+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Weird slaves showing up? (/showthread.php?tid=5513940)
Pages: Pages
1
2
Weird slaves showing up? - Tyler Durden. - Jan 4, 2017
Hello
So I am using Imminent Monitor, and Cyberseal Protector.
I just built a new server, and crypted it with CyberSeal protector.
- Now I haven't even spread the file yet, and only after about 5 min after crypting my file, these slaves show up. Now are these HoneyPots, and how the hell did they end up there, when I JUST created the server?
Spoiler (Click to View)
* - chase. - Jan 4, 2017
It's the FBI you're fucked dude see ya in prison
* - Baitable - Jan 4, 2017
Usually from VT scans, I suggest you don't use VT for your scanning purposes.
* - bzrΚ - Jan 4, 2017
Its a honeypot. Your stub has made its way into the hands of the anti virus companies and they're scanning it.. Just block them and be more careful.
* - Dankkk - Jan 4, 2017
I recommend setting your stub up to melt... aswell if you see a VM on your connections or someone trying to fuck with your stub in a VM or in CMD you should most deffs uninstall the payload. fuck the feds OP 🤝
* - President Morty - Jan 4, 2017
Its the FBI dude you're fucked, throw your hard drive in a river.
Its a honey pot mostly likely someone scanned your file on VirusTotal.
* - Tyler Durden. - Jan 4, 2017
Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?
Just trying to understand how the honeypots received the file then.
* - White. - Jan 4, 2017
(Jan 4, 2017 10:51 AM)Tyler Durden. Wrote: Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?
Just trying to understand how the honeypots received the file then.
Do you with any chance run any anti-virus software yourself that might have taken it and decided to scan?
* - Dankkk - Jan 4, 2017
(Jan 4, 2017 10:51 AM)Tyler Durden. Wrote: Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?
Just trying to understand how the honeypots received the file then.
what crypter did you get? is it a shady ass crypter ...
* - Tyler Durden. - Jan 4, 2017
(Jan 4, 2017 10:53 AM)Dankkk Wrote: what crypter did you get? is it a shady ass crypter ...
Thank you for replying, but read the thread before you post.
CyberSeal
* - Sheeple - Jan 4, 2017
(Jan 4, 2017 10:51 AM)Tyler Durden. Wrote: Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?
Just trying to understand how the honeypots received the file then.
Turn off/uninstall any anti-virus software on your pc. Chances are that shit got sent straight to analysis.
Thanks for ruining the detections
* - ze-slade - Jan 4, 2017
Ignore the idiots saying it's the FBI, the clients are just honeypots, your program must've gotten picked up by an anti virus scanner like VT, did you download your stub from Chrome? If so that'd explain it other possibilities: anti virus scanned and distrubuted or you uploaded it to a bad scan site/file upload site
* - Tyler Durden. - Jan 4, 2017
(Jan 4, 2017 10:53 AM)ThatUnnamedWhiteDude Wrote: Do you with any chance run any anti-virus software yourself that might have taken it and decided to scan?
No, I am absolutely certain as I currently have 0 antivirus software installed on that computer.
(Jan 4, 2017 10:56 AM)Sheeple Wrote: Turn off/uninstall any anti-virus software on your pc. Chances are that shit got sent straight to analysis.
Thanks for ruining the detections
Yes, and thank you for your useless post. I don't have any antivirus software
* - ze-slade - Jan 4, 2017
(Jan 4, 2017 10:56 AM)Sheeple Wrote: Turn off/uninstall any anti-virus software on your pc. Chances are that shit got sent straight to analysis.
Thanks for ruining the detections
He's probably new still, judging by the thread. Don't give him such a hard time, we all make mistakes after all, and I'm sure you made one like this before too. 😉
* - White. - Jan 4, 2017
(Jan 4, 2017 10:56 AM)Tyler Durden. Wrote: No, I am absolutely certain as I currently have 0 antivirus software installed on that computer.
I would suggest that you check out Windows Defender settings as it enables itself if not turned off by user policy or an alternative AV program (Windows 10).
Also, disable your Windows Firewall.
Furthermore, do not download your stub from a browser even when localhost a browser will upload it and scan it.
Other then this you must've been leaking your file somewhere as I can't think of anything else that happened, but these clients are not the end of the world, just block them and be done with them.