shavitush

MawaStealer

Introduction

Nyaa. You're probably familiar with it if you're a stinky weeb like me. But if you're not, it's a torrent tracker; it allows users to upload torrents and to use their server as a tracker. In the past, the website allowed for registrations.
Ever since the website was flooded with child pornography and malware, they closed down on registrations years ago & disabled guest uploads, so only old accounts exist, and uploads are mostly fine. Occasionally, accounts are stolen and are used for spreading malware in the form of torrents.

Earlier today, 2025/09/11, there was a malicious archive uploaded to the website. It was titled Dr. STONE - Science Future - S04E21.zip. Advertises itself as a pirated copy of episode 21 in the 4th season of the anime series "Dr. STONE". The issue is that the contents of the file are actually a few unrelated items..

shavitush

aCharacterActionData =
{
    BSTR_INIT("walk1"),
    BSTR_INIT("walk2"),
    BSTR_INIT("stand1"),
    BSTR_INIT("stand2"),
    BSTR_INIT("alert"),
    BSTR_INIT("swingO1"),
    BSTR_INIT("swingO2"),
    BSTR_INIT("swingO3"),

shavitush

#pragma once

#include <any>
#include <cstdint>
#include <fstream>
#include <filesystem>
#include <xxhash.h>

class file_not_found_exception : public std::runtime_error
{

shavitush

template<typename T>
T sig_scan(const uint32_t dwStart, const uint32_t dwEnd, const uint8_t abPattern[], const char aMask[], const size_t dwPatternSize)
{
	for(uint32_t i = dwStart; i < dwEnd; i++)
	{
		for(uint32_t x = 0; x < dwPatternSize; x++)
		{
			const uint8_t bMemory = *reinterpret_cast<uint8_t*>(i + x);

			if(aMask[x] == 'x' && bMemory != abPattern[x])

shavitush

Windia client mods

Note: Anticheat related features are omitted from this list for obvious reasons.

1. !notice uses a custom color
2. .ini configuration
3. @vote integration
4. Added minimize button for the game client window
5. Airborne teleporting

shavitush

original word - filter
cookiezi - used to be "obama", "justin bieber" and "kettle". filter is removed now.
cookiez - used to be "lady gaga", now removed
dress - used to be "rainbow", now removed
cheat - break the law
ppv2 - pp
gay - coconut milk
fgt - lieutenant
nigger - fine sir
loli - fine lady