[Release] MW3 +12 Singleplayer Trainer 1.9.453 by Geomatrical

[kokole]

This file is obviously infected, it had an exe inside the trainer exe which was executed after the trainer was executed, well anyway, it was added as resource. After extracting it, i've uploaded it to virustotal, and here are the results:

https://www.virustotal.com/file/6ca5bb29...358539306/

This is obviously a virus

Here the real "trainer" code (even thought there is no trainer code, i've only found that it has strings like firefox.exe in it, so it means that it steals information) DONT RUN IT (JUST DECOMPILE TO SEE BY YOURSELF)

Bad admins dont know how to analyze

Decompiled code: http://pastebin.com/UMmdrrfv (it has mysql stuff, and names of famous applications, see by yourself (interesting stuff))

More proof if you dont believe: the real name of the file is Crime.exe
Even more proof: This is not the file that was released at mpgh.net

[attachment=2471]

[99IRock]

Well, this file is online for a long time.
Fail, 185 people are infected.
Gj

[JariZ]

Could you please upload to anubis?
http://anubis.iseclab.org/

---

@kokole I know how, I just don't do it with every file that gets uploaded on here.

[kokole]

Could you please upload to anubis?
http://anubis.iseclab.org/

---

@kokole I know how, I just don't do it with every file that gets uploaded on here.

I bet you dont know how to extract a base64 added resource

btw what is that site lol

Result will be soon: http://anubis.iseclab.org/?action=result...7598edc780

[JariZ]

Oh kokole, yerr so pro, base64? I don't even know what that type of jargon means! Please enlighten me with your pro reversing skillz!
All bullshit aside, Removed it.

[JariZ]

Serves me right for trusting d0h again, lol...

---

This thread has been moved to the boards archive.
Contact a moderator in case you want to contribute to this thread.