)
And by "Potatoe Soup on Tacos" and "Jimothy on Tuesday", I'm giving a nudge and a wink to some people, so they know that I know what's up, so they know I'm cool and badass (I actually know almost nothing still)
Читать полностью…
I'm not going to discuss the malware logs, pictures and stuff, others have shared.
I've got 444,000+ followers on X and 50,000+ on Telegram. I don't want to be an asshole and put this particular employee on blast in front of nearly half-a-million people.
I don't believe they did this on purpose and I'm sure they're aware this was a massive oopsie doopsie on the oopsie doopsie scale (they're going to get fired)
Maybe it's not ideal to meme post-9/11 CIA torture cinematography, but I believe this accurately conveys the extreme rage Rockstar feels
Читать полностью…
Someone is leaking footage of GTA VI and is threatening to release more footage of GTA VI unless RockStar games makes some changes to their base game.
They also have launched a cryptocurrency.
I'm not particularly interested in the leaks. The game releases soon. These leaks do not hurt RockStar games, in fact I'd argue it helps them build more hype for the game.
I am however very interested in the legal things happening behind the scenes.
Last time I shared a snippet of a leak from when they were compromised, RockStar games asserted it was AI generated and was unironically willing to fight me to prove otherwise. It took them about three years for them to complain about it. I said, "wow you guys suck" and went on about my business (although with a lot more swear words).
This guy (or girl) needs to be extremely careful. RockStar games has immense power and money. They will play the long game and hunt this person down and beat them over the head with their sales figures.
tldr bad ideas for 200, Alex
And you only tipped the lady $5, you cheap little bitch. It's stolen money, how the fuck are you going to only tip $5 with stolen money? You're the worst thief oh my God bro
Читать полностью…
The ordinary human mind simply cannot comprehend the mind of a Hacker.
Every single second a hacker is awake they're thinking of hacking.
Today I hacked the bathroom. I pooped while showering and mud stomped the poopy down the drain.
I hacked time, the shower, and the drain