[Account of the Gods]

LINK TO NEW THREAD:
https://hackforums.net/showthread.php?ti...id53035901

If you upload your exe on # and then download it, you will get other file with other size and more detections.

Spoiler (Click to View)

my file was 7mb
file i download from link i got is 100kb
my file was undetected
new stub was detected instantly





his threads are:
https://hackforums.net/showthread.php?tid=5309527
https://hackforums.net/showthread.php?tid=5416987
https://hackforums.net/showthread.php?tid=5412310
https://hackforums.net/showthread.php?tid=5309638

Obviously i didnt buy anything from him, only used free "service" thats why i called this "scam" in quotation marks.

What can this do? that literally kills (or steals) all your slaves (if you do update/execute) and malwares you if you open it.

U guys can check this yourself.

I know its free but i also know a lot of people upload there and personally i wouldnt want a free service to kill all my slaves (it would be even worse if ive paid for it).

[White.]

Putty.exe
SHA256: 9f9e74241d59eccfe7040bfdcbbceacb374eda397cc53a4197b59e4f6f380a91
VT Link: https://virustotal.com/en/file/9f9e74241...478603644/

Putty (1).exe
SHA256: a189910ef5892ea53bb744637027ee449fba487d4bcdf7148b2d779585c18ee2
VT Link: https://virustotal.com/en/file/a189910ef...478603762/
Fetzhost Link: http://#/download/32c48789383be0666548520bd3bc07f6.html
(Download at own risk)

"Details" comparison:
Spoiler (Click to View)


File size has also dropped from 518KB (Original file) to 138KB (Fetzhost File).
Tried it with multiple files all same results.

When clicking Report File on Fetzhost it shows that the file size is 518.91KB but when I download it is 138KB.
Spoiler (Click to View)


It also says 518.91KB when opening the removal link that Fetzhost gives you.
Spoiler (Click to View)



-- Edit: It seems that Fetzhost has one .exe that renames itself to your uploaded .exe file and serves that to the people who download.
When you download that .exe and scan it on VT you'll see that it has been detected and scanned before.

[warpje]

Damn smart way! Only really stupid he tried it here...
Curious what he has to say about this

[White.]

When you setup your putty.exe binary did you add a domain/dns or ip or was it just a dummy test? I tested your file and its contacting two namecheap domains when download and run.

I've uploaded a official putty.exe to Fetzhost and the one you downloaded is the output of Fetzhost. A completely different file.

You can easily try it out yourself. Just upload a random .exe file and see what it gives you when you download from Fetzhost.

[bzrΚ]

This is some nice detective work, but I think it needs to be in the Marketplace Discussions SF as a Community Alert. This should get it more exposure.

Marketplace Discussions

[VirtualMon3y]

This is some nice detective work, but I think it needs to be in the Marketplace Discussions SF as a Community Alert. This should get it more exposure.

Marketplace Discussions

Totally agree.

[White.]

NEW THREAD> https://hackforums.net/showthread.php?tid=5457821

This is some nice detective work, but I think it needs to be in the Marketplace Discussions SF as a Community Alert. This should get it more exposure.

Marketplace Discussions

Totally agree.

[TheMC Haxor]

I noticed this a few days ago, I didn't post because I thought people would've already figured it out. I'm guessing his injecting his own botnet file into exe's then using this to power his botshop

[Armada]

Fucking LOL.

Smart way to spread I gotta admit, too bad he will now likely be closed here for his tom foolery.

[yotoprules]

I can confirm this!
https://imgur.com/a/P0daj
Spoiler (Click to View)
I uploaded a clean file, when I downloaded it AV instantly removed it. Old file still intact.

[Autist]

Shit man, he probably has thousands or bots

[Tommy Chong-]

And this is where Fetz gets fucked =D


Can't believe you lmao
Seems like a referral or something, when I go to it theres a from@ somethingy at the end..

So I was curious what that domain was exactly.
Did a quick scan on it and found something suspicious.

"/main/Ekit-newtask.php"

So I googled the filename and as first result.... guess what.. Hunter exploit kit. At least, it appears it is.
https://github.com/hexlax/HunterEK_explo...xploit.php
Look at line 9; file: Ekit-newtask.php

Here's is a screenshot of the site structure:


Unfortunately it asks for credentials.
But there are possible SQL injection vulnerabilities but It's nearly 4:30 AM right now so I really can't be bothered.

Code

GET /main/del.php?id=218&taskname=1'%22 HTTP/1.1
Referer: http://csgonature.com
Cookie: PHPSESSID=h56fi57t6eqrletn5khgmvpll3
Host: csgonature.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*

Code

GET /main/taskreport.php?taskname=JyI%3d HTTP/1.1
Referer: http://csgonature.com
Cookie: PHPSESSID=h56fi57t6eqrletn5khgmvpll3
Host: csgonature.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*

EDIT:

Confirmed (like it wasn't obvious enough already but yea)

[President Morty]

Its a betabot botnet.
Gonna see what version it is and see what I can do to bring it down.
Its version 1.8 its not vulnerable like version 1.7 atleast not vulnerable to my method of hijacking.

[xxtexanzxx44]

Damn, I used this site. Guess I'm a slave now. Damn

[CKkio23]

Damn, I used this site. Guess I'm a slave now. Damn

Well don't infected yourself with your own rat. Lesson learned here for everybody is to not give trust to these site and check them every now and then. 🤝