Report Malware and Suspicious Links here so Mods can take Action !

[logfiles]

Alright let me just explain this if you scroll up I have reported multiple time against these gang, Apart from my reporting, many of their accounts have been banned. They are not actually scamming the people but they show that by exploiting gambling  can earn a lot of money and ask people to download the malware file they given the link of google drive. So those who will download the files will be become victims of hacking.
And if you pay attention to the user that you have mentioned, he has also given the same kind of link of Google's drive. I'm just reporting these phisher's here as soon as they get out of the forum. Hope you get it.

Thanks for your dedication @Crypto Library on the war to clean malware off this forum.

In the past, I have actually seen some chaps try to sell gambling casino scripts, but I wasn't sure what to do about it. I will keep a keen eye on those who share the scripts and the scripts too if I come across such ANNs again.

[Crypto Library]

@Crypto Library
thanks for keeping your eyes open and reporting that things here.

Thanks for your dedication @Crypto Library on the war to clean malware off this forum.

In the past, I have actually seen some chaps try to sell gambling casino scripts, but I wasn't sure what to do about it. I will keep a keen eye on those who share the scripts and the scripts too if I come across such ANNs again.

Thanks you guys for yours appreciations it's gives me more energy.
Two years ago I myself became a victim of phishing and my important data along with the funds of Meta Mask and some purchased games were taken away by hackers.  I know how painful these are.  Hopefully my efforts will at least save someone else from falling for this phishing. 

By the way here is another one-

Account: Gebrossa (need to be ban ASAP)

Hey guys, I found this method today and it worked perfectly with $500 Amazon and 100 EUR Valorant giftcards.

It should work with every giftcard that is available in the store. I am not sure how long it's gonna take them to patch this exploit but it works for now, so enjoy.

Btw. you can use it to make money - just use Paxful to sell these giftcards for BTC (use $200 and $500 giftcards for that, because sellers pay about 80% for those, and only about 50-60% for lower values)

https://drive. google. com/file/d/ 1B6xZyKm1_qZ862jRcsvrTBad5IJB4Xoj/view?usp=sharing

Giftcards I got:

https://i.imgur.com/pxzO2Pp.png

https://i.imgur.com/9psp2pg.png

View Archive

Hey guys, I found this method today and it worked perfectly with $500 Amazon and 100 EUR Valorant giftcards.

It should work with every giftcard that is available in the store. I am not sure how long it's gonna take them to patch this exploit but it works for now, so enjoy.

Btw. you can use it to make money - just use Paxful to sell these giftcards for BTC (use $200 and $500 giftcards for that, because sellers pay about 80% for those, and only about 50-60% for lower values)

https://drive. google. com/file/d/ 1B6xZyKm1_qZ862jRcsvrTBad5IJB4Xoj/view?usp=sharing

Giftcards I got:

https://i.imgur.com/pxzO2Pp.png

https://i.imgur.com/9psp2pg.png

View Archive

I started with $450 and this is my balance now
 
https://i.imgur.com/ujHmBNH.png
 
this method is about doublespendning btc transactions with 1 confirmations
 
some casinos are vulnerable which means that after 1 confirmation they add money to your account but u get your money back due to doublespend, then u can also withdraw money from the casino
 
tried this on Stake.com btw but I heard there are many more of them

Method:

https://drive.g oogle. com/file/ d/1nkP1yUdK8tCh1anGAgm-gHSn6qawG9PF/view?usp=sharing

View Archive

[Lafu]

Looks like we have another Fake download wallet for KASHBA v1 from Mediafire !

This time they used a 2 short links for there download.

KASHBA v1 is here!
We are launching the Kaspa fork (no premine/ no dev fee), pre-launch phase. All minted coins will remain valid in the blockchain.

Code:

Windows wallet:
link1 https://shorturl.at/SUs7S
link2 https://shorturl.at/H0Fbv 

The first Short Link if you use https://wheregoes.com that checks the short link for you and show you the real source.
https://wheregoes.com/trace/20243665073/

Code:

https://www.mediafire.com/download_repair.php?flag=1&dkey=2owhin6gsczgYzU9zl6AkTiib5BNO0ckq7wf%2Di928uoSSU9KhgkFlWiN0vAF6FXzUPVfj1eXUFKKXGm3X6zS1k%5Fc3qA3ygZe9pM8yP0HXCHnHzy%5FNYtahUNbAaZSZqkHWVFNpuhBsmb49RYUHdx87Co3JI5NYnOstvCqd6MkZisDDw&qkey=vivrhxp7llbxcky&ip=142%2E93%2E176%2E189

The second one will this :
https://wheregoes.com/trace/20243665288/

Code:

https://easyupload.io/p3slxx

Thanks @xandry as he was a faster then me for checking the file!
https://bitcointalk.org/index.php?topic=5502371.msg64303882#msg64303882

https://www.virustotal.com/gui/file/e17e318e3a22362b59b7482e4144b7bec3324e9c6c68730005bc6a46cf62f249

Code:

W32.AIDetectMalware
Suspicious.low.ml.score
Trojan-Spy.Node.LxnnyStealer

Account : hojcuv  <--- Please ban or Lock that Account and delete the Thread

Thread 1 : KASHBA v1 is here!
Thread 2 : KASHBA - no premine/no dev fee - Kaspa fork (prelaunch)

[Lafu]

We have again an Fake Ann with a short link that redirects to a Fake Github Account with Malware download for ChuckleChain !

The Short Link if you check with Virustotal directs to that Fake Github Account:

Code:

Redirection chain

https://t.ly/ldtM1
https://github.com/monee103/windows-lifetime-license/releases/download/v1/Setup.zip

Source : https://www.virustotal.com/gui/url/7153203da807502e98a725c0ef1c8e2b457bfdadb6951aaf97b5cf015d512412/details

The Fake Github was just created 1 hour ago !

Fake Github : github.com/monee103/windows-lifetime-license/

Code:

Trojan-Spy.Node.LxnnyStealer
Riskware ( 00584baa1 )

Source : https://www.virustotal.com/gui/file/9972046316f16fd2705d777305b85571b215c17e60521ee20f91649b2063cd38/detection

Account : diqigexo  <--- Please ban or Lock that Account and delete the Thread
The Account was just created 2days ago and only posted that Thread.

ChuckleChain
Wallet download

Code:

Windows wallet: https://t.ly/ldtM1

The User changed his thread after i posted that but you can read all here : https://ninjastic.space/search?author=diqigexo

This post is also a reference for the Github Report !

[Lafu]

We have a new Fake Ann Thread with an Malware download Link and Fake Github Account for Mallior !

The Fake Github was created 3 days ago.

Fake Github : github.com/Mallior

The qt-windows wallet file has 28 detections with bad things.

Code:

Trojan/Win32.RL_Generic.C4346791
Trojan.Jalapeno.D81F
Win64:DropperX-gen [Drp]
Gen:Variant.Jalapeno.2079
A Variant Of MSIL/Kryptik.ADGR
Trojan.MSIL.Krypt
Trojan ( 005b3cc11 )
Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:fZp5mqnWJI+uolAWKJSAJg)
Heuristic.HEUR/AGEN.1313073
HEUR:Trojan-Spy.MSIL.Quasar.gen
Trojan.Generic.TRFH449
Trojan.PackedNET.1560

Source : https://www.virustotal.com/gui/file/abdac7b13dbad121ddf16189d33d76dd010c381172461b95c0dc8b55b7966253

Account : Toresfyuit  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 01, 2021 ,  Hacked or sold Account

Fake Ann Thread :  [ANN] Mallior - Best Crypto Decision On The Market

Mallior Coin (MLR)

Code:

https://mallior.com]Website
https://github.com/Mallior/Core/releases/tag/v1.0.0

This post is also a reference for the Github Report !

