Wa Gateway | Multi device BETA | MPWA MD v8.0.0 ( Extended License )

[Gemes]

@Tomz can you please check this? infected with Win32/Wacatac.B!ml. (and maybe miner for linux too, didnt check)
First i thought its a false positive, until i found this in AdminController.php (witch is the single code in this file)

https://gyazo.com/fccc04b9cbc19794ac5d19abef528e3e

oh no i found this wacatac malware too
3 files admincontroller.php, settingcontroller.php and isverifiedlicense.php

 

[Morehere]

oh no i found this wacatac malware too
3 files admincontroller.php, settingcontroller.php and isverifiedlicense.php

Bro by which software you are scaning it?

 

[Morehere]

hello bro, please the zip file password not working.

Copy paste it correctly and check for the space

 

[Gemes]

Bro by which software you are scaning it?

regular windows defender maybe it false but you can verify it @Morehere

 

[Morehere]

regular windows defender maybe it false but you can verify it @Morehere

I'm using Norton and no infection alerts from this antivirus software.

 

[DragonMAX]

How to change the Device name - Google Chrome (M Pedia) to anything else

 

[erwinzzz]

Morehere updated Wa Gateway | Multi device BETA | V3.5.0 MPWA MD with a new update entry:

Update v4.0.0 Nulled (26 July 2022)



Read the rest of this update entry...

thanks to @Morehere for shared

 

[Morehere]

How to change the Browser name - Google Chrome (M Pedia) to anything else

Goto this file "\server\router\model\whatsapp.js" and search for 'M\x20Pedia' and change.

 

[kecoamumet]

Goto this file "\server\router\model\whatsapp.js" and search for 'M\x20Pedia' and change.

wow... there the script, im changing in waconnection.js not work. ty bro

 

[Rotsen]

Good how are you, I hope you are fine, I have been testing version 4.0, and I realized that you cannot use the same keyword with another user, so you cannot add the same contact with another user, does anyone know how it can be allowed it's ??

 

[jackabmarti120]

password please sir

 

[Morehere]

maybe, but what developer will encrypt + rand + eval on only 3 files and only 12 lines of code after decoded? and some of base64 string is encode twice witch is similar with a malware not for protection. This is my opinion and waiting for someone to confirm. PS: im not blaming anyone, its just for people who want to be safe

But I didn't got any infection alert from Northon antivirus. Is this antivirus will detect such malware?

 

[Rotsen]

But I didn't got any infection alert from Northon antivirus. Is this antivirus will detect such malware?

how are you the one that detects is the windows defender sent a screen

 

[Morehere]

how are you the one that detects is the windows defender sent a screen

Windows defender is disabled by my Northon antivirus .

 

[Morehere]

paid norton will detect, as malware bytes does

BTW, i got the untouched version.
2 of 3 files are not encoded + AdminController.php missing (witch ive searched where this file is called, nowhere).
Clearly this reseource is not safe, at least for me.
Peace

https://gyazo.com/ecbe7e1e51c95678358e091f519fbc7e

Share file. I will update your file.

Also I have paid Northon

 

[maswondho]

Here you are.

thank you ma brotha..

 

[average_coder]

I'm using Norton and no infection alerts from this antivirus software.

Same, I am also using Norton Security Ultra No infections found

 

[kecoamumet]

@Morehere i can not change the route/web.php file, it encrypted. i want to change the path of /register and other path. can you give the solution?

 

[Marvelz0x1]

paid norton will detect, as malware bytes does

BTW, i got the untouched version.
2 of 3 files are not encoded + AdminController.php missing (witch ive searched where this file is called, nowhere).
Clearly this reseource is not safe, at least for me.
Peace

https://gyazo.com/ecbe7e1e51c95678358e091f519fbc7e

What is the way to decrypt these files?

 

[Morehere]

paid norton will detect, as malware bytes does

BTW, i got the untouched version.
2 of 3 files are not encoded + AdminController.php missing (witch ive searched where this file is called, nowhere).
Clearly this reseource is not safe, at least for me.
Peace

https://gyazo.com/ecbe7e1e51c95678358e091f519fbc7e

Bro. You have old version file as per the code. Please check correctly before you post.