Apr 6, 2023 12:47 PM
(This post was last modified: Sep 5, 2024 09:55 PM by Bastille.)
So I've just joined back up on here and thought id start off by dumping this collection on here
Enjoy
🙂
Reviewed by staff : Infected
All these tools contain the same malware, even programs that you can find for free online such as ProtonVPN, OpenVPN, NMAP for Windows, ... Few examples :
https://www.virustotal.com/gui/file/49fa.../detection
https://www.virustotal.com/gui/file/cc10.../detection
https://www.virustotal.com/gui/file/0864.../detection
https://www.virustotal.com/gui/file/2856.../detection
https://www.virustotal.com/gui/file/d719.../detection
https://www.virustotal.com/gui/file/d298...cca3c43a50
![[Image: sfHZkse.png]](https://i.imgur.com/sfHZkse.png)
The file "Launcher.exe" is present in every folder : https://www.virustotal.com/gui/file/0d87...2/behavior
![[Image: 74kWTes.png]](https://i.imgur.com/74kWTes.png)
![[Image: IkFJVGK.png]](https://i.imgur.com/IkFJVGK.png)
When the main .exe is executed, it automatically execute "Launcher.exe" present in a subfolder :
![[Image: v0fDFfu.png]](https://i.imgur.com/v0fDFfu.png)
Launcher.exe > Adds exclusion path to Windows Defender > then it executes :
I've found few IP addresses but it seems that his activity is not running anymore :
![[Image: Y21tPWf.png]](https://i.imgur.com/Y21tPWf.png)
The following IP address has been reported many times : https://www.abuseipdb.com/check/13.107.4.50 > last report 2024-04-24
The following IP address has been reported many times : https://www.abuseipdb.com/check/192.229.211.108 > last report 2024-08-05
Enjoy
🙂
Reviewed by staff : Infected
All these tools contain the same malware, even programs that you can find for free online such as ProtonVPN, OpenVPN, NMAP for Windows, ... Few examples :
https://www.virustotal.com/gui/file/49fa.../detection
https://www.virustotal.com/gui/file/cc10.../detection
https://www.virustotal.com/gui/file/0864.../detection
https://www.virustotal.com/gui/file/2856.../detection
https://www.virustotal.com/gui/file/d719.../detection
https://www.virustotal.com/gui/file/d298...cca3c43a50
![[Image: sfHZkse.png]](https://i.imgur.com/sfHZkse.png)
The file "Launcher.exe" is present in every folder : https://www.virustotal.com/gui/file/0d87...2/behavior
![[Image: 74kWTes.png]](https://i.imgur.com/74kWTes.png)
![[Image: IkFJVGK.png]](https://i.imgur.com/IkFJVGK.png)
When the main .exe is executed, it automatically execute "Launcher.exe" present in a subfolder :
![[Image: v0fDFfu.png]](https://i.imgur.com/v0fDFfu.png)
Launcher.exe > Adds exclusion path to Windows Defender > then it executes :
- Windows Services.exe > https://www.virustotal.com/gui/file/2c33.../detection
- Secure System Shell.exe > https://www.virustotal.com/gui/file/f1ab...9/behavior
- Runtime Explorer.exe > https://www.virustotal.com/gui/file/baca...1/behavior
I've found few IP addresses but it seems that his activity is not running anymore :
![[Image: Y21tPWf.png]](https://i.imgur.com/Y21tPWf.png)
The following IP address has been reported many times : https://www.abuseipdb.com/check/13.107.4.50 > last report 2024-04-24
The following IP address has been reported many times : https://www.abuseipdb.com/check/192.229.211.108 > last report 2024-08-05

