Reported Post by MiM3

MiM3 · Oct 28, 2009

MiM3 has reported a post.

Reason:

Keylogged, admitting it.
Click to expand...

Post: Response to: To Anyone Who Downloaded The So Called Rsca Surfpin Pin Gen
Forum: Selling
Assigned Moderators: Chase, R2Pleasent, HeavenLord

Posted by: Redtube
Original Content:

Alright guys, I'm done with your crap & your so called evidences. If I wouldn't have deleted the downloadlinks myself, I would have infected most of you guys, even the self-declared smartest ones.

I came here with a goal and a plan; and I didn't do bad at all in my opinion. As long as I was arround to save the day, nobody was suspicious. I removed the thread myself after a couple of hours, even though I could keep on infecting people. I simply didn't. Feel free to read why.

Breaking news: it was a keylogger. If I didn't tell you guys, you could have only guessed what it was. You would have never been sure 100% that I was here to scam, you just followed your feelings. The evidence you guys included, is utter bullshit.

Swindle said: ↑

Well, we DON'T actually have PROOF that it's something malicious, however we do have EVIDENCE

1) Redtube clearly stated many times that this has been leaked from RSCA, Correct?
Steel Fluff kindly invited me to RSCA, and guess what? There's no sign of a 'pin gen', don't you think that seems a tad suspicious? I believe he said it was leaked from RSCA so it would sound professional, and people would believe that they would never do anything to infect anyone intentionally; when however it was actually Redtubes work.

2) Someone claims there account was hacked and they have now recovered it. I believe them as he supplied his IP. Theres always a chance he got infected by something else, but it just seems a bit too co-incidential.

3) He seems to know what he's doing, somewhat.
Click to expand...

1) It was never leaked from RSCA, but I could have given a twist to that. I could have stated that the thread was removed not long after the release, because they were fixing the so-called "DLL errors".

2) The guy that got scammed, Dr Tim, has included an IP. It's not hard to find someone's IP via MSN. I included my MSN on the thread. He never posted a picture of it. In short: it is no proof, it's just an IP that he could have easily found and posted.

He could have made it all up.
I use a Virtual Private Network to hide my original IP.
I never scammed his account.

--> Dr Tim's proof is worthless.

3) "I seem to know what I'm doing, somewhat."

What I posted in there is common sense, even a five year old could come up with that. Legit programs show up in the Task Manager, while Keyloggers & Remote Administration Tools (RATs) don't.

Dr Tim stated that the Keylogger shows up in the Task Manager, which is actually not true. My Keylogger does run silently.

Alright, now that's been said, let me explain my goal.

My goal was to test my Human Manipulation skills by infecting as much as people possible until I would have been discovered. I thought I could infect at least 10 people, thinking somebody should have noticed what was going on.

The first day I've infected 20 people and still nobody that posted a bad word about the file. I removed the thread because I didn't actually wanted to harm anyone, nor was I after accounts. People post clean virusscans of password protected rar-file. Think guys, a rar-file protected by a password is always clean, no matter what kind of malware you put inside.
The second day, I came online and had 15 PMs of people asking for the download link. Then this thread got created by people that speculated about the file being malicious.
Even the third day, I still recieved PMs & adds on MSN for people asking for the program.

Remember my goal? I infected over 10 people, but it still didn't get discovered.

Now, I infected alot of guys on one of the most suspicious websites of all with a keylogger that gets detected. Sythe has the reputation of knowing what programs not to download.

Goal completed!

What kind of dammage would I be able to do if I simply crypted the Keylogger with my FUD stubs. And before anybody says I don't have FUD stubs, I do. It's not hard to hex-edit detected stubs, split them up in partions and see what partions get detected. I hex-edit the chains of numbers that get detected with other chains of numbers, so in short, the stubs becomes FUD (fully undetected) once again for a couple of months. Scantime/Runtime that is. Even the best antivirus programs don't pick this up.

Special thanks to:

TheNewbie93 for being the only one that showed some respect to this scam.
All Sythe admins for not doing anything about this.

Note to the guys that I've infected: don't panic. I never planned on monitoring anyone. I was just trying out my Human Manipulation skills, which is still the best scam in the world!

Thanks for your time guys and sorry for letting you go through this. I don't want your love, but a bit of respect would be appreciated. If you want some White Hat help, feel free to contact me on how to remove the keylogger, if I would get banned, feel free to add me on MSN. [email protected]

As promised, here is the original post. Don't download the files, it's a keylogger.
---------------------------------------------------

RSCA's official surpin generator™

Introduction

We are pleased to present our very first official release and it's a damn good one: RSCA's official surfpin generator™. We've written the program in C#. This allowed us to make the program generate pins on a much faster rate than possible in any other computer language. Thanks to C#, the file only is 17kB, so even computers that are from the 1988 should be able to handle this!

This is a new concept based on the so-called "3 minute pins" and it still is very basic. We're still busy trying to remove common bugs, but we're pretty proud of it. Please report any bugs you find yourself to help improve the program!

