TEMP: Investigation into scotaloo

[🏰 TradeFortress 🏰]

I don't see why I should

[r3wt]

I don't see why I should

there's more smoke and mirrors in here than a whore house on the French Riviera

[🏰 TradeFortress 🏰]

I actually don't give a fuck about the IP 49.176.67.225

Yes, I've used it before. I've been doing some digging on a RAT file that has the phone home set to my IP:

BTCTalkAccs pointed me to this virustotal analysis of a DarkComet/DarkKomet RAT with the name 'minecraft.exe':

https://www.virustotal.com/en/file/9970283d1c08091f9260a5bbbc76220ed7b88b75d8352bcbfe35c4730f608262/analysis/

This RAT is set to phone home to: 58.111.143.105:200, which is my IP and on the port 200. However, this is quite meaningless as anyone can do that - it's no different than linking to another webpage. This is the first time I became aware of 'minecraft.exe', and a search on 9970283d1c08091f9260a5bbbc76220ed7b88b75d8352bcbfe35c4730f608262 doesn't turn up anything.

It also has the file name MSRSAAP.EXE, which turns up on virustotal here:

https://www.virustotal.com/en/file/4589cc7f0791e87906da850d27306637d01a71fb6aca9cee74be84c5bfff65c2/analysis/

The SHA hash doesn't also turn up anything other than virustotal on Google, but there are a lot of info on the name MSRSAAP.EXE.

http://answers.yahoo.com/question/index?qid=20120219155647AAN5JIV
http://softwaredownloadpro.com/question14580.html
http://translate.googleusercontent.com/translate_c?depth=1&hl=en&prev=/search%3Fq%3DMSRSAAP.EXE%26safe%3Doff%26client%3Dfirefox-a%26hs%3DFi4%26sa%3DN%26rls%3Dorg.mozilla:en-US:official%26biw%3D1920%26bih%3D940&rurl=translate.google.com&sl=ru&u=http://otvet.mail.ru/question/76611000&usg=ALkJrhiiM8v8n5hHgMTrWiy8ZWjVQYIGJg

This malware has been posted by the user "manolz" as some anti-anticheat or something:
http://www.gamersoul.com/forums/showthread.php?185177-Hackshield-AntiHook-NoShield-0-1-beta/page3

Also on youtube by "iCrack Trainers" (shell youtube account):
http://www.youtube.com/watch?v=VaKLmM40428

So, there's two possibilities:

1) I've been spreading malware disguised as anticheat bypasses and trainers for games that has been documented in English, Chinese and Russian while using my own IP address and have been doing it from 2012 or earlier decides to make a new RAT and upload it to virustotal and do nothing with it.

2) Someone who wants to frame me / plant false evidence and has a history of making game-related malware makes a new RAT that connects to my IP and port 200 (which isn't even open), uploads it to virustotal and does nothing with it.

If you look at the date (2013-06-09), you'll see that exactly a week earlier MoneyPakTrader got butthurt that I penetrated his website (which deals with currency exchange) - without doing any malicious damage - and found my IP address:

https://bitcointalk.org/index.php?topic=223665
June 02, 2013, 05:36:28 PM

(I also have some other info on MoneyPakTrader, in relation to some of his other suspicious activites).

Given by the dates of MSRSAAP.EXE, I think it's also possible that it back when I was running a tor exit node on this IP and someone wanted to cloak their identity and tried to use Tor to do that. Obviously it didn't connect (not only is the port not open, but also you can't use tor to do this AFAIK as the command server packets will not be tunneled back), so they did nothing with minecraft.exe and somehow this was uploaded on June 09th (maybe because they got arrested, had HDD seized and had all the files analyzed)? I'm still leaning towards MoneyPakTrader.

You decide. Thanks for digging that out, BTCTalkAccounts!

[scotaloo]

I actually don't give a fuck about the IP 49.176.67.225

So is that a refusal to answer? Are you giving theymos permission to check the logs and disclose if its your IP or not?

It's best that you just choose an answer now and stick to it, there is a lot the community does not know...

[🏰 TradeFortress 🏰]

I actually don't give a fuck about the IP 49.176.67.225

So is that a refusal to answer? Are you giving theymos permission to check the logs and disclose if its your IP or not?

It's best that you just choose an answer now and stick to it, there is a lot the community does not know...

