Cracked PandorahVNC | $1199/LIFETIME | 2FA BYPASS | CLONE PROFILE | HIDDEN DESKTOP | C4C.IO

[148]

That's true but if they check with something like vt or dnspy they would be able to see the original file name. But if they do that in the first place, then they aren't likely to fall for opening the application. Also, the person that's named in the crack in the about me "HAX_CRYPT", would he be a trustworthy person to purchase a product off of?

I wouldn't. The TG was claimed shortly after this crack by someone who is not myself.

Is there any reason you added your own connection to the stub? I thought your goal was to have the developers upgrade their product.

Bait not accepted.   I am no parasite or bottom feeder.

If you don't like the crack, purchase the product if you want it. Simple. The developer has already updated their product.
There are many different versions of hVNC out there, Pandora is based off of hiddenz source. Many are based off of tinynuke framework.

Best of luck in your endeavors, and as always use cracks and paid products on an RDP/VPS.


EDIT: However, in light of your claims which I do not take lightly, I have asked @Mastiff to look into the stub in question.
This will be locked until then.

[1.748]

If you build your stub and use localhost as the C2, cvtres.exe sends an HTTP GET to http:[//]51.254.27.112:1337[/]skra.jpg, to which it replies 200 with a 3.1 MB malformed image.
skra.jpg does not render as an image, and it is only composed of ASCII characters (it's not an exe/vbs/powershell renamed). The same IP was seen distributing other files in 2021:

"2021-10-25 07:53:02","http:[//]51.254.27.112:1337[/]bob.jpg","offline","malware_download","ascii|encoded","51.254.27.112","51.254.27.112","16276","FR"
"2021-10-22 19:27:07","http:[//]51.254.27.112:1337[/]pandora[/]update[/]PandorahVNC.exe","offline","malware_download","32|exe","51.254.27.112","51.254.27.112","16276","FR"

Because this request would only be sent by infected clients, my best guess is a double infection attempt.
But it's just a guess, because no external code was executed on any of the machines I ran some stubs on.

Because we aren't able to determine the purpose of skra.jpg, and we aren't sure of who runs 51.254.27.112, it's safer for us to keep this thread locked.