Report Malware and Suspicious Links here so Mods can take Action !

[examplens]

I guess this can be reported here

Account: TerryW he should be banned or at least have his link removed from the account profile page.
Website link in profile:

Code:

https://darknetbible[.]info/bible/cryptocurrencies/

The site from the profile is a copy of the original onion site on the Tor network: http://biblemeowimkh3utujmhm6oh2oeb3ubjw2lpgeq3lahrfr2l6ev6zgyd.onion/
The questionable site sends visitors to phishing links of certain exchanges. This is a page dedicated to the whole case https://namecheapscamexpose.info

[$crypto$]

It looks like that they always and in the last weeks only going for that one Coin " [STRS] STRONGS Coin - kHeavyHash " from what i have been seen.
I also reported some of them even i dont have written here as you are was faster on that.
Yesterday i just have seen that topic when i was coming back to home after work and instant tagged the User and reported that thread.
Here again you was faster as me to write here and i really appreciate that very much.
Would be nice if more new and old Users take care about it and look after this kind of things.

Yes, when I saw this fake thread, I immediately reported it to the moderators and reported the thread here for faster action because I was afraid that other people would download the malware, so I did my best when I saw this thread immediately.
I have also reported this fake github to them but unfortunately it is still not blocked.

[Lafu]

Yes, when I saw this fake thread, I immediately reported it to the moderators and reported the thread here for faster action because I was afraid that other people would download the malware, so I did my best when I saw this thread immediately.
I have also reported this fake github to them but unfortunately it is still not blocked.

Thanks to you , and its always good to report that kind of things when you see them , really appreciate that !
Sometimes i dont have the time to write that kind of stuff here but i report them and tagg them so that others see whats going on.
There are already some other threads now that are in the Altcoin section that got my attention.
I guess that a few or one of them Fake Anns , but i havnt looked deeper in it.

[$crypto$]

There is another fake thread with [ANN] [STRS] STRONGS Coin they are as usual spreading malware downloads via github.

Account: Baskentliia It is possible that the account was hacked.
Fake ANN: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW

Keep reporting on this fake Github account by referencing this link!

[Crypto Library]

Here is another the fake thread including malware, this time come with another member account this is also maybe hacked account.

Account: husnanparebok (should be ban immediately)

[ANN] [STR$] STRONG$ Coin - kHeavyHash | PoW

Topic Archive View

[cygan]

i think that this post fits best here...
in its new report for 2024, the FBI's internet crime reporting center relayed that there has been a surge in cryptocurrency-related scams.
there were more than 140,000 complaints of cryptocurrency scams over the past year, leading to a staggering financial loss of as much as $9.3 billion
we also learn from the report about the drastic year-on-year increase in losses - we can see a jump of 66% compared to 2023, when the total loss was 'only' $5.6 billion


https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf

[Lafu]

And we have a new Fake Ann with an Fake Github Account , this time its for Fivebalance FBN !

The Fake Github Account was just created 4 days ago

Fake Github : github.com/fivebaIanceID
Real Github : github.com/fivebalanceID

Looks like the same Github but the Fake Github has fivebaIanceID and the real Github has fivebalanceID .

If you download the Fake Github Wallet its the same as we got in the past from that Malware Shit Fake Anns:
First and the one Detection is :

Code:

Python/TrojanDownloader.Agent.AMK

And the behavior of that File is this :

Code:

The sandbox Zenbox flags this file as: MALWARE EVADER

Drops script at startup location
Search for Antivirus process
Renamed AutoIt Execution
DarkGate - Autoit3.EXE Execution Parameters
Startup Folder File Write
Potentially Suspicious CMD Shell Output Redirect

Source : https://www.virustotal.com/gui/file/eca32e68acfcbaffd4d71fb02b4b7fc341898fa8c64ea9073e0701e2dcd14292/behavior

Account : fivebalance_ID  <--- Please ban or Lock that Account and delete the Thread
This Account was just registred yesterday.

Fake Ann Thread :  [ANN] Fivebalance — Self-Improvement Platform + Crypto Ecosystem Powered by FBN

What is Fivebalance?

Code:

https://fivebalance.com
https://github.com/fivebaIanceID/Fivebalance_V3/releases/tag/v3.3.0

Original Ann Thread : [ANN] POS+MN FIVEBALANCEUSA Relaunches their Self Improvement App
Account : fivebalance

FivebalanceUSA
https://github.com/fivebalanceID

This post is also a reference for the Github Report !

[$crypto$]

As fake threads proliferate again --- there is a possibility of hacked accounts spreading fake threads again.