[Crypto Library]

I think I got some asshole those should be ban. I have checked their link via the virus total and here I found this -
https://www.virustotal.com/gui/url/a9012d0fab8e5547d6f44da30a83c1f61e859f0b91813a7ad88a0babc8ed0703?nocache=1




Account: Ljax1988 (need to be ban ASAP)

Dear Community,

We are thrilled to announce that Kick .com, your go-to destination for immersive streaming experiences, has officially partnered with the $STAKE Crypto Casino Token! As part of this exciting collaboration, we're hosting an exclusive $STAKE token airdrop, with a total of 120,000,000 tokens available for our dedicated users.

Don't miss out on this fantastic opportunity to be part of the future of crypto gaming and streaming. Join us now and claim your share of $STAKE tokens!


➡️ - Complete the tasks

➡️ - Take your $STAKE Airdrop 

 

Visit :  👉  http://joinstake . v ip/  👈  to participate

View Archive

And this monkey_nr account is being used as positive feedback to attract people. I think this is also need to be banned

Thanks is fasttt 

View Archive

[Lafu]

I think I got some asshole those should be ban. I have checked their link via the virus total and here I found this -
https://www.virustotal.com/gui/url/a9012d0fab8e5547d6f44da30a83c1f61e859f0b91813a7ad88a0babc8ed0703?nocache=1

Account: Ljax1988 (need to be ban ASAP)

Visit :  👉  http_://joinstake . v ip/  👈  to participate[/size]

View Archive

About that User that posted that link for and about joinstake it looks like that it is an phishing Link and attempt for that.
But you forgot something important and that is that when you click on that Link you get directed to a Webpage that has an other adress.

Code:

https://kcki.online/

And i guess everybody can see there that its not a serious Webpage as every link you click there it directly ask you to connect your wallet.
Even you want to look at the Terms and Con.

About the other User i dont know if there is enough evidence to ban him but you can be right.

[Lafu]

We have a new Fake Ann with an Fake Website that have a Malware download Wallet file from a Fake Github Account for Friemon Coin !

The Fake Github Account was created 4 days ago and the Malware files was uploaded 9 hours ago.

Fake Github : github.com/Friemon

The sandbox CAPE Sandbox flags this file as: RAT MALWARE

Code:

Drops script at startup location
Suspicious DNS Query for IP Lookup Service APIs
Startup Folder File Write
Usage Of Web Request Commands And Cmdlets - ScriptBlock
RegAsm.EXE Initiating Network Connection To Public IP
Potentially Suspicious CMD Shell Output Redirect
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
INDICATOR-SHELLCODE x86 NOOP

Source : https://www.virustotal.com/gui/file/54138d80e63cbb98ae02c2a806cd8b38824766332c8692c881afdd065514bf85/behavior

Account : uadrenopl  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 02, 2021 , Hacked or sold Account

Fake Ann Thread : ANN] Friemon Coin (FRMN) - The Friendliest Meme Coin!

Friemon Coin is an innovative memecoin designed to bring fun and utility to the cryptocurrency world. Focused on community engagement and real-world applications, it aims to revolutionize digital transactions with a friendly twist.

Code:

Website: [url=https://friemon.com]friemon.com[/url]

On top of that the Fake Website is hosted from UK in Manchester

This post is also a reference for the Github Report !

[Lafu]

And we have again the same Fake Ann as the last time with a Fake Github Account and Malware download Link on the Website for Azlora (AZL).

The Fake Github Account was created 4 days ago and the Malware File uploaded 16 Hours ago.

Fake Github : github.com/Azlora

Also here the sandbox CAPE Sandbox flags this file as: RAT MALWARE

Code:

Drops script at startup location
Suspicious DNS Query for IP Lookup Service APIs
Startup Folder File Write
Usage Of Web Request Commands And Cmdlets - ScriptBlock
RegAsm.EXE Initiating Network Connection To Public IP
Potentially Suspicious CMD Shell Output Redirect
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
ET MALWARE Common RAT Connectivity Check Observed
A Network Trojan was detected

Source : https://www.virustotal.com/gui/file/0672dfa586109d7b621757ed3e554e97b3cda928797ccf4f07fc192ab43597f7/behavior

Suspicious IP Connection:

Code:

ttasstsat.tech
lifehackov.ru

Source : https://www.virustotal.com/gui/file/0672dfa586109d7b621757ed3e554e97b3cda928797ccf4f07fc192ab43597f7/relations

Account : Zahjejjiko  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 04, 2021 , Hacked or sold Account

Fake Ann Thread :  [ANN] Azlora (AZL) - The Meme Coin That’s Out of This World!
Thread is Self Moderated as always from the hackers and 18 comments already deleted.

