Free, but easily detected. The public version of EZfrags is available for those who want to use our CS GO cheat, but do not mind if they get banned. The public version does not include any of our protection features to keep you safe from anti-cheats like VAC. We recommend that.
(Photo source: Pony Strike: Global Offense by FilipinoNinja95)
We recently found Counter-Strike: Global Offensive (CS: Go) hacks on macOS that is also a trojan that could mine CryptoCurrencies without user consent.
InsanityCheats provides the most popular free CSGO cheats in 2020. Our free hack is 100% undetected by VAC and has been since we launched. Join today and download our free CSGO cheat. In this video, you will see the presentation of the free cheat for CSGO, which has such basic functions as aimbot, wallhack, no reload. You can download it f.
According to VirusTotal Retrohunt, the threat is in the wild since the beginning of July 2017.
Warning: At the time of this writing, all URLs are live.
Entry Point: Vlone.cc Portal
The entry point is vlone.cc portal, where a user can Register, Login and Download for free the hack installer.
The domain name was registered through eNom in April 2017, 14th, and resolves to a shared web host at namecheap:
HTTPS certificate was delivered by COMODO PositiveSSL in June 2017, 27th.
When logged in, members can browse the Prices page and purchase a premium subscription for 1, 3 or 6 months through Selly:
Members download the same archive of the free installer than guests:
According to the user GET query value, members count in August 2017, 22nd, is nearly two thousand.
We don’t know if the private installer of the hack also installs the mining software without user consent.
Binaries analysis
Csgo Hacks For Mac 2019 Free
It’s all C++ Standard Library code. Network connections use libcurl and secure HTTPS protocol.
All executables, but the miner CLI, require super-user privileges, so the user must run the installer with sudo:
The main binary hides itself as Dynamic Web TWAIN, an online document scanning platform.
vHook
vHook is the installer. It is packed with UPX, probably to avoid user analysis and bypass some security products.
It is a command line interface:
With a valid member account, it downloads and extracts bootstrap.dylib and vhook.dylib from https://vlone.cc/portal/gateway.php as assets.zip to /Library/Application Support/:
It loads bootstrap.dylib from osxinj project. If Counter-Strike: Global Offensive is running, it downloads and extracts some fonts (https://vlone.cc/fontfix.zip as vlone.zip to /Library/Fonts/), and injects vhook.dylib into csgo_osx64 process.
It could be a perfect deal for a CS: GO user, but it turns out vHook also sneaky downloads and extracts https://vlone.cc/abc/assets/asset.zip as fonts.zip to /var/, changes directory to /var and runs sudo ./helper &.
It then kills Terminal application to hide the detached process output.
helper
helper is the miner downloader dropper. It is also packed with UPX.
It first asks the C&C server for the name of the binary to execute upon download:
It downloads https://www.vlone.cc/abc/assets/b.zip as /b.zip, extracts its contents to /var/.log/, changes directory to /var/.log/ and runs sudo ./com.dynamsoft.WebHelper &.
At the time of this writing, https://www.vlone.cc/abc/assets/b.zip URL response is a File Not Found 404 error code, but https://www.vlone.cc/abc/assets/bz.zip URL is live and send the expected archive.
com.dynamsoft.WebHelper
com.dynamsoft.WebHelper is the miner downloader. Despite the name, it is not related to Dynamsoft.
It starts by downloading and extracting:
WebTwainServicefromhttps://www.vlone.cc/abc/assets/d.zipto/var/.log/com.dynamsoft.WebTwainService.plistfromhttps://www.vlone.cc/abc/assets/p.zipto/Library/LaunchDaemons/
It loads the daemon, sends computer unique identifier (UUID) and its version to C&C server, and checks if it meetsRequirements(), i.e. running as root and not in a debugger:
It then sleeps for one hour. If one is in a hurry, he or she can cut out the nap easily:
Once rested, it sends commands to C&C server every minute to ask if it should mine and update or kill itself:
Every minute, it also creates or updates the mining thread to:
- download and extract
https://www.vlone.cc/abc/assets/helper.zipto/var/.trash/.assets/ - get miner settings (maximum core number, currency, email address)
- check if Activity Monitor is running
- check if it is already mining
- check if it should stop mining
- run
cd /var/.trash/.assets/; ./com.apple.SafariHelperwith appropriate arguments
WebTwainService
WebTwainService tries to take care of com.dynamsoft.webhelper persistency. It is again packed with UPX.
It sets its current directory to /var/.log and runs sudo ./com.dynamsoft.webhelper &, then recursively sleeps for one hour…
minergate-cli
com.apple.SafariHelper actually is the official MinerGateCLI v4.04:
It is written in Qt, so it comes with frameworks:
It takes as CPU as requested by com.dynamsoft.WebHelper so the user enjoys the delight of computer’s fans background music:
In this example, it is mining Monero (XMR) with all virtual machine cores (two: 200.0%).
Current MinerGate email address is pwnedboi@protonmail.com, and xxanax420@gmail.com email address was also found hardcoded in another sample.
Maximum core number, CryptoCurrency and email address are provided by com.dynamsoft.WebHelper and the C&C server:
vLoader
We finally ended up with vLoader, the private installer, and, once more, it is packed with UPX.
