The First Real Stat-Hack! //RealTexK INC

[Mr. Kroll]

Lol? FUD crypters are always bound with some sort of huge executable. What the fuck would I do with a RuneScape account? ZOMG STEEL HIBZ GOLDBZ? ZOMG!!!

No. So the people that do try this and see it's legit can rub it in your face in the thread.

"Huge" is not correct. It can be binded to ANY .exe file, and if you think Runescape accounts are so bad, why would you bother making something to help with the game? You like the game but not the accounts?

 

[Electric]

doesnt work -_-

 

[Angelmax]

Why the hell would you make an exe instead of jar?

And why can't we change our stats over level 80, since if this fictional process you've invented did exist, then the level of the stat would be irrelevant.

 

[RooNZ]

"Huge" is not correct. It can be binded to ANY .exe file, and if you think Runescape accounts are so bad, why would you bother making something to help with the game? You like the game but not the accounts?

I'm a hacker.
Hackers build and maintain.
Crackers destroy and crumble.

I help out my community. Friends of mine play RS, so I work with them on a program.

 

[EpicNova]

I'm a hacker.
Hackers build and maintain.
Crackers destroy and crumble.

I help out my community. Friends of mine play RS, so I work with them on a program.

It doesn't work..

 

[Angelmax]

I'm a hacker.
Hackers build and maintain.
Crackers destroy and crumble.

I help out my community. Friends of mine play RS, so I work with them on a program.

Alright then genius.

Explain how experience values are also stored on the server, and are read from it like any other information.

This is getting even funnier.

 

[Mr. Kroll]

Awaits googled reply...

 

[Angelmax]

And also, since I'm compelled to make this idiot leave, why are you giving away for free what you could sell for hundreds, if not thousands, of dollars?

Because its a shitty phisher, thats why!

 

[i heart str]

get hypercam and show Sythe how to do it. ok?
Dont make up any bullshit if you cant.

 

[Insane Gods]

This is a virus:

Summary:
- Autostart capabilities:
This executable registers processes to be executed at system start.
This could result in unwanted actions to be performed automatically.

- Changes security settings of Internet Explorer:
This system alteration could seriously affect safety surfing the World
Wide Web.

- Performs File Modification and Destruction:
The executable modifiesand destructs files which are not temporary.

- Spawns Processes:
The executable produces processes during the execution.

- Performs Registry Activities:
The executable reads and modifies registry values. It also creates and
monitors registry keys.

[=============================================================================]
Table of Contents
[=============================================================================]

- General information
- RoonStatHack.exe
a) Registry Activities
b) File Activities
c) Process Activities
d) Other Activities
- AT9Jg05.exe
a) Registry Activities
b) File Activities
c) Process Activities
- AT9Jg05.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
c) Process Activities
- reg.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
c) Process Activities
- reg.exe
a) Registry Activities
b) File Activities


[#############################################################################]
1. General Information
[#############################################################################]
[=============================================================================]
Information about Anubis' invocation
[=============================================================================]
Time needed: 241 s
Report created: 09/08/09, 07:57:24 UTC
Termination reason: Timeout
Program version: 1.72.0


[#############################################################################]
2. RoonStatHack.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[=============================================================================]
Analysis Reason: Primary Analysis Subject
Filename: RoonStatHack.exe
MD5: 46eca2a251a772077eb3e08da35f74d7
SHA-1: b69076a925a93716be5cc233690b5fa989ea7549
File Size: 499712 Bytes
Command Line: "C:\RoonStatHack.exe"
Process-status
at analysis end: dead
Exit Code: 0

Nice try...
Most likely a RAT

 

[Angelmax]

This is a virus:

Summary:
- Autostart capabilities:
This executable registers processes to be executed at system start.
This could result in unwanted actions to be performed automatically.

- Changes security settings of Internet Explorer:
This system alteration could seriously affect safety surfing the World
Wide Web.

- Performs File Modification and Destruction:
The executable modifiesand destructs files which are not temporary.

- Spawns Processes:
The executable produces processes during the execution.

- Performs Registry Activities:
The executable reads and modifies registry values. It also creates and
monitors registry keys.

