LilyJade again

Lilyjade is back and has moved up in the world. After Google chrome prevented the installation of extensions from sources other than the official webstore (due to the actions of malicious extensions such as lilyjade), lilyjade had a problem. Rather than explain the complicated steps needed to bypass the restriction, lilyjade spreaders have bypassed the restriction by registering at the webstore. Here are some lilyjade scripts hosted on the chrome webstore.

https://chrome.google.com/webstore/detail/demcpmafdoldpikmeijecnejbdhalegf

https://chrome.google.com/webstore/detail/imifilddnbnjclipnefjdpjkipbchmdk

https://chrome.google.com/webstore/detail/amoobcjlpgloocplpikcldcpjjdnoeii

Example extension:https://chrome.google.com/webstore/detail/eijbdinddjecmebnlienfoijpjjobkjh

They only have around 800 users between them, hinting at a pretty dismal performance for lilyjade’s vaunted spreading ability.

The sites used to host scripts are here:
Main script is still at the same site, just a different url

http://lilyjadev2.com/panel/cache/c059ca83c22e28bfd712343a23f3327a.js

http://jsbeautifier.org/ is handy for looking at this.

The new google ads id is:pub-0321047848968757

Additional scripts

https://fbapprep.com/classict.js

https://fbapprep.com/external_script.js  404 right now

https://fbapprepoa.com/adbrite.js

New dropbox account

https://dl.dropbox.com/u/62399492/wau.js

https://dl.dropbox.com/u/62399492/AdInjecting.txt

There is one “Webplayer Extention Update” extension and two “Dislike – Final” extensions. The fourth extension appears to be an example extension provided by the developers.
The two “Dislike – Final” extensions actually function as disliking applications due to wholesale code theft from another disliking extension. The facebook disliking code appears to have been ripped out and plugged into lilyjade, and still uses the website of the other extension to keep track of dislikes. The other coder is now having to deal with people bitching about ads on his extension page because people have the shitty lilyjade version.

New spreading attempt appears to be buying “viral” likes on semi popular facebook pages.

https://www.facebook.com/permalink.php?story_fbid=428298427209006&id=296121079380
https://www.facebook.com/ROcker.Fans.Club/posts/293496637424171
https://www.facebook.com/permalink.php?story_fbid=435033876543529&id=244254240771

Urls used for spreading

Facebook dislike extensions

http://fbappupdater.com/APPUPDATER/

https://fbapprepoa.com/APPUPDATER/

https://fbapprep.com/APPUPDATER/

Webplayer update extension

stalkerwatcher.info/GameofThronesS03E01.html

A bit.ly url was used to redirect to the page opened after first installing, so we can see the install statistics by adding a + to the end of it. 

https://bitly.com/NQuM9J+

Not very impressive.

Two other generic lilyjade extensions

http://www.marketingconceptsreview.com/BrowserExtension.crx

Panel url:http://lilyjadev2.com/panel/cache/629b10b5a8e89fe616bf887ab7e44825.js

Google ads id: pub-7182608930620297

http://dl.dropbox.com/u/94625960/google.crx

Panel url: http://lilyjadev2.com/panel/cache/a07b28af1d4a3f792484645a326eb202.js

Google ads id: ca-pub-2957341046889941

Download link

Thanks to whoever posted this:http://pastebin.com/KW8tEvt9