img14.poco.cn(HTTP Banking trojan hosted in China Shanghai Chinanet Shanghai Province Network)

Resolved : [img14.poco.cn] To [101.226.200.132]
Resolved : [img14.poco.cn] To [101.226.200.130]
Resolved : [img14.poco.cn] To [61.183.42.151]
Resolved : [img14.poco.cn] To [101.226.200.134]
Resolved : [img14.poco.cn] To [101.226.200.152]
Resolved : [img14.poco.cn] To [61.183.42.150]

Samples:

hxxp://www.ccfyi.com/notepad.exe
hxxp://www.ccfyi.com/mstsc.exe

hxxp://www.ccfyi.com/cc.tx
timg14.poco.cn GET /mypoco/myphoto/20130323/19/874940020130323195257040.jpg
hxxp://174.139.56.114:54321/1.txt

1.txt:

67.198.167.37 keb.co.kr
67.198.167.37    keb.co.kr
67.198.167.37 www.keb.co.kr
67.198.167.37    www.keb.co.kr
67.198.167.37 citibank.co.kr
67.198.167.37    citibank.co.kr
67.198.167.37 www.citibank.co.kr
67.198.167.37    www.citibank.co.kr
67.198.167.37 www.secbank.co.kr
67.198.167.37    www.secbank.co.kr
67.198.167.37 secbank.co.kr
67.198.167.37    secbank.co.kr
67.198.167.37 ibs.kfcc.co.kr
67.198.167.37    ibs.kfcc.co.kr
67.198.167.37 www.kfcc.co.kr
67.198.167.37    www.kfcc.co.kr
67.198.167.37 open.ibk.co.kr
67.198.167.37    open.ibk.co.kr
67.198.167.37 kiup.ibk.co.kr
67.198.167.37    kiup.ibk.co.kr
67.198.167.37 mybank.ibk.co.kr
67.198.167.37    mybank.ibk.co.kr
67.198.167.37 www.ibk.co.kr
67.198.167.37    www.ibk.co.kr
67.198.167.37 www.epostbank.go.kr
67.198.167.37    www.epostbank.go.kr
67.198.167.37 epost.go.kr
67.198.167.37    epost.go.kr
67.198.167.37 www.epost.co.kr
67.198.167.37    www.epost.co.kr
67.198.167.37 open.shinhan.com
67.198.167.37    open shinhan.com
67.198.167.37 bizbank.shinhan.com
67.198.167.37    bizbank.shinhan.com
67.198.167.37 banking.shinhan.com
67.198.167.37    banking.shinhan.com
67.198.167.37 www.shinhan.com
67.198.167.37    www.shinhan.com
67.198.167.37 obiz.kbstar.com
67.198.167.37    obiz.kbstar.com
67.198.167.37 kbstar.com
67.198.167.37    kbstar.com
67.198.167.37 www.kbstar.com
67.198.167.37    www.kbstar.com
67.198.167.37 obank.kbstar.com
67.198.167.37    obank.kbstar.com
67.198.167.37 open.hanabank.com
67.198.167.37    open.hanabank.com
67.198.167.37 hanabank.chzero.com
67.198.167.37    hanabank.chzero.com
67.198.167.37 www.hanabank.com
67.198.167.37    www.hanabank.com
67.198.167.37 hanabank.com
67.198.167.37    hanabank.com
67.198.167.37 u.wooribank.com
67.198.167.37    u.wooribank.com
67.198.167.37 spd.wooribank.com
67.198.167.37    spd.wooribank.com
67.198.167.37 pid.wooribank.com
67.198.167.37    pid.wooribank.com
67.198.167.37 www.wooribank.com
67.198.167.37    www.wooribank.com
67.198.167.37 wooribank.com
67.198.167.37    wooribank.com
67.198.167.37 www.nonghyup.com
67.198.167.37    www.nonghyup.com
67.198.167.37 nonghyup.com
67.198.167.37    nonghyup.com
67.198.167.37 banking.nonghyup.com
67.198.167.37    banking.nonghyup.com

TCP Traffic:
174.139.56.114:8899

hosting infos:
http://whois.domaintools.com/101.226.200.132