6 ms·

He ran a carding forum in the past, malkit.ws and then malkit.su. Virustotal passive DNS shows that it was hosted for a time on the same server as his old irc,

by goatsi 9y ago

He ran a carding forum in the past, malkit.ws and then malkit.su. Virustotal passive DNS shows that it was hosted for a time on the same server as his old irc, irc.voidptr.cz https://www.virustotal.com/en/ip-address/188.190.99.148/information/ https://www.virustotal.com/en/ip-address/188.190.99.148/info...

ryanlol 9y ago
Was it him or BetaMonkey running this? If I recall correctly BM owned voidptr but both had admin access there? EDIT: Ah, found some old logs on google: http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.html http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.h... [08:08] <TouchMe> if i still owned this irc [08:09] <TouchMe> i would shut it down and start over
- christina_b 9y ago
  BetaMonkey/TouchMe was in fact the person I was referring to who was providing support for his botnet drone builder until he dissapeared with no trace at a later date. Just could not recall the nick at the time of making my original post.
  - ryanlol 9y ago
    I always assumed the two to be different people. The log shows the two of them talking at the same time, and I remember the two of them having very different attitudes in general. I know TouchMe is malwaretech but would be inclined to assume that BetaMonkey isn't. TouchMe was still a malware developer though, and apparently used to run voidptr before handing it over to BetaMonkey.
    - christina_b 9y ago
      I was pretty sure TouchMe was BetaMonkey's new nick, I don't think it was Ntoskrnl (MalwareTech). From what I've heard TouchMe continued support of his drone's users until he dissapeared without a trace. This was so long ago and my memory isn't amazing.
      - ryanlol 9y ago
        TouchMe is MalwareTech, 0 doubt https://twitter.com/touchmymalware https://twitter.com/touchmymalware If BetaMonkey==TouchMe then they were trying really hard to conceal that. Here's a hackforums thread mentioning some other malware TouchMe was distributing though https://hackforums.net/showthread.php?tid=3786935 https://hackforums.net/showthread.php?tid=3786935
        fweespeech 9y ago
        > TouchMe is MalwareTech, 0 doubt https://twitter.com/touchmymalware https://twitter.com/touchmymalware If I was a bad man in the security profession who was certain he was anonymous, I'd point to someone else who was a security professional on twitter when I vanished too. It just y'know, wouldn't have been me.
        blaquee 9y ago
        That tweet was in 2013 however.
        fweespeech 9y ago
        If you tweet and stop using an account that is what happens and that was a shady group of people in 2013.
        ryanlol 9y ago
        pfft. I used to talk to this guy on a malware dev IRC on a daily basis, he started a blog "TouchMyMalware" which eventually evolved into Malwaretech. This is all easily verifiable with google and archive.org. And lol, apparently some twitter user dug up logs of him offering to sell me a rootkit for $20k https://twitter.com/jeremiahg/status/893207272154734592 https://twitter.com/jeremiahg/status/893207272154734592
        sugersvoltet 9y ago
  - goatsi 9y ago
    Betamonkey was someone different. The reason he disappeared without a trace was that he was so bad at PHP that people got sent to prison (his support site was owned by a whitehat and all the customer information was harvested and distributed to law enforcement)[0]. Touchme/Marcus was a close friend of his though, one of his first articles on the site that eventually became malwaretech.com was an attempt to disprove the claim that betamonkey's malware was banking malware. This had gotten him banned from selling on hackforums, his main source of customers at the time. You have to read the article on the way back machine, for some reason he deleted it from his site later on [1]. If I were betamonkey I would be sweating pretty hard right now, his malware is also still being used and Marcus will be looking hard for someone else to drag under the bus. [0] http://www.xylibox.com/2015/04/betabot-retrospective.html http://www.xylibox.com/2015/04/betabot-retrospective.html [1] https://web-beta.archive.org/web/20130625172146/http://touchmymalware.blogspot.com https://web-beta.archive.org/web/20130625172146/http://touch... (halfway down the page)
jtl999 9y ago
I don't think he directly ran his own IRC, it was a "in partnership with another organization" sort of thing.
- jtl999 9y ago
  Here it is > For anyone still into IRC, MalwareTech has partnered with sigterm.no to launch a new IRC network. It’s still fairly new so don’t expect an instant response, but everyone is welcome (socializing or just asking for help). https://www.malwaretech.com/2014/10/new-irc-launc.html https://www.malwaretech.com/2014/10/new-irc-launc.html
  - ryanlol 9y ago
    Different irc, different time. Look at the timestamps on VT, we're talking about 2013 stuff :)