Account: nakata121 Possible hacked accounts
Fake ANN: [ANN] Mulierum | POW | GhostRider

Wallet:

Code:

[b]Windows:[/b] https://github.com/Mulierum-blockchain/Mulierum/releases/download/1.3.1/Mulierum-win64-v1.3.1-1.zip
[b]Linux:[/b] https://github.com/Mulierum-blockchain/Mulierum/releases/download/1.3.1/mulierum-linux-QT-v.1.3.1.tar.gz

[N.O]

We have found a new Fake ANN thread for $STRONG Coin with malicious download links.

Possible sold/hacked account

Account link: greggy327 <<<< Please Ban this account

Fake Ann topic: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW please remove topic

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

This post is used as reference for Github Report!



One more Sold/hacked account posted fake Ann topic with virus links

Account Link: curtis777 <<< Please Ban this account

Fake ANN thread: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

This post is used as reference for Github Report!

Edited

Highly possible this account cryptowarrio8i
 sold/hacked and published fake topic for $STRONG Coin

Account link: cryptowarrio8i <<< please Ban that account

Fake ANN Topic: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

This post is used as reference for Github Report!

[N.O]

Today, we again found a new Fake ANN topic for Mulierum with Malware wallet links and a junior sold/hacked account posted it.

Account Link: kermitas <<< Please Ban this account

Fake ANN topic: [ANN] Mulierum | POW | GhostRider please remove that topic

Code:

[b]Windows:[/b] https://github.com/Mulierum-blockchain/Mulierum/releases/download/1.3.1/Mulierum-win64-v1.3.1-1.zip
[b]Linux:[/b] https://github.com/Mulierum-blockchain/Mulierum/releases/download/1.3.1/mulierum-linux-QT-v.1.3.1.tar.gz

This post is used as reference for Github Report!


One more sold account posted virus download links for $STRONG Coin.

Account Link: Utopia <<< Please Ban this account

Fake ANN topic: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW please remove that topic

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

This post is used as reference for Github Report!

[$crypto$]

If you notice --- lately there have been many newbie accounts that have just woken up immediately spreading fake [STRS] STRONGS Coin posts, but fortunately after a few seconds the post was immediately deleted, has this been included in the bot so that it is automatically deleted?

But thank goodness because some of the accounts that spread this have been banned.

[Mitchell]

[...]
has this been included in the bot so that it is automatically deleted?
[...]

Yes, my bot is hunting em down.

[Ms_Mining]

Account: phwizard  <= Please Banned
Fake Ann topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS)

Explorer

Code:

https://explorer.perfix.io    coming soon          

Wallet

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

[Lafu]

Account: phwizard  <= Please Banned
Fake Ann topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS)

Explorer

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

Yeb it was for sure an Fake Ann with Malware , i was already on the way to write it here down but you was faster.

The Fake Github was just created 4 Hours ago.
And also if you look at the detections from Virustotal what i have done its the same as we got in the last or past weeks when you check the Files.

Fake Github : github.com/Perfix-blockchain/

Code:

The sandbox CAPE Sandbox flags this file as: MALWARE

Malware.SwollenFile!1.E38A (CLASSIC)

Startup Folder File Write 
ET MALWARE Remcos 3.x Unencrypted Checkin
ET MALWARE Remcos 3.x Unencrypted Server Response

Source : https://www.virustotal.com/gui/file/4ebdd280302b5c7cd4e2b2680b957fe634c60d45754c8f5db1c2bc1d2da5b70b/behavior

Maybe Mitchell can take that also in his bot as i assume that we will see more of them in the future.
We got already a lot of the same Fake Anns in the past with " PerFix " over the last years.
Can be seen here : https://ninjastic.space/search?title=perfix

[N.O]

We have found a new Ann topic for PreFix with virus wallets links and hacked/sold account posted it.

Account Link: _backslash <<<< Please Ban this account

Fake ANN Topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS) please remove topic

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

This post is used as reference for Github Report!


One more hacked/sold Full member account spread malware links with Fake Ann topic for PreFix.

Account Link: 5thFear <<< please Ban this account

Fake ANN topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS)

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

This post is used as reference for Github Report!

[Ms_Mining]

Account: BitcoinVideoPoker  <= Please Banned
Fake Ann topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS)

Explorer

Code:

https://explorer.perfix.io    coming soon

         

Wallet

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

Account: redline71  <= Please Banned
Fake Ann topic: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW

Wallet:

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

[Lafu]

And we have again a new Fake Ann Topic with an Fake Github Account and Malware download Link , this time for Telestai TLS

The Fake Github Account was just created 3 Days ago!

