Malware Domain List

Malware Related => Malicious Domains => Topic started by: EP_X0FF on July 14, 2011, 04:09:16 pm

Title: Trojan Ransom
Post by: EP_X0FF on July 14, 2011, 04:09:16 pm: Hello,

the following links lead to malicious software known as

Trojan Ransom (Kaspersky)
Trojan Winlock (Dr.Web)
Trojan LockScreen (ESET)
TR/Ransom (Avira)

Quote
hxxp://archivpornovideo.info/1/video/porno-rolik1.avi.exe
hxxp://archivpornovideo.info/2/video/porno-rolik2.avi.exe
hxxp://archivpornovideo.info/3/video/porno-rolik3.avi.exe
hxxp://archivpornovideo.info/4/video/porno-rolik4.avi.exe
hxxp://archivpornovideo.info/6/video/porno-rolik6.avi.exe
hxxp://archivpornovideo.info/7/video/porno-rolik7.avi.exe
hxxp://archivpornovideo.info/8/video/porno-rolik8.avi.exe
hxxp://archivpornovideo.info/9/video/porno-rolik9.avi.exe

Domain name frequency mutates (10-15 times per day) but host IP always the same - 46.251.237.239

Another ransom known as Lock'Em'All - updates every day.

Quote
hxxp://4xrubin.s3.amazonaws.com/xxx_video.exe

Kind Regards.
Title: Re: Trojan Ransom
Post by: SysAdMini on July 14, 2011, 04:50:51 pm: Thanks for submission and welcome to MDL.

We will forward those domain names to GoDaddy abuse desk.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 14, 2011, 05:03:18 pm: Thanks.

Here are some other fresh links to ransoms

Quote
hxxp://rim2bi.s3.amazonaws.com/xxx_video.exe

and this is link to current MBR lock trojan.

Quote
hxxp://ssssaniedirki.ru/xxxvideo.avi.exe

Regards.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 15, 2011, 07:05:48 am: New ransoms.

MBRLocker hosts on one IP for a long time (only name changing constantly, 3-4 per day).

Quote
hxxp://govnobakovkaxxx.ru/xxxvideo.avi.exe
hxxp://vaginudetrhr.ru/xxxvideo.avi.exe

new one on amazon

Quote
hxxp://new3porn.s3.amazonaws.com/xxx_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 15, 2011, 09:08:18 am: New ransoms, on the same 46.251.237.239

Quote
hxxp://love-devushkivseti.info/1/video/porno-rolik1.avi.exe
hxxp://love-devushkivseti.info/2/video/porno-rolik2.avi.exe
hxxp://love-devushkivseti.info/3/video/porno-rolik3.avi.exe
hxxp://love-devushkivseti.info/4/video/porno-rolik4.avi.exe
hxxp://love-devushkivseti.info/6/video/porno-rolik6.avi.exe
hxxp://love-devushkivseti.info/7/video/porno-rolik7.avi.exe
hxxp://love-devushkivseti.info/8/video/porno-rolik8.avi.exe
hxxp://love-devushkivseti.info/9/video/porno-rolik9.avi.exe
hxxp://love-devushkivseti.info/10/video/porno-rolik10.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 15, 2011, 04:09:36 pm: ransoms from Amazon

Quote
hxxp://w2yporn.s3.amazonaws.com/xxx_video.exe
hxxp://w1porka.s3.amazonaws.com/xxx_video.exe

pornorolik ransoms

Quote
hxxp://kiss-lublutebya.info/1/video/porno-rolik1.avi.exe
hxxp://kiss-lublutebya.info/2/video/porno-rolik2.avi.exe
hxxp://kiss-lublutebya.info/3/video/porno-rolik3.avi.exe
hxxp://kiss-lublutebya.info/4/video/porno-rolik4.avi.exe
hxxp://kiss-lublutebya.info/6/video/porno-rolik6.avi.exe
hxxp://kiss-lublutebya.info/7/video/porno-rolik7.avi.exe
hxxp://kiss-lublutebya.info/8/video/porno-rolik8.avi.exe
hxxp://kiss-lublutebya.info/9/video/porno-rolik9.avi.exe
hxxp://kiss-lublutebya.info/10/video/porno-rolik10.avi.exe

MBRLocker fresh

Quote
hxxp://fatrmutrfaker.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 16, 2011, 02:47:29 pm: Amazon (all different samples)

Quote
hxxp://us1porn.s3.amazonaws.com/xxx_video.exe
hxxp://2bioko.s3.amazonaws.com/xxx_video.exe

Pornorolik

Quote
hxxp://xxxfilmaviforyou.info/1/video/porno-rolik1.avi.exe
hxxp://xxxfilmaviforyou.info/2/video/porno-rolik2.avi.exe
hxxp://xxxfilmaviforyou.info/3/video/porno-rolik3.avi.exe
hxxp://xxxfilmaviforyou.info/4/video/porno-rolik4.avi.exe
hxxp://xxxfilmaviforyou.info/6/video/porno-rolik6.avi.exe
hxxp://xxxfilmaviforyou.info/7/video/porno-rolik7.avi.exe
hxxp://xxxfilmaviforyou.info/8/video/porno-rolik8.avi.exe
hxxp://xxxfilmaviforyou.info/9/video/porno-rolik9.avi.exe
hxxp://xxxfilmaviforyou.info/10/video/porno-rolik10.avi.exe

MBRLocker (each address gives different sample)

Quote
hxxp://utubexxxvideo.ru/xxxvideo.avi.exe
hxxp://gigosporno.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 17, 2011, 11:19:54 am: Amazon (all different samples)

Quote
hxxp://gnpotk.s3.amazonaws.com/xxx_video.exe
hxxp://w3nixx.s3.amazonaws.com/xxx_video.exe
hxxp://sv2porn.s3.amazonaws.com/xxx_video.exe

Pornorolik

Quote
hxxp://hardsexfilmavi.info/1/video/porno-rolik1.avi.exe
hxxp://hardsexfilmavi.info/2/video/porno-rolik2.avi.exe
hxxp://hardsexfilmavi.info/3/video/porno-rolik3.avi.exe
hxxp://hardsexfilmavi.info/4/video/porno-rolik4.avi.exe
hxxp://hardsexfilmavi.info/6/video/porno-rolik6.avi.exe
hxxp://hardsexfilmavi.info/7/video/porno-rolik7.avi.exe
hxxp://hardsexfilmavi.info/8/video/porno-rolik8.avi.exe
hxxp://hardsexfilmavi.info/9/video/porno-rolik9.avi.exe
hxxp://hardsexfilmavi.info/10/video/porno-rolik10.avi.exe

MBRLocker

Quote
hxxp://dikiesu4ki.ru/xxxvideo.avi.exe
hxxp://RUSSIANSUKAVOM.ru/xxxvideo.avi.exe
hxxp://geffkiudaff.ru/xxxvideo.avi.exe
hxxp://udaffkom.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 17, 2011, 01:02:16 pm: Hope I'm not flooding very often :)

This is malware redirector used by Pornorolik ransom. It leads to new domains.

Quote
hxxp://dokoler-w.info/gischematest.cgi?14

by changing last id number you can go to different malware samples pages.

Hot Amazon ransom

Quote
hxxp://ffporm.s3.amazonaws.com/xxx_video.exe
Title: Re: Trojan Ransom
Post by: SysAdMini on July 17, 2011, 01:17:12 pm: Quote from: EP_X0FF on July 17, 2011, 01:02:16 pm
Hope I'm not flooding very often :)
No, it's ok. I appreciate your submissions.

Quote from: EP_X0FF on July 17, 2011, 01:02:16 pm
This is malware redirector used by Pornorolik ransom. It leads to new domains.

Code: [Select]
hxxp://dokoler-w.info/gischematest.cgi?14
by changing last id number you can go to different malware samples pages.

I can't find malware. Can you give me an example what you see ?
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 17, 2011, 01:23:27 pm: Currently it can't redirect to new domains because they all suspended (very fast response I see).

Perhaps we should just wait few hours :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 17, 2011, 04:38:08 pm: Pornorolik

Quote
hxxp://gigpornoforfree.ru/1/video/porno-rolik1.avi.exe
hxxp://gigpornoforfree.ru/2/video/porno-rolik2.avi.exe
hxxp://gigpornoforfree.ru/3/video/porno-rolik3.avi.exe
hxxp://gigpornoforfree.ru/4/video/porno-rolik4.avi.exe
hxxp://gigpornoforfree.ru/6/video/porno-rolik6.avi.exe
hxxp://gigpornoforfree.ru/7/video/porno-rolik7.avi.exe
hxxp://gigpornoforfree.ru/8/video/porno-rolik8.avi.exe
hxxp://gigpornoforfree.ru/9/video/porno-rolik9.avi.exe
hxxp://gigpornoforfree.ru/10/video/porno-rolik10.avi.exe

Redirector now works :)

For example
Quote
hxxp://dokoler-w.info/gischematest.cgi?13
redirects to
Quote
hxxp://gigpornoforfree.ru/3/porno.html
Title: Re: Trojan Ransom
Post by: SysAdMini on July 17, 2011, 04:46:50 pm: Quote from: EP_X0FF on July 17, 2011, 04:38:08 pm
Pornorolik

Redirector now works :)

For example
Quote
hxxp://dokoler-w.info/gischematest.cgi?13
redirects to
Quote
hxxp://gigpornoforfree.ru/3/porno.html

Doesn't work here. It always redirects to

Code: [Select]
hxxp://nightdate.ru/?tid=727&fo=1&gender=2
Target url probably depends on country.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 17, 2011, 05:35:53 pm: Quote
Target url probably depends on country.

Likely :)

Here is fresh Amazon sample

Quote
hxxp://3vvporn.s3.amazonaws.com/xxx_video.exe

MBRLocker

Quote
hxxp://fukudafcom.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: SysAdMini on July 17, 2011, 09:00:28 pm: Redirection still doesn't work for me. I have tried different user agents and from different countries.

Have you used a referrer ? What was your user agent ? From what country did you send requests ?

If you don't want to publish details, then please send me a PM.

Thanks.
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 17, 2011, 11:08:34 pm: Tried different countries, UAs and referers here too :(

Cheers for keeping us up to date :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 18, 2011, 01:44:34 am: dokoler-w.info suspended by GoDaddy.

No additional configurations I just used simple Internet Explorer with default settings :)
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 18, 2011, 02:33:52 am: No problem :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 18, 2011, 03:08:20 am: Amazon ransom

Quote
hxxp://4youporn.s3.amazonaws.com/xxx_video.exe

MBRLocker

Quote
hxxp://venkasexisdeffki.ru/xxxvideo.avi.exe

I don't know if it useful here, but unblock code for this MBRLocker is W887451D :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 18, 2011, 11:25:27 am: Amazon

Quote
hxxp://wq1porm.s3.amazonaws.com/xxx_video.exe

MBRLocker

Quote
hxxp://beladesiusconcha.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 18, 2011, 02:01:57 pm: Amazon ransom

Quote
hxxp://2tipornn.s3.amazonaws.com/xxx_video.exe

Pornorolik
By changing number from 1 to 10 you can get more samples (except number 4).

Example:

Quote
hxxp://besplatnomegaporno.ru/video/porno-rolik.avi.exe
hxxp://besplatnomegaporno.ru/1/video/porno-rolik1.avi.exe
hxxp://besplatnomegaporno.ru/2/video/porno-rolik2.avi.exe
hxxp://besplatnomegaporno.ru/3/video/porno-rolik3.avi.exe
hxxp://besplatnomegaporno.ru/4/video/porno-rolik4.avi.exe
hxxp://besplatnomegaporno.ru/6/video/porno-rolik6.avi.exe
hxxp://besplatnomegaporno.ru/7/video/porno-rolik7.avi.exe
hxxp://besplatnomegaporno.ru/8/video/porno-rolik8.avi.exe
hxxp://besplatnomegaporno.ru/9/video/porno-rolik9.avi.exe
hxxp://besplatnomegaporno.ru/10/video/porno-rolik10.avi.exe

MBRLocker

Quote
hxxp://FUKINGTHESHITGIRL.ru/xxxvideo.avi.exe
hxxp://xxxxxxxxxmove.ru/xxxvideo.avi.exe

P.S.

Regarding to old links, these following sites and their payload are dead

Quote
hxxp://ffporm.s3.amazonaws.com/xxx_video.exe DEAD
hxxp://sv2porn.s3.amazonaws.com/xxx_video.exe DEAD
hxxp://w3nixx.s3.amazonaws.com/xxx_video.exe DEAD
hxxp://gnpotk.s3.amazonaws.com/xxx_video.exe DEAD
hxxp://2bioko.s3.amazonaws.com/xxx_video.exe DEAD
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 18, 2011, 03:26:28 pm: Seems this is redirector for Amazon ransom

All path look like this

hxxp://xrvid-porno.com (216.137.41.107) -> hxxp://xrvid-porno.com/video.html (216.137.41.107) -> hxxp://ltizz.com/in.cgi?20 (95.211.111.86) -> hxxp://2tipornn.s3.amazonaws.com/index.htm (72.21.194.23) -> hxxp://2tipornn.s3.amazonaws.com/xxx_video.exe (72.21.194.23)

Probably Russian IP required.

Navigation was done from IE with default settings.

Excuse me, I mislabeled 2tipornn.s3.amazonaws.com as dead in previous post :(
Title: Re: Trojan Ransom
Post by: SysAdMini on July 18, 2011, 06:12:52 pm: Quote from: EP_X0FF on July 18, 2011, 03:26:28 pm
Seems this is redirector for Amazon ransom

All path look like this

hxxp://xrvid-porno.com (216.137.41.107) -> hxxp://xrvid-porno.com/video.html (216.137.41.107) -> hxxp://ltizz.com/in.cgi?20 (95.211.111.86) -> hxxp://2tipornn.s3.amazonaws.com/index.htm (72.21.194.23) -> hxxp://2tipornn.s3.amazonaws.com/xxx_video.exe (72.21.194.23)

Probably Russian IP required.

Navigation was done from IE with default settings.

works outside Russia too. ;)

Quote from: EP_X0FF on July 18, 2011, 03:26:28 pm
Excuse me, I mislabeled 2tipornn.s3.amazonaws.com as dead in previous post :(

No problem.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 19, 2011, 02:48:21 am: Amazon ransom

Quote
hxxp://hhn3por.s3.amazonaws.com/xxx_video.exe

MBRLocker

Quote
hxxp://xxxxxxxxxxxxxporno.ru/xxxvideo.avi.exe

Looks like this is redirector for Pornorolik ransom

Quote
hxxp://sdomankor.info/gierqwwn.cgi?13 (88.208.33.155) -> hxxp://pornositeforfree.ru/3/porno.html (46.251.237.240) -> hxxp://pornositeforfree.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
(currently it points to new domain name that distributes binaries that weren't modified since last pornorolik domains submission to MDL).
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 19, 2011, 10:46:24 am: MBRLocker (fresh and new)

Quote
hxxp://youngpornoseks.ru/xxxvideo.avi.exe

This is redirectors to MBRLocker

Quote
hxxp://tdschtotakoetds.ru/in.cgi?6 (212.124.110.134)
hxxp://habrmabrt.ru/in.cgi?4 (212.124.110.134)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 19, 2011, 01:03:48 pm: Amazon ransom

Quote
hxxp://sukporn1.s3.amazonaws.com/xxx_video.exe

also after suspending their previous redirector now this site leads to this ransom type

Quote
hxxp://s3.amazonaws.com/freepornx/index.html -> hxxp://s3.amazonaws.com/freepornx/video.htm -> hxxp://pornokiska.com/go.php?sid=1 -> hxxp://sukporn1.s3.amazonaws.com/ -> hxxp://sukporn1.s3.amazonaws.com/xxx_video.exe

Pornorolik updated with new binaries and unlock codes.

