Synthèse
L'auteur adresse un message aux développeurs du malware MecchaChameleon, analysant leur stratégie de distribution via des cartes personnalisées malveillantes et leur utilisation présumée de PureRAT. Il détaille ses observations de rétro-ingénierie du payload C# en soulignant les faiblesses de l'obfuscation, de la mise en scène et de la dissimulation du code.
Also, apparently Meccha Chameleon people follow me on Telegram. Hello MecchaChameleon malware people living inside my computer, I think overall your strategy of using a malicious custom map thingie was cool and probably yielded moderate success. I don't think your intention was being like, 100,000 infected machines, but I suspect you got enough infected machines to be happy. People wrote you were using PureRAT, whether or not that is true, I don't know, YARA rules for flagging can be iffy. But, when I was reverse engineering your C# payload (which I think you attempted to obfuscate?
) I saw the weird dependency you used for remote access to machines. I can't remember what it was now, I deleted your goopies off my machine, but I saw it as an embedded resource next to PAYLOAD_ULTRA_MEGA_FUCK_OFF. zip which you decrypted and loaded as a raw assembly. Maybe that raw assembly you loaded was PureRAT? Or was it the stager?
I don't know. Obviously we've been this a million times before with other video games (malicious mods), but seeing it in something obscure was a nice surprise. Your advertisement, or demo, or whatever, you showed was not an RCE. An RCE would require ... remote code execution.
This is really fancy payload smuggling. Anyway, it's obvious your staging was vibe coded. It was pretty easy to reverse engineer. I think you had the right idea on how to go about things, but between the segments being in order (1 - 66), the obvious embedded payload in the 2nd stager, and the really loud BATCH files, it wasn't going to go very far. Thanks for the goopies though, it was chill.
Source originale
t.me