hfgfr56745fg.com (Betabot http botnet hosted by ecatel.net)

Resolved hfgfr56745fg.com to Server:   hfgfr56745fg.com Gate file:  /rem/order.php Brian Krebs on the login page  It still crashes skype. Sample here A previous version of the bot was posted here. Hosting infos: http://whois.domaintools.com/

lolwutirc.crabdance.com (Insomnia irc botnet hosted by rh.com.tr)

Resolved lolwutirc.crabdance.com to Server:  lolwutirc.crabdance.com Port:  6667 Channel:  #bot123 Oper: [KyleFYI] (KyleFYI@Kyle123irc): …[KyleFYI] #bot123 [KyleFYI] irc.localhost.com :bytestyle symmetry[KyleFYI] is a Network Administrator[KyleFYI] is available for help. Hosting infos: http://whois.domaintools.com/

filehelp.us (Various irc bots hosted by securedservers.com)

Resolved filehelp.us to Athena Server:  filehelp.us Port:  7200 Channel:  #Athena Insomnia Server:  filehelp.us Port:  4242 Channel:  #insomnia Channel password:  k6geyzs Dixie bot Server:  filehelp.us Port:  4242 Channel:  #DDoS# hxxp://filehelp.us/Panel/gate.php aryan bot Server Password: Username: 5644413 Nickname: New{DE-XP-x86}5644413 Channel: #aryan (Password: k6geyzs) Channeltopic: :.dl hxxp://filehelp.us/upload/files/bin.exe 1 Other samples here hxxp://filehelp.us/upload/ Opers are Vapor and

webingenial.com (ngrBot irc botnet hosted by hosting.ua)

Resolved webingenial.com to Server:  webingenial.com Port:  1865 Channel:  #main Channel password:   4m3r1k4 Topic for #main is: .m on .mdns http://interactua.edu30.com/php.txt Topic for #main set by fuckoff at Thu Feb 07 10:32:31 2013 php.txt www.banamex.com www.banamex.com.mx banamex.com banamex.com.mx bancanet.boveda.banamex.com.mx boveda.banamex.com.mx www.bancanetempresarial.banamex.com.mx Looks like he’s pharming for Mexican

mom003.net (ngrBot irc botnet hosted by Serverius.com)

Resolved mom003.net to, Server:  mom003.net (other domains: mom002.net, mom004.net) Port:  1887 Server password:  speedd Channel:  #bon2 Channel password:  speedd Topic for #xp is: ~dw hxxp://www.sendspace.com/pro/dl/1wzt65 e6bd0bd11484b27ca4f162421a4d423b ~dw hxxp://www.sendspace.com/pro/dl/a3he3l 3c2df1fd533d955c462faaaef03bab02 Topic for #xp set by google at Tue Feb 05 11:49:09 2013 Bots also join #XP, #W7 or #VIS depending on their operating system.

oppnetspeed.co.ua (Andromeda http botnet hosted by Panamaserver.com)

C&C Discovered by Malekal Morte Resolved oppnetspeed.co.ua to Server:  oppnetspeed.co.ua Gate file:  /forum/images/image.php Plugins Rootkit:  /forum/r.pack All the info you would ever need to know about his server can be found on these handy pages. Hosting infos: http://whois.domaintools.com/