Pages:
Author

Topic: Report Malware and Suspicious Links here so Mods can take Action ! - page 9. (Read 36657 times)

legendary
Activity: 3136
Merit: 3213
And we have a new Fake Ann Thread with a new Fake Github Account and Malware download Link for RadiumX !

The Fake github Account was just created 2 Days ago!

Fake Github Account : github.com/RadiumX-coin-project

Virustotal have detected 8 Trojan and Malware things
Code:
Win32:Malware-gen
A Variant Of Win32/Injector_AGen.AFT
Trojan.Win32.Krypt
Malware.SwollenFile!1.E38A (CLASSIC)
HEUR:Backdoor.Win32.Remcos.gen
Source : https://www.virustotal.com/gui/file/a5fcb0759bd43b60c0c68dad26580fb78f315fbf9d2280fed73addbcc05a0505/detection

Account : Runs.com  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since April 09, 2018 and the last post was back in 2018 , hacked or sold Account

Fake Ann Thread :  [ANN] RadiumX New PoW coin . No ICO. No Masternode

Wallets
Code:
https://github.com/RadiumX-coin-project/RadiumX/releases/download/1.0.2/RadiumX.zip

And another Fake Ann Thread here.
Wallets
Code:
https://github.com/RadiumX-coin-project/RadiumX/releases/download/1.0.2/RadiumX.zip


This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
And we have a new Fake Ann with a new Fake Github Account with Malware download Link for FitiCoin !

The Fake Github Account was just created yesterday

Fake Github : github.com/Fiti-Network

And here its the same as for the other last Fake Github Accounts ,
The Windows QT Wallet file size there is again 700 MB and the same as for the last Fake Ann.

Account : Brighthopler  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 02, 2021, hacked or sold Account

Fake Ann Thread : [ANN] FitiCoin - Revolutionizing Fitness through Blockchain Technology
The Thread is also Self Moderated as always from the Hackers.

FitiCoin - Revolutionizing Fitness through Blockchain Technology
Code:
https://github.com/fiti-network/fiticoin
https://github.com/Fiti-Network/FitiCoin/releases

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
We have a new Fake Ann with a new Fake Github Malware download Link for FastyCoin !

Fake Github Account was created just 10 Hours ago.

Fake Github : github.com/Fasty-Coin

The Windows QT Wallet file size there is 700 MB and is the same as a few Fake ones in the past.

Account : Vautidroes  <--- Please ban or Lock that Account and delete the Thread
Registered since October 02, 2021 , hacked or sold Account

This Account got already tagged and reported in 2023-11-10 for posting a Fake Ann with Malware download Link.

First Fake Ann from November 2023
]Ramcoin is the Digital Currency for Romanian People on 100 Anniversary
Wallets: https://github.com/ramcoin-project/ramcoin/releases                                                                                                          

Fake Ann Thread from today:  [ANN] FastyCoin - Fast, Secure, and Community-Driven Cryptocurrency
Thread is Self Moderated as always from the Hackers

FastyCoin
Code:
https://github.com/Fasty-Coin/Core

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
And we have a new Fake Ann Thread with an new Fake Github Account with Malware Link for ObscurityCoin (OBSC) !

The Fake Github Account was created 2 Days ago !

Fake Github : github.com/Obscurity-Network/

The Windows QT File there is 670 MB big and the Linux only 19 MB and thats very suspicious!

Account : Makkoortin  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 02, 2021 , Hacked or sold Account

Fake Ann Thread :  [ANN] ObscurityCoin (OBSC) - Securing Your Digital Transactions with Privacy!
Self-Moderated Thread as always from the Hackers

