malware · Sun 26 Jul 2026 · 17:48 UTC
> free time today > what was bro doing with a torrent movie .exe > download > 1gb .exe > lmfao binary inflation > bonk bonk > remove junk > deflate binary > 500kb > bonk bonk > no imports > crt stripped > position independent > checks language > kills self if in belarus or russia > runs 2000 random functions in random order > trying to stall to evade VMs > decrypts .exe from inside itself > runs mystery .exe in memory > .exe steals goop off machine > bonk bonk > yara flags as lumma stealer overall this wasnt the greatest goop ive ever seen, but i was a big fan of free_movie.exe. its a certified limewire 2002 classic. inflated binary: e25ae92b95809ee42f61810a0253ead29b3a6aa8adf91f785c80c9bec5f38bd8 stripped binary: 732d7a945163a3f31eae25028562bd5d9a352c31eb90c777042bceeeb1c6b3ec in-memory payload (partially reconstructed): 3e561eecde0071766626d80d6ce3cf1626fb2dbed0ef437948f622c283a0e91e c2: overcjo(.)cyou betavmt(.)cyou hiatuft(.)cyou auditva(.)cyou
Filed UTCSource X ↗
<p>> free time today<br /> > what was bro doing with a torrent movie .exe<br /> > download<br /> > 1gb .exe<br /> > lmfao binary inflation<br /> > bonk bonk<br /> > remove junk<br /> > deflate binary<br /> > 500kb<br /> > bonk bonk<br /> > no imports<br /> > crt stripped<br /> > position independent<br /> > checks language<br /> > kills self if in belarus or russia<br /> > runs 2000 random functions in random order<br /> > trying to stall to evade VMs<br /> > decrypts .exe from inside itself<br /> > runs mystery .exe in memory<br /> >…
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.