Project Name: Azlora   

Code:

https://azlora.com

This post is also a reference for the Github Report !

[MiningCoinsPool]

https://bitcointalk.org/index.php?topic=5505577.0

Trojan in the windows binary from that post - please delete it

[Lafu]

Yes its a Fake Ann again with the same sheme as the others , this time its Liaron Coin (LRN)

The Fake Github was just created yesterday

Fake Github : github.com/liaron-coin

Fake Webpage :

Code:

https://liaron.com/

When downloading the file from there or from the Webpage i getting instant a warning from Windows that the File is an Virus or Malware.

Account :  pevirtiunes  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 04, 2021, Hacked or sold Account

Fake Ann Thread : [ANN] 💥 Liaron Coin (LRN) – Your Ticket to the Future of Digital Currency!💥

Thanks to MiningCoinsPool

https://bitcointalk.org/index.php?topic=5505577.0
Trojan in the windows binary from that post - please delete it

And we have another new Fake Ann Thread with Malware download Link for NOTPOW !

Fake Github : github.com/NOTPOW
Malware Wallet File was uploaded just 50 Min ago

Code:

Win32:Malware-gen
Malware.SwollenFile!1.E38A (CLASSIC)

This Files will be started when you install the file and start it

Code:

C:\Users\<USER>\AppData\Roaming\tg_Sync\ObjectDock.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
C:\Windows\system32\WerFault.exe -u -p 3956 -s 532
C:\Windows\system32\services.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p

https://www.virustotal.com/gui/file/e1452648afbd302b5cc88e540ff23fc806052d7ce9a6f52a23bdd7caff8c714f/detection

Account : Pelunize12  <--- Please ban or Lock that Account and delete the Thread
Registered since August 27, 2016, and last post was back in Jan 2020 , Hacked or sold Account

Fake Ann Thread :  [ANN] NOTPOW | Probably nothing

NOTPOW wallet

Code:

https://github.com/NOTPOW/NOTPOW-frens/releases/download/1.0.1/NOTPOW-frens-v.1.0.1-0.zip

This post is also a reference for the Github Report !

[Crypto Library]

Yes its a Fake Ann again with the same sheme as the others , this time its Liaron Coin (LRN)

Good catch dude!
Here I found kinda same before I have reported some that show how to exploit the gambling site and they put the google drive link and using pdf file and put those phisy links on there and as well as the fishy method. And they also use their alt account to shows some positive touch and they also the locked the topic so that no one can say anything negative about them.

Now they have brought little changed in their plan they try to use now amazon exploit method .



https://www.virustotal.com/gui/url/7e77225a88bab643cce7f1b795e3064937af1bed4708fbfd54c7f8b5342e8791


Account: Revaniz (need to be ban ASAP)
Try to Phishing people by Site Exploit Method

Hey guys, so I came around a method for free giftcards today, I used it and got 2x $500 Amazon giftcards.

I'm kinda scared to use them myself on my Amazon profile becuase I have my real data here, so I'm worried if the store could know this giftcard is from an exploit and then charge the money from me.

So the question is - Do you know how I can quickly sell these giftcards for Bitcoins or Cashapp?

Or maybe any of u guys want to buy 2x$500 Amazon cards for 600$ for both? This is proof that I got them : https://i.imgur.com/APZsWNs.png

We can use middleman ofc since I am not trusted here, let me know if u know any way to sell them or if u wanna buy them

View Archive

Code:

[size=5pt]https://drive .google. com/file/d/ 1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?OAxXtfCKIY

that's the method bro, but dont use it with more than 1000$, they will block the payment.

I will try paxful, thanks btw

closed for now, if I have any more questions i will let u know guys ! love u[/size]

View Archive

[Lafu]

And we  got the next Fake Ann Thread with an already used Fake Github Account with Malware , this time for Binarium!

