+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: [WARNING] SteamCommunity PHISHING PAGE + .EXE STEALER (/showthread.php?tid=4375323)
[WARNING] SteamCommunity PHISHING PAGE + .EXE STEALER - dEn00 - Aug 3, 2014
Today I was playing cs, and Ive got a request from this stranger.
He said:
![[Image: RsQSPc3.jpg]](https://i.imgur.com/RsQSPc3.jpg)
After clicking on that link, it transfers you at a steam player page,
then you click on Add Friend, and it redirect you to an
"SteamGuard" pop-up windows, which is "required to download" in order to continue.
SteamGuard link: http://steamc0mmunnity.com/id/BEAR_XD/login/home/
![[Image: D7KLulE.jpg]](https://i.imgur.com/D7KLulE.jpg)
So a scan of a file:
![[Image: oUzrrsB.jpg]](https://i.imgur.com/oUzrrsB.jpg)
WHOIS of the site:
![[Image: AdmZe9j.png]](https://i.imgur.com/AdmZe9j.png)
I contacted Razor regarding this, and asked him if he can debug the file for me and identify connections.
![[Image: 73a7066e0120f0e79f3ff4d3fa92e53f.png]](https://i.gyazo.com/73a7066e0120f0e79f3ff4d3fa92e53f.png)
![[Image: 7b426044c36c9475c4f7f534409bd89d.png]](https://i.gyazo.com/7b426044c36c9475c4f7f534409bd89d.png)
![[Image: f28f6797b8acb59969a61c3c3f257297.png]](https://i.gyazo.com/f28f6797b8acb59969a61c3c3f257297.png)
![[Image: c352edf1fecc37abd1a6dea345bb6bae.png]](https://i.gyazo.com/c352edf1fecc37abd1a6dea345bb6bae.png)
RazorSoft | Razor:
"I can definitely tell that it's main purpose is to steal from steam
you see that spreaded all over the code
and i bet that the owner of darkclub.cc is somehow involved
http://catalogs.darkclub.cc/steam/download/
check that
file is stored there + ip gets checked from there
and so i bet that he even coded/c&p'd this himself"
you see that spreaded all over the code
and i bet that the owner of darkclub.cc is somehow involved
http://catalogs.darkclub.cc/steam/download/
check that
file is stored there + ip gets checked from there
and so i bet that he even coded/c&p'd this himself"
The trojan name is xQuadStealer and it grabs steam info / items.
Feel free to grab the .exe and DEBUG it and search for any IP addresses to fuck him or just report his site and tell us results. Thank you.
Be aware and share this with your friends! 🤝
* - Internet Explorer. - Aug 3, 2014
There is sadly alot of these phishing sites out there.
* - Aura - Aug 3, 2014
.... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.
God this fucking annoys me.
* - Hidden™ - Aug 3, 2014
God damn, nice find! I will be weary of this.
* - dEn00 - Aug 3, 2014
(Aug 3, 2014 10:34 AM)Aurа Wrote: .... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.
God this fucking annoys me.
As I am saying at the end of the thread, I am searching for someone who can search for his IP address or something more, so I can report him.
* - Aura - Aug 3, 2014
(Aug 3, 2014 10:45 AM)dEn00 Wrote: As I am saying at the end of the thread, I am searching for someone who can search for his IP address or something more, so I can report him.
To what end ? These phishing pages will always be up, no matter what. Just report them, end of story.
* - Sleazy P. Martini - Aug 3, 2014
Sorry but whoever falls for this is a fucking retard.
Pretty sure most of HF have a brain cell to avoid this without an alert...
* - Mons - Aug 3, 2014
(Aug 3, 2014 10:53 AM)Sleazy P. Martini Wrote: Sorry but whoever falls for this is a fucking retard.
Pretty sure most of HF have a brain cell to avoid this without an alert...
Indeed, I agree.
OP, thank you for the alert.
* - DpzFAsq4UEK8 - Aug 3, 2014
There are multiple variants of this stealer, there is also one coded in Delphi or something like that.
darkclub.cc down, such a shame. I wanted to upload a little present for 'em…
* - HIGH PAID FELLA - Aug 4, 2014
(Aug 3, 2014 01:08 PM)Arrhythmia Wrote: There are multiple variants of this stealer, there is also one coded in Delphi or something like that.
darkclub.cc down, such a shame. I wanted to upload a little present for 'em…
Dayum, they were prepared for lil feggets like you uploading backdoored c99 shell 🤗🎉
* - Sacred Symmetry - Aug 4, 2014
(Aug 3, 2014 10:34 AM)Aurа Wrote: .... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.
God this fucking annoys me.
True dat.
I believe this calls for a /rant /thread.
* - Austerity - Aug 7, 2014
Very nice find mate, I need to notify most of my mates about this phish. I believe it is a progressive method as well.
* - MechWarrior67 - Aug 7, 2014
thanks for the heads up. I will alert my friends about this.
* - Jesus666 - Aug 8, 2014
Thanks for this information good to see some have their eye open :)