Report Malware and Suspicious Links here so Mods can take Action ! - page 4.

Ms_Mining

member

Activity: 205

Merit: 43

✔️ Telegram @miningrelease

Account: aji471 <= Please Banned
Fake Ann topic: [ANN] RadiumX New PoW coin . No ICO. No Masternode

Quote from: aji471 on October 15, 2024, 05:19:50 AM

Wallets

Code:

https://github.com/RadiumXMain/RadiumX/releases/download/v2.0.3/RadiumX_win64_v2.0.3.zip

Site

Code:

radiumxcoin.info (in maintenance)

Lafu

legendary

Activity: 3178

Merit: 3295

We have a new Fake Ann Thread with an Fake Webpage and a Malware download there for [CCCN] Cococoin !

Fake Webpage :

Code:

https://cocomemefun.net/

On the Page there is a Link to a Github Account that is only 5 days old and nothing in there.
Fake Github : github.com/coco-meme

On the Webpage there is a download for the Wallet.

Code:

https://download.cocomemefun.net/files/cococoin-qt-windows.zip

And here its getting interesting , when you download the Wallet File and install and run it a lot of things will be happen.
Malware detected : Win64:Evo-gen [Trj]

Code:

Drops script at startup location
Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Dot net compiler compiles file from suspicious location
Suspicious DNS Query for IP Lookup Service APIs
PowerShell Script Run in AppData
Startup Folder File Write
Unsigned DLL Loaded by Windows Utility
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Code:

SSLBL: Traffic to malicious host (likely QuasarRAT C&C traffic) <--- A Network Trojan was detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
ET MALWARE Generic AsyncRAT Style SSL Cert
SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)

Source : https://www.virustotal.com/gui/file/bbf26e9b118b49791296baf3eca4442de993b2e5931acfa2eb7fe10c0b6d4811/behavior

Account : Anevigra <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 04, 2021 and not a single post , Hacked or sold Account

Fake Ann Thread : [ANN] [CCCN] Cococoin – The Funniest Meme Coin of the Decade! 🐔🚀

Quote from: ?? on ??

Cococoin – The Funniest Meme Coin of the Decade

Code:

Download a CCCN Wallet: https://cocomemefun.net

There are more results and investigation about more and other Hacked Accounts i cant post for now but i will write a pm to Cyrus.

Ms_Mining

member

Activity: 205

Merit: 43

✔️ Telegram @miningrelease

Account: chekamarue <= Please Banned
Fake Ann topic: [ANN] RadiumX New PoW coin . No ICO. No Masternode

Quote from: chekamarue on September 30, 2024, 07:21:58 AM

Wallet Address Prefix: P

Wallets

Code:

https://github.com/RadiumXMain/RadiumX/releases/download/v2.0.3/RadiumX_win64_v2.0.3.zip

Lafu

legendary

Activity: 3178

Merit: 3295

We have a new Fake Ann Thread with an already used Fake Github download Link with Malware for Mulierum again !

Fake Github : github.com/mulierum

The Fake Wallet download file is still the same 114 MB size big.

Account : MSAS <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since May 07, 2016 and last post was back in December 14, 2018 , Hacked or sold Account

Fake Ann Thread : [ANN] Mulierum | POW | GhostRider

Quote from: ?? on ??

Wallet:

Code:

https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

This post is also a reference for the Github Report !

BlackBoss_

sr. member

Activity: 602

Merit: 387

Rollbit is for you. Take $RLB token!

A download file in this post https://bitcointalksearch.org/topic/--5510016 can be malicious.

I checked with Virustotal with URL checking, it's clean. I don't want to download the file and check it with Virustotal but a newbie share a download file is very suspicious.

Code:

Download https://mega.nz/file/HWh0zIoZ#kYdT27HIvOpMGlxX7V28es-5pVNJfSNkhVqBJuGZ0Lo

$crypto$

legendary

Activity: 2394

Merit: 1049

Smart is not enough, there must be skills

It's like the Mulierum virus is back, this time from a hacked account. Be vigilant and keep reporting the fake Github.

Account: theseratio This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Quote from: theseratio on September 15, 2024, 05:15:22 AM

Code:

[b]Windows:[/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux:[/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

Lafu

legendary

Activity: 3178

Merit: 3295

We have again an Fake Ann Thread with the Fake Github Malware download Link for Mulierum!

