Hack Forums
[Community Alert] ByteCrypter == ByteProtector V3 == Backdoor RAT - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: [Community Alert] ByteCrypter == ByteProtector V3 == Backdoor RAT (/showthread.php?tid=6266984)

ByteCrypter == ByteProtector V3 == Backdoor RAT - Hackers - Mar 27, 2024

Hello, I just received my purchased copy of SIM-2362145 's crypter "ByteCrypter v3".
When I inspected it, I noticed a few things.

1) Not modified since 2021. This is modern?
Spoiler (Click to View)

2) The hex data says it is ByteProtector V3 - Not ByteCrypter
Spoiler (Click to View)

3) The hex data shows a connection to Aegis 'loader & logger' - that's their bot/logs system, NOT licensing like SIM says it is.
Spoiler (Click to View)

4) When I opened it, it immediately tried to perform drag & drop operations, and I had 1 other failed error for an attempt to steal clipboard data. I had a locked down VirtualBox for this & if I hadn't set the permissions like this, it would've transferred files and completely f'd me.
Spoiler (Click to View)

5) The builder is infected
Spoiler (Click to View)

6) Sketchy behavior logs - Takes a screenshot for example
Spoiler (Click to View)



Please check the following threads for more information about ByteCrypter from SIM-2362145 & the associated Aegis logger/scanner/crypter tool:

https://hackforums.net/showthread.php?tid=6263240

https://hackforums.net/showthread.php?tid=6264915

https://hackforums.net/showthread.php?tid=6262966



SIM-2362145
Please tell me why you are backdooring HF users - your own customers... Why would you do this?

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Scrubspoof - Mar 27, 2024

Hasn't this guy been closed like 5 times now?

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Euaggelistes - Mar 27, 2024

Thank you so much for making this known and helping us investigate.

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Juoku - Mar 27, 2024

Damn that's crazy 😧
So a copied / rebranded, outdated crypter thats also backdoored....
That's just low

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Hackers - Mar 27, 2024

(Mar 27, 2024 04:54 AM)Juoku Wrote:  Damn that's crazy 😧
So a copied / rebranded, outdated crypter thats also backdoored....
That's just low

Yep and SIM-2362145 also made comments about him knowing that I talked to some of his previous customers, but at least 1 told me they never mentioned that to him - pretty sure they were ratted and he was able to see their HF convo w/ me.

also lets not forget that even though SIM-2362145 is distributing copies of ByteProtector V3 in his ByteCrypter sales thread, he simultaneously claims to have never heard of Byte Protector. Just more evidence of his manipulation and lies.

[Image: Screenshot-2024-03-27-003016.png]

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Komodo - Mar 27, 2024

Idk shit about this topic but honestly just wanted to say you’re super smart.

I enjoy reading your posts about how things work and when you bring people into the spotlight for being shady.

Thanks for protecting the community.

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Hackers - Mar 27, 2024

(Mar 27, 2024 04:50 AM)Scrubspoof Wrote:  Hasn't this guy been closed like 5 times now?

AFAIK, SIM-2362145 is just a "proxy seller" and it has always been said that he is not the same user Royal ! ...although I think it is, some people claim that Royal's bytecrypter was always 0 FUD but that SIM can barely get below 20. So, it's possible they are two different users, but it's very clear to me that SIM's version is infected, hasn't been updated, etc. If they aren't the same user, then I'm assuming SIM probably doesn't have source at all and is just re-selling the same compiled program. This would also explain why he can't get FUD and why there are so many tools that must be used for 1 crypt.

(Mar 27, 2024 04:52 AM)Euaggelistes Wrote:  Thank you so much for making this known and helping us investigate.

You're welcome ~ I hope others will help identify scammers too.

(Mar 27, 2024 05:10 AM)Komodo Wrote:  Idk shit about this topic but honestly just wanted to say you’re super smart.
I enjoy reading your posts about how things work and when you bring people into the spotlight for being shady.
Thanks for protecting the community.

Thanks, I appreciate that. I think a lot of this stuff can be found by anyone that wants to try, it didn't take much effort to discover all this, but it did take up a lot of time initially.

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Kompers - Mar 27, 2024

Pretty wild. Thanks for posting this.

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Scrubspoof - Mar 27, 2024

I never understood why someone would backdoor a product that is already a turn key operation.

RE: ByteCrypter == ByteProtector V3 == Backdoor RAT - Omniscient - Mar 29, 2024

Please note that Hackers did not get the file directly from the seller but instead used a 3rd party to obtain it. This leaves room for doubt. He's also expressed interest in creating his own product/service to compete.

I'm all for protecting the community but I'm also not going to allow a member to harass sellers continually.

Hackers will be closed if this continues.