[Added] ArtMoney - App-Request

[OLLI_S]

Name of the app:

• ArtMoney

File Path:

• C:\Games\ArtMoney\am801.exe

Developer:

• System SoftLab

Website:

• http://www.artmoney.ru/

Download Site:

• http://www.artmoney.ru/e_download.htm

App-Icon: in ICO format

Notes:

• The icon is only available in 32 x 32 pixel
• There is a Special Edition (freeware) and a Professional Edition (that I have)
• ArtMoney is a tool to cheat games (search in memory for values and modify them) so ArtMoney is trying to be not detected by apps
• Unfortunately the AppInfo can not be read by GetAppDetails so I have to type here the values from the EXE file:
  • Description: am801
  • File Description: <empty>
  • Product Name: <empty>
  • Copyright: <empty>
  • File Version: 1.0.0.0
  • Product Version: 1.0.0.0
• In the list of installed applications in Windows 10 ArtMoney is listed:

[OLLI_S]

I released a new version of GetAppDetails right now where some bugs are fixed.
So here is the information stored in the EXE:

File name and path: C:\Games\ArtMoney\am801.exe
Product Name:       
Internal Name:      
Original Filename:  

File Description:   
Company:            
Legal Copyright:    
Legal Trademarks:   
Comments:           

File Version:       1.0.0.0
Product Version:    1.0.0.0

[Tom]

I'll put this one on hold for now. The primary purpose of our tool is to detect software that behaves "normally".

I will not rule out completely that we will support it at some point.

For now, it could be interesting if you kept updating this topic with new version and file info as it is released and then occasionally I will attempt to see if this can be detected reliably across other users.

[OLLI_S]

Here you need HASH values to detect it.

[Tom]

@olli_s You are probably right about that, but on the other hand, from your screenshot, there seems to be some useful information in the registry.

[OLLI_S]

OK, so just keep me updated.

[Tom]

This one will be postponed a bit more, as we need one small (but not very important feature overall) to properly support this

[OLLI_S]

Here is the version information of ArtMoney 8.01

File name and path:     C:\Games\ArtMoney\am801.exe
Product Name:           
Internal Name:          
Original Filename:      

File Description:       
Company:                
Legal Copyright:        
Legal Trademarks:       
Comments:               

File Version String:    1.0.0.0
File Version:           1.0.0.0
Product Version String: 1.0.0.0
Product Version:        1.0.0.0

---

Here is the version information of ArtMoney 8.02

File name and path:     C:\Games\ArtMoney\am802.exe
Product Name:           
Internal Name:          
Original Filename:      

File Description:       
Company:                
Legal Copyright:        
Legal Trademarks:       
Comments:               

File Version String:    1.0.0.0
File Version:           1.0.0.0
Product Version String: 1.0.0.0
Product Version:        1.0.0.0

[OLLI_S]

@Tom In my original posting I uploaded the app-icon in ICO-format.
So here is the app-icon in PNG-format:

[Tom]

@olli_s Do you still have this app?
I just stumbled upon this post, we and found that we have all the capabilities to detect it now. In fact I have made a "test" detection, so I can verify it next time you inspect a host with this app.

[OLLI_S]

@tom said in ArtMoney - App-Request:

Do you still have this app?

No, I am using Cheat Engine instead.
But I can install ArtMoney in my VM to prove the detection.
Should I?

[Tom]

@olli_s Up to you, but detection should be working.

[OLLI_S]

I installed ArtMoney in ny VM, but it is not detected by VulnDetect.

File name and path:     C:\Games\ArtMoney\am812.exe
Product Name:           
Internal Name:          
Original Filename:      

File Description:       
Company:                
Legal Copyright:        
Legal Trademarks:       
Comments:               

File Version String:    1.0.0.0
File Version:           1.0.0.0
Product Version String: 1.0.0.0
Product Version:        1.0.0.0

[Tom]

@olli_s Thank you.

I installed it just to verify that it is detected, and I can see that we started detecting it for a few other users as well.

So I'll mark this as Added.

[OLLI_S]

@tom ArtMoney is now detected properly.
Thank you for adding this!