3 ms·
Why is the #2 torrent in DHT a 25Mb file named AF.dat?
- 0x0 11y agoThere's another curious entry too, "x86", with filenames consisting of a random collection of unzipping .dlls and other weird stuff... Why would anyone want to torrent such a seemingly useless collection of random files?
- oakwhiz 11y agoI think this has something to do with a Korean antivirus program called ALYac.
- slater 11y agohttp://www.exterminate-it.com/malpedia/file/af.dat http://www.exterminate-it.com/malpedia/file/af.dat maybe?
- lcrs 11y agoInteresting, whilst downloading the bittorrent client ID strings were all "LT/1.0.3.0", maybe a connection to the Lineage malware from that page?
- deleted 11y ago[deleted]
- lcrs 11y agoFor the curious, the magnet link is: magnet:?xt=urn:btih:a4a75d2e4095d457467777673e96cd331575b511&dn=AF file(1) has nothing to say about it but at a glance it doesn't look like a uniform encrypted blob...
- oh_sigh 11y agoMalware or child porn
- untog 11y agoThat whole list is kind of fascinating. Interesting to see the movies and shows that are particularly popular when it comes to piracy (Marvel, Marvel, Marvel...)
- ant6n 11y ago..and GTA San Andreas? That game is more than 10 years old!
- J_Darnley 11y agoI'm going to guess at a password database of some kind, perhaps a "rainbow table". There seem to be frequent occurrences of long strings of the alphabet. Byte value counts are almost equal.
- teach 11y agoAren't rainbow tables EXTREMELY large?
- geoah 11y agoIf I was making a botnet I would use the DHT to download updates, settings etc. Not sure what else.
- mappu 11y agoP2P update for a videogame?
- eli 11y agoLooks like this piece of Windows malware: https://malwr.com/analysis/NDI4YmUxNjM0ZTUwNDY0OWFhNjM3YzFiZmY1YmQ4ZDU/ https://malwr.com/analysis/NDI4YmUxNjM0ZTUwNDY0OWFhNjM3YzFiZ... It uses a data file called AF.dat and connect to bittorrent.
- lcrs 11y agoAha, the long .torrent file it drops matches the magnet link too. The MD5 of AF.dat from that page doesn't match what I've got but maybe it gets modified...
- deleted 11y ago[deleted]
- jondumbau 11y agoi'm pretty sure the most popular torrent in the DHT doesnt have 644 downloads in the last week. this must be measuring downloads/hits from btdigg.org (only), so someone is linking directly to it and relying on them to jump clients into the DHT perhaps?
- lcrs 11y agoI can't imagine btdigg can scrape the whole DHT, but I think the idea is that the traffic they see by running many "fake" nodes is proportional to the whole, because the DHT spreads all traffic around fairly equally? I'm presuming they're using a method similar to the one presented here: https://www.usenix.org/legacy/event/woot10/tech/full_papers/Wolchok.pdf https://www.usenix.org/legacy/event/woot10/tech/full_papers/...
- brudgers 11y agoSomewhat Related: http://daniel.haxx.se/blog/2015/11/16/the-most-popular-curl-download-by-a-malware/ http://daniel.haxx.se/blog/2015/11/16/the-most-popular-curl-... Discussion: https://news.ycombinator.com/item?id=10574011 https://news.ycombinator.com/item?id=10574011
- rverbitsky 11y agoSHA256:459b05fe2dbd56cb0f31babdf722c40bd7ce061c7701fdbb56dfb382e8cd2371 File name: AF.dat Detection ratio: 0 / 55 https://www.virustotal.com/en/file/459b05fe2dbd56cb0f31babdf722c40bd7ce061c7701fdbb56dfb382e8cd2371/analysis/1448148451/ https://www.virustotal.com/en/file/459b05fe2dbd56cb0f31babdf...