Report Malware and Suspicious Links here so Mods can take Action !

[Welsh]

All the contents of the ANN including the malicious link are the same as those in the earlier report. I will try to get GitHub to delete his profile.

Pretty sure these two accounts are connected: chikon that I just nuked for another topic by a different name. Almost all the accounts are inactive for several years, appear randomly and then post dodgy projects. I'm convinced that most of these are controlled by the same user / group at this point which I've suspected for quite some time.

A lot of the accounts seem to be old bounty users too with a very small amount of posts. I don't know if its worth looking at the seclog and finding some correlation because its not really going to achieve much. They seem to have an unlimited arsenal at this point.

[Charcol]

User: daciana.postavaru

Fake ANN thread: [ANN] Quantex (QTX) - Official ANN

Fake File:

Code:

[b]Download from GitHub[/b] - https://github.com/Quantex-dev/Quantex/releases/download/v1.0.0/Quantex-1.0.0-win-x64.zip

Download XMRig from: [url=https://github.com/xmrig/xmrig/releases]https://github.com/xmrig/xmrig/releases

[Charcol]

User: Bkewlbro

Fake ANN thread: [ANN] ZTX – Zentrix GPU Coin | KawPoW | Difficulty Still Minimum |

Fake File:

Code:

[b]Download from GitHub[/b] - https://github.com/Zentrix-proj/Zentrix/releases/download/v1.0.0/Zentrix-1.0.0-win-x64.zip

[$crypto$]

Fake Thread --- Corelium is a fake brand that spreads malicious malware/trojan links with github being spread, it is likely that this is a hacked account that does this.

Account: Germzy This user recently woke up from a long period of inactivity. please ban
Fake ANN: [ANN] Corelium - Official topic

Code:

[size=13pt][b]Download Corelium Core for Windows[/b][/size] - https://github.com/Corelium/Corelium/releases/download/v1.0.0/Corelium-1.0.0-win-x64.zip

Virustotal: https://www.virustotal.com/gui/file/ee0b365aa2a9b1681e7e10562648f22eded71b1e7e55a2c3180f25e07cafcbad?nocache=1

Reported!

[$crypto$]

Xynarium is a fake thread that spreads malware/trojan links through Github that are likely done by hacked accounts.

Account: xinberg This user recently woke up from a long period of inactivity. please ban
Fake ANN: [ANN] Xynarium - Welcome to the official Xynarium announcement thread

Code:

[size=13pt][b]Download Xynarium Core for Windows (Tor‑ready)[/b][/size] - https://github.com/Xynarium/Xynarium/releases/download/v1.0.0/Xynarium-1.0.0-win-x64.zip

Virustotal: 14/64 https://www.virustotal.com/gui/file/14214d54d1c01875dc78e8bd2bf8d74b5d8312fc18df5a7b2943f9bcf75e8630?nocache=1

Reported!

[Xal0lex]

Could someone check this file? VirusTotal isn't working for me (it keeps asking for a CAPTCHA).

Code:

https://github.com/Eidolon-dev/Eidolon/releases/download/v1.0.0/Eidolon-1.0.0-win-x64.zip

[juttsab@]

Could someone check this file? VirusTotal isn't working for me (it keeps asking for a CAPTCHA).

Code:

https://github.com/Eidolon-dev/Eidolon/releases/download/v1.0.0/Eidolon-1.0.0-win-x64.zip

Here is Virustotal scan:

https://www.virustotal.com/gui/file/6128b58299e971c0c7351d35e0fa85f5672ba74717021f811ccd323b33b223a7?nocache=1

[SilverCryptoBullet]

Could someone check this file? VirusTotal isn't working for me (it keeps asking for a CAPTCHA).

Code:

https://github.com/Eidolon-dev/Eidolon/releases/download/v1.0.0/Eidolon-1.0.0-win-x64.zip

It's clean with this one
https://www.virustotal.com/gui/url/78100305e105242c1cb1848ad3651bdabd66115230461d230269a9f4f59d5318?nocache=1

With the file, let's see the result from virustotal
https://www.virustotal.com/gui/file/308e7ea49fea831702fa869ca0e909c90bf8f6899e5cb6392fa556e7a685db63?nocache=1

21/69 security vendors flagged this file as malicious
Popular threat label
trojan.yogi/geninflated

[logfiles]

Could someone check this file? VirusTotal isn't working for me (it keeps asking for a CAPTCHA).

Code:

https://github.com/Eidolon-dev/Eidolon/releases/download/v1.0.0/Eidolon-1.0.0-win-x64.zip

here is another angle

The extracted file once executed masquerades as a Windows application installer and the downloads another small file from this malicious link (plain HTTP, raw IP, no domain).:

Code:

http://31.77.168.180:5000/refac.exe

The downloaded file refac.exe then gets executed in the background, and its purpose is to harvest browser data (passwords, cookies, sessions etc.), and calls out to a geolocation API prior to further activity.
It looks into these folders paths

Code:

    • \Google\Chrome\User Data and \Google\Chrome\Application\Chrome.exe
    • \BraveSoftware\Brave-Browser\User Data and \...\Application\brave.exe
    • \Mozilla\Firefox\Profiles\
    • \Yandex\YandexBrowser\User Data

Here is a virus total report for the file that downloads in the background: 62/70 vendors say it's malicious https://www.virustotal.com/gui/file/6144677a8ff6d6cb5b04403c9f07ea326419600f9b469a95502fa022613c56bd/detection

[Xal0lex]

Could someone check this file? VirusTotal isn't working for me (it keeps asking for a CAPTCHA).

