Polyspora wrote:

This is the most incompetent “hacker” I clicked his link 2 times, and I still have my discord intact lol


Os: you guys know if it does anything else besides the discord thing?

Stomiks wrote:

Polyspora wrote:

This is the most incompetent “hacker” I clicked his link 2 times, and I still have my discord intact lol


Os: you guys know if it does anything else besides the discord thing?

why the hell would you do that lol

If it's smart enough, then it could probably get access to accounts outside of discord.

Polyspora wrote:

Stomiks wrote:

Polyspora wrote:

This is the most incompetent “hacker” I clicked his link 2 times, and I still have my discord intact lol


Os: you guys know if it does anything else besides the discord thing?

why the hell would you do that lol

If it's smart enough, then it could probably get access to accounts outside of discord.

O trusted abraker and wanted to help him “fix” it. The thing is, I still have access to my discord and I don’t know how to proceed

HoosierTransfer wrote:

wait if his discord got hacked than why ist he a gmt anymore

also i want gmt

Joon Yorigami wrote:

I will be gmt

z0z wrote:

in the meanwhile, who would cover for the gmt?

synthwavesquid wrote:

Patatitta wrote:

wait wtf happened

z0z wrote:

wait what

community/forums/topics/1628821?n=1

i'll just direct you guys to this thread for context ^

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

Stomiks wrote:

I guess this event was short-lived.

eblf2013 wrote:

Stomiks wrote:

I guess this event was short-lived.

What do you mean the OT!neus server is screwed.

Cerno wrote:

eblf2013 wrote:

Stomiks wrote:

I guess this event was short-lived.

What do you mean the OT!neus server is screwed.

checked the audit log and ippe, wither and angiee got banned. wtf happened in the server when it first went down, i was sleepin

ShinRun wrote:

Cerno wrote:

eblf2013 wrote:

Stomiks wrote:

I guess this event was short-lived.

What do you mean the OT!neus server is screwed.

checked the audit log and ippe, wither and angiee got banned. wtf happened in the server when it first went down, i was sleepin

Wither did some naughty stuff and angie got banned probably for exposing the hacker

eblf2013 wrote:

Stomiks wrote:

I guess this event was short-lived.

What do you mean the OT!neus server is screwed.

eblf2013 wrote:

ShinRun wrote:

Cerno wrote:

eblf2013 wrote:

Stomiks wrote:

I guess this event was short-lived.

What do you mean the OT!neus server is screwed.

checked the audit log and ippe, wither and angiee got banned. wtf happened in the server when it first went down, i was sleepin

Wither did some naughty stuff and angie got banned probably for exposing the hacker

TIL Angie is Abraker's sister.

So, when abraker got hacked and lost access to his account, he tried messaging through Angie. The message was deleted by the fake abraker.

Karmine wrote:

Time to make manish GMT to save OT

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

Cerno wrote:

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

in this new era of ot we’ll be having 2 overlords

Puck- wrote:

Cerno wrote:

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

in this new era of ot we’ll be having 2 overlords

Sies & Me.

Cerno wrote:

Puck- wrote:

Cerno wrote:

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

in this new era of ot we’ll be having 2 overlords

Sies & Me.

u are quite possibly the least qualified person to be in charge of a community

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

z0z wrote:

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

is this a server attack

eblf2013 wrote:

In case you ask, we're talking through MAL.

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

Manishh wrote:

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

that was my plan from the start, revenge

McEndu wrote:

Various things I can confirm about the hack:

1. The program uses JavaScript heavily; its icon even gives it away as a Node.js bundle.
2. It gets on to mainly your Discord. People have also confirmed that osu! credentials are stolen.

I am still trying to identify the damage done to my side. Also, the script kiddie hosted the trojan on itch.io (deadtriggerofficial.itch.io), so try to send itch.io a contact email if you can.

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

ClevelandsMyBro wrote:

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

just saying, us at NEOS are getting a bit lonely ngl.

ClevelandsMyBro wrote:

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

just saying, us at NEOS are getting a bit lonely ngl.

Karmine wrote:

ClevelandsMyBro wrote:

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

just saying, us at NEOS are getting a bit lonely ngl.

Gotta find the link, it's like a puzzle game

Manishh wrote:

ok i was wondering, how abraker gonna recover his account

HoosierTransfer wrote:

Manishh wrote:

ok i was wondering, how abraker gonna recover his account

get a new email and contact ppy

Manishh wrote:

HoosierTransfer wrote:

Manishh wrote:

ok i was wondering, how abraker gonna recover his account

get a new email and contact ppy

like forget the previous account for forever?

KatouMegumi wrote:

itt: discord bad

eblf2013 wrote:

Update

Death wrote:

I feel like this should be common sense, but I guess it's not. Don't provide links to malware here. If people are interested, use PMs or preferably a different platform please.

1. The EXE file has a Node.js icon. The version of Node.js is also written in the resources section; I can only remember the major version number 14.
2. The program is ran as a command line app. Once it is run, it opens a terminal window, minimizes it, kills your browser and Discord, then reopens Discord. The reopened Discord appears to work normally, but I believe that they injected their code in it.
3. The terminal window did not close while the malware is running. My theory for the reason behind is that the terminal window, conhost.exe, is the trojan's parent process, and closing the terminal window kills the trojan. I can't preclude the possibility of installing an operating system service, though.
4. Opening the file using a plain text editor, you can find long pieces of plain JavaScript embedded in the middle and at the end.
5. You can see the variables PAYLOAD_POSITION and PAYLOAD_SIZE in the script at the end. Doing a Ctrl+F search and you have something more interesting...In the JavaScript data in the middle of everything, the exact same variables are assigned a number.
6. Combined with variable names, we have located the actual package that does the dirty work. An invocation of the Unix command dd, and the package is extracted.
7. The trailing script should not be discarded yet...The package itself does not contain any info on how to extract from them, and it is in the trailing script. The data is also stored in a very easy to access location -- at the very end of the script. These data gives away the location of each file in the package, and (deduced by analysis of the script) also gives away the compression algorithm used for each file.
8. While the package contains many files, it turns out that many of them are dependencies, which I promptly ignored. (Should the actual script portion consist of more files, I would write a script to extract the files.) I used dd to manually extract the core script file, a dependency listing, and a JSON containing a key to somewhere.
9. Unfortunately the script is compiled to V8 bytecode, which impeded further analysis as I can't find a good decompiler. I suspect however that it is a GitHub-sourced stealer with minimal modifications.

McEndu wrote:

Let me summarize the current findings:

1. The EXE file has a Node.js icon. The version of Node.js is also written in the resources section; I can only remember the major version number 14.
2. Opening the file using a plain text editor, you can find long pieces of plain JavaScript embedded in the middle and at the end.
3. You can see the variables PAYLOAD_POSITION and PAYLOAD_SIZE in the script at the end. Doing a Ctrl+F search and you have something more interesting...In the JavaScript data in the middle of everything, the exact same variables are assigned a number.
4. Combined with variable names, we have located the actual package that does the dirty work. An invocation of the Unix command dd, and the package is extracted.
5. The trailing script should not be discarded yet...The package itself does not contain any info on how to extract from them, and it is in the trailing script. The data is also stored in a very easy to access location -- at the very end of the script. These data gives away the location of each file in the package, and (deduced by analysis of the script) also gives away the compression algorithm used for each file.
6. While the package contains many files, it turns out that many of them are dependencies, which I promptly ignored. (Should the actual script portion consist of more files, I would write a script to extract the files.) I used dd to manually extract the core script file, a dependency listing, and a JSON containing a key to somewhere.
7. Unfortunately the script is compiled to V8 bytecode, which impeded further analysis as I can't find a good decompiler. I suspect however that it is a GitHub-sourced stealer with minimal modifications.

I am going to put it in a virtual machine some time later.

eblf2013 wrote:

Update

Cerno wrote:

my dumbass cant comprihend whatever tf yall are on about but aight

Aireunaeus wrote:

is that me or is the ot-chat back again?

Aireunaeus wrote:

is that me or is the ot-chat back again?

Clicky- wrote:

i have a theory that McEndu is probably the hacker

ColdTooth wrote:

Clicky- wrote:

i have a theory that McEndu is probably the hacker

I have a completely different theory that may blow everyone's minds here.

ColdTooth wrote:

Clicky- wrote:

i have a theory that McEndu is probably the hacker

I have a completely different theory that may blow everyone's minds here.

1. The malware process calls itself Node.js JavaScript Runtime.
2. The malware requires conhost to run as intended. If the new Windows Terminal is used as the default console program (in place of conhost), the malware would only minimize and fail to go to the background.
3. Once it goes into the background, it crashes and reopens Discord. After reopening Discord (now with malicious code injected), the Node.js process exits.
4. Until you terminate Discord, everything works fine...but on the next time you open it, any trace of you having logged in would be gone! The QR code also takes infinitely long to load -- acceptable in the communist internet (of China), but definitely weird in America and Europe.
5. Task Manager reveals no new startups other than the hijacked Discord.
6. You can no longer trust the Discord on the machine. For your safety, reboot, delete the entire Discord folder, then download a fresh installer.
7. One last thing...Quake II ran smoothly on the virtual machine.

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

Manishh wrote:

good person, if someone will say try my game I will try it

1. AppX Deployment Service
2. Base Filtering Engine
3. Client License Service (ClipSVC)
4. CoreMessaging
5. Security Accounts Manager

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

McEndu wrote:

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

I think abraker actually got the thing from an hijacked account of someone close to him
and the chain goes on terminating at the actual stupid guy making the blunder

ColdTooth wrote:

McEndu wrote:

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

I think abraker actually got the thing from an hijacked account of someone close to him
and the chain goes on terminating at the actual stupid guy making the blunder

Still a massive blunder imo, shouldn't even trust close ones or yourself, let alone have them ask the whole ordeal of them hijacking your account w/ a "pls test me game".

How do people fall for that still, really baffles me.

McEndu wrote:

Set my virtual machine up, would destroy it now

(Also want to play Quake II in it, because VirtualBox has some neat 3d acceleration in place)

Also interested in how well can the script kiddie speak chinese (please send him 我想聴你説一句中文，可不可以喵？)

McEndu wrote:

Test using a virtualized Windows 10:

1. The malware requires conhost to run as intended. If the new Windows Terminal is used as the default console program (in place of conhost), the malware would only minimize and fail to go to the background.