How does the program work?

The program generates unique Surfpin codes just the way Surfpin generates them after someone made a call or sent an SMS. The pins that are created, aren't always working. Here's why: Surfpin hasn't created that code yet or someone has used that pin already in the past. So we can say for a fact that 95% of the pins created won't work to you. The good thing is that there always are some pins that aren't redemeed yet because people are selling them or simply forgot about them. Then there still are the "3 minute pins", there's alot of them going around these days, so it's very likely you get one of those. On an average, 1 out of every 20 generated pins should work!

The program doesn't require any usernames or passwords to run nor does it ask for any account details. No registering needed, no hidden payments.

Advantages

Free

Easy-to-use

Both SMS & Phone support

Unlimmited pin generation

Unique results to every user

Malware free

No installation needed

Lightweight software (only 17kB!)

Undetectable to Jagex & Surfpin since it only uses their pins

No chargebacks by Jagex

Disadvantages

May take a while to get a working pin

Still has some bugs to fix

Program crashes from time to time

Program might ask for DLL files which aren't included yet in the package

Download & how-to

Download the package by clicking here or manually go to the following link if your browser doesn't redirect you.

http://qooy.com/files/HFA4BTZD/RSCA.rar

After the download is completed, extract the files with any unzipper. The password is RSCA. If you don't have an unzipper yet, we strongly advise you to get winrar. You can do so by clicking on it or manually go to the following link if your browser doesn't redirect you.

http://www.win-rar.com/download.html

Once the package has been unzipped, you should have two files. One being the readme-file, the other being the generator. Simply run the software, which will be named "RSCA surfpin generator.exe". Choose between "SMS" or "Phone" and click the "Generate now" button. After a couple of seconds a text file will appear with the results. Open the file and there you have the generated pins.

Now for the last step, manually check if the pins work. Go to RuneScape.com, click the "Start/Extend Subscribtion" button which can be found under "Account Management" and log in to your account.

Important: change your country to United States if this isn't already the case.

Next, click "RuneScape" only. Do not pick "FunOrb" or "RuneScape + FunOrb".

Depending on the choice you made when generating, either pick "Subscribe by SMS" or "Subscribe by Phone". It will ask you for a phone number, but you can enter random numbers aswell. Now you are on the screen where you can enter the generated Surfpins one by one. You won't get blocked for entering wrong pins.

Please bear in mind that on an average only 1 out of 20 pins will be working. Patience is a requirement.

Anti-Virus Reports

We suggest you always scan files that you've downloaded before using them.

Some popular online malware scanners are Jotti, NoVirusThanks and VirusTotal. We've included our scanreports, but feel free to scan it yourself. The links of the virusscanners are included.

Jotti

http://virusscan.jotti.org/

Filename: RSCA.rar
Status:
Scan finished. 0 out of 21 scanners reported malware.
Scan taken on: Mon 26 Oct 2009 13:50:56 (CET)

Additional info
File size: 17849 bytes
Filetype: RAR archive data, v1d, os: Win32
MD5: e190b2aad235ba2b58fd75a0af9f67fc
SHA1: accb5c52a842264adb7938bd2b7ca24f02feaaa4

Scanners
[ArcaVir]
2009-10-25 Found nothing
[G DATA]
2009-10-26 Found nothing
[A-Squared]
2009-10-26 Found nothing
[Ikarus]
2009-10-26 Found nothing
[Avast! antivirus]
2009-10-25 Found nothing
[Kaspersky Anti-Virus]
2009-10-26 Found nothing
[Grisoft AVG Anti-Virus]
2009-10-26 Found nothing
[ESET NOD32]
2009-10-26 Found nothing
[Avira AntiVir]
2009-10-26 Found nothing
[Norman Virus Control]
2009-10-23 Found nothing
[Softwin BitDefender]
2009-10-26 Found nothing
[Panda Antivirus]
2009-10-25 Found nothing
[ClamAV]
2009-10-26 Found nothing
[Quick Heal]
2009-10-26 Found nothing
[CPsecure]
2009-10-26 Found nothing
[Sophos]
2009-10-26 Found nothing
[Dr.Web]
2009-10-26 Found nothing
[VirusBlokAda VBA32]
2009-10-23 Found nothing
[Frisk F-Prot Antivirus]
2009-10-25 Found nothing
[VirusBuster]
2009-10-25 Found nothing
[F-Secure Anti-Virus]
2009-10-26 Found nothing

