Scam Report Against @doener2323 and @NicolasM99 , ValoSharp

[143]

Scammers Profile Link: https://cracked.sh/doener2323 https://cracked.sh/NicolasM99
Sales Thread: https://cracked.sh/Thread-Sellix-1-VALOS...ree-Trials
Amount or Item(s) Scammed: big amount
Screenshots of Communication: https://cdn.discordapp.com/attachments/9...nknown.png  after dumping strings with process hacker found this https://cdn.discordapp.com/attachments/9...nknown.png exodus wallet stealer with webhook, 
Additional Information: Hey 30m ago i got valosharp files, and i dumped strings with process hacker to see if this file infected or not, and i found in strings it sends your exodus wallet files to their webhook https://cdn.discordapp.com/attachments/9...Wallet.zip the files they take used webhook https://discord.com/api/webhooks/9624668...iS-mobIy27 also they download this weirdo exe on the pc when you run exe https://cdn.discordapp.com/attachments/9..._ELITE.exe checker files to verify this with dumping strings https://cdn.discordapp.com/attachments/9...harpcs.zip,  screen shot from process hacker

Crypto address for a refund:

[0]

System bot message: @doener2323 (doener2323), @NicolasM99 (NicolasM99) have been notified about this dispute via private messages and have 24hours to reply in this thread

 

Taking care of cracked.sh's leechers. Every day.
If you have a question regarding your leeching level, click here.

[184]

i verify this, old version has hit stealer 
new version has exodus Stealer + RAT (They r so fking clowns)

0x2da7738 (192): https://cdn.discordapp.com/attachments/9..._ELITE.exe || RAT DON'T DOWNLOAD

[16]

Scammers Profile Link: https://cracked.sh/doener2323 https://cracked.sh/NicolasM99
Sales Thread: https://cracked.sh/Thread-Sellix-1-VALOS...ree-Trials
Amount or Item(s) Scammed: big amount
Screenshots of Communication: https://cdn.discordapp.com/attachments/9...nknown.png  after dumping strings with process hacker found this https://cdn.discordapp.com/attachments/9...nknown.png exodus wallet stealer with webhook, 
Additional Information: Hey 30m ago i got valosharp files, and i dumped strings with process hacker to see if this file infected or not, and i found in strings it sends your exodus wallet files to their webhook https://cdn.discordapp.com/attachments/9...Wallet.zip the files they take used webhook https://discord.com/api/webhooks/9624668...iS-mobIy27 also they download this weirdo exe on the pc when you run exe https://cdn.discordapp.com/attachments/9..._ELITE.exe checker files to verify this with dumping strings https://cdn.discordapp.com/attachments/9...harpcs.zip,  screen shot from process hacker

Crypto address for a refund:

wh1ter0se betrayed valosharp doener and nicolas miller got nothing to do with it

Discord https://discord.gg/4QyWKAzJpQ

[143]

Scammers Profile Link: https://cracked.sh/doener2323 https://cracked.sh/NicolasM99
Sales Thread: https://cracked.sh/Thread-Sellix-1-VALOS...ree-Trials
Amount or Item(s) Scammed: big amount
Screenshots of Communication: https://cdn.discordapp.com/attachments/9...nknown.png  after dumping strings with process hacker found this https://cdn.discordapp.com/attachments/9...nknown.png exodus wallet stealer with webhook, 
Additional Information: Hey 30m ago i got valosharp files, and i dumped strings with process hacker to see if this file infected or not, and i found in strings it sends your exodus wallet files to their webhook https://cdn.discordapp.com/attachments/9...Wallet.zip the files they take used webhook https://discord.com/api/webhooks/9624668...iS-mobIy27 also they download this weirdo exe on the pc when you run exe https://cdn.discordapp.com/attachments/9..._ELITE.exe checker files to verify this with dumping strings https://cdn.discordapp.com/attachments/9...harpcs.zip,  screen shot from process hacker

Crypto address for a refund:

wh1ter0se betrayed valosharp doener and nicolas miller got nothing to do with it

idc they shouldve checked the source thats violation

[57]

Hey, so i actually made this checker in python once and then actually (i am being honest) wanted to steal my customer‘s hits once. I released a version with the dualhook for like 30 minutes and then deleted it again as it was bugging & i was feeling bad. So then I released the version without the dualhook. -> never stole any of my customers hits, as it didnt work + i never implemented it later then anymore
After valokeker exposed me then, I made another python build with „better“ obfuscation but then some other people unfortunately cracked it again. Since then I was looking for a solution for that and came to the idea, that I should rewrite our checker in C#. But as I didn‘t have any c# knowledge I asked a good friend (wh1ter0se - wh1ter0se#1337) who has UHQ obfuscations and shit and is a big brain to help me out with protecting the checker from being cracked. Then he told me that he was ready to help me out, and I rewrote the checker from scratch into C# within 48 hours. When I finally then finished the checker, I gave him the source code for him to build the exe & obfuscate it for me (I trusted him 100%). Then I released the version which wh1ter0se sent to me and it was bugging (didn‘t work on RDP‘s and shit) and then he told me that he virtualized my exec and that the loops in my code cause the obfuscation being incompatible with my checker. So then he released sent a „fixed“ version which was still not working and then sent me another one without virtualization which worked pretty fine for everyone. Then there weren‘t any problems for the next days and we could just basically lay back and watch our customers being satisfied. However I then received a message from Toffy (an admin from us) that our checker is a logger & probably a rat which made me confused as I didn‘t know anything about this. So then I was starting to become suspicious about wh1ter0se and started asking him out about shit. He told me that virustotal flags everything. He had many excuses which made me believing him so I just left this shit going on as I couldn‘t prove if he‘s lying or not + none of my customers havent reported lost money on their wallet or anything similar yet. So then I received a message that valokeker announced, that we are ratting people and stealing their wallets and I was like panicking and didnt know whats going on. Then I saw the webhook stuff and the webhook urls and dmed wh1ter0se about that stuff. After I spammed him he blocked me and I didn‘t know what to do.











sending more chats soon, going 2 sleep mow

btw tharwat (valokeker) mass dmed our server

[184]

that reason he added hit stealer before

[143]

1- You used Logging System Via webhook to get notified For everyone who logins
2- The checker have only 1 working webhook
2- The Exodus Stealer Works Via webhook

So there is Webhook For Users logins, Stealer
but only 1 webhook working "Facepalm"
and this takes us to

the webhook of users login which Doener Have it is same as exodus webhook stealer