Anvilpoint CyberOps - Hacker for Hire ◆ Traffic service & campaign optimization ◆ Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Remote Administration Tools › Weird slaves showing up?

New Reply 

Weird slaves showing up?
Tyler Durden.
Tyler Durden. Offline
8th year
***
HF l33t
Posts:
1,930
Threads:
346
Credibility:
2803
Popularity:
217
βytes:
β 0
Game XP:
6
Jan 4, 2017 10:41 AM
Hello

So I am using Imminent Monitor, and Cyberseal Protector.
I just built a new server, and crypted it with CyberSeal protector.
- Now I haven't even spread the file yet, and only after about 5 min after crypting my file, these slaves show up. Now are these HoneyPots, and how the hell did they end up there, when I JUST created the server?

Spoiler (Click to View)
chase.
chase. Offline
[bin@HF:]
***
HF Ub3r
Posts:
3,241
Threads:
167
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:42 AM
It's the FBI you're fucked dude see ya in prison
Dead
Baitable
Baitable Offline
14eMpNYg3doDm2ALCzDEjzo5AfeKrQ9pgD
***
HF l33t
Posts:
981
Threads:
102
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:44 AM
Usually from VT scans, I suggest you don't use VT for your scanning purposes.
You should click here.
bzrΚ
bzrΚ Offline
Lost in the sea
***
HF Ub3r
Posts:
2,952
Threads:
21
Credibility:
000
Popularity:
1,405
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:46 AM
Its a honeypot. Your stub has made its way into the hands of the anti virus companies and they're scanning it.. Just block them and be more careful.
[Image: signature.png]
Dankkk
Dankkk Offline
[n00b@HF:]
*
Registered
Posts:
36
Threads:
6
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:48 AM
I recommend setting your stub up to melt... aswell if you see a VM on your connections or someone trying to fuck with your stub in a VM or in CMD you should most deffs uninstall the payload. fuck the feds OP 🤝
President Morty
President Morty Offline
[closed@HF:]
Posts:
1,743
Threads:
145
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:48 AM
Its the FBI dude you're fucked, throw your hard drive in a river.

Its a honey pot mostly likely someone scanned your file on VirusTotal.
Tyler Durden.
Tyler Durden. Offline
8th year
***
HF l33t
Posts:
1,930
Threads:
346
Credibility:
2803
Popularity:
217
βytes:
β 0
Game XP:
6
Jan 4, 2017 10:51 AM
Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?

Just trying to understand how the honeypots received the file then.
White.
White. Offline
[closed@HF:]
Posts:
342
Threads:
19
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:53 AM
(Jan 4, 2017 10:51 AM)Tyler Durden. Wrote:  Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?

Just trying to understand how the honeypots received the file then.

Do you with any chance run any anti-virus software yourself that might have taken it and decided to scan?
Dankkk
Dankkk Offline
[n00b@HF:]
*
Registered
Posts:
36
Threads:
6
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:53 AM
(Jan 4, 2017 10:51 AM)Tyler Durden. Wrote:  Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?

Just trying to understand how the honeypots received the file then.

what crypter did you get? is it a shady ass crypter ...
Tyler Durden.
Tyler Durden. Offline
8th year
***
HF l33t
Posts:
1,930
Threads:
346
Credibility:
2803
Popularity:
217
βytes:
β 0
Game XP:
6
Jan 4, 2017 10:56 AM
(Jan 4, 2017 10:53 AM)Dankkk Wrote:  what crypter did you get? is it a shady ass crypter ...

Thank you for replying, but read the thread before you post.
CyberSeal
Sheeple
Sheeple Offline
Bruh
****
HF Ub3r
Posts:
6,600
Threads:
109
Credibility:
500
Popularity:
386
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:56 AM
(Jan 4, 2017 10:51 AM)Tyler Durden. Wrote:  Listen.
The file never left my computer + the only scanner I used was the inbuilt scanner in CyberSeal.
Now I doubt the creator is stupid enough to implement VirusTotal into his own crypter?

Just trying to understand how the honeypots received the file then.

Turn off/uninstall any anti-virus software on your pc. Chances are that shit got sent straight to analysis.
Thanks for ruining the detections
ze-slade
ze-slade Offline
irrelevant.
***
HF Ub3r
Posts:
4,268
Threads:
343
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:56 AM
Ignore the idiots saying it's the FBI, the clients are just honeypots, your program must've gotten picked up by an anti virus scanner like VT, did you download your stub from Chrome? If so that'd explain it other possibilities: anti virus scanned and distrubuted or you uploaded it to a bad scan site/file upload site
Tyler Durden.
Tyler Durden. Offline
8th year
***
HF l33t
Posts:
1,930
Threads:
346
Credibility:
2803
Popularity:
217
βytes:
β 0
Game XP:
6
Jan 4, 2017 10:56 AM (This post was last modified: Jan 4, 2017 10:57 AM by Tyler Durden..)
(Jan 4, 2017 10:53 AM)White. Wrote:  Do you with any chance run any anti-virus software yourself that might have taken it and decided to scan?

No, I am absolutely certain as I currently have 0 antivirus software installed on that computer.
(Jan 4, 2017 10:56 AM)Sheeple Wrote:  Turn off/uninstall any anti-virus software on your pc. Chances are that shit got sent straight to analysis.
Thanks for ruining the detections

Yes, and thank you for your useless post. I don't have any antivirus software
ze-slade
ze-slade Offline
irrelevant.
***
HF Ub3r
Posts:
4,268
Threads:
343
Credibility:
000
Popularity:
6
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:58 AM
(Jan 4, 2017 10:56 AM)Sheeple Wrote:  Turn off/uninstall any anti-virus software on your pc. Chances are that shit got sent straight to analysis.
Thanks for ruining the detections

He's probably new still, judging by the thread. Don't give him such a hard time, we all make mistakes after all, and I'm sure you made one like this before too. 😉
White.
White. Offline
[closed@HF:]
Posts:
342
Threads:
19
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jan 4, 2017 10:59 AM (This post was last modified: Jan 4, 2017 11:01 AM by White..)
(Jan 4, 2017 10:56 AM)Tyler Durden. Wrote:  No, I am absolutely certain as I currently have 0 antivirus software installed on that computer.

I would suggest that you check out Windows Defender settings as it enables itself if not turned off by user policy or an alternative AV program (Windows 10).
Also, disable your Windows Firewall.

Furthermore, do not download your stub from a browser even when localhost a browser will upload it and scan it.

Other then this you must've been leaking your file somewhere as I can't think of anything else that happened, but these clients are not the end of the world, just block them and be done with them.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Rat and KeyloggerApr 11, 2019 09:42 PM 31 727 Apr 11, 2019 09:42 PM
Last Post: SoonTM
by ScepsisFeb 3, 2016 10:44 AM 8 260 Feb 3, 2016 10:44 AM
Last Post: Doxer_Pro
by ScepsisFeb 2, 2016 12:12 PM 2 259 Feb 2, 2016 12:12 PM
Last Post: DingusMonster