Bitcoin Forum

Economy => Scam Accusations => Topic started by: marlboroza on May 04, 2019, 09:56:49 PM



Title: MASK - possibly malware
Post by: marlboroza on May 04, 2019, 09:56:49 PM
Announcement thread: [ANN] MASK [POW][CRYPTONIGHT]: THE MOST PRIVATE BLOCKCHAIN WITH 60 M (https://bitcointalk.org/index.php?topic=5139446.0)
Archive: http://archive.is/xqMNX
Announced by: https://bitcointalk.org/index.php?action=profile;u=2593898

Virustotal showed malicious activity in their windows wallet:

https://i.imgur.com/hD5uHnA.png

Reporting this to moderator


Title: Re: MASK - possibly malware
Post by: morvillz7z on May 04, 2019, 10:09:18 PM
That Russian dude again with his lame attempts to spread malicious wallets. I've lost count of all his fake ANNs.

This one, for example, is a copy of [ANN] 🚀 MASK 🚀 [POW][CRYPTONIGHT]: THE MOST 🤫 PRIVATE 🤐 BLOCKCHAIN WITH 60 MIXIN (https://bitcointalk.org/index.php?topic=4986394.0) and of course bitbucket or newly made github leading to those infected qt wallets. I wish mods would ban this fool.



Title: Re: MASK - possibly malware
Post by: TryNinja on May 04, 2019, 10:19:06 PM
100% malware. The exe creates a file called "file.exe" that has a rat/trojan called QUASAR.

See: https://app.any.run/tasks/1d504af9-c431-4c42-94c4-67ff782a3fb5

I wish mods would ban this fool.
Report him. He is not only plagiarizing other coin's ANN threads but spreading malware (which is against the rules).


Title: Re: MASK - possibly malware
Post by: morvillz7z on May 04, 2019, 10:29:09 PM
Report him. He is not only plagiarizing other coin's ANN threads but spreading malware (which is against the rules).

I have, not this account in particular but at least 7+ alts of his for the exact same thing - spreading malware.

One ended being banned (plagiarism), all others are still intact. Mods will only delete the thread, sadly.


Title: Re: MASK - possibly malware
Post by: marlboroza on May 04, 2019, 10:34:35 PM
Perhaps newbie jail could solve malicious attempts in altcoin section.
One ended being banned (plagiarism), all others are still intact. Mods will only delete the thread, sadly.
This is much bigger issue than plagiarism and they should be perma banned. It is strange they are not.


Title: Re: MASK - possibly malware
Post by: morvillz7z on May 04, 2019, 10:55:36 PM
This is much bigger issue than plagiarism and they should be perma banned.

It absolutely is and they should be banned!

I'll see if I can put a list tomorrow of all his accounts and fake announcement threads. I'd say there are at least 20 of those (all created within the last 30 days, most of which are gone; either deleted by a mod or self-edited/deleted).



edit; I take my words back, mods actually ban/nuke some of these accounts. Here's the list of his alts as promised:

KillRoy2005 (https://bitcointalk.org/index.php?action=profile;u=1172103) - not banned

Hezacez (https://bitcointalk.org/index.php?action=profile;u=2584432) - not banned

morthar (https://bitcointalk.org/index.php?action=profile;u=2382626) - nuked

MaBug (https://bitcointalk.org/index.php?action=profile;u=2585596) - not banned

s107n (https://bitcointalk.org/index.php?action=profile;u=1683391) - banned

AlexDuma (https://bitcointalk.org/index.php?action=profile;u=1079176) - banned

imreal (https://bitcointalk.org/index.php?action=profile;u=1334043) not banned, currently has one active fake ann (https://bitcointalk.org/index.php?topic=5137936), haven't checked wallet.

Kiokawa (https://bitcointalk.org/index.php?action=profile;u=2593283) not banned, has also one active fake ann (https://bitcointalk.org/index.php?topic=5139092) which is copy of this one (https://bitcointalk.org/index.php?topic=5055495.0), haven't checked wallet either.

I swear that there was another newbie account, but I can't remember his name right now. However, one thing I can assure you, he's not just going to stop, expect a lot more of these ANN...soon.


Title: Re: MASK - possibly malware
Post by: morvillz7z on May 07, 2019, 01:11:10 AM
I told you, it won't be long before he comes with new accounts. I haven't reported any of the two, and since your previous one came with a nuke, I'm going to leave it to you (if you don't have time, I will report it myself, but I can't promise mods will ban him). :P


[ANN] [BEAR] Voytek BEAR Coin (PoS->PoA 30% / Masternodes 70%) (https://bitcointalk.org/index.php?topic=5140050.0) fake ANN

[ANN] [BEAR] Voytek BEAR Coin (PoS->PoA 30% / Masternodes 70%) (https://bitcointalk.org/index.php?topic=5116171.0) original


[ANN] [PRX] [Masternode] [Staking] ProxyNode Network (https://bitcointalk.org/index.php?topic=5139999.0) - fake ANN

[ANN] [PRX] [Masternode] [Staking] ProxyNode Network - The Rebirth (https://bitcointalk.org/index.php?topic=5117769.0) original


Both GitHub wallet links replaced with bitbucket, both tested positive for DNS8 Malicious.