> free time today > what was bro doing with a torrent movie .exe > download > 1gb .exe > lmfao binary inflation > bonk bonk > remove junk > deflate binary > 500kb > bonk bonk > no imports > crt stripped > position independent > checks language > kills self if in belarus or russia > runs 2000 random functions in random order > trying to stall to evade VMs > decrypts .exe from inside itself > runs mystery .exe in memory > .exe steals goop off machine > bonk bonk > yara flags as lumma stealer overall this wasnt the greatest goop ive ever seen, but i was a big fan of free_movie.exe. its a certified limewire 2002 classic. inflated binary: e25ae92b95809ee42f61810a0253ead29b3a6aa8adf91f785c80c9bec5f38bd8 stripped binary: 732d7a945163a3f31eae25028562bd5d9a352c31eb90c777042bceeeb1c6b3ec in-memory payload (partially reconstructed): 3e561eecde0071766626d80d6ce3cf1626fb2dbed0ef437948f622c283a0e91e c2: overcjo(.)cyou betavmt(.)cyou hiatuft(.)cyou auditva(.)cyou
<p>> free time today<br /> > what was bro doing with a torrent movie .exe<br /> > download<br /> > 1gb .exe<br /> > lmfao binary inflation<br /> > bonk bonk<br /> > remove junk<br /> > deflate binary<br /> > 500kb<br /> > bonk bonk<br /> > no imports<br /> > crt stripped<br /> > position independent<br /> > checks language<br /> > kills self if in belarus or russia<br /> > runs 2000 random functions in random order<br /> > trying to stall to evade VMs<br /> > decrypts .exe from inside itself<br /> > runs mystery .exe in memory<br /> >
● loading threat intel…