1. The trade part of Lethal Zone has fully been taken over by FoG (Fortress of Gamers) and this site can no longer be used to make appeals. If you feel that your tag is unjust, please file an appeal over at https://f-o-g.eu.trade instead.

Accepted Scam report: 76561198081457625 (Headhunter)

Discussion in 'Archive' started by аdvicebanana, Aug 14, 2015.

Thread Status:
Not open for further replies.
  1. аdvicebanana

    аdvicebanana Registered
    Partner community

    Joined:
    Aug 13, 2015
    Messages:
    174
    Likes Received:
    14
    Accused:
    | steamname: Headhunter
    | steam3ID: [U:1:121191897]
    | steamID32: STEAM_0:1:60595948
    | steamID64: http://steamcommunity.com/profiles/76561198081457625
    | customURL:
    | steamrep: http://steamrep.com/profiles/76561198081457625

    Target:
    | steamname: аdvicebanana
    | steam3ID: [U:1:23045495]
    | steamID32: STEAM_0:1:11522747
    | steamID64: http://steamcommunity.com/profiles/76561197983311223
    | customURL: http://steamcommunity.com/id/advicebanana
    | steamrep: http://steamrep.com/profiles/76561197983311223

    What happened?
    Told me his needs a fifth play for his team, told me to connect to his Teamspeak server which prompted me to download a malware file. It is not detected by any engine on Virustotal yet, but does employ several anti-debugging techniques.

    Analysis:
    https://www.virustotal.com/en/url/a...f7d621833e6ec0279a85bb4631e509528a2/analysis/
    https://www.virustotal.com/en/file/...e915cda06907e7cbcac75a49c07f5ef4084/analysis/
    https://malwr.com/analysis/YzBiZDk5MGI3ZWY0NGFlYWIwMjhkYWIxNzM5OTlmOTQ/

    Screenshots:
    http://files.f-o-g.eu/ae044a
    http://files.f-o-g.eu/df8gge
     
    #1 аdvicebanana, Aug 14, 2015
    Aug 14, 2015
  2. аdvicebanana

    аdvicebanana Registered
    Partner community

    Joined:
    Aug 13, 2015
    Messages:
    174
    Likes Received:
    14
    IP address of the malicious Teamspeak server: 185.5.250.116
     
    #2 аdvicebanana, Aug 14, 2015
    Aug 14, 2015
  3. Chride2k8

    Chride2k8 Not so custom title

    Joined:
    Apr 10, 2012
    Messages:
    1,370
    Likes Received:
    74
    Than you for the report.
    Can you please upload the screenshots directly to the forums.
     
    #3 Chride2k8, Aug 14, 2015
    Aug 14, 2015
  4. аdvicebanana

    аdvicebanana Registered
    Partner community

    Joined:
    Aug 13, 2015
    Messages:
    174
    Likes Received:
    14
    a valid message
     

    Attached Files:

    #4 аdvicebanana, Aug 14, 2015
    Aug 14, 2015
  5. Chride2k8

    Chride2k8 Not so custom title

    Joined:
    Apr 10, 2012
    Messages:
    1,370
    Likes Received:
    74
    Accepted and marked.
     
    #5 Chride2k8, Aug 14, 2015
    Aug 14, 2015
(You must log in or sign up to post here.)
Thread Status:
Not open for further replies.