Quote
hxxp://megaavivideoporevo.ru/1/video/porno-rolik1.avi.exe
hxxp://megaavivideoporevo.ru/2/video/porno-rolik2.avi.exe
hxxp://megaavivideoporevo.ru/6/video/porno-rolik6.avi.exe
hxxp://megaavivideoporevo.ru/7/video/porno-rolik7.avi.exe
hxxp://megaavivideoporevo.ru/10/video/porno-rolik10.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 19, 2011, 02:23:36 pm: MBRLocker (fresh binary with new unblock code) :)

Quote
hxxp://videopornocam.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 19, 2011, 05:08:23 pm: MBRLocker (binary and unlock code new)

Quote
hxxp://habrmabrt.ru/in.cgi?4 (212.124.110.134) -> hxxp://pornyxaavi.ru/xxxvideo.avi.exe (91.220.0.35)

To get this redirector work, probalby required russian IP.
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 19, 2011, 05:41:25 pm: Any chance you can drop me the samples you've got of these so far please? (can't seem to get any of the redirs to work)
Title: Re: Trojan Ransom
Post by: SysAdMini on July 19, 2011, 05:45:28 pm: Cleanmx has posted some additional domains. I have inserted all of them into database.

http://www.malwaredomainlist.com/mdl.php?search=porno-rolik&colsearch=All&quantity=50
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 19, 2011, 06:18:43 pm: Quote from: MysteryFCM on July 19, 2011, 05:41:25 pm
Any chance you can drop me the samples you've got of these so far please? (can't seem to get any of the redirs to work)

Sure, I sent you PM with link to archive with two today samples, pass "malware" without quotes.
Please lets me know if something is wrong.
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 19, 2011, 09:23:21 pm: Much appreciated, cheers :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 20, 2011, 01:45:51 am: Amazon ransom

full trace below including redirector (pornomamaebet.com, registar PUBLICDOMAINREGISTRY.COM)

Quote
hxxp://s3.amazonaws.com/freepornx/index.html (72.21.194.15) -> hxxp://s3.amazonaws.com/freepornx/video.htm (72.21.194.15) -> hxxp://pornomamaebet.com/in.cgi?2 (95.211.111.86) -> hxxp://1qporka.s3.amazonaws.com/index.htm (72.21.194.23) -> hxxp://1qporka.s3.amazonaws.com/xxx_video.exe (72.21.194.23)

update, now redirects to
Quote
hxxp://hnyporka.s3.amazonaws.com/xxx_video.exe
, however previous location also working.

MBRLocker (active locations)

Quote
hxxp://avipornoonline.ru/xxxvideo.avi.exe
hxxp://megasyperxxx.ru/xxxvideo.avi.exe
hxxp://PORNYXAAVI.ru/xxxvideo.avi.exe

Below is list of domains which are reserved by ransom guys for future use (some of them already working, some just sleeping)
I'm sorry it's unfiltered, maybe some of them already listed here. This list is courtesy of mc0blck :)

Quote
hxxp://AVIPORNOONLINE.ru/
hxxp://AVIPORNOONLINE.ru/xxxvideo.avi.exe
hxxp://CAMSHOTPORNO.ru/
hxxp://CAMSHOTPORNO.ru/xxxvideo.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/
hxxp://CLUBTRAXTELOKSUPER.ru/video/porno-rolik.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/1/video/porno-rolik1.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/2/video/porno-rolik2.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/3/video/porno-rolik3.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/4/video/porno-rolik4.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/5/video/porno-rolik5.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/6/video/porno-rolik6.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/7/video/porno-rolik7.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/8/video/porno-rolik8.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/9/video/porno-rolik9.avi.exe
hxxp://CLUBTRAXTELOKSUPER.ru/10/video/porno-rolik10.avi.exe
hxxp://DADNMOMSPORNO.ru/
hxxp://DADNMOMSPORNO.ru/xxxvideo.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/
hxxp://GIGABAYTSTUDENTPORNO.ru/video/porno-rolik.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/1/video/porno-rolik1.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/2/video/porno-rolik2.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/3/video/porno-rolik3.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/4/video/porno-rolik4.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/5/video/porno-rolik5.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/6/video/porno-rolik6.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/7/video/porno-rolik7.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/8/video/porno-rolik8.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/9/video/porno-rolik9.avi.exe
hxxp://GIGABAYTSTUDENTPORNO.ru/10/video/porno-rolik10.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/
hxxp://MALOLETKIINSCHOOLPORNO.ru/video/porno-rolik.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/1/video/porno-rolik1.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/2/video/porno-rolik2.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/3/video/porno-rolik3.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/4/video/porno-rolik4.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/5/video/porno-rolik5.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/6/video/porno-rolik6.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/7/video/porno-rolik7.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/8/video/porno-rolik8.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/9/video/porno-rolik9.avi.exe
hxxp://MALOLETKIINSCHOOLPORNO.ru/10/video/porno-rolik10.avi.exe
hxxp://MEGAARCHIVETRAX.ru/
hxxp://MEGAARCHIVETRAX.ru/video/porno-rolik.avi.exe
hxxp://MEGAARCHIVETRAX.ru/1/video/porno-rolik1.avi.exe
hxxp://MEGAARCHIVETRAX.ru/2/video/porno-rolik2.avi.exe
hxxp://MEGAARCHIVETRAX.ru/3/video/porno-rolik3.avi.exe
hxxp://MEGAARCHIVETRAX.ru/4/video/porno-rolik4.avi.exe
hxxp://MEGAARCHIVETRAX.ru/5/video/porno-rolik5.avi.exe
hxxp://MEGAARCHIVETRAX.ru/6/video/porno-rolik6.avi.exe
hxxp://MEGAARCHIVETRAX.ru/7/video/porno-rolik7.avi.exe
hxxp://MEGAARCHIVETRAX.ru/8/video/porno-rolik8.avi.exe
hxxp://MEGAARCHIVETRAX.ru/9/video/porno-rolik9.avi.exe
hxxp://MEGAARCHIVETRAX.ru/10/video/porno-rolik10.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/
hxxp://MEGAARCHIVSCHOOLPORNO.ru/video/porno-rolik.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/1/video/porno-rolik1.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/2/video/porno-rolik2.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/3/video/porno-rolik3.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/4/video/porno-rolik4.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/5/video/porno-rolik5.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/6/video/porno-rolik6.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/7/video/porno-rolik7.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/8/video/porno-rolik8.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/9/video/porno-rolik9.avi.exe
hxxp://MEGAARCHIVSCHOOLPORNO.ru/10/video/porno-rolik10.avi.exe
hxxp://MEGASYPERXXX.ru/
hxxp://MEGASYPERXXX.ru/xxxvideo.avi.exe
hxxp://OOOPSMYPUSY.ru/
hxxp://OOOPSMYPUSY.ru/xxxvideo.avi.exe
hxxp://PORNOAGENTX.ru/
hxxp://PORNOAGENTX.ru/xxxvideo.avi.exe
hxxp://PORNOBESPLATNOXX.ru/
hxxp://PORNOBESPLATNOXX.ru/video/porno-rolik.avi.exe
hxxp://PORNOBESPLATNOXX.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOBESPLATNOXX.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOBESPLATNOXX.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOBESPLATNOXX.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOBESPLATNOXX.ru/5/video/porno-rolik5.avi.exe
hxxp://PORNOBESPLATNOXX.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOBESPLATNOXX.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOBESPLATNOXX.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOBESPLATNOXX.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOBESPLATNOXX.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/
hxxp://PORNOCLUBSMOTRIONLINE.ru/video/porno-rolik.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/5/video/porno-rolik5.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOCLUBSMOTRIONLINE.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNOSEKSAS.ru/
hxxp://PORNOSEKSAS.ru/xxxvideo.avi.exe
hxxp://PORNOSITEFORFREE.ru/
hxxp://PORNOSITEFORFREE.ru/video/porno-rolik.avi.exe
hxxp://PORNOSITEFORFREE.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOSITEFORFREE.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOSITEFORFREE.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOSITEFORFREE.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOSITEFORFREE.ru/5/video/porno-rolik5.avi.exe
hxxp://PORNOSITEFORFREE.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOSITEFORFREE.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOSITEFORFREE.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOSITEFORFREE.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOSITEFORFREE.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNYXAAVI.ru/
hxxp://PORNYXAAVI.ru/xxxvideo.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/
hxxp://PORVALIZELKUMALOLETKI.ru/video/porno-rolik.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/1/video/porno-rolik1.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/2/video/porno-rolik2.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/3/video/porno-rolik3.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/4/video/porno-rolik4.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/5/video/porno-rolik5.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/6/video/porno-rolik6.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/7/video/porno-rolik7.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/8/video/porno-rolik8.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/9/video/porno-rolik9.avi.exe
hxxp://PORVALIZELKUMALOLETKI.ru/10/video/porno-rolik10.avi.exe
hxxp://REDPUSSYX.ru/
hxxp://REDPUSSYX.ru/xxxvideo.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/
hxxp://SEXPOREVOTERRAARCHIV.ru/video/porno-rolik.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/1/video/porno-rolik1.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/2/video/porno-rolik2.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/3/video/porno-rolik3.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/4/video/porno-rolik4.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/5/video/porno-rolik5.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/6/video/porno-rolik6.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/7/video/porno-rolik7.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/8/video/porno-rolik8.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/9/video/porno-rolik9.avi.exe
hxxp://SEXPOREVOTERRAARCHIV.ru/10/video/porno-rolik10.avi.exe
hxxp://STUDENTDOMATRAX.ru/
hxxp://STUDENTDOMATRAX.ru/video/porno-rolik.avi.exe
hxxp://STUDENTDOMATRAX.ru/1/video/porno-rolik1.avi.exe
hxxp://STUDENTDOMATRAX.ru/2/video/porno-rolik2.avi.exe
hxxp://STUDENTDOMATRAX.ru/3/video/porno-rolik3.avi.exe
hxxp://STUDENTDOMATRAX.ru/4/video/porno-rolik4.avi.exe
hxxp://STUDENTDOMATRAX.ru/5/video/porno-rolik5.avi.exe
hxxp://STUDENTDOMATRAX.ru/6/video/porno-rolik6.avi.exe
hxxp://STUDENTDOMATRAX.ru/7/video/porno-rolik7.avi.exe
hxxp://STUDENTDOMATRAX.ru/8/video/porno-rolik8.avi.exe
hxxp://STUDENTDOMATRAX.ru/9/video/porno-rolik9.avi.exe
hxxp://STUDENTDOMATRAX.ru/10/video/porno-rolik10.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/video/porno-rolik.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/1/video/porno-rolik1.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/2/video/porno-rolik2.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/3/video/porno-rolik3.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/4/video/porno-rolik4.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/5/video/porno-rolik5.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/6/video/porno-rolik6.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/7/video/porno-rolik7.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/8/video/porno-rolik8.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/9/video/porno-rolik9.avi.exe
hxxp://SUPERMEGAARCHIVAVIPORNOSEXXXX.ru/10/video/porno-rolik10.avi.exe
hxxp://VIDEOPORNOCAM.ru/
hxxp://VIDEOPORNOCAM.ru/xxxvideo.avi.exe
hxxp://YOUNGPORNOSEKS.ru/
hxxp://YOUNGPORNOSEKS.ru/xxxvideo.avi.exe
hxxp://mnogomolodihtelokokporno.ru/
hxxp://mnogomolodihtelokokporno.ru/1/video/porno-rolik1.avi.exe
hxxp://mnogomolodihtelokokporno.ru/2/video/porno-rolik2.avi.exe
hxxp://mnogomolodihtelokokporno.ru/3/video/porno-rolik3.avi.exe
hxxp://mnogomolodihtelokokporno.ru/4/video/porno-rolik4.avi.exe
hxxp://mnogomolodihtelokokporno.ru/6/video/porno-rolik6.avi.exe
hxxp://mnogomolodihtelokokporno.ru/7/video/porno-rolik7.avi.exe
hxxp://mnogomolodihtelokokporno.ru/8/video/porno-rolik8.avi.exe
hxxp://mnogomolodihtelokokporno.ru/9/video/porno-rolik9.avi.exe
hxxp://mnogomolodihtelokokporno.ru/10/video/porno-rolik10.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 20, 2011, 10:30:06 am: Amazon

Quote
hxxp://llkzporn.s3.amazonaws.com/xxx_video.exe

MBRLocker (new build)

Quote
hxxp://pornoagentx.ru/xxxvideo.avi.exe

Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.
Title: Re: Trojan Ransom
Post by: mc0blck on July 20, 2011, 12:49:13 pm: Blocker: hxxp://sdomankor.info/gierqwwn.cgi?11 (88.208.33.155) -> hxxp://pornositexxx.ru/1/ (46.251.237.240) -> hxxp://pornositexxx.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/2/ (46.251.237.240) -> hxxp://pornositexxx.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/3/ (46.251.237.240) -> hxxp://pornositexxx.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/4/ (46.251.237.240) -> hxxp://pornositexxx.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
Blocker: hxxp://pornositexxx.ru/6/ (46.251.237.240) -> hxxp://pornositexxx.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 20, 2011, 04:35:51 pm: New redirector for Amazon ransom

hxxp://ebiporka.com/in.cgi?2

full path

Quote
hxxp://freepornx.s3.amazonaws.com/index.html -> hxxp://freepornx.s3.amazonaws.com/video.htm -> hxxp://ebiporka.com/in.cgi?2 -> hxxp://4tporl.s3.amazonaws.com/index.htm -> hxxp://4tporl.s3.amazonaws.com/xxx_video.exe
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 20, 2011, 04:56:49 pm: Quote from: EP_X0FF on July 20, 2011, 10:30:06 am
Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

Working on it ;)
Title: Re: Trojan Ransom
Post by: Amishrabbit on July 20, 2011, 06:31:38 pm: http://blog.webroot.com/2011/07/20/criminals-abuse-amazon-hosting-with-rogues-ransomware/
Title: Re: Trojan Ransom
Post by: cleanmx on July 20, 2011, 06:41:23 pm: Quote from: MysteryFCM on July 20, 2011, 04:56:49 pm
Quote from: EP_X0FF on July 20, 2011, 10:30:06 am
Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

Working on it ;)

I contacted their upstream provider, ripe -tel-nr of them is not allocated ....
update: I reached optimate-server.de on their cell phone, they promised to shut down this server
-- gerhard

