|It's stars, you fools.|
Corvus is an ARG that began with secrets hidden within a VR game studio's promotional images.
A gallery of secrets
The VR game studio Subreality Studios posted a reddit thread promoting their new Discord server and linking to an Imgur gallery containing screenshots of their currently released games. Small letters were hidden in these images, spelling out
This was another Imgur gallery link, depicting the constellation of Corvus.
Users investigating the ARG in the Subreality Discord server were given a special Corvus role, allowing them into a private #corvus channel. Three messages have been posted by the Mee6 Discord bot to that channel.
01/01/2017 at 5:01 AM
01/01/2017 at 6:00 PM
=Unch5mb1R3c1NGI1RWdwBXYsxWZgUnbhRXQ, when reversed, decodes from Base64 to
Atanu ellappudu custunnaru, which is Telugu and translates roughly to "he always watches".
d41d8cd98f00b204e9800998ecf8427e is the MD5 hash of an empty string.
c50267b906a652f2142cfab006e215c9f6fdc8a01c27680133b781cadd037e8a6dcc001b is the concatenation of a 40 character string
c50267b906a652f2142cfab006e215c9f6fdc8a0 and the 32-character string
1c27680133b781cadd037e8a6dcc001b. The first one is the SHA-1 hash of
www and the second – the MD5 hash of
sniper, leading to http://subrealitystudios.com/sniper/ on the Subreality Studios website.
The /sniper page contained an embedded Imgur image that has yet to be solved.
After a few more hours, the Mee6 bot posted another message:
01/01/2017 at 9:41 PM
This was found to be octal, and led to a YouTube video https://www.youtube.com/watch?v=PvJXZuQsLmA. The description of the video contains the same Telugu phrase as before, "Atanu ellappuḍū cūstunnāru." Within the video there is a sticky note on a door, which seems to have more words:
The larger word above turned out to be in a language called Gurmukhi; the word is ਖਾਲੀ, and means "empty," according to Discord user taru. This continues the theme of the empty hash from earlier.
Sunbaked and Crow's Calling
At this point, Discord users Jeppevinkel and jumpre discovered that there were two more pages added to the Subreality Studios website. Jeppevinkel discovered http://subrealitystudios.com/sunbaked/, which contains a pixelated image of a red herring, implying that it is a dead end. Jumpre discovered the page http://subrealitystudios.com/crowscalling/, which contains the image of a text message conversation containing a hash:
This hash has yet to be solved.
Discord user jumpre discovered that the empty hash that was found was a password for the Google Account that had posted the video (the hash in the username decodes to "lotb"):
username: [email protected] password: d41d8cd98f00b204e9800998ecf8427e
The only thing of note within this account is a single email draft, which contains:
This decodes to