If by "your IP" you are asking if I used it or not, then yes

I'd actually like to thank you for bringing minecraft.exe to my attention.

[scotaloo]

If by "your IP" you are asking if I used it or not, then yes

Great that's all I needed to know thank you and good night.

[🏰 TradeFortress 🏰]

Don't you already know it's not night where I am from?

 

[scotaloo]

I actually don't give a fuck about the IP 49.176.67.225

Yes, I've used it before. I've been doing some digging on a RAT file that has the phone home set to my IP:

BTCTalkAccs pointed me to this virustotal analysis of a DarkComet/DarkKomet RAT with the name 'minecraft.exe':

https://www.virustotal.com/en/file/9970283d1c08091f9260a5bbbc76220ed7b88b75d8352bcbfe35c4730f608262/analysis/

This RAT is set to phone home to: 58.111.143.105:200, which is my IP and on the port 200. However, this is quite meaningless as anyone can do that - it's no different than linking to another webpage. This is the first time I became aware of 'minecraft.exe', and a search on 9970283d1c08091f9260a5bbbc76220ed7b88b75d8352bcbfe35c4730f608262 doesn't turn up anything.

It also has the file name MSRSAAP.EXE, which turns up on virustotal here:

https://www.virustotal.com/en/file/4589cc7f0791e87906da850d27306637d01a71fb6aca9cee74be84c5bfff65c2/analysis/

The SHA hash doesn't also turn up anything other than virustotal on Google, but there are a lot of info on the name MSRSAAP.EXE.

http://answers.yahoo.com/question/index?qid=20120219155647AAN5JIV
http://softwaredownloadpro.com/question14580.html
http://translate.googleusercontent.com/translate_c?depth=1&hl=en&prev=/search%3Fq%3DMSRSAAP.EXE%26safe%3Doff%26client%3Dfirefox-a%26hs%3DFi4%26sa%3DN%26rls%3Dorg.mozilla:en-US:official%26biw%3D1920%26bih%3D940&rurl=translate.google.com&sl=ru&u=http://otvet.mail.ru/question/76611000&usg=ALkJrhiiM8v8n5hHgMTrWiy8ZWjVQYIGJg

This malware has been posted by the user "manolz" as some anti-anticheat or something:
http://www.gamersoul.com/forums/showthread.php?185177-Hackshield-AntiHook-NoShield-0-1-beta/page3

Also on youtube by "iCrack Trainers" (shell youtube account):
http://www.youtube.com/watch?v=VaKLmM40428

So, there's two possibilities:

1) I've been spreading malware disguised as anticheat bypasses and trainers for games that has been documented in English, Chinese and Russian while using my own IP address and have been doing it from 2012 or earlier decides to make a new RAT and upload it to virustotal and do nothing with it.

2) Someone who wants to frame me / plant false evidence and has a history of making game-related malware makes a new RAT that connects to my IP and port 200 (which isn't even open), uploads it to virustotal and does nothing with it.

If you look at the date (2013-06-09), you'll see that exactly a week earlier MoneyPakTrader got butthurt that I penetrated his website (which deals with currency exchange) - without doing any malicious damage - and found my IP address:

https://bitcointalk.org/index.php?topic=223665
June 02, 2013, 05:36:28 PM

You decide. Thanks for digging that out, BTCTalkAccounts!

Quoted for future reference. I am not BTCTalkAccounts btw, that wasn't even my nick on IRC pay attention.

[scotaloo]

Don't you already know it's not night where I am from?

 

Lol! G'day mate!

[🏰 TradeFortress 🏰]

Quoted for future reference. I am not BTCTalkAccounts btw, that wasn't even my nick on IRC pay attention.

Yes you are, BTCTalkAccs !== BTCTalkAccounts but BTCTalkAccs == BTCTalkAccounts.

Also, I am going to laugh so hard when you go off 49.176.67.225 for a reason I'm not about to tell you yet.

[scotaloo]

Quoted for future reference. I am not BTCTalkAccounts btw, that wasn't even my nick on IRC pay attention.

Yes you are, BTCTalkAccs !== BTCTalkAccounts but BTCTalkAccs == BTCTalkAccounts.

My nick was BTCTalkAcc, that doesn't imply I am an alt of BTCTalkAccounts or something, thats all I was trying to say lol!

