(Jul 17, 2010 10:06 PM)Zephyrus Wrote:  Lol nah, don't be nervous... Just be cautious :P. Prob not a smart idea to test a RAT on yourself/friends ;|...

(Jul 17, 2010 10:08 PM)Shoveb1 Wrote:  i know how this happaned. who ever fud'ed ur rats binded his rat with urs.

(Jul 17, 2010 10:11 PM)Zephyrus Wrote:  I FUDed my own RAT lol, with the crypter given to me by the [very]trusted maker of that crypter, as stated in the OP :P.

(Jul 17, 2010 09:55 PM)Zephyrus Wrote:  Hey,

Today something really weird happend...

I was testing out my updated cybergate 1.07.5 server against my cousin's Avira AV. He has Avira and a few others, I have nod32 and ones he doesnt have, and we ensure 100% runtime FUD by testing against each others AV's.

I was testing out the new features/fixes of CG 1.07.5 on his machine, and after I was done, I right-click uninstalled it from his computer.

A few hours later, he notices his C drive activity and network activity picked up by his tools matched that of someone who was RATed, so he went to run a full system scan with avira only to find his avira was completely disabled!

Later on in the day, he went to log into his facebook only to find the password has been changed and the language changed to german. He quickly reset his password, and assumed that I did all of it so he wasn't too worried, meanwhile i was no where near a computer while all of this happened.

I got back online not too long ago and was met by a bombardment of offline msn msgs from him explaining/acusing me of everything that was happening lol... I quickly explained I had nothing to do with any of it which lead us both into a panic, as we both know the damage a stealer/RAT can do... All seems to be fine now, looking through HJTlogs and millions of scans and password changes, but one question is still imbedded in our minds: How the fuck did this happen?

I've heard of bot hijacking and the like, but he's never had a password changed on him before, and it just so happend the day I test cybergate on his comp is the day his fb gets hacked. Coincidence? Possibly, but I'd like to rule some things out...

How likely is it dyou guys think that the fb hacking was related to the cybergate testing? The CG version I used was downloaded from the official site, the crypter made by a well reconized and trusted coder, the CG settings were all customized, the only two weaknesses I can think of would be 1. the crypter disabling the AV(which it was programed to do) and thus allowing something already installed on his computer to connect elsewhere, or 2. my cybergate password wasn't the strongest, I now realize an extended dictionary attack would probably guess it, (Does cybergate leave any vulnerabilities on systems it infects? Does an unsecure CG password carry any repercussions?)

Dyou think its related to the cybergate RAT? Is it possible for cybergate to be hijacked? Or was it just fluke that his fb acc was hacked around the same time?

Discuss.

Zephyrus