Code: [Select]
|2011-07-18 14:53:00 CEST |913511 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/video/porno-rolik.avi.exe |2011-07-18 14:53:00 CEST |913512 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/1/video/porno-rolik1.avi.exe |2011-07-18 14:53:00 CEST |913513 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/2/video/porno-rolik2.avi.exe |2011-07-18 14:53:00 CEST |913514 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/3/video/porno-rolik3.avi.exe |2011-07-18 14:53:00 CEST |913515 |TR/Ransom.DN.18 |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/4/video/porno-rolik4.avi.exe |2011-07-18 14:53:00 CEST |913516 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/6/video/porno-rolik6.avi.exe |2011-07-18 14:53:00 CEST |913517 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/7/video/porno-rolik7.avi.exe |2011-07-18 14:53:00 CEST |913518 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/8/video/porno-rolik8.avi.exe |2011-07-18 14:53:00 CEST |913519 |TR/Ransom.DN.14 |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/9/video/porno-rolik9.avi.exe |2011-07-18 14:53:00 CEST |913520 |TR/Crypt.ZPACK.Gen |46.251.237.240 |besplatnomegaporno.ru |http://besplatnomegaporno.ru/10/video/porno-rolik10.avi.exe |2011-07-18 23:08:10 CEST |916246 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/video/porno-rolik.avi.exe |2011-07-19 01:00:26 CEST |916526 |TR/Ransom.DN.14 |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/9/video/porno-rolik9.avi.exe |2011-07-19 01:00:26 CEST |916529 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/2/video/porno-rolik2.avi.exe |2011-07-19 01:00:26 CEST |916530 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/1/video/porno-rolik1.avi.exe |2011-07-19 03:08:13 CEST |916577 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/2/video/porno-rolik2.avi.exe |2011-07-19 03:08:14 CEST |916578 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/1/video/porno-rolik1.avi.exe |2011-07-19 07:00:22 CEST |916653 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/3/video/porno-rolik3.avi.exe |2011-07-19 09:00:23 CEST |916706 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/3/video/porno-rolik3.avi.exe |2011-07-19 09:00:23 CEST |916707 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/video/porno-rolik.avi.exe |2011-07-19 09:00:24 CEST |916708 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/1/video/porno-rolik1.avi.exe |2011-07-19 09:00:24 CEST |916709 |TR/Ransom.DN.14 |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/9/video/porno-rolik9.avi.exe |2011-07-19 09:00:24 CEST |916710 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/10/video/porno-rolik10.avi.exe |2011-07-19 09:00:24 CEST |916714 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/8/video/porno-rolik8.avi.exe |2011-07-19 09:00:24 CEST |916715 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/7/video/porno-rolik7.avi.exe |2011-07-19 10:00:32 CEST |916779 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/video/porno-rolik.avi.exe |2011-07-19 10:00:32 CEST |916780 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/1/video/porno-rolik1.avi.exe |2011-07-19 10:00:32 CEST |916781 |TR/Ransom.DN.14 |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/9/video/porno-rolik9.avi.exe |2011-07-19 10:00:32 CEST |916782 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/8/video/porno-rolik8.avi.exe |2011-07-19 10:00:32 CEST |916783 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/10/video/porno-rolik10.avi.exe |2011-07-19 10:00:32 CEST |916784 |TR/Ransom.DN.18 |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/4/video/porno-rolik4.avi.exe |2011-07-19 10:00:32 CEST |916785 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/6/video/porno-rolik6.avi.exe |2011-07-19 10:00:32 CEST |916786 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/2/video/porno-rolik2.avi.exe |2011-07-19 14:00:25 CEST |916947 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/3/video/porno-rolik3.avi.exe |2011-07-19 13:11:00 CEST |917039 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/1/video/porno-rolik1.avi.exe |2011-07-19 13:11:00 CEST |917040 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/2/video/porno-rolik2.avi.exe |2011-07-19 13:11:00 CEST |917041 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/6/video/porno-rolik6.avi.exe |2011-07-19 13:11:00 CEST |917042 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/7/video/porno-rolik7.avi.exe |2011-07-19 13:11:00 CEST |917043 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/10/video/porno-rolik10.avi.exe |2011-07-19 22:15:24 CEST |917435 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/video/porno-rolik.avi.exe |2011-07-19 22:15:24 CEST |917436 |TR/Ransom.DN.14 |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/9/video/porno-rolik9.avi.exe |2011-07-19 22:15:24 CEST |917437 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/8/video/porno-rolik8.avi.exe |2011-07-19 22:15:24 CEST |917438 |TR/Ransom.DN.18 |46.251.237.240 |megaavivideoporevo.ru |http://megaavivideoporevo.ru/4/video/porno-rolik4.avi.exe |2011-07-20 00:15:22 CEST |917559 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/10/video/porno-rolik10.avi.exe |2011-07-20 00:15:23 CEST |917562 |TR/Ransom.DN.14 |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/9/video/porno-rolik9.avi.exe |2011-07-20 00:15:23 CEST |917564 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/video/porno-rolik.avi.exe |2011-07-20 00:15:23 CEST |917565 |TR/Ransom.DN.18 |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/4/video/porno-rolik4.avi.exe |2011-07-20 00:15:23 CEST |917566 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/8/video/porno-rolik8.avi.exe |2011-07-20 00:15:23 CEST |917567 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/7/video/porno-rolik7.avi.exe |2011-07-20 00:15:23 CEST |917568 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/6/video/porno-rolik6.avi.exe |2011-07-20 00:15:23 CEST |917569 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/3/video/porno-rolik3.avi.exe |2011-07-20 00:15:23 CEST |917571 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoclubsmotrionline.ru |http://pornoclubsmotrionline.ru/1/video/porno-rolik1.avi.exe |2011-07-20 01:00:35 CEST |917581 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/8/video/porno-rolik8.avi.exe |2011-07-20 01:00:36 CEST |917582 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/3/video/porno-rolik3.avi.exe |2011-07-20 01:00:36 CEST |917583 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/7/video/porno-rolik7.avi.exe |2011-07-20 01:00:36 CEST |917584 |TR/Ransom.DN.18 |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/4/video/porno-rolik4.avi.exe |2011-07-20 01:00:36 CEST |917585 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/6/video/porno-rolik6.avi.exe |2011-07-20 02:00:40 CEST |917605 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/video/porno-rolik.avi.exe |2011-07-20 02:00:40 CEST |917606 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/10/video/porno-rolik10.avi.exe |2011-07-20 02:00:40 CEST |917607 |TR/Ransom.DN.14 |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/9/video/porno-rolik9.avi.exe |2011-07-20 09:00:49 CEST |917714 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/6/video/porno-rolik6.avi.exe |2011-07-20 09:00:49 CEST |917715 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/3/video/porno-rolik3.avi.exe |2011-07-20 09:00:49 CEST |917716 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/2/video/porno-rolik2.avi.exe |2011-07-20 09:00:49 CEST |917717 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/1/video/porno-rolik1.avi.exe |2011-07-20 10:00:07 CEST |917726 |TR/Ransom.DN.18 |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917819 |TR/Crypt.ZPACK.Gen |46.251.237.240 |clubtraxteloksuper.ru |http://clubtraxteloksuper.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917820 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917821 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917822 |TR/Ransom.DN.18 |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917824 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917825 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917826 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917827 |TR/Crypt.ZPACK.Gen |46.251.237.240 |gigabaytstudentporno.ru |http://gigabaytstudentporno.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917828 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917829 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917830 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917831 |TR/Ransom.DN.18 |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917833 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917834 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917835 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917836 |TR/Ransom.DN.14 |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917837 |TR/Crypt.ZPACK.Gen |46.251.237.240 |maloletkiinschoolporno.ru |http://maloletkiinschoolporno.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917838 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917839 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917840 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917841 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917842 |TR/Ransom.DN.18 |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917844 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917845 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917846 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917847 |TR/Ransom.DN.14 |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917848 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivetrax.ru |http://megaarchivetrax.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917849 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917850 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917851 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917852 |TR/Ransom.DN.18 |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917854 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917855 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917856 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917857 |TR/Ransom.DN.14 |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917858 |TR/Crypt.ZPACK.Gen |46.251.237.240 |megaarchivschoolporno.ru |http://megaarchivschoolporno.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917859 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917860 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917861 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917862 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917863 |TR/Ransom.DN.18 |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917865 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917866 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917868 |TR/Ransom.DN.14 |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917869 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornobesplatnoxx.ru |http://pornobesplatnoxx.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917870 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917871 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917872 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917873 |TR/Ransom.DN.18 |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917875 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917876 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917877 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917878 |TR/Ransom.DN.14 |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917879 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositeforfree.ru |http://pornositeforfree.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917880 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917881 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917882 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917883 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917884 |TR/Ransom.DN.18 |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917886 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917887 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917888 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917889 |TR/Ransom.DN.14 |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917890 |TR/Crypt.ZPACK.Gen |46.251.237.240 |porvalizelkumaloletki.ru |http://porvalizelkumaloletki.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917891 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917892 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917893 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917894 |TR/Ransom.DN.18 |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917896 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917897 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917898 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917899 |TR/Ransom.DN.14 |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917900 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexporevoterraarchiv.ru |http://sexporevoterraarchiv.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917901 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917902 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917903 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917904 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917905 |TR/Ransom.DN.18 |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917907 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917908 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917909 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917910 |TR/Ransom.DN.14 |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917911 |TR/Crypt.ZPACK.Gen |46.251.237.240 |studentdomatrax.ru |http://studentdomatrax.ru/10/video/porno-rolik10.avi.exe |2011-07-20 08:39:00 CEST |917912 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917913 |TR/Ransom.DN.18 |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917915 |TR/Crypt.ZPACK.Gen |46.251.237.240 |supermegaarchivavipornosexxxx.ru |http://supermegaarchivavipornosexxxx.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917916 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/video/porno-rolik.avi.exe |2011-07-20 08:39:00 CEST |917917 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/1/video/porno-rolik1.avi.exe |2011-07-20 08:39:00 CEST |917918 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/2/video/porno-rolik2.avi.exe |2011-07-20 08:39:00 CEST |917919 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/3/video/porno-rolik3.avi.exe |2011-07-20 08:39:00 CEST |917920 |TR/Ransom.DN.18 |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/4/video/porno-rolik4.avi.exe |2011-07-20 08:39:00 CEST |917921 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/6/video/porno-rolik6.avi.exe |2011-07-20 08:39:00 CEST |917922 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/7/video/porno-rolik7.avi.exe |2011-07-20 08:39:00 CEST |917923 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/8/video/porno-rolik8.avi.exe |2011-07-20 08:39:00 CEST |917924 |TR/Ransom.DN.14 |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/9/video/porno-rolik9.avi.exe |2011-07-20 08:39:00 CEST |917925 |TR/Crypt.ZPACK.Gen |46.251.237.240 |mnogomolodihtelokokporno.ru |http://mnogomolodihtelokokporno.ru/10/video/porno-rolik10.avi.exe |2011-07-20 11:38:00 CEST |918154 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/1/video/porno-rolik1.avi.exe |2011-07-20 11:38:00 CEST |918155 |TR/Crypt.ZPACK.Gen |46.251.237.240 |sexfornightfreeporno.ru |http://sexfornightfreeporno.ru/2/video/porno-rolik2.avi.exe |2011-07-20 11:38:00 CEST |918157 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/video/porno-rolik.avi.exe |2011-07-20 11:38:00 CEST |918159 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/7/video/porno-rolik7.avi.exe |2011-07-20 11:38:00 CEST |918160 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/8/video/porno-rolik8.avi.exe |2011-07-20 11:38:00 CEST |918161 |TR/Ransom.DN.14 |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/9/video/porno-rolik9.avi.exe |2011-07-20 11:38:00 CEST |918162 |TR/Crypt.ZPACK.Gen |46.251.237.240 |traxnochyustudent.ru |http://traxnochyustudent.ru/10/video/porno-rolik10.avi.exe |2011-07-20 12:54:00 CEST |918221 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/video/porno-rolik.avi.exe |2011-07-20 12:54:00 CEST |918222 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/1/video/porno-rolik1.avi.exe |2011-07-20 12:54:00 CEST |918223 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/2/video/porno-rolik2.avi.exe |2011-07-20 12:54:00 CEST |918224 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/3/video/porno-rolik3.avi.exe |2011-07-20 12:54:00 CEST |918225 |TR/Ransom.DN.18 |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/4/video/porno-rolik4.avi.exe |2011-07-20 12:54:00 CEST |918227 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/6/video/porno-rolik6.avi.exe |2011-07-20 12:54:00 CEST |918228 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/7/video/porno-rolik7.avi.exe |2011-07-20 12:54:00 CEST |918229 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/8/video/porno-rolik8.avi.exe |2011-07-20 12:54:00 CEST |918230 |TR/Ransom.DN.14 |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/9/video/porno-rolik9.avi.exe |2011-07-20 12:54:00 CEST |918231 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornositexxx.ru |http://pornositexxx.ru/10/video/porno-rolik10.avi.exe |2011-07-20 19:00:48 CEST |918324 |TR/Ransom.DN.18 |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/4/video/porno-rolik4.avi.exe |2011-07-20 19:00:48 CEST |918325 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/2/video/porno-rolik2.avi.exe |2011-07-20 19:00:48 CEST |918326 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/1/video/porno-rolik1.avi.exe |2011-07-20 19:00:48 CEST |918327 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/3/video/porno-rolik3.avi.exe |2011-07-20 20:00:51 CEST |918356 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/7/video/porno-rolik7.avi.exe |2011-07-20 20:00:51 CEST |918357 |TR/Crypt.ZPACK.Gen |46.251.237.240 |pornoeblyadlyatebya.ru |http://pornoeblyadlyatebya.ru/6/video/porno-rolik6.avi.exe /usr/sbin/gwrsigmail.pl abuse@clean-mx.de abuse@exetel.de /tmp/viruses_complain_913511.1311187554.mail /usr/sbin/gwrsigmail.pl abuse@clean-mx.de certbund@bsi.bund.de /tmp/viruses_complain_913511.1311187554.mail /usr/sbin/gwrsigmail.pl abuse@clean-mx.de abuse@optimate-server.de /tmp/viruses_complain_913511.1311187554.mail
Title: Re: Trojan Ransom
Post by: mc0blck on July 20, 2011, 08:38:36 pm: Code: [Select]
Blocker: http://comruporn.s3.amazonaws.com/index.html (72.21.214.42) -> http://livepornohd.ru/in.cgi?2 (95.211.111.80) -> http://5uporn.s3.amazonaws.com/index.htm (72.21.214.42) -> http://5uporn.s3.amazonaws.com/xxx_video.exe (72.21.214.42)
Title: Re: Trojan Ransom
Post by: Amishrabbit on July 20, 2011, 08:40:01 pm: Quote from: cleanmx on July 20, 2011, 06:41:23 pm

I contacted their upstream provider, ripe -tel-nr of them is not allocated ....
update: I reached optimate-server.de on their cell phone, they promised to shut down this server
-- gerhard

A number of the domains from this thread/attack that were formerly hosted on 46.251.237.240 appear to be moving over to 91.220.0.35 / AS51630, which is another Latvian network.

avipornoonline.ru
camshotporno.ru
dadnmomsporno.ru
megasyperxxx.ru
ooopsmypusy.ru
pornoagentx.ru
pornoseksas.ru
pornyxaavi.ru
redpussyx.ru
ssssaniedirki.ru
utubexxxvideo.ru
videopornocam.ru
youngpornoseks.ru

They are all still active.

aut-num: AS51630
as-name: SIABAS-AS
descr: SIA BUSINESS AVIATION SERVICES
org: ORG-BASL1-RIPE
import: from AS24589 action pref=120; accept ANY
import: from AS8285 action pref=120; accept ANY
import: from AS21156 action pref=120; accept ANY
export: to AS24589 announce AS51630
export: to AS8285 announce AS51630
export: to AS21156 announce AS51630
admin-c: VLAS1-RIPE
tech-c: VLAS1-RIPE
mnt-by: RIPE-NCC-END-MNT
mnt-by: SIABAS-MNT
mnt-routes: SIABAS-MNT
source: RIPE # Filtered

organisation: ORG-BASL1-RIPE
org-name: SIA BUSINESS AVIATION SERVICES
org-type: OTHER
address: Graudu str. 48A, Riga, LV-1058, Latvia
mnt-ref: SIABAS-MNT
mnt-by: SIABAS-MNT
source: RIPE # Filtered

person: Vadims Vlasovs
address: Graudu str. 48A, Riga, LV-1058, Latvia
phone: +371 29528757
nic-hdl: VLAS1-RIPE
mnt-by: SIABAS-MNT
source: RIPE # Filtered
Title: Re: Trojan Ransom
Post by: mc0blck on July 20, 2011, 09:18:08 pm: Porno-rolik
Quote
Blocker: hxxp://sosutstudentxxx.ru/1/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/2/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/4/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/6/ (46.251.237.240) -> hxxp://sosutstudentxxx.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
Blocker: hxxp://sosutstudentxxx.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)

Amazon
Quote
hxxp://comruporn.s3.amazonaws.com/index.html (72.21.211.200) -> hxxp://comruporn.s3.amazonaws.com/video.htm (72.21.211.200) -> hxxp://livepornohd.ru/in.cgi?2 (95.211.111.80) -> hxxp://ebpoino.s3.amazonaws.com/index.htm (72.21.211.200) -> hxxp://ebpoino.s3.amazonaws.com/xxx_video.exe (72.21.211.200)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 21, 2011, 03:39:52 am: MBRLocker (new binary and updated unlock code)

Quote
hxxp://redpussyx.ru/xxxvideo.avi.exe

Quote from: MysteryFCM on July 20, 2011, 04:56:49 pm
Quote from: EP_X0FF on July 20, 2011, 10:30:06 am
Regarding to EXETEL.DE who hosts all pornorolik malware. As far as I know it ignored all abuses we sent in a last two weeks. If anyone knows a way how to make it answer please tell.

Working on it ;)

Quote from: cleanmx on July 20, 2011, 06:41:23 pm
I contacted their upstream provider, ripe -tel-nr of them is not allocated ....
update: I reached optimate-server.de on their cell phone, they promised to shut down this server
-- gerhard

Thank you both, really appreciate that :)

Quote from: Amishrabbit on July 20, 2011, 08:40:01 pm
A number of the domains from this thread/attack that were formerly hosted on 46.251.237.240 appear to be moving over to 91.220.0.35 / AS51630, which is another Latvian network.

Yes. Pornorolik (this is reincarnation of Ransom formerly known as WinAD) and MBRLocker seems coming from one gang and Amazon WS hosted ransom (formerly known as Lock'Em'All, named because of specific strings found in the previous version of this locker) from other group. First uses EXETEL.DE to host their malware and SIA BUSINESS AVIATION SERVICES. Second group migrating from one free service to another.

In the end of June, beginning of July LockEmAll were hosted on Yandex's narod.ru hosting (it's completely free). We successfully wiped it from there. After this Lock'Em'All moved to hosting located in Japan (also free) ninja.co.jp, we kicked it from there (ninja response was very quick :)) and they finally moved to Amazon Web Services (starting from 11 July).

The pity thing in Amazon WS - their abuse system seems not working at all (or we don't know *how* to use it), because all abuse requests we done have been returned with the following response:

Quote
Dear Abuse Reporter,

Thank you for submitting your abuse report. Unfortunately, we're unable to identify an Amazon EC2 customer using the source IP address(es) at the time you provided. This can happen when Amazon EC2 does not own the IP address(es) or when the date, time, or time zone that you provided is incorrect. If you feel you have mistyped the IP address or the abuse time, please re-submit the Amazon EC2 Abuse Report Form with updated information so we may proceed with processing your report:

http://aws-portal.amazon.com/gp/aws/html-forms-controller/contactus/AWSAbuse

Source IP address(es): 72.21.211.173
Abuse time: Tue Jul 19 14:11:00 UTC 2011
Title: Re: Trojan Ransom
Post by: mc0blck on July 21, 2011, 06:00:27 am: Quote
The pity thing in Amazon WS - their abuse system seems not working at all (or we don't know *how* to use it), because all abuse requests we done have been returned with the following response:
It is really strange - just check the provided link in the abuse form and you will get all proofs - IP, date, time.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 21, 2011, 09:31:50 am: Quote from: mc0blck on July 21, 2011, 06:00:27 am
Quote
The pity thing in Amazon WS - their abuse system seems not working at all (or we don't know *how* to use it), because all abuse requests we done have been returned with the following response:
It is really strange - just check the provided link in the abuse form and you will get all proofs - IP, date, time.

I think this is because this system is automatic. I've send abuse regarding hxxp://ebpoino.s3.amazonaws.com few minutes ago, if it will again not work I will do what MysteryFCM suggested :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 21, 2011, 11:01:05 am: Current active Pornorolik locations (with fresh new binaries and new unlock code "NASTYA", w/o quotes)

Quote
hxxp://FREEARCHVIVIDEOFORU.ru/video/porno-rolik.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/7/video/porno-rolik7.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/8/video/porno-rolik8.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/9/video/porno-rolik9.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/10/video/porno-rolik10.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/video/porno-rolik.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/7/video/porno-rolik7.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/8/video/porno-rolik8.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/9/video/porno-rolik9.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/10/video/porno-rolik10.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/video/porno-rolik.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/7/video/porno-rolik7.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/8/video/porno-rolik8.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/9/video/porno-rolik9.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/10/video/porno-rolik10.avi.exe (46.251.237.240)

The following domain names are reserved (some already active) by gang for future use. Some of them will be used to host MBRLocker, others Pornorolik.
This list is courtesy of mc0blck :)

Quote
hxxp://DACHAPOREVODA4NIZXXX.ru/
hxxp://DACHAPOREVODA4NIZXXX.ru/video/porno-rolik.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/1/video/porno-rolik1.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/2/video/porno-rolik2.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/3/video/porno-rolik3.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/4/video/porno-rolik4.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/6/video/porno-rolik6.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/7/video/porno-rolik7.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/8/video/porno-rolik8.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/9/video/porno-rolik9.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/10/video/porno-rolik10.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/video/porno-rolik.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/1/video/porno-rolik1.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/2/video/porno-rolik2.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/3/video/porno-rolik3.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/4/video/porno-rolik4.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/6/video/porno-rolik6.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/7/video/porno-rolik7.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/8/video/porno-rolik8.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/9/video/porno-rolik9.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/10/video/porno-rolik10.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/
hxxp://DOMAEBUTSYAKRITO.ru/video/porno-rolik.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/1/video/porno-rolik1.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/2/video/porno-rolik2.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/3/video/porno-rolik3.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/4/video/porno-rolik4.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/6/video/porno-rolik6.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/7/video/porno-rolik7.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/8/video/porno-rolik8.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/9/video/porno-rolik9.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/10/video/porno-rolik10.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/
hxxp://KAKEBALINASTUDOMA.ru/video/porno-rolik.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/1/video/porno-rolik1.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/2/video/porno-rolik2.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/3/video/porno-rolik3.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/4/video/porno-rolik4.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/6/video/porno-rolik6.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/7/video/porno-rolik7.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/8/video/porno-rolik8.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/9/video/porno-rolik9.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/
hxxp://PORNOXXXONLINEFREE.ru/video/porno-rolik.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/10/video/porno-rolik10.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/
hxxp://SOCHIEBLYADOMASMOTRET.ru/video/porno-rolik.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/1/video/porno-rolik1.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/2/video/porno-rolik2.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/3/video/porno-rolik3.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/4/video/porno-rolik4.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/6/video/porno-rolik6.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/7/video/porno-rolik7.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/8/video/porno-rolik8.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/9/video/porno-rolik9.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/10/video/porno-rolik10.avi.exe

Seems without taking down that EXETEL server they will continue generate numerous domains each day.

update

seems they all already working. At least I can get payload from each.
Title: Re: Trojan Ransom
Post by: cleanmx on July 21, 2011, 05:15:41 pm: at lease exetel's upstream provider has blocked this host !

just got a email...

-- gerhard
Quote
Hi Marcel,

super !!!!!!!!!!!

das problem schein zu sein das sich exetel einen absolut obscuren kunden angelacht hat, der mit seinen malwareseiten rund um den globus zieht.

das ärgerliche an der sache ist das der telefon kontakt von deren class-c netzt nicht geht und auch abuse bei denen sich absolut nicht cooperativ gezeigt hat ....

-- gerhard

Am 21.07.2011 15:44, schrieb Optimate-Server.de (Support):
> Guten Tag,
>
> danke für den Hinweis, die IP ist nun geblockt.
>
> Mit freundlichen Grüßen,
> Optimate-Server.de
>
> http://www.optimate-server.de
> Bei den Pflanzenländern 3; 61191 Rosbach
>
>
> "abuse@clean-mx.de" <abuse@clean-mx.de> schrieb:
>
>> hallo exetel ist
>> nicht erreichbar,
>> wenn sie der
>> upstream sind, bitte
>> die malwaresites
>> schliessen lassen.
>> übersicht auf:
>> http://support.clean
>> -mx.de/clean-
>> mx/viruses.php?
>> email=abuse@exetel.d
>> e&sort=id%20desc&res
>> ponse=alive
>>
>> tel 0171 4802507
>>
>> es ist wirklich
>> eilig !
>>
>> Gruß Gerhard Recher
>>
>>
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 21, 2011, 05:23:33 pm: Thank you very much :) This is wonderful news. You did a great job!
Title: Re: Trojan Ransom
Post by: cleanmx on July 21, 2011, 05:25:14 pm: Quote from: EP_X0FF on July 21, 2011, 05:23:33 pm
Thank you very much :) This is wonderful news. You did a great job!

if you ever have a problem related to german providers, feel free to contact me !

-- gerhard
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 21, 2011, 05:52:55 pm: Ah, they are quick.

They moved to new IP. Not accessible for me through DNS name but opens with IP. Check this out.

hxxp://31.214.145.191/

Quote
hxxp://31.214.145.191/video/porno-rolik.avi.exe
hxxp://31.214.145.191/video/1/porno-rolik1.avi.exe
hxxp://31.214.145.191/video/2/porno-rolik2.avi.exe
hxxp://31.214.145.191/video/3/porno-rolik3.avi.exe
hxxp://31.214.145.191/video/4/porno-rolik4.avi.exe
hxxp://31.214.145.191/video/6/porno-rolik6.avi.exe
hxxp://31.214.145.191/video/7/porno-rolik7.avi.exe
hxxp://31.214.145.191/video/8/porno-rolik8.avi.exe
hxxp://31.214.145.191/video/9/porno-rolik9.avi.exe
hxxp://31.214.145.191/video/10/porno-rolik10.avi.exe

update All binaries except first are inaccessible for me, up to current time.
Title: Re: Trojan Ransom
Post by: SysAdMini on July 21, 2011, 06:06:22 pm: Quote from: EP_X0FF on July 21, 2011, 05:52:55 pm

They moved to new IP. Not accessible for me through DNS name but opens with IP. Check this out.

hxxp://31.214.145.191/

Same provider as before.

@Gerhard : Would you please contact Exetel's upstream provider again ?
Title: Re: Trojan Ransom
Post by: mc0blck on July 21, 2011, 07:30:36 pm: hxxp://sdomankor.info/gierqwwn.cgi?13 is still alive.
I have sent the abuse to GoDaddy two times - no success.
Title: Re: Trojan Ransom
Post by: mc0blck on July 21, 2011, 07:33:11 pm: Amazon
Quote
Blocker: hxxp://xxx-mixxi.ru/ (95.211.111.80) -> hxxp://morexporno.ru/in.cgi?2 (95.211.111.80) -> hxxp://llz3porn.s3.amazonaws.com/index.htm (72.21.194.16) -> hxxp://llz3porn.s3.amazonaws.com/xxx_video.exe (72.21.194.16)

Porno-rolik
Quote
New Blocker: hxxp://sdomankor.info/gierqwwn.cgi?16 (88.208.33.155) -> hxxp://sexlifeclubxxx.info/6/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/6/video/porno-rolik6.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/1/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/1/video/porno-rolik1.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/2/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/2/video/porno-rolik2.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/4/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/4/video/porno-rolik4.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/3/video/porno-rolik3.avi.exe (31.214.145.191)
Title: Re: Trojan Ransom
Post by: cleanmx on July 21, 2011, 07:55:40 pm: I just send another complain to them and request to null-route this ip! (31.214.145.191)

-- gerhard

btw:

another nice finding...

http://support.clean-mx.de/clean-mx/viruses.php?review=173.242.114.45&sort=id%20desc

update just got a confirmation from marcel, they null-routed them. on this ip (22:56 CEST)

our conversation... just in german....

Quote
Hi Marcel,

klingt ja gut...

aber warum ist dann euer Kunde Exetel nicht wirklich kommunikativ ?

1) tel in ripe gibt es nicht
2) keine reaktion auf mails ...

ich belästige ungern den Upstream....

-- Gerhard

Am 21.07.2011 23:02, schrieb Optimate-Server.de (Support):
> Ja, vorher hatten wir nur IP gesperrt.
> Jetzt ist der ganze Server dicht und der Kunde von exetel gekündigt.
>
> Mit freundlichen Grüßen,

> Optimate-Server.de
>
> http://www.optimate-server.de
> Bei den Pflanzenländern 3; 61191 Rosbach
> Tel.: 06003 / 9344144
> Fax: 06003 / 9344143
>
>
> "Gerhard W. Recher (abuse)" <abuse@clean-mx.de> schrieb:
>
>> Hi Marcel,
>>
>> danke für die super-sonic-schnell reaktion.
>>
>>
>> habt ihr mit euerem down-stream kunden exetel mal ein wörtchen gewechselt ?
>>
>> ich glaube das das noch nicht das ende war...
>>
>>
>> -- gerhard
>>
>> Am 21.07.2011 22:51, schrieb Optimate-Server.de (Support):
>>> Guten Tag,
>>>
>>> danke nochmal, IP geblockt
>>>
>>> Mit freundlichen Grüßen,

>>> Optimate-Server.de
>>>
>>> http://www.optimate-server.de
>>> Bei den Pflanzenländern 3; 61191 Rosbach
>>> Tel.: 06003 / 9344144
>>> Fax: 06003 / 9344143
>>>
>>>
>>> "Gerhard W. Recher (abuse)" <abuse@clean-mx.de> schrieb:
>>>
>>>> hi Marcel,
>>>>
>>>>
>>>> die nomaden sind innerhalb exetel weitergezogen !
>>>>
>>>> auf "AS197043" "31.214.145.191"
>>>>
>>>> bitte auch diese ip sofort blocken sprich null-routen !
>>>>
>>>> -- gerhard
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 22, 2011, 02:34:43 am: Amazon ransom trace, previous all dead.

Quote
hxxp://mixxporkaa.ru/ (95.211.111.80) -> hxxp://porno-vsetut.com/in.cgi?2 (95.211.111.80) -> hxxp://zx1uporn.s3.amazonaws.com/index.htm (72.21.203.149) -> hxxp://zx1uporn.s3.amazonaws.com/xxx_video.exe (72.21.203.149)

MBRLocker

Quote
hxxp://prostituytka.ru/xxxvideo.avi.exe

update Amazon taken down the host.

New trace bellow.

Quote
hxxp://eroticzporn.ru/ (95.211.111.80) -> hxxp://eroticzporn.ru/video.htm (95.211.111.80) -> hxxp://uspornno.ru/in.cgi?2 -> hxxp://w2biporn.s3.amazonaws.com/index.htm (72.21.203.146) -> hxxp://w2biporn.s3.amazonaws.com/xxx_video.exe (72.21.203.146)

Seems they are now quickly changing whole redirectors path with every locker update.
Title: Re: Trojan Ransom
Post by: SysAdMini on July 22, 2011, 06:00:41 am: Quote from: mc0blck on July 21, 2011, 07:30:36 pm
hxxp://sdomankor.info/gierqwwn.cgi?13 is still alive.
I have sent the abuse to GoDaddy two times - no success.

It has been taken now by GoDaddy.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 22, 2011, 09:54:05 am: Amazon ransom

Quote
hxxp://eroticzporn.ru/ (95.211.111.80) -> hxxp://eroticzporn.ru/video.htm (95.211.111.80) -> hxxp://uspornno.ru/in.cgi?2 (95.211.111.80) -> hxxp://frtnnbc.s3.amazonaws.com/index.htm (72.21.214.39) -> hxxp://frtnnbc.s3.amazonaws.com/xxx_video.exe (72.21.214.39)

MBRLocker (still 91.220.0.35 SIA Business Aviation Services)
Quote
hxxp://zhopaseksporno.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 22, 2011, 01:34:59 pm: Amazon, trace path the same.

Quote
hxxp://ndcporka.s3.amazonaws.com/xxx_video.exe

MBRLocker

Quote
hxxp://anusanalzhopa.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: mc0blck on July 22, 2011, 08:15:20 pm: Quote
Blocker: hxxp://askpornkas.ru/ (95.211.111.80) -> hxxp://jjkpornoz.ru/in.cgi?2 (95.211.111.80) -> hxxp://cbipoxf.s3.amazonaws.com/index.htm (72.21.214.42) -> hxxp://cbipoxf.s3.amazonaws.com/xxx_video.exe (72.21.214.42)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 23, 2011, 01:21:33 am: Amazon, trace path the same
Quote
hxxp://sukazporka.s3.amazonaws.com/xxx_video.exe

MBRLocker new

Quote
hxxp://mossdamozxxx.ru/xxxvideo.avi.exe

We believe gang who stand for Pornorolik preparing to migrate to some Russian hoster. Probably soon they will back online.
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 23, 2011, 04:56:34 am: Cheers :)
Title: Re: Trojan Ransom
Post by: mc0blck on July 23, 2011, 05:35:19 am: Amazon
Quote
hxxp://mansboxporn.ru/ (95.211.111.80) -> hxxp://mansboxporn.ru/video.htm (95.211.111.80) -> hxxp://bhtdsnz.ru/in.cgi?2 (95.211.111.80) -> hxxp://ttedhoki.s3.amazonaws.com/index.htm (72.21.214.144) -> hxxp://ttedhoki.s3.amazonaws.com/xxx_video.exe (72.21.214.144)

MBRLocker
Quote
New Blocker: hxxp://ALISSSASEX.ru/ (91.220.0.35) -> hxxp://valaskor.ru/in.cgi?5 (212.124.110.134) -> hxxp://mossdamozxxx.ru/ (91.220.0.35) -> hxxp://mossdamozxxx.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://SOKIZSOSOK.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://ANUSANALZHOPA.ru/xxxvideo.avi.exe (91.220.0.35)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 23, 2011, 02:09:03 pm: Pornorolik back to business

Quote
hxxp://terabytepornovideo.ru/11/video/porno-rolik11.avi.exe
hxxp://terabytepornovideo.ru/12/video/porno-rolik12.avi.exe
hxxp://terabytepornovideo.ru/13/video/porno-rolik13.avi.exe
hxxp://terabytepornovideo.ru/16/video/porno-rolik16.avi.exe
hxxp://terabytepornovideo.ru/17/video/porno-rolik17.avi.exe
hxxp://terabytepornovideo.ru/18/video/porno-rolik18.avi.exe
hxxp://terabytepornovideo.ru/20/video/porno-rolik20.avi.exe

Quote
hxxp://davaypornosei4as.ru/11/video/porno-rolik11.avi.exe
hxxp://davaypornosei4as.ru/12/video/porno-rolik12.avi.exe
hxxp://davaypornosei4as.ru/13/video/porno-rolik13.avi.exe
hxxp://davaypornosei4as.ru/16/video/porno-rolik16.avi.exe
hxxp://davaypornosei4as.ru/17/video/porno-rolik17.avi.exe
hxxp://davaypornosei4as.ru/18/video/porno-rolik18.avi.exe
hxxp://davaypornosei4as.ru/20/video/porno-rolik20.avi.exe

Quote
hxxp://kakpravilnotrahattelok.ru/11/video/porno-rolik11.avi.exe
hxxp://kakpravilnotrahattelok.ru/12/video/porno-rolik12.avi.exe
hxxp://kakpravilnotrahattelok.ru/13/video/porno-rolik13.avi.exe
hxxp://kakpravilnotrahattelok.ru/16/video/porno-rolik16.avi.exe
hxxp://kakpravilnotrahattelok.ru/17/video/porno-rolik17.avi.exe
hxxp://kakpravilnotrahattelok.ru/18/video/porno-rolik18.avi.exe
hxxp://kakpravilnotrahattelok.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 23, 2011, 03:06:41 pm: Amazon (previous locations dead)

Quote
hxxp://3rewporn.s3.amazonaws.com/xxx_video.exe

trace path including redirector

Quote
hxxp://ninnporno.ru/ -> hxxp://ninnporno.ru/video.htm -> hxxp://jjkpornoz.ru/in.cgi?2 (95.211.111.80) -> hxxp://3rewporn.s3.amazonaws.com/index.htm -> hxxp://3rewporn.s3.amazonaws.com/xxx_video.exe

where redirector -> jjkpornoz.ru is domain that always on the same IP: 95.211.111.80, so they are basically just generating new domains.
Quote
created: 2011.07.22
paid-till: 2012.07.22

Abuse response from LeaseWeb told me (regarding few previous domain working as redirectors) they will inform their customer about the problem and this is reply to all abuses.

