Maybe its worth to try https://www.spyshelter.com/ and reboot the system. If there is a keylogger or some other kind of evil software Spyshelter will find it. |
|
|
|
|
Basically Namecheap should remove their account for "electrumdiamond.org". But it seems to be difficult to contact the Namecheap support at all.
|
|
|
|
and ... the hackers wallet is online again: http://electrumdiamond.org/I think Github has kicked them. They have renamed the executable to version 3.0.5.3 and put it into the file system download directory. disgusting |
|
|
|
One million USD is such a big money. Someone is spying on you since you had a lot of portfolio in your system.
I am not the only victim of these criminals. And I think they did not spy directly on me but on people who downloaded and used their trap like BCD wallet malware. I guess you can't recover your coins since it is already been taken away from you. I can only advice is to make a seperate wallets that you will put 2FA for more security.
yes - I should have known it before. Now the damage is there. For sure I will not make that mistake again. And I will not recover from it anytime soon. I worked for many years to get together what has been stolen now. I'm so sorry for your lost. I hope you can recover your money / coins back. Last year, me and lots of people were scammed by coinsmarkets exchange and we never get back our's. Thread was locked ( I have never understand why it's locked ) but you can get some authorities' contact info and some advises. https://bitcointalk.org/index.php?topic=2185903.4060honestly contacting the authorities is always a good step in this kind of situation. If it helps is another kind of question. I assume that most of these criminals make a failure former or later which directs them into prison. But does it help the victims? Most times not. Anyways it might help to keep some out of this criminal business - like this one: Russian 'hacking genius' accused of $530 million 'dark web' fraud against Americans posed with tigers and crocodiles before his FBI-ordered arrest |
|
|
|
Now lets talk about passwords. Never EVER Re-use the same password anywhere, period. Use a password manager to generate a different random password for every site and service you use, and password protect that with a GOOD (2) password. If you have a password for your PC (which you should) make this also a good password different to the one in your password manager. Then every time you need to login to a site, use your password manager. This works better in a safer OS like Linux, BSD, etc; which is why permanently installing linux in another PC dedicated for such tasks is not such a bad idea (ie. your productivity separate from your gaming PC).
Passwords may be as good as they can. When they are stored in the same password safe the single password of the safe unlocks all of them. A password safe does not provide real security. At most it helps to distribute your passwords over many devices. 2fa is not panacea, but I'm not against you backing up the codes within the password manager, tho you could use a separate password file (with a different GOOD password) for that exclusive use, since you very rarely need the backups (only when your smartphone is lost); again much better to do this in a "secure" PC running a safer OS.
do not put backup codes in any password safe. They are only safe on paper and that only if they are read from the screen on a safe system. 2FA means to have a second independent source for the authentication - that is not given anymore if the backup codes are stored on the same system as the password - that is even true if a different password manager is used. |
|
|
|
...
To make Windows more secure anti keylogger, anti screen recording software and constant port checks need to be done. With my experience I would not use a non dedicated computer for crypto anymore - too late. For anybody: Use hardware wallets or dedicated computers without automatic updates
'without automatic updates' Why?  [/quote] because 'automatic updates' deploy new code on the computer which is a risk on itself - even if the original software is from a trusted source the updates may contain malicious code |
|
|
|
Where my wallet should be registered? which the best wallet? I didn't find any information about best wallet.
Use a hardware wallet for funds that exceed your daily expenses. All other wallets put your funds in danger of total loss |
|
|
|
OMG! That's enormous!, sorry for your loss, it would be of great help if you could elaborate where coins where held, is it a multi wallet(If Yes, which wallet ?) how it happen or what you could think have happened ? A malware installation, phishing site and or anything that is more specific.
@ Valerian77 => @Harkorede, i'm sorry about the loss. i wish you will be able to recover partial coin if, not full amount. i'll suggest any discussion should be made via pm. Harkorede, pls use PM when asking such question(s) in so doing Valerian77, can also reply and post detail info's to you via pm.* Otherwise, is not adviceable to post such info's on the public board where everyone including the person behind the act can easily access.If the attacker reads this thread he will not get any information that he doesn't have already. Regarding the method of hacking - it was a RAT attack in electrumdiamond. We understand the function of that malware pretty well now. From that and what was said before I recommend not to install anything whatsoever on your system what has not been electronically signed by a known entity. Virus and Malware check do not help to prevent such a scenario. |
|
|
|
A simple premium version of avast for less than 15 buck ...
Please Check the history of the thread. The critical file has been checked by virustotal and was marked ok. Avast and other virus checks wouldn't have helped. Basically that was the trap I was running in. To make Windows more secure anti keylogger, anti screen recording software and constant port checks need to be done. With my experience I would not use a non dedicated computer for crypto anymore - too late. For anybody: Use hardware wallets or dedicated computers without automatic updates |
|
|
|
By the way if you're going to use a windows box forget using standard AV tools. Microsoft's Defender is useless, as is most of the normal AV tools. A bit of recompiling and a little salt and an executable with a full reverse command shell can be installed in no time.
true Get a real EDR and AETD tool like SentinelOne, or Crowdstrike. They can usually spot fileless tricks in about 6-10 seconds, giving the attacker a pretty limited window to get a persistent session going. Granted they could loop but your system should scream about thousands of attacks being killed a minute, if you're not monitoring your system you're fucked.