It does many checks against the C&C server:
They are trivial to bypass for anyone who can force a conditional jump:
Private payloads are downloaded and extracted to /var/.old/:
boots.dylibfromhttp://vlone.cc/clear/sadmio.zip.uhdexter.dylibfromhttp://vlone.cc/clear/getout.zip
Compared to the free injected library, the private hook is very similar:
vLoader doesn’t uninstall any of the free version naughty payloads.
Finn and ponies
We didn’t spend too much time reverse engineering vhook.dylib. The source code was available on GitHub (archive) and videos of the hack are also available on YouTube here and there.
GitHub owner of the vHook project is fetusfinn (original author is ViKiNG) and we coincidentally found debugger symbols matching Finn username in GitHub’s libvHook.dylib and in all analyzed binaries:
This is how we know Finn’s project name is pwnednet. Shortened to pwnet, it sounds like poney in French, i.e. pony in English and, everybody loves ponies, so here you have OSX.Pwnet.A!
There also is a reference to someone named Jennifer Johansson in Xcode user data:
We didn’t take the time to ask pwned’s boyfriend on Discord if Finn is much into ponies:
But, just in case, here is a Dutch Pony for Finn and her team.
From Hackestria with ❤
Cs Go Hacks Free Download
EDIT: added vLoader on 2017/08/29.
Sign up today, download undetected CSGO cheats, free and paid hacks available.
Abyss provides paid and free CSGO cheats perfectly crafted for cheating in CS GO allowing you to rank up safely while remaning undetected not just by VAC but by your friends and other players as well. Our CS:GO Cheat has every unique feature you need to stand out in Matchmaking, Dangerzone and Deathmatch, especially against other cheat providers. Our aimbot hack is super stealthy and very safe for use on prime accounts. Don't miss out! Download our Counter Strike Global Offensive cheats today!
Best CSGO Cheats
CSGO cheats wont ever be the same again after you try Abyss premium CSGO hack. Our legit aimbot features humanized technology enabling you to kill every enemy or cheater that stands before you while remaining undetected to spectators, team mates, enemies and most improtantly, VAC. Our visual cheats are smooth and give you the extra sense you need for victory. People often come back to Abyss as they find that the aimbot in our CSGO cheat is simply far superior when compared to other cheat providers and we have the best, fastest cheat support.
Legit CSGO Cheats
Our premium CS:GO Cheat has the best aimbot in the CS:GO scene in 2020 and it is impossible to detect by other players or by overwatch. Download our legit hacks in minutes, it is super fast and highly costumizable. Abyss CSGO cheats are perfect for legit hacking as they are coded in an entirely different way to every other cheat on the scene. We use humanized technology in our aimbot to produce aim assitance that mimics human movement, this is what seperates Abyss from other legit providers. People have been using our cheats on prime and matchmaking and are able to rank up without fear of detection.
Free CSGO Cheats
Abyss if proud to present our stream friendly free CSGO cheat that is undetected by VAC. Unfortunately it does not benefit from being secured by our premium loader which houses our paid cheat, however, it is brand new and has never been detected. Our cheat is OBS friendly which means you can record your gameplay for Youtube videos or stream with the cheats but without them being visible. This is also referred to as stream safe cheats or stream safe cheats and ours are totally free! After you register on the site the download link will be unlocked and you can download our free wall hacks.
Rage Hacks (HvH)
Even though our hack is the best for legit play, many users use our premium game hacks for raging in CS;GO as well. People call this HvH which stands for Hack Versus Hack. Rage hacks typically have faster aimbots which will kill enemies quicker than other cheaters can kill you. You might also want your hack to have backtracking for CS GO with your cs;go hacks. CSGO backtracking is vital these days as it allows you kill enemies in the position where they used to be previously. Backtracking works by taking advantage of lag compenation in counter strike global offensive, of course include this in our premium hacks.
Cheat Security
Our hacks are totally VAC safe, or undetected by VAC if you prefer. Nobody who has used Abyss has ever reported a ban from using our cheats. This is in part due to our security against VAC, we make it near impossible for VAC to detect this cheat. It means our cheat is safe for use in VAC servers and 100% undetected. Our developers work day and night to ensure that our premium CSGO hacks are online and undetected 24/7. We have the most experienced developers working on our CS GO cheats in 2020.
Cheat Download
Download Abyss undetected counter strike global offensive hack today if you want to try our miscellaneous features such as backtracking, rank revealer, spectator ESP or radar hack. Its very simple to download our CSGO cheat and we provide clear instructions how to download and install it. Download our hack, use it in game and not get reported by other players and you can use these CSGO hacks without fear of a detection by VAC for a very long time, possibly for the entire duration of 2020.
Cheat Features
Our premium cheat contains every feature you could need to be top of the leaderboard. Our aimbot hack is unlike any you have seen before, super smooth and almost impossible to detect and you can fit it into your playstyle without any problems. Our wallhacks (ESP) are very clear and well optimizied allowed you the perfect sixth sense to see players through walls and on your radar before they appear in game. We provide other useful features like a spectator list to show you who is spectating you in game.