During this story they interviewed a 'hacker' just before the subject, a voice-over do an introduction and say "il a conçu ce qu'on appelle un trojan ou troyen ou cheval de troie en jargon informatique"
You can translate simply this by "He created a trojan blablabla insert some random name for trojan here"
Then the 'hacker' show us Teamviewer with Darkcomet RAT:
And this is not DarkCoderSc in this interview.
The 'hacker' tell us how he infect poker players: Youtube
A classic way: videos of fake applications to cheat on online poker rooms.
By searching the Youtube description on Google we have this:
And we got a profile:
Malwares are hosted on Mediafire servers, the 'hacker' have also do some blogspot like this one:
Some md5:
f8c5dd0f2c359adad2fd22a1ce902b35
a576c6a07852ef126ff2e918678ea54f
195a56821175d3c725dd3919282e0342
acb40e46b1582b5207b6addcf8c42a08
Let's take a file:
• dns: 1 ›› ip: 93.23.104.21 - adresse: HACKGS.NO-IP.ORG
Fynloski.A config:
#BEGIN DARKCOMET DATA --
MUTEX={DC_MUTEX-1XNQ69V}
SID={PokBot}
FWB={0}
NETDATA={hackgs.no-ip.org:1604|hackgs.no-ip.org:93|hackgs.no-ip.org:94}
GENCODE={0LGYVhtuCi4W}
INSTALL={1}
COMBOPATH={2}
EDTPATH={MSDCSC\WinUpdata.exe}
KEYNAME={WinUpdate}
EDTDATE={16/04/2007}
PERSINST={1}
MELT={1}
CHANGEDATE={1}
DIRATTRIB={6}
FILEATTRIB={6}
SH1={1}
CHIDEF={1}
CHIDED={1}
PERS={1}
OFFLINEK={1}
#EOF DARKCOMET DATA --
MUTEX={DC_MUTEX-1XNQ69V}
SID={PokBot}
FWB={0}
NETDATA={hackgs.no-ip.org:1604|hackgs.no-ip.org:93|hackgs.no-ip.org:94}
GENCODE={0LGYVhtuCi4W}
INSTALL={1}
COMBOPATH={2}
EDTPATH={MSDCSC\WinUpdata.exe}
KEYNAME={WinUpdate}
EDTDATE={16/04/2007}
PERSINST={1}
MELT={1}
CHANGEDATE={1}
DIRATTRIB={6}
FILEATTRIB={6}
SH1={1}
CHIDEF={1}
CHIDED={1}
PERS={1}
OFFLINEK={1}
#EOF DARKCOMET DATA --
To the 'hacker':
Hidding in a hotel and using remote PC for Darkcomet don't make you anonymous, i know who you are since you are registered on some forums.
Canal plus:
If you're going to make a program and talk about hacking, then at least have a feel for the subject first.
Edit 11 June 2013:
My most sincere apologies to a french site i've quoted before the edit: they are absolutely not involved in this story.
and same for the YouTube account associated.
(I deleted the pictures, this part is for people who saw my first version of this article)
The YouTube account in question got hacked, and I concluded (too quickly) that the actor behind was also involved in 3D activities. (due to videos found)
After being contacted by those guys to clarify the situation, it seems reasonable for me to 'mea culpa' once again for the false 'accusations' i've do.
I rarely do mistake like this but when i do it's normal to get back on facts and re-analyse the whole situation.
French:
Mes plus sincère excuses à un site internet français que j'avais cité, ils ne sont en aucun cas impliqué dans l'histoire tout comme le compte YouTube associé que j'avais impliqué (j'ai supprimé les images ceci s'adresse au personnes qui on vu mon article quand il y avais ces fameuses images.)
Le compte YouTube en question avais été piraté par ce hacker et j'ai conclu (un peut trop vite) que l'acteur derrière était impliqué dans des activités de travail 3D.
Après avoir été contacté par ses personnes et avoir clarifié la situation, il me semble légitime de ma part de m'excusée pour ses fausse 'accusations'
