stealthisblog
Regular Member
- May 26, 2008
- 289
- 239
Hey. So i was searching around last night and found a post where someone apparently posted GodCPA for download. I thought what the hell, I'll give it a shot. So I downloaded it and ran it, and nothing happened. I tried like 4 times and still nothing happened. Thats when I realized I probably just got trojaned...
So I turned on wireshark and sniffed the traffic
As you can see the exe tried to log into an FTP server, which means it was most likely a firefox/IE password stealer. For some reason the username and password combo the guy put into the exe didn't work anymore though... Anyway, so I decided to check out some info on the domain:
And I saw that this was a dedicated box since thats what the host offered and there were only 4 sites on it. So I got the list of sites and decided to do a whois on each one. The first site gave me this:
The site was about CPA Greed, which would link the guy to the original fake CpaGod trojan... and after I scrolled down, I found:
Owned! So what do you guys think, is this the real guy? I think it is, one because its a dedi box and the sites about CPA... I'm thinking about giving him a call to ask 
So I turned on wireshark and sniffed the traffic
As you can see the exe tried to log into an FTP server, which means it was most likely a firefox/IE password stealer. For some reason the username and password combo the guy put into the exe didn't work anymore though... Anyway, so I decided to check out some info on the domain:
And I saw that this was a dedicated box since thats what the host offered and there were only 4 sites on it. So I got the list of sites and decided to do a whois on each one. The first site gave me this:
The site was about CPA Greed, which would link the guy to the original fake CpaGod trojan... and after I scrolled down, I found:
Last edited by a moderator: