Remote Host Port Number 82.192.87.164 80 91.121.243.240 3389 The data identified by the following URL was then requested from the remote web server: http://tmrace.net/v5/v5.php?action=logout exe file: http://c442cbf8.tubeviral.com hosting infos: http://whois.domaintools.com/91.121.243.240
92.241.165.124(irc botnet hosted in Russian Federation Moscow Oao Webalta)
Remote Host Port Number 212.7.214.59 80 216.178.38.224 80 63.135.80.46 80 72.21.91.19 80 92.241.165.124 1234 PASS xxx NICK NEW-[USA|00|P|01507] USER XP-5713 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|01507] -ix JOIN #!nw! test PONG 22 MOTD text file used to give cmd’s to bots index.txt: http://ef8488f8.tubeviral.com hosting infos: http://whois.domaintools.com/92.241.165.124
222.88.205.215(ngrBot hosted in China Henan Chinanet Henan Province Network)
Remote Host Port Number 199.15.234.7 80 66.45.56.124 80 69.71.57.254 80 70.38.98.238 80 222.88.205.215 5101 PASS hax0r PRIVMSG #% :[Visit]: Visited “http://g.1click.im/fY” PRIVMSG #p– :[d=”http://img104.herosh.com/2011/10/16/876345700.gif” s=”229376 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.tmp” – Download retries: 0 hosting infos: http://whois.domaintools.com/222.88.205.215
212.7.214.129(irc botnet hosted in Netherlands Dediserv Dedicated Servers Sp. Z O.o)
Remote Host Port Number 173.245.60.21 80 63.135.80.224 80 63.135.80.46 80 64.62.181.43 80 72.21.91.19 80 212.7.214.129 2866 PASS xxx NICK NEW-[USA|00|P|77494] USER XP-8936 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|77494] -ix JOIN #!nine! test PONG 22 MOTD * The data identified by the following URLs was then requested from the remote web server: o http://www.refillntime.com/sweet.txt o http://browseusers.myspace.com/Browse/Browse.aspx oRead more...
212.7.214.129(ngrBot hosted in Netherlands Dediserv Dedicated Servers Sp. Z O.o)
Remote Host Port Number 199.15.234.7 80 83.233.33.6 80 212.7.214.129 1866 PASS ngrBot PRIVMSG #!hot! :[DNS]: Blocked 1310 domain(s) – Redirected 0 domain(s) NICK n{US|XPa}rzvcxsk USER rzvcxsk 0 0 :rzvcxsk JOIN #!hot! ngrBot PRIVMSG #!hot! :[HTTP]: Updated HTTP spread interval to “3” PRIVMSG #!hot! :[MSN]: Updated MSN spread interval to “2” PRIVMSG #!hot! :[HTTP]: Updated HTTPRead more...
119.59.99.239(ngrBot hosted in Thailand Bangkok 453 Ladplacout Jorakhaebua)
Remote Host Port Number 119.59.99.239 1234 PASS priv9 199.15.234.7 80 NICK n{US|XP}fktrfon USER fktrfon 0 0 :fktrfon JOIN #ngr HELO hosting infos: http://whois.domaintools.com/119.59.99.239
60.190.223.150(ngrBot hosted in China Zhejiang Ninbo Lanzhong Network Ltd)
Remote Host Port Number 199.15.234.7 80 66.45.56.124 80 69.71.57.93 80 70.38.98.238 80 60.190.223.150 5101 PASS hax0r PRIVMSG #p– :[d=”http://img104.herosh.com/2011/10/16/876345700.gif” s=”229376 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.tmp” – Download retries: 0 PRIVMSG #% :[Visit]: Visited “http://cpv.onlinelivesearch.com/cpv.jsp?p=113890&aid=10036145&partnerMin=0.00&ron=on&ronMin=0.00&url=&context=&default=http://cpvback.onlinelivesearch.com/ads.php” channel:#ngme ng00 hosting infos: http://whois.domaintools.com/60.190.223.150
ngrBot v1.3 multilanguage spreading
looks like fubar and jam3s are developing this lame bot in private now the version 1.3 have diferent update and spreading commands the code here is given to bots in .txt file with list of commands to be executed from the bot u can download the exe file from links below link1: http://02a4bc0e.urlbeat.net link2: http://59b97c61.urlbeat.net
109.68.191.166(ngrBot hosted in Russian Federation Moscow Jsc Tel Company)
Remote Host Port Number 109.68.191.166 1234 PASS xxx 173.245.60.21 80 212.7.214.59 80 216.178.39.11 80 63.135.80.224 80 72.21.91.19 80 NICK NEW-[USA|00|P|72548] USER XP-8030 * 0 :COMPUTERNAME MODE NEW-[USA|00|P|72548] -ix JOIN #!nw! test PONG 22 MOTD hosting infos: http://whois.domaintools.com/109.68.191.166
80mb malware samples
This package contains alot of irc bot samples,worms like fworm etc,email spreaders,rootkits and banking trojans have fun Download: http://c45d041d.urlbeat.net