This morning (Tue, 13 Dec 2022) I received an e-mail with the subject
READ OR GO TO JAIL!
It was in the spam folder, but due to the exclamation mark it seemed important.
Of course I don't have time to go to jail (although I might visit my old inmates at some point), so I read the mail...
Hi, I keep the whole story short.
Nice. As already indicated, I don't have much time anyway.
Your device got infected with my private trojan, it gave me access to all your files, accounts and contacts.
Sorry to interrupt, but that's a lot of info at once, and I haven't had my coffee yet.
First of all, what do you mean by 'private' trojan? Do you have public ones as well?
Secondly... I understand that such a tool allows you to read all my files, and view all my images (Btw. did you find my lingerie pics? Admittedly they're a bit hard to detect - see C:/User/Pictures/priv/2009/may/underware/eros/ if you're interested. I crochetted all that garment myself, and I think they look gorgeous on my hairy body, especially the pink underpants, oh-lala!). However, what accounts/contacts are you speaking of? I thought I accidentally deleted those MySpace credentials decades ago. Also, I once had a contacts list in a text file which sadly seemed to have disappered when this damn E: partition crashed in 2012. You're saying this data still exists on my hard disk? Wow, I had no clue, that's great. The MySpace credentials I don't care, but could you please tell me where this old contacts list is? I'd need the phone number of a guy who still owes me some money. Thanks alot in advance :)
Check the sender of this email, I sent it from your email account.
Ok, checked it. The sender string reads "asaguare@raschedv.net", yes; it's called 'Return-Path'. Hmmm... either you really sent it from my email account, or (what's more likely) you sent it from your own account, simply inserting my address in the Return-Path field; it's just a string, after all. Consider a thought experiment: Say, you get a postal letter, and the sender (written on the envelope) is your own name. Would you now think you've been hacked? LOL, that'd be quite naïve. Wait, are you that naïve?
I stole all your data and then I removed my trojan again, to not leave any traces.
For one, "stole all your data" means my hard disk is empty now? I just checked. All the usual directories and files are still there, hence you must have done something wrong. Or do you mean you 'copied' all my data? In other words, you kindly made a backup? Now I'm flattered, because 90% (~8 terabytes, mostly gay b-movies) of my data is actually downright crap, not worth your precious storage space, but hey, don't look a gift horse in the mouth :)
Oh, and thanks for removing that trojan afterwards. I totally respect people who clean up after them, for I'm quite the opposite :)
I KNOW EXACTLY ABOUT YOUR ILLEGAL ACTIVITIES!
Not sure what you mean by that. Activities? Me, the laziest bloke in town? On the other hand, I did some illegal stuff when I was waaay younger, sure, but you really can't know exactly how much material I took out of granma's cookie box, or can you? That's impressing.
It won't take a long time to send your data with the proof of your activities to the police.
Well, since I've already eaten the pieces of evidence back then - and I was a pretty quick eater in such circumstances - it will take a very long time (technically, an eternity) to send anything to the police, who are probably not interested in cookie crumbs (or stool samples) anyway.
If you want to avoid jail time, send 1400$ in Bitcoin (BTC) to my address.
Everybody wants to avoid jail time. But what do I know?
Aah, your mail is a petition for money? Get it. Let's see... 1400$. I'm in Germany, we have Euros here. Nevermind, you say you prefer Bitcoin. Fancy modern stuff. Really need some coffee now.
May I ask why it's this exact amount? Rent? Food? Alimony? New clothing? In the latter case I can send you loads of knitting patterns for crochetting stylish rags, e.g. underpants.
Why not demanding a round sum, like 1000$, or dare I say 2000$? Trust me, a willy-nilly number like 1400 is ridiculous, and doesn't impress anyone.
You can easily buy Bitcoin (BTC), just Google: "Where to buy Bitcoin (BTC)?".
Thanks for the info, but honestly, I guess I'm too old to investigate in new financial technologies. Wish I still had your optimism.