Fake Github : github.com/mulierum
The Wallet File there was just uploaded 40 Min ago with an size of 116 MB
Source : https://www.virustotal.com/gui/file/b1acdc009df8f2af7e45b6216fd94179d05d1b335f4cdbc146a72e3e37d98a53/detection

If you install that Fake Wallet file and starting it it will be a remote desktop access program be installed

Code:

Processes created
"C:\Users\\AppData\Roaming\rustdesk.exe"
C:\Users\\AppData\Roaming\Zlvmon_v3\rustdesk.exe

Sorce : https://www.virustotal.com/gui/file/b1acdc009df8f2af7e45b6216fd94179d05d1b335f4cdbc146a72e3e37d98a53/behavior

Account : CCMS <--- Please ban or Lock that Account and delete the Thread
Last post from that Account was August 14, 2024 , so its freshly hacked or sold.

Fake Ann Thread : [ANN] Mulierum | POW | GhostRider
As always the Thread is self moderated from the hackers.

Quote from: CCMS on September 11, 2024, 05:39:29 AM

Wallet:

Code:

Windows: https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
Linux: https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

And another User posted it also
Account : Cholidm <--- Please ban or Lock that Account and delete the Thread

Quote from: Cholidm on September 11, 2024, 07:23:01 AM

Wallet:

Code:

https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz]

This post is also a reference for the Github Report !

$crypto$

legendary

Activity: 2394

Merit: 1049

Smart is not enough, there must be skills

Full member users who just woke up/hacked back are spreading the virus with two threads at once, please be careful.

Account: BlueStone This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Quote from: ?? on ??

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

Fake ANN: [ANN][SSPOS] CodeBlock Blockchain: Welcome to a New Era

Quote from: BlueStone on September 03, 2024, 09:25:01 PM

Code:

https://github.com/CodeBlockMainnet/CodeBlock/releases/download/1.3.1/CodeBlock-wallet_v1.3.1.zip

Ms_Mining

member

Activity: 205

Merit: 43

✔️ Telegram @miningrelease

Account: DareToken <= Please Banned
Fake Ann topic: [ANN] Mulierum | POW | GhostRider

Quote from: DareToken on September 02, 2024, 06:50:54 AM

Wallet:

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

$crypto$

legendary

Activity: 2394

Merit: 1049

Smart is not enough, there must be skills

The hacked Hero Member account last posted in 2015 and is now actively spreading the virus via Github.

Account: Herbert This user recently woke up from a long period of inactivity. - Please Ban
Fake ANN: ANN] Mulierum | POW | GhostRider

Quote from: Herbert on August 31, 2024, 12:50:24 AM

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

MiningCoinsPool

member

Activity: 450

Merit: 10

Same guy again https://bitcointalksearch.org/topic/ann-aldibi-aldb-best-coin-possible-5506842

Lafu

legendary

Activity: 3178

Merit: 3295

Yeb its again a Fake Ann with Malware download Link from there Webpage this time for Aldibi

Fake download Wallet File on the Webpage:

Code:

download.aldibi.com/files/aldibi-qt-windows.zip

Also there is a Fake Github Link on there Page that is already deleted.
Fake Github : github.com/aldibi-coin/core

The sandbox CAPE Sandbox flags this file as: MALWARE RAT
The sandbox Zenbox flags this file as: MALWARE EVADER

Code:

Drops script at startup location
ET MALWARE Common RAT Connectivity Check Observed
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016

Source : https://www.virustotal.com/gui/file/7fb14f997b1c92cc4d7a70db91657fc01f5feba66c9dd1e1b918567280218e37/behavior

Account : qiqikesfket <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 04, 2021 , Hacked or sold Account

Fake Ann Thread: [ANN] Aldibi: Empowering the Next Era of Global Transactions

Quote from: ?? on ??

Aldibi (ALDB)

Code:

https://aldibi.com/

MiningCoinsPool

member

Activity: 450

Merit: 10

Trojan in the Windows binary available for download from their website: https://aldibi.com/

https://bitcointalksearch.org/topic/--5506809

Ms_Mining

member

Activity: 205

Merit: 43

✔️ Telegram @miningrelease

Account: Tam.Shams <= Please Banned
Fake Ann topic: [ANN] Mulierum | POW | GhostRider

Quote from: Tam.Shams on August 19, 2024, 03:28:24 AM

Wallet:

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

Ms_Mining

member

Activity: 205

Merit: 43

✔️ Telegram @miningrelease

Account: pedpedped101 <= Please Banned
Fake Ann topic: [ANN] Mulierum | POW | GhostRider

