Archived
-
This was a report post because I found an executable file in an avatar (.exe), and after a manual analysis, I concluded that it was highly likely to be malware given its strange behavior, the libraries it imported, and the warnings on triage sites.
However, after spending hours analyzing the file in question, showing it to a malware analyst, and relying on input from others, the conclusion is that the program is a version of HDiffPatch prior to Dec 1, 2023 (I’ve been comparing the SHA-256 of the releases with the file found, and that was the last SHA-256 I checked.)
Given the program’s anti-debug nature and dynamic execution, it was difficult for me to figure out exactly what the program did, but I wanted to issue a warning so that people wouldn’t download the program until there was a definitive conclusion.
I often use translators, which can make my messages look ai-generated.
-
Here is the link to the post about the tool used to scan unitypackages. Please give it a upvote to support the creator: https://forum.ripper.store/post/1745792
-
only FT setting? phew im safe i guess
-
did you check through the other files from that thread by chance? i just downloaded the 2.0 version update yesterday
-
did you check through the other files from that thread by chance? i just downloaded the 2.0 version update yesterday
-
@Fluttershy I checked the other files and didn't find anything. But personally, I wouldn't use them until I wait a few more days. Did you end up importing them into Unity?
@anonberry i already imported it yes : / i do run everything through a virus scanner before using it though and it seemed fine, but now im worried
-
@anonberry i already imported it yes : / i do run everything through a virus scanner before using it though and it seemed fine, but now im worried
@Fluttershy Unfortunately, an antivirus program won’t protect you in this case. As mentioned, this malware uses techniques that make it impossible to detect, and it can only be identified through a manual analysis. Which files did you download exactly?
-
@anonberry i already imported it yes : / i do run everything through a virus scanner before using it though and it seemed fine, but now im worried
@Fluttershy Be sure you didn't download the FT setting files, they're infected.
-
@Fluttershy Unfortunately, an antivirus program won’t protect you in this case. As mentioned, this malware uses techniques that make it impossible to detect, and it can only be identified through a manual analysis. Which files did you download exactly?
@anonberry I downloaded this one
-
@Rat-z If you've imported the assets into Unity, then your computer must be infected. Disconnect your computer from all networks, especially wired connections; remove any mobile phones or USB storage devices connected to your computer; change all your passwords using another device; and format your computer with a completely clean new installation of Windows.
-
I believe this is a false positive. After looking through multiple FT addons, both on here and from various vendors on booth, I found that some use hpatchz as a patcher. This includes addons from vendors like adjerry91 (Jerry's Face Tracking), Fermata, and Ocian, just to name a few. However, vendors like めれShop, Kino, and suzuの気まぐれ use a asset instead of patching it using hpatchz. All in all, use it if you'd like and trust your own judgment. Hope this gives some clarity
SIDENOTE: This is the wrong category for this topic
Happy hunting
-
@Rat-z If you've imported the assets into Unity, then your computer must be infected. Disconnect your computer from all networks, especially wired connections; remove any mobile phones or USB storage devices connected to your computer; change all your passwords using another device; and format your computer with a completely clean new installation of Windows.
-
@anonberry oh thank god it only activates if imported? so i would be okay if i deleted it?
-
uhh can you check this one? https://forum.ripper.store/post/1761155 i tried it with the scanner and it says high risk but im not sure
-
using AI to write your post. you clearly do not understand what you're trying to say. you can go to the official github repo of HDiffPatch and compare the files. there has been no altercation. it is not a virus.
@gwinaniai well to be fair the official repos version dosnt have a past file name of
2026-02-14_f78fd7e3e20383f3ddc868b2762da48f_cobalt-strike_icedid_njrat_satacom_vidar
LOL
and isnt in a known malware database
-
guess I write like an AI I guess lmao
@picturesque was talking about OP using AI.
@5687476 they used virustotal as their proof of virus which provides file checksum. its a normal scan
-
@picturesque was talking about OP using AI.
@5687476 they used virustotal as their proof of virus which provides file checksum. its a normal scan
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login