www.mydowncenter.me (Andromeda http botnet hosted by pw-service.com)

Resolved www.mydowncenter.me to

Server:  www.mydowncenter.me
Gate file:  /andro/image.php

Rootkit:  hxxp://www.mydowncenter.me/andro/r.pack
Socks:  hxxp://www.mydowncenter.me/andro/s.pack
Formgrabber:  hxxp://www.mydowncenter.me/andro/f.pack
  Gate file:  /andro/fg.php

Hosting infos: http://whois.domaintools.com/

Related md5s (search on malwr.com to download the samples):
Andromeda: a26ffa2c7bd0e7899b04768f9e76a938

Categories: Uncategorized


Anonymous - June 6, 2013 at 11:12 pm

there's also an athena http hosted on the same site that gave orders to download that sample (version 1.0.8, hosted in root – gate file is /gate.php)
. it also ordered to download another exe that was 404'd

Anonymous - June 7, 2013 at 4:00 am

Also Athena HTTP


Comments are closed