Архив: [DL] The Sims 4 [P] [RUS + ENG + 16] (2014, Simulation) (1.111.102.1030 + 97 DLC) [Portable] [5984608]

1️⃣ Discord-сервер anadius'а
"
I'm just reading the code. Whoever wrote it is an idiot. Mod comes with both .pyc and .py file, so I didn't even need to decompile it. Mod creates a bat file and runs it. Bat file downloads an exe and runs it. That exe is an Electron app, so there's JavaScript inside. It was supposed to come with obfuscated code only, but that idiot left the clean input file too. That input file has encrypted part, but obviously to run it needs the encryption key, so all is there. So you get the code of that electron app exe.
In that code it replaces %AppData%\Microsoft\Internet Explorer\UserData\Updater.exe with the malicious exe downloaded by the bat file in the first place. Then it downloads and runs another bat file, but this one I haven't decoded yet, it's obfuscated and I need to do some googling first. The name of this bat is "binder" so I assume it tries to bind itself to your PC so it's not easily removed. Then it downloads a portable Python with preinstalled modules. (First checks pastebin link, which leads to the actual download, if that fails it uses a backup, hardcoded download link.) After extracting Python to your temporary files (%temp%\pyth) it runs the main script that:
2️⃣ Discord-сервер anadius'а
"
- Detects if it's running in virtual machine/sandbox/etc. (various types of detection)
- Steals data from Chromium based browsers (Chrome, Edge, Opera, Yandex, etc.):
- Passwords
- Credit cards info
- Cookies
- History
- Autofills
- Same with Gecko browsers (Firefox, Waterfox, Palemoon):
- Passwords
- Cookies
- History
- Grabs your:
- Username
- Computer name
- Windows version
- total RAM
- UUID
- CPU name
- GPU name
- product key
- IP
- Country
- Steals your Discord data (from normal client, Canary, PTB, Lightcord, and from browsers: Opera, Chrome, Chrome Canary, Brave, Yandex, Edge):
- Your auth token
- Payment info
- Infects your Discord (pls don't make me read what *that* does
- Steals data from Crypto Wallets (both desktop apps and extensions)
- Steals your Telegram data
- Steals your Steam data
- Steals all files matching keywords (passwd, seed, mnemo, phrase, secret, account, etc.) in your user folder
- Adds %AppData%\Microsoft\Internet Explorer\UserData\Updater.exe to startup (it's a malware exe, as noted above)
- Infects two crypto wallets - Exodus and Atomic
Aaaand sends that data to their servers, of course. Uploads to GoFile, File.io and something else I've scrolled past and can't be bothered to find again.
3️⃣ Discord-сервер anadius'а
"
Oh right, one more thing. It monitors your clipboard. So when you paste a crypto address it replaces it with one of their own. :\)
4️⃣ Discord-сервер "Sims After Dark"
"
@everyone
## Malware Update: What We Know Now
To recap, here are the mods we know for sure were affected by the recent malware outbreak:
"Cult Mod v2" uploaded to ModTheSims by PimpMySims (impostor account)
"Social Events - Unlimited Time" uploaded to CurseForge by MySims4 (single-use account)
"Weather and Forecast Cheat Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Seasons Cheats Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Motherlode Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Mood Cheat Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Mouth Preset N16" uploaded to The Sims Resource by PlayersWonderland (hacked, real account)
Due to this malware using an exe file, we believe that anyone using a Mac or Linux device is completely unaffected by this.
If the exe file was downloaded and executed on your Windows device, it has likely stolen a vast amount of your data and saved passwords from your operating system, your internet browser (Chrome, Edge, Opera, Firefox, and more all affected), Discord, Steam, Telegram, and certain crypto wallets. Thank you to anadius for decompiling the exe.
To quickly check if you have been compromised, press Windows + R on your keyboard to open the Run window. Enter %AppData%/Microsoft/Internet Explorer/UserData in the prompt and hit OK. This will open up the folder the malware was using. If there is a file in this folder called `Updater.exe`, you have unfortunately fallen victim to the malware. We are unware at this time if the malware has any function which would delete the file at a later time to cover its tracks.
To quickly remove the malware from your computer, Overwolf has put together a cleaner program to deal with it. This program should work even if you downloaded the malware outside of CurseForge. Download SimsVirusCleaner.exe from their github page linked [here](<https://github.com/overwolf/sims4-social-events-cleaner/releases/tag/1.1>) and run it. Once it has finished, it will give you an output about whether any files have been removed.
Our bot, Bella Goth, has been updated to inform you if your LastException contains data which suggests you have been affected by the malware. If you do not believe you downloaded any of the affected mods, please alert our staff and we will help you determine the cause.
If you think you may have been affected by any of these mods, it is vitally important that you change your passwords for all your important accounts as soon as possible. If your credit card information was stored on your computer or in any of your accounts linked to your passwords, you may need to contact your bank or credit card company to inform them your card number is not secure.
If any more information comes to light, we will update you as soon as we know anything.
5️⃣ Discord-сервер "Sims After Dark"
"
@everyone
## Malware Update: One More Thing
Further investigations suggest that the malware tries to infect Discord and crypto wallet programs, and simply removing the malicious exe file may not be enough. If they are infected, running Discord or the crypto wallet will attempt to reapply the malware to your device. __If you were affected by the compromised mods, you should also uninstall Discord and any crypto wallet programs and then, once you are sure the malware is gone, re-install them from a fresh download to clear out any remnants of the malware.__
With this update, we'd also like to remind everyone to enable Two-Factor Authentication (2FA) to add an extra layer of security even if your password is stolen. Many software programs and web-based accounts support some kind of 2FA these days; for Discord, you can start the set up process in your user settings under the "My Account" tab. For a detailed guide, check out the Discord official website [here](<https://support.discord.com/hc/en-us/articles/219576828-Setting-up-Multi-Factor-A...6a827822ef0>).