5 ms·

It's distributed in English with an English interface.

codedokode 10y ago
The support forum thread started by the developer is in russian (many people living in Ukraine speak both Russian and Ukranian so there is no contradictions with an Ukranian flag on the download page): https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567
- zzzcpan 10y ago
  And the author of the thing on the last page claims that many "packers" can be made to satisfy that signature.
  - codedokode 10y ago
    Maybe he understood that things got serious and doesn't want to get extradited to USA.
zzzcpan 10y ago
Doesn't mean anything, the thing is still way more likely to be promoted inside the community than reaching international recognition or any international users really.
codedokode 10y ago
The download page earlier [1] had a Webmoney wallet identifier for donations. Webmoney is a russian payment system that was popular in 00's [2] in ex-soviet countries. [1] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [2] https://en.wikipedia.org/wiki/WebMoney https://en.wikipedia.org/wiki/WebMoney
- waterphone 10y ago
  To be clear, I'm not suggesting that it isn't Ukranian, or whatever, I was just pointing out the fact that the interface, etc., is in English and so there may be a wider "market" for the malware. It's consistent with the sort of malware I see on clients' infected WordPress installs semi-regularly.
  - codedokode 10y ago
    I tried to Google "pas web shell" and "profexer pas download" (with option to search pages in any language) to understand the audience of a project. What I saw were mostly links to forums in russian (with reviews of the software or tutorials on how to use it), one chinese github account with a collection of web shells and english posts from people who found the backdoor and tried to understand what it was. So I got an impression that posts in english were mostly from victims and posts in russian were mostly from users. You can try google these words and see the results yourself.
  - zzzcpan 10y ago
    The international market exists, but there is no evidence of the malware having any positions there or any efforts to promote it there, which is how things usually are. So, it is used mostly by Russians and Ukrainians and is known almost only among them. If you believe the intelligence agencies, it's only logical to believe that Russians did in fact do it. Simple estimates based on the things that we know about the world don't suggest other possibilities. Not that it matters though. Russia already did a lot worse, but US officials were so afraid to call it out, even downing MH17 was presented as if Russia "helped rebels" and didn't do it itself.

The support forum thread started by the developer is in russian (many people living in Ukraine speak both Russian and Ukranian so there is no contradictions with an Ukranian flag on the download page): https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567

zzzcpan 10y ago
And the author of the thing on the last page claims that many "packers" can be made to satisfy that signature.
- codedokode 10y ago
  Maybe he understood that things got serious and doesn't want to get extradited to USA.

zzzcpan 10y ago

Doesn't mean anything, the thing is still way more likely to be promoted inside the community than reaching international recognition or any international users really.

codedokode 10y ago

The download page earlier [1] had a Webmoney wallet identifier for donations. Webmoney is a russian payment system that was popular in 00's [2] in ex-soviet countries. [1] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [2] https://en.wikipedia.org/wiki/WebMoney https://en.wikipedia.org/wiki/WebMoney

waterphone 10y ago
To be clear, I'm not suggesting that it isn't Ukranian, or whatever, I was just pointing out the fact that the interface, etc., is in English and so there may be a wider "market" for the malware. It's consistent with the sort of malware I see on clients' infected WordPress installs semi-regularly.
- codedokode 10y ago
  I tried to Google "pas web shell" and "profexer pas download" (with option to search pages in any language) to understand the audience of a project. What I saw were mostly links to forums in russian (with reviews of the software or tutorials on how to use it), one chinese github account with a collection of web shells and english posts from people who found the backdoor and tried to understand what it was. So I got an impression that posts in english were mostly from victims and posts in russian were mostly from users. You can try google these words and see the results yourself.
- zzzcpan 10y ago
  The international market exists, but there is no evidence of the malware having any positions there or any efforts to promote it there, which is how things usually are. So, it is used mostly by Russians and Ukrainians and is known almost only among them. If you believe the intelligence agencies, it's only logical to believe that Russians did in fact do it. Simple estimates based on the things that we know about the world don't suggest other possibilities. Not that it matters though. Russia already did a lot worse, but US officials were so afraid to call it out, even downing MH17 was presented as if Russia "helped rebels" and didn't do it itself.