I am absolutely flabbergasted
Okay, so this nerd DMs me saying he thinks he got sent malware. He said I should check it out. I said "I'm in my undies, I'll do it later when I'm on my PC" (Image 1)
This malware has so many twists and turns bro, this shit is all vibe coded too. I don't know what AI agent wrote it, but I know it's vibe coded because THE NOTES FROM THE AI AGENT ARE PRESENT.
I think the Threat Actor who wrote this didn't understand how reverse engineering works, so they didn't know the AI agent notes would be present.
This malware wasn't super sophisticated, it didn't contain any extreme logic or anything, but it was a convoluted fucking MESS and it a colossal pain in the ass.
A normal malware developer could have written this too, but it's got so many stages this would be more akin to a well-established Threat Actor. This was written by someone who doesn't understand how reverse engineering works and someone who is willing to target GAMERS OVER DISCORD with malware that is actually pretty decent.
In fairness, it could be MaaS, but this doesn't line up with anything I've seen from my peers (yet). It's possible I've missed it. But, this is a bitch of a payload and I unironically enjoyed it.
Here is the silly meme summary
> get sent rivals_toolkit.exe
> electron app goop
> masquerades as legit toolkit
> electron app contains resource called "Discord.exe"
> Discord.exe is a malware loader
> Discord creates a Java VM
> Loads obfuscated Java payload
> I can't find where it the JVM payload
> JVM payload hidden in different file from Electron app
> Annoying.jpg
> Electron App also has spoopy secondary functionality
> Displays legit HTML stuff
> Secondary thread executes, executes Ira.JS stager
> f91a7efa0d476811455271e023dfb3be
> Decodes and executes initial stager, Ira.jsc
> c286ad4c51128266e10ad0a49da9cb3f
> Decodes and drops secondary payload stage
> 816bfabbb3408ad2114ba351690410c3
> Decodes and drops third payload stage
> 7364f758b4b8623c0beb020a74ff09b5
> Decodes and drops fourth payload stage
> 7b9627f07f7fb604f5edfb23c706b22a
> Final payloads syncs and does IPC with Java payload
> Contains AI notes (Image 2)
Holy Christ, all of this for fucking gamers on Discord? Multi-staged masquerading payload with cross-language IPC? What the fuck?
In the Tao Te Ching, Laozi calls the child's state "Pu" (The Uncarved Block)—the raw, uncarved, chaotic, and deeply authentic state of original nature.
The kid screaming in the cold puddle is letting his life force (Qi) flow naturally, unburdened by societal conditioning.
The adult, meanwhile, is trying to carve himself with a $4,000 "golden chisel" (expensive candles, mountain views, retreats). He thinks he's achieving spiritual elevation, but Taoism would coldly remind him: You just paid a premium for a more aesthetically pleasing cage.
True cultivation isn't escaping the mud to meditate on a mountain; it's "blending with the light and mixing with the dust."
It is important to resist the commodification of basic human needs. Food, water and healthcare cannot be subordinated to market considerations or geopolitical interests. Access to adequate food is a fundamental human right grounded in the dignity of every person. Meeting this need not only alleviates suffering but also addresses underlying causes of geopolitical instability. Indeed, food security is an essential component of global and integral security. https://t.co/DgkM9RegJ7
I make computers do things that only the deepest, darkest corners of the government can possibly imagine
(High performance software with low memory usage)
Looking for some pixel-dusted terminal nostalgia? Check out this free, open-source Winamp-inspired retro terminal player for local files, radio, podcasts, and streams from YouTube, Spotify, Plex, Jellyfin and much more
Laughter is anti-inflammatory. Crying is regulating. Hugging is immunoprotective. Singing is vagal toning. Dancing is neurogenic.
Joy is a biological necessity.