[LF] Misa by Larens

Avada Kedavra

Bump

? Offline

Avada Kedavra

@BLACK0NYX ty!

robbanks

@BLACK0NYX Dude, why you're spreading malware?

misa\Assets!MisabyLarens\Materials\hairearstail\hairearstail\VRChat\Editor

There's 4 files

RuntimeCrashHandler.cs
VRCSDK.Analytics.dll
VRCSDK.Core.dll
VRCSDK.Editor.dll

VRCSDK.Core.dll is actually 0Harmony.dll used to override methods during runtime
VRCSDK.Editor.dll is actually Newtonsoft.Json.dll

and finally the cherry on top

VRCSDK.Analytics.dll contains malware obfuscated by ConfuserEx

I guess someone is having a fun time collecting vrchat logins

? Offline

@robbanks
I've had this package for a very long time. Due to the large amount of content, it is not possible to check each package individually and carefully. Nevertheless, thank you for paying attention to this. As soon as I get free, I will delete the files you specified from this package.

robbanks

@BLACK0NYX Sorry, I just noticed that this file was uploaded in 2022. Maybe you're not even involved in this mess.
This malware does not even seem to work correctly since its that old.

CodeAngel

Thanks for the heads up @robbanks

lucimoot

@robbanks That malware i believe was made by a guy named Bin, he was the founder of a vrc asset pirating site called sanctuary.moe, he used it as a honeypot for his project akisoba which is a drm product, then after scrutiny dipped from that project and moved to another site called vrc.garden (another pirate/trading site) which then died out and now is gone

lucimoot

at the very least is looks similar to the malware he used sanctuary to inject

lucimoot

@CodeAngel chances are Bin no longer collects info from the malware since all of his projects have died, especially akisoba which was the whole point of the malware