Report Malware and Suspicious Links here so Mods can take Action !

[lovesmayfamilis]

Another Sold/Hacked account was posted TYPEX Ann topic with Malware download links.

Another fake thread and possibly hacked hero account.

Account: knightkon Please Ban
Ann Fake: [ANN] [TYPX] TYPEX - A secure & untraceable blockchain with AI applications

Code:

[b]Windows:  [/b][url=https://github.com/RadiumXMain/Typex/releases/download/1.5.2/Typex-win64-v.1.5.2.zip]https://github.com/typex-coin/Typex/releases/download/1.5.2/Typex-win64-v.1.5.2.zip[/url]

every help and report is appreciated.

Yes, always use this link reference to report to Github, and now it has been reported, let's wait for the update, even though it takes a while, at least we have tried.

another
https://bitcointalk.org/index.php?topic=5522760.0

[Lafu]

And again there is another new Fake Ann with a new Fake Github donwload Link with Malware , copy and pasted from DigitalNode !

Fake Github Wallet download was just created 5 Hours ago.

Fake Github : github.com/phlddsy/DigitalNote
Real Github : github.com/DigitalNoteXDN

Code:

The sandbox CAPE Sandbox flags this file as: MALWARE
The sandbox Zenbox flags this file as: MALWARE TROJAN EVADER RAT

Startup Folder File Write
Potential Raspberry Robin Registry Set Internet Settings ZoneMap
ET MALWARE Remcos 3.x Unencrypted Checkin
ET MALWARE Remcos 3.x Unencrypted Server Response

Malware.SwollenFile!1.E38A (CLASSIC)
W32.Adware.Gen

Source : https://www.virustotal.com/gui/file/0a7ab7dcd3f0ff7ae5bbbbf52f293526be78500d48eeef01809758b6bd95ee3e

Account : Yanisumin  <--- Please ban or Lock that Account and delete the Thread
Registered since   February 25, 2016,
Last post was back in September 22, 2018  , Hacked or sold Account

They just copied and pasted from Original Ann and changed some things!
Fake Ann Thread :  [ANN] DigitalNode [XDT] - PoW/PoS, Masternodes, Untraceable encrypted messaging

DigitalNode

Code:

[b]Windows:[/b] https://github.com/phlddsy/DigitalNote/releases/download/2.0.1/DigitalNode-qt.win64.zip
[b]Linux:[/b] https://github.com/phlddsy/DigitalNote/releases/download/2.0.1/DigitalNote-qt.linux.arm64

Original Ann Thread :  [ANN] DigitalNote [XDN] - PoW/PoS, Masternodes, Untraceable encrypted messaging

This post is also a reference for the Github Report !

[$crypto$]

And again there is another new Fake Ann with a new Fake Github donwload Link with Malware , copy and pasted from DigitalNode !

Another one came a FAKE thread with a malicious download via GitHub, and the same copy from DigitalNode.

Account: wahyuagung26 please ban
Ann FAKE: [ANN] DigitalNode [XDT] - PoW/PoS, Masternodes, Untraceable encrypted messaging

Code:

[b]Windows:[/b] https://github.com/DigitalNode-main/Wallet-GUI/releases/download/2.0.1/DigitalNode-qt.win64.zip
[b]Linux:[/b] https://github.com/DigitalNode-main/Wallet-GUI/releases/download/2.0.1/DigitalNode-qt.linux.arm64

Official link thread:
ANN] DigitalNote [XDN] - PoW/PoS, Masternodes, Untraceable encrypted messaging
Real Github : github.com/DigitalNoteXDN

[LoyceV]

Newbie Jordan19ward posted this archived post:

you may check this video of opening wallet.dat without passphrase

That's not how encryption works. The spam on Youtube has a link to a "Bitcoin Core Wallet - Cracked". That's either malware, or trying to sell fake software. Or both. Either way, don't do it.

The Youtube video is 2 hours old.

[Lafu]

And again we have a new Fake Ann Thread with an Fake Website and where you have the Fake Wallet Malware download this time for True Pepe Coin (TPC) !
Same pattern as it was for the other Fake Websites and Wallet downloads.

Fake Github : github.com/True-Pepe/Pepe-Core

Fake Website:

Code:

https://truepepe.com/

Fake Wallet download on the Website:

Code:

https://palegreen-cheetah-217044.hostingersite.com/wp-content/uploads/2024/12/truepepe-qt-windows.zip

The Fake Wallet File has the same shit in it as the other got , shady things !

