EQGRP_Lost_in_Translation icon indicating copy to clipboard operation
EQGRP_Lost_in_Translation copied to clipboard

Is there any proof any of these .exes are not exploits themselves?

Open Theo1996 opened this issue 7 years ago • 7 comments

Is there any proof any of these .exes are not exploits themselves?Why should i trust a hacker group released if i cant even see the source code?

Theo1996 avatar Apr 15 '17 12:04 Theo1996

There's no proof, and nobody is saying you should trust them. In fact everyone will explicitly tell you NOT to run any of these scripts without personally verifying them for yourself.

Also (anyone who knows more about winblows correct me if I'm wrong), I don't believe it's possible to turn a windows Portable Executable back into source; you can turn it into machine code, but there's a shit ton of symbols and other undocumented crap going on in them; it's not like ELF.

I don't work with windows binaries; currently looking for a disassembler and a decompiler since I don't have $$$ to drop on IDA (and they probably wouldn't sell it to me anyway), if anyone has some good *nix programs for this (other than objdump you gits ain't nobody got time for that) let me know.

NoahGWood avatar Apr 15 '17 12:04 NoahGWood

well im not saying it definitely is a virus but i ran it and after like 10 mins or so ( i was away from the PC).. my antivirus detected a dropper.. ive now deleted it and im scanning my whole pc.

RUN AT YOUR OWN RISK

Haroon01 avatar Apr 15 '17 13:04 Haroon01

ok thanks,at least got some proper&serious answers.

Theo1996 avatar Apr 15 '17 19:04 Theo1996

@haroon01 at this point I would just reinstall your OS

multinerd avatar Apr 15 '17 20:04 multinerd

@JohnnyHobo radare2 ?

darkpandaman avatar Apr 16 '17 06:04 darkpandaman

@multinerd @Haroon01 yea senpai the guys who released this are incentivized to add malware to these. Who else here is too stupid/scared/not gud enough to run these?

DukeCityDev avatar Apr 18 '17 19:04 DukeCityDev

  • [x] Remote Code Execution
  • [x] Privilege Escalation

EternalBlue addressed by MS17-010 EmeraldThread addressed by MS10-061 EternalChampion addressed by CVE-2017-0146 CVE-2017-0147 ErraticGopher addressed prior to the release of Windows Vista EsikmoRoll addressed by MS14-068 EternalRomance addressed by MS17-010 EducatedScholar addressed by MS09-050 EternalSynergy addressed by MS17-010 EclipsedWing addressed by MS08-067

Atavic avatar Apr 26 '17 19:04 Atavic