TamperedChef within GTA V/FiveM mods report - ModsHub / Network Graphics
This is ModsHub (formerly FiveMods) - a GTA V/FiveM software claiming to have over 1,2 million active users. It falls under the family TamperedChef.
It shares similarities with previous TC-classified software - e.g. it collects a lot of system user data, provides extensive logging, various backup domains, obfuscated C2 communication and scheduled task set to autorun every day at 18:00 with a custom argument.
We have also discovered a more capable variant (which does not fall under the same business/network) called Network Graphics that includes for example WebSocket connection that shares undeniable similarities with ModsHub - the code, technical functionality, behaviour and code signer Danylo Babenko are all almost identical.
Full report: https://rifteyy.org/report/tamperedchef-within-gta-v-modding-community