Report Malware and Suspicious Links here so Mods can take Action !

[MiningCoinsPool]

Trojan in the Windows binary available for download from their website: https://aldibi.com/

https://bitcointalk.org/index.php?topic=5506809.0

[Lafu]

Yeb its again a Fake Ann with Malware download Link from there Webpage this time for Aldibi

Fake download Wallet File on the Webpage:

Code:

download.aldibi.com/files/aldibi-qt-windows.zip

Also there is a Fake Github Link on there Page that is already deleted.
Fake Github : github.com/aldibi-coin/core

The sandbox CAPE Sandbox flags this file as: MALWARE RAT
The sandbox Zenbox flags this file as: MALWARE EVADER

Code:

Drops script at startup location
ET MALWARE Common RAT Connectivity Check Observed
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016

Source : https://www.virustotal.com/gui/file/7fb14f997b1c92cc4d7a70db91657fc01f5feba66c9dd1e1b918567280218e37/behavior

Account : qiqikesfket  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 04, 2021 , Hacked or sold Account

Fake Ann Thread:  [ANN] Aldibi: Empowering the Next Era of Global Transactions

Aldibi (ALDB)

Code:

https://aldibi.com/

[MiningCoinsPool]

Same guy again https://bitcointalk.org/index.php?topic=5506842

[$crypto$]

The hacked Hero Member account last posted in 2015 and is now actively spreading the virus via Github.

Account: Herbert This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

[Ms_Mining]

Account: DareToken  <= Please Banned
Fake Ann topic: [ANN] Mulierum | POW | GhostRider

Wallet:

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

[$crypto$]

Full member users who just woke up/hacked back are spreading the virus with two threads at once, please be careful.

Account: BlueStone This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

Fake ANN: [ANN][SSPOS] CodeBlock Blockchain: Welcome to a New Era

Code:

https://github.com/CodeBlockMainnet/CodeBlock/releases/download/1.3.1/CodeBlock-wallet_v1.3.1.zip

[Lafu]

We have again an Fake Ann Thread with the Fake Github Malware download Link for Mulierum!

Fake Github : github.com/mulierum
The Wallet File there was just uploaded 40 Min ago with an size of 116 MB
Source : https://www.virustotal.com/gui/file/b1acdc009df8f2af7e45b6216fd94179d05d1b335f4cdbc146a72e3e37d98a53/detection

If you install that Fake Wallet file and starting it it will be a remote desktop access program be installed

Code:

Processes created
"C:\Users\<USER>\AppData\Roaming\rustdesk.exe"
C:\Users\<USER>\AppData\Roaming\Zlvmon_v3\rustdesk.exe

Sorce : https://www.virustotal.com/gui/file/b1acdc009df8f2af7e45b6216fd94179d05d1b335f4cdbc146a72e3e37d98a53/behavior

Account : CCMS  <--- Please ban or Lock that Account and delete the Thread
Last post from that Account was August 14, 2024 , so its freshly hacked or sold.

Fake Ann Thread : [ANN] Mulierum | POW | GhostRider
As always the Thread is self moderated from the hackers.

Wallet:

Code:

Windows: https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
Linux: https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

And another User posted it also
Account : Cholidm  <--- Please ban or Lock that Account and delete the Thread

Wallet:

Code:

https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz]

This post is also a reference for the Github Report !

[$crypto$]

It's like the Mulierum virus is back, this time from a hacked account. Be vigilant and keep reporting the fake Github.

Account: theseratio This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Code:

[b]Windows:[/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux:[/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

[BlackBoss_]

A download file in this post https://bitcointalk.org/index.php?topic=5510016.0 can be malicious.

I checked with Virustotal with URL checking, it's clean. I don't want to download the file and check it with Virustotal but a newbie share a download file is very suspicious.

Code:

Download https://mega.nz/file/HWh0zIoZ#kYdT27HIvOpMGlxX7V28es-5pVNJfSNkhVqBJuGZ0Lo

[Lafu]

We have a new Fake Ann Thread with an already used Fake Github download Link with Malware for Mulierum again !

