1 reply to this topic

[ZeroSecurity]

Found on youtube video, currently UD on Malwarebytes database.

Coded in: C#/VB.NET

File: RunescapeBot V1.08 Setup.exe
Size: 938496
MD5: CC2E826681142D313F32115EBE4E26DA
Path: C:\Users\Zher0\Downloads\RunescapeBot V1.08



DNS REQUESTS:

edis22.no-ip.biz:184.171.198.41
edis22.no-ip.biz:184.171.198.41

One file droped + added to startup:

Startup name: Spoof Service
File: taskmgr.exe
Size: 938496
MD5: CC2E826681142D313F32115EBE4E26DA
Path: C:\Users\Zher0\AppData\Local\Temp\taskmgr.exe - DETECTED by malwarebytes but not on direct scan
Microsoft Visual C# / Basic .NET

Same MD5 hash but malwarebytes only detects in temp directory.

VT:

Detection ratio: 8 / 42

https://www.virustot...sis/1336622645/

[sUBs]

Thank you for your help. Attached file will be verified.