Code:
https://github.com/Obscurity-Network/ObscurityCoin

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
Are links on the coinmarketcap website dangerous?  There are so many links you can click on whether it's about a coin and things like that.  They highlight so many different things.  Also on the right side, there are lot of posts from people that seem to be twitter posts regarding the coin.  So clicking those links are unsafe or not?
First at all every Link can be dangerous on the internet or at any Website.
But normaly that Links on coinmarketcap are should be okay but what you will be find or can be download on that clicked Links can be dangerous.
You should be doing your own research if not sure if its safe or not looking on google maybe or here on the Forum if there are some Informations.
full member
Activity: 1750
Merit: 186
Are links on the coinmarketcap website dangerous?  There are so many links you can click on whether it's about a coin and things like that.  They highlight so many different things.  Also on the right side, there are lot of posts from people that seem to be twitter posts regarding the coin.  So clicking those links are unsafe or not?
hero member
Activity: 1036
Merit: 928
Find your Digital Services at- cryptolibrary.pro
Why the quick posts advertising some software that looks like tradingview. The person is trying to spread malware but rather more subtle way and also trying to provide clean virustotal results in each post when not even asked. Guilty conscience? I say yes!
The proverbs work here "A guilty in mind is always suspicious".
And they didn't just open four of the same topic, they opened several more. But the interesting thing is that those accounts are not newly registered accounts, All these accounts are  opened up a few years ago. Roll Eyes I think they should be banned or  locked in addition to deleting their posts.
copper member
Activity: 2114
Merit: 1814
฿itcoin for all, All for ฿itcoin.
It's Looks suspicious that Same topic created 4time from 4 different accounts  Roll Eyes . Just take a look, aren't they spreading malware?

Code:
https://mega.nz/file/ihN13B6D#CIJVDW-nlS-5-tUKxgM1kvgwY2IqAWKzWDCMvZJw9kw
1. ProChart Navigator: Empowering Your Trading Experience ?  
2. ProChart Navigator: Empowering Your Trading Experience
3. ProChart Navigator: Empowering Your Trading Experience
4. ProChart Navigator with Download Link !
Sorry I didn't have enough smerits, but something is definitely not adding up. Why the quick posts advertising some software that looks like tradingview. The person is trying to spread malware but rather more subtle way and also trying to provide clean virustotal results in each post when not even asked. Guilty conscience? I say yes!

Here is what I asked in one of the posts
Binaries uploaded on Mega.nz give me chills. It doesn't matter if the virustotal results are clean or not.  Tongue

I have some questions;
1. What advantageous difference does your app have over the original trustable trading view app? What is funny is your executable app is also named "Tradingview.exe"
2. Did you tinker with the tradingview code?
hero member
Activity: 1036
Merit: 928
Find your Digital Services at- cryptolibrary.pro
It's Looks suspicious that Same topic created 4time from 4 different accounts  Roll Eyes . Just take a look, aren't they spreading malware?

Code:
https://mega.nz/file/ihN13B6D#CIJVDW-nlS-5-tUKxgM1kvgwY2IqAWKzWDCMvZJw9kw
legendary
Activity: 3136
Merit: 3213
And we have a new Fake Ann Thread with an Fake Github Account with Malware for [KASPAR] Kasparov !

Fake Github : github.com/tehasholdem/Kasparov
The File on the Fake Github has already the size of 170 MB as the other Malware files
Github Account was created on 10 November this is also the same date as the github.com/toootoooo/NetworkPHYS Account

Code:
C:\Users\user\AppData\Local\Temp\db4dfn0r.gxn\kasparov-gui.exe" /VERYSILENT
C:\Users\user\AppData\Local\Temp\is-LFTIA.tmp\kas.tmp" /SL5="$B019A,159993928,842240,C:\Program Files (x86)\My Program\kas.exe"
C:\Program Files (x86)\My Program\electrum.exe
C:\Program Files (x86)\My Program\kas.exe

C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="KDX genkeypair" program="C:\Program Files\Kaspa\KDX\bin\windows-x64\genkeypair.exe" dir=out action=allow enable=yes
C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

ET MALWARE Observed Malicious SSL Cert
ET MALWARE Generic AsyncRAT Style SSL Cert
ET INFO External IP Lookup Domain in DNS Lookup
Suspicious DNS Query for IP Lookup Service APIs

Source: https://www.virustotal.com/gui/file/6b639de205612d838e0f40ca43372f6e67a16c034b0108b0c4095af618841e97/behavior

Account : boxpackaging  <--- Please ban or Lock that Account and delete the Thread
Registered since August 04, 2020 , Hacked or sold Account !

Fake Ann Thread:  [ANN] [KASPAR] Kasparov - experimental fork Kaspa with new algo (POW+CPU mining)

Wallets
Code:
Windows GUI: https://github.com/tehasholdem/Kasparov/releases/download/0.9.0/kasparov-gui.zip
Source: https://github.com/tehasholdem/Kasparov/

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
And we have a new Fake Ann with a new Fake Github Account with malware Link for [PHYS] PhysicalNetwork !

Github Account was created on November 10, 2023

Fake Github : github.com/toootoooo/NetworkPHYS

Same here as from the other Fake Github Files that was posted from the Hackers
Code:
Processes created

C:\Users\user\AppData\Local\Temp\qcdh5c4k.vj2\physnetwork-qt\physnetwork-qt.exe" /VERYSILENT
C:\Program Files (x86)\My Program\electrum.exe
C:\Program Files (x86)\My Program\kas.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Files Dropped
C:\Program Files\Kaspa\KDX\
C:\Program Files\Kaspa\KDX\bin\windows-x64\genkeypair.exe

ET MALWARE Observed Malicious SSL Cert
ET MALWARE Generic AsyncRAT Style SSL Cert
ET INFO External IP Lookup Domain in DNS Lookup
Suspicious DNS Query for IP Lookup Service APIs
Source : https://www.virustotal.com/gui/file/d103c368f748aeea587e47888c9a832cb1abc5d03797639af59ae58bf3e775c6/behavior

Account : rednick   <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since February 27, 2018, lst post was March 09, 2021 , Hacked or sold Account

Fake Ann Thread :   [ANN] [PHYS] PhysicalNetwork - scalable and private network [GPU/ghostdag]

Wallets
Code:
Windows: https://github.com/toootoooo/NetworkPHYS/releases/download/1.0.0/physnetwork-qt.zip
Linux: https://github.com/toootoooo/NetworkPHYS/releases/download/1.0.0/phys-linux.zip

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
And we have a new Fkae Ann Thread with an Fake Github , Malware downlaod Link for [NRP] Physical Network !

Fake Github : github.com/waynedickey/phys-network

Very bad things going on when you start the File from that Github.
Code:
Hidden Tear Ransomware
HanaLoader (Sysmon detection)
PsiXBot Malware behavior
Orcus RAT detection
DropboxAES RAT (Sysmon detection)
Change PowerShell Policies to an Insecure Level
POLICY-OTHER HTTP request by IPv4 address attempt
Source : https://www.virustotal.com/gui/file/f42ba385274e659f519fcecf8e673c527ccf7277d3b4b139989fb35202aa3007/behavior

Account : blouch  <--- Please ban or Lock that Account and delete the Thread
Hacked or sold Account

Fake Ann Thread : [ANN] [NRP] Physical Network - experimental POW mining (ghostdag)

Wallets
Code:
Windows: https://github.com/waynedickey/phys-network/releases/download/0.0.1/phys-qt-win64.zip
Linux: https://github.com/waynedickey/phys-network/releases/download/0.0.1/phys-linux.zip

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
Thanks Lafu, I will keep posting here when I find fake ANNs spreading malware with fake github here.
I've updated it with code so someone can't click on it.
Nice Thanks for the edit and this helps for sure that its not accidentally clickable for other Users.
Also thanks for keeping your eyes open and you are right on that last Fake Ann.

There is more evidence and information about that Fake Github File when you looking on the behavior of the File.

And its the same file as we got it from Fake Github github.com/troyseate/electrum-kas just a other Github Account.
Code:
C:\Program Files (x86)\My Program\MyProg.exe
C:\Program Files (x86)\My Program\electrumkas.exe
C:\Program Files (x86)\My Program\electrumkas.exe.config
C:\Program Files (x86)\My Program\electrumkas.exe\:Zone.Identifier
Source  : https://www.virustotal.com/gui/file/90865b85c96429951ec2d1014398dfaf336e5be6cfd6d6fcbb13827184e1a4f8/behavior

Whats interesting on that File is that here:
Code:
fullnode-win64/fullnode-win64-qt.exe
256 - C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="KDX kaspa-miner" program="C:\Program Files\Kaspa\KDX\bin\windows-x64\gpuminer.exe" dir=out action=allow enable=yes
It modifies your Firewall when you start the Wallet.exe and a lot of other bad things.
sr. member
Activity: 294
Merit: 433
HODL - BTC
A fake ANN that spreads malware from github and accounts just woke up with 5 years of sleep.

