u/dsrules

i've been seeing much more people saying that they got pwned by malware from one of fitgirls various hosts so I did some digging, its much more devious than I expected.

#1: if you dont have uBlock, a frame will be injected into the various hosting services that fitgirl uses for the files. It's not a matter of clicking the wrong Download button, the FIRST click you make in the browser will redirect you to this malicious chain

`filecrypt.cc` is the worst offender by far, it will sometimes show you a fake Cloudflare captcha that redirects you to a base64 encoded file with the malware.

they accidentally left the comments in for this, gg

/*

this function will build an link on our own domain i'm to lazzy to always write

domain.tld/Link/hashid.html

so, openLink(hashid) is way more nice, additionally we need the JS "tricks"

"DANGER" "DANGER" "DANGER".....

GipsyDanger ;)

*/

var openLink = function(link_id, t, h) {

// MEGA SECURE NOW, AWESOME.

if (

_DOMAIN.indexOf('192.168') == -1 &&

_DOMAIN.indexOf('localhost') == -1 &&

_DOMAIN.indexOf('filecrypt.cc') == -1 &&

_DOMAIN.indexOf('filecrypt.to') == -1 &&

_DOMAIN.indexOf('filecrypt.co') == -1 &&

_DOMAIN.indexOf('staging.') == -1

) {

// just in case you are wondering, yes, this is our domain ....

_DOMAIN = 'https://www.filecrypt.cc/';

}

// LOOK AT MY NEW VERSION, AMAZING? i escape the link_id.

if (typeof(h) == 'undefined' || !h) {

// o.O dare you open a popup, well "new tab" is needed ....... even a moron should know this.

window.open(_DOMAIN.replace('https:', 'http:') + 'Link/' + escape(link_id) + '.html');

} else {

// DAMN, changing a location on the own domain... Haxx0r level 300, WOW GODNESS.

top.location.href = _DOMAIN.replace('https:', 'http:') + 'Link/' + escape(link_id) + '.html';

}

// DEAR KASPERSPY ;), this is absolutely harmless.. i guess, i mean, WOW WE ARE MEGA HAXX0RS but

// even you should see, changing a class on a button element... wow mega awesome.

if (!t.hasClassName('singlebutton') && (typeof(h) == 'undefined' || !h)) {

if (t.hasClassName('stream')) {

t.addClassName('streamed').removeClassName('stream');

} else {

t.addClassName('downloaded').removeClassName('download');

}

}

}; // << ---- LOOK, i even closed the function with a ";" like we all learned in IT school?! no?

I uploaded this to YT over a year ago but kept it unlisted, but I think others would appreciate this. Directed by Jack Silberman and produced in Canada, it documents the cluster bombing and leaflet campaign during Vietnam in Laos. This documentary is 99% the source of the Yanqui artwork. Bombies came out before the terrible "america has a package for every country" video that is usually cited as the source.

Cover art footage
https://youtu.be/vaFRHX0Pw2s?t=1071&is=lmGVvRh5UzMsDHvn

Possibly footage of the photo insert from the packaging

https://youtu.be/vaFRHX0Pw2s?t=1003&is=D\_J\_H3cAdan4Kvgd

I haven't been able to determine what operation this was though, this specific bomb only seems to have been used sparingly, possibly as a test. If anyone out there is a plane or bomb or 'nam guy, maybe you can help me out here?