iamdeadlyz.pcc.eth | YGG Profile picture
Jul 1, 2022 12 tweets 11 min read Read on X
1/

With #P2E's popularity, threat actors are leveraging on the fact that excited players are ready to jump on board to test the new game (and earn at the same time).

Here's a 🧵about a #Redline stealer #malware from a "project" that recently launched a "beta test" Image
2/

I came across @DheerajShah_'s thread about how he was almost hacked, and one of the commenters caught my eye.

@_Starkcrypto shared that he was compromised by a project claiming to be a "p2e beta testing"


https://t.co/M1daLjbsKU
3/

That project is @rworldp2e (now @R_WorldP2E). As they were called out by Stark, the account changed the username lol. Here's the ID though: 1467094027480625155

It is an impersonation of the original project called @ReptileChronic @R_chronicls

Image
4/

@R_WorldP2E's shared a scam domain claiming to host the game's beta.

☣/reptileworldp2e.com
/reptileworldp2e.com/ReptileWorld_P2E_0.7.3b.rar

🌐@regru 31.31.196.45 Image
5/

Upon unpacking the rar file, a password-locked rar file and a Readme.txt is given which contains the password.

The second rar file, contains the so-called beta game. It looks convincing as it contains the libraries and other files to run a "legitimate" game. Image
6/

Running the ReptileWorld_Launcher_Setup.exe and granting the admin permission is the start of the #Redline stealer #malware.

It begins to crawl on the victim's files to steal browser data, which also contains the Metamask vault files: metamask.zendesk.com/hc/en-us/artic… Image
7/

The stolen data is then exfiltrated to a command and control server (C&C) for the threat actors to check your data and begin their devious acts. And one example is stealing your digital assets, which is what @_Starkcrypto experienced. Image
8/

Interestingly, it is the same C&C used for a fake @rStellaFantasy, which is a #P2E project as well.

The botnet value for the fake stella fantasy was "07.06", and "29.06" for reptile chronicles. This is very likely the starting date of the campaign.

Image
9/

How do you protect yourself against this?
- Use a hardware wallet
- Don't download and run shady files, especially if there's no established trust from multiple users who are eager to play the game. The testimonials may be bottled, so verify it on various sources, ask a lot.
10/

#Redline stealer #malware IOCs

initial rar: 557d8f41efbdec0435d9cf5f001f0d8a
bazaar.abuse.ch/sample/6dcb56e…

second rar: 557d8f41efbdec0435d9cf5f001f0d8a
pw: RW073
bazaar.abuse.ch/sample/33c1246…

C&C: 193.124.22[.]17:23520

@JAMESWT_MHT @malwrhunterteam @dubstard @sniko_ @ActorExpose
Meant to say botted here...when edit button 😢
@JAMESWT_MHT @malwrhunterteam @dubstard @sniko_ @ActorExpose yikes, copied the MD5 hash of the 1st rar to the 2nd one...should be:

second rar: 0678a21c1105c84324861ed03508c0eb
pw: RW073
bazaar.abuse.ch/sample/33c1246…

exe only: bazaar.abuse.ch/sample/7ee8966…

#Redline stealer #malware

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with iamdeadlyz.pcc.eth | YGG

iamdeadlyz.pcc.eth | YGG Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @Iamdeadlyz

Jul 18, 2022
ETH and NFT #drainer

🎯@MEGAMINFT

☣/claim-megami.xyz

🌐@Porkbun | @digitalocean 159.203.120.44

🚩 @etherscan 0xaB667563D81Ab99CD3a613622686c93177B07846

Twitter ID: 1321159828748881920

@CryptoPhishing @dubstard @sniko_ @ActorExpose @PhishFort @phishunt_io @illegalFawn
@MEGAMINFT @Porkbun @digitalocean @etherscan @CryptoPhishing @dubstard @sniko_ @ActorExpose @PhishFort @phishunt_io @illegalFawn .@telegram bot: 5460934623:AAGL8L5USBHfIaiU39AhDPDhIfzeh9qBYWc

chat ID: -401891758
chat name: Dra!ner
chat link: /t.me/+BkNhCMEy6Gk1MGVh

members:
ID: 5302408506 - viper (viper)
ID: 2082943997 - Jas-py (istealfromkids)
ID: 5266391684 - Kry (scripts)
@MEGAMINFT @CryptoPhishing @dubstard @sniko_ @phishunt_io 🚩@etherscan

Part of the config, I don't see any victim approval but worth checking out...

0x261091CbDe098E1543119b91bbbfE2e6Ac59FeC1
0x6d4C8f43BfbE381486FA37F9Ce88927b7E106e85
0x5F05a2B84Fb9c08A9aBBBDaA666833017601367a
0xf8A4f66210Bc9D712e5a4b00eEF1ab73DE7B7E24
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(