 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Geri
Moderator
![]() Reputation: 111
Joined: 05 Feb 2010
Posts: 5627
|
 Posted: Fri Jul 18, 2014 9:59 am Post subject: Warning about malwares in recent trainers |
 |
|
Hi,
We had a guy who was trying to spread malware on this forum. His forum account on this forum was FLING Releases. If you have downloaded his Borderlands 2 trainer, then delete it asap and also make sure to find and delete
- WMIService.exe
- pthreadGC2.dll
- wimihost.exe
- u-host.exe
The files were packed along with LEGIT and WORKING trainers from FLING.
It's unlikely that you have the file, because it was removed fairly quickly and he is already banned, but if someone saw it and run the exe, then make sure to look for those files that I have mentioned above. They will be in the Users folder (probably).
The infected trainers are having a txt file that comes with a text
Downloaded From: TrainersMasterdot tk
Uploaded by: T-Master.
Status: Verified.
If you have this, it's truly verified that you have malware on your computer. Make sure to avoid any trainer that is related to that site, because the sole purpose of the website is to spread malware.
This does NOT mean that all trainers from FLING are having malwares, it means that someone has modified some of the FLING trainers and packed malware next to it.
(And thanks for atom0s who has analyzed the file in details.)
_________________
|
|
| Back to top |
|
 |
Geri
Moderator
![]() Reputation: 111
Joined: 05 Feb 2010
Posts: 5627
|
| Posted: Sat Jul 19, 2014 10:36 pm Post subject: |
|
|
Here is an update.
It has turned out that the guy who is spreading this malware has also repacked h4x0r's trainer on another forum and he has used the name Mr.ExA-MaN.
Be aware that all trainers that are connected to
Trainersmaster
and
exa-man
are malwares.
(Thanks to STN for the additional info.)
_________________
|
|
| Back to top |
|
|
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Sun Jul 20, 2014 2:44 am Post subject: |
|
|
Information regarding these trainers:
Each trainer is repacked into an extractor that dumps files from the executable's resources. (The files are managed, written in VB.NET.)
Each trainer dumps two files to the AppData folder:
- mT
- mM
mT is the actual original trainer file that appears to be unmodified and fine.
mM is the infected trojan / downloader that is used to infect peoples machines. (The actual file name is MemoryStr.exe upon extraction.)
MemoryStr.exe - mM
- File is an executable.
- File is managed, written in VB.NET
- File is obfuscated with CryptoObfuscator.
This file can be deobfuscated with de4dot (https://github.com/0xd4d/de4dot) to dissect the important data from it.
Once the file is deobfuscated, we can investigate the file further with ILSpy (http://ilspy.net/).
The file does the following upon being loaded:
- Connects to the site trainersmasterdot (dot) tk/api/ and downloads a base64 string.
- Decodes the base64 string and does some minor DES decryption using the key: DerLo (uses MD5 of this string)
- Decoded string is the address to download another file.
- The decoded file being downloaded is found at: exa-main (dot) site90 (dot) net/MyDB.db
- File is downloaded and stored where the original trainer was launched. This file is saved as WMIClient.exe
- File is then executed immediately after being launched.
WMIClient.exe / MyDB.db
- File is an executable.
- File is managed, written in VB.NET
- File is obfuscated with CryptoObfuscator.
This file contains 3 binaries inside its resources. (m32bit, m64bit, mDll)
Once this file is ran it attempts to download more junk from the internet. (I did not bother to analyze further for this file after the below.)
The file attempts to locate various registry information about your system to locate and determine any anti-virus running on your system.
It cans for the following (truncated from the full list since it looks for a lot of them):
- NOD32, AVG, Avira, AhnLab-v3, BitDefender, ByteHEro, ClamAV, F-Prot, F-Secure, GData, and much more.
It adds itself to your systems registry to ensure that it runs on startup of your machine.