NoVirusThanks

http://novirusthanks.org/

STATUS: Finished
File Information
Report Generated: 26.10.2009 at 13.52.58 (GMT 1)
Time for scan: 57 seconds
File Name: RSCA.rar
File Size: 17849
MD5 Hash: e190b2aad235ba2b58fd75a0af9f67fc
SHA1 Hash: ACCB5C52A842264ADB7938BD2B7CA24F02FEAAA4
Detection Rate: 0 on 23 (0%)
Status: CLEAN
Antivirus Sig version Engine Version Result
a-squared 24/10/2009 4.5.0.8 -
Avira AntiVir 7.1.6.145 7.6.0.59 -
Avast 091023-0 4.8.1229 -
AVG 270.14.24/2449 8.0.0.0 -
BitDefender 26/10/2009 7.0.0.2555 -
ClamAV 24/10/2009 0.95.1 -
Comodo 2707 3.12.560 -
Dr.Web 26/10/2009 5.0 -
Ewido 26/10/2009 4.0.0.2 -
F-PROT6 20091025 4.5.1.85 -
Ikarus T3 24/10/2009 1001044 -
Kaspersky 26/10/2009 8.0.0.357 -
McAfee 23/10/2009 5.1.0.0 -
NOD32 v3 4543 3.0.677 -
Norman 2009/10/23 5.92.08 -
Panda 20/10/2009 9.5.1.00 -
QuickHeal 26/10/2009 10.0 -
Solo Antivirus 26/10/2009 8.0 -
Sophos 26/10/2009 4.32.0 -
TrendMicro 571(657100) 1.1-1001 -
VBA32 26/10/2009 3.12.0.300 -
VirusBuster 10.112.77 1.4.3 -
ZonerAntivirus 26/10/2009 0.1.0 -

VirusTotal

http://virustotal.com/

File RSCA.rar received on 2009.10.26 12:51:31 (UTC)
Current status: finished
Result: 0/41 (0%)

Antivirus Version Last Update Result
a-squared 4.5.0.41 2009.10.26 -
AhnLab-V3 5.0.0.2 2009.10.23 -
AntiVir 7.9.1.44 2009.10.26 -
Antiy-AVL 2.0.3.7 2009.10.26 -
Authentium 5.1.2.4 2009.10.26 -
Avast 4.8.1351.0 2009.10.25 -
AVG 8.5.0.423 2009.10.26 -
BitDefender 7.2 2009.10.26 -
CAT-QuickHeal 10.00 2009.10.26 -
ClamAV 0.94.1 2009.10.26 -
Comodo 2738 2009.10.26 -
DrWeb 5.0.0.12182 2009.10.26 -
eSafe 7.0.17.0 2009.10.25 -
eTrust-Vet 35.1.7083 2009.10.26 -
F-Prot 4.5.1.85 2009.10.25 -
F-Secure 9.0.15370.0 2009.10.22 -
Fortinet 3.120.0.0 2009.10.26 -
GData 19 2009.10.26 -
Ikarus T3.1.1.72.0 2009.10.26 -
Jiangmin 11.0.800 2009.10.26 -
K7AntiVirus 7.10.879 2009.10.24 -
Kaspersky 7.0.0.125 2009.10.26 -
McAfee 5782 2009.10.25 -
McAfee+Artemis 5782 2009.10.25 -
McAfee-GW-Edition 6.8.5 2009.10.26 -
Microsoft 1.5202 2009.10.26 -
NOD32 4543 2009.10.26 -
Norman 6.03.02 2009.10.23 -
nProtect 2009.1.8.0 2009.10.26 -
Panda 10.0.2.2 2009.10.26 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.26 -
Rising 21.53.04.00 2009.10.26 -
Sophos 4.46.0 2009.10.26 -
Sunbelt 3.2.1858.2 2009.10.25 -
Symantec 1.4.4.12 2009.10.26 -
TheHacker 6.5.0.2.053 2009.10.24 -
TrendMicro 8.950.0.1094 2009.10.26 -
VBA32 3.12.10.11 2009.10.23 -
ViRobot 2009.10.26.2005 2009.10.26 -
VirusBuster 4.6.5.0 2009.10.25 -

Jotti, NoVirusThanks and VirusTotal are known to be the most frequently updated online malware scanners. I suggest you use them for any files you're insecure about. Feel obliged to feel safe by reperforming the scans included in this post, we've included the links.

Questions?

Feel free to post any questions here!

If you need a custom program to be made, please don't hesitate to send me a PM.

Do not redistribute without permission.

Â© Copyright 2009 - RSCA, Impulse Software

Special thanks to Fatmans for debugging.

***This was originaly posted by "Mark [GenoDemoN]", administrator at the RSCA forums, a forum which is invite-only. I decided to leak this for the Sythe community aswell! This is not my work and I didn't edit any links. I did post new scanresults to show it's clean. Feel free to scan for yourself again, that's what you should always do by the way.

The password for the rar-file is RSCA because I know alot of people asked for the password at RSCA forums... Enjoy this program, it worked fine to me.***
Click to expand...

tintrade · Oct 29, 2009

tintrade has also reported this post.

Reason:

Posting keylogger
Click to expand...

HeavenLord · Oct 29, 2009

done, thanks

Log in or Sign up

Reported Post by MiM3

MiM3 Guru

tintrade Forum Addict

HeavenLord ujean

Log in or Sign up

Reported Post by MiM3

Thread Tools

MiM3 Guru

tintrade Forum Addict

HeavenLord ujean

Useful Searches