Spoof Call and Spoof SMS set any caller ◆ Anvilpoint CyberOps - Hacker for Hire ◆ Cheap KYC Verifications & Openups ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › My password were changed after downloading a RAT

New Reply 

My password were changed after downloading a RAT
Badplum
Guest
 
Dec 8, 2014 01:36 PM
Okay it was stupid of me I know. I downloaded a RAT by accident and I did a system restore. I though I was safe only to notice that my MC passwords were changed (I have 2 accounts) and I'm worried he will get my steam next. I dont even feel safe on the web right now until its removed. Ill have a link of were I downloaded it. Anyone know how to uninstall it? Im very nervous and fairly scared...

(removed)
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 01:44 PM
Remove the download link if its infected. PM me it directly and I'll take a look to gather more information
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
-Hyperion
-Hyperion Offline
Windows/Mac Malware Specialist
***
HF Ub3r
Posts:
3,945
Threads:
190
Credibility:
000
Popularity:
4
βytes:
β 0
Game XP:
0
Dec 8, 2014 07:20 PM
and you need to run a scan right away then change your passwords please follow these basic removal instructions https://hackforums.net/showthread.php?tid=4558828 then post the logs. We can go more in depth after
[Image: T2TtNNn.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 07:23 PM
(Dec 8, 2014 07:20 PM)-Hyperion Wrote:  and you need to run a scan right away then change your passwords please follow these basic removal instructions https://hackforums.net/showthread.php?tid=4558828 then post the logs. We can go more in depth after

I got information about the file, its a DarkComet stub with a miner in it. Want screenshots and shit?
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
-Hyperion
-Hyperion Offline
Windows/Mac Malware Specialist
***
HF Ub3r
Posts:
3,945
Threads:
190
Credibility:
000
Popularity:
4
βytes:
β 0
Game XP:
0
Dec 8, 2014 07:25 PM (This post was last modified: Dec 8, 2014 07:26 PM by -Hyperion.)
(Dec 8, 2014 07:23 PM)Aura Wrote:  I got information about the file, its a DarkComet stub with a miner in it. Want screenshots and shit?

if it was something good I might... hell even cryptolocker mundane now. Why don't you try running it on the new site I found and see what it finds as a test?
[Image: T2TtNNn.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 07:27 PM
(Dec 8, 2014 07:25 PM)-Hyperion Wrote:  if it was something good I might... hell even cryptolocker mundane now. Why don't you try running it on the new site I found and see what it finds as a test?

Which new website? I'm not aware of any new website? And its a basic stub too. Killing the processes actually kills it and if you disable it in msconfig and delete the stubs, it doesn't comeback. Top tier skiddy material.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
-Hyperion
-Hyperion Offline
Windows/Mac Malware Specialist
***
HF Ub3r
Posts:
3,945
Threads:
190
Credibility:
000
Popularity:
4
βytes:
β 0
Game XP:
0
Dec 8, 2014 07:31 PM
https://www.hybrid-analysis.com/ this one see what report it drops
[Image: T2TtNNn.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 07:35 PM
(Dec 8, 2014 07:31 PM)-Hyperion Wrote:  https://www.hybrid-analysis.com/ this one see what report it drops

Oh alright, let me boot up a VM.
Meanwhile:
https://i.imgur.com/MgOH2NH.png
https://i.imgur.com/U0EiFnO.png
https://www.virustotal.com/en/file/a3cd7.../analysis/
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Badplum
Guest
 
Dec 8, 2014 07:49 PM
Wait so it was only Dark comet? Nothings in my ms config that's suspicious I checked after running a scan and system restoring. If its not in the start up do you think im safe now? I changed my passwords but he got 1 of my mine craft accounts :(
"Whole Computer Scan"
"High severity";"6";"6";"0"
"Medium severity";"32";"32";"0"
"Scanned folders:";"Scan Whole Computer"
"Started:";"12/8/2014, 5:20:46 PM"
"Finished:";"12/8/2014, 6:48:45 PM"
"Scanned items:";"266848"
"Launched by:";"Badplum25"

