Report Malware and Suspicious Links here so Mods can take Action !

[Zaka1221]

Today I found another fake topic of Flow Protocol  :owith malware link and I am submitting all detail here please take action against user and topic.

User: flowprotocol Please ban

Topic Link: Flow Protocol (FTC) — 81,670 Lines C++ From Scratch. Not a Fork. Keccak-256d PoW

Fake File:

Code:

https://github.com/Kristian5013/flow-protocol]https://github.com/Kristian5013/flow-protocol

Another Fake fake topic of Norix

User: DotorSojat Please ban

Topic Link: [ANN] Norix - Trusted & Secure Crypto Project (POW+POS)

Fake File:

Code:

https://github.com/NoriXchain/NoriX/releases/download/1.2.0/Norix-qt-win.zip

Reference:
https://www.virustotal.com/gui/file/76a04d8f4331ce1325376530a852617f9e3236cfa626a25fabf79d633475f505?nocache=1




Two more fake topics were found which have already been reported.

Fake Topic <<Norix>> which contain Malware

User: Jonnytor Please ban

Topic Link: [ANN] Norix - Trusted & Secure Crypto Project (POW+POS)

Fake File:

Code:

https://github.com/NoriXchain/NoriX/releases/download/1.2.0/Norix-qt-win.zip

Other fake topic Dilithion

User: twwoods Please ban

Topic Link: [ANN] Dilithion (DIL)

Fake File:

Code:

https://github.com/dilithion

https://www.virustotal.com/gui/file/72ae99cebd15f40ab6891057da8472a2cc41f3df2ae4359b26d650fc5ea871b0?nocache=1

[Charcol]

A Fake Ninacatcoin topic has been found, which contains malware.

User: jose rodrigues <-----   Please Ban this User

Fake ANN: ninacatcoin crypto new

Fake File:

Code:

https://github.com/ninacatcoin/ninacatcoin

Edit:@AuchanX The fake topic reference in this thread has already submitted all the details. Please delete the fake topic.

I found another fake topic of Ninacatcoin with malware link and I am submitting all detail here please take action against user and topic.

User: ninacatcoin PLEASE BAN

Fake Topic: ninacatcoin crupto new

Fake File:

Code:

https://github.com/ninacatcoin/ninacatcoin

What I found after checking with Virus total:

https://www.virustotal.com/gui/file/67ba18120de6431e06e051d8583feecd7fbe2b353565eeb804aaffb63eed399e/detection

[Renampun]

This user had just registered and immediately posted a thread for a project called Q-BitX.

after checking the GitHub link he provided, 3/64 security vendors flagged this file as malicious.

User : h1j2k27  <== Please Ban this User



Github : https_://github.com/q-bitx/Source-/releases/download/v0.2.0/windows_release_0.2.0.zip

ANN thread: [ANN] Q-BitX (QBX) – Quantum PoW Blolchchain | Windows x64 binary

https://www.virustotal.com/gui/file/3f68a65c443a0e49fd120ffb48ea2a8c6b92e050456693cef86ed18b92798f63?nocache=1

[theymos]

This user had just registered and immediately posted a thread for a project called Q-BitX.
https://www.virustotal.com/gui/file/3f68a65c443a0e49fd120ffb48ea2a8c6b92e050456693cef86ed18b92798f63?nocache=1

A lot of people are reporting stuff here just because something has virustotal detections, but almost every new piece of software will have virustotal detections. The legit Bitcoin Core or Monero software will have 10-20 detections on the day that it's released, though the anti-malware vendors will over time manually remove detections for popular pieces of software. In that one for example, 2 of the detections are for "containing a crypto miner", which is obviously normal and expected in this case.

That certainly doesn't mean that it is safe. I wouldn't trust software from some random person on the Internet even if Virustotal didn't detect anything. Virustotal just doesn't give much information in either direction.

[Lafu]

A lot of people are reporting stuff here just because something has virustotal detections, but almost every new piece of software will have virustotal detections. The legit Bitcoin Core or Monero software will have 10-20 detections on the day that it's released, though the anti-malware vendors will over time manually remove detections for popular pieces of software.

Its better to report them if you have some feeling thats something wrong with it or maybe some evidence about a Fake Wallet or Software or.
A lot of Old Wallets have that called False Positiv detections thats clear i guess for the OGs here and know all the old stuff from the beginning.

I wouldn't trust software from some random person on the Internet even if Virustotal didn't detect anything.

I fully agree on that , no detection dosnt mean that there is something wrong about that file , Software or Wallet.
We have seen that in the past for a few Malware Wallets.

Virustotal just doesn't give much information in either direction.

