Sunday, October 19, 2014

Hacked: RDP-Shop.RU

RDP-Shop.RU 
"the black online shop"

This shop was selling login credentials to hacked Windows servers (TS/RDP) . 

Criminals usually purchase access to these hacked servers and use them for shady activities such as spamming or to make online shopping purchases with stolen credit cards. It becomes clear only after gaining administrative access to and closely researching some prolific users of this particular black market, that 'traditional' internet fraud activities are being supplemented by more lucrative schemes. 

The crooked customers of this website have been observed committing identity theft, wire/bank transfer fraud, and federal and state income tax fraud by filing an income tax return online and depositing the refund to an account the thieves control. Some prefer to get their stolen refund in the form of VISA debit cards mailed to 'drops' inside the U.S. 

To the fraudsters, the value of using hacked servers in this manner is that it provides a proxy layer for the perpetrator, making it more difficult to attribute activities back to their original source. The true location of the criminal could be somewhere in Lagos or Los Angeles, but they are remotely accessing a computer in another country and using it to disguise their location. The servers are cheap and practically disposable. However, access to the hacked servers is volatile, due to the fact that the real owner of the server could (and usually does) discover the illegal activities.  

There are a handful of shops that sell hacked or stolen digital goods like this one, but they are now becoming more popular venture for enterprising mongers. This trend is likely related to the recent major data breaches that have provided the criminal underground with a wealth of personal information and this paves the way for a cascade effect of fraud and theft.

[ More developments on this research will be posted soon ] 


main login screen 



rdp-shop.ru index page



Users of Lampeduza looking for RDP shops.



'Wino' an admin of rdp-shop.ru



Lulz:



Ok, so after some work we now have administrative access.

Lets look around.


Bitcoin config:
// config Blockchain account
$system = "bitcoin";
$btc = 600;
$guid = 'b6b013ef-62ca-4561-811d-1aa6b2736d43';  // Blockchain account
$main_password = 'Drilonial123.'; // Blockchain pass
$second_password = 'Winoal123..'; // Blockchain pass
$rate = 600;

transactions



MySQL:

The back end of the shop was a MySQL database, (salted password hashes - salt = fs978 )
The database contained the login credentials and IP address for the hacked RDP servers being sold, and user information.

The picture below is a sorted list of the users with the highest balance on the shop. (Users of the shop deposit bitcoin to their shop account, allowing purchases to be made.)

select * from 'users' order by 'balance' desc


RDP-Shop.RU High Roller:

aceboogie145

Read more about this perpetrator here.


Admins:

('drilon', '925a55978b473420d3d07e40bf102941', '123456', 'splet-pasoja@live.com', '41.155.20.61', '2011-10-01 23:03:49', '2014-09-11 06:15:40', '0', '0.00', '0', '178.175.44.127', '5', '0', '1', '0')
,('Wino', '83275c8093a8e9ca03434bc590d2c151', '123456', 'wino@pentagon.al', '178.175.4.95', '2013-03-06 14:48:07', '2014-09-24 19:27:15', '0', '0.00', '0', '46.99.224.7', '0', '0', '1', '0')




Admin Area: 
(update 3/29/15 - forgot to post these admin screenshots)



Admins:




Main Database dump:
if you have a legit need for this, email me.

Support database dump:
if you have a legit need for this, email me.


Plain text user:password list:
sorry, not sharing this data.  
ProTip: Add some code to the login form processor so that it writes the form input to a file before the hashing and voila ..no need to crack hashed passwords ;-)

250+ email addresses from user table:

splet-pasoja@live.com
wino@pentagon.al
gjani.jaha-xx@live.com
aa@hoc.om
richardscott1969@yahoo.com
davtym1@yahoo.com
secsion@yahoo.com
kobbylivingston@yahoo.com
kay_kuku001@yahoo.co.uk
hoodhenry14@yahoo.com
mickfuture001@gmail.com
info@low2.com
aldo_parker@ymail.com
gardarus@gmail.com
tester@live.com
dr_uploader@yahoo.com
tyga@hotmail.com
darahvieh@gmail.com
slimkuta@juno.com
knightrider8620@gmail.com
vavavum88@yahoo.com
m00n81@yahoo.com
vhpoop@gmail.com
freshfor@yahoo.com
shit@shit.com
mirchee14@gmail.com
good_buyers123@yahoo.fr
maartenwydogen@yahoo.com
amine_azri@live.fr
haruncyrbagi@gmail.com
iron.myke@yahoo.com
verycaringangel@yahoo.com
headlimit@hotmail.fr
ianwicks4@gmail.com
paa_kwesi44@yahoo.com
dismalgod@gmail.com
pommediz@hotmail.fr
gameover353@rocketmail.com
zon3@live.com
enohekun@gmail.com
pajsor2k@hotmail.fr
toniduncan56@yahoo.com
nexusabh@yahoo.com
com02444@yahoo.com
comfort.power@yahoo.com
cwcwcw@live.com
rdpshop@ymail.com
alexmiettaux@live.fr
andreev@msn.com
hhl505@hotmail.com
asfdsf@web.de
jimicola@ok.de
odaikakador@yahoo.com
jackice@hotmail.de
eyeyeyeyeye@eyeyeyeyeye.de
elvisglah@gmail.com
entropyideas@gmail.com
alapugacionka@gmail.com
amar175@yahoo.com
cvv_pmrkumo@yahoo.com
delux@live.com
david4garry@yahoo.com
davidlame8@gmail.com
b4ti@gmail.com
monymonylover@yahoo.com
crespim@live.com
donnelwalter00100@gmail.com
k_emergency2012@yahoo.com
getoar.e@gmail.com
ellkops@yahoo.com
singlechrisseeking@yahoo.com
noma.noma1987@hotmail.com
AMISTRAL7@GMAIL.COM
selasiewan@yahoo.com
ug.l0v3@gmail.com
smoothe_hacker@yahoo.com
lolcreelol@gmail.com
kes@msn.com
sniojam@gmail.com
devil_cvv@yahoo.com
cartshop60@hotmail.com
recharge_ve@yahoo.com
tristanb12345@hotmail.com
ayamga@gmail.com
User101@User101.com
wray.harrison@yahoo.com
lckaal@yahoo.com
xplora2007@gmail.com
roer.2@live.com
best1234@yahoo.com
razzmuss312@hotmail.com
khariemshaw@ymail.com
smillinggeorge@yahoo.com
qazbam@yahoo.com
grasstol@hotmail.fr
joeniel56@yahoo.com
ycezayir@yahoo.com
shit@shit.shit
sdffd@yahoo.com
spammtoolssws1@yahoo.com
pauls.kings@yahoo.com
lopac_1@yahoo.com
tomas250519@gmail.com
dcbsod@gmail.com
andini_z@hotmail.com
wubugbanklogins@yahoo.com
lol@live.com
d.harrinson@gmail.com
vcC_sel@hotmail.com
tombui9110@gmail.com
toilaai1806@gmail.com
rocking@live.com
username@gmail.com
oscardevelopments@gmail.com
geshep100@yahoo.com
itr0nic@hushmail.com
needualas3script@yahoo.com
scorpioserver@gmail.com
gouser09@fastmail.fm
viet.phong5@yahoo.com
volfymac@gmail.com
ratibeeh@yahoo.com
jamesbdd4@gmail.com
bgaskin61@hotmail.com
sprayman1@ymail.com
hatgroup2@yahoo.com
ripper.rubber@gmail.com
teodorov666@hotmail.com
greg63042@gmail.com
fcuda@ymail.com
humphreyhumphreydman@yahoo.com
hotbarcaguy19@yahoo.com
cat@liveuks.com
ishipcon11@gmail.com
stepheniewill@yahoo.com
trimii.cool@gmail.com
wendyadams1012@gmail.com
marcelo2kk9@yahoo.com
micheal.sam25@yahoo.com
cambell@yahoo.com
musa@fbi.al
drilonnpajazitii@gmail.com
jaknco@yahoo.com
wm197171@yahoo.com
ilesanmiayo@yahoo.com
felizmoni@yahoo.com
shadowwalker2@ymail.com
sdksk@aol.com
tevo0o@hotmail.com
taner.barila@yahoo.com
mcolbum100@yahoo.com
unlockhack@live.com
see.me144@yahoo.com
