mostvideo2012.no-ip.info (AryaN and Barracuda irc botnets hosted by Russian Federation Beringovskiy Mediaserviceplus Ltd.)

Resolved mostvideo2012.no-ip.info to 192.162.102.212

Server:  mostvideo2012.no-ip.info
Port:  4562
Server password:  leroumain49

 Channel          Users   Topic
 #plouque         41      [+nt]
 #mafia           2       [+nt]
 #arisauve        66      [+nt]
 #bio             3       [+nt] 

AryaN bots
Channel:  #arisauve
Channel password:  leroumain49
Channel: #bio

Barracuda bots
Channel:  #plouque
Channel: #mafia

Command nick is RutE94
RutE94 (~RutE94@User-CD7BBD3D.rev.numericable.fr) has joined #plouque
RutE94 !botkill
[CATALIN-PC]58632  Startup Cleaned, all bots in startup terminated. Thanks for using Barracuda Bot Killer!
[BOGDAN-PC]20572  Startup Cleaned, all bots in startup terminated. Thanks for using Barracuda Bot Killer!
[FERNANDO-PC]903  Startup Cleaned, all bots in startup terminated. Thanks for using Barracuda Bot Killer!

I’m surprised anyone still uses the barracuda irc bot. If you remember the previous posts about it, the auth mechanism is broken, requiring only the correct nick to gain complete control of the bots.

Hosting infos:  http://whois.domaintools.com/192.162.102.212

Categories: Uncategorized