Mod_honey is Back!

[00slayerzone101]

if u Know Commands already Good. Im Not Giving Out any Commands because of the abusers.... (Give Me Thanks Plz)


Some Commands Dont work They are. (hcbot,hdrag,dbuff)

[Thrillerz]

What? Lies.

[tylian1]

Why do I not believe this one bit?

Hmm.

[Thrillerz]

Already tried it in game, most of the original commands were removed. I had my doubts before I touched that download button.

[harrybong1]

Originally Posted by tylian1

Why do I not believe this one bit?

Hmm.

Because it doesn't work? lol

[AutoLib]

I am warning you all not to download this. Me and a few people have been analyzing it and some of us think it is infected with a RAT. If you ran it, you might want to system restore.

Proof thus far:
Hashes are different
Commands don't work
File size is drastically different (141kb original to 700kb+ now)
Multiple sketchy commands in IDA show up such as monitor and key hooks.

Use at your own caution.

Update:
Upon further IDA analyzing, I found the following functions:

SetWindowsHookExA - Used to hook keyboard input and used in keyloggers

Following are used to analyze keys and keyboard input
GetKeyState
GetKeyboardState
GetKeyNameTextA
GetKeyboardLayout
GetKeyboardLayoutList

GetDesktopWindow - Gives a handle to the desktop window for other functions to use

[Epvp_God]

It's a RAT. "Trojan" Has a keylogger and a Screen Logger.

[Alwaho]

What lib said. You don't want this... x.x. It will be hard to delete, you would have to rei nstall your entire OS. I say, don't use this

[00slayerzone101]

Why You Guys lying for?

[harrybong1]

z.z bye-bye windows.

[tylian1]

... It's just renamed ..
It's not a freaking keylogger.

Don't go saying **** just to look cool.

"OH NO IT CALLS CALLNEXHOOKEX IT MUST ME A HARD TO REMOVE TROJAN EVERYONE REINSTALL WINDOWS!!!"

Next time look up the API it calls, it's part of the way Windows handles.. well.. windows.

[shadowsforu]

Originally Posted by Epvp_God

It's a RAT. "Trojan" Has a keylogger and a Screen Logger.

Everything is not an RAT.

[00slayerzone101]

Originally Posted by AutoLib

I am warning you all not to download this. Me and a few people have been analyzing it and some of us think it is infected with a RAT. If you ran it, you might want to system restore.

Proof thus far:
Hashes are different
Commands don't work
File size is drastically different (141kb original to 700kb+ now)
Multiple sketchy commands in IDA show up such as monitor and key hooks.

Use at your own caution.

Update:
Upon further IDA analyzing, I found the following functions:

SetWindowsHookExA - Used to hook keyboard input and used in keyloggers

Following are used to analyze keys and keyboard input
GetKeyState
GetKeyboardState
GetKeyNameTextA
GetKeyboardLayout
GetKeyboardLayoutList

GetDesktopWindow - Gives a handle to the desktop window for other functions to use

Shes Says She Thinks That Means 50% not Sure.

[AutoLib]

Originally Posted by tylian1

... It's just renamed ..
It's not a freaking keylogger.

Don't go saying shit just to look cool.

"OH NO IT CALLS CALLNEXHOOKEX IT MUST ME A HARD TO REMOVE TROJAN EVERYONE REINSTALL WINDOWS!!!"

Next time look up the API it calls, it's part of the way Windows handles.. well.. windows.

SetWindowsHookEx function

Installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread.

Noted procedure:

WH_KEYBOARD_LL -13

Installs a hook procedure that monitors low-level keyboard input events. For more information, see the LowLevelKeyboardProc hook procedure.




CallNextHook was the least of my worries.

And besides that, explain the filesize, the lack of working functions, all the calls in my first post which I edited in, and the fact that a guy with 13 posts comes in here and just hands out a revamped mod for no reason. I might be paranoid, but this entire thing just looks completely wrong.

Edit: Sha1 hash matched. I'm wrong, but mod is still a fake. I'm highly paranoid since I worked with this stuff a long time ago. Won't edit it my posts though, that wouldd just be wrong. Hate people who cover up mistakes.

Anyway, your mod is not a RAT, but it is a fake so I still recommend not downloading it.

[tylian1]

Look at the picture I posted. That explains it.

And SetWindowsHookEx is still used when it comes to how windows are handled.
So, If I go post a renamed mod_Alissa you'll call it a keylogger too? Cause it contains all the functions you mentioned, and more.

And to be totally honest, I just chose SetWindowsHookEx as a random function in IDA to complain about. Every function in that module is 100% legit and not used for Keylogging because it matches another module already posted here.

It's nice of you to warn people about it potentially being a keylogger, but there's also other stuff you should look for, like what the module actually does.

(Also my rant post above was mainly pointed at Epvp_god. Lol.)