Before starting a flame i want to say that i have NOT tried the Oxygen that has been shared on this thread but
i tried one (same version) that was shared originally in a telegram channel and that version (again, i'm not saying
that is the same that has been shared here but i think it's better anyone used it makes some checks) was infected
with an info stealer malware.
The checks you can do to verify if you have been infected are the following:
******************************************************************************************************
If you find any of these files on your system, there is a strong possibility that your
system has been compromised:
C:\ProgramData\CryptoServices\Cukeci.exe
C:\ProgramData\NetworkProvider\Ncitool.exe
C:\ProgramData\WindowsSecurity\MpCuon.exe
These 2 windows sytem dll are infected by the malware:
TokenBroker.dll in c:\windows\system32
TokenBroker.dll in C:\Windows\SysWOW64
In "C:\ProgramData\WindowsSecurity\" i found not only the exe
but also an sqlite db, it's called "storage.db"
It has 3 tables called "clipboard", "storage" and "disk" the only one with data for me
was the "clipboard" table, it contained 1512 records starting from the day i installed the infected copy of Oxygen
those records contained anythyng that had passed from my clipboard from that date.
Another feature of the virus is that it insert 3 tasks in the system task scheduler..
Task name: cloudServer
Command: "C:\ProgramData\WindowsSecurity\MpCuon.exe"
Arguments: "--run=Df2Srv2026 --app=sm-task --task-name=cloudServer --rid=1 --mutex-name=Global\sm-task"
Task name: MonctvStatus
Command: "C:\Program Files\Windows Mail\MpCuon.exe"
Arguments: "--run=Df2Srv2026 --app=sm-task --task-name=cloudServer --mutex-name=Global\sm-task"
Task name: Scanner
Command: "C:\ProgramData\CryptoServices\Cukeci.exe"
Arguments: "--run=Df2Srv2026 --app=scanner --task-name=Scanner --mutex-name=Global\sm-scanner"
*************************************************************************************************
I suggest making these checks, costs nothing and can save you from big problems
Rusya Bağlantısı (Gizli Sahiplik ve Geliştirme)
Türkiye Ayağı (Altyapı ve Distribütörlük)