Tag: irc bot

gigasbh.org(IRC Botnet Hosted In France Paris 1&1 Internet Ag)

Domains Domain                    IP f.eastmoon.pl s.richlab.pl gigasbh.org IRC Traffic >> NICK {USA-XPx86a}cwecttyo >> USER cwectty 7949 7840 :cwectty >> MODE {USA-XPx86a}cwecttyo +iwG >> JOIN #sp yap >> PING 422 MOTD << 332 {USA-XPx86a}cwecttyo #sp : << 333 {USA-XPx86a}cwecttyo #sp x 1436609273 >> PONG 422 botnet hosted in Netherlands Amsterdam Ecatel Ltd)

Botnet found by sPy. Only server and port no channels here because no exe file to see for more. Feel free to check for channels ur self. Connecting to (6667) Invisible Users 12: 12 3554Operators: 2 operator(s) onlineChannels: 12 channels formedClients: I have 3555 clients and 0 serversLocal users: 3555 29989 Current local users

gki2mpdt3rsokbmv.onion (Irc botnet hosted on a Tor hidden service)

Server:  gki2mpdt3rsokbmv.onion Port:  6667 Channel:  #channel Oper: [wac] (wac@9bedb2.host): ac[wac] #channel[wac] lair.hell.net :Cerberus Server[wac] idle 00:00:18, signon: Tue May 13 18:24:47[wac] End of WHOIS list. The owner must have used very old bot code to create this, as it fails to work properly on windows 7 and higher. Related md5s (Download sample from Malwr.com) Ircbot:

keshmoney.biz(irc botnet hosted in France Roubaix Ovh Systems)

Found by AliSs Server: keshmoney.biz:6667 Channel: #all,#x00 password 777.#boss Bitcoin Miner: hxxp://knal.wut.re:8332 -u bram226_1 Hosted in this link: hxxp://noinei90.sommadue.it/Built.exe Sample here Hosting infos: http://whois.domaintools.com/

y.osej36.com (Irc botnet hosted by gandi.net)

Resolved y.osej36.com to Server:  y.osej36.com Port:  80 Server password:  passwd Channel:  #root Channel password:  redem !NAZEL hxxp://www12.0zz0.com/2013/06/21/20/723860853.png a392564eae140562e4b27d0ab078ba1e !NAZEL hxxp://upload.tehran98.com/img1/9kxogpyfckk2xwuzzn6j.png a392564eae140562e4b27d0ab078ba1e !s -n A modified ircd is used, so you may have trouble connecting. Alternate domains: y.v23sdy.com y.rwt234.com Bitcoin mining info:  minerd.exe -a scrypt -s 20 –no-longpoll -q -o za.oisdj.com:443 -u anonymous.1 -p -x

z.joerv02.com(irc botnet hosted in China Nanjing Chinanet Jiangsu Province Network)

Name                     Query Type               Query Result        Successful        Protocol api.wipmania.com      DNS_TYPE_A      YES                   udp z.baerr02.com          DNS_TYPE_A                                     NO                    udp z.joerv02.com          DNS_TYPE_A         YES                    udp Server: z.joerv02.com:6513 PASS smart Channels: #dpi,#suk.#sar PASS smart botnet hosted in Netherlands Amsterdam Rens Ariens Trading As Your Internet Service Provider)

Server: channel: #pirelli Now talking in #pirelli Topic On: [ #pirelli ] [ !down /99/106/112/81/55/59/40/125/111/122/35/110/105/106/100/107/119/122/121/59/106/120/102/9/71/113/109/127/105/99/54/56/52/50/49/22/48/55/59/15/44/52/51/40/99/101/ 12] Topic By: [ x ] credits to aLiSs for finding this botnet hosting infos: http://whois.domaintools.com/