Apr 8, 2018 07:44 PM
(This post was last modified: Apr 9, 2018 12:10 AM by Cav45.)
Hi,Guys.
I am a crpytomania and I've been looking for 0days since a few days ago.
I've heard the Jpg 0day sales news in Ranger-Exploit and contacted to the supporter with Jabber
(His JabberID:[email protected])
He asked me 15$ BTC to show me the perfermance on TeamViewer.
And then he executed ps file with parameters of jpg file and putty.exe,
and build a new Jpg Malware file.
When he clicked that Jpg file, the picture opened and putty.exe was also executed.
At that time, i asked him to down Process Hacker and execute it.
And then i found putty.exe is executed as child process of Svchost.exe 😠
That Scvchost.exe was located in Desktop\newfolder and it has been loaded about 1 hours ago..
😏
I asked him what that svchost.exe file, but he hasn't answered and close TV and gone away....
I think svchost.exe was hooking Windows Image View and open putty.exe
🤩 That site was scam and he doesn't reply my msg anymore~
Does the person who sells real 0day exist on earth? 😭
swindler's contact
https://ranger-exploit.com/product/jpeg-exploit-0day/
skype:ranger.exploit
jabber:rangerexploit@[email protected]
PS: I have recorded TV file and pm me if u r interested.
I am a crpytomania and I've been looking for 0days since a few days ago.
I've heard the Jpg 0day sales news in Ranger-Exploit and contacted to the supporter with Jabber
(His JabberID:[email protected])
He asked me 15$ BTC to show me the perfermance on TeamViewer.
And then he executed ps file with parameters of jpg file and putty.exe,
and build a new Jpg Malware file.
When he clicked that Jpg file, the picture opened and putty.exe was also executed.
At that time, i asked him to down Process Hacker and execute it.
And then i found putty.exe is executed as child process of Svchost.exe 😠
That Scvchost.exe was located in Desktop\newfolder and it has been loaded about 1 hours ago..
😏
I asked him what that svchost.exe file, but he hasn't answered and close TV and gone away....
I think svchost.exe was hooking Windows Image View and open putty.exe
🤩 That site was scam and he doesn't reply my msg anymore~
Does the person who sells real 0day exist on earth? 😭
swindler's contact
https://ranger-exploit.com/product/jpeg-exploit-0day/
skype:ranger.exploit
jabber:rangerexploit@[email protected]
PS: I have recorded TV file and pm me if u r interested.



![[Image: CJLOhGd.gif]](https://i.imgur.com/CJLOhGd.gif)
![[Image: iEfFqhr.gif]](https://i.imgur.com/iEfFqhr.gif)