voscomptesenligne.eu(Andromeda Bot hosted in Netherlands International Widespread Services Limited)

Sample found by ALiSs

urls’s:
hxxp://voscomptesenligne.eu/joomla/image.php
hxxp://www.curboc.com/joomla/image.php

Plugins:
hxxp://voscomptesenligne.eu/joomla/f.pack
hxxp://voscomptesenligne.eu/joomla/s.pack
hxxp://voscomptesenligne.eu/joomla/r.pack
hxxp://www.curboc.com
/joomla/f.pack

hxxp://www.curboc.com
/joomla/s.pack 

hxxp://www.curboc.com
/joomla/r.pack
hxxp://voscomptesenligne.eu/joomla/fg.php?id=1880376902

Love Poem dedicated to Brian Krebs here: hxxp://voscomptesenligne.eu/

Same Poem here : hxxp://www.curboc.com

Samples:
hxxp://91.223.82.147/andro.exe
hxxp://www.curboc.com/andro.exe
hxxp://www.curboc.com/miner.exe
hxxp://voscomptesenligne.eu/miner.exe

miner.exe downloads: hxxp://93.113.171.18/upl/pYofXDkAVERHbkeo/m.jpg (www.fisier.ro)

hosting infos:
http://whois.domaintools.com/91.223.82.179