Rappelz Bot+MultiClient *BETA RELEASE 20th MAY*

[meilleur]

Originally Posted by KentuckyFC

you need net framework 3.5

I have it installed

[KentuckyFC]

so you must add doom in msn the e-mail is on the first page

[meilleur]

he say that maybe because the bot was made for her pc for that why the bot dont work on mine

[meilleur]

this is not a bot, this program steal password.

[Cytherea]

gz for you.

how u know its a password stealer?

[meilleur]

link for bot removed... i think its not good idea to post it

[Gertos]

Originally Posted by meilleur

this is not a bot, this program steal password. **** you dommrazr go to die

Really , I am not surpriced to read this.

Why ? Because:

1. 80% of all files that have been posted here latly are something like this.
2. We haven't seen anythink that the bot works.
( no concept, no tecnical details )
3. The file is crypted. So you can't use your anti virus programms with it.

The Code example in the first post looks not like C# for me.
More like some kind of Autoit script.

On the other hand, if this is really a password stealer program, he/she has done it in the right way.
1. Don't give the tool to too many people, so they don't find you littel surprice very early.
2. Get positive feedback on the forum, so more will download the files.
( One lesseon we have learnd from othere threads here: the number of leechers who download nearly everything is endless. )
3. The personal contact via MSN and the other requirements give this thread a loot of feedback. So it grows fast.


I expect that in a few days , once the thread has several pages and the autor has 25 positive 'thanks' , we will get a download link in the first post.
And the people will download it , without reading all the pages.


We will see

[ckret]

actually the code example IS autoit

#region includes
#include <GUICon.h>
#include <GUICBX.h>
#include <Array2X.au3>
#include <ArrayX.au3>
#Include <Misce.au3>
#endregion includes

you can see it at the .au3 includes

the gui looks like made with paint

[blacklion120]

lol this is a great lesson for al the leachers....cuz they dont reed the posts so they not gonna know this is a pass stealer

[KentuckyFC]

I open this file and scan it with online virus scan+gdata only

and nothing found

[KentuckyFC]

Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found


Scanned by


And now only the rappelz bot
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found


Scanned by

the opt data
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found


Scanned by

and now the launcher
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found

[meilleur]

Originally Posted by KentuckyFC

I open this file and scan it with online virus scan+gdata only

and nothing found

try to decompile it with vbdecompiler u ill see

[ckret]

omg noob
the file is crypted
you cant find anything without decompiling or decrypting it

[KentuckyFC]

STFU NOOB

I knew not!!



and what i saw there a lots of letters
With which i cannot do anything

[meilleur]

