Bitcoin Forum>Other>Meta
Pages:
Author

Topic: Report Malware and Suspicious Links here so Mods can take Action ! - page 23. (Read 36688 times)

Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
August 09, 2021, 07:49:51 AM
#1138
Quote from: Rizzrack on August 09, 2021, 05:28:18 AM
Since he has been allegedly hacked the best thing to do would be to direct him to this thread so he would send us an email.
Thanks and i have written that he should be sending the Recovery Team an email to the email adress from theymos thread about Hacked Accounts.
Also i have written that he should write in this Thread here when his Account is fully back in his hands and recovered , so i can remove my Feedback i have given back in the days.
And thats why like to write in this Thread for using it as reference , sometimes it helps to get Users there Account back .

Rizzrack
copper member
Activity: 783
Merit: 710
Defend Bitcoin and its PoW: bitcoincleanup.com
Re: Report Malware and Suspicious Links here so Mods can take Action !
August 09, 2021, 05:28:18 AM
#1137
Quote from: Lafu on August 09, 2021, 05:11:09 AM
...my question is now when i am write him back that he should be open a new Thread in Meta or is enough that he write in here ?
Or should i just write him that he should be just send an email to [email protected] from his original email adress as far this not also hacked ?
Let me know and i will reply to his pm i got .

Since he has been allegedly hacked the best thing to do would be to direct him to this thread so he would send us an email.

Quote from: theymos on December 26, 2018, 10:48:07 AM
If your account was hacked

Email [email protected], ideally from the account's email address. Include your username and a brief description of the details of how/when the account was hacked. A signature will likely be required
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
August 09, 2021, 05:11:09 AM
#1136
Quote from: Rizzrack on July 30, 2021, 05:38:03 AM
Thanks for keeping an eye out!!

No problem i doing my best to find and report them , even when they got catched from mitchells bot mostly !

Following text is for reference !

But anyway i have an Account for you that sended me an PM that his real Account got banned as it was reported from me in here !

Account name : flooren is the Account from the User : MasterPP

Thats the post why he got banned !
Quote from: Lafu on October 05, 2020, 10:46:08 AM
User : flooren  <----- Please Ban that User

Last Post from that User was in September 13, 2020 , possible Account got Hacked

Archive : https://loyce.club/archive/posts/5532/55321757.html

Post : https://bitcointalksearch.org/topic/claymores-dual-ethereum-amdnvidia-gpu-miner-v150-windowslinux-1433925  <-----  Please delete this post
Quote from: ?? on ??
New project for miners, absolute free, this project development "ETHlargement" - EthereumPill release

Code:
[b]More info:[/b] https://github.com/EthereumPill/PillForETH/releases/tag/1.0.0
Thats the PM i got today from the User MasterPP

Quote from: MasterPP on August 09, 2021, 06:57:21 AM
Quote
User : flooren  <----- Please Ban that User

Last Post from that User was in September 13, 2020 , possible Account got Hacked

Archive : https://loyce.club/archive/posts/5532/55321757.html

Hello.
Flooren: this is my first account got hacked, and someone work from my account
How i can back my first account ?
Thank you

@Rizzrack , @Cyrus , @alanst my question is now when i am write him back that he should be open a new Thread in Meta or is enough that he write in here ?
Or should i just write him that he should be just send an email to [email protected] from his original email adress as far this not also hacked ?
Let me know and i will reply to his pm i got .

Rizzrack
copper member
Activity: 783
Merit: 710
Defend Bitcoin and its PoW: bitcoincleanup.com
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 30, 2021, 05:38:03 AM
#1135
Quote from: Lafu on July 29, 2021, 10:16:12 PM
Guess there is a new style of Fake downloads for PhoenixMiner Versions !
Just saw a post and done some more research of the User and looks like it got maybe hacked or sold !
Account : victorviran  <------   Please ban that User and delete the Post

Not really new...
https\\github.com\PhoenixMinerTeam
https\\github.com\PhoenixMlnerDevTeam (L insted of i)
https\\github.com\PhoenixDevTeamMiner
https\\github.com\PhoenixDevMinerTeam
https\\github.com\Phoenix-MinerDev
https\\github.com\PhoenixMiner-TeamDev
https\\github.com\PhoenixDev-Team-Miner
https\\github.com\Phoenix-DevMinerTeam
https\\github.com\PhoenixMiner-Team-Dev/
and now
https\\github.com\Phoenix-Miner-TeamDev/

