I have it installedQuote:
you need net framework 3.5
Rappelz Bot+MultiClient *BETA RELEASE 20th MAY*
05/23/2009 01:04
meilleur#46
05/23/2009 01:20
KentuckyFC#47
so you must add doom in msn the e-mail is on the first page
05/23/2009 01:29
meilleur#48
he say that maybe because the bot was made for her pc for that why the bot dont work on mine
05/23/2009 03:28
meilleur#49
this is not a bot, this program steal password.
05/23/2009 04:01
Cytherea#50
gz for you.
how u know its a password stealer?
how u know its a password stealer?
05/23/2009 09:43
meilleur#51
link for bot removed... i think its not good idea to post it
05/23/2009 10:29
Gertos#52
Really , I am not surpriced to read this.Quote:
Why ? Because:
1. 80% of all files that have been posted here latly are something like this.
2. We haven't seen anythink that the bot works.
( no concept, no tecnical details )
3. The file is crypted. So you can't use your anti virus programms with it.
The Code example in the first post looks not like C# for me.
More like some kind of Autoit script.
On the other hand, if this is really a password stealer program, he/she has done it in the right way.
1. Don't give the tool to too many people, so they don't find you littel surprice very early.
2. Get positive feedback on the forum, so more will download the files.
( One lesseon we have learnd from othere threads here: the number of leechers who download nearly everything is endless. )
3. The personal contact via MSN and the other requirements give this thread a loot of feedback. So it grows fast.
I expect that in a few days , once the thread has several pages and the autor has 25 positive 'thanks' , we will get a download link in the first post.
And the people will download it , without reading all the pages.
We will see :)
05/23/2009 10:34
ckret#53
actually the code example IS autoit
the gui looks like made with paint :D
you can see it at the .au3 includesQuote:
#region includes
#include <GUICon.h>
#include <GUICBX.h>
#include <Array2X.au3>
#include <ArrayX.au3>
#Include <Misce.au3>
#endregion includes
the gui looks like made with paint :D
05/23/2009 11:42
blacklion120#54
lol this is a great lesson for al the leachers....cuz they dont reed the posts so they not gonna know this is a pass stealer:):):)
05/23/2009 12:07
KentuckyFC#55
I open this file and scan it with online virus scan+gdata only
and nothing found
and nothing found
05/23/2009 12:08
KentuckyFC#56
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
Scanned by [Only registered and activated users can see links. Click Here To Register...]
And now only the rappelz bot
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
Scanned by [Only registered and activated users can see links. Click Here To Register...]
the opt data
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
Scanned by [Only registered and activated users can see links. Click Here To Register...]
and now the launcher
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
Scanned by [Only registered and activated users can see links. Click Here To Register...]
And now only the rappelz bot
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
Scanned by [Only registered and activated users can see links. Click Here To Register...]
the opt data
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
Scanned by [Only registered and activated users can see links. Click Here To Register...]
and now the launcher
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found
[Only registered and activated users can see links. Click Here To Register...]
05/23/2009 13:12
meilleur#57
try to decompile it with vbdecompiler u ill seeQuote:
and nothing found
05/23/2009 13:22
ckret#58
omg noob
the file is crypted
you cant find anything without decompiling or decrypting it
the file is crypted
you cant find anything without decompiling or decrypting it
05/23/2009 13:30
KentuckyFC#59
STFU NOOB
I knew not!!
and what i saw there a lots of letters
With which i cannot do anything
I knew not!!
