[NEW] MobLock Undedected

[chrisi2902]

#removed

[#DasBonobo]

vt?

[Exploid1st]

Und wo sollen in dem Archiv die root.epk und die root.eix sein?

[falaga]

geht der nur auf pservern oder auch auf DE?

[chrisi2902]

Kommt sofort.

Nur auf pserver getestet.

Sollte aber auch eigentlich auf DE gehen.

[falaga]

bei mir ist nur eine exe da. keine root dateien?

[chrisi2902]

Noe läuft alles über die .exe

[falaga]

ich finde nur die datei ''Moblock Metin2'' keine metin2client.exe oder andere dateien. kannst du das nochmal uploaden?

[chrisi2902]

Moblock Metin 2.exe verbindet sich zur metin2client.exe in deinen C:\Programme... solange du keinen speziellen Pfad hast.

[falaga]

ich hab das so verstanden:
1.downloaden.
2.die datei in den metin2 ordner tun.
3. metin2 von der gedownloadeten datei starten

ist das richtig? bei mir passiert nämlich nichts wenn ich das so mache

[chrisi2902]

Teilweise.

1. Downloaden
2. Rar entpacken
3. MobLock Metin 2.exe in dein metin 2 Ordner kopieren.
4. MobLock Metin 2.exe starten und warten bis Metin 2 startet.

Falls du W7 nutzt musst du die .exe als Admin ausführen.

[Slait]

VIRUS!!!

Analyse des Bots:
Ist ein in VB gecrypteter VIRUS!!!

1. Das .NET-Projekt heißt Crypted for BlackCrypter
2. Der Hack sendet verschiedene Daten ans Internet, das ist klar, welche das sind, kann ich nicht sagen, weil der Hack verschlüsselt ist.


Hier der Code(ist verschlüsselt darum nicht so verständlich):

