nomsi

Malware Analysis: "UnoSetup.exe" Dropper (Discord/Infostealer RAT)

⚠️ Social engineering warning: This sample is distributed through Discord using social engineering. The victim is contacted on Discord and sent a link to uno-community.com, which presents the malicious download as an Uno game.

This is not necessarily a quick "download this file" scam. The person I spoke with described a process where the attackers may spend days talking to someone, building a relationship, and gaining their trust before eventually asking them to download and play the game. The amount of effort put into the social engineering appears to be deliberate.

Do not assume a file is safe just because it was sent by someone you know. Discord accounts can be compromised, and someone you trust can unknowingly become part of the distribution chain. Be especially careful when someone sends you a PC game or directs you to an unfamiliar website to download one.

Background

nomsi

#!/sbin/openrc-run
# OpenRC service file for speedify (this is how I installed it by the way
# just setup links to where you extracted it to the correct spots. (i installed in /opt)
# This isn't needed for systems using systemd, speedify packages a systemd file
name="speedify"
description="Speedify VPN Service"
command="/usr/share/speedify/SpeedifyStartup.sh"
command_args=""
#command_background=true
depend() {

nomsi

Keybase proof

I hereby claim:

• I am nomsi on github.
• I am nomsy (https://keybase.io/nomsy) on keybase.
• I have a public key ASC9dFYabKuJVEQbFUQ14UDSJHZQAb1p7o5dJG1_lcgcwQo

To claim this, I am signing this object:

nomsi

Keybase proof

I hereby claim:

• I am nomsi on github.
• I am nomsy (https://keybase.io/nomsy) on keybase.
• I have a public key ASCmnglXGjuAhK8AI5eEFkNtoTDVcSSqhb7nnnnhXLhtNAo

To claim this, I am signing this object:

nomsi

#!/bin/bash
# Tiny colored fetch script
# Requires Typicons Font to display the icons
# elenapan @ github | modified @truency

f=3 b=4
for j in f b; do
  for i in {0..7}; do
    printf -v $j$i %b "\e[${!j}${i}m"
  done

nomsi

Format disks (see Installation Guide for UEFI support and fdisk help)

mkfs.ext4 /dev/sdx1
mkswap /dev/sdx2
swapon /dev/sdx2
mount /dev/sdx1` /mnt

Sync time (not required, nice to have)

nomsi

sudo curl -o /etc/fonts/local.conf https://paste.nomsy.net/raw/ewiyeduqug

nomsi

How 2 make big Discord Bot (only for people hoping for 70k+ users!!!!!)

Step 1

First, you go to github and type in "Dyno" (or "Yukikaze" or "Misaki" or even "RedBot"!)

Step 2

You download that shit to your desktop 👌 Make sure you delete .gitignore and package-lock.json. If you do not do that then you can't really say it's yours. This allows you to also upload your downloaded packages (for coding) to save Internet!

Step 3

nomsi

Keybase proof

I hereby claim:

• I am truency on github.
• I am nomsy (https://keybase.io/nomsy) on keybase.
• I have a public key ASD2Stbkq82TdnCviK78l9yvfmN70D14ruzOWuGrXf4Xjgo

To claim this, I am signing this object:

nomsi

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>ACPI</key>
	<dict>
		<key>SSDT</key>
		<dict>
			<key>DropOem</key>
			<true/>