Today I was playing cs, and Ive got a request from this stranger.
He said:
![[Image: RsQSPc3.jpg]](https://i.imgur.com/RsQSPc3.jpg)
After clicking on that link, it transfers you at a steam player page,
then you click on Add Friend, and it redirect you to an
"SteamGuard" pop-up windows, which is "required to download" in order to continue.
SteamGuard link: http://steamc0mmunnity.com/id/BEAR_XD/login/home/
![[Image: D7KLulE.jpg]](https://i.imgur.com/D7KLulE.jpg)
So a scan of a file:
![[Image: oUzrrsB.jpg]](https://i.imgur.com/oUzrrsB.jpg)
WHOIS of the site:
![[Image: AdmZe9j.png]](https://i.imgur.com/AdmZe9j.png)
I contacted Razor regarding this, and asked him if he can debug the file for me and identify connections.
![[Image: 73a7066e0120f0e79f3ff4d3fa92e53f.png]](https://i.gyazo.com/73a7066e0120f0e79f3ff4d3fa92e53f.png) ![[Image: 7b426044c36c9475c4f7f534409bd89d.png]](https://i.gyazo.com/7b426044c36c9475c4f7f534409bd89d.png) ![[Image: f28f6797b8acb59969a61c3c3f257297.png]](https://i.gyazo.com/f28f6797b8acb59969a61c3c3f257297.png) ![[Image: c352edf1fecc37abd1a6dea345bb6bae.png]](https://i.gyazo.com/c352edf1fecc37abd1a6dea345bb6bae.png)
RazorSoft | Razor: "I can definitely tell that it's main purpose is to steal from steam
you see that spreaded all over the code
and i bet that the owner of darkclub.cc is somehow involved
http://catalogs.darkclub.cc/steam/download/
check that
file is stored there + ip gets checked from there
and so i bet that he even coded/c&p'd this himself "
The trojan name is xQuadStealer and it grabs steam info / items.
Feel free to grab the .exe and DEBUG it and search for any IP addresses to fuck him or just report his site and tell us results. Thank you.
Be aware and share this with your friends! 🤝
DO NOT DEAL WITH THIS MEMBER
There is sadly alot of these phishing sites out there.
.... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.
God this fucking annoys me.
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
God damn, nice find! I will be weary of this.
(Aug 3, 2014 10:34 AM)Aura Wrote: .... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.
God this fucking annoys me.
As I am saying at the end of the thread, I am searching for someone who can search for his IP address or something more, so I can report him.
(Aug 3, 2014 10:45 AM)dEn00 Wrote: As I am saying at the end of the thread, I am searching for someone who can search for his IP address or something more, so I can report him.
To what end ? These phishing pages will always be up, no matter what. Just report them, end of story.
Fiat justitia ruat cælum
My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Sorry but whoever falls for this is a fucking retard.
Pretty sure most of HF have a brain cell to avoid this without an alert...
I'm Sleazy and I think you outta know this!
The girlies love me cause I wear the right clotheses
They see the bulges when I strike the right poses
Pull my pants down and you ask me can you blow this
(Aug 3, 2014 10:53 AM)Sleazy P. Martini Wrote: Sorry but whoever falls for this is a fucking retard.
Pretty sure most of HF have a brain cell to avoid this without an alert...
Indeed, I agree.
OP, thank you for the alert.
Aug 3, 2014 01:08 PM
(This post was last modified: Aug 3, 2014 01:17 PM by DpzFAsq4UEK8.)
There are multiple variants of this stealer, there is also one coded in Delphi or something like that.
darkclub.cc down, such a shame. I wanted to upload a little present for 'em…
DO NOT DEAL WITH THIS MEMBER
(Aug 3, 2014 01:08 PM)DpzFAsq4UEK8 Wrote: There are multiple variants of this stealer, there is also one coded in Delphi or something like that.
darkclub.cc down, such a shame. I wanted to upload a little present for 'em…
Dayum, they were prepared for lil feggets like you uploading backdoored c99 shell 🤗🎉
(Aug 3, 2014 10:34 AM)Aura Wrote: .... Can you just stop with these threads already ? We have THOUSANDS OF THEM HERE.
YES WE KNOW. STEAM PHISHING PAGES ARE EVERYWHERE AND SO IS THAT FUCKING STEAMGUARD.EXE
NOW JUST STOP IT.
SEARCH BEFORE POSTING.
God this fucking annoys me.
True dat.
I believe this calls for a /rant /thread.
Very nice find mate, I need to notify most of my mates about this phish. I believe it is a progressive method as well.
thanks for the heads up. I will alert my friends about this.
Thanks for this information good to see some have their eye open :)
https://www.youtube.com/watch?v=Pf6o8zaA6cE
My friend asked me "What day is it today?"
and I look hem straight in the eyes and said
"Never mind the party continues"
and turned up the music And he
left his apartment
Day - 2
|
