Archived 76561197998520140 (Fat German Pigletzzz)

Discussion in 'Scam Reports (archive)' started by ring, Apr 7, 2015.

Thread Status:
Not open for further replies.
  1. ring

    ring Member

    Joined:
    Apr 7, 2015
    Messages:
    4
    Likes Received:
    0
    Steam:
    Steam SteamRep
    Accused of Hijacking

    Code:
    | steamname: Fat German Pigletzzz
|  steam3ID: [U:1:38254412]
| steamID32: STEAM_0:0:19127206
| steamID64: http://steamcommunity.com/profiles/76561197998520140
| customURL: 
|  steamrep: http://steamrep.com/profiles/76561197998520140
    This is not a bot.
    He added me, then this chat went on:
    http://files.f-o-g.eu/g88bfa

    Of course i first checked if he is legit by checking steamrep and his backpack.tf profile, he is banned from backpack.tf for being an alt of a scammer.

    I downloaded the executable file from the shady, unofficial "mumble" site and uploaded it to virustotal.
    I was surprised it is signed and not detected by any Antivirus yet.

    https://www.virustotal.com/en/file/...733bdce767f9b7e99805e5e5/analysis/1428435932/

    If you need any more information tell me.
     
    ring, Apr 7, 2015
    #1
  2. ring

    ring Member

    Joined:
    Apr 7, 2015
    Messages:
    4
    Likes Received:
    0
    Steam:
    Steam SteamRep
    Alright, i analyzed the executable. It is indeed mumble, but with a nasty surprise appended, a malicious Microsoft Javascript file:
    fishy.png
     
    ring, Apr 7, 2015
    #2
  3. advicebanana

    advicebanana Member

    Joined:
    Feb 4, 2015
    Messages:
    861
    Likes Received:
    23
    Steam:
    Steam SteamRep
    I have seen this kind of files numerous times. The Javascript downloads an encrypted archive that contains a NetSupport installation which is then installed and gives the attacker remote access to your computer, so that he can do and see anything.
     
    advicebanana, Apr 7, 2015
    #3
  4. ring

    ring Member

    Joined:
    Apr 7, 2015
    Messages:
    4
    Likes Received:
    0
    Steam:
    Steam SteamRep
    ring, Apr 7, 2015
    #4
  5. Tio José das Vacas

    Tio José das Vacas Senior Trade Moderator

    Joined:
    Jun 29, 2014
    Messages:
    3,686
    Likes Received:
    370
    Steam:
    Steam SteamRep
    Hidden Content:
    **Hidden Content: Content of this hidden block can only be seen by members of (usergroups: Legacy Trade Moderator).**
     
    Tio José das Vacas, Apr 8, 2015
    #5
  6. Tio José das Vacas

    Tio José das Vacas Senior Trade Moderator

    Joined:
    Jun 29, 2014
    Messages:
    3,686
    Likes Received:
    370
    Steam:
    Steam SteamRep
    Last edited by a moderator: Oct 15, 2016
    Tio José das Vacas, Apr 8, 2015
    #6
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...