Fake Github : github.com/mulierum

The Fake Wallet download file is still the same 114 MB size big.

Account : MSAS  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since May 07, 2016 and last post was back in December 14, 2018 , Hacked or sold Account

Fake Ann Thread :  [ANN] Mulierum | POW | GhostRider

Wallet:

Code:

https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

This post is also a reference for the Github Report !

[Ms_Mining]

Account: chekamarue  <= Please Banned
Fake Ann topic: [ANN] RadiumX New PoW coin . No ICO. No Masternode

Wallet Address Prefix: P

Wallets

Code:

https://github.com/RadiumXMain/RadiumX/releases/download/v2.0.3/RadiumX_win64_v2.0.3.zip

[Lafu]

We have a new Fake Ann Thread with an Fake Webpage and a Malware download there for [CCCN] Cococoin !

Fake Webpage :

Code:

https://cocomemefun.net/

On the Page there is a Link to a Github Account that is only 5 days old and nothing in there.
Fake Github : github.com/coco-meme

On the Webpage there is a download for the Wallet.

Code:

https://download.cocomemefun.net/files/cococoin-qt-windows.zip

And here its getting interesting , when you download the Wallet File and install and run it a lot of things will be happen.
Malware detected : Win64:Evo-gen [Trj]

Code:

Drops script at startup location
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Dot net compiler compiles file from suspicious location
Suspicious DNS Query for IP Lookup Service APIs
PowerShell Script Run in AppData
Startup Folder File Write
Unsigned DLL Loaded by Windows Utility
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Code:

SSLBL: Traffic to malicious host (likely QuasarRAT C&C traffic)  <--- A Network Trojan was detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
ET MALWARE Generic AsyncRAT Style SSL Cert
SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)

Source : https://www.virustotal.com/gui/file/bbf26e9b118b49791296baf3eca4442de993b2e5931acfa2eb7fe10c0b6d4811/behavior


Account : Anevigra  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 04, 2021 and not a single post , Hacked or sold Account

Fake Ann Thread :   [ANN] [CCCN] Cococoin – The Funniest Meme Coin of the Decade! 🐔🚀

Cococoin – The Funniest Meme Coin of the Decade

Code:

Download a CCCN Wallet: https://cocomemefun.net

There are more results and investigation about more and other Hacked Accounts i cant post for now but i will write a pm to Cyrus.

[Ms_Mining]

Account: aji471  <= Please Banned
Fake Ann topic: [ANN] RadiumX New PoW coin . No ICO. No Masternode

Wallets

Code:

https://github.com/RadiumXMain/RadiumX/releases/download/v2.0.3/RadiumX_win64_v2.0.3.zip

Site

Code:

radiumxcoin.info (in maintenance)

[$crypto$]

FAKE ANN

Account: Krendom This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Code:

[b]Linux:[/b] [url=https://github.com/RadiumXMain/mulierum/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz]https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz[/url]
[b]Windows:[/b] [url=https://github.com/RadiumXMain/mulierum/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip]https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip[/url]

Binarium Fake Thread

Account: Bitcoinislifer09 This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: [ANN] Binarium |GhostRider| Cryptocurrency protected from ASICs

Code:

[b]Linux:[/b] [url=https://github.com/RadiumXMain/Binarium/releases/download/1.0.1/Binarium-linux-v.1.0.1.tar.gz]https://github.com/Binarium-coin-project/Binarium/releases/download/1.0.1/Binarium-linux-v.1.0.1.tar.gz[/url]
[b]Windows:[/b] [url=https://github.com/RadiumXMain/Binarium/releases/download/1.0.1/Binarium-win64-v.1.0.1.zip]https://github.com/Binarium-coin-project/Binarium/releases/download/1.0.1/Binarium-win64-v.1.0.1.zip[/url]

[Lafu]

Code:

https://github.com/RadiumXMain/RadiumX/releases/download/v2.0.3/RadiumX_win64_v2.0.3.zip

Binarium Fake Thread

Thanks guys for keeping your eyes open and reporting this kind of Fake Anns and also for write that here so that everybody knows it , really appreciate that very much.
Looks like they are back with creating new Fake Github Accounts and using that for multiple Fake Wallet download.