Quote from: pedpedped101 on August 14, 2024, 10:26:25 PM

Wallet:

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

$crypto$

legendary

Activity: 2394

Merit: 1049

Smart is not enough, there must be skills

Another hacked account spreading the virus via a Github link

Account: ikanunaki accounnt hacked and please ban
Fake ANN: [ANN] Mulierum | POW | GhostRider

Quote from: ikanunaki on August 12, 2024, 08:12:36 AM

Code:

[b]Windows: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
[b]Linux: [/b] https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

Lafu

legendary

Activity: 3178

Merit: 3295

And again we have a new Fake Ann Thread with an Fake Github Account and Malware download Link for Mulierum !

The Fake Github was just created 1 Hour ago.

Fake Github : github.com/mulierum

The Download Wallet File is 100 MB big and the same as we got already in the past.

Code:

[code]
C:\Users\\AppData\Roaming\ObjectDock.exe"
C:\Users\\AppData\Roaming\tg_Sync\ObjectDock.exe
C:\Windows\system32\SecurityHealthService.exe
C:\Windows\system32\WerFault.exe -u -p 636 -s 504

[/code]
Source : https://www.virustotal.com/gui/file/b6761479c00cffc7e99e820060518b12024e533fbc908da116ecce2a4cb2759d/behavior

Account : havi agasa <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since June 08, 2017 , and the last post from that User was back in July 04, 2021 , Hacked or sold Account

Fake Ann Thread : [ANN] Mulierum | POW | GhostRider

Quote from: ?? on ??

Mulierum
Wallet:

Code:

https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-win.x64-QT-v.2.0.1-1.zip
https://github.com/mulierum/mulierum-core/releases/download/2.0.1/mulierum-linux-QT-v.2.0.1-1.tar.gz

This post is also a reference for the Github Report !

Mitchell

copper member

Activity: 3948

Merit: 2201

Verified awesomeness ✔

Quote from: FatFork on August 11, 2024, 04:50:32 AM

If anyone has more experience with analyzing obfuscated javascript code and is willing to try, it would be interesting to find out what the script actually does.

I tried using some online tools: https://private.coinsofnakamoto.com/?b4527618e0f7c407#2jRhaSBjdSStxKnJApfAMhszgfJM3mLJv4giXjN94UGz (do not run this, obv).

They seem to pick a random BTC address from the list, replace the one on the page (including the QR code) and then do a call to pipedream with some basic description (which seems to return 204). Very basic stuff honestly.

FatFork

legendary

Activity: 1820

Merit: 2700

Crypto Swap Exchange

A potential scam unfolding in the "Question about selling free giftcards" thread - [https://bitcointalk.org/index.php?topic=5505793.0]

Here's what we know:

A new member, Revaniz, claims to have found a method for free gift cards and offers to sell them.
Another new member, WARtoze99, suggested a platform for selling the gift cards only twenty seconds later, then asked for the method to obtain them.
Revaniz provides a Google Drive link claiming to be the exploit method.

Code:

https://drive.google.com/file/d/1Mzn6o3n5xIhN6nueBAl3YTzyb27ZgMrD/view?OAxXtfCKIY

The fake exploit method they promote involves installing a greasemonkey/tampermonkey script into the user's browser. The script is heavily obfuscated and undoubtedly contains a malicious payload designed to steal your crypto or worse.

Code:

Link #1 https://paste.sh/7vnaa5T9#rnL_3Gbklz9HKMIUKuPPG3yf
Link #2 (backup) https://files.catbox.moe/1evss2.txt

If anyone has more experience with analyzing obfuscated javascript code and is willing to try, it would be interesting to find out what the script actually does.

Crypto Library

hero member

Activity: 1036

Merit: 933

Find your Digital Services at- cryptolibrary.pro

Quote from: Lafu on August 11, 2024, 03:41:47 AM

And we got the next Fake Ann Thread with an already used Fake Github Account with Malware , this time for Binarium!
<✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂>

Fake Ann Thread : [ANN] Binarium | POW | GhostRider

owh gosh they are fake !!!

I just visited their thread and I was also looking at their officials representative social handles for offering some business Tongue

.

Anyway bad luck for those scammers

thanks again for the catch.

Topic: Report Malware and Suspicious Links here so Mods can take Action ! - page 4. (Read 37843 times)