My address is: bc1qfzlmekudmjnhj88yjl8277zkzu6v9c2r890fan
Funny, it ends with 'fan' (suggesting you're a fan of such modern crap), did you notice that? :)
Yes, that's how the address looks like, just copy and paste it, the address is (CaSe-SenSitiVE).
I didn't question its look, it's just some kind of hash I think. And case-sensitive? I'm not allowed to upper-case it? What a bummer; sometimes, when I'm lacking coffee, I totally want to upper-case things.
You are given not more than 4 days after you have opened this email.
Why 4 days? Is that the time it takes to buy Bitcoin? Or does '3 days' sound too corny? Come to think of it, yes, there's a lot of bad movies containing a 3 days deadline, so I reckon '4 days' isn't that bad.
Another thing: you say 'after you have opened this email'. By what kind of mechanism do you get informed about me opening this mail which is pure passive text? Wouldn't this instead require HTML, that is, some inline script, or a dummy image loading trick?
And what if I had opened your mail only after 8 weeks; would these 4 days be added still? If yes, I admire your generosity. In my world nobody is given extra time when I already waited 8 weeks.
Once I get the payment, I will remove everything, be sure, I keep my promises.
Remove it... from your computer? Naah, I'm glad someone keeps a backup of my crap.
Or do you mean from MY computer? Oh, I forgot, you already removed your trojan; happy me. :)
Pro tip: never say "I keep my promises". Only people who don't keep promises say that. Live by your deeds, not your blabber. At least that's what my wise grandma blabbered.
Next time keep your device updated with the newest security patches.
You're implying my device isn't up-to-date? When you had access to my machine you should have noticed it patches automatically. Looks like your 'private' trojan can't be trusted; next time use a public trojan again. Just saying.
Before I forget... a header excerpt from your e-mail:
Return-Path: <asaguare@raschedv.net>
Authentication-Results: web.de; dkim=none
Received: from mout-xforward.kundenserver.de ([82.165.159.39]) by mx-ha.web.de (mxweb113 [212.227.17.8]) with ESMTPS (Nemesis) id 1MpEJR-1oaF3I1Jd9-00qkPY for <raschedv@web.de>; Tue, 13 Dec 2022 04:07:03 +0100
Received: from [217.72.192.67] ([217.72.192.67]) by mx.kundenserver.de (mxeue112 [217.72.192.67]) with ESMTP (Nemesis) id 1MrA7U-1oYKAs3GdS-00oJC6 for <raschedv@web.de>; Tue, 13 Dec 2022 04:07:03 +0100
Received: from [62.122.139.42] ([62.122.139.42]) by mx.kundenserver.de (mxeue112 [217.72.192.67]) with ESMTP (Nemesis) id 1N2kig-1owyZU3GW4-0135Bw for <asaguare@raschedv.net>; Tue, 13 Dec 2022 04:07:00 +0100
Received: from lnlldlt ([115.139.59.198]) by 98211.com with MailEnable ESMTP; Tue, 13 Dec 2022 08:07:02 +0500
Received: (qmail 09397 invoked by uid 093); 13 Dec 2022 08:07:00 +0500
From: asaguare@raschedv.net
To: asaguare@raschedv.net
Subject: READ OR GO TO JAIL!
Date: Tue, 13 Dec 2022 08:07:02 +0500
Message-ID: <093971.093971@98211.com>
Mime-Version: 1.0
Content-type: text/plain;
X-Spam-Flag: YES
...
From analyzing your sender IP (highlighted in blue) above, I learned (via https://ipinfo.io/115.139.59.198) that your mail server is located in Cheonan, Chungcheongnam-do, South Korea. What's the Korean word for 'troll' again? Aha, 'teulol', cute.
Now, that I know the coordinates (36.8021,127.1339), we could have one of my warfare satellites fire a proper gigawatt laser beam down into the vicinity - after I had my coffee, mind you. Shall we? Naah, kidding. Have a nice day :)