The Fake Github Account github.com/RadiumXMain is only 2 weeks old and maybe we will see more of that in the next weeks.
I have seen that Fake Anns too but you guys was faster , thank you and i hope at some time we can catch the one who is all behind them.
I am on it and there are already some results but some Laws in on other countries are blocking the final strike against the person to get the personal Details and all.
But i am on it and hopefully together we can catch him and end this all.

[N.O]

This is my first report on this thread and I hope my report is correct. I noticed that newbie account add a malicious link to their topic in Announcements (Altcoins). Please @Lafu check it. I am right or wrong.

Account: layla-wagamoto

Topic: WagLayla [WALA] – ALGO [Walahash] - GPU – Based on Kaspa, Karlsen & Pyrin

Code:

Node Setup: https://waglayla.com/setup_node
Wagpaper: https://waglayla.com/wagpaper

Source: https://www.virustotal.com/gui/url/a0c900d929519224a03bb3ea9ec47a5d69ea273fd0cb4b2239583e6a61ee3649



Source: https://www.virustotal.com/gui/url/bce7ccfa1a1c0fd426c78b8176402ccdddcc080b53f3720afde8f61151619332

[$crypto$]

The Fake Github Account github.com/RadiumXMain is only 2 weeks old and maybe we will see more of that in the next weeks.
I have seen that Fake Anns too but you guys was faster , thank you and i hope at some time we can catch the one who is all behind them.
I am on it and there are already some results but some Laws in on other countries are blocking the final strike against the person to get the personal Details and all.
But i am on it and hopefully together we can catch him and end this all.

Now they come again with a thread in self-moderation, the Github account github.com/RadiumXMain again created a Repository with the name Limba clearly believes that they continue to spread on the forum, we must not allow it even though several times have reported this fake Github but have not been blocked.

Account: kesmex This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: [ANN] Limba KawPow Masternode

[N.O]

Account: kesmex This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: [ANN] Limba KawPow Masternode

Another guy published fake ann Topic of [ANN] Limba KawPow Masternode few hours ago please banned this account also.

Account: ldcomp
Fake ANN: [ANN] Limba KawPow Masternode

[Lafu]

This is my first report on this thread and I hope my report is correct. I noticed that newbie account add a malicious link to their topic in Announcements (Altcoins). Please @Lafu check it. I am right or wrong.
Topic: WagLayla [WALA] – ALGO [Walahash] - GPU – Based on Kaspa, Karlsen & Pyrin
Source: https://www.virustotal.com/gui/url/bce7ccfa1a1c0fd426c78b8176402ccdddcc080b53f3720afde8f61151619332

Hello N.O and thanks for write here in this Topic , the way you have written here is right but the Topic you mentioned is wrong.
Because you only checked the URL of the Webpage with virustotal and i see nothing wrong with that URL you have scanned.
For getting a fully scan of the Wallet file you have to download it and then upload it to virustotal.

On your last post yes you was right and it got already deleted , thank you.

Now they come again with a thread in self-moderation, the Github account github.com/RadiumXMain again created a Repository with the name Limba clearly believes that they continue to spread on the forum, we must not allow it even though several times have reported this fake Github but have not been blocked.

For sure they come back and it will be not take long and they have maybe a new Fake Github Account.
The best way to deal with Fake Github Accounts is to report them on Github and take your post here as an reference.
Mostly the Github is quick and they delete this Accounts but sometimes it takes weeks for it.

[N.O]

Another junior account post fake [ANN] Limba KawPow Masternode topic

Account: BWC Market <<< Please Ban this account
Fake ANN: [ANN] Limba KawPow Masternode

Code:

[b]Windows:[/b]  [url=https://github.com/RadiumXMain/Limba/releases/download/2.0.1/Limba-qt-win64-v2.0.1.zip]https://github.com/Limba/releases/download/1.1.2/LimbaWallet-Win64-v.1.1.2.zip[/url]