Mod_honey is Back!

if u Know Commands already Good. Im Not Giving Out any Commands because of the abusers.... (Give Me Thanks Plz)


Some Commands Dont work They are. (hcbot,hdrag,dbuff)

What? Lies.

Why do I not believe this one bit?

Hmm.

Already tried it in game, most of the original commands were removed. I had my doubts before I touched that download button.

Quote:

Originally Posted by tylian1 Why do I not believe this one bit? Hmm.

Because it doesn't work? lol

I am warning you all not to download this. Me and a few people have been analyzing it and some of us think it is infected with a RAT. If you ran it, you might want to system restore.

Proof thus far:
Hashes are different
Commands don't work
File size is drastically different (141kb original to 700kb+ now)
Multiple sketchy commands in IDA show up such as monitor and key hooks.

Use at your own caution.

Update:
Upon further IDA analyzing, I found the following functions:

SetWindowsHookExA - Used to hook keyboard input and used in keyloggers

Following are used to analyze keys and keyboard input
GetKeyState
GetKeyboardState
GetKeyNameTextA
GetKeyboardLayout
GetKeyboardLayoutList

GetDesktopWindow - Gives a handle to the desktop window for other functions to use

It's a RAT. "Trojan" Has a keylogger and a Screen Logger.

What lib said. You don't want this... x.x. It will be hard to delete, you would have to rei nstall your entire OS. I say, don't use this

Why You Guys lying for?

z.z bye-bye windows.

... It's just [Only registered and activated users can see links. Click Here To Register...] renamed ..
It's not a freaking keylogger.

Don't go saying shit just to look cool.

"OH NO IT CALLS CALLNEXHOOKEX IT MUST ME A HARD TO REMOVE TROJAN EVERYONE REINSTALL WINDOWS!!!"

Next time look up the API it calls, it's part of the way Windows handles.. well.. windows.

[Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally Posted by Epvp_God It's a RAT. "Trojan" Has a keylogger and a Screen Logger.

Everything is not an RAT.

Quote:

Originally Posted by AutoLib I am warning you all not to download this. Me and a few people have been analyzing it and some of us think it is infected with a RAT. If you ran it, you might want to system restore. Proof thus far: Hashes are different Commands don't work File size is drastically different (141kb original to 700kb+ now) Multiple sketchy commands in IDA show up such as monitor and key hooks. Use at your own caution. Update: Upon further IDA analyzing, I found the following functions: SetWindowsHookExA - Used to hook keyboard input and used in keyloggers Following are used to analyze keys and keyboard input GetKeyState GetKeyboardState GetKeyNameTextA GetKeyboardLayout GetKeyboardLayoutList GetDesktopWindow - Gives a handle to the desktop window for other functions to use

Shes Says She Thinks That Means 50% not Sure.

Quote:

Originally Posted by tylian1 ... It's just [Only registered and activated users can see links. Click Here To Register...] renamed .. It's not a freaking keylogger. Don't go saying shit just to look cool. "OH NO IT CALLS CALLNEXHOOKEX IT MUST ME A HARD TO REMOVE TROJAN EVERYONE REINSTALL WINDOWS!!!" Next time look up the API it calls, it's part of the way Windows handles.. well.. windows.

SetWindowsHookEx function

Installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread.

Noted procedure:

WH_KEYBOARD_LL -13

Installs a hook procedure that monitors low-level keyboard input events. For more information, see the LowLevelKeyboardProc hook procedure.

[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]

CallNextHook was the least of my worries.

And besides that, explain the filesize, the lack of working functions, all the calls in my first post which I edited in, and the fact that a guy with 13 posts comes in here and just hands out a revamped mod for no reason. I might be paranoid, but this entire thing just looks completely wrong.

Edit: Sha1 hash matched. I'm wrong, but mod is still a fake. I'm highly paranoid since I worked with this stuff a long time ago. Won't edit it my posts though, that wouldd just be wrong. Hate people who cover up mistakes.

Anyway, your mod is not a RAT, but it is a fake so I still recommend not downloading it.

Look at the picture I posted. That explains it.

And SetWindowsHookEx is still used when it comes to how windows are handled.
So, If I go post a renamed mod_Alissa you'll call it a keylogger too? Cause it contains all the functions you mentioned, and more.

And to be totally honest, I just chose SetWindowsHookEx as a random function in IDA to complain about. Every function in that module is 100% legit and not used for Keylogging because it matches another module already posted here.

It's nice of you to warn people about it potentially being a keylogger, but there's also other stuff you should look for, like what the module actually does.

(Also my rant post above was mainly pointed at Epvp_god. Lol.)