trik.su (Snk aspermod irc botnet hosted by midphase.com)

Uncategorized

Resolved trik.su to 174.127.123.4 Server:  trik.su Port:  5050 Channel:  #trk #trk :.j #upd .u trk2 /120/126/99/107/25/61/37/112/72/120/110/67/113/123/122/115/35/64/118/114/35/123/85/74/78/111/125/83/8/55/46/39/32/63/42/55/63/35/44/11/42/38/32/37/120/110/121/ Channel:  #upd #upd :.u trk2 /120/126/99/107/25/61/37/103/86/99/120/83/100/118/123/98/98/13/108/108/35/123/85/74/15/107/97/69/ Hosting info: http://whois.domaintools.com/174.127.123.4 Related md5s (Download samples from Malwr.com) Aspermod: 1f876d3830527f22f84205069695d3d2

vvvhhhccc.com (Betabot http botnet hosted by dacentec.com)

Uncategorized

Resolved vvvhhhccc.com to 192.111.153.98 Server:  vvvhhhccc.com Gate file:  /8/8/8/be/order.php Alternate domains: virusprotect.su virus-protector.net latinodancewears.com.vn He has a plasma http botnet on the same domain that he is using to mine dogecoins. Gate file:  /8/8/plasma/login.php Hosting info: http://whois.domaintools.com/192.111.153.98 Related md5s (Download samples from Malwr.com) Betabot: a58ddb7a7a3b823ff0ddd541f136d9f4 Plasma: 401459ef275cf0639a855a4dff234bf5 Mining info: Stratum+tcp://pool.dogechain.info:3333 -u latinodresses.plasmahttp -p x

googleisearch.com (ferret DDOS botnet hosted by sigmait.dk)

Uncategorized

Resolved googleisearch.com to 195.20.141.115 Server:  googleisearch.com Gate file:  /tmp/search.php The panel is version 2.2, indicating continued development since it’s discovery.    Hosting info: http://whois.domaintools.com/195.20.141.115 Related md5s (Download samples from Malwr.com) Ferret: bcf167ad78a41f695b766531ed3a6fea

iappleblog.net (Betabot http botnet hosted by ubris-hosting.com)

Uncategorized

Resolved iappleblog.net to 37.9.55.98 Server:  iappleblog.net Gate file:  /img/beta/order.php Alternate domains: iapplegeek.com androidistore.net This is the first betabot 1.7 I’ve seen in the wild. Thanks to Xylitol for the C&C info. Looks like the network signatures need to be updated Hosting info: http://whois.domaintools.com/37.9.55.98 Related md5s (Download sample from Malwr.com) Betabot: 5f3b16af36bfa193a222222035c7321c