Hammereditor attacks RTB servers - The discussion thread

[Cuddles le Bear]

Wow, nice.
Hammereditor removed the download link.
If anyone still has it, can they put it up so someone can brown townyze it to see what it is exactly?

I saw that coming from a MILE.
That pretty much closes this case. Hammer is guilty.
If the file would bring ANY suspicion to him, of course he'd take it down so no one can see it. Soon after you posted about the file, Hammer takes it down to keep him on "innocent" levels.
That just makes you the #1 Suspect.
Congratulations, Hammer! You're officially a Grade-A moron who attacked RTB and then tried to pawn it off on someone else.

[Ad Bot]

[Blockzillahead]

The virus file is not an actual virus, although it is broken and doesn't execute propertly. It does something with registry keys though.

Code: [Select]

E x t e r n a l A d a p t e r   S o f t w a r e \ M i c r o s o f t \ W i n d o w s   N T \ C u r r e n t V e r s i o n \ U n a t t e n d S e t t i n g s   I n t e r n a l I s B r i d g e     I n t e r n a l A d a p t e r   E n a b l e I C S   2 5 5 . 2 5 5 . 2 5 5 . 0       1 9 2 . 1 6 8 . 1 3 7 . 1       I n t e r f a c e s     E n a b l e D H C P     I P A d d r e s s   S u b n e t M a s k     S Y S T E M \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ T c p i p \ P a r a m e t e r s     I c s U p g r a d e E v e n t N a m e

Code: [Select]

RegQueryValueExW  ‰RegOpenKeyExW XRegCloseKey ¦RegSetValueExW  ADVAPI32.dll  jGetLastError  Ê CreateEventW  Ž CloseHandle KERNEL32.dll  2swprintf_s
It is not picked up by any anti-virus. Running it will do nothing and it will just close itself, no infections are present, no nothing.
HiJackThis brings up nothing either, MsConfig start up programs are normal, went through registry keys and nothing is out of place. Malwarebytes scan brings up nothing. netstat -o on command prompt doesn't bring up any unusual IPs.

Doesn't look like a RAT and has nothing to do with what happened to Ham. Sounds to me like he just got a random .exe file off his computer, named it to something suspicious and acted like it's the problem.

I would post it but I can get banned if it does end up being an actual RAT/keylogger/DDoS or w/e.

[joe411]

Also, you should

Scan the rest of your computer

[hammereditor³]

Wow, nice.
Hammereditor removed the download link.
If anyone still has it, can they put it up so someone can brown townyze it to see what it is exactly?

I removed the link because too many people downloaded the file, and I don't want to be banned for distributing shady executable files.

[hammereditor³]

I removed the link because too many people downloaded the file, and I don't want to be banned for distributing shady executable files.

I saw that coming from a MILE.
That pretty much closes this case. Hammer is guilty.
If the file would bring ANY suspicion to him, of course he'd take it down so no one can see it. Soon after you posted about the file, Hammer takes it down to keep him on "innocent" levels.
That just makes you the #1 Suspect.
Congratulations, Hammer! You're officially a Grade-A moron who attacked RTB and then tried to pawn it off on someone else.

[Epicduke]

that page stretch

[hammereditor³]

Sounds to me like he just got a random .exe file off his computer, named it to something suspicious and acted like it's the problem.

I would post it but I can get banned if it does end up being an actual RAT/keylogger/DDoS or w/e.

Well, I'm glad that this file is not malware.
The only suspect left is Pacnet, because I know I didn't do the crime.

[Char]

"deny" is an accusation. You are not accusing your self of anything.

We are the ones accusing him of something. And besides,

1:  to declare untrue <deny an allegation>

2:  to refuse to admit or acknowledge :  disavow <deny responsibility>

3
a:  to give a negative answer to <denying the petitioners>
b:  to refuse to grant <deny a request>
c:  to restrain (oneself) from gratification of desires

4: [archaic]  decline

5:  to refuse to accept the existence, truth, or validity of

you don't have to be admitting the truth of something in order to deny it.
What you're denying may be true, though.

Wow, nice.
Hammereditor removed the download link.
If anyone still has it, can they put it up so someone can brown townyze it to see what it is exactly?

Wow, that's a horrible move. Now he just looks even more like the attacker.

I removed the link because too many people downloaded the file, and I don't want to be banned for distributing shady executable files.

Liar. It was uploaded last July, not recently at all.
Unless you mean to say you knowingly uploaded potential malware to your site and kept it up for over a year.

[Pandan]

Well, I'm glad that this file is not malware.
The only suspect left is Pacnet, because I know I didn't do the crime.

*Claps*

You're loving learning now!

[Cuddles le Bear]

I removed the link because too many people downloaded the file, and I don't want to be banned for distributing shady executable files.

We know it's shady, so we're trying to figure this out. By taking it down, you practically revealed yourself in my eyes beyond reasonable doubt guilty of this.
You're also constantly dodging my posts.

No response? Did you hit post too early or did you just mix up the order?
If it's shady, you shouldn't have put it on your website. When someone finds it, it's too late to take it down otherwise you'll pretty much be proven.

Well, I'm glad that this file is not malware.
The only suspect left is Pacnet, because I know I didn't do the crime.

Except we do know you did it. You are the suspect, same with Pacnet except you're a bigger suspect. You cannot say you're not a suspect in this case.

[Night Fox]

you give it to me
now

do you think you have any authority? that is specifically the kind of attitude that will not get you what you want

If he didn't do it, why is HE including HIMSELF on the list?

this is really scraping the barrel

[Pandan]

Liar. It was uploaded last July, not recently at all.
Unless you mean to say you knowingly uploaded potential malware to your site and kept it up for over a year.

Nice catch.

Pheonixwright.gif

[hammereditor³]

Liar. It was uploaded last July, not recently at all.
Unless you mean to say you knowingly uploaded potential malware to your site and kept it up for over a year.

The file was modified 1 year ago, but I uploaded it today.

[Blockzillahead]

The file was modified 1 year ago, but I uploaded it today.

Can you talk to Pacnet already? This is going nowhere real quick.

[hammereditor³]

Can you talk to Pacnet already? This is going nowhere real quick.

I already talked to Pacnet long ago, and he is denying all of this and accusing me.
Just like you would expect.