[thmaster100]

Hi , I've been refuding my crypter over run4me service since dyncheck was blocked

I was testing one detected rat (njRAT) so after the scan of the files about like 10  - 15 mins another Russians computer labs come to my RAT

check the picture
Spoiler (Click to View)


I had many of them like this I kept checking the Vm they use and they do the following :

1 - fill the desktop with files contain name like ( sercrets , passwords , finance .xls / doc , invoice )
2 - put a USB stick with random file names
3 - sometimes they open notepad of file called 'passwords.txt' and start typing random letters and stuff

so what I did to make sure it's this site , I made new file server ( named xXx-Hacked-xXx ) and crypted it and uploaded it to run4me scanner, after like 10 min the hosts started comming over again so am Prettry sure it's that site

in this case the site sends samples I mailed the owner hoping he take actions

Edited
the owner answer :
Spoiler (Click to View)

🤝

[nCuX0]

i had the same results with avcheck scanner

[thmaster100]

i had the same results with avcheck scanner

I just did another 3 testes , trying to find out what AV send samples

[lesstech]

I just did another 3 testes , trying to find out what AV send samples

We should avoid run4me entirely correct?

[MavenGradle]

Kaspersky is quite resourceful these days. Better watch out for those bees and their honey.

[Cyber Coder]

few weeks ago i tried to use it and the runtime scanner never worked and had infinite queue , the owner didin't bother refunding or anything
dyncheck seems fine to me

[thmaster100]

this was the owner answer :