 Spoiler

Friend Class  
' Methods
<MethodImpl(MethodImplOptions.NoInlining)> _
Friend Shared Function (ByVal  As Integer) As String
SyncLock  .
Dim str As String
Label_000D:
If Not  ..TryGetValue(, str) Then
Dim buffer As Byte()
Dim buffer4 As Byte()
Dim num9 As Integer
If ( . Is Nothing) Then
Dim name As AssemblyName
Dim executingAssembly As Assembly = Assembly.GetExecutingAssembly
Dim callingAssembly As Assembly = Assembly.GetCallingAssembly
 . = &H189282
Dim manifestResourceStream As Stream = executingAssembly.GetManifestResourceStream(ChrW(8 192) & ChrW(8199) & ChrW(8200) & ChrW(8197) & ChrW(8200) & ChrW(8198) & ChrW(8201) & ChrW(8198) & ChrW(8201) & ChrW(8201) & ChrW(8199) & ChrW(8203))
Dim skipFrames As Integer = 1
Dim trace As New StackTrace(skipFrames, False)
 . = ( . Xor (&H1946 Or skipFrames))
skipFrames -= 1
Dim frame As StackFrame = trace.GetFrame(skipFrames)
Dim base2 As MethodBase = IIf((frame Is Nothing), Nothing, frame.GetMethod)
 . = ( . Xor (skipFrames + &H80))
Dim type As Type = IIf((base2 Is Nothing), Nothing, base2.DeclaringType)
If (frame Is Nothing) Then
 . = ( . Xor &H358B3)
End If
Dim flag As Boolean = (type Is GetType(RuntimeMethodHandle))
 . = ( . Xor 160)
If Not flag Then
flag = (type Is Nothing)
If flag Then
 . = ( . Xor &H35893)
End If
End If
If (flag = (Not trace Is Nothing)) Then
 . = ( . Xor &H20)
End If
 . = ( . Xor (&H1966 Or (skipFrames + 1)))
 . = New BinaryReader(manifestResourceStream)
Dim num2 As Short = CShort(( ..ReadInt16 Xor CShort((Not -Not --Not Not -Not -1223397982 Xor -1223411648))))
If (num2 = 0) Then
 . = CShort(( ..ReadInt16 Xor CShort((-Not Not -Not -Not -Not -476557868 Xor &H1C67DA4C))))
Else
 . =  ..ReadBytes(num2)
End If
callingAssembly = executingAssembly
Try
name = callingAssembly.GetName
Catch obj1 As Object
name = New AssemblyName(callingAssembly.FullName)
End Try
 . = name.GetPublicKeyToken
If ((Not  . Is Nothing) AndAlso ( ..Length = 0)) Then
 . = Nothing
End If
 . = (( . And &HFFFFF72) Xor &H1A84)
End If
Dim num3 As Integer = ( Xor -1330832779)
 ..BaseStream.Position = num3
If (Not  . Is Nothing) Then
buffer =  .
Else
Dim num4 As Short
If ( . = -1) Then
num4 = CShort((( ..ReadInt16 Xor &H4173) Xor num3))
Else
num4 =  .
End If
If (num4 = 0) Then
buffer = Nothing
Else
buffer =  ..ReadBytes(num4)
End If
End If
Dim count As Integer = (( ..ReadInt32 Xor num3) Xor -Not -Not -Not Not -Not -521915164)
If (count = -2) Then
Dim buffer2 As Byte() =  ..ReadBytes(4)
 = &H1F1BCB1D
 = ((((buffer2(2) Or (buffer2(3) << &H10)) Or (buffer2(0) << 8)) Or (buffer2(1) << &H18)) Xor -)
goto Label_000D
End If
Dim flag2 As Boolean = ((count And -2147483648) <> 0)
Dim flag3 As Boolean = ((count And &H40000000) <> 0)
count = (count And &H3FFFFFFF)
Dim buffer3 As Byte() =  .(buffer,  ..ReadBytes(count))
If ((Not  . Is Nothing) <> ( . <> &H188886)) Then
Dim i As Integer
For i = 0 To count - 1
Dim num7 As Byte =  .((i And 7))
num7 = CByte(((num7 << 3) Or (num7 >> 5)))
buffer3(i) = CByte((buffer3(i) Xor num7))
Next i
End If
Dim num8 As Integer = ( . - 12)
If Not flag3 Then
buffer4 = buffer3
num9 = count
Else
num9 = (((buffer3(2) Or (buffer3(0) << &H10)) Or (buffer3(3) << 8)) Or (buffer3(1) << &H18))
buffer4 = New Byte(num9 - 1) {}
 .(buffer3, 4, buffer4)
End If
<MyGroupCollection("System.Web.Services.Protocols. SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", ""), EditorBrowsable(EditorBrowsableState.Never)> _
If (flag2 AndAlso (num8 = &H18887A)) Then
Dim chArray As Char() = New Char(num9 - 1) {}
Dim j As Integer
For j = 0 To num9 - 1
chArray(j) = DirectCast(buffer4(j), Char)
Next j
str = New String(chArray)
Else
str = Encoding.Unicode.GetString(buffer4, 0, buffer4.Length)
End If
num8 = (num8 + ((&H7F + (num8 And 3)) << 5))
If (num8 <> &H18989A) Then
str = ((( + count) Xor &HE4A78) Xor (num8 And &H50D)).ToString("X")
End If
str = String.Intern(str)
 ..Add(, str)
If ( ..Count = &H43) Then
 ..Close
 . = Nothing
 . = DirectCast( . = Nothing, Byte())
End If
End If
Return str
End SyncLock
End Function

Private Shared Function (ByVal  As Byte(), ByVal  As Integer, ByVal  As Byte()) As Integer
Dim num As Integer = 0
Dim num2 As Integer = 0
Dim num3 As Integer = &H80
Dim length As Integer = .Length
Do While (num < length)
num3 = (num3 << 1)
If (num3 = &H100) Then
num3 = 1
num2 = (++)
End If
If ((num2 And num3) = 0) Then
goto Label_008C
End If
Dim num5 As Integer = ((() >> 2) + 3)
Dim num6 As Integer = (((() << 8) Or (( + 1))) And &H3FF)
 = ( + 2)
Dim num7 As Integer = (num - num6)
If (num7 >= 0) Then
goto Label_0076
End If
Return -1
Label_0066:
(num++) = (num7++)
Label_0076:
If ((--num5 >= 0) AndAlso (num < length)) Then
goto Label_0066
End If
Continue Do
Label_008C:
(num++) = (++)
Loop
Return 0
End Function


' Fields
Private Shared ReadOnly  As Dictionary(Of Integer, String) = New Dictionary(Of Integer, String)(&H43)
Private Shared  As BinaryReader
Private Shared  As Byte()
Private Shared  As Integer
Private Shared  As Short
Private Shared  As Byte()
End Class

NICHT DOWNLOADEN!!!

[eliano]

Slait du bist besser als ein VT... mach bitte weiter so mit den Analysen der Hacks

[YellowBear007]

Ich will jetzt nicht spammen, aber gibts hier eigentlich nicht sowas wie Moderatoren, die die Links mal rausnehmen?^^ Ich steh nicht soo auf Viren.

[Daaaft]

ich frag mich wirklich, warum ein mod das hier nicht löscht ?!