that what i got

004052AC: push 0040327Ch ; ========================================
004052B1: push 00000002h
004052B3: push 00403230h
004052B8: call Print #
004052BA: push 004032D4h ; Firefox Password Stealer FUD - Coded By: Zack
004052BF: push 00000002h
004052C1: push 00403230h
004052C6: call Print #
004052C8: add esp, 00000018h
004052CB: push 00000002h
004052CD: call Close #arg_1
004052D3: mov eax, [40C018h]
004052D8: test eax, eax
004052DA: jnz 4052E8h
004052DC: push 0040C018h
004052E1: push 00401C94h
004052E6: call ebx
004052E8: mov esi, [0040C018h]
004052EE: lea eax, var_2C
004052F1: push eax
004052F2: push esi
004052F3: mov edx, [esi]
004052F5: call [edx+30h]
004052F8: test eax, eax
004052FA: fclex 
004052FC: jnl 405309h
004052FE: push 00000030h
00405300: push 00403344h
00405305: push esi
00405306: push eax
00405307: call edi
00405309: mov eax, [40C018h]
0040530E: test eax, eax
00405310: jnz 40531Eh
00405312: push 0040C018h
00405317: push 00401C94h
0040531C: call ebx
0040531E: mov esi, [0040C018h]
00405324: lea edx, var_30
00405327: push edx
00405328: push esi
00405329: mov ecx, [esi]
0040532B: call [ecx+34h]
0040532E: test eax, eax
00405330: fclex 
00405332: jnl 40533Fh
00405334: push 00000034h
00405336: push 00403344h
0040533B: push esi
0040533C: push eax
0040533D: call edi
0040533F: mov eax, [40C010h]
00405344: test eax, eax
00405346: jnz 405354h
00405348: push 0040C010h
0040534D: push 00401E70h
00405352: call ebx
00405354: mov ecx, var_2C
00405357: mov esi, [0040C010h]
0040535D: mov edi, &
00405363: lea eax, var_00000088
00405369: mov ebx, [esi]
0040536B: push eax
0040536C: push ecx
0040536D: push 0040353Ch ; ---
00405372: call edi
00405374: mov edx, eax
00405376: lea ecx, var_34
00405379: call MSVBVM60.DLL.__vbaStrMove
0040537F: mov edx, var_30
00405382: push eax
00405383: push edx
00405384: call edi
00405386: mov edx, eax
00405388: lea ecx, var_38
0040538B: call MSVBVM60.DLL.__vbaStrMove
00405391: push eax
00405392: push 004029D0h ; C:\zer0.txt
00405397: push esi
00405398: call [ebx+3Ch]
0040539B: test eax, eax
0040539D: fclex 
0040539F: jnl 4053B0h
004053A1: push 0000003Ch
004053A3: push 004026C8h
004053A8: push esi
004053A9: push eax
004053AA: call MSVBVM60.DLL.__vbaHresultCheckObj
004053B0: lea eax, var_38
004053B3: lea ecx, var_30
004053B6: push eax
004053B7: lea edx, var_34
004053BA: push ecx
004053BB: lea eax, var_2C
004053BE: push edx
004053BF: push eax
004053C0: push 00000004h
004053C2: call MSVBVM60.DLL.__vbaFreeStrList
004053C8: add esp, 00000014h
004053CB: push 00001388h
004053D0: call 004025E8h
004053D5: call MSVBVM60.DLL.__vbaSetSystemError
004053DB: lea edx, var_00000084
004053E1: lea ecx, var_54
004053E4: mov var_7C, 004029D0h ; C:\zer0.txt
004053EB: mov var_00000084, 00000008h
004053F5: call MSVBVM60.DLL.__vbaVarDup
004053FB: lea ecx, var_54
004053FE: push ecx
004053FF: call rtcKillFiles
00405405: lea ecx, var_54
00405408: call MSVBVM60.DLL.__vbaFreeVar
0040540E: call End
00405414: push 00405494h
00405419: jmp 405477h
0040541B: mov esi, [004011D4h]
00405421: lea edx, var_20
00405424: push edx
00405425: call MSVBVM60.DLL.__vbaAryUnlock
00405427: lea eax, var_24
0040542A: push eax
0040542B: call MSVBVM60.DLL.__vbaAryUnlock
0040542D: lea ecx, var_28
00405430: push ecx
00405431: call MSVBVM60.DLL.__vbaAryUnlock
00405433: lea edx, var_3C
00405436: lea eax, var_38
00405439: push edx
0040543A: lea ecx, var_34
0040543D: push eax
0040543E: lea edx, var_30
00405441: push ecx
00405442: lea eax, var_2C
00405445: push edx
00405446: push eax
00405447: push 00000005h
00405449: call MSVBVM60.DLL.__vbaFreeStrList
0040544F: lea ecx, var_44
00405452: lea edx, var_40
00405455: push ecx
00405456: push edx
00405457: push 00000002h
00405459: call MSVBVM60.DLL.__vbaFreeObjList
0040545F: lea eax, var_74
00405462: lea ecx, var_64
00405465: push eax
00405466: lea edx, var_54
00405469: push ecx
0040546A: push edx
0040546B: push 00000003h
0040546D: call MSVBVM60.DLL.__vbaFreeVarList
00405473: add esp, 00000034h
00405476: ret