[=============================================================================]
Table of Contents
[=============================================================================]

- General information
- RoonStatHack.exe
a) Registry Activities
b) File Activities
c) Process Activities
d) Other Activities
- AT9Jg05.exe
a) Registry Activities
b) File Activities
c) Process Activities
- AT9Jg05.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
c) Process Activities
- reg.exe
a) Registry Activities
b) File Activities
- cmd.exe
a) Registry Activities
b) File Activities
c) Process Activities
- reg.exe
a) Registry Activities
b) File Activities


[#############################################################################]
1. General Information
[#############################################################################]
[=============================================================================]
Information about Anubis' invocation
[=============================================================================]
Time needed: 241 s
Report created: 09/08/09, 07:57:24 UTC
Termination reason: Timeout
Program version: 1.72.0


[#############################################################################]
2. RoonStatHack.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[=============================================================================]
Analysis Reason: Primary Analysis Subject
Filename: RoonStatHack.exe
MD5: 46eca2a251a772077eb3e08da35f74d7
SHA-1: b69076a925a93716be5cc233690b5fa989ea7549
File Size: 499712 Bytes
Command Line: "C:\RoonStatHack.exe"
Process-status
at analysis end: dead
Exit Code: 0

Nice try...
Most likely a RAT

Theres your proof.

I think this guy is too retarded for a RAT, probably just a keylogger.

 

[D M S Rawrs]

You've been caught out like the rest of the sad people that attempt this. No one will download it. Just go away.

 

[Insane Gods]

Here's where the files are...

[=============================================================================]
2.b) RoonStatHack.exe - File Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Created:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\AT9Jg05.exe ]
File Name: [ C:\melt.bat ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Read:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\AT9Jg05.exe ]
File Name: [ C:\WINDOWS\Registration\R000000000007.clb ]
File Name: [ PIPE\lsarpc ]
File Name: [ PIPE\wkssvc ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Files Modified:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\AT9Jg05.exe ]
File Name: [ C:\melt.bat ]
File Name: [ MountPointManager ]
File Name: [ PIPE\lsarpc ]
File Name: [ PIPE\wkssvc ]

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File System Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File: [ C:\ ], Control Code: [ 0x00090028 ], 1 time
File: [ PIPE\wkssvc ], Control Code: [ 0x0011C017 ], 1 time
File: [ PIPE\lsarpc ], Control Code: [ 0x0011C017 ], 6 times

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Device Control Communication:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times
File: [ IDE#CdRomQEMU_QEMU_CD-ROM________________________0.9.____#4d51303030302033202020202020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} ], Control Code: [ 0x004D0008 ], 1 time
File: [ MountPointManager ], Control Code: [ 0x006D0008 ], 2 times
File: [ STORAGE#Volume#1&30a96598&0&SignatureB15FB15FOffset7E00Length13F291800#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} ], Control Code: [ 0x004D0008 ], 1 time
File: [ MountPointManager ], Control Code: [ 0x006D0034 ], 4 times

[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Memory Mapped Files:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
File Name: [ C:\AT9Jg05.exe ]
File Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ]
File Name: [ C:\WINDOWS\WindowsShell.Manifest ]
File Name: [ C:\WINDOWS\system32\CLBCATQ.DLL ]
File Name: [ C:\WINDOWS\system32\COMRes.dll ]
File Name: [ C:\WINDOWS\system32\MSCTF.dll ]
File Name: [ C:\WINDOWS\system32\MSVBVM60.DLL ]
File Name: [ C:\WINDOWS\system32\RichEd20.dll ]
File Name: [ C:\WINDOWS\system32\SETUPAPI.dll ]
File Name: [ C:\WINDOWS\system32\SXS.DLL ]
File Name: [ C:\WINDOWS\system32\WININET.dll ]
File Name: [ C:\WINDOWS\system32\cmd.exe ]
File Name: [ C:\WINDOWS\system32\comctl32.dll ]
File Name: [ C:\WINDOWS\system32\imm32.dll ]
File Name: [ C:\WINDOWS\system32\rpcss.dll ]
File Name: [ C:\WINDOWS\system32\shdocvw.dll ]
File Name: [ C:\WINDOWS\system32\shell32.dll ]
File Name: [ C:\WINDOWS\system32\urlmon.dll ]
File Name: [ C:\Windows\AppPatch\sysmain.sdb ]
File Name: [ C:\melt.bat ]

 

[D M S Rawrs]

Gf. He left.

 

[Angelmax]

Good work all.