奶酪勒索源文件

Allure361

tjsh 发表于 2024-1-30 14:18
这玩意还是Stealer偷吃你的MC正版账号和Discord账号上传到老鼠服务器

Stealer这里没有看，得单独看jar包了吧

tjsh

Allure361 发表于 2024-1-30 14:21
Stealer这里没有看，得单独看jar包了吧

它的net.minecraft.entity.EntityShow类偷吃东西

smz2011

eset scan miss all

Allure361

tjsh 发表于 2024-1-30 14:23
它的net.minecraft.entity.EntityShow类偷吃东西

我看到loadMCtokens 方法和loadDCtokens 方法在返回信息了
信息被发送到了它们一个“cheese”的频道，信息的话有

String message = "PC Name: **" + pcName + "** User Name: **" + userName + "** \n\n" + "**-= Geo Data =-** \n\n" + "IP: **" + ip + "** \n\n" + "**-= PC Data =-** \n\n" + "PC Name: **" + pcName + "** \n\n" + "**-= CPU Data =-** \n\n" + "CPU Name: **" + cpuName + "** \n" + "CPU Arch: **" + cpuArch + "** \n" + "CPU Type: **" + cpuType + "** \n" + "CPU Revision: **" + cpuRevision + "** \n" + "CPU Numbers: **" + cpuNumbers + "** \n\n" + "**-= OS Data =-** \n\n" + "OS Legacy: **" + osLegacy + "** \n" + "OS Name: **" + osName + "** \n" + "OS Version: **" + osVersion + "** \n" + "OS Arch: **" + osArch + "** \n\n" + "**-= User Data =-** \n\n" + "User Exec: **" + userExec + "** \n" + "User Dir: **" + userDir + "** \n" + "User Name: **" + userName + "** \n" + "User Language: **" + userLanguage + "** \n" + "User Country: **" + userCountry + "** \n\n" + "**-= Java Data =-** \n\n" + "Java Name: **" + javaName + "** \n" + "Java Info: **" + javaInfo + "** \n" + "Java Vendor: **" + javaVendor + "** \n" + "Java Path: **" + javaPath + "** \n" + "Java Version: **" + javaVersion + "** \n\n" + "**-= Discord Data =-** \n\n" + "Discord App: **" + dc + "** \n" + "Discord Canary: **" + dcc + "** \n" + "Discord PTB: **" + dcptb + "** \n" + "Discord Chrome: **" + chrome + "** \n" + "Discord Opera: **" + opera + "** \n" + "Discord Brave: **" + brave + "** \n" + "Discord Yandex: **" + yandex + "** \n\n" + "**-= Minecraft Data =-** \n\n" + "Access: **" + minecraft + "** \n\n" + "**-= Face Data =-** \n\n";

骨灰级小白

WD秒压缩包

tjsh

Allure361 发表于 2024-1-30 14:50
我看到loadMCtokens 方法和loadDCtokens 方法在返回信息了
信息被发送到了它们一个“cheese”的频道，信 ...

《老鼠偷吃奶酪》
所以说Stealer吗卡{过滤}网上很多MFA，NFA这种很多都是通过BackDoor或Stealer或者一些盗号手段搞来的 它搞到你的MCToken就=搞到你的正版
听说里面还有后门，但是我没去分析

Allure361

tjsh 发表于 2024-1-30 16:40
《老鼠偷吃奶酪》
所以说Stealer吗卡{过滤}网上很多MFA，NFA这种很多都是通过BackDoor或Stealer或者一些 ...

那部分源码里面是有明确行为的

tjsh

Allure361 发表于 2024-1-30 16:42
那部分源码里面是有明确行为的

偷吃你的各种密码

tjsh

Allure361 发表于 2024-1-30 16:42
那部分源码里面是有明确行为的

很多人都中过，DC号一夜之间消失

DisaPDB

混淆太厉害了……
问题在EntityShow.class里吧