Code:

https://github.com/Eidolon-dev/Eidolon/releases/download/v1.0.0/Eidolon-1.0.0-win-x64.zip

It's clean with this one
https://www.virustotal.com/gui/url/78100305e105242c1cb1848ad3651bdabd66115230461d230269a9f4f59d5318?nocache=1

With the file, let's see the result from virustotal
https://www.virustotal.com/gui/file/308e7ea49fea831702fa869ca0e909c90bf8f6899e5cb6392fa556e7a685db63?nocache=1

21/69 security vendors flagged this file as malicious
Popular threat label
trojan.yogi/geninflated

Could someone check this file? VirusTotal isn't working for me (it keeps asking for a CAPTCHA).

Code:

https://github.com/Eidolon-dev/Eidolon/releases/download/v1.0.0/Eidolon-1.0.0-win-x64.zip

here is another angle

The extracted file once executed masquerades as a Windows application installer and the downloads another small file from this malicious link (plain HTTP, raw IP, no domain).:

Code:

http://31.77.168.180:5000/refac.exe

The downloaded file refac.exe then gets executed in the background, and its purpose is to harvest browser data (passwords, cookies, sessions etc.), and calls out to a geolocation API prior to further activity.
It looks into these folders paths

Code:

    • \Google\Chrome\User Data and \Google\Chrome\Application\Chrome.exe
    • \BraveSoftware\Brave-Browser\User Data and \...\Application\brave.exe
    • \Mozilla\Firefox\Profiles\
    • \Yandex\YandexBrowser\User Data

Here is a virus total report for the file that downloads in the background: 62/70 vendors say it's malicious https://www.virustotal.com/gui/file/6144677a8ff6d6cb5b04403c9f07ea326419600f9b469a95502fa022613c56bd/detection

Guys, no need for all those details 😀 The first answer was enough for me.

Thanks.

[AakZaki]

Indirectly they don't include the GitHub link that goes to the .exe file, but the GitHub link if we refer to the wallet part, the .exe wallet file is there along with the .dmg file for macOS and all of it contains Trojan Malware 5/69 and 6/60 security vendors flagged this file as malicious

Account: fernanditu<= Please Banned
Fake ANN Thread: [ANN][BRVA] Brisvia — CPU-mineable RandomX coin | 0% premine | Fair launch Aug 1
archive

Code:

https://github.com/brisvia/brisvia-desktop/releases/tag/v0.5.0

[b]Download[/b] it — [url=https://github.com/brisvia/brisvia-desktop/releases/download/v0.5.0/Brisvia-Miner-Windows.exe]Windows (.exe)[/url], [url=https://github.com/brisvia/brisvia-desktop/releases/latest/download/Brisvia-Miner-macOS.dmg]Mac (.dmg)[/url]

VirusTotal Scan Result: https://www.virustotal.com/gui/file/e99ff6b0a0f29780774a85691d9361533bf68014b00a13fa1bb5b48122d1a8a3
VirusTotal Scan Result: https://www.virustotal.com/gui/file/ecfcf82bd535f98ab60908a5811b3574e890ab1b510e56aca4af0f17e996ebb3?nocache=1

[AakZaki]

They appear again with a different new account

Indirectly they don't include the GitHub link that goes to the .exe file, but the GitHub link if we refer to the wallet part, the .exe wallet file is there along with the .dmg file for macOS and all of it contains Trojan Malware 5/69 and 6/60 security vendors flagged this file as malicious

Account: brisvia<= Please Banned
Fake ANN Thread: [ANN][BRVA] Brisvia — CPU-mineable RandomX coin | 0% premine | Fair launch Aug 1
archive

Code:

[b]Download:[/b] · Releases: [url=https://github.com/brisvia/brisvia-desktop/releases]github.com/brisvia/brisvia-desktop/releases[/url]

VirusTotal Scan Result: https://www.virustotal.com/gui/file/e99ff6b0a0f29780774a85691d9361533bf68014b00a13fa1bb5b48122d1a8a3
VirusTotal Scan Result: https://www.virustotal.com/gui/file/ecfcf82bd535f98ab60908a5811b3574e890ab1b510e56aca4af0f17e996ebb3?nocache=1

[AakZaki]

They appear again with a different new account

Indirectly they don't include the GitHub link that goes to the .exe file, but the GitHub link if we refer to the wallet part, the .exe wallet file is there along with the .dmg file for macOS and all of it contains Trojan Malware 5/69 and 6/60 security vendors flagged this file as malicious

Account: brisvia<= Please Banned
Fake ANN Thread: [ANN][BRVA] Brisvia — CPU-mineable RandomX coin | 0% premine | Fair launch Aug 1
archive

Again he came back with a new account again and made ANN again. It looks like they did it on purpose
5/70 security vendors flagged this file as malicious

Account: brisviacoin<= Please Banned
Fake ANN Thread: [ANN][BRVA] Brisvia — CPU-mineable RandomX coin | 0% premine | Fair launch Aug 1
archive

Code:

[b]Official releases page:[/b] https://github.com/brisvia/brisvia-desktop/releases

https://www.virustotal.com/gui/file/6025b4af8186ca922de83db4b208cda840a37561a3cdecec702df067a5ad6266?nocache=1