Guess they focus on phoenix miner because of it's popularity overall and on bitcointalk (one of the top traffic keywords) and because it only recently has an "official" website (https://phoenixminer.info)

Thanks for keeping an eye out!! Luckily their posts don't last more than a few minutes Smiley
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 29, 2021, 10:16:12 PM
#1134
Quote from: qwertyup23 on July 28, 2021, 09:30:53 AM
Thank you for going the extra mile and checking it, Lafu!

No problem , you are welcome  Smiley


Guess there is a new style of Fake downloads for PhoenixMiner Versions !
Just saw a post and done some more research of the User and looks like it got maybe hacked or sold !


Quote from: ?? on ??
The new beta version is finally ready. You can download PhoenixMiner 5.7a from here:

[url_https_://github.com/Phoenix-Miner-TeamDev/PhoenixMiner/releases/download/5.7a/PhoenixMiner_5.7a_Windows.zip]PhoenixMiner_5.7a_Windows.zip[/url] (GitHub)
[url_https_://github.com/Phoenix-Miner-TeamDev/PhoenixMiner/releases/download/5.7a/PhoenixMiner_5.7a_Linux.tar.gz]PhoenixMiner_5.7a_Linux.tar.gz[/url] (GitHub)
The Github Account was created 20 Hours ago .
I tried to download the file from Github but i instant got an warning from the download manager that the File is a Virus or Malware

The Account of the User victorviran last post was back in January 08, 2019
Guess its hacked or sold .

Post : https://bitcointalksearch.org/topic/phoenixminer-62c-fastest-ethereumethash-miner-with-lowest-devfee-winlinux-2647654

Account : victorviran  <------   Please ban that User and delete the Post




qwertyup23
hero member
Activity: 2268
Merit: 789
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 28, 2021, 09:30:53 AM
#1133
Quote from: Lafu on July 28, 2021, 08:14:15 AM
From what i can see on the detection list from Virustotal there are a lot of false positive detections !

There is only 1 detection , but anyway the Thread is deleted already now if it is a serious project they will be asking why it was deleted .


Yup this is true.

Normally, I would check the windows wallet only for viruses in virus total. Upon checking it also, it only contained one false-positive result, so I tried downloading the Mac wallet also. To my surprise, it contained 14 detections (most are false-positive) but the fact that the thread has been deleted and the user just recently awoken, those evidences conclude that the wallet did contain some malware on it.

Thank you for going the extra mile and checking it, Lafu!
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 28, 2021, 08:14:15 AM
#1132
Quote from: qwertyup23 on July 28, 2021, 04:36:52 AM
1. Malware from Github link and Fake Wallet

Thread: TEDDYBYTE - CRYPTOCURRENCY BASED CHATTING APPLICATION - POS/MN COIN <---- DELETE

Profile Link: vingg
----> Recently awoken account: Last post February 14, 2018

Archive: https://archive.fo/f4ojx

Virus Total Link/s:

Code:
https://github.com/TDBDevelopers/teddycore/releases/download/v1.0.0/TDB-MacOs.dmg






From what i can see on the detection list from Virustotal there are a lot of false positive detections !

Trojan.Application.MAC.Miner.6
MacOS:BitCoinMiner-BT [PUP]
Gen:Variant.Application.MAC.Miner.6 (B)
A Variant Of OSX/CoinMiner.AU Potentially Unwanted
BitCoinMiner (PUA)
Not-a-virus:HEUR:RiskTool.OSX.Miner.j

Source : https://www.virustotal.com/gui/file/e6a683396b5b029d316e8f77b51a899bf28498e6297a12fe5994f73ae40ffd47/detection
You only checked the Wallet for MAC and this Wallet has miner integrated.

But since the User just woked up and posted this Thread and wallet its possible that there is something wrong with the Wallet.