I dont agree here on that , most people just dosnt know where to look at , the detection section is not all where i can get Informations 
If you know where to look at you get more Infos about the Files and Stuff , Processes created , Shell commands , Processes tree , Process and service actions , Files dropped and more.
Experienced Hunters will find what matters , but i cant tell all my secrets about finding them 

[Welsh]

If you know where to look at you get more Infos about the Files and Stuff , Processes created , Shell commands , Processes tree , Process and service actions , Files dropped and more.
Experienced Hunters will find what matters , but i cant tell all my secrets about finding them  

Just worth putting what lead to the conclusion in the reports to the moderators, as we might not have all the information that you might have. I'll leave reports that I'm unsure as "unhandled", since I don't think they're bad reports as you have a right to be suspicious of files from randoms on the internet, but not enough conclusive evidence other than VirusTotal detections.

This is one example of where leaving reports as unhandled is the suitable choice in my opinion.

Of course, there's clear examples of fake projects or projects trying to pose as another, which are usually removed swiftly.

[Lafu]

Just worth putting what lead to the conclusion in the reports to the moderators, as we might not have all the information that you might have.

Thats why when i made a Report there will be all as good as explaind with all the Sources for an evidence that its Fake or Malware.
But i guess you know that  

This is one example of where leaving reports as unhandled is the suitable choice in my opinion.
Of course, there's clear examples of fake projects or projects trying to pose as another, which are usually removed swiftly.

I know what you mean and want to say and i am fully with you!
Saddly nobody from all that new Hunters and Reporters ask about how they can improve there Searching.

[AuchanX]

This user had just registered and immediately posted a thread for a project called Q-BitX.
https://www.virustotal.com/gui/file/3f68a65c443a0e49fd120ffb48ea2a8c6b92e050456693cef86ed18b92798f63?nocache=1

A lot of people are reporting stuff here just because something has virustotal detections, but almost every new piece of software will have virustotal detections. The legit Bitcoin Core or Monero software will have 10-20 detections on the day that it's released, though the anti-malware vendors will over time manually remove detections for popular pieces of software. In that one for example, 2 of the detections are for "containing a crypto miner", which is obviously normal and expected in this case.

That certainly doesn't mean that it is safe. I wouldn't trust software from some random person on the Internet even if Virustotal didn't detect anything. Virustotal just doesn't give much information in either direction.

theymos sir, I want to mention something. I really thought for a while whether it is right to say this here. Still, if I said something wrong, I am really sorry.

Recently, malware was found in the files attached to the ANN threads created by two users and their threads were reported here.And as usual, the moderator reviewed it. And deleted the thread. But since those users did not have much knowledge of the forum rules, they created alternate accounts and asked the reason on the meta board. And one of them wrongly blamed Xal0lex and Lafu because both of them had merit in the reported post. I think you noticed the complaint. And so gave us this clear message. Your message is certainly valuable to us. I will accept it. But I just want to say that the two users who recently complained on the meta board to have their ANN threads deleted, later admitted that the files of their ANN threads did indeed contain malware.

(1) https://bitcointalk.org/index.php?topic=5575473.msg66442153#msg66442153
 (2) https://bitlist.co/post/66443555

And they also promised to fix it. Even the complaint they made was completely wrong.  Later they fully understood the fact that their files had malware. And one of them mentioned Xal0lex and apologized.Since they admitted that their files had malware and according to VirusTotal we are also somewhat clear that the file had suspicious malware, can't we be a little clear that VirusTotal is not giving out completely false information? Again as you said, even if VirusTotal doesn't detect anything, it can be risky for us to trust it, I believe so too.

I know you have noticed everything in the forum. Still, I mentioned the issue to show everyone. So if I am wrong, then I sincerely apologize to everyone. So I would like to know your opinion on this whole matter and ask for your advice.

[RGBTC]

That certainly doesn't mean that it is safe. I wouldn't trust software from some random person on the Internet even if Virustotal didn't detect anything. Virustotal just doesn't give much information in either direction.

My involvement in malware reporting is probably limited to just a few, but I guarantee all files/sites are fake and malicious, and I will also provide information to the original or valid source they are faking (if any) in the same post. Yeah, I don't rely too much on a single analyzer tool, especially Virustotal, after having some doubts over the past few years.
But I appreciate the hard work of the contributors to this thread; I believe they rely not only on scanning tools but also on account behavior patterns.

[Ms_Mining]

Account: anwaqa<= Please Banned
Fake Ann topic: [ANN] Norix | ProgPowZ

https://github.com/NoriXchain/NoriX/releases/download/1.2.0/Norix-qt-win.zip

[AuchanX]

A fake ANN of Norix has been found. I am submitting all the details here please take action against the user and the subject.

User: rabisa PLEASE BAN

Fake ANN: [ANN] Norix - Trusted & Secure Crypto Project (POW+POS)

Fake File:

Code:

https://github.com/NoriXchain/NoriX/releases/download/1.2.0/Norix-qt-win.zip

What I found after checking with Virus total:
Popular threat label
trojan.tedy/actor

https://www.virustotal.com/gui/file/d8c52d62c4a0e877e40b60e8ff4fba49a5412198924e7772c07a0e2ad0dcfa6f/detection

[Charcol]

Other fake topic Dilithion

User: twwoods Please ban

Topic Link: [ANN] Dilithion (DIL)

Fake File:

Code:

https://github.com/dilithion

https://www.virustotal.com/gui/file/72ae99cebd15f40ab6891057da8472a2cc41f3df2ae4359b26d650fc5ea871b0?nocache=1

The same fake issue of Dilithion has been found again.

User: DDDworld <-----   Please Ban this User

Fake Topic: [Dilithion (DIL) DILCOIN ]DDDDDDD

Fake File:

Code:

https://github.com/dilithion

[FinneysTrueVision]

Since they admitted that their files had malware and according to VirusTotal we are also somewhat clear that the file had suspicious malware, can't we be a little clear that VirusTotal is not giving out completely false information? Again as you said, even if VirusTotal doesn't detect anything, it can be risky for us to trust it, I believe so too.

I know you have noticed everything in the forum. Still, I mentioned the issue to show everyone. So if I am wrong, then I sincerely apologize to everyone. So I would like to know your opinion on this whole matter and ask for your advice.

The links you posted are not an admission of having malware. It is an admission of understanding why people were accusing them of this after it was explained that mining software can trigger false positives.

Deciding whether something is malware based on a simple VirusTotal scan is imperfect, since legitimate software and their many forks can trigger a false positive if they include the ability to mine crypto.

For example the latest release of the official Monero GUI software is flagged by 34 of 65 vendors. They are flagged for many of the same things as what people are being reported for in this thread.
https://www.virustotal.com/gui/file/9f3cf22fdb12cec1df6b1cb4cbe78d48457d68cbccdc46a82920a167885a988c

[Zaka1221]

Account: anwaqa<= Please Banned
Fake Ann topic: [ANN] Norix | ProgPowZ

https://github.com/NoriXchain/NoriX/releases/download/1.2.0/Norix-qt-win.zip

Today another Fake topic of Noris has been found which contain malware.

User: CoinAgeConsult << Please Ban this account

Topic Link: [ANN] Norix - Trusted & Secure Crypto Project (POW+POS)

Code:

https://github.com/NoriXchain/NoriX/releases/download/1.2.0/Norix-qt-win.zip

[MiningCoinsPool]

AUREUS (AURE) post:
https://bitcointalk.org/index.php?topic=5574769.0

CAPE Sandbox from virustotal claims it has a MALWARE with Process Injection (T1055)

They edited the Github link on the post, but from their website https://auracoin.gt.tc/ it says the source code is there:

https://github.com/sipherapex/aureus-core/

and from their releases section we find that file New_Windows_Wallet_1.0.2v_Aureuscoin.rar  that has the malware inside.

Virustotal:
https://www.virustotal.com/gui/file/3ad8f6c501dff62af839de610ed33754295e4016f09578ea868994578d39b6f7/behavior

Several posts for the same project, from that same user, here:
https://bitcointalk.org/index.php?topic=5575910.msg66455305

And also there:
https://bitcointalk.org/index.php?topic=5574716.msg66415838
https://bitcointalk.org/index.php?topic=5574965.msg66423578
https://bitcointalk.org/index.php?topic=5575167.msg66429915
https://bitcointalk.org/index.php?topic=5575179.msg66430349

User: Aur(cipher)

[Zaka1221]

Today I found fake topic of MOLEX coin with malware link and I am submitting all detail here please take action against user and topic.

User: ZayedCoin Please ban

Topic Link: [ANN] MOLEX Coin - kHeavyHash | PoW

Fake File:

Code:

https://github.com/Molex-chain/molex/releases/download/0.12.1/molex-wallet-0.12.1.zip

Reference: https://www.virustotal.com/gui/file/b1ad04a3c82b1893a0cab3489e20bed3c0efb351addef0f7daa7c2ea9c789eaf?nocache=1

[Zaka1221]

Topic Link: [ANN] MOLEX Coin - kHeavyHash | PoW

Reference: https://www.virustotal.com/gui/file/b1ad04a3c82b1893a0cab3489e20bed3c0efb351addef0f7daa7c2ea9c789eaf?nocache=1

Found another fake topic of MOLEX Coin which contain Malware.

