هیچی برگر [﷼]

Better hold those farts in buddy, the government is after you. That gas station burrito you purchased? The gas station clerk? He's in the CIA. It's Operation Ass Blast

If you're at DEFCON this year, there will be vx-underground wrist bands distributed for free. Yes, this is an ADVERTISEMENT. Oh, and by the way, these wrist bands were created by the CIA, FBI, NSA and, IRS. They contain a tracking beacon that activates when you fart

Kathy Hochul and Letitia James have the combined IQ of a fine plate of spaghetti with some freshly made meatballs. Soon New York state will implement the SAFE for Kids Act. Basically, you need to verify your identity to Instagram, TikTok, or any social media platform which is algorithmic (???). They're doing this to protect children. They ARE NOT doing it to allow social media companies to aggregate your data and sell it to third parties (or worse). You trust Instagram, TikTok, Facebook, X, SnapChat, YouTube, Reddit, LinkedIn, and Pinterest with your driver's license, right? Because to even view these websites you need to give them your driver's license. It is to protect children from algorithms. Just give them your driver's license, bro. They said they'll delete it and they said they won't track you. Why would multi-billion dollar companies do something potentially unethical? You trust them, right? It's to protect kids, bro, you care about kids, right? It's a well established fact parents are incapable of parenting and we must make tech companies and the government parent our children. Right?

> download weird .exe > accidentally run it > disappears in the void

> wake up > take a shit > get out of bed > remember colleagues hardcore malware thingie > download > look inside > confused.mp4 > regular .exe, but has .exe inside of it > bonk with stick > .exe inside of it is the same .exe > .exe has itself inside of itself > only small difference > cant tell difference > confusion_intensifies.mp5 > has anti-vm code > cant get to work in emulation > written using delphi > delphi tform GUI thingy > weird af de-compilation > 16,000 functions present > most do basic stuff, like add or subtract > staticly links a bunch of random libraries > LOLWTF WHO WROTE THIS > bonk with really big stick > eventually find some good goop > new .exe randomly appears in-memory > ??? > grab from memory > c++ .exe, staticly linked > 500 functions > heavily obfuscated > has anti-code tampering in place > ??? > this in-memory .exe references 1st .exe goop > ask colleague about goop > "We discovered this Threat Actor likely created their own custom .exe encryptor and decryptor" I've been bonking this malware with a stick for over an hour, I think, maybe two hours. I've been able to grab an in-memory mapped PE file which the original .exe loads into memory. However, I am unable to determine precisely where this PE file is mapped exactly because it's a Delphi TForm application, its statically linked, and is intentionally obfuscated. This secondary .exe loaded into memory has tamper protection, patching it to force itself to give me more malware won't be easy. This binary also has anti-VM features as well, I think from calculating disk space. However, I can't tell right now either, but this is what it appears like based on the API it imports. 1. Delphi TForm application 2. Does stuff, lots of junk 3. Maps secondary PE into memory (somehow) 4. Secondary PE does recon to assess the machine 5. ??? Somewhere in the midst of this, this binary is going to make an external call, somewhere, somehow, but it's proven to be difficult due to how obfuscated this code is, coupled with the custom PE cryptor, decoy data present, ... and everything else. Initially I was under the impression one of the obvious .EXEs I saw was the actual secondary payload, but it's not (I think?), it appears to be a decoy (I think). I don't know who wrote this, but this is probably one of the most sophisticated malware payloads I've seen in recent time. It has successfully evaded my VM, RecordedFuture Triage, VirusTotal VM, and AnyRun I still don't know what this malware is trying to do.