هیچی برگر [﷼]

Okay, the silly shenanigans are over. I've repaired the damage done to my box. Overall this was a very whimsical Saturday. For people new to this account: Do I really not use a VM when doing malware analysis? Yes. I have a VM, but I don't know, I get lazy. I throw the malware in a random directory called like, "sgsdggggg" (I type random letters on the keyboard) and start poking it. Is this the first time I've detonated malware on my computer? No. I've detonated ransomware (REvil), some suspected state-sponsored malware from the Russian government (APT28), a crypto-miner, and now this. I also once messed up an rsync command and synced my tax documents to the staff at DEFCON. They expected malware, instead they got my birth certificate, my tax returns, and some other various documents. Do I panic? No, I deal with malware every single day. I collect malware, reverse engineer malware, write malware, etc. It is more annoying than actually concerning. The only time I was genuinely concerned was when I detonated REvil because I usually don't make backups (I'm not a coward). Basically, I'm a jackass who has gotten way too comfortable with malware and you should not do what I do.

"Why are you reverse engineering malware on your main PC? Why don't you use a VM? If you used a VM you wouldn't have infected yourself"

I guess the only thing more embarrassing than accidentally detonating an information stealer payload on your computer, while trying to remove the .exe file extension, is reviewing the payload closer and seeing it comes with cartoon pornography (I've censored it) and an image of a random woman

What do I do in this scenario? 1. Disconnect from internet 2. Sigh, take a huge rip off my vape 3. Blame the keyboard, not me. 4. Remove the .exe, any persistence mechanism on my machine 5. Angrily reset all my passwords 6. Refuse to use a VM in the future, I'm not a coward

shout out to salat stealer for having my banking information right now

> be me > "smelly is this malware?" > download file > file.exe > click to rename file > accidentally hit enter > detonate malware on personal pc chat, ive accidentally detonated an information stealer on my pc. brb

Image 1. Website with uBlock Origin on Image 2. Website with uBlock Origin off uBlock Origin IS PREVENTING US FROM FREE MALWARE

Dawg, I don't want to sound like a hater, but some of you malware nerds NEED to lock in and TRY HARDER. Someone found a malicious GitHub repo and DM'd it to me. It had piss poor obfuscation (if you even want to call it that, it's Base64 encoding) and the malware C2 is basically plain text. The delivery method is masquerading as an Adobe Acrobat plugin? My Brother in Christ, WHAT ARE YOU DOING The C2 is literally houndsregimeskid-dot-com Hounds Regime Skid? Hounds Regimes Kid? Also, for the record, if the people who wrote this malware are reading this: I'm not the guy spamming your Telegram C2. That is someone else. You left all of Telegram channel stuff plain text too