mining League of Legends gift cards - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45) +--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447) +---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10) +---- Thread: mining League of Legends gift cards (/showthread.php?tid=6269932)

mining League of Legends gift cards - isafe09 - Apr 30, 2024 I present a checker for obtaining accounts on the site [deleted] in the archive there are complete instructions and the checker itself, good luck to everyone!!! link to archive [deleted] : MALWARE RE: mining League of Legends gift cards - xSe7eNx - Apr 30, 2024 Your link gets flagged as fishing and malware. Click at your own risk guys. I wouldn't. RE: mining League of Legends gift cards - Bastille - May 1, 2024 Result of the analysis : Stealer The link is a shorten URL that is related to a dropbox share. Retrieving the user account used for the share is not possible (or I'm not aware of any method for this). The link conains a ZIP archive with a single .exe file and a password to avoid being scanned, no procedures nor instructions as decribed in user's post. The file is identified as a Zennoposter.exe which is used to automate tasks and is flagged as malicious by many AV : https://www.virustotal.com/gui/file/5da377d76611a347da1d7e4ea5854f66b527b62e7fde3c9cf3e558e2cde2773d/relations https://zennolab.com/en/products/zennoposter/ When executed nothing visually happens, however it acts as a dropper for many files : Then it executes the main.bat file which then install a "Installer.exe" contained in the file_1.zip : "C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\AppData\Local\Temp\main.bat" C:\Windows\System32\attrib.exe attrib +H "Installer.exe" The Zennoposter.exe drops the "Google Chrome.lnk" file with a specific argument to connect to a proxy server : Target working directory > C:\Program Files\Google\Chrome\Application Target relative path > ..\..\..\Program Files\Google\Chrome\Application\chrome.exe Command line arguments > --proxy-server="217.XX.2.14:3333" file_2.zip seems to be dedicated to Linux OS. Bountree.exe doesn't seem to be executed.