Trojan-Spy.Win32.FtpSend.b

[Serg]

Code: [Select]

http://cs.rm510.com/ads.txt and http://cs.rm510.com/ftpdata.asp already in a base.
ads.txt includes some crypto

Code: [Select]

===
> ads.txt.1
> 0x000029 -> LinearXor(0x65,0x00) -> http://v.freefl.info/day.js
> http://v.freefl.info/day.js   
===
js writes iframes with exploits on

Code: [Select]

http://v.freefl.info/lz.htm
http://v.freefl.info/bf.htm
http://v.freefl.info/kong.htm


[JohnC]

Thanks.