kanesangels@yahoo.co.uk
burnstom100@hushmail.com
x2@live.com
sammyjohnson125@yahoo.co.uk
sammyjohnson125@yahoo.com
happymn@yahoo.com
dasharkfan@yahoo.com
benken112@yahoo.com
johnbarracksg@yahoo.com
abcd19886@hotmail.com
agboolasamuellove@yahoo.com
skimmerdoe@gmail.com
phong252@yahoo.com
softdogmedia@gmail.com
andi-.cs@msn.com
Bigbosscity@hotmail.com
netphone86@yahoo.com
anithingbetter@hotmail.com
zoro_spain@hotmail.com
willams9@yahoo.com
mark9gader1966@gmail.com
lanzberis@inbox.com
lana2k@yahoo.com
debbiecaresforyou@rocketmail.c
crlm3@ymail.com
zakink@gmail.com
jnsadasjdn@live.com
janidilda37@yahoo.fr
jose3111@gmail.com
ratyeseng@yahoo.es
hrita117@yahoo.com
madmani@live.com
antoniaff@live.com
hotfile1231@hotmail.com
shittu0147@yahoo.com
johnstak_233fg@yahoo.com
bob4mi@googlemail.com
drakewil101@yahoo.com
azri@live.fr
Shopliker@live.com
ovatimez@yahoo.com
donny.eric@yahoo.com
adms746@aol.com
nguyenquoctien463@gmail.com
manookoro@yahoo.com
rev.jusyicewayne1@yahoo.com
dismalgod@me.com
buomden.sellcvv@yahoo.com
daddyslovelives@gmail.com
comunit@live.com
humancan@yahoo.com
souljah7@live.com
Kosy0090@gmail.com
kenney_reyes@yahoo.com
superdelegate54@yahoo.com
celedonbhz@yahoo.com
farri909@gmail.com
adepop10@gmail.com
p.3n@hotmail.com
leoslovecourt1@yahoo.com
sambranolr@yahoo.com
hi.world.tech@gmail.com
rita.buysth@gmail.com
mayorsworldx1@yahoo.com
drbryn@live.com
dec28728@yahoo.com
big.cc39@yahoo.com
trade_pride@yahoo.com
iksddd@gmail.com
yamazago2@gmail.com
badblack56@gmail.com
asge@yahoo.com
trustmankind@yahoo.com
ocelia_25@hotmail.com
johnnymark90@yahoo.com
ms6al@hotmail.com
tranlonghk@yahoo.com.vn
n33dle_pro@yahoo.com
zq2012@gail.com
it.kurdish@gmail.com
asds@aol.com
magret.canard@free.fr
sada@gmail.com
ajibade12@yahoo.com
akuffo@live.com
woodseric1234@gmail.com
zebi44204@zebi44204.fr
vietkal@yahoo.com
h4k4zworld@yahoo.com
ggggghh6@gmail.com
asasa@as.vn
senxyhrdp@shop.ru
nokiatl79@gmail.com
baget@tormail.org
toine_df@yahoo.com
techsupport025@gmail.com
oluuman@gmail.com
test1@yopmail.com
ivy004@rocketmail.com
dhristo@dr.com
alcane98@yopmail.com
tayson@mail.ru
ht-_-k@hotmail.com
identitydavid@gmail.com
gizobouy@yahoo.com
blessedfellow@msn.com
cvv.lord@yahoo.com
wyzzoo@yahoo.com
m.2g900@yahoo.com
ansahgyimah@yahoo.com
crazycanada@tormail.org
esfahanlove@aol.com
paypal@sdfsd.de
nega@live.com
boss.h43ker@yahoo.com
minch1982@gmail.com
karragerj@yahoo.com
elgenero_55@yahoo.com
drilon-al@live.com
rudethugist@yahoo.com
gimwd@hotmail.com
nagato_ad@hotmail.fr
one-dz@hotmail.com
are@jefw.com
asdasd@yahoo.com
davan.cecile@gmail.com
beulaeq8503@hotmail.com
denis.soto50@yahoo.com
jone4788@yahoo.com
lovegreentea89@gmail.com
paulkaka27@gmail.com
rich_jah@yahoo.com
marciosantos277@yahoo.com.br
cccandy75@yahoo.com
samuelsm79@gmail.com
digit_spamer@yahoo.com
jimmy_brown12345@yahoo.co.uk
iparadise31@yahoo.com
ikwere_baruki001@yahoo.com
sifangerke1@gmail.com
anthonio_debrasky@yahoo.com
mr.cute@talktalk.net
a.matt@live.dk
john.mark654@yahoo.com
fiona1978hk@gmail.com


Drilon (admin) 

1 comment:

  1. THIS IS OLD , HE WAS also my parter but now removed it and his saying i hacked lol

    ReplyDelete