Malware Domain List

Malware Related => Malicious Domains => Topic started by: tom_ on July 15, 2009, 10:02:01 pm

Title: 2 URLs that appeared on yahoo groups today
Post by: tom_ on July 15, 2009, 10:02:01 pm
patipezy.freehostking.com

dulofady.hostevo.com

These were in posts made by an account we know to be compromised.
Title: Re: 2 URLs that appeared on yahoo groups today
Post by: MysteryFCM on July 15, 2009, 10:11:40 pm
Both load a script from;

Code: [Select]
http://3ttman.com/ok2.htm
Which loads;

Code: [Select]
http://lipesr.com/update/?eb70c8bc3e184ffe5a98905e484546d9
Which I'm working on decoding :)
Title: Re: 2 URLs that appeared on yahoo groups today
Post by: MysteryFCM on July 15, 2009, 10:23:09 pm
JSUnpack, Wepawet and Malzilla have all sadly failed to decode it :( manual decoding has also failed.
Title: Re: 2 URLs that appeared on yahoo groups today
Post by: CM_MWR on July 15, 2009, 11:56:20 pm
Odd one....mystery check the priv section