Pornorolik

Quote
hxxp://smotripornomnogoxxx.ru/11/video/porno-rolik11.avi.exe
hxxp://smotripornomnogoxxx.ru/12/video/porno-rolik12.avi.exe
hxxp://smotripornomnogoxxx.ru/13/video/porno-rolik13.avi.exe
hxxp://smotripornomnogoxxx.ru/16/video/porno-rolik16.avi.exe
hxxp://smotripornomnogoxxx.ru/17/video/porno-rolik17.avi.exe
hxxp://smotripornomnogoxxx.ru/18/video/porno-rolik18.avi.exe
hxxp://smotripornomnogoxxx.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 23, 2011, 05:49:17 pm: Pornorolik

Quote
hxxp://bestvideopornoxxx.ru/11/video/porno-rolik11.avi.exe
hxxp://bestvideopornoxxx.ru/12/video/porno-rolik12.avi.exe
hxxp://bestvideopornoxxx.ru/13/video/porno-rolik13.avi.exe
hxxp://bestvideopornoxxx.ru/14/video/porno-rolik14.avi.exe
hxxp://bestvideopornoxxx.ru/16/video/porno-rolik16.avi.exe
hxxp://bestvideopornoxxx.ru/17/video/porno-rolik17.avi.exe
hxxp://bestvideopornoxxx.ru/18/video/porno-rolik18.avi.exe
hxxp://bestvideopornoxxx.ru/20/video/porno-rolik20.avi.exe

MBRLocker

Quote
hxxp://soskisoskii.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 23, 2011, 06:17:02 pm: Dropped my friends at Leaseweb an e-mail, IP should hopefully be down within the hour.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 23, 2011, 06:25:46 pm: Seems it's already down :) Thanks so much!
Title: Re: Trojan Ransom
Post by: mc0blck on July 23, 2011, 08:22:11 pm: Porno-rolik redirector ( + replace 13 on 11-20):
Quote
hxxp://asi-top.ru/gierqwwn.cgi?13 (88.208.33.154)
Blocker: hxxp://traxxxpornoavi.ru/13/ (195.226.220.141) -> hxxp://traxxxpornoavi.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)

Amazon
Quote
Blocker: hxxp://scdporno.ru/ (91.221.99.241) -> hxxp://uiupoba12.ru/go.php?sid=1 (91.221.99.241) -> hxxp://porn4tow.s3.amazonaws.com/index.htm (72.21.214.42) -> hxxp://porn4tow.s3.amazonaws.com/xxx_video.exe (72.21.214.42)
Blocker: hxxp://pornpojpor.ru/ (95.211.111.80) -> hxxp://nixposdss.ru/in.cgi?2 (95.211.111.80) -> hxxp://3rewporn.s3.amazonaws.com/index.htm (72.21.203.149) -> hxxp://3rewporn.s3.amazonaws.com/xxx_video.exe (72.21.203.149)
Blocker: hxxp://xxxbuxc.s3.amazonaws.com/index.htm (72.21.214.144) -> hxxp://xxxbuxc.s3.amazonaws.com/xxx_video.exe (72.21.214.144)
Blocker: hxxp://ninnporno.ru/ (95.211.111.80) -> hxxp://ninnporno.ru/video.htm (95.211.111.80) -> hxxp://movhpornd.ru/in.cgi?2 (95.211.111.80) -> hxxp://3rewporn.s3.amazonaws.com/index.htm (72.21.203.149) -> hxxp://3rewporn.s3.amazonaws.com/xxx_video.exe (72.21.203.149)
Blocker: hxxp://fingopas.s3.amazonaws.com/index.htm (72.21.194.23) -> hxxp://fingopas.s3.amazonaws.com/xxx_video.exe (72.21.194.23)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 24, 2011, 01:59:56 am: Amazon ransom trace

Quote
hxxp://scdporno.ru/ -> hxxp://scdporno.ru/video.htm -> hxxp://uiupoba12.ru/go.php?sid=1 -> hxxp://ebatporkas.s3.amazonaws.com/index.htm -> hxxp://ebatporkas.s3.amazonaws.com/xxx_video.exe

update ebatporkas.s3.amazonaws.com taken down, 404.

New trace

Quote
hxxp://amkkporno.ru/ -> hxxp://amkkporno.ru/video.htm -> hxxp://uiupoba12.ru/go.php?sid=1 -> hxxp://azxpoixx.s3.amazonaws.com/index.htm -> hxxp://azxpoixx.s3.amazonaws.com/xxx_video.exe

update azxpoixx.s3.amazonaws.com taken down, 404

Redirectors seems moved to Latvia.

Pornorolik domain

Quote
hxxp://zapretnoepornokruto.ru/11/video/porno-rolik11.avi.exe
hxxp://zapretnoepornokruto.ru/12/video/porno-rolik12.avi.exe
hxxp://zapretnoepornokruto.ru/13/video/porno-rolik13.avi.exe
hxxp://zapretnoepornokruto.ru/16/video/porno-rolik16.avi.exe
hxxp://zapretnoepornokruto.ru/17/video/porno-rolik17.avi.exe
hxxp://zapretnoepornokruto.ru/18/video/porno-rolik18.avi.exe
hxxp://zapretnoepornokruto.ru/20/video/porno-rolik20.avi.exe

Quote
hxxp://megabytespornovideo.ru/11/video/porno-rolik11.avi.exe
hxxp://megabytespornovideo.ru/12/video/porno-rolik12.avi.exe
hxxp://megabytespornovideo.ru/13/video/porno-rolik13.avi.exe
hxxp://megabytespornovideo.ru/16/video/porno-rolik16.avi.exe
hxxp://megabytespornovideo.ru/17/video/porno-rolik17.avi.exe
hxxp://megabytespornovideo.ru/18/video/porno-rolik18.avi.exe
hxxp://megabytespornovideo.ru/20/video/porno-rolik20.avi.exe

Redirector to MBRLocker (likely Russian IP required to make it work)

hxxp://valaskor.ru/in.cgi?5 (212.124.110.134)

hxxp://212.124.110.134/in.cgi?5 <- working well for me.

Regarding to this redirector. This is another mutant, that previously was named habrmabrt.ru, tdschtotakoetds.ru, all hosts on the same IP. And all used to be MBRLock redirectors.
DigitalOne AG has ignored abuse we've sent 4 days ago.

Quote
inetnum: 212.124.108.0 - 212.124.111.255
netname: DIGITALONE-NET
descr: DigitalOne AG Colocation and Dedicated Servers
remarks: --------------------------------------------------
remarks: Please, send abuse reports to abuse@digitalone.com
remarks: --------------------------------------------------
country: US
admin-c: DA440-RIPE
tech-c: DA440-RIPE
status: ASSIGNED PA
mnt-by: MNT-TRI
changed: noc@digitalone.com 20091111
source: RIPE

role: DigitalOne AG
address: 12100 Sunrise Valley Drive
address: Reston, VA 20191, United States
e-mail: noc@digitalone.com
abuse-mailbox: abuse@digitalone.com
admin-c: SO1294-RIPE
tech-c: SO1294-RIPE
nic-hdl: DA440-RIPE
mnt-by: MNT-TRI
changed: noc@digitalone.com 20091111
source: RIPE

% Information related to '212.124.108.0/22AS47328'

route: 212.124.108.0/22
descr: True Records Inc.
remarks: ------------------------------------------------------
remarks: Routing, peering and security: noc@truerec.com
remarks: Spam reports and abuse: abuse@truerec.com
remarks: ------------------------------------------------------
origin: AS47328
mnt-by: MNT-TRI
changed: noc@truerec.com 20090630
source: RIPE
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 24, 2011, 10:10:34 am: Some other redirector revealed.

hxxp://asi-top.ru/gifeesdccz.cgi?12 (88.208.33.154, ADVANCEDHOSTERS-NET) it will redirect you to pornorolik domains (all on the 195.226.220.141)
Changing the id used in as param of gifeesdccz.cgi?id gives the following locations

Quote
hxxp://domatolkodetixxx.ru/11/video/porno-rolik11.avi.exe
hxxp://domatolkodetixxx.ru/12/video/porno-rolik12.avi.exe
hxxp://domatolkodetixxx.ru/13/video/porno-rolik13.avi.exe
hxxp://domatolkodetixxx.ru/16/video/porno-rolik16.avi.exe
hxxp://domatolkodetixxx.ru/17/video/porno-rolik17.avi.exe
hxxp://domatolkodetixxx.ru/18/video/porno-rolik18.avi.exe
hxxp://domatolkodetixxx.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: MysteryFCM on July 24, 2011, 10:33:37 am: Quote from: EP_X0FF on July 24, 2011, 01:59:56 am
DigitalOne AG has ignored abuse we've sent 4 days ago.

DigitalOne have a US address but are a Swiss company, and known to be bulletproof (just like their upstream). I'll have another word with True Records upstream and see what we can do about this.
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 24, 2011, 11:34:42 am: Thanks :)

Fresh pornoroliks (binaries updating with new unlock codes, tel numbers)

Quote
hxxp://lolkorussiangirlsporno.ru/11/video/porno-rolik11.avi.exe
hxxp://lolkorussiangirlsporno.ru/12/video/porno-rolik12.avi.exe
hxxp://lolkorussiangirlsporno.ru/13/video/porno-rolik13.avi.exe
hxxp://lolkorussiangirlsporno.ru/16/video/porno-rolik16.avi.exe
hxxp://lolkorussiangirlsporno.ru/17/video/porno-rolik17.avi.exe
hxxp://lolkorussiangirlsporno.ru/18/video/porno-rolik18.avi.exe
hxxp://lolkorussiangirlsporno.ru/20/video/porno-rolik20.avi.exe

Amazon
Quote
hxxp://tix3porn.s3.amazonaws.com/xxx_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 24, 2011, 04:17:19 pm: Amazon update site down, 404
Quote
hxxp://rim5tporn.s3.amazonaws.com/xxx_video.exe

Pornorolik

Quote
hxxp://russkieebutteloknaprirode.ru/11/video/porno-rolik11.avi.exe
hxxp://russkieebutteloknaprirode.ru/12/video/porno-rolik12.avi.exe
hxxp://russkieebutteloknaprirode.ru/13/video/porno-rolik13.avi.exe
hxxp://russkieebutteloknaprirode.ru/16/video/porno-rolik16.avi.exe
hxxp://russkieebutteloknaprirode.ru/17/video/porno-rolik17.avi.exe
hxxp://russkieebutteloknaprirode.ru/18/video/porno-rolik18.avi.exe
hxxp://russkieebutteloknaprirode.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 24, 2011, 06:19:29 pm: Amazon ransom starts spreading through their new hosting previously used only for redirectors.

Quote
hxxp://PORNBIJJIN.ru/ (91.221.99.241) -> hxxp://PORNBIJJIN.ru/xxx_video.exe (91.221.99.241)
hxxp://PORNODAPORN.ru/ (91.221.99.241) -> hxxp://PORNODAPORN.ru/xxx_video.exe (91.221.99.241)
hxxp://XRASVIXPORN.ru/ (91.221.99.241) -> hxxp://XRASVIXPORN.ru/xxx_video.exe (91.221.99.241)

Quote
hxxp://z4nixxxi.s3.amazonaws.com/index.htm (72.21.211.171) -> hxxp://z4nixxxi.s3.amazonaws.com/xxx_video.exe (72.21.211.171)

this list is courtesy of mc0blck :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 25, 2011, 09:05:44 am: I've done some research in case of Amazon ransom and found their sites actually contains obfuscated redirection code that leads to another server, full of exploits.

Below is the links I've gathered from there.

Page with exploit pack, gives fake 404 error, code obfuscated
Quote
hxxp://6g12w.ru/indexx.php?tp=8b797d0916c09fa8

6g12w.ru
IP: 85.15.231.110

Quote
inetnum: 85.15.231.107 - 85.15.231.122
netname: LE_Collocation
mnt-by: latvenergo-mnt
descr: SIA "Projektam.lv" clients
country: LV
admin-c: SL666
tech-c: SL666
status: ASSIGNED PA
mnt-by: projektamlv-mnt
changed: meistars@projektam.lv 20110308
source: RIPE

person: Solution Solution6
address: SL666
abuse-mailbox: solutionsolution6@gmail.com
phone: +37126546676
nic-hdl: SL666
mnt-by: projektamlv-mnt
changed: meistars@projektam.lv 20110308
source: RIPE

Trojan ransom similar to that located on Amazon WS
Quote
hxxp://6g12w.ru/d.php?f=236&e=2

There can be more files, I just deobfuscated page and quickly looked inside.

Amazon ransom I've examined to get this results
Quote
hxxp://kinvivifas.s3.amazonaws.com/index.htm

Binary itself
Quote
hxxp://kinvivifas.s3.amazonaws.com/xxx_video.exe

Exploit PDF (Exploit.JS.Pdfka.eka) extracted from sploit pack code:
Quote
hxxp://6g12w.ru/games/2fdp.php?f=236

Some malware Java package (Exploit.Java.229)
Quote
hxxp://6g12w.ru/games/worms.jar

+ some other stuff for Java
Quote
hxxp://6g12w.ru/games/java_trust.php?f=236
Title: Re: Trojan Ransom
Post by: SysAdMini on July 25, 2011, 09:24:02 am: Quote from: EP_X0FF on July 25, 2011, 09:05:44 am

Page with exploit pack, gives fake 404 error, code obfuscated
Quote
hxxp://6g12w.ru/indexx.php?tp=8b797d0916c09fa8

Quote
hxxp://6g12w.ru/d.php?f=236&e=2

Exploit PDF (Exploit.JS.Pdfka.eka) extracted from sploit pack code:
Quote
hxxp://6g12w.ru/games/2fdp.php?f=236

Some malware Java package (Exploit.Java.229)
Quote
hxxp://6g12w.ru/games/worms.jar

This is a "Blackhole exploit kit".
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 25, 2011, 09:40:17 am: Fresh location of Amazon, previous down, 404

Quote
hxxp://binxx3fi.s3.amazonaws.com/xxx_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 25, 2011, 10:06:42 am: Pornorolik updated

Quote
hxxp://devushkasosetvmetro.ru/11/video/porno-rolik11.avi.exe
hxxp://devushkasosetvmetro.ru/12/video/porno-rolik12.avi.exe
hxxp://devushkasosetvmetro.ru/13/video/porno-rolik13.avi.exe
hxxp://devushkasosetvmetro.ru/16/video/porno-rolik16.avi.exe
hxxp://devushkasosetvmetro.ru/17/video/porno-rolik17.avi.exe
hxxp://devushkasosetvmetro.ru/18/video/porno-rolik18.avi.exe
hxxp://devushkasosetvmetro.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 25, 2011, 01:07:38 pm: Pornoroliks :)

Quote
hxxp://AVIVEDIOPORNOSMOTRET.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://AVIVEDIOPORNOSMOTRET.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://AVIVEDIOPORNOSMOTRET.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://AVIVEDIOPORNOSMOTRET.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://AVIVEDIOPORNOSMOTRET.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://AVIVEDIOPORNOSMOTRET.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://AVIVEDIOPORNOSMOTRET.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://EBUTTELKUPRYAMOVMETRO.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://KAKMNOGOKASSNOGOPORNO.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://KAKZASTAVITTELKUSOSAT.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://LOVIPORNUHUBESPLATNO.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://MNOGOHOROSHEGOPORNO.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://MOLODIYPARYSNIMAUTSYAVPORNO.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://NEOPUBLIKOVANIYARCHIVEPORNO.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://PORNOINSIDEXXX.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://PORNOSVADBAXXX.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://RUSSIANPORNOAVIXXX.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://RUSSKIEEBUTTELOKNAPRIRODE.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/11/video/porno-rolik11.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/12/video/porno-rolik12.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/13/video/porno-rolik13.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/16/video/porno-rolik16.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/17/video/porno-rolik17.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/18/video/porno-rolik18.avi.exe (195.226.220.141)
hxxp://SUPERMEGAVIDEOXXX.ru/20/video/porno-rolik20.avi.exe (195.226.220.141)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 25, 2011, 03:13:57 pm: MBRLocker

Quote
hxxp://velcocozels.ru/xxxvideo.avi.exe

Amazon

Quote
hxxp://xri4pork.s3.amazonaws.com/xxx_video.exe

+

exploit pack link extracted from homepage
Quote
hxxp://8hjsx3.ru/indexx.php?tp=4b97a19d3bd6eab0
(down for me)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 25, 2011, 03:23:14 pm: I'm sorry but seems all pornoroliks links in my previous post resolving to Google.

