[miso]

@mothered @Oni @bamboucha

The .zip archive contains 15 scans of apps he shared

Intro.txt (without the ascii art)

Code:

Hello fellow sinister.ly user & welcome to the first "MalBusted" report, this type of "content" is about hunting down malware-sharers on sinister.ly in the hopes that the person doesn't publish any more content that can affect viewer's computers. Other memebers can use the term "MalBusted" for their own reports, i don't care if you do, but please remember the meaning of it & what it is susposed to bring to the community (which is to show how malwares can be decompiled, how apps can bring malwares & just to make the place a better place) This report is about "bamboucha" & how all of the content he/she shared are considered as malicious applications. ### Please remember ### The point of this huge report is not to harass or insult bamboucha, it is made to be a lesson for him, i am not responsible if you decide to do anything. Do i want to get this person banned, yes, however, if he understand his actions & doesn't do it anymore, i'd be more than happy for him to comeback, but i will still watch his content closely. ### Strategy ### bamboucha (over the time) had different techniques, but they all start the same, via an installer. This installer does indeed have the actual application, however, you will need to "install it" to use it. The installer already has malicious code running, whether it is build it or in a seperate file, usually CMD Scripts. The scripts can differ from locking the user down with a new username & password, making them unable to use their windows account or can just download a malicious application. There is no editions to the applications, but running it in a virtual machine or sandbox is recommended. The installer can also contain another application "installed" aswell as the actual application the user wanted, those normally download other malicious application via powershell. He also spoofs virus scans since the installer contains malicious code, they get easily flagged: (His scan) MetaDefender [4/40]: https://metadefender.opswat.com/results/file/bzIwMDQyMEUxS1o3Q1Z5dTc3ZzBkNGYtb1dF/regular/overview?lang=en (Actual file) Virustotal Scan [40/69]: https://www.virustotal.com/gui/file/ede533dc5509731d1abcd19c84d7a5754c10ed47d2ca5929a7c17bfd9b9d35b0/detection (file used: Instagram.com.exe, from this thread: https://sinister.ly/showthread.php?tid=119936) ### The vulnerability of his "Strategy" ### Most of his installers use "Smart Install Maker v5.04", however, there is an unpacked for it, extracting the files from the installer without having to deal with the installer malicious code running. Other installers can also be unpacked using the "Open as archive (#)" feature present in 7z, also allowing the extraction of its files without directly running the installer. ### Tools used: - dnSpy (x64) v6.1.5 - Sandboxie - sim_unpacker - NoFuserEx - de4dot - de4dot-cex - EXE (by MiTeC) - HEXEdit (by MiTeC) - UniExtract - Exe2Aut - DIE (Detect It Easy) 2.05 - ExeInfoPe - Net Generic Unpacker - UpxUnpacker - Process Hacker - CudaText - 7zip - Resource Hacker - chara.GetFileType ### Thanks to: - Azrec: coded "chara.GetFileType" & tested it on a few reports - All of the tools creators :)

Download (mega.nz)
There is only text files in the .zip archive

[mothered]

The .zip archive contains 15 scans of apps he shared

Precisely what apps Is this referring to?

[miso]

The .zip archive contains 15 scans of apps he shared

Precisely what apps Is this referring to?

The names of the files have the thread link & their name is the thread name

[Defeat]

The .zip archive contains 15 scans of apps he shared

Precisely what apps Is this referring to?

The names of the files have the thread link & their name is the thread name

Interesting.

[mothered]

The .zip archive contains 15 scans of apps he shared

Precisely what apps Is this referring to?

The names of the files have the thread link & their name is the thread name

Are you referring to the text files In the "reports" folder?

[miso]

Precisely what apps Is this referring to?

The names of the files have the thread link & their name is the thread name

Are you referring to the text files In the "reports" folder?

yes indeed

[mothered]

The names of the files have the thread link & their name is the thread name

Are you referring to the text files In the "reports" folder?

yes indeed

Thanks.

It'll take quite a while to sift through the lot and most Importantly, accurately Identify Its content.