User: Cerii Please Ban this user

Topic: [ANN] MOLEX Coin - kHeavyHash | PoW

Fake File:

Code:

https://github.com/Molex-chain/molex/releases/download/0.12.1/molex-wallet-0.12.1.zip

One more Fake topic

User: rwg4th Please Ban this user

Topic: [ANN] MOLEX Coin - kHeavyHash | PoW

Fake File:

Code:

https://github.com/Molex-chain/molex/releases/download/0.12.1/molex-wallet-0.12.1.zip

[AuchanX]

A fake ANN thread was found. And the file contained there clearly contained harmful malware.

User: ruscripto PLEASE BAN

Fake ANN: [ANN] SplitHash | Proof-of-Work

Fake File:

Code:

https://github.com/SPLITHASH/split-hash/releases/download/1.2.0/SplitHash-win64.zip

What I found after checking with Virus total:
Popular threat label
trojan.tedy/actor

https://www.virustotal.com/gui/file/ec3a505fe7ffbd73bc5d63f2c1f0664b45a3e758c303624c484df35c062ef951/detection

[Aur(cipher)]

AUREUS (AURE) post:
https://bitcointalk.org/index.php?topic=5574769.0

CAPE Sandbox from virustotal claims it has a MALWARE with Process Injection (T1055)

They edited the Github link on the post, but from their website https://auracoin.gt.tc/ it says the source code is there:

https://github.com/sipherapex/aureus-core/

and from their releases section we find that file New_Windows_Wallet_1.0.2v_Aureuscoin.rar  that has the malware inside.

Virustotal:
https://www.virustotal.com/gui/file/3ad8f6c501dff62af839de610ed33754295e4016f09578ea868994578d39b6f7/behavior

Several posts for the same project, from that same user, here:
https://bitcointalk.org/index.php?topic=5575910.msg66455305

And also there:
https://bitcointalk.org/index.php?topic=5574716.msg66415838
https://bitcointalk.org/index.php?topic=5574965.msg66423578
https://bitcointalk.org/index.php?topic=5575167.msg66429915
https://bitcointalk.org/index.php?topic=5575179.msg66430349

User: Aur(cipher)

Technical Debunking of CAPE Sandbox False Positives for Aureus Wallet

It is disappointing to see a project flagged based on a generic sandbox report that clearly misinterprets standard cryptocurrency wallet behavior. As a security researcher, I will break down why these "detections" are actually Standard Operational Procedures for any Bitcoin/Litecoin-core derivative.

1. The "Process Injection (T1055)" Myth:
The report flags rundll32.exe execution. This is a common False Positive in Qt6-based applications. The wallet uses these calls to load essential graphics and network libraries (D3Dcompiler_47.dll, Qt6Core.dll). Any wallet compiled with the Qt framework for Windows will trigger this in a low-level sandbox because it maps these DLLs into its memory space to render the interface. Calling this "Malware Injection" is technically illiterate.

2. Anti-Behavioral Analysis (OB0001) & Evasion:
The report mentions "Virtualization/Sandbox Evasion". This is a security feature, not a bug.
Bitcoin-core based wallets include entropy-gathering functions and anti-tampering mechanisms. These functions check the environment to ensure that private keys are not being extracted by a debugger. When the wallet detects it's in a "fake" sandbox environment (like CAPE), it intentionally alters its execution path or "sleeps" to prevent memory scraping. This protects the users!

3. "Long Sleeps" & Network Discovery:
Sandboxes have no internet access or peer-to-peer connectivity. A blockchain node is programmed to wait (Sleep) and retry peer discovery if it cannot find seeds. CAPE flags this as "Malware behavior" because it doesn't understand that a blockchain node must wait for network consensus.

4. Windows Error Reporting (WER) Actions:
The report shows the wallet accessing C:\ProgramData\Microsoft\Windows\WER. This happens because the sandbox environment itself is unstable and causes the application to trigger a standard Windows error report during its forced termination. This is a system-level action, not a malicious file operation.

5. The "Community Score" Fact:
Look at the VirusTotal Main Header: "0 / 60 - No security vendors flagged this file as malicious".
The most advanced antivirus engines in the world (Kaspersky, BitDefender, Symantec) all confirm the file is CLEAN. Only an automated, unconfigured Sandbox (CAPE) gave a generic warning based on heuristic patterns.

Conclusion:
If you flag every software that uses memory encryption and P2P networking as malware, then every crypto wallet in existence (including Bitcoin Core) is malware.

I challenge the reporter to point out a single malicious function in the publicly available source code. Until then, this is nothing but technical FUD (Fear, Uncertainty, Doubt).

Source Code: https://github.com/sipherapex/aureus-core/

in the end official website is https://aureuscoin.site  BTC

[Charcol]

A fake topic on Flow Protocol was found with malware links.

User: Plara  <-----   Please Ban this User

Fake ANN thread: [ANN] Flow Protocol (FTC) — Equihash + Keccak-256 | 81K Lines Original

Fake File:

Code:

[b]GitHub:[/b] https://github.com/Kristian5013/flow-protocol