Posible cabal bot

Crazycrack · 11/05/2007, 10:29

Hey there i found some taiwan (well i think it was taiwan...) forum and as much as i can understand they say that they got a Cabal online bot so i need some1 to confirm if its true or not i am posting it here i scanned it for viruses and it seems to be clean if some1 will manage to make it run please share the info how to do it .
Link:

Cheers

vivian62 · 11/05/2007, 12:13

Lol don't enter your ID an PA he just need hack you -_- ban it don't dl.

vivian62

Crazycrack · 11/05/2007, 12:19

This bot(If it is bot) it connects to taiwan or what ever country it is cabal server just open UserInfo\config.ini ....

P.S. There are some Cabal client files maps and some others and here i found screen of ver 1.5 but i dunno if its real

And here the screen of bot launched

I found out some functions of it: useitem,pickup,attack monster,cripple walk,auto sell to player shop,smooth walk,avoid monster,semi-auto sell to npc,smart money boom pickup,auto walk buy/sell (same map) and some more.

KamikadZee · 11/05/2007, 13:06

and it realy Works? or it's just the simple Spam keyloger or other **** ?

Crazycrack · 11/05/2007, 13:09

I dont know i havent runned it i need some1 who understands in this kind of stuff to check it out.
P.S. I wrote an email to the guy who claims that have created this bot for more information about it and possible translation of it into English.

KamikadZee · 11/05/2007, 13:19

Dont sure if it safe
Antivirus;Version;Last Update;Result
AhnLab-V3;2007.11.5.0;2007.11.05;-
AntiVir;7.6.0.30;2007.11.05;-
Authentium;4.93.8;2007.11.03;-
Avast;4.7.1074.0;2007.11.04;-
AVG;7.5.0.503;2007.11.05;-
BitDefender;7.2;2007.11.05;-
CAT-QuickHeal;9.00;2007.11.03;(Suspicious) - DNAScan
ClamAV;0.91.2;2007.11.04;-
DrWeb;4.44.0.09170;2007.11.05;DLOADER.Trojan
eSafe;7.0.15.0;2007.10.28;-
eTrust-Vet;31.2.5264;2007.11.02;-
Ewido;4.0;2007.11.05;-
FileAdvisor;1;2007.11.05;-
Fortinet;3.11.0.0;2007.10.19;-
F-Prot;4.4.2.54;2007.11.05;-
F-Secure;6.70.13030.0;2007.11.05;-
Ikarus;T3.1.1.12;2007.11.05;Trojan-Spy.Win32.Ardamax.i
Kaspersky;7.0.0.125;2007.11.05;-
McAfee;5155;2007.11.02;-
Microsoft;1.2908;2007.11.05;-
NOD32v2;2637;2007.11.05;-
Norman;5.80.02;2007.11.05;-
Panda;9.0.0.4;2007.11.04;Suspicious file
Prevx1;V2;2007.11.05;Heuristic: Suspicious Self Modifying File
Rising;20.17.01.00;2007.11.05;-
Sophos;4.23.0;2007.11.05;-
Sunbelt;2.2.907.0;2007.11.02;VIPRE.Suspicious
Symantec;10;2007.11.05;-
TheHacker;6.2.9.110;2007.10.27;-
VBA32;3.12.2.4;2007.11.03;-
VirusBuster;4.3.26:9;2007.11.04;-
Webwasher-Gateway;6.6.1;2007.11.05;Win32.Malware.gen (suspicious)

Additional information
File size: 2289259 bytes
MD5: 28165c3347f03c9152117874e19d9a96
SHA1: 2e5e33ffdd5835cccf52fdc293e7468cadc6e383
packers: Edit, PE_Patch
Prevx info:

Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

x901 · 11/05/2007, 13:42

i tried it when i write user name and pass it says strange words i can't read the language any help????

KamikadZee · 11/05/2007, 13:51

same here

i dont think it;s for Eu Cabal dont wokr for me

-Chrome- · 11/05/2007, 14:15

Quote:

Originally Posted by KamikadZee

Ikarus;T3.1.1.12;2007.11.05;Trojan-Spy.Win32.Ardamax.i

ardamax is a keylogger

x901 · 11/05/2007, 17:52

yes i know then o deleted it all

rinleez · 11/06/2007, 01:14

A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

Bot.exe.....

well the executor looks clean and maybe some dll files look ifnected.. look at config.ini maybe we try change it to cabal addresses

soundwave3 · 11/06/2007, 14:18

also we should change enc files :] but anyway i don't think that this will work for europe cabal

Bzzz · 11/06/2007, 19:05

Quote:

Originally Posted by soundwave3

also we should change enc files :] but anyway i don't think that this will work for europe cabal

I try connect to European server. But it gives the error message.

soundwave3 · 11/07/2007, 00:15

what error message? by the way this bot for xtrap and we got gg..

Bzzz · 11/07/2007, 06:12

Quote:

Originally Posted by soundwave3

what error message? by the way this bot for xtrap and we got gg..

there is all in hieroglyphic