SRL Archive - News and General

well I don't like to accuse anyone for stealing my accounts but I feel this download is associated to the loss of my accounts.
http://uppit.com/51uaamkps49u/BoomScapeClient.exe
I don't know if someone would know how to unpack this file and test if it has a virus within it so then I can find out who stole my gear. Until I work all of this out I am no longer testing/using runescape.

many thanks,
Sgt Soul

It's logical that the two could be connected, but we do need proof before we blame anyone for anything. Was that file detected as a virus by your anti-virus software?

Where were you referred to that from?

And what is it?

From: kitchenrange
Where were you referred to that from?

And what is it?

Told me on MSI that it's a private server from Dynamite.

Why oh why would you ever use real username and same password on a private server??

Any screen shots of ip?

From: Hobbit
Why oh why would you ever use real username and same password on a private server??

Any screen shots of ip?

exactly what i was thinking…

From: Coh3n
Told me on MSI that it's a private server from Dynamite.

If it's anything Dynamite sent out in the past day or two it's more than likely infected because he had keylogger on his computer, so someone was sending out stuff over MSN with his account.

From: Sgt Soul
well I don't like to accuse anyone for stealing my accounts but I feel this download is associated to the loss of my accounts.
censored in case removed
I don't know if someone would know how to unpack this file and test if it has a virus within it so then I can find out who stole my gear. Until I work all of this out I am no longer testing/using runescape.

many thanks,
Sgt Soul

Will be investigating this if I find time today. If not you might have to bother me about it since I'll probably forget by tomorrow.

Edit:
Seriously? 53 MB? This will be fun waiting for this thing to download.

From: Hobbit
Why oh why would you ever use real username and same password on a private server??

Any screen shots of ip?

Could be keylogger.

Yes it could be, my post wasn't intended to imply it was the private server. But as general on sense why would you? People fall to temptation, why would you add your username and password to a database on Someones computer :p

Someone could install this on a VM and trace the connection, to see if this is Dynamite doing this or if he really got hacked.

Basically a FUD. Nothing too special, everything is encrypted like all FUDs. Needless to say, that is the culprit. From a quick look using my VM, it loads a long encrypted string that it decrypts and writes to your computer. I didn't do any in depth analysis but you might want to check for svg64.exe. Check HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run for any abnormal keys.

From: lordsaturn
Someone could install this on a VM and trace the connection, to see if this is Dynamite doing this or if he really got hacked.

I could as I'm running Linux atm, just point me in the right direction for network traffic please?

I could use wireshark at a push :)

You never open a private server client with the .exe extension, they should always be jarred. It's a general safety rule in the private server community.

From: Echo_
You never open a private server client with the .exe extension, they should always be jarred. It's a general safety rule in the private server community.

Implying you couldn't make the .jar download and run an .exe file. Just because it's a different extension or program to run it doesn't make it any safer.

I didn't use my runescape username and password when opening it (due to the fact that it actually wouldn't open). I believe that the .exe file just opened something in the background. I just think its a bit suss that the day I get jacked of all my stuff is the same day that dynamite comes back on to msn (as himself)? and no the file wasn't detected as a virus using AVG but the file also didn't open a client so I don't know :/

is it possible to check a list of which ip addresses have used my account?

Not unless you got a screenie of the last ip logged in screen. Do you have a dated msn log or pm, where he sent you the link? Honestly right now there isn't much pointing at him at all. Anyone could upload something and call it boomscape.exe

Well, I was talking to him just last night (this morning, I guess? after midnight iirc), and he was talking to me about rsps stuff. He asked me to convert some very simple batch stuff to bash. You can see that here (http://paste.villavu.com/show/466/).

So if he didn't even know how to convert that simple batch stuff, I don't think he'd know how to make a keylogger and what not.

So I don't know if it was dynamite himself, but I never believe "I was hacked, someone keylogged me, and then stole rs info." So iono. Just thought that info may help.

He definitely seemed like himself when I was talking to him by the way. But, he didn't mention anything about being hacked or anything (which may mean he wasn't hacked? dunno).

And, he posted the stuff on paste.villavu.com. Someone who keylogged him wouldn't go to paste.villavu.com I'm sure. :p

EDIT:

Uhh.. Just saw 467 (I knew nothing about this until now). So I dunno, it may have been him. :/ Sadly.

Actually, I dunno. I'm confus.

From: i luffs yeww
Just saw 467 (I knew nothing about this until now). So I dunno, it may have been him.

You mean "cmd=${1:-"pwd"}"? pwd prints the working directory. Probably doesn't have much to do with passwords.

Lol. I'm thinking now, sorry. <3

going to upload 6 pages of chat history so you guys can decide whether it is him or not :)

Sorry didn't mean to double post I meant to choose edit :/

Did he email it to you after all? can check IP it was sent from there to make sure it was him.

nope :/ so I just downloaded the .exe link and tried it because I was bored. when I clicked it my mouse showed a loading symbol but then nothing popped up :S

From: Harry
Implying you couldn't make the .jar download and run an .exe file. Just because it's a different extension or program to run it doesn't make it any safer.

But an .exe extension for a program that is supposed to run completely off of java is a little suspicious, no?

Also, that bash script was mine. It has nothing weird in it, it just starts his RSPS.

From: i luffs yeww
Well, I was talking to him just last night (this morning, I guess? after midnight iirc), and he was talking to me about rsps stuff. He asked me to convert some very simple batch stuff to bash. You can see that here (http://paste.villavu.com/show/466/).

So if he didn't even know how to convert that simple batch stuff, I don't think he'd know how to make a keylogger and what not.

So I don't know if it was dynamite himself, but I never believe "I was hacked, someone keylogged me, and then stole rs info." So iono. Just thought that info may help.

He definitely seemed like himself when I was talking to him by the way. But, he didn't mention anything about being hacked or anything (which may mean he wasn't hacked? dunno).

And, he posted the stuff on paste.villavu.com. Someone who keylogged him wouldn't go to paste.villavu.com I'm sure. :p

EDIT:

Uhh.. Just saw 467 (I knew nothing about this until now). So I dunno, it may have been him. :/ Sadly.

Actually, I dunno. I'm confus.

Nowadays, you dont need to know anything about coding to generate a trojan or keylogger. All you need to know is how to setup a ftp or many cases just an email. Black market on coding sites ftw….or ftl in this case lol

Sgt: Are you Beau from HackForums.net?

nope, never been on that website :S sgt soul is always my username for all websites :)