[Ratting] - Tarnial

[_RSPSShop_]

Profile link:
- http://www.sythe.org/members/416607-tarnial.html

Explanation:
- User added me on first/second day I joined here and he was requesting proofs that I own items and stuff, he was a good guy. But today about 1-2 weeks later he sent me "RLpk sold.exe" (AKA picture), to show that he is out of business.
After that he tried to convince me that file converted to .exe because he was on mac.. Cmon.. rly?
- Short: He tried to infect me with "Remote administrator tool"

Skype profile ID & conversation pictures:
- http://scr.hu/1tgx/6tgr8 (Image showing that user owns that skype)
- http://scr.hu/1tgx/ioyrv (Image showing conversation/skype username)
- http://scr.hu/1tgx/awig3 ("Picture information")

Now again, I tough how can I still prove that's virus because it's fudded, so I scanned it online using anubis.iseclab.org and here are results:
- https://anubis.iseclab.org/?action=result&task_id=12af4c6f92095f214b9ca9218bc29154e

If you check results and look traffic.pcap file (you can download it and check) there is NO-IP DNS:
- http://scr.hu/1tgx/j0tx5

I checked that DNS IP and got this:
- http://scr.hu/1tgx/4xlfh

And if you look at Tarnial IP-s on sythe there is IP ending with .167 :
- http://scr.hu/1tgx/46xaq
- And why the f* are there so many accounts anyway.

 

[-Ryan]

Banned, Thanks.