[🏰 TradeFortress 🏰]

My nick was BTCTalkAcc, that doesn't imply I am an alt of BTCTalkAccounts or something, thats all I was trying to say lol!

I've got some pretty hard evidence, and also have information on the other phishing operations (like furrycoat - not saying that's directly related to you).

Also, I'm not sure if you understand but I didn't want BTCTalkAccounts banned (yet) for a reason. Should become more clear with the mega thread but I'm waiting for info (no, not the fake ones you get people to send to me) from a few people.

Btw, re scotaloo:

And morally I see nothing wrong with phishing, people gave me their passwords so they deserve to learn the lesson the hard way

[DiamondCardz]

TF, do you have a current list of all known BTCAccs alts?

[greyhawk]

TF, do you have a current list of all known BTCAccs alts?

I don't think they have invented hard drives that large yet.

[DiamondCardz]

TF, do you have a current list of all known BTCAccs alts?

I don't think they have invented hard drives that large yet.

Oh god, win

[krudkeeper]

if i were you id stop using a certain vpn

If I were you I'd know to shut up about now. You think I already didn't know about that? you think I'm actually still using that VPN? lolplz

if i was cayce franklin id.

Hi,
My account was hacked by this guy. I am the real Cayce Franklin. The guy said on other recent posts (scams) that his name is Mark. I have since changed my password. My apologies if this has caused you any trouble. I have never even been to Minneapolois or anywhere else in Minnesota.

All I am doing is running a website called rainingbitcoin.com . I don't want anyone's money or Bitcoin, I don't mine, use asics, build them, or want to start an ipo. (these were some of the idiot's posts using my account). I am also not 13. I am 33. Hope you find him. Sorry for any inconvenience this may have caused you (Lord knows it has caused me a lot today)

[Kouye]

Hi,
My account was hacked by this guy. I am the real Cayce Franklin. The guy said on other recent posts (scams) that his name is Mark. I have since changed my password. My apologies if this has caused you any trouble. I have never even been to Minneapolois or anywhere else in Minnesota.

All I am doing is running a website called rainingbitcoin.com . I don't want anyone's money or Bitcoin, I don't mine, use asics, build them, or want to start an ipo. (these were some of the idiot's posts using my account). I am also not 13. I am 33. Hope you find him. Sorry for any inconvenience this may have caused you (Lord knows it has caused me a lot today)

Then you were hacked by someone in scotaloo's ennemies team.
Which would mean they both play dirty. But have you been hacked, really ?

[krudkeeper]

Hi,
My account was hacked by this guy. I am the real Cayce Franklin. The guy said on other recent posts (scams) that his name is Mark. I have since changed my password. My apologies if this has caused you any trouble. I have never even been to Minneapolois or anywhere else in Minnesota.

All I am doing is running a website called rainingbitcoin.com . I don't want anyone's money or Bitcoin, I don't mine, use asics, build them, or want to start an ipo. (these were some of the idiot's posts using my account). I am also not 13. I am 33. Hope you find him. Sorry for any inconvenience this may have caused you (Lord knows it has caused me a lot today)

Then you were hacked by someone in scotaloo's ennemies team.
Which would mean they both play dirty. But have you been hacked, really ?

Yes. I actually haven't been on here in a few days. They got my password somehow and changed it but I changed it back. I chat with you on coinchat i believe for the past few months. I don't know who scotaloo is or his enemies. I just run the website shown on my avatar. That's all. Plain and simple.

[🏰 TradeFortress 🏰]

Have you entered anything into bitcoin - talk.org?

[🏰 TradeFortress 🏰]

Hi,
My account was hacked by this guy. I am the real Cayce Franklin. The guy said on other recent posts (scams) that his name is Mark. I have since changed my password. My apologies if this has caused you any trouble. I have never even been to Minneapolois or anywhere else in Minnesota.

All I am doing is running a website called rainingbitcoin.com . I don't want anyone's money or Bitcoin, I don't mine, use asics, build them, or want to start an ipo. (these were some of the idiot's posts using my account). I am also not 13. I am 33. Hope you find him. Sorry for any inconvenience this may have caused you (Lord knows it has caused me a lot today)

Then you were hacked by someone in scotaloo's ennemies team.
Which would mean they both play dirty. But have you been hacked, really ?

Or hacked by scotaloo or hacked by the other phisher..