Month: June 2013

sisisu.su (Citadel banking malware hosted by he.net)

By I_Post_Ur_Info, June 18, 2013
Uncategorized

Resolved sisisu.su to 64.62.210.103 Server:  sisisu.su Config file:  /wheelbarrow/file.php Gate file:  /wheelbarrow/prism.php Currently being downloaded by this betabot. This is his second attempt at a citadel net, the first one can be found here. Hosting infos: http://whois.domaintools.com/64.62.210.103 Related md5s (search on malwr.com to download the samples): Citadel: 5707e28e79f6b6d469874f8b87ecb3b9  Edit: The moron forgot to remove theRead more...

kalurjaq.ru(Kelihos hosted in Kazakhstan Almaty Jsc Almatv)

By Pig, June 17, 2013
Uncategorized

Kelihos (also know as Hlux) is a Spambot with the capability to steal credentials from the victims computer and drop additional malware. While the old version used the second level domain cz.cc for it’s distribution and to control the botnet, the new version takes advantage of TLD .eu in combination with Fast Flux techniques. HTTPRead more...

z.joerv02.com(irc botnet hosted in China Nanjing Chinanet Jiangsu Province Network)

By Pig, June 15, 2013
Uncategorized

Name                     Query Type               Query Result        Successful        Protocol api.wipmania.com      DNS_TYPE_A      69.197.137.58      YES                   udp z.baerr02.com          DNS_TYPE_A                                     NO                    udp z.joerv02.com          DNS_TYPE_A       58.221.60.87         YES                    udp Server: z.joerv02.com:6513 PASS smart Channels: #dpi,#suk.#sar PASS smartRead more...

skyline2050.net (Andromeda http botnet hosted by infiumhost.com)

By I_Post_Ur_Info, June 12, 2013
Uncategorized

Resolved skyline2050.net to 188.190.127.160 Server:  skyline2050.net Gate file:  /761994/gate.php This is andromeda 2.07, not the cracked 2.06. You can tell by the admin page located at /adm.php, not on the index page. The owner of this betabot is updating with this, abandoning the betabot. Mining infos:  dum:dum@s5.6d6f6e65797072696e746572.com:3333 Hosting infos: http://whois.domaintools.com/188.190.127.160 Related md5s (search on malwr.comRead more...

64.85.233.8 (Citadel banking malware hosted by home ip?)

By I_Post_Ur_Info, June 10, 2013
Uncategorized

Server:   64.85.233.8 Config file:  /hide/1355/file.php Gate file:  /hide/1355/enter.php According to whois, this is a home cable internet ip (United States Concord Astound Broadband). Also on the server, smoke loader and pony Smoke Server:  64.85.233.8 Gate file:  /smokeldr/index.php Pony Server:  64.85.233.8 Gate file:  /js/gate.php The moron running this has Pony downloading itself, creating a continuousRead more...