[White.]

Thanks to everyone! We got Fetz closed!

Alright, so my buddy nulyi made a thread about this but wanted me to post about it here.
Old thread > https://hackforums.net/showthread.php?tid=5457769

REMOVAL VIDEO FOR OUTPUT FILE BY Fộrcəd CAN BE FOUND HERE

Quick summary:
It seems that Fetzhost has one .exe that renames itself to your uploaded .exe file and Fetzhost serves that file to the people who download.
When you download that .exe and scan it on VT you'll see that it has been detected and scanned before.

nulyi made a video about this, watch it:

Obviously i didnt buy anything from him, only used free "service" thats why i called this "scam" in quotation marks.

What can this do? that literally kills (or steals) all your slaves (if you do update/execute) and malwares you if you open it.

U guys can check this yourself.

I know its free but i also know a lot of people upload there and personally i wouldnt want a free service to kill all my slaves (it would be even worse if ive paid for it).

Here is an example that I made with a official putty.exe file I downloaded from
http://www.chiark.greenend.org.uk/~sgtat...nload.html

Putty.exe (My File, Official Putty.exe)
SHA256: 9f9e74241d59eccfe7040bfdcbbceacb374eda397cc53a4197b59e4f6f380a91
VT Link: https://virustotal.com/en/file/9f9e74241...478603644/

Putty (1).exe (Fetzhost output file)
SHA256: a189910ef5892ea53bb744637027ee449fba487d4bcdf7148b2d779585c18ee2
VT Link: https://virustotal.com/en/file/a189910ef...478603762/
Fetzhost Link: http://#/download/32c48789383be0666548520bd3bc07f6.html
(Download at own risk)

"Details" comparison:

Spoiler (Click to View)



File size has also dropped from 518KB (Original file) to 138KB (Fetzhost File).
Tried it with multiple files all same results.

When clicking Report File on Fetzhost it shows that the file size is 518.91KB but when I download it is 138KB.
Spoiler (Click to View)


It also says 518.91KB when opening the removal link that Fetzhost gives you.
Spoiler (Click to View)



The user that promotes this site:
https://hackforums.net/member.php?action...id=1922763

Here some threads from that user:
https://hackforums.net/showthread.php?tid=5309527
https://hackforums.net/showthread.php?tid=5416987
https://hackforums.net/showthread.php?tid=5412310
https://hackforums.net/showthread.php?tid=5309638

[bzrΚ]

Do you know who runs the site? Are they on HF?

[White.]

Do you know who runs the site? Are they on HF?

https://hackforums.net/member.php?action...id=1922763 This man hosts or at least promotes the site.

Here some threads from that user.
https://hackforums.net/showthread.php?tid=5309527
https://hackforums.net/showthread.php?tid=5416987
https://hackforums.net/showthread.php?tid=5412310
https://hackforums.net/showthread.php?tid=5309638

[bzrΚ]

Interested to see what he has to say, if anything.

[Koopa.]

That's pretty sketchy of FetzHosting. Could this be classified as infecting members?

[White.]

Interested to see what he has to say, if anything.

Indeed. Let's await what he has to say.

That's pretty sketchy of FetzHosting. Could this be classified as infecting members?

I'd say so but I haven't fully scanned the .exe that Fetzhost outputs as I'm not a White Hat.

[VirtualMon3y]

Op, this is the scan of your putty.exe after I downlaoded it from Fetz Hosting:

https://www.reverse.it/sample/a189910ef5...mentId=100

It contacts two namecheap domains:

162.255.119.249
and
198.54.117.216

http://whois.domaintools.com/198.54.117.216 and http://whois.domaintools.com/162.255.119.249

[݃݃݃๖ۣۜKosdff]

Wow this is interesting. Great find man props to you 🤝

[White.]

Op, this is the scan of your putty.exe after I downlaoded it from Fetz Hosting:

https://www.reverse.it/sample/a189910ef5...mentId=100

It contacts two namecheap domains:

162.255.119.249
and
198.54.117.216

http://whois.domaintools.com/198.54.117.216 and http://whois.domaintools.com/162.255.119.249

What I found on that site ^

Spoiler (Click to View)


Spoiler (Click to View)

Wow this is interesting. Great find man props to you 🤝

Thanks, but this came to light thanks to nulyi.

[Account of the Gods]

lol he even has botshop, such a ultimate scam, selling hf members slaves that he got because of fake file hosting, then probably doing a botkill there and there.

in fact many hf members were probably infected this way so some of his rep could be fake as well

i wonder why i didnt notice it earlier, tbh if he binded his file with yours it wouldnt get detected at all, but he replaced files instead. :)

[Baitable]

And I ran the fucking files downloaded from FetzHost (Check if my stub works), time to do a full PC scan.. It was long ago so if I am infected should be an easy removal... hopefully..

Fuck Fetz

[White.]

And I ran the fucking files downloaded from FetzHost (Check if my stub works), time to do a full PC scan.. It was long ago so if I am infected should be an easy removal... hopefully..

Fuck Fetz

Glad to hear (Discord) that you aren't infected!

lol he even has botshop, such a ultimate scam, selling hf members slaves that he got because of fake file hosting, then probably doing a botkill there and there.

in fact many hf members were probably infected this way so some of his rep could be fake as well

i wonder why i didnt notice it earlier, tbh if he binded his file with yours it wouldnt get detected at all, but he replaced files instead. :)

Might be a possibility for sure, we'll see when he comes online and see what he has to say.

[wh420]

Good catch! Surprised it took this long to catch...quick look over the file hashes would have told you to instantly be suspect of what was going on. Probably got them a great deal of slaves though considering most people just blindly believe what they're told or have an uncanny ability to convince themselves that nothing is wrong even though their gut is telling them the exact opposite. I wonder how many people that used this site claimed their crypter/rat/botnet wasn't working because they weren't getting slaves...

[DamienVC]

The site looks the same as http://expirebox.com/
hmm

[AlphaIndustries]

I have used Fetzhost for a long time now, and this has never happened to me.