User: ranastic Please ban or Lock that Account - This user recently woke up from a long period of inactivity.
ANN Fake: [ANN] BURNSTAR - New GEM for GPU mining (GPU PoW/ghostDAG/blockDAG)


Code:
[b]OUR WALLETS[/b]
Windows: https://github.com/tpillatzke/burnstar/releases/download/1.0.0/fullnode-win64.zip
Linux: https://github.com/tpillatzke/burnstar/releases/download/1.0.0/burnstar-linux.zip
Source: https://github.com/tpillatzke/burnstar

Virustotal: https://www.virustotal.com/gui/file/90865b85c96429951ec2d1014398dfaf336e5be6cfd6d6fcbb13827184e1a4f8/detection

I really appreciate it that you keep your eyes open and posting this things here in the thread to collect as much data for the Fake Github Account.
But again is it possible when you write your posts that you use the code function ( as i have done it in your quote ) for the Links so that nobody can click on them , that would be nice.
Thanks Lafu, I will keep posting here when I find fake ANNs spreading malware with fake github here.
I've updated it with code so someone can't click on it.
legendary
Activity: 3136
Merit: 3213
I reported a fake ANN with the same case above, and now the old account is alive again to spread malware through github.

Github fake
GITHUB
Code:
WINDOWS: https://github.com/troyseate/purn-network/releases/download/1.0.0/purn-qt-win64.zip
LINUX:  https://github.com/troyseate/purn-network/releases/download/1.0.0/purn-qt-linux.zip
SOURCE: https://github.com/troyseate/purn-network
Yes there was a few of them the last days but they got already all deleted.
I really appreciate it that you keep your eyes open and posting this things here in the thread to collect as much data for the Fake Github Account.
But again is it possible when you write your posts that you use the code function ( as i have done it in your quote ) for the Links so that nobody can click on them , that would be nice.
sr. member
Activity: 294
Merit: 433
HODL - BTC
I reported a fake ANN with the same case above, and now the old account is alive again to spread malware through github.

User: Toto2020 Please ban or Lock that Account
ANN Fake: [ANN] PURN-NETWORK - Kaspa fork with new features (GPU PoW/ghostDAG)

Virustotal: https://www.virustotal.com/gui/file/281768a452b533759c21c0dc80b81cf0d49de1be645368fbdda8c66dcb7120d3/detection

Github fake
Code:
WINDOWS: https://github.com/troyseate/purn-network/releases/download/1.0.0/purn-qt-win64.zip
LINUX:  https://github.com/troyseate/purn-network/releases/download/1.0.0/purn-qt-linux.zip
SOURCE: https://github.com/troyseate/purn-network
legendary
Activity: 3136
Merit: 3213
And we have again a new Fake Ann Thread with the Fake Github Link with Malware for PURN !

Fake Github : github.com/troyseate/purn-network

This Fake Github Account have already other Links in it too.
Code:
github.com/troyseate/purn-network
github.com/troyseate/electrum-kas
github.com/troyseate/pyrinwallet
github.com/troyseate/electrum
github.com/troyseate/awesome-nodejs

Windows already gives you a Warning vor Virus and Trojan when you try to download the File from the Fake Github.

Account : Digitminer  <--- Please ban or Lock that Account and delete the Thread
Registered since   July 15, 2017 , Hacked or sold Account

WINDOWS:
Code:
https://github.com/troyseate/purn-network/releases/download/1.0.0/windows.zip

This post is also a reference for the Github Report !
legendary
Activity: 3136
Merit: 3213
We have a new Fake Ann Thread with anew Fake Github Account with Malware and Trojan download Link for KASTLS (kaspa tools project) !

