mirror.serverhalflife.com (Pandora http bot hosted by Netherlands Haarlem Leaseweb B.v.)

Resolved  mirror.serverhalflife.com to 95.211.209.178

Pandora ddos bot
Server: mirror.serverhalflife.com
Gate file:  /pando/?u=17b6n82405v5ycal3ks4bb7i655e088m

Other crap on the server
Microworm panel: mirror.serverhalflife.com/micro/
The password is “root”

Files are located at hxxp://mirror.serverhalflife.com/files/
blackdra.exe is blackshades
Connects to own3d-private.no-ip.org:4010

Blackshades downloads more of the files

x0x0.294.24.10.10.0.2.15.0.0.0.Federal-Agent.FBI-PC.1.Microsoft Windows XP
.522.0.5.0.58802054.0.new.November 4, 2012.Hide My Ass Vpn FBI access panel (Welcome Agent Hogue) [Google Chrome]
x74.64.e4e497e1ec0a03c3e5e49ab8868bdc755b520583cbf4e31605a016d82147ec63x25x1.8.1.1..0.0x49.49.
hxxp://mirror.servehalflife.com/files/micro.exe.2x49.49.hxxp://mirror.servehalflife.com/files/steal.exe.2x49.52.
hxxp://mirror.servehalflife.com/files/blackdra.exe.2x105x74.7.UNKNOWNx53.1.0x114.1.0x53

Hosting infos: http://whois.domaintools.com/95.211.209.178

Categories: Uncategorized

4 Comments

Anonymous - November 4, 2012 at 9:28 pm

Wow, Hide My Ass VPN. Someone didn't learn anything from LulzSec. lol

Anonymous - November 5, 2012 at 5:11 pm

Hey. Kind of as a reader, got any post of how you are finding all of the bots? I have started running a few honeypots myself but from the findings it's mostly old stuff or "backnoice".

Any tips would be awsome

    I_Post_Ur_Info - November 7, 2012 at 2:07 pm

    You won't find that much by running listening honeypots, as no new bots are doing any scanning that I know of. Check out http://support.clean-mx.de/clean-mx/viruses.php, and filter for alive responses and %exe in the url. Most of it will be adware or zeus, but some other stuff will show up. Sniff it in vbox and see where it leads.
    Most skid botnets are incredibly incestuous, so once you start listening in a channel you'll find plenty of others.

    Anonymous - November 7, 2012 at 5:02 pm

    Thanks alot for that answer 🙂

    that the way i been trying to do it before. but i never had a good source for samples, That's the reason i started the honeypot.

    This will be fun!

Comments are closed