(Andromeda http botnet hosted by Up2vps.com)

This was loaded from snk’s latest irc net.
The bot is pretty strange, as it tries to connect to five unregistered domains before connecting to the ip.
Here they are: amnsreiuojy.ru amnsreiuojy.in amnsreiuojy.biz amnsreiuojy.com amnsreiuojy.nl 

Gate file:  /sg.php 

It appears to be some sort of Facebook spreader.

hosting infos: http://whois.domaintools.com/

Categories: Uncategorized


Anonymous - January 30, 2013 at 3:28 pm

also :
POST http://amnsreiuojy.biz/sg.php – DIRECT/ text/html

    Pig - January 30, 2013 at 4:03 pm

    thank you for this
    please next time replace http with hxxp in your links

Anonymous - February 2, 2013 at 4:35 am

Do you have the exe for this?

Comments are closed