[sCRiPTz-TEAM] scriptzteam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

for 4.2.4 or higher, 4.2.5,4.2.6,4.3.7, it's works, this is the way which makes Always in evaluation mode.

open Terminal, go to the dir : cd /Applications/Beyond Compare.app/Contents/MacOS
change the name BCompare to BCompare.bak: mv BCompare BCompare.bak
touch a file name BCompare , and chmod a+ux BCompare : touch BCompare && chmod a+ux BCompare
open BCompare with text editor, insert the script :

#!/bin/bash
rm "/Users/$(whoami)/Library/Application Support/Beyond Compare/registry.dat"
"`dirname "$0"`"/BCompare.bak $@

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	apikey="xxx"
	echo "$(tput setaf 7)Uploading $1 to VirusTotal$(tput sgr0)"
	vt_hash=$(curl -X POST 'https://www.virustotal.com/vtapi/v2/file/scan' --form apikey=$apikey --form file=@"$(realpath $1)" \| grep -o '"[0-9\|a-f]{64}"' \| head -1 \| sed 's/"//g')
	echo done: $(sha256sum $1)

	#!/bin/zsh
	#Copyright 2019 Ryan 'GodofGrunts' Whited
	#Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

	#The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

	#THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE

	#!/usr/bin/env bash
	#
	# Backup selected directories to a Backblaze B2 bucket
	#
	# If youre encountering errors running the script you probably need Bash 4.0
	#
	# You need to login to your b2 account once with b2 authorize-account [<accountId>] [<applicationKey>] before running it.
	#
	# Example daily cron running script.sh in home directory:
	# @daily /usr/local/bin/bash ~/script.sh

	d.is_meta
	directory.watch.added
	group.seeding.ratio.max
	group.seeding.ratio.max.set
	group.seeding.ratio.min
	group.seeding.ratio.min.set
	group.seeding.ratio.upload
	group.seeding.ratio.upload.set
	group.seeding.view
	group.seeding.view.set

	#!/bin/sh

	#
	# INFO
	#

	# This works if sonarr and radarr are set up to have a Category of sonarr and radarr respectively
	# If you are using other Categories to save your automated downloads, update the script where you see:
	# "radarr"\|"sonarr")
	# This script will not touch anything outside those Categories

	####
	# Install magneticod go-rewrite on a brand new scaleway ubuntu 16.04 instance
	####
	apt-get update && apt-get -y upgrade
	apt-get install -y software-properties-common python-software-properties git trickle
	add-apt-repository ppa:gophers/archive
	apt update
	apt-get -y install golang-1.9-go
	mkdir -p $HOME/go/src
	cd $HOME/go/src

	NetLimiter 3
	Registration name: Peter Raheli
	Registration code: C99A2-QSSUD-2CSBG-TSRPN-A2BEB

	NetLimiter 4
	Registration Name: Vladimir Putin #2
	Registration Code: XLEVD-PNASB-6A3BD-Z72GJ-SPAH7

	https://www.netlimiter.com/download
	# Netlimiter Full Netlimiter Activated Netlimiter cracked Netlimiter Full Version Netlimiter Serial Netlimiter keygen Netlimiter crack Netlimiter 4 serial Netlimiter 4 Crack Netlimiter 4 register Netlimiter 4 patch Netlimiter full Full version Netlimiter 4 Activated Netlimiter 4 Cracked Netlimiter Pro