Here is actual working domain with fresh payload

Quote
hxxp://rebyatasexdevchata.ru/11/video/porno-rolik11.avi.exe
hxxp://rebyatasexdevchata.ru/12/video/porno-rolik12.avi.exe
hxxp://rebyatasexdevchata.ru/13/video/porno-rolik13.avi.exe
hxxp://rebyatasexdevchata.ru/16/video/porno-rolik16.avi.exe
hxxp://rebyatasexdevchata.ru/17/video/porno-rolik17.avi.exe
hxxp://rebyatasexdevchata.ru/18/video/porno-rolik18.avi.exe
hxxp://rebyatasexdevchata.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 26, 2011, 03:11:24 am: Yandex narod.ru hosted ransom (LockEmAll variant)
Quote
hxxp://comdunnbeantrocart.narod.ru/xxx_video.exe

MBRLock
Quote
hxxp://beeporn.in/xxxvideo.avi.exe

Redirector to LockEmAll
Quote
hxxp://imiziporno.ru/in.cgi?2
Currently points to
Quote
hxxp://superporbbaa.ru/xxx_video.exe

Looks like they finally moved from Amazon.

Redirector to pornorolik, by changing ID in cgi param you can get to different locations
Quote
hxxp://bim-dot.ru/er3tggg.cgi?13

Another type of ransom

Redirector
Quote
hxxp://housevideo1.ru/xvid/cc/click.php?id=1
Payload
Quote
hxxp://pornhouse8.ru/xxxvideo.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 26, 2011, 08:16:29 am: Pornorolik domains with payload. All working at moment of post. All on IP: 195.226.220.141

Quote
hxxp://FREEPORNOVIDEOKRUTO.ru/11/video/porno-rolik11.avi.exe
hxxp://FREEPORNOVIDEOKRUTO.ru/12/video/porno-rolik12.avi.exe
hxxp://FREEPORNOVIDEOKRUTO.ru/13/video/porno-rolik13.avi.exe
hxxp://FREEPORNOVIDEOKRUTO.ru/16/video/porno-rolik16.avi.exe
hxxp://FREEPORNOVIDEOKRUTO.ru/17/video/porno-rolik17.avi.exe
hxxp://FREEPORNOVIDEOKRUTO.ru/20/video/porno-rolik20.avi.exe
hxxp://FREEPORNOVIDEOKRUTO.ru/18/video/porno-rolik18.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/11/video/porno-rolik11.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/12/video/porno-rolik12.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/13/video/porno-rolik13.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/16/video/porno-rolik16.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/17/video/porno-rolik17.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/18/video/porno-rolik18.avi.exe
hxxp://ILIKIPORNOSEXCLUB.ru/20/video/porno-rolik20.avi.exe
hxxp://JESTKIYTRAXXX.ru/11/video/porno-rolik11.avi.exe
hxxp://JESTKIYTRAXXX.ru/12/video/porno-rolik12.avi.exe
hxxp://JESTKIYTRAXXX.ru/13/video/porno-rolik13.avi.exe
hxxp://JESTKIYTRAXXX.ru/16/video/porno-rolik16.avi.exe
hxxp://JESTKIYTRAXXX.ru/17/video/porno-rolik17.avi.exe
hxxp://JESTKIYTRAXXX.ru/18/video/porno-rolik18.avi.exe
hxxp://JESTKIYTRAXXX.ru/20/video/porno-rolik20.avi.exe
hxxp://JESTOKOEPORNO4U.ru/11/video/porno-rolik11.avi.exe
hxxp://JESTOKOEPORNO4U.ru/12/video/porno-rolik12.avi.exe
hxxp://JESTOKOEPORNO4U.ru/13/video/porno-rolik13.avi.exe
hxxp://JESTOKOEPORNO4U.ru/16/video/porno-rolik16.avi.exe
hxxp://JESTOKOEPORNO4U.ru/17/video/porno-rolik17.avi.exe
hxxp://JESTOKOEPORNO4U.ru/18/video/porno-rolik18.avi.exe
hxxp://JESTOKOEPORNO4U.ru/20/video/porno-rolik20.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/11/video/porno-rolik11.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/12/video/porno-rolik12.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/13/video/porno-rolik13.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/16/video/porno-rolik16.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/17/video/porno-rolik17.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/18/video/porno-rolik18.avi.exe
hxxp://KAKPORVATPOPUTELKI.ru/20/video/porno-rolik20.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/11/video/porno-rolik11.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/12/video/porno-rolik12.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/13/video/porno-rolik13.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/16/video/porno-rolik16.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/17/video/porno-rolik17.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/18/video/porno-rolik18.avi.exe
hxxp://KRUTOEBATVSEHVJOPU.ru/20/video/porno-rolik20.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/11/video/porno-rolik11.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/12/video/porno-rolik12.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/13/video/porno-rolik13.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/16/video/porno-rolik16.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/17/video/porno-rolik17.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/18/video/porno-rolik18.avi.exe
hxxp://KRUTOYPARENEBETVSEH.ru/20/video/porno-rolik20.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/11/video/porno-rolik11.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/12/video/porno-rolik12.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/13/video/porno-rolik13.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/16/video/porno-rolik16.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/17/video/porno-rolik17.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/18/video/porno-rolik18.avi.exe
hxxp://LASKAISEXONLINEPORNO.ru/20/video/porno-rolik20.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/11/video/porno-rolik11.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/12/video/porno-rolik12.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/13/video/porno-rolik13.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/16/video/porno-rolik16.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/17/video/porno-rolik17.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/18/video/porno-rolik18.avi.exe
hxxp://LEGKIYFLIRTPORNO.ru/20/video/porno-rolik20.avi.exe
hxxp://MEGABLYADIONLINE.ru/11/video/porno-rolik11.avi.exe
hxxp://MEGABLYADIONLINE.ru/12/video/porno-rolik12.avi.exe
hxxp://MEGABLYADIONLINE.ru/13/video/porno-rolik13.avi.exe
hxxp://MEGABLYADIONLINE.ru/16/video/porno-rolik16.avi.exe
hxxp://MEGABLYADIONLINE.ru/17/video/porno-rolik17.avi.exe
hxxp://MEGABLYADIONLINE.ru/18/video/porno-rolik18.avi.exe
hxxp://MEGABLYADIONLINE.ru/20/video/porno-rolik20.avi.exe
hxxp://POPROBUYXXXPORNO.ru/11/video/porno-rolik11.avi.exe
hxxp://POPROBUYXXXPORNO.ru/12/video/porno-rolik12.avi.exe
hxxp://POPROBUYXXXPORNO.ru/13/video/porno-rolik13.avi.exe
hxxp://POPROBUYXXXPORNO.ru/16/video/porno-rolik16.avi.exe
hxxp://POPROBUYXXXPORNO.ru/17/video/porno-rolik17.avi.exe
hxxp://POPROBUYXXXPORNO.ru/18/video/porno-rolik18.avi.exe
hxxp://POPROBUYXXXPORNO.ru/20/video/porno-rolik20.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/11/video/porno-rolik11.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/12/video/porno-rolik12.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/13/video/porno-rolik13.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/16/video/porno-rolik16.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/17/video/porno-rolik17.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/18/video/porno-rolik18.avi.exe
hxxp://REBYATASEXDEVCHATA.ru/20/video/porno-rolik20.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/11/video/porno-rolik11.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/12/video/porno-rolik12.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/13/video/porno-rolik13.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/16/video/porno-rolik16.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/17/video/porno-rolik17.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/18/video/porno-rolik18.avi.exe
hxxp://TOLKOUNASPORNODLYAVAS.ru/20/video/porno-rolik20.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/11/video/porno-rolik11.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/12/video/porno-rolik12.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/13/video/porno-rolik13.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/16/video/porno-rolik16.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/17/video/porno-rolik17.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/18/video/porno-rolik18.avi.exe
hxxp://TRAHNIMENYAVPOPU.ru/20/video/porno-rolik20.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/11/video/porno-rolik11.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/12/video/porno-rolik12.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/13/video/porno-rolik13.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/16/video/porno-rolik16.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/17/video/porno-rolik17.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/18/video/porno-rolik18.avi.exe
hxxp://TRIHUYAVZADNIZU.ru/20/video/porno-rolik20.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/11/video/porno-rolik11.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/12/video/porno-rolik12.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/13/video/porno-rolik13.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/16/video/porno-rolik16.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/17/video/porno-rolik17.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/18/video/porno-rolik18.avi.exe
hxxp://VSEONLINEPORNOUNAS.ru/20/video/porno-rolik20.avi.exe

Courtesy of mc0blck :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 26, 2011, 08:58:26 am: Fresh binaries with new unblock code:

Quote
hxxp://domashneexxxporevo.ru/11/video/porno-rolik11.avi.exe
hxxp://domashneexxxporevo.ru/12/video/porno-rolik12.avi.exe
hxxp://domashneexxxporevo.ru/13/video/porno-rolik13.avi.exe
hxxp://domashneexxxporevo.ru/16/video/porno-rolik16.avi.exe
hxxp://domashneexxxporevo.ru/17/video/porno-rolik17.avi.exe
hxxp://domashneexxxporevo.ru/18/video/porno-rolik18.avi.exe
hxxp://domashneexxxporevo.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 26, 2011, 03:58:13 pm: Exploit pack link extracted from MBRLock host
Quote
hxxp://ksjhsf89w44.ru/index.php?tp=41e8265b85752fe4

MBRLocker
Quote
hxxp://ksjhsf89w44.ru/d.php?f=193&e=2

Exploit CVE-2010-1885
Quote
hxxp://ksjhsf89w44.ru/games/pch.php?f=193

Exploit CVE-2010-0840
Quote
hxxp://ksjhsf89w44.ru/games/worms.jar

Java exploit
Quote
hxxp://ksjhsf89w44.ru/games/java_trust.php?f=193
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 26, 2011, 06:59:22 pm: Fresh binaries with new unlock code "ULTRA"

Quote
hxxp://konchautnalizobabam.ru/11/video/porno-rolik11.avi.exe
hxxp://konchautnalizobabam.ru/12/video/porno-rolik12.avi.exe
hxxp://konchautnalizobabam.ru/13/video/porno-rolik13.avi.exe
hxxp://konchautnalizobabam.ru/16/video/porno-rolik16.avi.exe
hxxp://konchautnalizobabam.ru/17/video/porno-rolik17.avi.exe
hxxp://konchautnalizobabam.ru/18/video/porno-rolik18.avi.exe
hxxp://konchautnalizobabam.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 27, 2011, 09:43:42 am: Ransom known as "Pornoblocker"

Quote
hxxp://porntube1.ru/xvid/cc/click.php?id=1

To get actual exe you need to set referrer to something like IE6 otherwise 403.

Lock Em All ransom trace

Quote
hxxp://ebutsukkiz.ru/ -> hxxp://ookokdporn.ru/in.cgi?2 -> hxxp://komukpornod.ru/802/xxx_video.exe
Quote
hxxp://md3porno.ru/509/xxx_video.exe

Blackhole link extracted from LockEmAll HP
Quote
hxxp://j1w9d.ru/indexx.php?tp=c557a87a37267723

Deobfuscated here http://pastebin.com/FcT463rc

Ransom
Quote
hxxp://j1w9d.ru/d.php?f=243&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 27, 2011, 03:21:02 pm: MBRLocker

Quote
hxxp://beaverporn.in/xxxvideo.avi.exe

LockEmAll ransom

Quote
hxxp://uawadporno.ru/937/xxx_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 28, 2011, 09:00:35 am: MBRLocker

Quote
hxxp://agmak.in/xxxvideo.avi.exe

Pornoroliks

Quote
hxxp://freetraxdlyatebya.ru/11/video/porno-rolik11.avi.exe
hxxp://freetraxdlyatebya.ru/12/video/porno-rolik12.avi.exe
hxxp://freetraxdlyatebya.ru/13/video/porno-rolik13.avi.exe
hxxp://freetraxdlyatebya.ru/16/video/porno-rolik16.avi.exe
hxxp://freetraxdlyatebya.ru/17/video/porno-rolik17.avi.exe
hxxp://freetraxdlyatebya.ru/18/video/porno-rolik18.avi.exe
hxxp://freetraxdlyatebya.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 30, 2011, 11:38:01 am: Pornoroliks

Quote
hxxp://telkiizkontaktadayut.ru/11/video/porno-rolik11.avi.exe
hxxp://telkiizkontaktadayut.ru/12/video/porno-rolik12.avi.exe
hxxp://telkiizkontaktadayut.ru/13/video/porno-rolik13.avi.exe
hxxp://telkiizkontaktadayut.ru/16/video/porno-rolik16.avi.exe
hxxp://telkiizkontaktadayut.ru/17/video/porno-rolik17.avi.exe
hxxp://telkiizkontaktadayut.ru/18/video/porno-rolik18.avi.exe
hxxp://telkiizkontaktadayut.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 02, 2011, 06:51:07 am: Pornoroliks

Quote
hxxp://pornositerufree.ru/11/video/porno-rolik11.avi.exe
hxxp://pornositerufree.ru/12/video/porno-rolik12.avi.exe
hxxp://pornositerufree.ru/13/video/porno-rolik13.avi.exe
hxxp://pornositerufree.ru/16/video/porno-rolik16.avi.exe
hxxp://pornositerufree.ru/17/video/porno-rolik17.avi.exe
hxxp://pornositerufree.ru/18/video/porno-rolik18.avi.exe
hxxp://pornositerufree.ru/20/video/porno-rolik20.avi.exe

Redirector to pornoroliks
Quote
hxxp://sko-vna.ru/dfdasae.cgi?11

LockEmAll ransom

Quote
hxxp://mirijikaporno.ru/300/xxx_video.exe

Redirector to lockemall
Quote
hxxp://lopojadinja.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 04, 2011, 03:26:54 pm: Pornoroliks

Quote
hxxp://shkollnitsiebutsya.ru/11/video/porno-rolik11.avi.exe
hxxp://shkollnitsiebutsya.ru/12/video/porno-rolik12.avi.exe
hxxp://shkollnitsiebutsya.ru/13/video/porno-rolik13.avi.exe
hxxp://shkollnitsiebutsya.ru/14/video/porno-rolik14.avi.exe
hxxp://shkollnitsiebutsya.ru/16/video/porno-rolik16.avi.exe
hxxp://shkollnitsiebutsya.ru/17/video/porno-rolik17.avi.exe
hxxp://shkollnitsiebutsya.ru/18/video/porno-rolik18.avi.exe
hxxp://shkollnitsiebutsya.ru/20/video/porno-rolik20.avi.exe

Redirector for pornoroliks
Quote
hxxp://zirn-ba.ru/sdgerwgerh.cgi?11
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 05, 2011, 12:23:42 pm: Pornoroliks + redirector

Quote
hxxp://mamkidayutvpopku.ru/11/video/porno-rolik11.avi.exe
hxxp://mamkidayutvpopku.ru/12/video/porno-rolik12.avi.exe
hxxp://mamkidayutvpopku.ru/13/video/porno-rolik13.avi.exe
hxxp://mamkidayutvpopku.ru/14/video/porno-rolik14.avi.exe
hxxp://mamkidayutvpopku.ru/16/video/porno-rolik16.avi.exe
hxxp://mamkidayutvpopku.ru/17/video/porno-rolik17.avi.exe
hxxp://mamkidayutvpopku.ru/18/video/porno-rolik18.avi.exe
hxxp://mamkidayutvpopku.ru/20/video/porno-rolik20.avi.exe
hxxp://alop-sa.ru/fdsbthtrtj.cgi?12
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 08, 2011, 01:06:10 pm: LockEmAll ransom
Quote
hxxp://dqn6drj.ru/22/xxx_video.exe

Blackhole exploit kit
Quote
hxxp://demwful.ru/indexx.php?tp=1f2965b33ed2cc11

Redirector to LockEmAll ransom
Quote
hxxp://bliadipoo.ru/in.cgi?2

Pornoroliks
Quote
hxxp://veronikapornosex.ru/11/video/porno-rolik11.avi.exe
hxxp://veronikapornosex.ru/12/video/porno-rolik12.avi.exe
hxxp://veronikapornosex.ru/13/video/porno-rolik13.avi.exe
hxxp://veronikapornosex.ru/14/video/porno-rolik14.avi.exe
hxxp://veronikapornosex.ru/16/video/porno-rolik16.avi.exe
hxxp://veronikapornosex.ru/17/video/porno-rolik17.avi.exe
hxxp://veronikapornosex.ru/18/video/porno-rolik18.avi.exe
hxxp://veronikapornosex.ru/20/video/porno-rolik20.avi.exe

Redirector to pornorolik
Quote
hxxp://giri-ji.ru/fdbrehe.cgi?11
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 10, 2011, 12:06:55 pm: Pornoroliks, only updated binaries listed, all others (13, 16, 18, 20) not updated for a long time.

