I believe someone moved this thread from another sub-forum to Virus & Spyware.   I don't know that this is the type of "analysis" ever done here. Unless someone else wishes to comment, all I can do is offer you some common-sense advice:   If you haven't already done so, contact your bank and credit card company to alert them to the potential fraud.   You may also consider contacting the major credit bureaus, Experian, Equifax, and TransUnion.
My Bank account just got hacked, and apparently it happened yesterday. It's registered that there were multiple purchases through Steam (a PC gaming platform), and that my Credit Card was used, and therefore assumed that either my Credit Card information was stolen or someone got into my Bank Account. So I checked my router (ASUS RT-AC87U) and found this in the logs: Sep 4 11:59:59 ntp: start NTP updateSep 4 12:01:01 HTTP login: Detect abnormal logins at 5 times. The newest one was from 207.172.85.203.Sep 4 12:01:02 HTTP login: Detect abnormal logins at 10 times. The newest one was from 207.172.85.203.Sep 4 12:01:02 HTTP login: Detect abnormal logins at 15 times. The newest one was from 207.172.85.203.Sep 4 12:01:03 HTTP login: Detect abnormal logins at 20 times. The newest one was from 207.172.85.203.Sep 4 12:01:03 HTTP login: Detect abnormal logins at 25 times. The newest one was from 207.172.85.203.Sep 4 12:01:04 HTTP login: Detect abnormal logins at 30 times. The newest one was from 207.172.85.203.Sep 4 12:01:04 HTTP login: Detect abnormal logins at 35 times. The newest one was from 207.172.85.203.Sep 4 12:01:05 HTTP login: Detect abnormal logins at 40 times. The newest one was from 207.172.85.203.Sep 4 12:01:05 HTTP login: Detect abnormal logins at 45 times. The newest one was from 207.172.85.203.Sep 4 12:01:06 HTTP login: Detect abnormal logins at 50 times. The newest one was from 207.172.85.203. And this message repeats over and over up to this: Sep 4 12:05:55 HTTP login: Detect abnormal logins at 2845 times. The newest one was from 207.172.85.203.Sep 4 12:05:55 HTTP login: Detect abnormal logins at 2850 times. The newest one was from 207.172.85.203.Sep 4 12:35:37 miniupnpd[17490]: Expired NAT-PMP mapping port 57477 UDP removedSep 4 12:35:37 miniupnpd[17490]: Expired NAT-PMP mapping port 57477 TCP removedSep 4 13:00:01 ntp: start NTP update The logs then continue with more commands like the 'Expired port' message, and some more updates. Can someone tell me what exactly happened, and what I should do from this point forward? Thank you! Side note: I myself have a Steam account, but my Computer with the Steam account logged in from was not on at the time that the Steam transaction happened, and my Steam Account receipt logs have no record of purchases happening within the last week.
Suspicious Router Activity, Bank Account got hacked. Can you help?