← cases

UNOPLAY.ME - DISCORD MALWARE (HADES)

CASE_ID: HADES-UNOPLAY-2026-09
TARGET: HADES Infostealer & RAT
DATE: September 08, 2026
ATTRIBUTION: Türkay (turkay)
REPOSITORY: unoplay.me-hades_malware
TELEMETRY: 59 Rooms / 144 Members

1. Attack Vector & Front-End Delivery

The infection chain originated from a domain impersonating an online multiplayer card game:

The website provided a functional multiplayer lobby where visitors selected nicknames and custom avatars. Once inside, the host used social engineering to convince the victim that the web client was only a waiting room. When the host clicked "Start Game", the client triggered an automated notification:

The host started the game. Continue in the UnoPlay app.

Simultaneously, the operator reiterated in chat: "You need to download it."

2. Payload Anatomy & Static Analysis

The downloaded executable presented the following specifications:

Deconstruction of the Electron Archive

Extracting resources/app.asar revealed that the author avoided plain JavaScript to bypass heuristic antivirus engines. The core logic was compiled into V8 bytecode:

Cryptographic String Table

All operational strings within app.protected.jsc were encrypted using AES-256-CBC. Static analysis of the initialization routines recovered the master key:

Decryption of the 688 embedded strings identified the binary as a customized build of the HADES Infostealer & Remote Access Trojan (RAT).

Reconstructed 24-Module Source Code Architecture

By mapping bytecode segment boundaries and decrypting local constant pools, we reverse engineered the entire original source tree into 24 distinct JavaScript modules (now open-sourced in the repository under decompiled_malware/source_code/):

3. Malware Capabilities & Internal Mechanics

A. Browser Credential & Session Exfiltration

The malware targets 15 browser families (Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Slimjet, Orbitum, Atom, Torch, Amigo, CocCoc, Uran, Firefox).

B. Cryptocurrency Wallet Theft

The wallet.js module systematically searches for desktop cryptocurrency wallets (Exodus exodus.wallet, Atomic leveldb, Electrum) and targets specific browser extension keystores by extension ID:

C. Discord Hooking & QR Code Blinding

The binary inspects %APPDATA%\Discord (including Canary, PTB, and Vesktop) and patches desktop_core/index.js with a persistent webhook listener. To prevent users from using mobile QR authentication (which bypasses credential entry), the malware injects SVG replacement code:

<svg height="160" viewBox="0 0 37 37" width="160"><rect width="37" height="37" fill="#ffffff"/></svg>

This renders the QR login box completely white, forcing victims to manually input credentials and 2FA recovery codes, which are intercepted immediately.

D. Remote Access Trojan (RAT) & Browser Wiper Protocol

The malware maintains a real-time bidirectional Socket.IO connection to the C2 server for interactive remote control, exposing the following remote commands:

E. Anti-Analysis & Hypervisor Detection

The AntiVM.js module performs multi-layered pre-execution checks:

F. Ransomware Lockscreen Artifacts (kilit.png)

Forensic inspection of the downloaded lockscreen image (https://i.hizliresim.com/oojtro9.png) revealed key authoring metadata:

4. Network Telemetry & C2 Infrastructure

Parameter Value Description
C2 Host ytfg6bx9mvkh.hellodcuser.com Primary Command & Control server (Apex: hellodcuser.com)
C2 IP Addresses 93.127.179.240, 77.37.83.120 Hostinger International Ltd (AS47583, Lithuania/Cyprus)
Registrar NameSilo, LLC Registration date: June 17, 2026 at 14:01:20 UTC
x-tg-id 8690153935 Immutable 64-bit Telegram user ID receiving victim log archives
x-license-key B31C6E241AC846728DA9C1FAC4936651CFFB944D143AB816276BCC6DA0284787 HADES MaaS commercial customer license token
System Mutex HADES_zz_390E413A8CCC2D4B43FEF926519C2070 Operator build tag (zz)

REST API Exfiltration Endpoints

All exfiltration HTTP POST requests require three mandatory headers (x-tg-id, x-license-key, x-hwid); missing headers return the hardcoded Turkish error: "❌ Eksik parametre: adminID, licenseKey ve hwid zorunludur."

5. The Cloud Database Pivot (Supabase Telemetry)

Reverse engineering the client-side JavaScript on unoplay.me revealed that lobby synchronization was managed entirely by Supabase:

Because the tables lacked Row-Level Security (RLS) read restrictions, we queried the REST endpoint and dumped the entire operational dataset across the campaign lifespan:

6. Forensic Evidence & Threat Actor Attribution

A. Direct Confession & Real Identity

At 23:40 UTC on September 6, 2026, the operator created room 9274M2F under his real identity:

[2026-09-06 23:40:26] turkay: naber (what's up)
[2026-09-06 23:40:32] turkay: sovme la essek (don't curse, donkey)
[2026-09-06 23:40:39] turkay: bura bizim anonim yer ("this is our anonymous place")
[2026-09-06 23:40:47] turkay: burdan gizli verileri aktarcaz ("we will exfiltrate the secret data from here")
[2026-09-06 23:40:51] turkay: ayiktin ("you get it?")

In an earlier room (VU4EJQ3, created at 23:11 UTC), associate qwe confirmed the operator's name in plain text:

[2026-09-06 23:12:12] qwe: alalhını sıkeyım turkay

B. Social Engineering Personas & Lures

The operator rotated through several female gamer personas (clove, Nadja, Lina, cccccc, ffe, yuy):

C. Linguistic & Turkish Origin Artifacts

D. Comprehensive Campaign Metrics

7. Judicial Subpoena Targets & Remediation

The completed forensic dossier established actionable subpoena targets for law enforcement (Emniyet Genel Müdürlüü Siber Suçlarla Mücadele Daire Başkanlığı, USOM, FBI IC3, Interpol):

  1. Telegram Legal (ID 8690153935): Subpoena for registered phone number (MSISDN), account creation timestamp, registration IP address, and login history.
  2. NameSilo, LLC (Domain hellodcuser.com): Account subscriber records, payment transaction details, and DNS modification IP logs.
  3. Hostinger International Ltd (IPs 93.127.179.240, 77.37.83.120): VPS customer identity, payment receipts (crypto/credit card), and SSH connection logs (/var/log/auth.log).
  4. Supabase, Inc. (Project myvuxkwbjpdkxaaonded): Project owner email, linked GitHub/Google developer profile, and dashboard management IP audit trails.
  5. Dropbox Abuse: Terminated malicious mirror for file ID fgw8s8ooovxntjlyapwp6.

8. Analytical Conclusions & Code Repository

This case highlights a common asymmetry in contemporary cybercrime: while the adversary deployed commercial crimeware evasion (V8 Bytenode compilation, AES string encryption, Chrome CNG DPAPI bypasses), operational security collapsed completely at the architecture and communication layers:

OPEN_SOURCE_REPO: github.com/straculencuandrei/unoplay.me-hades_malware
INCLUDES: 24 Reconstructed JS Modules, Decrypted Strings, Supabase JSON Dumps