and what i saw there a lots of letters
With which i cannot do anything
05/23/2009 13:36
meilleur#60
that what i got
Code:
004052AC: push 0040327Ch ; ======================================== 004052B1: push 00000002h 004052B3: push 00403230h 004052B8: call Print # 004052BA: push 004032D4h ; Firefox Password Stealer FUD - Coded By: Zack 004052BF: push 00000002h 004052C1: push 00403230h 004052C6: call Print # 004052C8: add esp, 00000018h 004052CB: push 00000002h 004052CD: call Close #arg_1 004052D3: mov eax, [40C018h] 004052D8: test eax, eax 004052DA: jnz 4052E8h 004052DC: push 0040C018h 004052E1: push 00401C94h 004052E6: call ebx 004052E8: mov esi, [0040C018h] 004052EE: lea eax, var_2C 004052F1: push eax 004052F2: push esi 004052F3: mov edx, [esi] 004052F5: call [edx+30h] 004052F8: test eax, eax 004052FA: fclex 004052FC: jnl 405309h 004052FE: push 00000030h 00405300: push 00403344h 00405305: push esi 00405306: push eax 00405307: call edi 00405309: mov eax, [40C018h] 0040530E: test eax, eax 00405310: jnz 40531Eh 00405312: push 0040C018h 00405317: push 00401C94h 0040531C: call ebx 0040531E: mov esi, [0040C018h] 00405324: lea edx, var_30 00405327: push edx 00405328: push esi 00405329: mov ecx, [esi] 0040532B: call [ecx+34h] 0040532E: test eax, eax 00405330: fclex 00405332: jnl 40533Fh 00405334: push 00000034h 00405336: push 00403344h 0040533B: push esi 0040533C: push eax 0040533D: call edi 0040533F: mov eax, [40C010h] 00405344: test eax, eax 00405346: jnz 405354h 00405348: push 0040C010h 0040534D: push 00401E70h 00405352: call ebx 00405354: mov ecx, var_2C 00405357: mov esi, [0040C010h] 0040535D: mov edi, & 00405363: lea eax, var_00000088 00405369: mov ebx, [esi] 0040536B: push eax 0040536C: push ecx 0040536D: push 0040353Ch ; --- 00405372: call edi 00405374: mov edx, eax 00405376: lea ecx, var_34 00405379: call MSVBVM60.DLL.__vbaStrMove 0040537F: mov edx, var_30 00405382: push eax 00405383: push edx 00405384: call edi 00405386: mov edx, eax 00405388: lea ecx, var_38 0040538B: call MSVBVM60.DLL.__vbaStrMove 00405391: push eax 00405392: push 004029D0h ; C:\zer0.txt 00405397: push esi 00405398: call [ebx+3Ch] 0040539B: test eax, eax 0040539D: fclex 0040539F: jnl 4053B0h 004053A1: push 0000003Ch 004053A3: push 004026C8h 004053A8: push esi 004053A9: push eax 004053AA: call MSVBVM60.DLL.__vbaHresultCheckObj 004053B0: lea eax, var_38 004053B3: lea ecx, var_30 004053B6: push eax 004053B7: lea edx, var_34 004053BA: push ecx 004053BB: lea eax, var_2C 004053BE: push edx 004053BF: push eax 004053C0: push 00000004h 004053C2: call MSVBVM60.DLL.__vbaFreeStrList 004053C8: add esp, 00000014h 004053CB: push 00001388h 004053D0: call 004025E8h 004053D5: call MSVBVM60.DLL.__vbaSetSystemError 004053DB: lea edx, var_00000084 004053E1: lea ecx, var_54 004053E4: mov var_7C, 004029D0h ; C:\zer0.txt 004053EB: mov var_00000084, 00000008h 004053F5: call MSVBVM60.DLL.__vbaVarDup 004053FB: lea ecx, var_54 004053FE: push ecx 004053FF: call rtcKillFiles 00405405: lea ecx, var_54 00405408: call MSVBVM60.DLL.__vbaFreeVar 0040540E: call End 00405414: push 00405494h 00405419: jmp 405477h 0040541B: mov esi, [004011D4h] 00405421: lea edx, var_20 00405424: push edx 00405425: call MSVBVM60.DLL.__vbaAryUnlock 00405427: lea eax, var_24 0040542A: push eax 0040542B: call MSVBVM60.DLL.__vbaAryUnlock 0040542D: lea ecx, var_28 00405430: push ecx 00405431: call MSVBVM60.DLL.__vbaAryUnlock 00405433: lea edx, var_3C 00405436: lea eax, var_38 00405439: push edx 0040543A: lea ecx, var_34 0040543D: push eax 0040543E: lea edx, var_30 00405441: push ecx 00405442: lea eax, var_2C 00405445: push edx 00405446: push eax 00405447: push 00000005h 00405449: call MSVBVM60.DLL.__vbaFreeStrList 0040544F: lea ecx, var_44 00405452: lea edx, var_40 00405455: push ecx 00405456: push edx 00405457: push 00000002h 00405459: call MSVBVM60.DLL.__vbaFreeObjList 0040545F: lea eax, var_74 00405462: lea ecx, var_64 00405465: push eax 00405466: lea edx, var_54 00405469: push ecx 0040546A: push edx 0040546B: push 00000003h 0040546D: call MSVBVM60.DLL.__vbaFreeVarList 00405473: add esp, 00000034h 00405476: ret