Fake bitcoin wallet stealer – Silent miner backdoor – Reverse

I found another backdoored software. This was made for thouse who want to become hackers… or to make some easy money.
Founded on Youtube.com with a search ”Bitcoin stealer”.
How to use it… the uploader helps you.

• Senha: Techup
• Desativar Antivirus (Claro, se trata de um hack)
• Chave
• Servidor de Ligação
• Adicionar a sua carteira
• Use Proxy
• Aceite os termos
• Verifique se o programa está atualizado

• Password: Techup
• Disable Antivirus (Of course, this is a hack)
• Key
• Connection Server
• Add to your wallet
• Use Proxy
• Accept the terms
• Make sure the program is up to date

All you have to do is to download it, run it and you become a rich guy…
We will not double click the .exe file…( it looks like a .exe).. or better say this SFX rar archive?!?
Let’s see something about the archive with richt click and propreties!
I dont like this SILENT=1. LOL If we dont run the ”.exe”, the backdoor will not run in the background, so let’s Extract it … and surprise.. there are more then one file, including the backdoor files.

winhlp32.exe

Isass.exe

After reversing the backdoor files i found this:

C:/Users/user/Documents/projects/minergate.app/sources/cudaminer/src/cuda_cryptonight_core.cu

… so what about this minergate?!?
With this lovely usage:

Usage:
minergate-cli [-version] -user <email> [-proxy <url>] -<currency> <threads> [<gpu intensity>] [-<currency> <threads> [<gpu intensity>] …] [-o <pool> -u <login> [-t <threads>] [-i <gpu intensity>]]

And so many options:

Options:
-user account email from minergate.com
proxy server URL. Supports only socks protocols (for example: socks://192.168.0.1:1080
possible values: bcn xmr qcn xdn fcn mcn aeon dsh inf8 <mm_cc>+bcn <mm_cc>+xmr <mm_cc>+qcn <mm_cc>+xdn <mm_cc>+aeon <mm_cc>+dsh. Where <mm_cc> is fcn or mcn
threads count for specified currency
GPU mining intensity (NVidia only) (values range: 1..4. Recommended: 2)
mining pool URL
mining pool login
CPU threads count
GPU mining intensity

Conecting to: h**ps://minergate.com
It seems that we have a nice backdoored software.
After you will run it.. in the backgound a silent miner will be instaled on your computer and in front of you will apare a nice error like this:

Blockchain Wallet Stealer 2017\message.vbs
x=msgbox(“Hardware is not compatible, try on another PC or restart and run with disabled antivirus.”, 0+16, “Error“)

If you dont understand, you will download this software, after the first run will appear a error message and it will not work, but in underground you will have already instaled a virus.
This time the virus is a Silent Miner, that will use your computer to work for some hacker and this will help hit to make some bitcoins.

The Youtube channel Teck up has more videos like this one .. and all of them are with this backdoor.

Have fun & Stay safe!!!

MyEtherWallet Notification - Email scam

A new scam.
This time, the hacker tries to steal logging data for the Ethereum wallet.
A site identical to the original was created with the intention of misleading users.

The email comes from an address that is unrelated to the website.*markus.reichenau@t-online.de*Although it could be directly from: myetherwallet.com.

Here you see the differences between the original and the fake websites.

 

And beyond that, the address difference is very clear!!! 

 myetherwallet.com vs myethlerwallet.com

Have fun & Stay safe!!! 

Hunting Paypal Scammer – Busted 100%

Here’s a new software that promises to increase your revenue.
The point is you do not have to believe in miracles.
Everything looks good, but if you try to log in to your Paypal account, the data will be sent without realizing it.
Data is sent to the email of the person who posted and you have all the chances of losing even the few money you have in your account.
Today i will try to find the ”hacker” for you!

To have time for account changes, it will ask you to wait 72 hours for the payment.

Once you’ve added your data, the software logs in to a google account and sends the data.

Because of Google’s security, I can not log in because does not recognize my device.
 
I have to admit that I have pressed several times to call and send message to the number attached on the account.
I hope I’ve stressed him a little!
If we want to catch the hacker, we just need to send an email identical to the one that comes from Google, where we can attach what we already have:

• Email  – ***sans@gmail.com
• Phone number – (…) …_.. 02
• Password – Nofreewifihere2468

The search on Google and you will find something like that:
***hacker911@gmail.com:Nofreewifihere2468::Pandora
Somewere i’ve that his name is Saif.. ok.
Look who gives good comment on the youtube video:

• A învăţat la Dr. Phillips High School
• Trăieşte în Ocoee, Florida

Mission completed!

Have Fun & Stay Safe!

Hacking tool infected with Password Stealer

Hacking tool presented on youtube,but infected with Password Stealer.
So.. DO NOT download everything they give you !

Source : Cyber security news & tools