uokmate.info (Insomnia irc botnet hosted by volumedrive.com)

Resolved uokmate.info to Server:   uokmate.info Port:  8527 * There are 1 users and 114 invisible on 1 servers* 3 :channels formed Channel:  #Insomnia  #Insomnia        103     [+sntu] Hosting infos: http://whois.domaintools.com/ (Multiple http botnets hosted by sentris.com)

Andromeda Server: Gate file:  /andro/image.php Plugins Rootkit: Socks: Formgrabber:   Gate file:  /andro/fg.php Smoke loader Server: Gate file:  /smoke/index.php Pony Server: Gate file:  /p/gate.php POE stealer Server: Gate file /poe/index.php Login details are admin:admin Hosting infos: http://whois.domaintools.com/ EDIT: I see he’s trying bitcoin mining Mining infos: hosted in Kazakhstan Almaty Jsc Kazakhtelecom)

Pony Gate: Pony admin login: Pony-legit-packed s.exe inside pony package is Autoiframer Bot, Version 1.0 here some strings from the sample: File: ZR1.exe Size: 193552 Bytes MD5: A889A2ADAFEFF5A16AFF93DD668B763C Packer: File not found C:peid.exe File Properties: CompanyName FileDescription FileVersion InternalName LegalCopyright OriginalFilename ProductName ProductVersion Exploit Signatures: ————————————————————————— Scanning for 19 signatures Scan Complete: 212Kb in 0,016 hosted in United States Scranton Network Operations Center Inc.)

C&C Server: Server Password: Username: fbidqck Nickname: n{DE|XPa}fbidqck Channel: #pool (Password: leonis)  Channeltopic: :~pu hxxp://www.sendspace.com/pro/dl/3qtgh8 da611193656522f073e0e64c8a65969a -r Downloads this file wich is another ngrbotnet:hxxp:// sample was found by our turkish kebap friend aLiSs hosting infos: http://whois.domaintools.com/

google-analystic-356.org (Carperb banking malware hosted by fartingghost.com)

Resolved google-analystic-356.org to Server:   google-analystic-356.org Gate file:  Not sure how carperb works for this, it seems to just post to random strings with random filetypes. You can see those here Backup domains: google-analystic-594.org google-analystic-462.pro  Neither of these has been registered yet, register them, ddos the others and steal some bots today. (won’t actually

srv5050.asia/pro/in (snk asper mod hosted by United Kingdom Birmingham Compuweb Communications Services Limited)

Resolved srv5050.asia to Resolved srv5050.pro to This is snk’s new set of domains for his bot. Server:  srv5050.asia (backup domains are srv5050.pro and srv5050.in) Port:  5050 Channel:  #new * Topic for #new is: .j #gt .d /100/97/111/124/49/59/47/127/124/127/58/64/116/118/98/124/102/100/48/127/101/100/57/107/112/38/96/93/121/ * Topic for #new set by x at Sun Dec 23 16:33:45 2012 Channel:  #gt *

afkm.in (snk asper mod hosted by United Kingdom Birmingham Compuweb Communications Services Limited)

Resolved afkm.in to snk is cycling through his old domains, trying to move the bots onto his new ones. Server: Port:  5050 Channel:  #$ * Topic for #$ is: .d /100/97/111/124/49/59/47/107/104/97/118/79/99/123/46/126/119/116/49/115/46/117/110/105/* Topic for #$ set by x at Sun Dec 23 14:19:00 2012 Channel:  #l * Topic for #l is: .d /100/97/111/124/49/59/47/105/111/111/102/66/103/119/105/115/118/101/109/120/103/126/56/111/112/38/112/78/51/100/111/62/70/112/98/*

a.loader.ws (andromeda http botnet and multi lock winlocker hosted by koddos.net)

Resolved a.loader.ws to Andromeda Server:  a.loader.ws Gate file:  /ad/image.php Plugins Rootkit:  http://a.loader.ws/ad/r.pack Socks:  http://a.loader.ws/ad/s.pack Formgrabber:  http://a.loader.ws/ad/f.pack   Gate file:  /ad/fg.php Multilocker Server:  a.loader.ws Gate file:  /l/lending/tds.php UPDATE: New domain used from the hecker: Resolved : [j87gyuh7uh.org] To [] the rest is same files paths etc from same guy 2 domains not activated yet j87gyuh7uh.org

gwassss.com (Insomnia irc botnet hosted by volumedrive.com)

Resolved gwassss.com to Server: Port:   8527 Channel:  #Insomnia * Topic for #Insomnia is: /b/ * Topic for #Insomnia set by lucky at Sat Dec 22 10:24:28 2012 Oper: [{AR|XP-32a}yknranh] (lucky@Vandernet): … [{AR|XP-32a}yknranh] @#Insomnia [{AR|XP-32a}yknranh] www.Privatenet.gov :im an orphan [{AR|XP-32a}yknranh] idle 00:01:45, signon: Sun Dec 23 16:54:16[{AR|XP-32a}yknranh] End of WHOIS list. Hosting infos: