Report Malware and Suspicious Links here so Mods can take Action !

[Zaka1221]

I came back again here today with new report. A while ago, user  GLSC posted fake project ANN topic in Altcoins (Announcement) thread and after analyzing it, I found that file included in thread contain dangerous viruses like Trojan. And this project also had bounty program running which was already reported here as well.

User: GLSC
 
Topic Link: [ANN][GLSS] Transparent Supply • Zero Premine • Clean Architecture

Fake File:

Code:

Website: https://glasscoin.net
Explorer: https://explorer.glasscoin.net  
GitHub: https://github.com/GlasssCoin  
Discord: https://discord.gg/K4Y8gsvy
Telegram: Coming soon  

[rat03gopoh]

User: AltoCentered(Nuked), tflmagic(Nuked)

I suspect this is all being controlled by someone. All the links they post and comment on are fake and suspicious, like wallet drainers disguised as airdrops.
Lastly, they posted a fake Metawin site.

Code:

blueswap.finance
gcoin.casino
prize.metawln.com

https://ninjastic.space/user/id/3682006
https://ninjastic.space/user/id/3738309

[$crypto$]

Fake threads with malware links are hidden in telegram and on Discord.

Account: Crypto_Mesh please ban
Fake ANN: [ANN] CryptoMesh – GPU Mining + Masternodes!

Code:

DISCORD : https://discord.gg/enqtZfN6A3

TELEGRAM: https://t.me/Crypto_Mesh_Official

Don't join

Virustotal:
https://www.virustotal.com/gui/file/488bdab1a62d8fe476a06c63a8cb5b57462fad496ec0720c4a425bffc9ede104
https://www.virustotal.com/gui/file/317ea6bdecb0c88676be376ca2b7d641b7cd78748c95346243c608834172f55d

Code:

Trojan-Ransom.FileCrypter
W64.AIDetectMalware
Trojan-Ransom.FileCrypter
Malicious

[Zaka1221]

Found another fake topic with malware links and I am submitting all details here please take action against user and topic.

User: Crypto_Mesh

Topic Link: [ANN] CM - GPU MINING - CUSTOM ALGO - MASTERNODES

Fake File:

Code:

DISCORD : https://discord.gg/ZpWUaQty5k

TELEGRAM: https://t.me/Crypto_Mesh_Official

https://github.com/Excubiae2026/CMN/releases/download/v1.9.0/CryptoMesh.zip

Reference:
https://www.virustotal.com/gui/file/317ea6bdecb0c88676be376ca2b7d641b7cd78748c95346243c608834172f55d

[albon]

This user posted a topic in the Marketplace (Altcoins) section and published a tool called "Crypto Seed Checker", claiming that it is used for Wallet Recovery & Brute Force.

However, after scanning this malicious tool on VirusTotal, the result showed: 39/68 security vendors flagged this file as malicious.

The popular threat label detected was: trojan.fsysna/razy.

Regardless of the scan results, all their claims are false. Such malicious tools should never be installed, as hackers can use them to steal secret recovery phrases and sensitive data from the device.



The topic he created: ⭐️ Crypto Seed Checker v12.8.0⚪️Ultimate Tool for Wallet Recovery & Brutefore ✅

User : vidab4413  <-----   Please Ban that User

Archived ANN thread: https://ninjastic.space/topic/5567660
 
Archived Link: https://archive.ph/vDDus

VirusTotal scan result: https://www.virustotal.com/gui/file/66dca8edb6cb060bb6b80a984781b0f661307421447188156557d23d71cf49a8

[albon]

I recently created a thread accusing a platform called CORTEXAI. This platform supposedly promises high and fixed profits, but multiple red flags suggest it is potentially fraudulent.

After creating the scam accusation thread, I checked the software that users of this fraudulent platform were asked to install on their devices, and it turned out to be malicious, with 40 out of 71 security vendors flagging this file as malicious.



Popular threat label: trojan.convagent



ANN thread: Cortex — AI-Powered Airdrop Intelligence & Auto-Claim System

User : ketrinadepp  <-----   Please Ban that User

Archived ANN thread: https://ninjastic.space/post/66168102
 
VirusTotal scan result: https://www.virustotal.com/gui/file/55bbc34e5c53c4b80b7cafdd7e50adb4e6f36ec81194659dd5b251c6c135f566?nocache=1

Scam accusation thread: https://bitcointalk.org/index.php?topic=5568479.0

[Ms_Mining]

Account: elwiswoodie<= Please Banned
Fake Ann topic: [ANN] PokyChain – PoW | No Premine | No Dev Fees | Ethash

Code:

[b]Wallet[/b]: https://github.com/PokyChain/POKY/releases/download/1.1.0/PokyCHAIN-win64.zip

[$crypto$]

Fake thread spreading malware virus via github link

Account: karmakeddon please ban
Fake ANN: [ANN] ODYX Coin - POW + POS + Masternode

Code:

WINDOWS: https://github.com/odyx-chain/odyx/releases/download/1.1/ODYX-chain-win64.zip

[$crypto$]

Fake thread, PEPEHASH distributes malware links via github.

