21–30 of 79 posts
Our discord got hit by the same shit, targeted at our game admins. We are the largest open source multiplayer video game on github, so (compromised) discord friends sending admins messages about "games they made" with exes in them was more effective then it should have been until news and announcements went out.
your admins are often underage and more liable to fall for these scams :)
Earlier quoted context omitted.
Is it really fair to call someone a "skript kiddie" if they wrote the malware themselves that became "the most common malware" ?
You beat me to this. This malware is better than some of the work my colleagues can do, and they're being paid a lot of money. Even though it has bad intentions, it's still good software. Credit where credit is due, I guess.
Off note: Is there any service where i can submit an executable (.exe) and it tells me if it contains malware?
I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online…
I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory.
Eventually I’d bore of it. Or have one of the chatbots tell them not to cross someone again. In your scenario I probably would have said it was the person he got the exploit from, instead of making a link to someone I care about.
I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online…
The most interesting results include apologies; one kid's father registered on the forum to post one for his son. Spamming a keylogger's logs with the physical address of its owner and "I know where you live" tends to cause them to repent in fear pretty quickly.
Off note: Is there any service where i can submit an executable (.exe) and it tells me if it contains malware?
Why did you redact the identity of the scammer? Please name and shame them! These people need to be called out and it seems like you’ve got irrefutable proof.
These posts show up on every thread like this and it always strikes me as off. It's not that I think the scammer here deserves protection, but the impulse to "name and shame" makes me very uncomfortable. I worry that supporting that impulse, even in cases like this, normalizes the use of internet lynch mobs to exact "justice" (for any subjective value of "justice" that can get enough steam).
> but at some point, I saw NodeRuntime. We can now say it is a NodeJS bundled executable! This is cute, but it's important to lose this naïveté/innocence if you want to analyze more sophisticated malware in the future.