Other Arctic tech

[Jprefect]

Arctic.tech is a new free cheat in dll.

Im not sure but when reversing the unpacked (upx packed) dll. I saw python, connecting to ip, vt
(mb false inf idk orcusrat and malware): https://www.virustotal.com/gui/file...7241334d7c1badfdd376f0f6004e27783bb9a272f086/

And this is only packed version. But you dont really need to unpack it, also its perfecthook
(github search:

You must be registered for see links

).

Conclusion: The cheat is pasted from an old hack but fixed and a lot better, meanwhile connecting to an ip, executing python, detecting debug softwares.
Its doing smth in java. This does not make the cheat a rat or malware but really acts like one.

Registry Keys Deleted​

\REGISTRY\A\{77e7cc7c-ef64-f0c4-295f-c52413119073}\Root\InventoryApplicationFile\PermissionsCheckTestKey

 

[Plisskien]

Arctic.tech is a new free cheat in dll.

Im not sure but when reversing the unpacked (upx packed) dll. I saw python, connecting to ip, vt (mb false inf idk orcusrat and malware): https://www.virustotal.com/gui/file...7241334d7c1badfdd376f0f6004e27783bb9a272f086/

And this is only packed version. But you dont really need to unpack it, also its perfecthook (github search:

You must be registered for see links

).

Conclusion: The cheat is pasted from an old hack but fixed and a lot better, meanwhile connecting to an ip, executing python, detecting debug softwares.
Its doing smth in java. This does not make the cheat a rat or malware but really acts like one.

Registry Keys Deleted​

• 
  \REGISTRY\A\{77e7cc7c-ef64-f0c4-295f-c52413119073}\Root\InventoryApplicationFile\PermissionsCheckTestKey
  
  
  

coule u provide sample?

 

[Jprefect]

packed dll

 

[Plisskien]

packed dll

This DLL is not packed, also seems to be safe, but entropy is a bit high in two sections of this PE.
Also keep in mind that any website like VT will include all other applications that are running in background (windows native applications), thus looking at these behaviors for DLL file is not good idea, it will be only suitable for normal exe file that is not requiring other process like CS to run.

P.S I zipped file

 

[jacobxsage]

This DLL is not packed, also seems to be safe, but entropy is a bit high in two sections of this PE.
Also keep in mind that any website like VT will include all other applications that are running in background (windows native applications), thus looking at these behaviors for DLL file is not good idea, it will be only suitable for normal exe file that is not requiring other process like CS to run.

P.S I zipped file

can i use it ?

 

[swyy]

theres a public source avaiable on yg, therefore i didn't deeply look into the source only besides the fact thats pasted airflow.su lol

 

[deepzking222]

wheres the cfg folder?