Claris

some sort of RAT, that's sad, I was hoping for an interesting binary to look at.

the first thing the binary does is run, try to see if a debugger is attached, and then sleeps for 18 days

sure, but we got some fun malware out of it! it's detected by basically everything under the sun, but it goes to some lengths to try and hide itself, download some interesting payloads from a .ru site.

hey, for once we got some interesting malware

@chytrik I guess I should be thankful all of the altcoin stuff is gone.

@Murch I'm more sad that in general most of the questions being asked are trending toward garbage, but that's something we can't help much. most of them aren't outright spam, just very low quality things that can't really be meaningfully answered.

there's a huge number of people who are turning up having been "advised" to buy bitcoin by a strnager, and of course when they go to "cash out" there's additional fees needed, or some delay.

do we have something better to do with all these people who are getting scammed?

just down the road from my house is a compute farm with several thousand Epyc machines in it, you just can't beat that with any sort of distributed system. they're having issues with interconnect even using bonded 40Gbit direct copper lines. the idea that you could do anything in a decentralized system like that just doesn't match up with reality in the least.

@Aizen compute, in general, is so cheap at this point that attempting to do anything like that isn't meaningfully helpful for any purpose. Threadripper and Ryzen cores absolutely tear through any workloads, and FPGA offloading is becoming cheaper and cheaper. there's not a whole lot I can't do just with the hardware I have sitting around, so larger projects or companies are never going to even consider something like that.

@Aizen I'm not mistaken. the concept of sharing compute power with a block chain is just not meaningfully useful. you can't really do anything with blinded data, and the only way of having any idea of if someone actually got the right result is to do it multiple times and have a trust based system around that. it's hard to make anything useful with a construction like that.

@chytrik that's a pretty common thing. one of the top ranked results in google for "qr code generator" was doing that at one point, just substituting bitcoin addresses occasionally and stealing funds from idiots who decided to make qr codes of their private keys.

@Aizen that's just silly. you've missed the core concept here, in a block chain you have massive amounts of compute doing all the same thing. no matter how many nodes you add, computation time for validating the chain remains the absolute same.

there's someone asking questions about rpcbind, and they just happily announced that their security solution for it being in plaintext on a world accessible port is to use a "secret" port. yes they're handling other people's money, and this was the best solution they could come up with.

I find this stack exchange to be utterly depressing sometimes.

@chytrik securelist.com/analysis-of-malware-from-the-mtgox-leak-archive/…

which lends to perhaps this sort of thing is all that's needed. which is why I posted a blunt warning about it, added the URLs to safebrowsing so they can't be loaded in a browser, and edited the URL out of the posts. it's not worth the risk that someone will be caught out by it.

yes. a hacker literally just announced they hacked mt gox. you downloaded the files they released and ran the executables they provided!? but yes, it worked and people did post afterwards saying they lost all their Bitcoin due to it.

you wouldn't believe it, but this has worked before. when Mt Gox went down someone appeared on some forums and dumped a huge amount of personal details from the service. it was a giant zipfile which contained all the wallet information and accounts of every single user. inside was something named "MtGoxBackOffice.exe", and people ran that and lost all of their money.

maybe this works every time. maybe it's just someone testing the waters.

it's up for debate if this is effective or not. maybe they just don't need to put in any more effort.

it's created using AutoIt, which is one of these "this isn't a hacking tool nudge nudge it has legitimate uses" sort of things. it's about as close to point and click malware as you can get, from the screenshots on their website you just give it a name, choose an icon, add some behavior of your own maliciousness and off you go.

@chytrik perhaps. it's often very difficult to tell what's going on in the minds of the people producing this sort of thing. here we have a really low effort bit of malware as a whole, I started doing actual analysis of the binary but it's not really worth the time spent.

the ultimate indicator to me was that one of the addresses "in the wallet" is one I know of already.

lots of malware infections are based around getting people to do things in haste without thinking.

"I could live like a king forever if I just download and run this first"

I think the reason it's such a large amount is that it's supposed to cause people to panic.

they could have tried harder, but it's always nice to have examples like this to link to.

but yeah.

hybrid-analysis will actually go and run the real malware in a virtual machine, take screenshots of it executing, and record all of the things it attempts to probe or communicate with. it's very handy.

@chytrik like a lot of tools you have to be careful taking them as absolutes. in general it should be an indicator of maliciousness, NEVER an indication that something is safe to run. I updated the answer with another link to hybrid-analysis which is a little better, but it'll take an hour of so for them to process it.

it talks to a command and control server in russia.

@chytrik I took the time to download it for you and run it.

I think that's the first time I've caused someone to delete all of their questions by pointing out that they should probably learn basic programming skills before creating an altcoin.

@chytrik It’s just self promoting as far as I can tell. The whole thing is just too obscure for anybody else to have noticed, let alone written multi paragraph answers for. I’d never even heard of the scammy looking thing until now.

@cleanmarker It's idiotic that for some reason people have been told to pay attention to a technical display of information and somehow make sense of it.

The "coolwallet" device is best unboxed and placed in the nearest trash receptacle, just skip the bit in the middle where you attempt to use it.

@RaghavSood You should go read the spec on the chip for that.

Should a Bitcoin focused site allow content which is not Bitcoin, is the question. We can argue very well that the non-bitcoin content is effectively garbage to the people looking at it, and has no applicability in the future. StackExchange shouldn't just be a help zone for people making random, broken altcoins. To be valuable it needs to be about Bitcoin.

@chytrik This is nothing about politics.

Half of the revue queue is people trying to make their own altcoin, which is no fun to answer.

The amount of garbage, useless to anybody questions about altcoins is unreal.

@darkknight This stackexchange realy needs to just ban altcoins.

it seems to be a mix of phishing, and just nonsense all caps and broken english questions about using blockchain.infos wallet.

really difficult to answer any of the questions now

@MaxVernon There's something like 3GB of spam transactions from over a year ago, do the deserve to be confirmed?

the only thing that matters is how many people are paying a fee higher than you.

my point was that it's totally meaningless to shout out numbers like that.