Account: keksik This user recently woke up from a long period of inactivity. please ban
Fake ANN: [ANN] PepeHash (PPH) — No ICO. No Premine. Just Proof-of-Work

Code:

[*][b]Wallet:[/b] https://github.com/pepehash/pph/releases/download/1.1/PEPEHASH-win.zip

Code:

Malware.SwollenFile!1.E38A (CLASSIC)
Trojan:W32/GenInflated.B

[$crypto$]

A fake thread, DCC-coin spreads malware via github links and possibly hacked accounts.

Account: DCC_Official please ban
Fake ANN: [ANN] DCC Coin - POW + POS + Masternode

Code:

WINDOWS: https://github.com/DCC-coin/dcc/releases/download/1.1/dcc-coin.zip

Code:

Malware.SwollenFile!1.E38A (CLASSIC)
Trojan:W32/GenInflated.B

Virustotal examination shows the presence of harmful viruses.

[Zaka1221]

Found another Fake project thread today and this thread contain Trojan virus in wallet links and I am submitting all details here please take action against user and topic.

User: Waves.support Please Ban

Topic Link: [ANN] DCC Coin - POW + POS + Masternode

Fake File:

Code:

WINDOWS: https://github.com/DCC-coin/dcc/releases/download/1.1/dcc-coin.zip
SOURCE: https://github.com/DCC-coin

[$crypto$]

Fake threads with malware links are hidden in telegram and on Discord.

Account: Crypto_Mesh please ban

A fake thread, CryptoMesh spread the malware virus through Discord and Telegram link groups that were shared in the thread.

The first account has been banned and the second account may have been hacked.

Account: dragonminer This user recently woke up from a long period of inactivity. Please ban
Fake ANN: 🛡️ CryptoMesh: Decentralized P2P💬. Mine & Masternodes🪙. Stay Secure 🔒.

Code:

Discord: https://discord.gg/enqtZfN6A3
Telegram: https://t.me/Crypto_Mesh_Official

https://www.virustotal.com/gui/file/1e6c635cd375cee4db5ed1a5b2261d4854a046aade3d8aefd1c81185f2d9dbc0

Code:

Trojan-Ransom.FileCrypter

[Zaka1221]

Today I have come with new report and today I visit new topic that was posted by FoxHashMeme. I also checked its bounty program in bounty section. I became suspicious when I visit project website and saw that it was tagged as dangerous site and warning message was displayed. Please check this website and project and take action against them.

User: FoxHashMeme

Topic Link: [ANN] FoxHash (FXH) — No ICO. No Premine. Just Proof-of-Work.

Bounty Link: [BOUNTY] FoxHash (FXH) — Community Bounty | $15 Fixed Reward

Code:

Website: https://foxhash.org/
Explorer: https://explorer.foxhash.org/
Telegram: https://t.me/+rfUhtrxLWGE4NjU0

[Zaka1221]

Found another fake thread with malicious wallet links and I am submitting all details here please take action against user and topic.

User: Gideon14 Please ban

Topic Link: [ANN] FREEZIUM (FRZ) — Ice-Powered PoW • Penguin Mascot

Fake File:

Code:

https://github.com/Freezium-coin/freezium/releases/download/1.1/Freezium-coin.zip
https://explorer.freezium.org/

Reference:
https://www.virustotal.com/gui/file/8a22d8641c1d7b7ddc39c59967eb0ec89886ff34dc64033c92bdeda6d166b5b2?nocache=1


Also take action against this user Daffadile and he also posted same same thread and them removed it.

https://ninjastic.space/post/66200900

[albon]

This user launched a bounty campaign [this one] to encourage bounty hunters to post replies in the announcement thread discussing this suspicious project. After sufficient research and technical analysis, it was found that the project’s wallet has been flagged by 12 antivirus engines, which is a relatively high number for a financial wallet. In addition, the analysis identified several concerning indicators, including: "detect-debug-environment" - "long-sleeps"  - "contains-PE", which are commonly used by trojans to evade analysis and conceal malicious behavior.

Popular threat label: trojan.tedy/atraps



ANN thread: [ANN] NapCoin (NAP) — The Chillest Scrypt PoW Memecoin

User : NapCoin-org  <-----   Please Ban that User

Archived ANN thread: https://ninjastic.space/post/66070609
 
VirusTotal scan result: https://www.virustotal.com/gui/file/ba078375cc968c81e2a4083b8fbc937700ae62220e54dcd926f8bf6d3f7c3f0e

[Zaka1221]

Found another fake thread of Freezium with malware links and I am submitting all details here please take action against user and topic.

User: Mikay01 Please ban

Topic Link: FREEZIUM (FRZ) — Ice-Powered PoW

Fake File:

Code:

https://github.com/Freezium-coin/freezium/releases/download/1.1/Freezium-coin.zip

[albon]

According to what @Zaka1221 posted regarding the fake announcement promoting the FREEZIUM wallet that contains a trojan, 2 out of 67 security vendors flagged this file as malicious: Malware.SwollenFile!1.E38A (CLASSIC) + Trojan:W32/GenInflated.B

The file exhibits the following behaviors: long-sleeps - detect-debug-environment -contains-pe



These are the accounts that promoted this malicious wallet, and all of them should be banned to protect members from downloading it, infecting their devices with viruses, and exposing their wallets to theft.

Note: All these accounts recently woke up from a long period of inactivity solely to promote this wallet.

[1] ☠ Gideon14  <-----  Please Ban
[2] ☠ Mikay01  <-----   Please Ban
[3] ☠ Daffadile  <-----    Please Ban

My new catch is the following account:

[4] Forseti6 <-----   Please Ban

ANN thread: [ANN] FREEZIUM (FRZ) — Ice-Powered PoW

Archived ANN thread: https://ninjastic.space/post/66212028
 
VirusTotal scan result: https://www.virustotal.com/gui/file/8a22d8641c1d7b7ddc39c59967eb0ec89886ff34dc64033c92bdeda6d166b5b2?nocache=1

[AakZaki]

I suspect that the file distributed through the link below is dangerous, and the person also posted its ANN on several different Local Boards.


User: durcoin

Thread Link:

• Maйнинг нa дoмeнax
• PoDO — إثبات ملكية النطاق | اربح من نطاقك عبر سجل TXT &
• PoDO — Proof of Domain Ownership | Dapatkan dari domain Anda dengan satu TXT | W
• PoDO — ingresos por controlar tu dominio con un único TXT (Waves, sin ICO/KYC/re
• PoDO — 通过一个 TXT 记录凭域名控制获得奖励（Waves，无 ICO/KYC/拉新）
• PoDO — Ausschüttungen für Domain‑Kontrolle über einen einzigen TXT‑Eintrag
• PoDO — des gains en contrôlant votre domaine via un seul enregistrement TXT

This link has an indication of risk because it was detected by 1 engine (CRDF) on VirusTotal.

Code:

https://t.me/dymohot/910

Virustotal: https://www.virustotal.com/gui/url/3e41bf435c8249d05d6cafd19b8c74833f811ea49e82c5eafb7deb5820d1260d

[JollyGood]

Had you not posted this absolute nonsensical post I would not have noticed your account. Clearly without a shadow of doubt, because of the total three posts you have made, it is safe to assume your "Lurkus" account was created for any possible purpose imaginable other than by a real newbie to the forum that really wants to learn.

@Lafu Sir, I need help. I am not able to understand or learn the whole thing mentioned in the OP. But I am very interested in learning about malware and suspicious fake links. Therefore, I request you to teach me about the subject in a simpler way. So that I can contribute here. Thanks in advance.

[albon]

This link has an indication of risk because it was detected by 1 engine (CRDF) on VirusTotal.

Code:

https://t.me/dymohot/910

Virustotal: https://www.virustotal.com/gui/url/3e41bf435c8249d05d6cafd19b8c74833f811ea49e82c5eafb7deb5820d1260d

If you put any Telegram link on VirusTotal, it may show up as marked Malicious by CRDF, but this does not necessarily mean that the file is malicious. I tested this by checking a link to my own Telegram account, and it showed the same result.

The PDF appears clean, but it is recommended to open it in an isolated environment.. However, this does not prevent the member from having violated local posting rules or used automatic translation tools. In addition, it does not prevent the project itself is questionable or scam. Therefore, an extensive research should be conducted into what this member mentioned about the project because its idea seems strange: "domain mining" and promising fast profits every hour from unknown tokens.

I came here to learn. That's why I'm asking for OP's help. I don't have any other purpose here for now. If possible, please clarify the whole matter for me. Because I have a lot of interest in learning. Yes, I know I post badly now. But if you help me, I can learn.

Okay, if you check what was mentioned in the OP, you’ll see that Lafu has indeed created a dedicated educational thread on this topic, which you may have missed.

You can check it here -> https://bitcointalk.org/index.php?topic=5167236.msg51891741#msg51891741