Fake Github : github.com/Telestai-Projec
Real Github : github.com/Telestai-Project

Its the same sheme and things that we got already in the past from other Fake Anns

CAPE Sandbox flags this file as: RAT

Code:

Win64:Malware-gen
Python/TrojanDownloader.Agent.AMK

Drops script at startup location
Search for Antivirus process
Renamed AutoIt Execution
DarkGate - Autoit3.EXE Execution Parameters
Python Image Load By Non-Python Process
Startup Folder File Write

Source : https://www.virustotal.com/gui/file/54c9b9d96bd9367178ed92e46159a3a6dd4a7e4ebde5cd9b19af7819fe9fa543/behavior

Account : Telestai-Project  <--- Please ban or Lock that Account and delete the Thread
The Account is new and only 4 days old.

Fake Ann Thread :  [ANN] Telestai — Fair-Launch GPU Coin Powered by Meraki | Decentralized Identity

Telestai

Code:

Core Wallet Release: https://github.com/Telestai-Projec/telestai/releases/tag/2.1.7

This post is also a reference for the Github Report !

[Ms_Mining]

Account: Bright_dhykseen  <= Please Banned
Fake Ann topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS)

Explorer

Code:

https://explorer.perfix.io    coming soon   

     

Wallet

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

[N.O]

We have found a new Ann topic for $STRONG Coin and hacked/sold account posted it.

Account Link: Saver1224 <<<<Please Ban this account

Fake ANN Topic: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW please remove that topic

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

This post is used as reference for Github Report!


Add one more account report

Account link : Morphyx

Fake ANN topic: [ANN] [STRS] STRONGS Coin - kHeavyHash | PoW please remove topic

Code:

[b]Windows:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Win64.zip
[b]Linux:[/b] https://github.com/STRONG-chain/STRONG/releases/download/1.0.1/STRONGS.-v.1.0.1-Release-Linux.tar.gz

We have found a new Ann topic for PreFix with virus wallets links and senior hacked/sold account posted it.

Account Link: brituspol <<< Please Ban this account

Fake ANN topic: [ANN] PerFix - Trusted & Secure Crypto Project (POW+POS) Please Remove this topic

Wallet

Code:

https://github.com/Perfix-blockchain/Perfix/releases/download/1.2.0/PerFix-win64-v1.2.0.zip

This post is used as reference for Github Report!

[Lafu]

And we have again a new Fake Ann Thread with an Fake Github Account with Malware , this time for KONJUNGATE (KONJ) !

The Fake Github Account was just created 4 Hours ago.

Fake Github : github.com/Konjungates
Real Github : github.com/Konjungate

On the Website there is another Github Account Linked to github.com/Marconi1515/Konjungate

Virustotal flaggs it as Trojan:

Code:

Malicious (high Confidence)
Trojan.NSIS.Runner
Trojan.BAT.bae

New RUN Key Pointing to Suspicious Folder
Use NTFS Short Name in Image
CurrentVersion Autorun Keys Modification
Use NTFS Short Name in Command Line

Source: https://www.virustotal.com/gui/file/790edc06f3d0f735c6038102507419d7a72c50f28bb4ed14b5f8939def373e08/behavior

Account : konjungates  <--- Please ban or Lock that Account and delete the Thread
The Account is new and only 1 Day old.

Fake Ann Thread :  [ANN] KONJUNGATE (KONJ) Official Thread

KONJUNGATE (KONJ)

Code:

https://github.com/Konjungates/Konjungate-Core/releases/tag/V1.1.6.3

Original Ann Thread :  [ANN] KONJUNGATE (KONJ), [POS] [MN] Official Thread

Account : mastrokonj

This post is also a reference for the Github Report !


And another new Fake Ann Thread here for PURN-NETWORK

The Fake Github was just created 40 Min ago !

Fake Github : github.com/PURN-NETWORK

CAPE Sandbox flags this file as: MALWARE

Code:

Malicious_Behavior.SB
Malware.SwollenFile!1.E38A (CLASSIC)
Trojan:W32/GenInflated.B

ET MALWARE Remcos 3.x Unencrypted Checkin
ET MALWARE Remcos 3.x Unencrypted Server Response

Source : https://www.virustotal.com/gui/file/c88f1908974c8d5444f34e01ddec9b247710e27f0b7ea8051e25ece3e2675335/detection

Account : Clavulanic  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Its an old Account from 2011 , last post was made in August 15, 2021 , Hacked or sold Account.

Fake Ann Thread :   [ANN] PURN-NETWORK - Kaspa fork with new features (GPU PoW/ghostDAG)

PURN

Code:

https://github.com/PURN-NETWORK/PURN/releases/download/1.0.0/purn-qt-win64.zip

This post is also a reference for the Github Report !