Quote
hxxp://pornovirtualxxx.ru/11/video/porno-rolik11.avi.exe
hxxp://pornovirtualxxx.ru/12/video/porno-rolik12.avi.exe
hxxp://pornovirtualxxx.ru/14/video/porno-rolik14.avi.exe
hxxp://pornovirtualxxx.ru/17/video/porno-rolik17.avi.exe

Redirector for pornoroliks

Quote
hxxp://arudir-z.ru/vbnmgfhm.cgi?11
hxxp://arudir-z.ru/vbnmgfhm.cgi?12
hxxp://arudir-z.ru/vbnmgfhm.cgi?14
hxxp://arudir-z.ru/vbnmgfhm.cgi?17

LockEmAll ransom
Quote
hxxp://hiokporno.ru/porn_video.exe
hxxp://wwvejwd.ru/12/xxx_video.exe

Redirector to LockEmAll ransom
Quote
hxxp://eriosporkas.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 11, 2011, 04:32:55 pm: Pornoroliks (they seems started scheduler for auto re-crypt each few hours).

Quote
hxxp://ilikerusporevo.ru/11/video/porno-rolik11.avi.exe
hxxp://ilikerusporevo.ru/12/video/porno-rolik12.avi.exe
hxxp://ilikerusporevo.ru/14/video/porno-rolik14.avi.exe
hxxp://ilikerusporevo.ru/17/video/porno-rolik17.avi.exe

Redirectors to pornoroliks
Quote
hxxp://britol-x.ru/rehehdfbere.cgi?11
hxxp://britol-x.ru/rehehdfbere.cgi?12
hxxp://britol-x.ru/rehehdfbere.cgi?14
hxxp://britol-x.ru/rehehdfbere.cgi?17

LockEmAll ransom
Quote
hxxp://xp58iod.ru/77/xxx_video.exe

Redirector path
Quote
hxxp://bybybgydas.ru/ -> hxxp://bybybgydas.ru/video.htm ->
hxxp://nunutufaka.ru/in.cgi?2
hxxp://nunutufaka.ru/in.cgi?3
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 12, 2011, 01:35:17 pm: Pornoroliks (directs links because domain names heavily mutates each hour-two)

Quote
hxxp://195.226.220.142/11/video/porno-rolik11.avi.exe
hxxp://195.226.220.142/12/video/porno-rolik12.avi.exe
hxxp://195.226.220.142/13/video/porno-rolik13.avi.exe
hxxp://195.226.220.142/14/video/porno-rolik14.avi.exe
hxxp://195.226.220.142/16/video/porno-rolik16.avi.exe
hxxp://195.226.220.142/17/video/porno-rolik17.avi.exe
hxxp://195.226.220.142/18/video/porno-rolik18.avi.exe
hxxp://195.226.220.142/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 13, 2011, 03:48:01 pm: Ransom "System Antivirus Microsoft 2011"

Quote
hxxp://virobala.in/porn_video.exe

Another creature distributed by LockEmAll gang

(http://img845.imageshack.us/img845/5002/s2011.th.png) (http://imageshack.us/photo/my-images/845/s2011.png/)
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 15, 2011, 06:40:45 am: Ransom LockEmAll

Quote
hxxp://mirkapopas.ru/ -> hxxp://mirkapopas.ru/video.htm -> hxxp://milinixas.ru/in.cgi?2 -> hxxp://dwzporn4.ru/ -> hxxp://dwzporn4.ru/11/xxx_video.exe
Quote
hxxp://xpl0ics.ru/d.php?f=338&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 15, 2011, 09:31:47 am: Ransom

Quote
hxxp://togetgirl.net/porn_video.exe

hxxp://togetgirl.net/ contains embedded link to Blackhole

Quote
hxxp://officara.in/index.php?tp=792a34dfd2fe3709
(here http://pastebin.com/bKZD2n29 deobfuscated)

Ransom
Quote
hxxp://officara.in/d.php?f=251&e=2

Exploits
Quote
hxxp://officara.in/games/pch.php?f=251
hxxp://officara.in/games/2fdp.php?f=251
hxxp://officara.in/games/worms.jar
hxxp://officara.in/games/java_trust.php?f=251
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 16, 2011, 01:50:59 am: Pornorolik moved because of server shutdown.

New location
Quote
hxxp://91.228.160.52/20/video/porno-rolik20.avi.exe
hxxp://91.228.160.52/18/video/porno-rolik18.avi.exe
hxxp://91.228.160.52/17/video/porno-rolik17.avi.exe
hxxp://91.228.160.52/16/video/porno-rolik16.avi.exe
hxxp://91.228.160.52/14/video/porno-rolik14.avi.exe
hxxp://91.228.160.52/13/video/porno-rolik13.avi.exe
hxxp://91.228.160.52/12/video/porno-rolik12.avi.exe
hxxp://91.228.160.52/11/video/porno-rolik11.avi.exe

Redirector
Quote
hxxp://bon-mak-r.ru/trhtrhtrd.cgi?12
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 16, 2011, 07:52:48 am: Hoster webxhost (not sure if it's not malware support :D) blocked access by IP due to abuse, but files are still available through domain names.
Samples constantly repacking (one time per 15-20 minutes).

Quote
hxxp://insertpenisgirls.ru/11/video/porno-rolik11.avi.exe
hxxp://insertpenisgirls.ru/12/video/porno-rolik12.avi.exe
hxxp://insertpenisgirls.ru/13/video/porno-rolik13.avi.exe
hxxp://insertpenisgirls.ru/14/video/porno-rolik14.avi.exe
hxxp://insertpenisgirls.ru/16/video/porno-rolik16.avi.exe
hxxp://insertpenisgirls.ru/17/video/porno-rolik17.avi.exe
hxxp://insertpenisgirls.ru/18/video/porno-rolik18.avi.exe
hxxp://insertpenisgirls.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 16, 2011, 11:37:08 am: New pornoroliks (previous locations gives 404)

Quote
hxxp://formulasporno.ru/11/video/porno-rolik11.avi.exe
hxxp://formulasporno.ru/12/video/porno-rolik12.avi.exe
hxxp://formulasporno.ru/13/video/porno-rolik13.avi.exe
hxxp://formulasporno.ru/14/video/porno-rolik14.avi.exe
hxxp://formulasporno.ru/16/video/porno-rolik16.avi.exe
hxxp://formulasporno.ru/17/video/porno-rolik17.avi.exe
hxxp://formulasporno.ru/18/video/porno-rolik18.avi.exe
hxxp://formulasporno.ru/20/video/porno-rolik20.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 16, 2011, 10:04:53 pm: Moved to new host (95.57.120.140).

Pornorolik renamed to videos

Quote
hxxp://hottotalporevo.ru/s11l/video/videos11.avi.exe
hxxp://deskxxxporno.ru/s11l/video/videos11.avi.exe
hxxp://supportpornoru.ru/s11l/video/videos11.avi.exe
hxxp://totralgoodporno.ru/s12o/video/videos12.avi.exe
hxxp://deskxxxporno.ru/s12o/video/videos12.avi.exe
hxxp://supportpornoru.ru/s17v/video/videos17.avi.exe
hxxp://hottotalporevo.ru/s17v/video/videos17.avi.exe
hxxp://deskxxxporno.ru/s17v/video/videos17.avi.exe

Redirector
Quote
hxxp://1triret.ru/dehehdsv.cgi?11
hxxp://1triret.ru/dehehdsv.cgi?12
hxxp://1triret.ru/dehehdsv.cgi?17
Title: Re: Trojan Ransom
Post by: mc0blck on August 17, 2011, 04:48:58 am: Abuses have been sent to GOHost.kz and ADVANCEDHOSTERS
Title: Re: Trojan Ransom
Post by: mc0blck on August 17, 2011, 02:07:26 pm: Quote from: EP_X0FF on August 16, 2011, 10:04:53 pm
Redirector
Quote
hxxp://1triret.ru/dehehdsv.cgi?11
hxxp://1triret.ru/dehehdsv.cgi?12
hxxp://1triret.ru/dehehdsv.cgi?17

Redirectors were taken down.
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 17, 2011, 02:32:54 pm: they already spawned new

redirectors
Quote
hxxp://2domnat.ru/ddfwefwg.cgi?11
hxxp://2domnat.ru/ddfwefwg.cgi?12
hxxp://2domnat.ru/ddfwefwg.cgi?17

pornorolik ransom (aka Trojan:Win32/Ransom.DN)

update 95.57.120.140 (where all randomized domains hosted) is off. Redirectors are pointing to nowhere (at the moment of post).

Quote
hxxp://m0repornoxxx.ru/s11l/video/videos11.avi.exe
hxxp://m0repornoxxx.ru/s12o/video/videos12.avi.exe
hxxp://m0repornoxxx.ru/s17v/video/videos17.avi.exe

all repacked and new

LockEmAll (aka Trojan:Win32/Ransom.DF)

Quote
hxxp://91.228.133.72/d.php?f=155&e=2
hxxp://91.228.133.72/d.php?f=348&e=2
hxxp://91.228.133.72/d.php?f=349&e=2
hxxp://91.228.133.72/d.php?f=350&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 19, 2011, 03:04:54 am: Pornorolik (moved to new host 91.220.90.30)

Quote
hxxp://tolkonewpornru.ru/s11l/video/videos11.avi.exe
hxxp://tolkonewpornru.ru/s12o/video/videos12.avi.exe
hxxp://tolkonewpornru.ru/s17v/video/videos17.avi.exe

Redirector path
Quote
hxxp://3nimnas.ru/dfgherh.cgi?12 (88.208.33.154) -> hxxp://newxxxsexru.ru/s12o/vu-index.html (91.220.90.30) -> hxxp://newxxxsexru.ru/s12o/video/videos12.avi.exe (91.220.90.30)

LockEmAll path
Quote
hxxp://ookokdporn.ru/in.cgi?2 (91.221.99.241) -> hxxp://ololosadasas.ru/in.cgi?15 (91.221.99.241) -> hxxp://zw5porn3.ru/74/ (91.220.0.66) -> hxxp://zw5porn3.ru/74/xxx_video.exe (91.220.0.66)

list is partially courtesy of mc0blck :)

LockEmAll more

Quote
hxxp://91.228.133.72/d.php?f=353&e=2
hxxp://91.228.133.72/d.php?f=354&e=2
hxxp://91.228.133.72/d.php?f=355&e=2
hxxp://91.228.133.72/d.php?f=356&e=2
hxxp://91.228.133.72/d.php?f=358&e=2
hxxp://91.228.133.72/d.php?f=359&e=2
hxxp://91.228.133.72/d.php?f=360&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 19, 2011, 01:35:40 pm: Pornorolik moved again (109.127.8.249)

Quote
hxxp://svejeepornoru.ru/s11l/video/videos11.avi.exe
hxxp://svejeepornoru.ru/s12o/video/videos12.avi.exe
hxxp://svejeepornoru.ru/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 20, 2011, 11:32:12 am: Pornorolik

Quote
hxxp://sexvkontaktru.ru/s11l/video/videos11.avi.exe
hxxp://sexvkontaktru.ru/s12o/video/videos12.avi.exe
hxxp://sexvkontaktru.ru/s17v/video/videos17.avi.exe

LockEmAll
Quote
hxxp://91.228.133.72/d.php?f=361&e=2
hxxp://91.228.133.72/d.php?f=362&e=2
hxxp://91.228.133.72/d.php?f=363&e=2
hxxp://91.228.133.72/d.php?f=364&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 21, 2011, 01:59:08 pm: Pornorolik ransom

Quote
hxxp://pornocityru.ru/s11l/video/videos11.avi.exe
hxxp://pornocityru.ru/s17v/video/videos17.avi.exe

LockEmAll ransom

Quote
hxxp://91.228.133.72/d.php?f=365&e=2
hxxp://91.228.133.72/d.php?f=367&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 21, 2011, 05:22:51 pm: Pornorolik redirectors

Quote
hxxp://xxx-pornomovs.ru/nnnclick/in.cgi?26
hxxp://vertol-j.ru/rththtrr.cgi?11
hxxp://vertol-j.ru/rththtrr.cgi?17

Pornorolik ransom
Quote
hxxp://speedporevonow.ru/s11l/video/videos11.avi.exe
hxxp://speedporevonow.ru/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 22, 2011, 10:06:26 am: Pornorolik

Quote
hxxp://gopornogosexxx.ru/s11l/video/videos11.avi.exe
hxxp://gopornogosexxx.ru/s17v/video/videos17.avi.exe
hxxp://sexsexvoolhard.ru/s11l/video/videos11.avi.exe
hxxp://sexsexvoolhard.ru/s17v/video/videos17.avi.exe

LockEmAll (comes without any kind of unblock code, even in case of payment).

Quote
hxxp://91.228.133.72/d.php?f=368&e=2
hxxp://91.228.133.72/d.php?f=369&e=2
hxxp://91.228.133.72/d.php?f=371&e=2
hxxp://91.228.133.72/d.php?f=372&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 22, 2011, 11:15:49 am: Domains used by Pornorolik 22 August

Quote
hxxp://HDKRUTOPORNOSEX.RU/s11l/video/videos11.avi.exe
hxxp://HDKRUTOPORNOSEX.RU/s17v/video/videos17.avi.exe
hxxp://RUSGORODPORNOXXX.RU/s17v/video/videos17.avi.exe
hxxp://RUSGORODPORNOXXX.RU/s11l/video/videos11.avi.exe
hxxp://RUFULLHDPOREVO.RU/s11l/video/videos11.avi.exe
hxxp://RUFULLHDPOREVO.RU/s17v/video/videos17.avi.exe
hxxp://VSEPORNONAODNOMSAITE.RU/s11l/video/videos11.avi.exe
hxxp://VSEPORNONAODNOMSAITE.RU/s17v/video/videos17.avi.exe
hxxp://FULLXXXSEXRU.RU/s11l/video/videos11.avi.exe
hxxp://FULLXXXSEXRU.RU/s17v/video/videos17.avi.exe
hxxp://VISUALPORNOLITE.RU/s11l/video/videos11.avi.exe
hxxp://VISUALPORNOLITE.RU/s17v/video/videos17.avi.exe
hxxp://FULLPORNOVERSION.RU/s11l/video/videos11.avi.exe
hxxp://FULLPORNOVERSION.RU/s17v/video/videos17.avi.exe
hxxp://PORNOVGORODERUS.RU/s11l/video/videos11.avi.exe
hxxp://PORNOVGORODERUS.RU/s17v/video/videos17.avi.exe
hxxp://VERYHARDFILMSSEX.RU/s11l/video/videos11.avi.exe
hxxp://VERYHARDFILMSSEX.RU/s17v/video/videos17.avi.exe
hxxp://SPEEDPOREVONOW.RU/s11l/video/videos11.avi.exe
hxxp://SPEEDPOREVONOW.RU/s17v/video/videos17.avi.exe
hxxp://ODINSAITVSEPOREVO.RU/s11l/video/videos11.avi.exe
hxxp://ODINSAITVSEPOREVO.RU/s17v/video/videos17.avi.exe
hxxp://SEXVKONTAKTESET.RU/s11l/video/videos11.avi.exe
hxxp://SEXVKONTAKTESET.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOKA4ESTVENNOGOPORNO.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOKA4ESTVENNOGOPORNO.RU/s17v/video/videos17.avi.exe
hxxp://KA4AYVKONTAKTEXXPORNO.RU/s11l/video/videos11.avi.exe
hxxp://KA4AYVKONTAKTEXXPORNO.RU/s17v/video/videos17.avi.exe
hxxp://RUSSKOEXXXPORNO.RU/s11l/video/videos11.avi.exe
hxxp://RUSSKOEXXXPORNO.RU/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 23, 2011, 03:29:21 am: Domains used by Pornorolik 23 August
All already operational.