Thats the result for Windows Wallet : https://www.virustotal.com/gui/file/d080cfcf83b55b56050793946f2b16d9bd7ac5479eac834fcd4e64bc85245a18/detection
There is only 1 detection , but anyway the Thread is deleted already now if it is a serious project they will be asking why it was deleted .
qwertyup23
hero member
Activity: 2268
Merit: 789
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 28, 2021, 04:36:52 AM
#1131
1. Malware from Github link and Fake Wallet

Thread: TEDDYBYTE - CRYPTOCURRENCY BASED CHATTING APPLICATION - POS/MN COIN <---- DELETE

Profile Link: vingg
----> Recently awoken account: Last post February 14, 2018

Archive: https://archive.fo/f4ojx

Virus Total Link/s:

Code:
https://github.com/TDBDevelopers/teddycore/releases/download/v1.0.0/TDB-MacOs.dmg



lovesmayfamilis
legendary
Activity: 2072
Merit: 4265
✿♥‿♥✿
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 28, 2021, 03:36:26 AM
#1130
6 security vendors flagged this file as malicious
ANN Thread: https://bitcointalksearch.org/topic/m.57562128
Archive link: https://web.archive.org/web/20210728083110/https://bitcointalk.org/index.php?topic=5351473.msg57562128
Profile link: https://bitcointalksearch.org/user/biggiddybust-1803813
Website link: www.bitcoinlove.ca
Archive link: https://web.archive.org/web/20210728083332/https://www.bitcoinlove.ca/



https://www.virustotal.com/gui/url/2605abfb5e4fffc21a0f6d28f9f6f1cebabf5a7008e4aff1760e677ae8e6fa50/detection


https://www.virustotal.com/gui/file/bc7858b2368810dd4f91793ac22664dbba48db987ae4f81bc87133a0cdacf83b/detection
DaveF
legendary
Activity: 3500
Merit: 6320
Crypto Swap Exchange
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 11, 2021, 07:54:54 PM
#1129
They also seem to be staying up much longer.
The one below was posted at 09:49:54 AM my time, I reported it at 10:05:28 AM when I saw it.
They never used to stay up for 15 minutes.

Oh well, guess we just have to start being a bit more proactive on this till the reporting bot is fixed.

And after I reported it, it was still up for a while. Guess the mods were on a lunch break.

-Dave

Quote from: ?? on ??
The new beta version is finally ready. You can download PhoenixMiner 5.7a from here:
.....
DaveF
legendary
Activity: 3500
Merit: 6320
Crypto Swap Exchange
Re: Report Malware and Suspicious Links here so Mods can take Action !
July 10, 2021, 05:13:49 PM
#1128
So the PhoenixMiner malware people are back. Or they have at least changed their posing bot enough to fool the malware reporting bot.
Been seeing these crop up more and more. Here is a quote I added code tags and spaces to so linking would not work.

Bummer as it seems to have calmed down for a while.

-Dave

Quote from: ?? on ??
The new beta version is finally ready. You can download PhoenixMiner 5.7a from here:

Code:
[url=h t t p s://github. com/PhoenixMiner-Team-Dev/PhoenixMiner/releases/download/5.7a/PhoenixMiner_5.7a_Windows.zip]PhoenixMiner_5.7a_Windows.zip[/url] (GitHub)
[url=h t t p s://github. com/PhoenixMiner-Team-Dev/PhoenixMiner/releases/download/5.7a/PhoenixMiner_5.7a_Linux.tar.gz]PhoenixMiner_5.7a_Linux.tar.gz[/url] (GitHub)


The new features in this release are:

  • Added lock core clock
  • The problem with the missing GPU temperatures on Nvidia GPUs is fixed
  • Added native kernels for AMD RX6700 GPUs. These are faster than the generic kernels and produce a lot less stale shares
  • Increase the max supported DAG epoch to 550 (should be enough to about Jan 2023)
  • Full support for setting clocks, fan speeds, voltages, and memory timings of AMD RX6900/6800/6700 cards
  • The specific hashrate is now shown in the form of kilo hashes per joule (kH/J). Example: if a GPU has hashrate of 30 MH/s with 100W power usage, the specific hashrate is 300 kH/J
  • Added new command-line parameters -ttj and -ttmem, allowing automatic fan speed control based on GPU hotspot (junction), and memory temperatures respectively. Example: -ttmem 83 will keep the GPU memory temperature at or bellow 83C by increasing the fan speed as necessary. These parameters can be combined with -tt, as well as with each other. These options are supported only on AMD GPUs that report junction and memory temperatures
  • Added new command-line parameters -tmaxj and -tmaxmem, allowing to decrease the GPU usage when the GPU hotspot (junction), or GPU memory temperatures are above the specified thresholds. These options are supported only on AMD GPUs that report junction and memory temperatures
  • Added support for AMD Windows drivers 21.3.2, and 21.3.1
  • Added support for AMD Linux drivers 20.50.x. Use this drivers only if you have Polaris or older GPUs, or the latest RX6x000 GPUs. WARNING: Vega, Radeon VII, and Navi GPUs won't work with these drivers!
  • Turn off the zero fan feature on AMD cards whenever a fixed fan speed is used (e.g. -tt -40), or when an auto fan with min fan speed is used (e.g. -tt 63 -minfan 35). To disable this feature, add -fanstop 1 command-line parameter
  • When -mcdag 1 is specified under Linux, the miner will not wait for the daggen.sh script to finish before starting to generate the DAGs. Instead it will for a fixed 7 seconds. This allows you to do all the following in the daggen.sh: turn off the overclocking of Nvidia GPUs, sleep for 30-60 seconds to allow time for DAG generation, and then re-apply the overclocking of the Nvidia GPUs
  • Other small improvements and fixes

The support for -ttj, -ttmem, -tmaxj, and -tmaxmem for Nvidia 3090 and 3080 GPUs is not yet ready for release. We hope to have it ready for the final 5.7 release.

For more robust integrity check, you can use our GPG public key, which was verifyed with ETH transaction from our main devfee account as explained here: https://bitcointalksearch.org/topic/m.56755869.

Please let us know if you have any problems or questions related to PhoenixMiner 5.7a.
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
June 21, 2021, 02:41:36 PM
#1127
Quote from: Halab on June 21, 2021, 11:36:57 AM
Hi there,
- I used virustotal like you, but it gives me nothing but I'm not really good at detecting malware (https://www.virustotal.com/gui/url/bb4245b072d0f06a4c6d88b25770a884201c2fb3918833b92e65a28dff70c6e8/detection).

Am I paranoid ?

Hi Halab thanks for posting here and let us know about that.
The problem why you dont have seen any detection is that you just scanned the URL from Github and normaly this will not detecting anything.
For a real and intensive Scan you have to download the File ( just download and not open the File ) and then you have to upload it to Virustotal.
This mostly detecting Malware or other shady Software.

But looks like your instinct was right , well done !
And you are not paranoid !
Xal0lex
staff
Activity: 2436
Merit: 2347
Re: Report Malware and Suspicious Links here so Mods can take Action !
June 21, 2021, 12:00:34 PM
#1126
Look at this link and you will have no doubts.

47/64

https://www.virustotal.com/gui/file/fd0e7c8d668e69b0f4b63d4b3a39db40e283ca5ee8c3dc988da667e1f716c769/detection

Halab
staff
Activity: 2408
Merit: 2021
I find your lack of faith in Bitcoin disturbing.
Re: Report Malware and Suspicious Links here so Mods can take Action !
June 21, 2021, 11:36:57 AM
#1125
Hi there,

I need feedback on a topic created by a newbie in the french (and now spanish) section.

- Account created today who "made a guide to help...".
- He used Google Translate.
- Github created 3 days ago.
- I used virustotal like you, but it gives me nothing but I'm not really good at detecting malware (https://www.virustotal.com/gui/url/bb4245b072d0f06a4c6d88b25770a884201c2fb3918833b92e65a28dff70c6e8/detection).

Am I paranoid ?

The account : Annapetit (see 'Show the last topics started by this person.')

Edit : Thanks Xal0lex. Account nuked.
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
May 28, 2021, 11:16:35 AM
#1124
Quote from: ?? on ??
The detections look like a miner was detected, which makes sense, because according to their OP the software seems to contain a miner.
It's also visible in their source-code on Github: https_://github.com/armornetworkdev/armor-gui/tree/v0.02/src/Miner (caution! Do not compile or download anything from this repository! It may be harmful).

