49 lines
2.0 KiB
Markdown
49 lines
2.0 KiB
Markdown
---
|
|
title: We Removed FileCR as we Found Malware
|
|
description: Update on FileCR
|
|
date: 2023-08-14
|
|
next: false
|
|
aside: left
|
|
prev: false
|
|
sidebar: false
|
|
footer: true
|
|
---
|
|
|
|
<Post authors="['nbats']" />
|
|
|
|
# FileCR Malware
|
|
|
|
Note: The malware is not exclusive to FileCR and we don't have proof FileCR is
|
|
intentionally hosting it, but they haven't removed it. Possible sources of the
|
|
malware include some uploaders on sanet, but it seems to be coming from multiple
|
|
sources.
|
|
|
|
Since the malware has been found coming from multiple sources, info about the
|
|
malware itself has moved to [here](https://rentry.co/big_load_malware). Check
|
|
there for technical info or to check if you've been infected.
|
|
|
|
So far, malware has been found in the following cracks, but it is likely it is
|
|
undiscovered in many more downloads because of how large their catalog is.
|
|
|
|
- https://filecr.com/windows/kms-matrix/
|
|
- https://filecr.com/windows/windows-activator-by-goddy/
|
|
- https://filecr.com/windows/stardock-start11
|
|
- https://filecr.com/windows/malwarebytes-premium
|
|
- https://filecr.com/windows/navicat-premium (Navicat Premium 16.2.3)
|
|
- https://filecr.com/windows/outbyte-driver-updater
|
|
- https://filecr.com/windows/jetbrains-pycharm (Premium release, you need
|
|
https://greasyfork.org/en/scripts/403170-bypass-filecrypt to access)
|
|
- https://filecr.com/windows/avast-premier-antivirus
|
|
|
|
So far FileCR has not responded at all, which is unusual as they are usually
|
|
very active and have removed malware in the past as quickly as 6 hours. Because
|
|
the malware is included in multiple unrelated cracks and because they have not
|
|
responded at all to reports, they are likely to be in some way involved in
|
|
spreading or creating the malware. Also, some of the malware had descriptions
|
|
written just for FileCR, which is unusual, and the description for KMS matrix
|
|
contains lies about the activation given by the software.
|
|
|
|
## [Samples](https://rentry.co/big_load_malware#samples)
|
|
|
|
## [Am I infected?](https://rentry.co/big_load_malware#am-i-infected)
|