The Fake Github was already used for NOTPOW.

Fake Github :
github.com/NOTPOW/NOTPOW-frens
github.com/NOTPOW/Binarium

The Malware File was just uploaded 50 Min ago.

Account : nosmis  <--- Please ban or Lock that Account and delete the Thread
Registered since July 11, 2017, Hacked or sold Account
Last post was back in May 11, 2021

Fake Ann Thread :  [ANN] Binarium | POW | GhostRider

Binarium is our first major blockchain project.
Windows:

Code:

https://github.com/NOTPOW/Binarium/releases/download/1.0.3/Binarium-win64-v.1.0.1.zip

This post is also a reference for the Github Report !

[Crypto Library]

And we  got the next Fake Ann Thread with an already used Fake Github Account with Malware , this time for Binarium!
<✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂>

Fake Ann Thread :  [ANN] Binarium | POW | GhostRider

owh gosh they are fake !!!

I just visited their thread  and I was also looking at their officials representative social handles for offering  some business  .

Anyway bad luck for those scammers thanks again for the catch.

[FatFork]

A potential scam unfolding in the "Question about selling free giftcards" thread - [https://bitcointalk.org/index.php?topic=5505793.0]

Here's what we know:

A new member, Revaniz, claims to have found a method for free gift cards and offers to sell them.
Another new member, WARtoze99, suggested a platform for selling the gift cards only twenty seconds later, then asked for the method to obtain them.
Revaniz provides a Google Drive link claiming to be the exploit method.

Code:

https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?OAxXtfCKIY

The fake exploit method they promote involves installing a greasemonkey/tampermonkey script into the user's browser. The script is heavily obfuscated and undoubtedly contains a malicious payload designed to steal your crypto or worse.

Code:

Link #1 https://paste.sh/7vnaa5T9#rnL_3Gbklz9HKMIUKuPPG3yf
Link #2 (backup) https://files.catbox.moe/1evss2.txt

If anyone has more experience with analyzing obfuscated javascript code and is willing to try, it would be interesting to find out what the script actually does.

[Mitchell]

If anyone has more experience with analyzing obfuscated javascript code and is willing to try, it would be interesting to find out what the script actually does.

I tried using some online tools: https://private.coinsofnakamoto.com/?b4527618e0f7c407#2jRhaSBjdSStxKnJApfAMhszgfJM3mLJv4giXjN94UGz (do not run this, obv).

They seem to pick a random BTC address from the list, replace the one on the page (including the QR code) and then do a call to pipedream with some basic description (which seems to return 204). Very basic stuff honestly.

[Lafu]

And again we have a new Fake Ann Thread with an Fake Github Account and Malware download Link for Mulierum !

The Fake Github was just created 1 Hour ago.

Fake Github : github.com/mulierum

The Download Wallet File is 100 MB big and the same as we got already in the past.

Code:

[code]
C:\Users\<USER>\AppData\Roaming\ObjectDock.exe"
C:\Users\<USER>\AppData\Roaming\tg_Sync\ObjectDock.exe
C:\Windows\system32\SecurityHealthService.exe
C:\Windows\system32\WerFault.exe -u -p 636 -s 504

[/code]
Source : https://www.virustotal.com/gui/file/b6761479c00cffc7e99e820060518b12024e533fbc908da116ecce2a4cb2759d/behavior

Account : havi agasa  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since June 08, 2017 , and the last post from that User was back in July 04, 2021 , Hacked or sold Account

Fake Ann Thread :  [ANN] Mulierum | POW | GhostRider

Mulierum
Wallet:

Code:

https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

This post is also a reference for the Github Report !

[$crypto$]

Another hacked account spreading the virus via a Github link

Account: ikanunaki accounnt hacked and please ban
Fake ANN: [ANN] Mulierum | POW | GhostRider

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

[Ms_Mining]

Account: pedpedped101  <= Please Banned
Fake Ann topic: [ANN] Mulierum | POW | GhostRider

Wallet:

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz