Report Malware and Suspicious Links here so Mods can take Action !

[Charcol]

User: lakmali123 <-----  Please Ban this User

Fake ANN thread: [ANN] PYTHRAX - Welcome to the official thread!

Fake File:

Code:

https://github.com/PYTHRAX/PYTHRAX/releases/download/v1.0.0/PYTHRAX-v1.0.0-win-x64.zip

Edit: I would like to draw the attention of the moderator. I reported this thread a long time ago, but no action has been taken against it even though the wallet file associated with the thread contains the malicious trojan.yogi/geninflated. I am providing the proof below, please take action against the thread and the user.

Reference:
https://www.virustotal.com/gui/file/6131b5684f5b07c6213752bdde80a91d2554c43b757be09e550c0dad11cb78f6?nocache=1

[P2PKH_dude]

I just compiled the source code from the GitHub repo, and the resulting Windows NSIS installer produces a similar VirusTotal report.

Given that the source code looks clean (as far as I can tell), I'd lean towards this being a false positive.

Nothing is certain in life, but VirusTotal is notorious for producing false positives when it comes to crypto software. I'd suggest also compiling from source to see if you get a similar report.

Yes it does but the attempts to spread malware through the forum are quite rampant which is why these folks are doing a good job to clean the forum off malware. False positives can be contested as the reports can never be 100% accurate but most of them at least are. I think I have seen it happen before, but the member hasn't bothered to come around and appeal.

Yeah, of course, I'd say it's better to have false positives rather than false negatives, given how many people just download and run stuff without a second thought. I'm also grateful for the screening these guys do!

I'll see if I can get a hold of the BitcoinIII dev about this malware report (assuming it's a false positive). I used to be in the Discord group, and he mentioned being banned from here but not knowing why. Anything I should mention to him regarding defending his case or appealing?

[AakZaki]

According to what I understand about "Sysmon File Executable Creation Detected" is to be able to try new files that can be injected remotely.

Account: RGM-Core<= Please Banned
Fake ANN Thread: [ANN] RGMChain (RGM) — Dogecoin fork w/ native post-quantum (ML-DSA-44) addresse
archive

Code:

GitHub (node): https://github.com/rgmchain/rgm
Wallet: https://github.com/rgmchain/rgmwallet

VirusTotal Scan Result:https://www.virustotal.com/gui/file/ea8f1480a8fe837c0edebe122f4552722a585781cc40d4943c526f6305d516b0/behavior

Code:

Disable or Modify Tools:

Description
Tries to unhook or modify Windows functions monitored by CAPE
Match
Process rgmd.exe
{"unhook": "function_name: DnsQuery_UTF8, type: restored"}
{"unhook": "function_name: DnsQuery_W, type: restored"}
Show less
Description
Creates guard pages, often used to prevent reverse engineering and debugging
Match
page read and write | page guard
------------------------------------------------------

Data from Local System:

Description
Attempts to access Bitcoin/ALTCoin wallets
Match
C:\Users\Bruno\AppData\Roaming\RGM\wallet.dat
------------------------------------------------------

Application Layer Protocol:

Description
Starts servers listening on 127.0.0.1:0, ::1:22555, 127.0.0.1:22555, :::14030, 0.0.0.0:14030
Match
Process rgmd.exe
Description
Attempts to connect to a dead IP:Port
Match
Process rgmd.exe

According to an analysis:

• Disable or Modify Tools - allows malware to bypass antivirus
• Data from Local System - allows malware to access wallet.dat, Bitcoin/ALTCoin wallets
• Application Layer Protocol - allows malware to communicate to the Command & Control (C2) server

The simple visuals are as follows:

Code:

User run file
      ↓
Anti-detection (unhook + anti-debug)
      ↓
Drop executable (payload)
      ↓
Access wallet.dat (target)
      ↓
Open port (listener)
      ↓
Connect to C2
      ↓
Exfiltrate data

[lightbit]

User: anon2806 <----- Please Ban this User

Fake ANN thread: [ANN] AXORION - Welcome to the official thread!

Fake File:

Code:

https://github.com/AXORION/AXORION/releases/download/v1.0/AXORION-v1.0.0-win-x64.zip

Edit: New ANN Reported

User: xenobyte25 <----- Please Ban this User

Fake ANN thread: [ANN] QUORVEX - Welcome to the official thread!

Fake File:

Code:

https://github.com/QUORVEX-dev/QUORVEX/releases/download/v1.0/QUORVEX-v1.0.0-win-x64.zip

Edit 2: New ANN Reported

User: jupz <----- Please Ban this User

Fake ANN thread: [ANN] DRAKYLON - Welcome to the official thread!

Fake File:

Code:

https://github.com/DRAKYLON-core/DRAKYLON/releases/download/v1.0/DRAKYLON-v1.0.0-win-x64.zip

[Charcol]

User: jupz <-----  Please Ban this User

Fake ANN thread: [ANN] DRAKYLON - Welcome to the official thread!

Fake File:

Code:

[b]Download - [/b] https://github.com/DRAKYLON-core/DRAKYLON/releases/download/v1.0/DRAKYLON-v1.0.0-win-x64.zip

[lightbit]

User: Rakesh4444 <----- Please Ban this User

Fake ANN thread: [ANN] OMNIVRA - Welcome to the official OMNIVRA thread!

Fake File:

Code:

https://github.com/OMNIVRA/OMNIVRA/releases/download/v1.0/OMNIVRA-v1.0.0-win-x64.zip

User: Pat London <----- Please Ban this User

Fake ANN thread: [ANN] RYNVEX [RNX] - Welcome to the official thread!

Fake File:

Code:

https://github.com/RYNVEX-dev/RYNVEX/releases/download/v1.0/RYNVEX-v1.0.0-win-x64.zip

[$crypto$]

A self-moderated fake thread, this is spreading malware directly via Github links.

Account: Pat London This user recently woke up from a long period of inactivity. please ban
Fake ANN: [ANN] RYNVEX [RNX] - Welcome to the official thread!

Code:

[b]Windows:[/b] Official wallet has been released
[b]Download - [/b] https://github.com/RYNVEX-dev/RYNVEX/releases/download/v1.0/RYNVEX-v1.0.0-win-x64.zip

Virustotal: https://www.virustotal.com/gui/file/398ad6e0c515cbd5487266261504320d136a74d3d6f279b37700d64fd74465ba?nocache=1

Reported!

[Mitchell]

This dude doesn't know when to stop. Please also make sure to report them on GitHub, so their account gets banned.

[lightbit]

This dude doesn't know when to stop. Please also make sure to report them on GitHub, so their account gets banned.

Thanks, Mitchell. I’ll also report the associated GitHub repositories from now on.

[lightbit]

User: tanjilahmed4000 <----- Please Ban this User

Fake ANN thread: [ANN] QUORATHIS - Welcome to the official thread!

Fake File:

Code:

https://github.com/QUORATHIS-dev/QUORATHIS/releases/download/v1.0/QUORATHIS-v1.0.0-win-x64.zip

Report their GitHub: https://github.com/QUORATHIS-dev

I have reported them on GitHub as well.

_______________________________________________________________________________ _______________________________________

#2

User: lonohaze <----- Please Ban this User

Fake ANN thread: [ANN] ⭐SYLVORIX - Welcome to the official thread!

Fake File:

Code:

https://github.com/SYLVORIX-core/SYLVORIX/releases/download/v1.0/SYLVORIX-v1.0.0-win-x64.zip

[lightbit]

User: Dharman <----- Please Ban this User

Fake ANN thread: [ANN] 💎 NYXELITH - Welcome to the official thread!

Fake File:

Code:

https://github.com/NYXELITH-dev/NYXELITH/releases/download/v1.0/NYXELITH-v1.0.0-win-x64.zip

#2

User: marcusism <----- Please Ban this User

Fake ANN thread: [ANN] PYROTHAR - Welcome to the official thread!

Fake File:

Code:

https://github.com/PYROTHAR-dev/PYROTHAR/releases/download/v1.0/PYROTHAR-v1.0.0-win-x64.zip

[lightbit]

User: bitkingx <----- Please Ban this User

Fake ANN thread: [ANN] ASTRONYX - Welcome to the official thread!

Fake File:

Code:

https://github.com/ASTRONYX-dev/ASTRONYX/releases/download/v1.0/ASTRONYX-v1.0.0-win-x64.zip

#2

User: CryptoGuru88 <----- Please Ban this User

Fake ANN thread: [ANN] ZYTHERION - Welcome to the official thread!

