Month: December 2012

shitty little nets run by shitty people

I’ve decided to clear out for the end of the year, here are all the irc nets I never posted because they had pathetically small numbers of bots. Server:  tannervps.no-ip.org Port:  6969 Current Local Users: 2  Max: 23 Channel:  #tentob  #tentob          2        // This is including me Bot:  insomnia Server:  irc.stressing.info Port:  6667 Channel #lipton

gwasnet.net (Spyeye banking malware hosted by ecatel.net)

Resolved gwasnet.net to 80.82.78.90 Server:  gwasnet.net Gate file:  /smd/gwas/nothing.php Yet another skid decides to try out “spyeye for bot herding”. Thanks to the anonymous commenter here for the sample. Hosting infos: http://whois.domaintools.com/80.82.78.90

sharesend.info (smoke loader http botnet hosted by voxility.net)

Resolved sharesend.info to 37.221.170.8 Server:   sharesend.info Gate file:  /admin/index.php A pity the guest.php credentials have been changed from the default or fun could have be had. Download the panel from here if you want it: hxxp://sharesend.info/admin/admin.zip Hosting infos: http://whois.domaintools.com/37.221.170.8

198.8.81.127 (Pony http loader hosted by coloat.com)

Server:  198.8.81.127 Gate file:  /Panel/gate.php Starting to see some pony bots now that it’s been leaked. FYI, pony just grabs passwords and uploads them, then downloads any files that are hard coded into it. If you set it to run at startup you’ll just get the same shit every time. Hosting infos: http://whois.domaintools.com/198.8.81.127

84mb samples

Another package around 84mb full of banking trojan samples, irc bots ,exploit packs etc have fun and remember only for analysis Source Source

jackhammermusic.com (Andromeda http botnet hosted by justhost.com)

Resolved jackhammermusic.com to 173.254.28.39 Server:  jackhammermusic.com Gate file:  /images/id/image.php There’s also a shell booter located at jackhammermusic.com/test/ Looks like it’s out of shells though. jackhammermusic.com/test/shells.php Hosting infos: http://whois.domaintools.com/173.254.28.39 EDIT:  Now with 100% more bitcoin mining. Mining infos: http://Juan:Johnxd32ssS@pool.bitclockers.com:8332