Skip to content

a well written trojan #15

Description

@grah4na

someone sent me a github repo and said "bro run this, it creates Gmail accounts automatically"

i decided to look before i ran anything. here's what i found:

the repo claims to be a Python tool but there is NOT a single .py file in it. just a 52MB pre-compiled .exe with no source code anywhere.

the config folder literally says "these files are NOT obfuscated" meaning the .exe IS. why would an open source tool obfuscate its binary?

and the setup asks you to put your API keys and passwords into local files that the exe reads at runtime. an exe you can't inspect. connected to the internet.

one requests.post() you'll never see and your credentials are gone.

this is textbook: fake hacking tool -> credential harvester. it's one of the oldest tricks in the book and it still works because the target audience wants the tool to be real.

always check for source code.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions