SRL Archive - Bot Information and Spottings

Well it wasn't infected until, i was going to update the bot today. I obfuscated the bot, to check if anything new was added since i was taking a vacation from rarebot.

Since i check, i see a whole new class (Which should not be there) Possibly could be a storer to store all the accounts saved, then in scripts there is another one for possibly pins.

Asked beta & delta what it was, started to tell me something else. And at the end they told me it was just for the update, i'm not retarded to believe that.

After that i decided, to quit developing for rarebot.

I'm nothing apart of rarebot, and it's infected.

* If anybody in HF are developing a client, and need help don't hesitate to ask.

* I've always taken Rarebot, seriously never infected it.
- Aka sperminator

/ Kronor, prev rarebot dev.

Link
http://hackforums.net/showthread.php?tid=2280883

What do you think?

=/ I personally wouldnt use rarebot either way. But thats a real bummer man. thanks for the info!

I'm not really surprised at all.

And now, i'm not using the rarebot sw script. Thank you for the heads up.

I and many other users posted quite a bit on other threads discussing about the other bots that have been introduced recently and we stated clearly not to trust these other bots yet.

Ah unfortunate for those who used rarebot.

This does not prove anything. Where's that class file.

just dont use rarebot/epicbot and you should be fine, really it is this simple

From: wister1
just dont use rarebot/epicbot and you should be fine, really it is this simple

Yup, and why would we move to these Website anyway… We are safe and have so much fun here!

I appreciate what you have done its always best to stay away from hacking and stuff you sir rock !

Rarebot Admin Statement: http://www.rarebot.com/community/index.php?topic=2788.0

Now it feels good that i havent used rarebot during the last 2 weeks, I think laakerules made a thread about keylogging stuff in this bot

comon guys, why are a bunch of u using a sketchy bot when u have simba! Narcles fast fight runs 6hr everytime what more could u ask for!

didnt i say i told you so to all those rarebotters about a month ago, never lick the ass of a closed source. if the want your shit, they shall take it, this is the internet not pre-school… l2 protect your shit. r

RAREBOT SMELLED OF VIRUS AS SOON AS I DOWNLOADED. I DON'T KNOW WHY "ANYBODY" PROCEEDED TO INSTALL IT, A REFLECTION BOT SHOULD BE PACKIN A JAR AMIRITE?

A CLOSED SOURCE BOT WITH AN EXE. ALARM BELLS SHOULDA RANG.

From: Neros
didnt i say i told you so to all those rarebotters about a month ago, never lick the ass of a closed source. if the want your shit, they shall take it, this is the internet not pre-school… l2 protect your shit. r

RAREBOT SMELLED OF VIRUS AS SOON AS I DOWNLOADED. I DON'T KNOW WHY "ANYBODY" PROCEEDED TO INSTALL IT, A REFLECTION BOT SHOULD BE PACKIN A JAR AMIRITE?

A CLOSED SOURCE BOT WITH AN EXE. ALARM BELLS SHOULDA RANG.

I agree about it being closed source, a good rule of thumb about java keyloggers and .exe files is….


If program A is a keylogger/trojan horse/ or virus
and program B is say a old powerbot open source and bind them you get…
program C. your antivirus will only scan it as program C not as A or B. That is the simplest way of putting it for people that aren't into much of the hacking scene for making things FUD(Fully UnDetectable). I don't wanna get into a huge lecture about FUD and VR string detection but I rather educate about possible threats towards you than stand around and see topics about being hacked because of epicbot or rarebot.

TL;DR
Program A + Program B = Program C
virus scanners only scan Program C to see if its a threat.

From: weeps
Well it wasn't infected until, i was going to update the bot today. I obfuscated the bot, to check if anything new was added since i was taking a vacation from rarebot.

Since i check, i see a whole new class (Which should not be there) Possibly could be a storer to store all the accounts saved, then in scripts there is another one for possibly pins.

Asked beta & delta what it was, started to tell me something else. And at the end they told me it was just for the update, i'm not retarded to believe that.

After that i decided, to quit developing for rarebot.

I'm nothing apart of rarebot, and it's infected.

* If anybody in HF are developing a client, and need help don't hesitate to ask.

* I've always taken Rarebot, seriously never infected it.
- Aka sperminator

/ Kronor, prev rarebot dev.