by goatsi 9y ago

ryanlol 9y ago

Was it him or BetaMonkey running this? If I recall correctly BM owned voidptr but both had admin access there? EDIT: Ah, found some old logs on google: http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.html http://www.exposedbotnets.com/2013/05/hf-elite-coding-team.h... [08:08] <TouchMe> if i still owned this irc [08:09] <TouchMe> i would shut it down and start over

christina_b 9y ago
BetaMonkey/TouchMe was in fact the person I was referring to who was providing support for his botnet drone builder until he dissapeared with no trace at a later date. Just could not recall the nick at the time of making my original post.
- ryanlol 9y ago
  I always assumed the two to be different people. The log shows the two of them talking at the same time, and I remember the two of them having very different attitudes in general. I know TouchMe is malwaretech but would be inclined to assume that BetaMonkey isn't. TouchMe was still a malware developer though, and apparently used to run voidptr before handing it over to BetaMonkey.
  - christina_b 9y ago
    I was pretty sure TouchMe was BetaMonkey's new nick, I don't think it was Ntoskrnl (MalwareTech). From what I've heard TouchMe continued support of his drone's users until he dissapeared without a trace. This was so long ago and my memory isn't amazing.
    - ryanlol 9y ago
      TouchMe is MalwareTech, 0 doubt https://twitter.com/touchmymalware https://twitter.com/touchmymalware If BetaMonkey==TouchMe then they were trying really hard to conceal that. Here's a hackforums thread mentioning some other malware TouchMe was distributing though https://hackforums.net/showthread.php?tid=3786935 https://hackforums.net/showthread.php?tid=3786935
      - fweespeech 9y ago
        > TouchMe is MalwareTech, 0 doubt https://twitter.com/touchmymalware https://twitter.com/touchmymalware If I was a bad man in the security profession who was certain he was anonymous, I'd point to someone else who was a security professional on twitter when I vanished too. It just y'know, wouldn't have been me.
        blaquee 9y ago
        That tweet was in 2013 however.
        fweespeech 9y ago
        If you tweet and stop using an account that is what happens and that was a shady group of people in 2013.
        ryanlol 9y ago
        pfft. I used to talk to this guy on a malware dev IRC on a daily basis, he started a blog "TouchMyMalware" which eventually evolved into Malwaretech. This is all easily verifiable with google and archive.org. And lol, apparently some twitter user dug up logs of him offering to sell me a rootkit for $20k https://twitter.com/jeremiahg/status/893207272154734592 https://twitter.com/jeremiahg/status/893207272154734592
        sugersvoltet 9y ago
- goatsi 9y ago
  Betamonkey was someone different. The reason he disappeared without a trace was that he was so bad at PHP that people got sent to prison (his support site was owned by a whitehat and all the customer information was harvested and distributed to law enforcement)[0]. Touchme/Marcus was a close friend of his though, one of his first articles on the site that eventually became malwaretech.com was an attempt to disprove the claim that betamonkey's malware was banking malware. This had gotten him banned from selling on hackforums, his main source of customers at the time. You have to read the article on the way back machine, for some reason he deleted it from his site later on [1]. If I were betamonkey I would be sweating pretty hard right now, his malware is also still being used and Marcus will be looking hard for someone else to drag under the bus. [0] http://www.xylibox.com/2015/04/betabot-retrospective.html http://www.xylibox.com/2015/04/betabot-retrospective.html [1] https://web-beta.archive.org/web/20130625172146/http://touchmymalware.blogspot.com https://web-beta.archive.org/web/20130625172146/http://touch... (halfway down the page)

jtl999 9y ago

I don't think he directly ran his own IRC, it was a "in partnership with another organization" sort of thing.

jtl999 9y ago
Here it is > For anyone still into IRC, MalwareTech has partnered with sigterm.no to launch a new IRC network. It’s still fairly new so don’t expect an instant response, but everyone is welcome (socializing or just asking for help). https://www.malwaretech.com/2014/10/new-irc-launc.html https://www.malwaretech.com/2014/10/new-irc-launc.html
- ryanlol 9y ago
  Different irc, different time. Look at the timestamps on VT, we're talking about 2013 stuff :)