steam scammer keylogger

[Maid]

alright so some random dude added me
and wanted to trade with me he said he wanted to trade a knife for my inventory
(my inventory is not even worth anything lol)
so he sent a link and told me download the "screenshot"

the link was very fishy

so i thought oh well hope this will be good

so the link auto downloaded a rar file
inside the rar file was a scr file

(scr works like a executable or it could also be used as a config file)
but in this case it was a executable file

when running the file
it will download a knife screenshot image (guess he did not lie about the screenshot xD )
it also install a keylogger/password grabber in attempt to steal the victims (always run fishy files in a closed test environment )

here is a link with the screenshot of the chat
(the link address to the file/keylogger you can find in the chat. DONT RUN IT unless you know what you are doing)

https://i.imgur.com/awHkE8p.png

the reason i post it here is so people will see what method the scammer is using
and also so people can report him


and remember when sending keyloggers to people
you are breaking the law
and sending it via steam is breaking the guidelines for steam too

[Seretti]

Ursprungligen skrivet av yamete oniisan itaii:

and sending it via steam is breaking the guidelines for steam too

As is naming and shaming, which you are doing. Remove the profile links.

[Maid]

Ursprungligen skrivet av Seretti:

Ursprungligen skrivet av yamete oniisan itaii:

and sending it via steam is breaking the guidelines for steam too

As is naming and shaming, which you are doing. Remove the profile links.

oh did not know that was not okay
i have removed the profile links

the reason i posted the links was that people could report him for breaking the rules

[Seretti]

Ursprungligen skrivet av yamete oniisan itaii:

the reason i posted the links was that people could report him for breaking the rules

Having random people, who did not deal with the guy, reporting him would do more harm than good. It might make him look like the victim.

Only the person involved should report.

[999999999]

Read https://support.steampowered.com/kb_article.php?ref=1927-RTSV-6909

[Maid]

understandable

[Maid]

Ursprungligen skrivet av 999999999:

Read https://support.steampowered.com/kb_article.php?ref=1927-RTSV-6909

done that

[Annihilator]

I repeat because is deleted the old response(not wanna talk about it anymore) :\ plus adding one thing.My tips is not add people you dont know.One of my friend have received a random add from one guy too, time ago, and asked one items for free with excuses is "my friend" but not is a my friend.

Unfortunately my friend gived it for free but this is common thing.For lucky steam have turned "only at friend" invectory from default for this reason.


But exsist who adding random for give link with virus or something similar and never click on it specially if is new friend recently. In any cases never click it from who dont know.


I already know this issue from long time.I hope to add a "not reiceived friend invite" option.

[Rogue_Zephyr (Meta)]

Ursprungligen skrivet av Annihilator:

I repeat because is deleted the old response(not wanna talk about it anymore) :\ plus adding one thing.My tips is not add people you dont know.One of my friend have received a random add from one guy too, time ago, and asked one items for free with excuses is "my friend" but not is a my friend.

Unfortunately my friend gived it for free but this is common thing.For lucky steam have turned "only at friend" invectory from default for this reason.


But exsist who adding random for give link with virus or something similar and never click on it specially if is new friend recently. In any cases never click it from who dont know.


I already know this issue from long time.I hope to add a "not reiceived friend invite" option.

Repeating something thats been deleted is only going to get it deleted again. And your friend is a fool for doing that.

[Annihilator]

Ursprungligen skrivet av Rogue_Zephyr (Meta):

Ursprungligen skrivet av Annihilator:

I repeat because is deleted the old response(not wanna talk about it anymore) :\ plus adding one thing.My tips is not add people you dont know.One of my friend have received a random add from one guy too, time ago, and asked one items for free with excuses is "my friend" but not is a my friend.

Unfortunately my friend gived it for free but this is common thing.For lucky steam have turned "only at friend" invectory from default for this reason.


But exsist who adding random for give link with virus or something similar and never click on it specially if is new friend recently. In any cases never click it from who dont know.


I already know this issue from long time.I hope to add a "not reiceived friend invite" option.

Repeating something thats been deleted is only going to get it deleted again. And your friend is a fool for doing that.

No i not repeated same thing i have added a note.Maybe is deleted for other reason maybe because i asked one thing on 9999 but i not want talking about it.But i not have break anything in any cases.


Edit: About my friend i know :\

[Rogue_Zephyr (Meta)]

Ursprungligen skrivet av Annihilator:

Ursprungligen skrivet av Rogue_Zephyr (Meta):

Repeating something thats been deleted is only going to get it deleted again. And your friend is a fool for doing that.

No i not repeated same thing i have added a note.Maybe is deleted for other reason maybe because i asked one thing on 9999 but i not want talking about it.

Why add to something you don't want to talk about?

[Annihilator]

Ursprungligen skrivet av Rogue_Zephyr (Meta):

Ursprungligen skrivet av Annihilator:

No i not repeated same thing i have added a note.Maybe is deleted for other reason maybe because i asked one thing on 9999 but i not want talking about it.

Why add to something you don't want to talk about?

No i mean about 9999* i asked only why my thread is closed but i not joined here for that reason is only a side note.I joined here only for reply at that guy because i know that problem also.

[Rogue_Zephyr (Meta)]

Ursprungligen skrivet av Annihilator:

Ursprungligen skrivet av Rogue_Zephyr (Meta):

Why add to something you don't want to talk about?

No i mean about 9999* i asked only why my thread is closed but i not joined here for that reason is only a side note.I joined here only for reply at that guy because i know that problem also.

Ah ok. Got it.

[Maid]

oh btw the keylogger dont only grab password for steam but other clients too
and if you have run this file then they will get access to most password you use
and that could be facebook and other social media password
and also password for example ftp servers and stuff like that

so remember if you suspect a file containing keylogger then dont run it

unless you know what you doing and want to reverse engineer it
to get more info about the attacker

[cinedine]

Ursprungligen skrivet av RedSKY:

the reason i post it here is so people will see what method the scammer is using
and also so people can report him

* you willingly clicked on a fishy link
* you downloaded a random archive file
* you extracted said file
* which of all things contained a SCR file
* you than proceeded to execute this SCR file

That's a 90s method. As in the 1990s. As in 20+ years ago.
Who do you think you will help by posting this?

What's next? Don't open random attachments in emails you don't know where they came from? Don't trust Nigerian royalty?

[Breezywarhead]

Anything do with the suspicious links without telling you is a virus or hacking things. so you must ignore screenshot files or what bc those are getting olds. for facking god sakes we have discord now and gyazo screenshot. like what a point making a files into screenshot to proof is dumb. One it could be fake. you must check the trader person inventory if he telling the truth. if he set private then he lying