The Fake Github download File was created 2 Days ago.

Fake Github : github.com/troyseate/electrum-kas

A Many shady and bad things happen when you start the Wallet File:
Code:
MALWARE TROJAN EVADER RAT

Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Detects the addition of a new rule to the Windows firewall via netsh
Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type
Detects the creation of scheduled tasks in user session
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes
Detects loading of Amsi.dll by uncommon processes
Detects a WMI modules being loaded by an uncommon process

C:\Program Files\Kaspa\KDX\bin\windows-x64\genkeypair.exe
C:\Program Files\Kaspa\KDX\bin\windows-x64\gpuminer.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
HKEY_CURRENT_USER\Software\Microsoft\RestartManager

C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "Discord startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Also your Discord App will be compromised with it on the startup.

Source : https://www.virustotal.com/gui/file/4dcae6a5ede0c0059bf0cdce636b144c40faa65c4539f91d456cc8df333509ff/behavior

Account :  fanepatent2  <--- Please ban or Lock that Account and delete the Thread and Posts
Registered since November 23, 2017 possible hacked or sold Account

Fake Ann Thread :  [ANN] KASTLS - kaspa tools project (For using)

Hello community!
Code:
https://github.com/troyseate/electrum-kas/tree/main

Fake Posts :
https://bitcointalksearch.org/topic/ann-pyrin-pyi-gpu-pow-ghostdag-blockdag-5476198
https://bitcointalksearch.org/topic/ann-karlsen-kls-gpu-pow-a-fork-of-kaspa-with-kheavyhash-asic-resistance-5475216
https://bitcointalksearch.org/topic/ann-kaspa-kas-cpu-pow-ghostdag-5373286

This post is also a reference for the Github Report !
sr. member
Activity: 294
Merit: 433
HODL - BTC
I found a suspicious thread that did not share a link within GitHub but rather with a free website from GoDaddy and there it appeared to be spreading a virus downloaded via mega.nz

User: FunkySkunk
ANN Fake: Release: New Altcoin - A even Lite version of Litecoin Called Obsidian (OBS)

Virustotal: https://www.virustotal.com/gui/file/8f836b7a9ecfcc716ee78bef17494d4789134646b695df05b656714a98b57ea1/detection

I found Obsidian project's old ANN : Obsidian ODN - CryptoCurrency & Secure Anonymous Messaging
legendary
Activity: 3136
Merit: 3213
We have a new Fake Ann Thread with a new Fake Github Malware download Link for MentaCoin (MNLC) !

The Fake Github Account was just created 1 Hour ago.

Fake Github : github.com/MNLCoinNetwork/MentaCore
Real Github : github.com/MentaCoin

Lot of bad things happen when you download and start the Files from the Fake Github.
Code:
Drops script at startup location
Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets
This detection method points out highly relevant Antivirus events
A Network Trojan was detected
Device Retrieving External IP Address Detected

C:\Users\user\AppData\Local\Oliver Robinson\SocialPulse Monitor.pif
C:\Users\user\AppData\Local\Temp\8819\5865\jsc.exe
C:\Users\user\AppData\Local\Temp\flofy.exe
C:\Users\user\AppData\Local\Temp\noply.exe
C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Legal + Rebel + Desktops + Sleeve + Romania 5865\Peeing.pif
C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 2176
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\user\AppData\Local\Temp\QY7M5JAACrWc.bat"
Source : https://www.virustotal.com/gui/file/0a483d211b2e8cefa76989095cb7965eae7a13d67626a96497dc213b0fae4a80/behavior

Account : Taoktoyre  <--- Please ban or Lock that Account and delete the Thread
This user recently woke up from a long period of inactivity.
Registered since October 02, 2021 , Hacked or sold Account

Fake Ann Thread :  [ANN] MentaCoin (MNLC) - Unleashing the Power of Minting for Mental Health

Code:
https://github.com/MNLCoinNetwork/MentaCore/

This post is also a reference for the Github Report !
Pages:
Jump to:
© 2020, Bitcointalksearch.org