Resolved : [support.leetpm.info] To [208.125.158.219]
Resolved : [support.leetpm.info] To [91.121.232.87]
Resolved : [support.leetpm.info] To [46.249.71.18]
Resolved : [support.leetpm.info] To [189.35.205.123]
Resolved : [support.leetpm.info] To [59.180.210.189]
Download URLs
http://107.20.230.29/u/69321915/Bl.exe (dl.dropbox.com)
C&C Server: 91.121.232.87:6667
Server Password:
Username: 3952
Nickname: {NEW}[DEU][XP]366531
Channel: #snowz# (Password: )
Channeltopic: :.dl http://dl.dropbox.com/u/69321915/Bl.exe
Topic By: [ a ]
Now talking in #sw#
Topic On: [ #sw# ] [ .dl http://dl.dropbox.com/u/68141128/v/r/java.exe ]
Topic By: [ V ]
hosting infos:
http://whois.domaintools.com/91.121.232.87
Anonymous - March 28, 2012 at 10:32 pm
haha Lamer using dropbox.
HINT FOR BURIMI: Idiot they submit files to VirusTotal.
Anonymous - November 4, 2013 at 5:15 pm
This botnet belongs to same people as:
http://www.exposedbotnets.com/2013/05/werehackedjpirc-botnet-hosted-in-france.html
http://www.exposedbotnets.com/2013/05/irce-qacscomirc-botnet-hosted-in.html
http://www.exposedbotnets.com/2013/05/hiloldumporgirc-botnet-hosted-in-france.html
st0n3d, Jack, TCL, x00