"Name";"Description";"Status";"Status";"Priority"
"C:\Users\Badplum25\Desktop\Random RATS\Terraria.exe.exe";"Trojan horse Downloader.Generic13.AWJB";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xBDC0 -> aswSnx.sys +0x2D9BC";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys XLATEOBJ_cGetPalette+0x15CA4 -> aswSnx.sys +0x2F5C8";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys XLATEOBJ_cGetPalette+0xF90 -> aswSnx.sys +0x2F614";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x8630 -> aswSnx.sys +0x2D6B0";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SIIT6E3K\BiTool[1].dll";"Adware Generic5.AOJI";"Secured";"Healed";"Medium"
"c:\Program Files (x86)\Spyrix Free Keylogger\spkl.exe (3048)";"Trojan horse PSW.Generic12.ATPL";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x12F34 -> aswSnx.sys +0x2E2F4";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xE368 -> aswSnx.sys +0x2E40C";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys XLATEOBJ_cGetPalette+0x6440 -> aswSnx.sys +0x2FB28";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xB8A0 -> aswSnx.sys +0x2E190";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngFntCacheLookUp+0x8F20 -> aswSnx.sys +0x2F38C";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x148E8 -> aswSnx.sys +0x2DBE0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x6400 -> aswSnx.sys +0x2D760";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xBF2C -> aswSnx.sys +0x2D938";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngPaint+0x914 -> aswSnx.sys +0x2FE90";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R5WNQS50\setup[1].exe";"Found MalSign.Generic.2E0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x5AF8 -> aswSnx.sys +0x2E438";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngSetPointerTag+0x130 -> aswSnx.sys +0x30190";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\Desktop\Darkcomet\DarkComet.exe";"Trojan horse Downloader.Generic13.AWJB.dropper";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x25DC -> aswSnx.sys +0x2DDF0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x81EC -> aswSnx.sys +0x2DB00";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys STROBJ_fxBreakExtra+0x1E00 -> aswSnx.sys +0x3000C";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngRestoreFloatingPointState+0x3EF8 -> aswSnx.sys +0x2D570";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xE1EC -> aswSnx.sys +0x2E568";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngRestoreFloatingPointState+0x1150 -> aswSnx.sys +0x2F568";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x5788 -> aswSnx.sys +0x2DCC0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x46C4 -> aswSnx.sys +0x2D180";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x7CCC -> aswSnx.sys +0x2E594";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngFntCacheLookUp+0x1240C -> aswSnx.sys +0x2D390";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\Desktop\Darkcomet\Celesty Binder\Celesty.exe";"Trojan horse Generic23.AVVP.dropper";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x6B5C -> aswSnx.sys +0x2E3E0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x9188 -> aswSnx.sys +0x2E6BC";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngBitBlt+0x606C -> aswSnx.sys +0x2E174";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\Desktop\Batch files\Skype.exe";"Found Win32/DH{ATZCKQ}";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x2670 -> aswSnx.sys +0x2DF04";"Secured";"Healed";"Medium"
"C:\Games\Watch Dogs\bin\Watch_Dogs.exe";"Virus found Win32/Blacked";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngCopyBits+0x16D8 -> aswSnx.sys +0x2F500";"Secured";"Healed";"Medium"

Heres my log
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 07:50 PM (This post was last modified: Dec 8, 2014 08:03 PM by Aura.)
(Dec 8, 2014 07:49 PM)Badplum Wrote:  Wait so it was only Dark comet? Nothings in my ms config that's suspicious I checked after running a scan and system restoring. If its not in the start up do you think im safe now? I changed my passwords but he got 1 of my mine craft accounts :(

I'm running the stub again in my VM to see if it have the same behavior. But the VirusTotal (and my analysis) confirm that it's indeed a skiddy DarkComet RAT stub with a CPUMiner feature.
Well, that's some detailled analysis indeed, the scan time is just extremely long:

https://www.hybrid-analysis.com/sample/a...e88c4e402/
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
-Hyperion
-Hyperion Offline
Windows/Mac Malware Specialist
***
HF Ub3r
Posts:
3,945
Threads:
190
Credibility:
000
Popularity:
4
βytes:
β 0
Game XP:
0
Dec 8, 2014 08:11 PM
did you follow all the directions OP? if so then change your passwords
[Image: T2TtNNn.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 09:28 PM
(Dec 8, 2014 08:11 PM)-Hyperion Wrote:  did you follow all the directions OP? if so then change your passwords

Along with that, if possible, enable 2FA (Two-Factor Authentification) on every accounts you can to drastically increase the security of these accounts.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
AcidBurnTrump
Guest
 
Dec 8, 2014 09:55 PM
whats the link where you download the rat i would like to have it

add on skype AcidBurnTrump
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Dec 8, 2014 09:56 PM
(Dec 8, 2014 09:55 PM)AcidBurnTrump Wrote:  whats the link where you download the rat i would like to have it

add on skype AcidBurnTrump

I have it, why would you like to have it?
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Accelerator.
Guest
 
Dec 8, 2014 10:22 PM
Try Darkcomet Remover?
Wasn't it made by the same guy who made Darkcomet?
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by SecurityCultJun 4, 2017 01:48 PM 10 373 Jun 4, 2017 01:48 PM
Last Post: SecurityCult
[Infected] by TheDFighterDec 11, 2014 12:09 PM 20 424 Dec 11, 2014 12:09 PM
Last Post: TheDFighter
by Xero666Oct 16, 2014 12:34 PM 7 168 Oct 16, 2014 12:34 PM
Last Post: Aura