Liberty Exploit System kit

[Malware-Web-Threats]

Exploits / Trojan Zbot

Code: [Select]

aol-update-installer.cn/cc/index.php
aol-update-installer.cn/cc/ethicsModel.pdf
aol-update-installer.cn/cc/ciceroHidden.swf
aol-update-installer.cn/cc/update.php
aol-update-installer.cn/cc/update.exe
aol-update-installer.cn/cc/admin.php

http://wepawet.iseclab.org/view.php?hash=911c68226b424c4176afad72cec9dbaa&t=1253822351&type=js
http://www.threatexpert.com/report.aspx?md5=77d95cee87843d00102d80ca5050781e
http://www.virustotal.com/analisis/40076fbd5df9e5c793238ae5351844a914f09592102178b231d291c866e5d176-1253804293 - 38/41 (92.68%)

zbot config file:

Code: [Select]

adobe-updating-service.cn/zs/cfg.bin


[sursmurf]

Code: [Select]

http://lioleng.org/white/evenNormal.pdf
VT 4/41
http://www.virustotal.com/sv/analisis/4b025e6bd80a48195eabb64dfa8155e3aeb9f3a008480ff6da96b038b6141ca4-1253988897

Code: [Select]

http://lioleng.org/white/sinceIs.swf
VT7/41
http://www.virustotal.com/sv/analisis/0ada9634aa07818278356853cdbd2b83bcecbd0e5b1f60656f82a3f067c24f94-1253988927

Code: [Select]

http://lioleng.org/white/update.php?id=6
VT 13/41
http://www.virustotal.com/sv/analisis/453e04127107891ba516791cf94deec60e1843586ddd1786f31fe2da535fc59a-1253988993

[RS-232]

hxxp://worknssrv.cn/
->
hxxp://meankirdo.info/white/index.php

hxxp://biodentri.com/white/

[Malware-Web-Threats]

Code: [Select]

wmforum.cn/up1/
wmforum.cn/up1/ethicsFor.pdf
wmforum.cn/up1/lookHiddenPoint.swf
wmforum.cn/up1/update.php
wmforum.cn/up1/update.exe
wmforum.cn/up1/admin.php
http://wepawet.iseclab.org/view.php?hash=5a0b8a503de01de9a97881f2df110c33&t=1255185133&type=js

[Malware-Web-Threats]

another one:

Code: [Select]

toringgo.cn/images/go.php?sid=6
toringgo.cn/turino/index.php
toringgo.cn/turino/sIpsum.pdf
toringgo.cn/turino/useSUsing.swf
toringgo.cn/turino/update.php
toringgo.cn/turino/update.exe
toringgo.cn/turino/admin.php


[Malware-Web-Threats]

Code: [Select]

soldenga.cn/versa/index.php
soldenga.cn/versa/everIt.pdf
soldenga.cn/versa/update.php
soldenga.cn/versa/update.exe
soldenga.cn/versa/admin.php


Code: [Select]

olandon.com/versa/index.php
olandon.com/versa/everIt.pdf
olandon.com/versa/update.php
olandon.com/versa/update.exe
olandon.com/versa/admin.php


Code: [Select]

82.98.235.187/versa/index.php
82.98.235.187/versa/everIt.pdf
82.98.235.187/versa/update.php
82.98.235.187/versa/update.exe
82.98.235.187/versa/admin.php


[Malware-Web-Threats]

Code: [Select]

homut1.cn/1/index.php
homut1.cn/1/thereHas.pdf
homut1.cn/1/haveHas.swf
homut1.cn/1/update.exe
homut1.cn/1/admin.php