Code:

The sandbox Zenbox flags this file as: MALWARE TROJAN EVADER RAT

Drops script at startup location
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Dot net compiler compiles file from suspicious location
Suspicious DNS Query for IP Lookup Service APIs
PowerShell Script Run in AppData
Startup Folder File Write

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
ET MALWARE Generic AsyncRAT Style SSL Cert
(http_inspect) invalid status line
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)


StartupProfileData-Interactive
powershell.exe.log
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RegAsm.exe.log
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempup.url
C:\Users\user\Documents\20241218\PowerShell_transcript.040965.JDM0d755.20241218190013.txt

Win64:Evo-gen [Trj]

Source : https://www.virustotal.com/gui/file/11fef0ecf812a7bc626148b8bfaaf36c226e9c37f715815a958413bdccae9ca4/behavior

Account : TruePepe  <--- Please ban or Lock that Account and delete the Thread
The Account was just created yesterday

Fake Ann Thread :  [ANN] 🌟 True Pepe Coin (TPC) - Where Memes Meet Majesty! 🌟
As always the Thread is self-moderated

True Pepe Coin (TPC)

Code:

[b]Windows Wallet:[/b] https://truepepe.com/#wallets
[b]Linux Wallet:[/b] https://truepepe.com/#wallets 
[b]Website:[/b] https://truepepe.com

This post is also a reference for the Github Report !

[Ambatman]

I don't know if this is the thread for this
But these are some suspicious users that shared same suspicious link.
I think there was a thread or something of Mitchell to report Spam similar to these.

It has been reported and could be removed anytime soon.


Edited : they are Back again
https://bitcointalk.org/index.php?topic=5523377.0

[Mitchell]

[...]

I don't know if this is the thread for this
But these are some suspicious users that shared same suspicious link.
I think there was a thread or something of Mitchell to report Spam similar to these.

It has been reported and could be removed anytime soon.

Thank you for reporting. We were discussing it in this topic: This Free Amazon Giftcards Method spammers.. New scam has been added to my bot.

[N.O]

One more member rank sold/hacked account posted Fake Ann topic with malicious download links for STRONG$ Coin.

Account Link: Makingsure <<<<Please ban this account

Fake ANN thread: [ANN] [STR$] STRONG$ Coin - kHeavyHash | PoW please remove this topic

Code:

[b]Windows:[/b] https://github.com/Strongs-release/STRONGS/releases/download/1.0.1/STRONG.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/Strongs-release/STRONGS/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

This post is used as reference for Github Report!

[Lafu]

We have again a new Fake Ann Thread with an Malware download Link from an Fake Github and Webpage and copied from Pepecoin this time its Shibacoin !

The Fake Github was created 20 Hours ago.

Fake Github : github.com/shibacoinppc/shibacoin

Fake Webpage :

Code:

https://shibainucoin.net/

Fake Wallet download from the Webpage:

Code:

https://shibainucoin.net/wp-content/uploads/2024/12/shibacoin-qt.zip

If you download the Wallet File instant Windows Defender will get activated and gives you a warning.

There is a Trojan in that Wallet File:

Code:

Trojan:Script/Wacatac.H!ml

Virustotal : https://www.virustotal.com/gui/file/a5fa2f90ca03d52c41875c4f07574ea6e921845c8a1dd9a7b5e1d24d6d3ca495/detection

Trojan:Script/Wacatac.H!ml

The Wacatac trojan virus, also called Wacatac.b!ml or Trojan:Win32/Wacatac, is malware that infiltrates computer devices and performs various malicious actions.
It pretends to be legitimate software but injects your device with malware to steal and compromise your data.

Source : https://www.astrill.com/blog/how-to-remove-wacatac-trojan-virus/

Also the whole and most thing is copied and pasted from Pepecoin.
Even its written that its a clone from Pepecoin its Fake and just Malware Shit.

I checked also the Pepecoin Wallet File (last update on that was 4 days ago) and there is nothing.
Virustotal for Pepecoin is clean : https://www.virustotal.com/gui/file/0df90ce84518f1bd827f67fb4900785ce4bfa422304f1a0bc768c0d2489fdf63/detection

Account : shibapow24  <--- Please ban or Lock that Account and delete the Thread
Its a new Account and was just registered today.

Fake Ann Thread :   Shibacoin pow scrypt coin

Shibacoin pow scrypt coin

Code:

Website: https://shibainucoin.net/
Github: https://github.com/shibacoinppc/shibacoin

This post is also a reference for the Github Report !

[Crypto Library]

It's begging only
I got one! Spreading the phishing link.It's looks like new strategy they just put the qr codes on the website and that directly asked to open the apps.