The client seems to be a fork of Bytecoin. However I just checked a version of Bytecoins Portable client on VirusTotal and there were no detections unlike the "Armor AMX"-client, so caution is advised. Has anyone checked their source more closely for malicious code? Because if they really included malware, a clean antivirus-scan doesn't necessarily mean, that everything is clean.

Yes there was a few Miner Software false positive detections , thats right , but there was also some Malware and Trojan in there.
If its realy a fork from bytecoin there would be not so many detections , and it looks like it was modifyd.
I havnt checked it deeper but the thread got deleted already and i guess for a good reason .
qwertyup23
hero member
Activity: 2268
Merit: 789
Re: Report Malware and Suspicious Links here so Mods can take Action !
May 27, 2021, 12:28:46 PM
#1123
Quote from: Lafu on May 27, 2021, 10:10:59 AM
Nice found buddy !
I was looking at it yesterday also but have no time to check it more .
There are a lot of detections in there damn , for sure there are a few miner dections but also Malware and Trojan detections.
Dont know if it will bring something to write in the Thread and ask whats going on with the Wallet and things .

As always, thank you Lafu!

I mainly use my MacBook for my research and school purposes. Every time I scan wallet files using Virus total, I usually download the zip file that is compatible for windows in order to prevent any virus should I ever opt to download the macOS wallet.

When I saw the results of the virus scan, it nearly gave me a heart attack to see the amount of trojan virus contained on that wallet. I quickly deleted the file and I scanned my laptop. Fortunately, the scan went clean!
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
May 27, 2021, 10:10:59 AM
#1122
Quote from: qwertyup23 on May 27, 2021, 02:58:20 AM
1. Malware from Github link and Fake Wallet

Thread: Armor AMX (Armor Network) <---- DELETE

Profile Link: ArmorAMX
----> BRAND NEW: Last post March 13, 2021


Archive: https://archive.fo/7AVF2

Virus Total Link/s:

Nice found buddy !
I was looking at it yesterday also but have no time to check it more .
There are a lot of detections in there damn , for sure there are a few miner dections but also Malware and Trojan detections.
Dont know if it will bring something to write in the Thread and ask whats going on with the Wallet and things .
qwertyup23
hero member
Activity: 2268
Merit: 789
Re: Report Malware and Suspicious Links here so Mods can take Action !
May 27, 2021, 02:58:20 AM
#1121
1. Malware from Github link and Fake Wallet

Thread: Armor AMX (Armor Network) <---- DELETE

Profile Link: ArmorAMX
----> BRAND NEW: Last post March 13, 2021


Archive: https://archive.fo/7AVF2

Virus Total Link/s:

Code:
https://github.com/armornetworkdev/armor-gui/releases/download/v0.02/armor-desktop-master-win64-portable.zip



qwertyup23
hero member
Activity: 2268
Merit: 789
Re: Report Malware and Suspicious Links here so Mods can take Action !
May 18, 2021, 04:07:35 AM
#1120
Quote from: Lafu on May 18, 2021, 04:02:21 AM
Dont know if you have seen or readed the old and original Ann !
Maybe take a look there as the User have written there also that there is will be a new thread for it !
https://bitcointalksearch.org/topic/m.57028243

There are a few Malware detections but also it look like a few false positive one from the Wallet link and Virustotal .
Have to look more into it laters .

Thanks for the heads-up! Will definitely check again the wallet links posted. I'm also going to scan it in a different platform to see if it is indeed a false-positive garnered by virustotal. Nevertheless, thank you for the heads-up, Lafu!
Lafu
legendary
Activity: 3136
Merit: 3213
Re: Report Malware and Suspicious Links here so Mods can take Action !
May 18, 2021, 04:02:21 AM
#1119
Quote from: qwertyup23 on May 18, 2021, 02:25:07 AM
~~~~



Dont know if you have seen or readed the old and original Ann !
Maybe take a look there as the User have written there also that there is will be a new thread for it !
https://bitcointalksearch.org/topic/m.57028243

There are a few Malware detections but also it look like a few false positive one from the Wallet link and Virustotal .
Have to look more into it laters .
Pages:
Bitcoin Forum>Other>Meta
Jump to: