LSD - Spreading RAT | Claims to have multiple BL slaves | Lot's keys |

[Cassord²]

http://forum.blockland.us/index.php?topic=241459.msg6891481#msg6891481
These songs are really good but I don't want to download it because I fear it's got the virus in it.

[Ad Bot]

[SWAT One]

>>disable LSD's keys and ban by IP.

ftfy

[Zeblote]

ftfy

Because it totally takes more than a few clicks to change your IP.

[Blockzillahead]

I don't believe this is a RAT more than it is a Trojan.
It seems to disable a stuff ton of functions and registries.

Code: [Select]

RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoFolderOptions", "REG_DWORD", 1)
RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", "ShowSuperHidden", "REG_DWORD", 0)
RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr", "REG_DWORD", "1")
RegWrite("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "EnableLUA", "REG_DWORD", "0")
RegDelete("HKLM64\Software\Microsoft\Windows NT\CurrentVersion\SPP\Clients")
Also writes itself to start up and disables methods of killing it. I think even removing anti-viruses from booting up at start up.

Please revoke this guy and all those stolen keys.

[Zanaran2]

Are you loving joking

whatd you expect guys it was 3 in the morning and my brain was fried

[Zeblote]

I don't believe this is a RAT more than it is a Trojan.
It seems to disable a stuff ton of functions and registries.

The main point of the script is to decrypt and execute a copy of darkcoment (and most likely other things too), and to prevent the user from shutting it down.

[Zeblote]

The main point of the script is to decrypt and execute a copy of darkcoment (and most likely other things too), and to prevent the user from shutting it down.

No edit: Here's a simple virustotal check of the decrypted file: https://www.virustotal.com/file/302f038f0a677da3099139721d098d3d87af280a6d744dcf1c491849f95955ab/brown townysis/1389380113/

[SWAT One]

Because it totally takes more than a few clicks to change your IP.

But then it's a federal offense.  If this kid is stupid enough to hand this out and welcome drama, he'd do it again and then be is really deep stuff.

[Zeblote]

But then it's a federal offense.  If this kid is stupid enough to hand this out and welcome drama, he'd do it again and then be is really deep stuff.

Please explain how changing your IP should be a 'federal offense' and how that should matter at all if he doesn't live in the US.

[Blockzillahead]

Please explain how changing your IP should be a 'federal offense' and how that should matter at all if he doesn't live in the US.

I think changing your IP after committing a crime online is a federal offense.
But yeah tough stuff if he doesn't live in the US.

[Zeblote]

I think changing your IP after committing a crime online is a federal offense.
But yeah tough stuff if he doesn't live in the US.

Dynamic IPs change all the time... or he could just use a vpn... unless he's a handicap and does this without any precautions.

[AutoBahn]

http://forum.blockland.us/index.php?topic=241459.msg6891481#msg6891481

I want to say Bishop has been hijacked/is linked to LSD as well, since he seems to have downloaded it and he recently posted a few links on my server to a file download that has similar results on a virustotal scan as

No edit: Here's a simple virustotal check of the decrypted file: https://www.virustotal.com/file/302f038f0a677da3099139721d098d3d87af280a6d744dcf1c491849f95955ab/brown townysis/1389380113/

[Zealott]

I'm assuming he is planning to sell them 70% like in Minecraft. I thought that selling BL keys was pretty much impossible because if the IP location constantly changes it would get detected or something?

[Truce]

I want to say Bishop has been hijacked/is linked to LSD as well, since he seems to have downloaded it and he recently posted a few links on my server to a file download that has similar results on a virustotal scan as

I don't want to accuse him, but maybe they know each other? I saw that when I made that post earlier.

[Renderman]

ID: 31337

my id is 33559 :O