Account: Witcher420 (should be ban immediately)

I made a fun way to collect coins for local help

https:// witcher420 . github. io/Tossacoin/

Please check and leave your feedback or suggestions to modify

View Archive



https://www.virustotal.com/gui/url/9e50f3a01cde3f6bcb3cee513ffe7a2e83baddd312ff5d1cf2946316b491697c

[Lafu]

And we have another new Fake Ann with an Fake Website and an Fake Github with a Malware download Link on the Website this time for Dogger Coin (DGR) !

The Fake Github was created just 14 Hours ago.

Fake Github : github.com/DOGGERCORE

Fake Webpage :

Code:

https://doggercore.com/

Fake Malware Wallet download Link:

Code:

https://doggercore.com/wp-content/uploads/2024/12/dogger-qt-windows.zip

I even cant download the Wallet File as Windows and Windows Defender instant tell me that its a Virus or Malware.

Account : DoggerOfficial  <--- Please ban or Lock that Account and delete the Thread
The Account is just 2 days old , Hacker Account

Fake Ann Thread :  [ANN] 🐾 Dogger Coin (DGR) - From Bark to Blockchain! 🚀

Dogger Coin (DGR)

Code:

https://doggercore.com/
https://github.com/DOGGERCORE/DOGGERCOIN

This post is used as reference for Github Report!

[Mitchell]

I got one! Spreading the phishing link. It's looks like new strategy they just put the qr codes on the website and that directly asked to open the apps.

[...]

The QR codes are harmless. They just contain `bitcoin:` / `dogecoin:` URI's, which will trigger your wallet apps to open. Totally normal and expected (and not phishing/harfuml).

It is however begging and not allowed.

[Crypto Library]

I got one! Spreading the phishing link. It's looks like new strategy they just put the qr codes on the website and that directly asked to open the apps.

[...]

The QR codes are harmless. They just contain `bitcoin:` / `dogecoin:` URI's, which will trigger your wallet apps to open. Totally normal and expected (and not phishing/harfuml).

It is however begging and not allowed.

My mistake,,,, yea I am seeing that it's only begging.
Actually, at the first look it was suspicious for me and when I checked with the virus-total and see that the 1st qr bring me to open my wallet I thought it's a phishing link........
by the way thanks, It will remind me to look out more deeply these things on the next time .

[Lafu]

Just posting this here now to have watch on that Ann Thread as it looks like it is a Fake Ann!

Same scheme as always from the Hackers with an sefl-moderated Thread and a cheap random Webpage.
Also the Github link in the thread was just created 2 days ago .

Account :  long-network
The Account is just 1 Day old

Suspicious Thread : [ANN] [LNGC] Longcoin: Empowering Global Collaboration and Innovation

[LNGC] Longcoin:

Code:

https://long-network.com
https://long-network.com/#wallets
https://github.com/long-network/core

Suspicious Webpage and download Link there :

Code:

https://long-network.com/
https://services-long-network-com.preview-domain.com/wp-content/uploads/2024/12/longcoin.7z
https://services-long-network-com.preview-domain.com/wp-content/uploads/2024/12/longcoin-qt-linux.tar.gz

As the File there cant be downloaded for some reason i cant check it and there is no proof for a Malware Wallet.

But all suspicious evidence and the same sheme is here , will be watching this Thread.

[btc_angela]

Just posting this here now to have watch on that Ann Thread as it looks like it is a Fake Ann!

Same scheme as always from the Hackers with an sefl-moderated Thread and a cheap random Webpage.
Also the Github link in the thread was just created 2 days ago .

Account :  long-network
The Account is just 1 Day old

Suspicious Thread : [ANN] [LNGC] Longcoin: Empowering Global Collaboration and Innovation

[LNGC] Longcoin:

Code:

https://long-network.com
https://long-network.com/#wallets
https://github.com/long-network/core

Suspicious Webpage and download Link there :

Code:

https://long-network.com/
https://services-long-network-com.preview-domain.com/wp-content/uploads/2024/12/longcoin.7z
https://services-long-network-com.preview-domain.com/wp-content/uploads/2024/12/longcoin-qt-linux.tar.gz

As the File there cant be downloaded for some reason i cant check it and there is no proof for a Malware Wallet.

But all suspicious evidence and the same sheme is here , will be watching this Thread.

I did try to run it on Virustotal and here are the results:



https://www.virustotal.com/gui/url/e2beaf2224688bdb6b68cc926c4517e1011b51b6786343968b36d455c934386e



https://www.virustotal.com/gui/url/48701549c28f62b50f147c451de8ae5cc5be236572e5d040e95230d9d9fbfb01

And Windows Defender automatically delete it when I try to download and check.



