Quote from: BABY SHOES on Today at 01:30:47 PM

Thanks Lafu, I will keep posting here when I find fake ANNs spreading malware with fake github here.
I've updated it with code so someone can't click on it.

Nice Thanks for the edit and this helps for sure that its not accidentally clickable for other Users.
Also thanks for keeping your eyes open and you are right on that last Fake Ann.

There is more evidence and information about that Fake Github File when you looking on the behavior of the File.

And its the same file as we got it from Fake Github github.com/troyseate/electrum-kas just a other Github Account.

Code:

C:\Program Files (x86)\My Program\MyProg.exe
C:\Program Files (x86)\My Program\electrumkas.exe
C:\Program Files (x86)\My Program\electrumkas.exe.config
C:\Program Files (x86)\My Program\electrumkas.exe\:Zone.Identifier

Source : https://www.virustotal.com/gui/file/90865b85c96429951ec2d1014398dfaf336e5be6cfd6d6fcbb13827184e1a4f8/behavior

Whats interesting on that File is that here:

Code:

fullnode-win64/fullnode-win64-qt.exe
256 - C:\Windows\System32\netsh.exe "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="KDX kaspa-miner" program="C:\Program Files\Kaspa\KDX\bin\windows-x64\gpuminer.exe" dir=out action=allow enable=yes

It modifies your Firewall when you start the Wallet.exe and a lot of other bad things.