Hey guys,
yesterday I have sent a PM to vit1988 (admin of coinichiwa.com) and I asked him about this situation. Convicted2008 aka Neonecrox13 said the problem was a dicebot ( named 999DICE.EXE) a fake bot (maybe a keylogger).
Reference :
Vit1988 has replied to me (with the chat log) that an user named "Tiktakbym159" has posted the link of that "bot" in the chat , this is the log:
RPUSH "chat:english" "{\"channel\":\"english\",\"from\":\"Tiktakbym159\",\"msg\":\"Know stratum 1 BTC 1 click and there will be 2 BTK! who should be added to the h t t p s://www.dropbox.com/s/hbosomsnyicqxtf/999dice.exe?dl=0\",\"color\":\"white\",\"date\":\"2015-01-25 18:35:09\",\"avatar\":\"/av/none.png\"}"
RPUSH "chat:english" "{\"channel\":\"english\",\"from\":\"Tiktakbym159\",\"msg\":\"h t t p s://www.dropbox.com/s/caoh261p554rvqv/%28%2B1%29Bitcoin-no-time.exe?dl=0\",\"color\":\"white\",\"date\":\"2015-01-24 21:43:12\",\"avatar\":\"/av/none.png\"}"
Now the first file was deleted but the second file (a MALWARE) is still "online" and this is the scan of it :
https://www.virustotal.com/en/file/eafbd90016b127e3de0a9cecc300d513c9f4e7ad110d359f68ee3857b6e4e73b/analysis/1426160381/
Now I can tell that (at 99%) the Convicted2008's forum account was victim of a malicious .exe file .
yesterday I have sent a PM to vit1988 (admin of coinichiwa.com) and I asked him about this situation. Convicted2008 aka Neonecrox13 said the problem was a dicebot ( named 999DICE.EXE) a fake bot (maybe a keylogger).
Reference :
LOOK THROUGH THE HISTORY I FUCKING USED OGNASTY FOR THE ESCROW OF THE SILVERFISH WHEN I BOUGHT THEM. I BOUGHT THE S1 OFF HERE AS WELL. THE HISTORY OF THE ACCOUNT WILL SHOW THAT IF YOU FUCKING LOOKED.
ALSO. I've very active in games and rounds? LOOK AT THE DATES. ITS JUST BEEN FOR THIS WEEK! I NEVER EVEN KNEW GAMES AND ROUNDS EXISTED UNTIL A WEEK AGO IF THAT.
I DIDN'T BUY FUCKING SHIT. I MADE THAT ACCOUNT WHEN I FIRST STARTED LEARNING ABOUT BITCOINS. I CAN GUARENTEE IF THE MODS WILL SHOW WHAT DATE THE EMAIL WAS CHANGED IT WILL COINCIDE WITH WHEN I POSTED ABOUT MY FORTUNEJACK ACCOUNT BEING HACKED AFTER I DOWNLOADED A 999DICE.EXE I THOUGTH WAS A DICE BOT.
IF I WAS THAT FUCKING CANDYSTRIPES U FUCKING THINK I'M GONNA SPEND THIS MUCH FUCKING TIME ARGUEING WITH YOU OR TRYING TO FIND A ANSWER? IF YOU HAVE DEALT WITH THEM ENOUGH APPARENTLY U KNOW THERE TYPING MANNERISMS AND OTHER THINGS ABOUT THEM? DO I FUCKING SOUND LIKE THEM? FUCK NO I READ THAT CHAT U WAS HAVING WITH THEM. THAT WHORE CAN'T EVEN SPEAK FUCKING ENGLISH. A FUCKING IDIOT CAN SEE THAT.