So it has been flag by both, so definitely that links has malware in it.

[Lafu]

And i was right and now i have the evidence that its a Fake Ann with an Fake Webpage and Malware Wallet download for [LNGC] Longcoin !

The Fake Github is only 4 days old.

Fake Github : github.com/long-network

Fake Webpage and Fake Wallet download Link there :

Code:

https://long-network.com/
https://services-long-network-com.preview-domain.com/wp-content/uploads/2024/12/longcoin.7z
https://services-long-network-com.preview-domain.com/wp-content/uploads/2024/12/longcoin-qt-linux.tar.gz

Zenbox flags this file as: MALWARE TROJAN EVADER RAT

Code:

Drops script at startup location
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Dot net compiler compiles file from suspicious location
Suspicious DNS Query for IP Lookup Service APIs
PowerShell Script Run in AppData
Startup Folder File Write

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
ET MALWARE Generic AsyncRAT Style SSL Cert
ET INFO Observed DNS Query to Commonly Abused Preview Domain (preview-domain .com)
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
C:\Users\user\AppData\Local\Temp\RegAsm.exe
C:\Users\user\Documents\20241226\PowerShell_transcript.019635._nBkIR+H.20241226130004.txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempup.url

Win64:Evo-gen [Trj]

Source : https://www.virustotal.com/gui/file/ef27c49ed817f7b8f55dfbe4accd1493473004dbcda3ea699b10a2ea6f855e12/behavior

Account :  long-network  <--- Please ban or Lock that Account and delete the Thread
The Account is just 3 Days old

Fake Ann Thread : [ANN] [LNGC] Longcoin: Empowering Global Collaboration and Innovation
The Fake Ann is also self-moderated as always from the Hackers.

[LNGC] Longcoin:

Code:

https://long-network.com
https://long-network.com/#wallets
https://github.com/long-network/core

This post is also a reference for the Github Report !

[N.O]

We have found a new Fake Ann topic with virus wallet for Medusa Coin and hacked/sold account was posted

Account link : boymuhammad <<<< Please Ban this account

Fake Ann topic: [ANN] Medusa Coin - POW + POS + Masternode please remove this topic

Original topic: https://bitcointalk.org/index.php?topic=5520901.0

Code:

[b]Windows:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Windows.zip
[b]Linux:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Linux.tar

This post is used as reference for Github Report!

[N.O]

Another Full member hacked/sold account was published fake Ann topic for Medusa Coin.

Account link: crafty <<<< Please ban account

Fake Ann topic: [ANN] Medusa Coin - POW + POS + Masternode please remove topic

Code:

[b]Windows:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Windows.zip
[b]Linux:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Linux.tar

This post is used as reference for Github Report!



Another sold/hacked account posted Fake Ann topic with virus Links for Binarium.

Account link: superstarbtc <<<<Please Ban this account

Fake Ann topic: [ANN] [BNRM] Binarium -100% POW CPU/GPU Minable (GhostRider) | SmartNodes

Code:

[b]Windows:[/b] https://github.com/Binarium-release/Binarium/releases/download/2.1.1/Binarium-win64-v2.1.1.zip

This post is used as reference for Github Report!

[$crypto$]

Fake threads and accounts hacked or sold by spreading Malware viruses via Github downloads.

Fake ANN: [ANN] [BNRM] Binarium -100% POW CPU/GPU Minable (GhostRider) | SmartNodes
Account: Valovut

Code:

[b]Windows:[/b] https://github.com/Binarium-release/Binarium/releases/download/2.1.1/Binarium-win64-v2.1.1.zip

The Github account was created yesterday and just created the repository an hour ago.
Just reported it, hopefully it will be acted upon sooner.


Another fake thread

Fake ANN: [ANN] Medusa Coin - POW + POS + Masternode
Account: Valovut

Code:

[b]Windows:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Windows.zip
[b]Linux:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Linux.tar

This Github account has been reported as well and this link is for reference.

[$crypto$]

Another fake thread + possible account sold or hacked.

Account: SaveOurSea Please ban
Fake ANN: [ANN] Medusa Coin - POW + POS + Masternode

Code:

[b]Windows:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Windows.zip
[b]Linux:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Linux.tar

Will report this Github again so it can be blocked immediately.


Edit
Fake thread comes again. please ban

account: Crypto_Tribunal
Fake ANN: [ANN] Medusa Coin - POW + POS + Masternode

Code:

[b]Wallets[/b]

[b]Windows:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Windows.zip
[b]Linux:[/b] https://github.com/medusa-main/Medusa/releases/download/1.0.1/Medusa-Linux.tar