- This topic has 16 replies, 11 voices, and was last updated 2 years, 6 months ago by
.
-
Posts
-
Generally speaking, there are two types of vendors in piracy. The ones that actually develop the cracks and the the ones that distribute them to the public. The ones that actually develop the crack sell them via private channels/forums to the "repackers". It is these repackers that add viruses and other malicious code to steal information from naive end users. Most pirated software that you encounter easily on the public internet are from these repackers. Rule of thumb: there is always a cost of hosting and bandwidth for distributing software freely. If you are unsure how the filehost is recovering those costs then it is highly likely that the software contains malware.
The repackers would then strongly advocate that any virus warnings are mere false positives, even sometimes going into details about how the crack needs to access memory and other running processes to generate keys or otherwise. I usually check the "behavior" section of the crack exe or dll in virustotal and compare those behaviors with the original exes. If there is any suspicious file/registry access or access to remote host that should not be happening, then its a red flag. For example, some of the earlier crack of m0nkrus used an exe to add hosts information in the etc/hosts file to prevent automatic license validation. Genuine concerns, but sloppy and suspicious implementations triggering virus warnings, when the same could have been achieved through direct means.
- You must be logged in to reply to this topic.
