[dEn00]

Today I was playing cs, and Ive got a request from this stranger.
He said:


After clicking on that link, it transfers you at a steam player page,
then you click on Add Friend, and it redirect you to an
"SteamGuard" pop-up windows, which is "required to download" in order to continue.

SteamGuard link: http://steamc0mmunnity.com/id/BEAR_XD/login/home/



So a scan of a file:



WHOIS of the site:



I contacted Razor regarding this, and asked him if he can debug the file for me and identify connections.

RazorSoft | Razor:

"I can definitely tell that it's main purpose is to steal from steam
you see that spreaded all over the code
and i bet that the owner of darkclub.cc is somehow involved
http://catalogs.darkclub.cc/steam/download/
check that
file is stored there + ip gets checked from there
and so i bet that he even coded/c&p'd this himself"

The trojan name is xQuadStealer and it grabs steam info / items.

Feel free to grab the .exe and DEBUG it and search for any IP addresses to fuck him or just report his site and tell us results. Thank you.

Be aware and share this with your friends! 🤝

[Hidden™]

God damn, nice find! I will be weary of this.

[dEn00]

.... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.

God this fucking annoys me.

As I am saying at the end of the thread, I am searching for someone who can search for his IP address or something more, so I can report him.

[Austerity]

Very nice find mate, I need to notify most of my mates about this phish. I believe it is a progressive method as well.

[MechWarrior67]

thanks for the heads up. I will alert my friends about this.