WingNews logo WingNews GitHub [2]
top | item 35308672

Dismantling a Crappy Malware Operation

102 points| MrBruh | 3 years ago |mrbruh.com | reply

32 comments

order
[+] nightpool|3 years ago|reply
You mentioned they were using Dropbox to distribute the malware—did you follow up with them? What about the university?
[+] jallasprit|3 years ago|reply
I am surprised and also not surprised that they had approximately 0 OPSEC related to their hustle.
[+] MrBruh|3 years ago|reply
Yeah for sure, also something interesting I found is that one of the guys is a teacher and the other is a student at the same university in Vietnam.
[+] nubinetwork|3 years ago|reply
Nice, but I have to wonder why Github acted on this so fast... I reported one account spreading Python based malware 2 months ago and the account was still there up until last week.
[+] quacksilver|3 years ago|reply
Great work! - though the redaction of names / university is very leaky if that is a concern (particularly if you have some knowledge of common Vietnamese naming patterns)
[+] Gordonjcp|3 years ago|reply
Not sure why you'd think that would be a problem.

I wouldn't have redacted any names.

[+] m3047|3 years ago|reply
Use something suffering from acropalypse and claim plausible deniability.
[+] atsushin|3 years ago|reply
Really fun analysis, wasn't aware that Python scripts could be packaged into an executable until now, learned something new. Thanks for sharing!
[+] anonym29|3 years ago|reply
PyInstaller is only one of several ways to do this. It bundles the Python interpreter, script, and dependencies together, drops them in a temp directory, and then starts the script using that interpreter, but that isn't the only technique.

There are also source-to-source translation tools like Nuitka that translate Python to C, which can then be compiled to a PE. Nuitka is less reliable than PyInstaller, but harder to reverse engineer for predictable reasons.

[+] voiper1|3 years ago|reply
Incredible detective work!

Why would discord let anyone delete a webhook?

I'd think anyone can post to the webhook, but you need to be authorized to modify it.

[+] charcircuit|3 years ago|reply
>Why would discord let anyone delete a webhook?

Why wouldn't they? Blocking it just leads to more abuse of Discord and its users.

[+] juunpp|3 years ago|reply
Did they have "malware development and distribution" on their resume?
[+] charcircuit|3 years ago|reply
As mentioned in the article anyone can delete a malicious webhook.

https://webhooks.scam.gay/ is a site that makes it easy to do for people who want a tool do it for them.