Better option: 10 year old burner PC. Best option Kali type burner OS.
thanks - good hint |
|
|
|
Yes - be careful with that one!! I checked it and it is the same malware as before. |
|
|
|
this is funny (or not) Namecheap never reacted to the ticket. GitHub seamed to have taken down the repository for some days. But now its up and running again. I think that for some people holidays have started a little earlier, at this time of year support may be slower than usual. Have you followed Namecheap rules regarding the abuse reporting? Maybe they consider your case as Fraud scheme and they will not assist you if report is not made to https://complaint.ic3.gov . I have to admit it's strange that GitHub is reacted in that way, maybe they remove them, but they find a way to get back. Only thing we can do is to report them again. yes probably - it would be a mess if another person would become victim of this fraud Is there any progress in the investigation of your case?
yes there is - I will post the progress when it will not affect the investigation anymore |
|
|
|
this is funny (or not) Namecheap never reacted to the ticket. GitHub seamed to have taken down the repository for some days. But now its up and running again. |
|
|
|
And the scammer is online again: http://www.electrumdiamond.org/I just want to know how domain registry services and international police can allow these criminals to go on with their activities. |
|
|
|
Who can help me? Previously, Bitcoin was cheap, so I set up a password at random. I wanted to sell it, but I found that I had forgotten the password. Who can help me unlock? I can pay him 10BTC
Pictures can't be uploaded. Who can tell me how to upload pictures?
do you remember - the length of the password - used character set (small, big, numbers, special characters, ...) - a part of the password like prefix or postfix if it is truely random, out of 100 characters, longer than 12 characters, without any additional information you will not be able to recreate it |
|
|
|
|
@npole2000
that is the reason that security is very expensive for companies and anyone else
|
|
|
|
I think a good prevention mechanism everyone should note is how to do data verification. In other words, I mean verification of MD5, SHA-1 and SHA-256 hashes. Its some cryptography stuffs!
If you have the real checksums they can be used to check the real executable. But what would prevent a scammer from creating new hashes for his malicious software? If the executable would be downloaded from his site then the hashes would also be from there. Because of that I can just recommend anybody to use a dedicated device or hardware wallet for cryptocurrencies - do not expose your funds to thiefs and scammers. I wish I had taken these precautions myself in time. |
|
|
|
... By the answer Cherry Servers give to Valerian77 they are not obliged to disclose such information to anyone then "local law enforcement agencies in Lithuania". Dear Sir,
Despite the best intentions, I'm afraid we cannot help you in this situation. We do not reveal any information about services associated with our prior or current clients to third parties. As our company is registered in Lithuania, we are only accountable to local law enforcement agencies in Lithuania and can only reveal such information to them when obliged to do so by local law or when a Lithuanian court order is received. they are not obliged to any law enforcement other than their local in a first glance. But if they provide knowingly a platform for scammers, criminals and maybe terrorists then they will see how quickly they will be involved in international criminal cases also in other countries and compensation requests. |
|
|
|
I'm opening a legal complaint against Cherry Servers. Due to the low amount involved I can use the EU small claims (no lawyer is needed and it's all electronic). Instead of pursuing the hacker (I believe Valerian is doing it already), I will try to recover my money from Cherry Servers proving their negligence. The evidence to support the thesis is about the fact that Valerian contacted them about the illegal activities running on their servers, giving enough information to identify the customer and while they didn't wanted to disclosure the customer identity (perfectly legal without a court/police mandate) they didn't reacted, neither they care to check the server, leaving it operative for several days, so leaving the criminals doing more damage (including to me). I may have more chance to settle this due to their negligence, than try to find the "hacker", because it would cost me more money in lawyers than what they robbed. The EU law exonerates the providers/host of the illegal activities conducted on their network/servers provided that they are unaware of it, while obliges them to react immediately as soon they became aware of the illegal conduct. The email sent by Valerian is clear evidence that they became aware of it, but not having reacted immediately, they became co-responsible of every subsequent damage. Hopefully it will make progress. Honestly I will not investing much time in this, I mean I won't go in Lithuania to talk to them, and surely I won't spend another cent on this.  @Valerian: if you may provide to me in private the original conversation you had with Cherry Servers, it will greatly help! EU small claims is only for claims up to 5000 EUR. But sure I will give you the conversation with Cherry Servers. |
|
|
|
Feel so sorry for OP. A few days ago, i made an article of how Not all crypto apps in App stores are safe. I didn't give much on other wallets and apps in Github but reading through your story, this is even more serious than phishing attempts through fake apps. Am going to update my thread using this experience (i hope it's okay) with major focus on the app in question so that new users can know how grave this matter can be. I wish you all the best in an attempt to try and net that/those culprit(s) ok - do not forget all the other scam wallet like fake BTCP etc. Nothing is safe before you are 100% sure about the source of an executable. And in case its possible that no virus protector shows an indication |
|
|
|
|
Show Posts