THATS WHAT I'M TRYING TO TELL YOU. I NEVER BOUGHT THAT ACCOUNT THAT MY MY FIRST ACCOUNT I HAD AND HAVE ALWAYS USED. I CAN'T FUCKING SEARCH BUT EVERY 90 SECONDS NOW BUT LOOK THROUGHT CONVICTED2008'S HISTORY. THEY ARE POSTS THAT SHOW I WAS HACKED ON OR ABOUT THAT DATE U SAY I BOUGHT THE ACCOUNT. I HAD NO IDEA THAT THEY HAD GOT MY BITCOINTALK ACCOUNT AS WELL UNTIL YESTERDAY
ALSO. I've very active in games and rounds? LOOK AT THE DATES. ITS JUST BEEN FOR THIS WEEK! I NEVER EVEN KNEW GAMES AND ROUNDS EXISTED UNTIL A WEEK AGO IF THAT.
I DIDN'T BUY FUCKING SHIT. I MADE THAT ACCOUNT WHEN I FIRST STARTED LEARNING ABOUT BITCOINS. I CAN GUARENTEE IF THE MODS WILL SHOW WHAT DATE THE EMAIL WAS CHANGED IT WILL COINCIDE WITH WHEN I POSTED ABOUT MY FORTUNEJACK ACCOUNT BEING HACKED AFTER I DOWNLOADED A 999DICE.EXE I THOUGTH WAS A DICE BOT.
IF I WAS THAT FUCKING CANDYSTRIPES U FUCKING THINK I'M GONNA SPEND THIS MUCH FUCKING TIME ARGUEING WITH YOU OR TRYING TO FIND A ANSWER? IF YOU HAVE DEALT WITH THEM ENOUGH APPARENTLY U KNOW THERE TYPING MANNERISMS AND OTHER THINGS ABOUT THEM? DO I FUCKING SOUND LIKE THEM? FUCK NO I READ THAT CHAT U WAS HAVING WITH THEM. THAT WHORE CAN'T EVEN SPEAK FUCKING ENGLISH. A FUCKING IDIOT CAN SEE THAT.
THATS WHAT I'M TRYING TO TELL YOU. I NEVER BOUGHT THAT ACCOUNT THAT MY MY FIRST ACCOUNT I HAD AND HAVE ALWAYS USED. I CAN'T FUCKING SEARCH BUT EVERY 90 SECONDS NOW BUT LOOK THROUGHT CONVICTED2008'S HISTORY. THEY ARE POSTS THAT SHOW I WAS HACKED ON OR ABOUT THAT DATE U SAY I BOUGHT THE ACCOUNT. I HAD NO IDEA THAT THEY HAD GOT MY BITCOINTALK ACCOUNT AS WELL UNTIL YESTERDAY
Vit1988 has replied to me (with the chat log) that an user named "Tiktakbym159" has posted the link of that "bot" in the chat , this is the log:
RPUSH "chat:english" "{\"channel\":\"english\",\"from\":\"Tiktakbym159\",\"msg\":\"Know stratum 1 BTC 1 click and there will be 2 BTK! who should be added to the h t t p s://www.dropbox.com/s/hbosomsnyicqxtf/999dice.exe?dl=0\",\"color\":\"white\",\"date\":\"2015-01-25 18:35:09\",\"avatar\":\"/av/none.png\"}"
RPUSH "chat:english" "{\"channel\":\"english\",\"from\":\"Tiktakbym159\",\"msg\":\"h t t p s://www.dropbox.com/s/caoh261p554rvqv/%28%2B1%29Bitcoin-no-time.exe?dl=0\",\"color\":\"white\",\"date\":\"2015-01-24 21:43:12\",\"avatar\":\"/av/none.png\"}"
Now the first file was deleted but the second file (a MALWARE) is still "online" and this is the scan of it :
https://www.virustotal.com/en/file/eafbd90016b127e3de0a9cecc300d513c9f4e7ad110d359f68ee3857b6e4e73b/analysis/1426160381/
Now I can tell that (at 99%) the Convicted2008's forum account was victim of a malicious .exe file .
I would like to personally thank you Redsnow for this. I feel that you have went above and beyond what anybody would have done. I do feel that you are also entitled to the bounty I offered to show that I had no involvement in this act against Quickseller. I do apologize to Quickseller because of this even though I had no action involved. Redsnow I will message you as well about the btc I'm gonna send you. Thank you very much for this post.
