+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: [Community Alert] imsorri1 | UID: 4233147 (/showthread.php?tid=6031706)
Pages: Pages
1
2
imsorri1 | UID: 4233147 - Harald - Dec 10, 2019
So, Morning All.
Was just chilling drinking my coffee, till I received a random-ass PM from some user. This user is claiming I asked for an eBook? Considering, I've never asked for an eBook in my life, I found this very hard to believe, so I had to check his profile which was already looking fishy as it is, so I proceed to run a virus total scan against the sent file, you can see for your self below the results and the PM.
So be cautious dealing with this user, I will update the thread with any more reports like this.
Profile Link:
https://hackforums.net/member.php?action=profile&uid=4233147
Virus Total:
https://www.virustotal.com/gui/url/c64bc5c7dbd40cefdd3237db4232acff7335838ed843c335798d18f88350f408/detection
PM Proof:
![[Image: 6e9744e18543e2febbbfa0d932eac006.png]](https://i.gyazo.com/6e9744e18543e2febbbfa0d932eac006.png)
User Info:
UID: 4233147
Usernames(s)
imsorri1
RE: imsorri1 | UID: 4233147 - rsx - Dec 10, 2019
There's gotta be someone with a VM on here to test this.
I'm willing to be it's a RAT.
RE: imsorri1 | UID: 4233147 - SIM-1729678 - Dec 10, 2019
Nice alert. Curious if the file is actually infected.
RE: imsorri1 | UID: 4233147 - Harald - Dec 10, 2019
(Dec 10, 2019 01:39 AM)Nuzi Wrote: There's gotta be someone with a VM on here to test this.
I'm willing to be it's a RAT.
I can send you the link, if you want?
RE: imsorri1 | UID: 4233147 - rsx - Dec 10, 2019
(Dec 10, 2019 01:40 AM)LiteDev Wrote: I will send you the link if you want?
I don't have that type of stuff or knowledge to test it, I know there was someone on here a while ago who used to test sus files in a VM.
RE: imsorri1 | UID: 4233147 - Harald - Dec 10, 2019
(Dec 10, 2019 01:41 AM)Nuzi Wrote: I don't have that type of stuff or knowledge to test it, I know there was someone on here a while ago who used to test sus files in a VM.
If I get some free time, I will set up a VM and debug it.
In the meantime, if anyone wishes to take this task on, just say. I can send you the link.
RE: imsorri1 | UID: 4233147 - rsx - Dec 10, 2019
(Dec 10, 2019 01:42 AM)LiteDev Wrote: If I get some free time, I will set up a VM and debug it.
In the meantime, if anyone wishes to take this task on, just say. I can send you the link.
Let us know what you find, his profile is for sure suspicious with an upgrade already with only 3 posts sending random links.
RE: imsorri1 | UID: 4233147 - Harald - Dec 10, 2019
(Dec 10, 2019 01:44 AM)Nuzi Wrote: Let us know what you find, his profile is for sure suspicious with an upgrade already with only 3 posts sending random links.
Exactly, The virus scan has picked up a detection as well, which is not normal behaviour for a PDF Document.
RE: imsorri1 | UID: 4233147 - Natas - Dec 10, 2019
Bastille your time to shine buddy enlighten us with your knowledge buddy.
Could be false positive could be a virus I cant really tell and am not gonna test it lmao.
although im going to upload one of my ebooks and see if it shows a false positive or not because im curious
and its pretty sketchy that dude has no posts giving a ebook he had 1 thread but it got deleted and I cant see what it is
so in my opinion it is super sketchy
RE: imsorri1 | UID: 4233147 - Harald - Dec 10, 2019
(Dec 10, 2019 01:48 AM)Natas Wrote: Bastille your time to shine buddy enlighten us with your knowledge buddy.
Could be false positive could be a virus I cant really tell and am not gonna test it lmao.
although im going to upload one of my ebooks and see if it shows a false positive or not because im curious
and its pretty sketchy that dude has no posts giving a ebook he had 1 thread but it got deleted and I cant see what it is
so in my opinion it is super sketchy
Yes, I should mention somewhere this isn't confirmed a threat. However, giving the following circumstances I'm at least 80% sure this is user is trying his luck to infect unware users that may fall for this.
Update; https://hackforums.net/showthread.php?tid=6031692
RE: imsorri1 | UID: 4233147 - Natas - Dec 10, 2019
Also looks like it could be a lost / stolen account
Password Reset in Last Week: Yes
Last Password Change: Yesterday
RE: imsorri1 | UID: 4233147 - cryp - Dec 10, 2019
Give me the link, will test it.
(Dec 10, 2019 01:40 AM)ScreemS Wrote: Nice alert. Curious if the file is actually infected.
(Dec 10, 2019 01:44 AM)Nuzi Wrote: Let us know what you find, his profile is for sure suspicious with an upgrade already with only 3 posts sending random links.
(Dec 10, 2019 01:50 AM)LiteDev Wrote: Yes, I should mention somewhere this isn't confirmed a threat. However, giving the following circumstances I'm at least 80% sure this is user is trying his luck to infect unware users that may fall for this.
Update; https://hackforums.net/showthread.php?tid=6031692
(Dec 10, 2019 01:52 AM)Natas Wrote: Also looks like it could be a lost / stolen account
Password Reset in Last Week: Yes
Last Password Change: Yesterday
I believe this file isn't actually a virus.
Now, I would NOT open this on a PC or disregard it because of my following statement.
But you can see: https://hackforums.net/showthread.php?tid=6031640
He responded to this, I'm 75% sure he's spreading a referral link rather than a virus.
RE: imsorri1 | UID: 4233147 - Bass_Reeves - Dec 10, 2019
Hahah, literally same thing just happened to me. Morning coffee, and everything.
Thought to myself..."not today Satan".
👹
RE: imsorri1 | UID: 4233147 - Dracaryzs - Dec 10, 2019
It;s not a RAT. It's a JavaScript Tamper Monkey script to change Bitcoin receiving address.
RE: imsorri1 | UID: 4233147 - Bastille - Dec 10, 2019
Natas Thanks for mentioning, old my beer
Harald Can you send me the link ?
By the way, should we move this thread to the White hat section admins ?
Edit : Get the link into the Virus Total link