Resolved www.vbvx.com to 94.23.56.186
Server: www.vbvx.com
Gate file: /remote/order.php
Bitcoin mining info:
Shell.exe” -o http://vbvx.com:8344 -u shubhank008_work -p plawasthi -t 0 -I 10
macromedia.exe” -o http://vbvx.com:8344 -u shubhank008_work -p plawasthi -g no -t 2
Looks like he’s running a mining proxy on his vps.
Hosting infos: http://whois.domaintools.com/94.23.56.186
Related md5s (search on malwr.com to download the samples):
Betabot: 76e38897f2c56a4b0c99cf275dc4c06b
Bitcoin miner: faa2191fcb4edd68d669ba10db5d872f