yimmenu v2 Virus and keylogger/card logger #615
-
|
Hey this may not be a issue for some but I just wanted to make sure I was safe. I was scanning through the code and ran it through Virus Total. When you check the behavior of the most recent update it says it can "Log keystroked via polling" "Parse credit card information" "log keystrokes" "get geographical location" "read clipboard data" It also says it uses a shellcode execution using indirect call + RWX memory use. I don't know if these are standard or normal but they definitely do not seem normal. In the previous release that was a couple days ago it did not have these behaviors. I just want to make sure my stuff and others stuff wont get stolen from this new release. |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 4 replies
-
|
I understand that every cheat has characteristics of malware and get false
positives however when I installed it from the official release today and
ran it through Virus Total it is now showing a keylogger and a credit card
logger in the files behavior. when I ran a previous version again from the
official release there was no such behavior. Again I don’t know if this is
normal but it definitely doesn’t seem normal especially with a credit card
logger.
|
Beta Was this translation helpful? Give feedback.
-
There's a very simple way to prevent that if you're really that paranoid, don't use it. lol |
Beta Was this translation helpful? Give feedback.
-
|
Well I just want some clarity because I don't think anyone wants their passwords and credit cards stolen. When I saw these wild things on VT I wanted to make this Q&A either to get clarity or to inform people that don't know that it could be a risk but it seems like what Flying-Scotsman said then its perfectly fine. |
Beta Was this translation helpful? Give feedback.
-
|
While VT is useful (I use it in my job), it does blindly go with what other vendors are saying - and that could mean "oh this is patching memory - therefore it must be bad!" without looking at context. Unfortunately with how popular Yimmenu is - it has also seen its fair share of malicious twats taking the source and adding their own code (i.e calling out to a C2 to drop a stealer) to catch users. This is why you never trust downloads on Youtube videos, but by extension it also means VT and other vendors tar everything Yimmenu with the same brush even though they're actually 2 different files, vendors only look for commonalities which can lead to false positives like this. The rule of thumb regardless - never trust any Yimmenu DLL which is not from the releases section here or from a reputable site like Unknowncheats which have a process for looking at uploads for poisoning. |
Beta Was this translation helpful? Give feedback.
-
|
So what you are saying is that people take yimmenu because its open source and modify a malicious version but it looks like the same thing to VT so VT flags the malicious version as well as the clean version and shows both results even if its not the file you put in to scan? If that is correct then This will most likely be the answer. (EDIT) Also what is preventing someone from putting a malicious file inside of the releases? |
Beta Was this translation helpful? Give feedback.
-
|
More a less - yes. Malicious actors will take the source, add their malware, compile it and upload it to Mega, Discord or some other file sharing site and spread it through Telegram, YouTube, Discord etc etc. They'll target Yimmenu, Menyoo etc because they know it's popular and it'll be easy to convince someone to load it up without thinking. An antivirus will scan and look for bits of code which does not change similar to how Yimmenu makes memory patterns so it can patch addresses or hook things. AVs function in a similar way. It's scanned the malicious Yimmenu DLL, found some areas which are unlikely to change and made detections for it. The problem is those sections where the AV's have made patterns on are used in the legit Yimmenu which is why it's false-flagging. The malicious code will change (i.e different download URLs, different obfuscation etc) but the core (Yimmenu) won't which is why the AV vendors have done it this way - because it's easier to do so than reverse engineer the whole thing and make custom detections. It's lazier but also faster to put in detections for. VT also runs on "by association" - for example ImGui has been flagged as 'bad' by 1 vendor (UrlHaus) because it was in a malware file at some point in time. Is ImGui malicious? No - but through association to malware, this vendor is convinced it is:-
Looking into it - vendors have flagged this DLL as "keylogging" because of the embedded Matrix server URL (to the official Yimmenu Matrix server). This would be because keyloggers will attempt to exfiltrate text to a server like Telegram, which is not the case here - the link is purely to allow you to join the server. As long as you grabbed the file from the releases on here and not some dodgy source (or just compile it yourself) then you'll be safe. Never trust DLLs compiled by random strangers, on file upload sites etc because you never know what you're getting. Regarding the releases here - there's always a risk someone adds in a malicious commit which is compiled (something which happened over time to the xz utils library) it's also likely to be picked up due to the attention Yimmenu has. The releases are also auto-compiled through a pipeline, not by a user so that's an extra step someone would have to take to make it malicious (i.e hijack the pipeline and/or add a malicious commit which is likely to be noticed). |
Beta Was this translation helpful? Give feedback.
-
|
Since all of the anti virus systems say that menus are viruses, you have to trust the people who make the menu and only download it from where they post it. The folks that have created Yimmenu have been around for awhile, and I personally think I can trust them. |
Beta Was this translation helpful? Give feedback.
-
|
https://github.com/YimMenu/YimMenuV2/releases/tag/nightly, is it safe or not? |
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
More a less - yes. Malicious actors will take the source, add their malware, compile it and upload it to Mega, Discord or some other file sharing site and spread it through Telegram, YouTube, Discord etc etc. They'll target Yimmenu, Menyoo etc because they know it's popular and it'll be easy to convince someone to load it up without thinking.
An antivirus will scan and look for bits of code which does not change similar to how Yimmenu makes memory patterns so it can patch addresses or hook things. AVs function in a similar way. It's scanned the malicious Yimmenu DLL, found some areas which are unlikely to change and made detections for it. The problem is those sections where the AV's have…