(Installs crap hosted by

Resolved to

I found a file on h4r3’s latest andromeda that downloaded a bunch of crap from this site.

hxxp:// Smoke loader, posted here

hxxp:// is a bitcoin miner, uses 50btc
Mining info:
Since he’s using no account mode we can snoop on his mining by plugging in his address on the 50btc website:


By plugging the address into we can see how much he has made so far and where he has spent it:

Total Received:    5.07081977 BTC

That works out to $67.7 based on current prices. The first input into the account was on 2012-11-30, so it works out to about $4.2 dollars a day. Pretty shitty mining.

hxxp:// This is zeroaccess, getting to be a popular affilate choice. snk installs this as well.

hxxp:// More affilate crap, not sure what botnet it is.

Finally the file reports in at with some long hash that I’m assuming is unique to each machine.

Hosting infos:

EDIT: New bitcoin mining infos:
Stats link:
Address info:

EDIT: The domain is no longer being used, now it’s just an IP address. hxxp:// The same filenames are used.