Link
http://hackforums.net/showthread.php?tid=2280883

What do you think?

lol at how they get called skids, i never knew Gh0st was a script kiddie. well he was. but wasn't that in like 2k3? LOL. everyone, and i mean everyone at rarebot knew what they were doing, your like let me guess. public not-so-related-relations?

once i get the solid black & white proof of it being Gh0st I'll upload it. RB needs to hides it'z internetz.

From: weeps
I obfuscated the bot, to check if anything new was added

From: n3ss3s

think he meant de-obbed.
but even then from his description all he did was unzip it.

yeah. pics or gtfo mate. its a virus, I KNOW 2 OF THE DEVS WORKING ON IT YOU MORON.

Gh0st, and more recently came to light paris is working on it, no doubt a stolen update from timer.

there's no trace of alpha, gamma or delta as programmers. so they are covering up something. im sorry but uhh fuck everyone who think lying. you'll understand after your acc gets hacked lol Simba Or Suck It Bitch.

http://www.sythe.org/showthread.php?t=1085097

bro. it's these 3 again work it out.

phase 1) take a powerbot source.

Phase 2)update it.

Phase 3) lie to the public and release while powerbot "can't" be updated… but somehow a group of "script kiddies" manage to update an old source that powerbot themself are working on?? (uhh yeah fishy?)

Phase 4) opensource java applet turned .exe binded with keylogger starts to spread the world of rs botting communities.

Phase 5) hack everyone like they did last year (did u forget this?)

Phase 6) get a kid to go around lying to everyone saying a developer fucked off on holiday (with stolen rsgpz turned into $$$ no doubt)

Phase 7) Erase all traces of rarebot and release the same client without the keylogger at powerbot within a month

now your thinking…. uhh why would they do that?

well uhhh why do they goldfarm anyway?

FOR MONEY.

trust me. i KNOW this is what's going doing. in a month. refer to this. and i would like a big thank you.

SOME KEYLOGGERS CANNOT BE DETECTED. CAREER CRIMINALS DO AND WILL FIND METHODS TO BEAT ALL ANTIVIRUS. TAKE THIS AS A WARNING. THE METHODS THESE GUYS GO TO TO EVEN MAKE AN INJECTION CLIENT IS AGAINST THE LAW. WHY WOULD THEY THINK TWICE ABOUT STEALING PIXELS FROM A 14 YEAR OLD?

From: n3ss3s

exactly what I was thinking when I read that post. sounds like bs to me, someone who was developing the bot would surely understand obfuscation

12 of my accounts were hackled and I used rarebot. 4b gone don't fucking use this bullshit so fucking mad i'm going for a high brb

From: HT BaaFly
12 of my accounts were hackled and I used rarebot. 4b gone don't fucking use this bullshit so fucking mad i'm going for a high brb

Stop vising gay porn sites.

If there is a rarebot "virus", and if you do have it, can it detect PIN's?

From: sahibjs
If there is a rarebot "virus", and if you do have it, can it detect PIN's?

I assume you're asking if it will steal your pin. If you typed your pin into it then yes, it definitely can.

If there is a real virus, your pin could also be screen recorded.

From: Neros
yeah. pics or gtfo mate. its a virus, I KNOW 2 OF THE DEVS WORKING ON IT YOU MORON.

Gh0st, and more recently came to light paris is working on it, no doubt a stolen update from timer.

there's no trace of alpha, gamma or delta as programmers. so they are covering up something. im sorry but uhh fuck everyone who think lying. you'll understand after your acc gets hacked lol Simba Or Suck It Bitch.

http://www.sythe.org/showthread.php?t=1085097

bro. it's these 3 again work it out.

phase 1) take a powerbot source.

Phase 2)update it.

Phase 3) lie to the public and release while powerbot "can't" be updated… but somehow a group of "script kiddies" manage to update an old source that powerbot themself are working on?? (uhh yeah fishy?)

Phase 4) opensource java applet turned .exe binded with keylogger starts to spread the world of rs botting communities.

Phase 5) hack everyone like they did last year (did u forget this?)

Phase 6) get a kid to go around lying to everyone saying a developer fucked off on holiday (with stolen rsgpz turned into $$$ no doubt)

Phase 7) Erase all traces of rarebot and release the same client without the keylogger at powerbot within a month

now your thinking…. uhh why would they do that?

well uhhh why do they goldfarm anyway?

FOR MONEY.

trust me. i KNOW this is what's going doing. in a month. refer to this. and i would like a big thank you.

SOME KEYLOGGERS CANNOT BE DETECTED. CAREER CRIMINALS DO AND WILL FIND METHODS TO BEAT ALL ANTIVIRUS. TAKE THIS AS A WARNING. THE METHODS THESE GUYS GO TO TO EVEN MAKE AN INJECTION CLIENT IS AGAINST THE LAW. WHY WOULD THEY THINK TWICE ABOUT STEALING PIXELS FROM A 14 YEAR OLD?

im down with this

What Should i do then I have it installed :s

I've scanned whole pc with malwarebytes and nothing what shud i do?

From: Im auz
What Should i do then I have it installed :s

I've scanned whole pc with malwarebytes and nothing what shud i do?

There is nothing wrong with the bot. All these people are crying wolf.

From: weequ
I'm not really surprised at all.

This.

Any form of connection with HF(hackforums) always leads to trouble, I'm really not surprised at all either, scumbag children these days.

[QUOTE='Toxin;959396]This.

Any form of connection with HF(hackforums) always leads to trouble, I'm really not surprised at all either, scumbag children these days.
What you mean scumbag children how they run to rarebot as its less work than simba?

From: Mat
What you mean scumbag children how they run to rarebot as its less work than simba?

Nah, I mean scumbag children metaphorically. That's what I feel about those developer(s) there. I read the entire thread on HF and they're actually so blind. That guy is doing them a favor by warning all of them and their greed and self-centred'ness is shameful if you ask me…

What other reason other than for malicious reasons would you not want to show source to new classes built for the bot? I mean duhhh it's obvious.

V1.0.0.12 checks resulted actually clean, modified/updated contra hook to check in run time.

In java nothing is called neither executed which does hack you.
And if it does, its not stored nor sended (or sends after 10 minutes…..)

Nothing in runtime is exceted, aka creating an new process.
Nothing is sended trough HTTP, HTTPS nor direct IP nor php script.

Still need to do deeper checking obv, but these are my results so far.

Yeah its a rat

Why is everyone saying stuff like 'its a virus', 'its a rat', 'its a keylogger' with no evidence what so ever.

You can say that you don't trust it, sure, but you can't just make up stuff because you don't trust it.

As for myself, I tried it on a virtual machine with a trow away account, fished crayfish for 6 hours. Nothing happened, no password change, nothing suspisious and no ban.

Wouldn't use my main or any account on it that I value over 1$ though.

too be safe just use powerbot and simba

Funny thing is, every fanboy of color bots claim it's a virus. How can he prove he's that guy "Kronor" when he's not even that fucking guy. Long live injection bots. RIP Color bots losing fame.

From: mx1000
V1.0.0.12 checks resulted actually clean, modified/updated contra hook to check in run time.

In java nothing is called neither executed which does hack you.
And if it does, its not stored nor sended (or sends after 10 minutes…..)

Nothing in runtime is exceted, aka creating an new process.
Nothing is sended trough HTTP, HTTPS nor direct IP nor php script.

Still need to do deeper checking obv, but these are my results so far.

Those saying its an trap/virus;

Its indeed very fishy that forums are down while bot still navigates to SVN googlecode after trying to acces rarebot site for host redirection.

On the other hand;
I didn't check recently but the last stated version, V1.0.0.12, LOOKS clean with accesing URLs, URLConnection and Runtime.

For the living farts think I used an decompiler to check all classes fuck you, I hooked into java and added hook when it executes runtime, processbuilder, to hook my hooker in the process.

From: Neros

SOME KEYLOGGERS CANNOT BE DETECTED. CAREER CRIMINALS DO AND WILL FIND METHODS TO BEAT ALL ANTIVIRUS. TAKE THIS AS A WARNING. THE METHODS THESE GUYS GO TO TO EVEN MAKE AN INJECTION CLIENT IS AGAINST THE LAW. WHY WOULD THEY THINK TWICE ABOUT STEALING PIXELS FROM A 14 YEAR OLD?

It is much more likely that they encrypt their virus with a stub. There is really no reason for your PSA. What you are saying is like telling everyone that you need oxygen to survive.

It also violated PB's gpl

Awkward… I'm using Rarebot right now?

Used rarebot on my "precious" main acc for 20 hours.Hmm…