(Betabot http botnet hosted by

Resolved to

Gate file:  /b/order.php

Alternate domain:

This botnet wasn’t actually mining bitcoins when I checked it. I’m very surprised.

Hosting infos:

Related md5s (search on to download the samples):
Beta bot bbfdbd53810751401b720641687a6116

EDIT: It finally started bitcoin mining

Mining infos:
macromedia.exe” -a scrypt -o -u -p dododo -g no -t 8
Shell.exe” -a sha256 -o -u j2244_cr -p cheese -t 0 -I 1

A blackshades exe hosted on the server points to, which currently points to, a residential IP.

EDIT: He has a new version using the same domains with a new gate location.
New gate file:  /swedftmfp/order.php

New md5: 316c434e77df2976934f574db68ce257

Categories: Uncategorized