It creates several more executables/binaries onto the disk:
- WMIService.exe
- pthreadGC2.dll
- wimihost.exe
- u-host.exe
It attempts to access info on your processor via:
- HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\ProcessorNameString
It attempts to access more downloadable files and junk:
| Code: | public const string string_1 = "http://exa-techo (dot) faster-host (dot) cz (dot) cc/API/";
public static string string_2 = "stratum+tcp://pool (dot) xhash (dot)net:3355";
public static string string_3 = "X11"; |
It attempts to upload your system information to:
| Code: | | http://exa-techo (dot) faster-host (dot) cz (dot) cc/API/ |
The data it uploads about your system includes:
- Your personal id.
- Your version of his software.
- Your processor type / info.
- Your system type (32bit / 64bit)
- Your antivirus type / software if any.
The files that this extracts are not managed. They are a console based bitcoin miner.
Conclusion of Analysis
These trainers are repacked from the original source and are intended to infect peoples machines to effectively mine bitcoins on your hardware in stealth without you knowing.
Help I Think I'm Infected!
To start, be sure you are infected. Look for the following files on your system:
%AppData%\Trainer.exe
%AppData%\MemoryStr.exe
%AppData%\WMIClient.exe
You can also look into your system registry and check your current startup programs to see if any unwanted programs are listed.
If you are infected, be sure to remove any of these applications from your auto-run on startup. You can edit your startup programs by running:
msconfig.exe
Once you load msconfig.exe, go to the 'Startup' tab. Sort the list by the Command column. Look for any applications that are launching from your personal AppData folder.
If you find any remove them.
Next, open Task Manager and locate any files executing from your AppData folder as well and stop them.
Afterward, navigate to your AppData folder in Explorer and delete any of the above files. Technically there should be NO binary files (.dll or .exe) directly inside your AppData folder. If there are, you should delete them all. Files should be placed into a folder associated with a software or software developer. Typically files dropped into this folder that are not bundled into a parent folder can be deemed malicious.
If you continue to have issues or fear you are still infected, I would suggest getting a better virus scanner than what you have.
Be sure your scanner definitions are fully up to date and actively monitoring your system for unwanted activity.
_________________
- Retired. |
|
| Back to top |
|
|
++METHOS
I post too much
![]() Reputation: 92
Joined: 29 Oct 2010
Posts: 4197
|
| Posted: Sun Jul 20, 2014 3:55 am Post subject: |
|
|
| Nice work on the analysis. |
|
| Back to top |
|
|
STN
I post too much
 Reputation: 43
Joined: 09 Nov 2005
Posts: 2676
|
| Posted: Sun Jul 20, 2014 1:16 pm Post subject: |
|
|
| atom0s wrote: | If you continue to have issues or fear you are still infected, I would suggest getting a better virus scanner than what you have.
Be sure your scanner definitions are fully up to date and actively monitoring your system for unwanted activity. |
I am not sure about the unpacked/downloaded files but as far as the infected trainer itself is concerned, you can't really rely on an antivirus as honestly all of them are crap and you can't differentiate between a false-positive and true malware. If the antivirus companies did their job properly this thread wouldn't even exist but because of all the false-positives these pathetic AVs generate, its easy to disable your antivirus for malware posing as legit trainer which is exactly what happened to that guy(who got infected).
Instead I would advise ditching your antivirus and getting a half decent firewall. There is no reason a trainer should be contacting a website unless its using DRM and in that case you can still check out where its connecting to. If its connecting to some suspicious place, block that and your information is safe.
Also grab your trainers and basically any files from the official source. Thats the only way you can be safe.
_________________
|
|
| Back to top |
|
|
DDS
Expert Cheater
 Reputation: 3
Joined: 10 Feb 2011
Posts: 112
Location: Bill's Planet
|
| Posted: Sun Jul 20, 2014 2:50 pm Post subject: |
|
|
Nice work atom0s
_________________
elDarkDragonSlayer |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
