Month: July 2011

IRC Botnet Host Malware: vnc.exe MD5: 0x962B127F456B05956DE254B0C68A767F IP: 72.10.160.166 / Host: ha3.ha2.ha1.us Location : CA, Canada NICK [00|USA|XP|SP2]-4374 USER yebse 0 0 :[00|USA|XP|SP2]-4374 JOIN #vnc USERHOST [00|USA|XP|SP2]-4374 MODE [00|USA|XP|SP2]-4374 +x Now talking in #vnc Topic On: [ #vnc ] [ Scanner VNC: ONline Link: http://www.fandefutebol.com.br/torcedores/vnc.exe] Topic By: [ Nogrod ] Modes On: [ #vnc ]Read more...

This is another sample from fake av used to infectd people asking them to download this antivirus wich is fake Sample was discovered by John Download link : http://www.multiupload.com/IGCWAUGNJR serial number: 2233-298080-3424(credits to xylitol for cracking it) Loader example by Xylitol: http://pastebin.com/qCxepgrp

Here is the elation bot from PhobiiA big hecker https://pastee.org/65fqw irc infos: 216.120.248.193:6667 PhobiiA use moded roxnet unrealircd he’s big hecker Hosting infos: http://whois.domaintools.com/216.120.248.193

Remote Host Port Number 64.69.44.51 4042 NICK new[USA|XP|COMPUTERNAME]kuffavh USER hh “” “lol” :hh JOIN #biznew# PONG 422 hosting infos: http://whois.domaintools.com/64.69.44.51

Remote Host Port Number 111.90.148.204 4042 PASS google_cache2.tmp NICK n[USA|XP]430406 USER 4304 “” “TsGh” :4304 JOIN #cash# abc PONG 422 PONG :irc.priv8net7.com hosting infos: http://whois.domaintools.com/111.90.148.204

– DNS Queries: envc.machcar.kr DNS_TYPE_A 222.24.94.15 vhosts.packmanbd.com DNS_TYPE_A 222.24.94.19 222.24.94.19 – HTTP Conversations: 222.24.94.15:80 – [envc.machcar.kr] Request: POST /envc.php Response: 200 “OK” 222.24.94.19:80 – [vhosts.packmanbd.com] Request: GET /manual/vhosts.txt Response: 200 “OK” Url used to infect people: http://pedofilia.warbe.org/id/noticias/g1.globo.com/pedofilia/2011/0-19384pastor-e-filmado-fazendo-sexo-oral-com-adolescente.php?0.82545 Direct download: http://pedofilia.warbe.org/id/noticias/g1.globo.com/pedofilia/2011/videos-pedofilia-1039-pastor-fazendo-sexo-oral-com-adolescente-AVI.exe Hosting infos: http://whois.domaintools.com/122.160.131.225

Remote Host Port Number ssh.mytijn.org 8782 PASS weed NICK {iNF-00-USA-XP-COMP-1493} USER blaze * 0 :COMP NICK {00-USA-XP-COMP-6216} hosting infos: http://whois.domaintools.com/117.211.84.155

HTTP Malware from Russia used to ddos Admin Panel: http://area.myarena.ru/ex/adm/auth.php – DNS Queries: area.myarena.ru DNS_TYPE_A 62.122.213.10 http://palmary73.net DNS_TYPE_A – HTTP Conversations: 62.122.213.10:80 – [area.myarena.ru] Request: GET /ex/?uid=035409&ver=9aXPA Response: 200 “OK” Request: GET /ex/adm/?uid=035409&ver=9aXPA Response: 302 “Found” Request: GET /ex/adm/auth.php Response: 200 “OK” Request: GET /ex/adm/index.php?uid=035409&ver=9aXPA Response: 302 “Found” Request: GET /ex/adm/auth.php Response: 200 “OK” ExeRead more...

Remote Host Port Number 178.211.58.11 2525 NICK {ORG-XP-USA}756551 USER 7565 “” “TsGh” :7565 JOIN ##Kuzen bla PONG :irc.clupversai.com Now talking in ##Kuzen Topic On: [ ##Kuzen ] [ ] Topic By: [ OrgeneraL ] hosting infos: http://whois.domaintools.com/178.211.58.11

safetysamvps.info:6667 Resolved : [safetysamvps.info] To [216.24.203.254] EXE FILE: http://fanaras.gr/up/catroot.exe if someone find more infos about this botnet post them here hosting infos: http://whois.domaintools.com/216.24.203.254