I’ve decided to clear out for the end of the year, here are all the irc nets I never posted because they had pathetically small numbers of bots. Server: tannervps.no-ip.org Port: 6969 Current Local Users: 2 Max: 23 Channel: #tentob #tentob 2 // This is including me Bot: insomnia Server: irc.stressing.info Port: 6667 Channel #liptonRead more...
3vi.tv(Pony hosted in Russian Federation Moscow Oversun-mercury Ltd)
Resolved : [3vi.tv] To [188.127.255.49] 3vi.tv/images/gate.php From Userbased: http://3vi.tv/l/guest.php guest:guest vuln here sample here hosting infos: http://whois.domaintools.com/188.127.255.49
img152200.servepics.com (Smoke loader hosted by kimsufi.com)
Resolved img152200.servepics.com to 94.23.213.78 Server: img152200.servepics.com Gate file: /x3/index.php This is h4r3’s smoke, he has his andromeda hosted on the same server. Hosting infos: http://whois.domaintools.com/94.23.213.78
gwasnet.net (Spyeye banking malware hosted by ecatel.net)
Resolved gwasnet.net to 80.82.78.90 Server: gwasnet.net Gate file: /smd/gwas/nothing.php Yet another skid decides to try out “spyeye for bot herding”. Thanks to the anonymous commenter here for the sample. Hosting infos: http://whois.domaintools.com/80.82.78.90
sharesend.info (smoke loader http botnet hosted by voxility.net)
Resolved sharesend.info to 37.221.170.8 Server: sharesend.info Gate file: /admin/index.php A pity the guest.php credentials have been changed from the default or fun could have be had. Download the panel from here if you want it: hxxp://sharesend.info/admin/admin.zip Hosting infos: http://whois.domaintools.com/37.221.170.8
198.8.81.127 (Pony http loader hosted by coloat.com)
Server: 198.8.81.127 Gate file: /Panel/gate.php Starting to see some pony bots now that it’s been leaked. FYI, pony just grabs passwords and uploads them, then downloads any files that are hard coded into it. If you set it to run at startup you’ll just get the same shit every time. Hosting infos: http://whois.domaintools.com/198.8.81.127
919computech.com (Andromeda http botnet and stealer hosted by main-hosting.com)
Resolved 919computech.com to 31.170.162.85 Andromeda Server: 919computech.com Gate file: /Panel/image.php Stealer Server: 919computech.com Gate file: /stealer/index.php also there is a vertexnet panel at /web/, but I don’t think anyone uses that crap anymore. Hosting infos: http://whois.domaintools.com/31.170.162.85
84mb samples
Another package around 84mb full of banking trojan samples, irc bots ,exploit packs etc have fun and remember only for analysis Source Source
jackhammermusic.com (Andromeda http botnet hosted by justhost.com)
Resolved jackhammermusic.com to 173.254.28.39 Server: jackhammermusic.com Gate file: /images/id/image.php There’s also a shell booter located at jackhammermusic.com/test/ Looks like it’s out of shells though. jackhammermusic.com/test/shells.php Hosting infos: http://whois.domaintools.com/173.254.28.39 EDIT: Now with 100% more bitcoin mining. Mining infos: http://Juan:Johnxd32ssS@pool.bitclockers.com:8332
4temp704.com (andromeda http botnet hosted by Seychelles Victoria Business Dialogue Ltd)
Resolved 4temp704.com to 91.217.178.32 Server: 4temp704.com Gate file: /Panel/image.php hosting infos: http://whois.domaintools.com/91.217.178.32