Fake File:

Code:

https://github.com/ZYTHERION-dev/ZYTHERION/releases/download/v1.0/ZYTHERION-v1.0.0-win-x64.zip

#3

User: haniy2kfire <----- Please Ban this User

Fake ANN thread: [ANN] THALOR | Kawpow | Fair Launch | Zero Premine | Windows Wallet Already

Fake File:

Code:

https://github.com/THALOR-core/THALOR/releases/download/v0.1/THALOR-win-x64.zip

[AakZaki]

This wallet contains a lot of Malware 14/69 security vendors flagged this file as malicious

Account: salmanaf08<= Please Banned
Fake ANN Thread: [ANN] Vortexa (VTXA) – Koin GPU KawPoW Baru yang Tahan terhadap ASIC
archive

Code:

[b]Windows Qt Wallet v0.1[/b] — already released  
Download: https://github.com/VORTEXA-core/VORTEXA/releases/download/v0.1/VORTEXA-win-x64.zip

VirusTotal Scan Result: https://www.virustotal.com/gui/file/86239075c5a96d741b4dff7b1391133f7390e6393f8619886779f2d9319868bd?nocache=1

[lightbit]

User: TxToker36 <----- Please Ban this User

Fake ANN thread: [ANN] VORTEXA - Welcome to the official thread!

Fake File:

Code:

https://github.com/VORTEXA-core/VORTEXA/releases/download/v0.1/VORTEXA-win-x64.zip

[lightbit]

User: said1998 <----- Please Ban this User

Fake ANN thread: [ANN] ★ Hashora (HORA) ★ RandomX CPU Coin | Mine Now

Fake File:

Code:

https://github.com/HASHORA-core/HASHORA/releases/download/v0.1/HASHORA-win-x64.zip

[AakZaki]

This wallet contains a lot of Malware 14/62 security vendors flagged this file as malicious

Account: Share_Coin<= Please Banned
Fake ANN Thread: [SHC] Sharecoin - KawPow GPU mining, no premine
archive

Code:

Desktop and Android wallets, both open source:
[url=https://github.com/TVHeroes/sharecoin-simple-wallet]github.com/TVHeroes/sharecoin-simple-wallet[/url] (Windows desktop)

VirusTotal Scan Result: https://www.virustotal.com/gui/file/77f803ec149751c0b625a7b29f1561733c9d457fdca1b102ac9796a22f1de67c?nocache=1

[AakZaki]

This wallet contains a lot of Malware 8/65 security vendors flagged this file as malicious
Potential Raspberry Robin Registry Set Internet Settings ZoneMap

Account: jemma<= Please Banned
Fake ANN Thread: [ANN] QuantOS (QOS) | Layer 1 blockchain | GPU POW | 21M supply
archive

Code:

[size=14pt][b] Wallet[/b][/size]

https://github.com/perlmine1/quantos/releases/download/1.0.0/quantos-v1.0.0-win64.zip

VirusTotal Scan Result: https://www.virustotal.com/gui/file/bf01a605eb40f9c611c4ca673ed9bcc6d4238b24a1be57db2eb38d7e84a1ca29/detection

[lightbit]

User: btcthm <----- Please Ban this User

Fake ANN thread: [ANN] Snowdrift (SDW) - RandomX Proof-of-Work for CPUs. 100% fair launch

Fake File:

Code:

https://github.com/snowdrift-dev/snowdrift-wallet/releases/download/v0.1.0/

[$crypto$]

Fake thread - - - Kestrel, an account that suddenly wakes up just woke up a possible hacked account with a self-moderated thread.

Account: la_kings please ban
Fake ANN: [ANN] Kestrel (KES) — a fair-launch RandomX coin for ordinary CPUs

Code:

[url=https://kestrel-dev.github.io/kestrel/downloads/windows/]https://kestrel-dev.github.io/kestrel/downloads/windows[/url]
[url=https://github.com/kestrel-dev/kestrel-wallet/releases]https://github.com/kestrel-dev/kestrel-wallet/releases[/url]
[url=https://kestrel-dev.github.io/kestrel/explorer/]https://kestrel-dev.github.io/kestrel/explorer[/url]

https://www.virustotal.com/gui/file/11238a799c17774d48cca1de03f6b1d49f20c1d0ab552c81da58558e61dee047?nocache=1

Github account has been reported!

[Crypto Library]

I don't know if this is legit or Malware, but still suspicious because this(ripple) account woke up recently after 8years and posts this thread first.

[ANN] Timbre (TMB) Fair launch · No premine · No ICO · Fixed supply · MIT


Can anyone check and verify this?

Code: https://github.com/timbre-dev/timbre-wallet/releases/download/v0.1.0/timbre-wallet-windows-0.1.0.zip

Don't download it , this is for only verify


I tried on the virust total but still it shows the file doesn't contain any malware.

So are they using any special method through which they can bypass VirusTotal?