Quote
hxxp://AVIHDPORNOVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://AVIHDPORNOVIDEO.RU/s17v/video/videos17.avi.exe
hxxp://OGROMNIYPORNOARCHIV.RU/s11l/video/videos11.avi.exe
hxxp://OGROMNIYPORNOARCHIV.RU/s17v/video/videos17.avi.exe
hxxp://SOSKIRUTELO4KI.RU/s11l/video/videos11.avi.exe
hxxp://SOSKIRUTELO4KI.RU/s17v/video/videos17.avi.exe
hxxp://NIKITAPORNOCLUB.RU/s11l/video/videos11.avi.exe
hxxp://NIKITAPORNOCLUB.RU/s17v/video/videos17.avi.exe
hxxp://SOSKAVROTPORNO.RU/s11l/video/videos11.avi.exe
hxxp://SOSKAVROTPORNO.RU/s17v/video/videos17.avi.exe
hxxp://NATALIPALKAVROT.RU/s11l/video/videos11.avi.exe
hxxp://NATALIPALKAVROT.RU/s17v/video/videos17.avi.exe
hxxp://SOSETSPERMUKRUTO.RU/s11l/video/videos11.avi.exe
hxxp://SOSETSPERMUKRUTO.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOSPERMINAPISKI.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOSPERMINAPISKI.RU/s17v/video/videos17.avi.exe
hxxp://RUSSKOEPORNOSEX.RU/s11l/video/videos11.avi.exe
hxxp://RUSSKOEPORNOSEX.RU/s17v/video/videos17.avi.exe
hxxp://MNOGORUSSKIXMALOLETOK.RU/s11l/video/videos11.avi.exe
hxxp://MNOGORUSSKIXMALOLETOK.RU/s17v/video/videos17.avi.exe
hxxp://RUSSKAYANADYADAET.RU/s11l/video/videos11.avi.exe
hxxp://RUSSKAYANADYADAET.RU/s17v/video/videos17.avi.exe
hxxp://LENASOSKACOOL.RU/s11l/video/videos11.avi.exe
hxxp://LENASOSKACOOL.RU/s17v/video/videos17.avi.exe
hxxp://PRKAARINASU4KA.RU/s11l/video/videos11.avi.exe
hxxp://PRKAARINASU4KA.RU/s17v/video/videos17.avi.exe
hxxp://XXLPORNORUNOW.RU/s11l/video/videos11.avi.exe
hxxp://XXLPORNORUNOW.RU/s17v/video/videos17.avi.exe
hxxp://INTERNETPORNORU.RU/s11l/video/videos11.avi.exe
hxxp://INTERNETPORNORU.RU/s17v/video/videos17.avi.exe
hxxp://PORNOPLUSFLIRT.RU/s11l/video/videos11.avi.exe
hxxp://PORNOPLUSFLIRT.RU/s17v/video/videos17.avi.exe
hxxp://XLPORNOSITERU.RU/s11l/video/videos11.avi.exe
hxxp://XLPORNOSITERU.RU/s17v/video/videos17.avi.exe
hxxp://FLIRTYOURPORNXXX.RU/s11l/video/videos11.avi.exe
hxxp://FLIRTYOURPORNXXX.RU/s17v/video/videos17.avi.exe
hxxp://POREVOXXLPOPKA.RU/s11l/video/videos11.avi.exe
hxxp://POREVOXXLPOPKA.RU/s17v/video/videos17.avi.exe
hxxp://UKRAINATSELKIXXX.RU/s11l/video/videos11.avi.exe
hxxp://UKRAINATSELKIXXX.RU/s17v/video/videos17.avi.exe

LockEmAll

Quote
hxxp://91.228.133.72/d.php?f=375&e=2
hxxp://91.228.133.72/d.php?f=376&e=2
hxxp://91.228.133.72/d.php?f=377&e=2
hxxp://91.228.133.72/d.php?f=378&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 24, 2011, 05:23:48 am: LockEmAll

Quote
hxxp://91.228.133.72/f.php?f=380&e=2
hxxp://91.228.133.72/f.php?f=381&e=2
hxxp://91.228.133.72/f.php?f=382&e=2
hxxp://91.228.133.72/f.php?f=383&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 24, 2011, 06:32:43 am: Domain names preallocated 23 August to use as LockEmAll/Blackhole dropzones.

Starting from the beginning of July LockEmAll allocated 474 domain names + 75 used for redirectors, Pornorolik allocated 515 domain names + 38 used for redirectors.

The following names will be used by LockEmAll while next week (24 Aug - 01 Sept).

Quote
YQ2PORN3.RU
EEBVID8.RU
FEMVIDEO6.RU
HJJPORN2.RU
KINVID6.RU
ORCVID7.RU
WE5PORN1.RU
YFVVIDEO3.RU
CYBVID8.RU
EWJPORN2.RU
HGVPORN7.RU
KIBPORN2.RU
NUMVID5.RU
VTVVID4.RU
XTZVIDEO8.RU
CFVVID5.RU
ETCVID6.RU
HFCVIDEO6.RU
KGKVIDEO6.RU
NH2VID7.RU
QWBVID8.RU
XR5VID8.RU
BUNVIDEO7.RU
EPXVIDEO6.RU
GYVVID7.RU
KGBVIDEO6.RU
MWBVIDEO7.RU
QR5PORN3.RU
BEKVIDEO7.RU
EJKVIDEO6.RU
GTLPORN5.RU
JJLVID8.RU
LY5PORN4.RU
QEMPORN4.RU
WRBPORN5.RU
AYBVID8.RU
EHJPORN8.RU
GFLPORN2.RU
JENPORN4.RU
LSKVIDEO8.RU
PSMPORN5.RU
WHXVIDEO6.RU
ZOZVID8.RU
AU5VID5.RU
EHBVID8.RU
GF5PORN6.RU
JDJVIDEO4.RU
LSJVID7.RU
PIKVID5.RU
WGKPORN5.RU
ZA5VID8.RU
EFVPORN6.RU
GAXVID4.RU
HO2VIDEO1.RU
LDNVID8.RU
PIJVIDEO1.RU
WFKVIDEO5.RU

LockEmAll redirectors allocated 6 day ago (always active only one per day, next day it deactivates)

Quote
PARANOYAPORNO.RU (Currently active)
NBYPORNO.RU
MUOPORKKA.RU
LIASHPORNO.RU
BZXPORNO.RU
VINPORJAD.RU
PORNOZPORKKAS.RU
POIUNIKIA.RU (Currently used as second stage redirector)

Second stage redirector always used to point to valid and operational LockEmAll domain.
For example today it looks like this

Quote
hxxp://paranoyaporno.ru/ -> hxxp://paranoyaporno.ru/video.htm -> hxxp://poiunikia.ru/in.cgi?2 -> hxxp://poiunikia.ru/in.cgi?14 -> hxxp://vynvid5.ru/14/ -> hxxp://vynvid5.ru/14/xxx_video.exe)

vynvid5.ru allocated 6 days ago, so it's not in list. Also you may notice that redirector param hxxp://poiunikia.ru/in.cgi?14 (highlighted) used to generate part of address -> hxxp://vynvid5.ru/14/.
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 24, 2011, 11:40:21 am: Pornorolik, new domains

Quote
hxxp://davayhardporku.ru/s11l/video/videos11.avi.exe
hxxp://davayhardporku.ru/s17v/video/videos17.avi.exe
hxxp://davayhardporku.ru/s12o/video/videos12.avi.exe
hxxp://hardsexxxporno.ru/s11l/video/videos11.avi.exe
hxxp://hardsexxxporno.ru/s17v/video/videos17.avi.exe
hxxp://hardsexxxporno.ru/s12o/video/videos12.avi.exe
hxxp://sosisuka4len.ru/s11l/video/videos11.avi.exe
hxxp://sosisuka4len.ru/s17v/video/videos17.avi.exe
hxxp://sosisuka4len.ru/s12o/video/videos12.avi.exe

Redirector

Quote
hxxp://9sarkov.ru/in.cgi?11
hxxp://9sarkov.ru/in.cgi?12
hxxp://9sarkov.ru/in.cgi?17
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 25, 2011, 03:34:02 am: Pornorolik domains allocated today

Quote
hxxp://HOTPOREVOXXX.RU/s11l/video/videos11.avi.exe
hxxp://HOTPOREVOXXX.RU/s12o/video/videos12.avi.exe
hxxp://HOTPOREVOXXX.RU/s17v/video/videos17.avi.exe
hxxp://RUSPOPKIDAYUTLIZNUT.RU/s11l/video/videos11.avi.exe
hxxp://RUSPOPKIDAYUTLIZNUT.RU/s12o/video/videos12.avi.exe
hxxp://RUSPOPKIDAYUTLIZNUT.RU/s17v/video/videos17.avi.exe
hxxp://PORNOFILMXXXDA.RU/s11l/video/videos11.avi.exe
hxxp://PORNOFILMXXXDA.RU/s12o/video/videos12.avi.exe
hxxp://PORNOFILMXXXDA.RU/s17v/video/videos17.avi.exe
hxxp://DOMENSITESEXRU.RU/s11l/video/videos11.avi.exe
hxxp://DOMENSITESEXRU.RU/s12o/video/videos12.avi.exe
hxxp://DOMENSITESEXRU.RU/s17v/video/videos17.avi.exe
hxxp://PORKATRAXHARDRU.RU/s11l/video/videos11.avi.exe
hxxp://PORKATRAXHARDRU.RU/s12o/video/videos12.avi.exe
hxxp://PORKATRAXHARDRU.RU/s17v/video/videos17.avi.exe
hxxp://DOMENPORNOSEXRU.RU/s11l/video/videos11.avi.exe
hxxp://DOMENPORNOSEXRU.RU/s12o/video/videos12.avi.exe
hxxp://DOMENPORNOSEXRU.RU/s17v/video/videos17.avi.exe
hxxp://POPKIRRRRKRUTO.RU/s11l/video/videos11.avi.exe
hxxp://POPKIRRRRKRUTO.RU/s12o/video/videos12.avi.exe
hxxp://POPKIRRRRKRUTO.RU/s17v/video/videos17.avi.exe
hxxp://PHONEPORNOCLUBBERS.RU/s11l/video/videos11.avi.exe
hxxp://PHONEPORNOCLUBBERS.RU/s12o/video/videos12.avi.exe
hxxp://PHONEPORNOCLUBBERS.RU/s17v/video/videos17.avi.exe
hxxp://VPOPKUPOSPERMERU.RU/s11l/video/videos11.avi.exe
hxxp://VPOPKUPOSPERMERU.RU/s12o/video/videos12.avi.exe
hxxp://VPOPKUPOSPERMERU.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOSOSUTXXX.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOSOSUTXXX.RU/s12o/video/videos12.avi.exe
hxxp://MNOGOSOSUTXXX.RU/s17v/video/videos17.avi.exe
hxxp://VPISUMNOGOSPEMY.RU/s11l/video/videos11.avi.exe
hxxp://VPISUMNOGOSPEMY.RU/s12o/video/videos12.avi.exe
hxxp://VPISUMNOGOSPEMY.RU/s17v/video/videos17.avi.exe
hxxp://KON4AYUTNALIZO.RU/s11l/video/videos11.avi.exe
hxxp://KON4AYUTNALIZO.RU/s12o/video/videos12.avi.exe
hxxp://KON4AYUTNALIZO.RU/s17v/video/videos17.avi.exe
hxxp://KAKMNOGOSEXROLIKOV.RU/s11l/video/videos11.avi.exe
hxxp://KAKMNOGOSEXROLIKOV.RU/s12o/video/videos12.avi.exe
hxxp://KAKMNOGOSEXROLIKOV.RU/s17v/video/videos17.avi.exe
hxxp://SMOTRISKOLKOMNOHOPOREVO.RU/s11l/video/videos11.avi.exe
hxxp://SMOTRISKOLKOMNOHOPOREVO.RU/s12o/video/videos12.avi.exe
hxxp://SMOTRISKOLKOMNOHOPOREVO.RU/s17v/video/videos17.avi.exe

Pornorolik redirector

Quote
hxxp://8piloti.ru/in.cgi?11
hxxp://8piloti.ru/in.cgi?12
hxxp://8piloti.ru/in.cgi?17

LockEmAll from Blackhole

Quote
hxxp://91.228.133.72/z.php?f=384&e=2
hxxp://91.228.133.72/z.php?f=385&e=2
Title: Re: Trojan Ransom
Post by: mc0blck on August 25, 2011, 09:11:47 am: Please send an abuse to block the malware (trojan ransom) hosted on IP (46.165.192.161)
hxxp://ujixuwrubvf.com/d.php?f=26&e=2
Title: Re: Trojan Ransom
Post by: SysAdMini on August 25, 2011, 01:20:41 pm: Quote from: mc0blck on August 25, 2011, 09:11:47 am
Please send an abuse to block the malware (trojan ransom) hosted on IP (46.165.192.161)
hxxp://ujixuwrubvf.com/d.php?f=26&e=2

It's not trojan ransom, but Sinowal/Mebroot. Abuse report already sent.
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 26, 2011, 03:43:08 am: Pornorolik allocated domains 25-26 August

Quote
hxxp://LOVIVPOPUSUKA.RU/s11l/video/videos11.avi.exe
hxxp://LOVIVPOPUSUKA.RU/s12o/video/videos12.avi.exe
hxxp://LOVIVPOPUSUKA.RU/s17v/video/videos17.avi.exe
hxxp://ORGIYANADNUHE.RU/s11l/video/videos11.avi.exe
hxxp://ORGIYANADNUHE.RU/s12o/video/videos12.avi.exe
hxxp://ORGIYANADNUHE.RU/s17v/video/videos17.avi.exe
hxxp://RUSSKOEMEGAPORKASEX.RU/s11l/video/videos11.avi.exe
hxxp://RUSSKOEMEGAPORKASEX.RU/s12o/video/videos12.avi.exe
hxxp://RUSSKOEMEGAPORKASEX.RU/s17v/video/videos17.avi.exe
hxxp://KLUBNI4KAPORKAXXX.RU/s11l/video/videos11.avi.exe
hxxp://KLUBNI4KAPORKAXXX.RU/s12o/video/videos12.avi.exe
hxxp://KLUBNI4KAPORKAXXX.RU/s17v/video/videos17.avi.exe
hxxp://NAVIBORVSETRLO4KI.RU/s11l/video/videos11.avi.exe
hxxp://NAVIBORVSETRLO4KI.RU/s12o/video/videos12.avi.exe
hxxp://NAVIBORVSETRLO4KI.RU/s17v/video/videos17.avi.exe
hxxp://RUORGIYADOMA.RU/s11l/video/videos11.avi.exe
hxxp://RUORGIYADOMA.RU/s12o/video/videos12.avi.exe
hxxp://RUORGIYADOMA.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOAV1VIDEO.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOAV1VIDEO.RU/s12o/video/videos12.avi.exe
hxxp://MNOGOAV1VIDEO.RU/s17v/video/videos17.avi.exe
hxxp://RULENTAPORNOAVI.RU/s11l/video/videos11.avi.exe
hxxp://RULENTAPORNOAVI.RU/s12o/video/videos12.avi.exe
hxxp://RULENTAPORNOAVI.RU/s17v/video/videos17.avi.exe
hxxp://DLYATEBYAPORNOJURNALS.RU/s11l/video/videos11.avi.exe
hxxp://DLYATEBYAPORNOJURNALS.RU/s12o/video/videos12.avi.exe
hxxp://DLYATEBYAPORNOJURNALS.RU/s17v/video/videos17.avi.exe
hxxp://MNOGO1ARCHIVVIDEORU.RU/s11l/video/videos11.avi.exe
hxxp://MNOGO1ARCHIVVIDEORU.RU/s12o/video/videos12.avi.exe
hxxp://MNOGO1ARCHIVVIDEORU.RU/s17v/video/videos17.avi.exe
hxxp://PUSTELEPORNOKLASS.RU/s11l/video/videos11.avi.exe
hxxp://PUSTELEPORNOKLASS.RU/s12o/video/videos12.avi.exe
hxxp://PUSTELEPORNOKLASS.RU/s17v/video/videos17.avi.exe
hxxp://TRITRAHSU4KIPORNO.RU/s11l/video/videos11.avi.exe
hxxp://TRITRAHSU4KIPORNO.RU/s12o/video/videos12.avi.exe
hxxp://TRITRAHSU4KIPORNO.RU/s17v/video/videos17.avi.exe
hxxp://DAVAYMNOGOSEXARU.RU/s11l/video/videos11.avi.exe
hxxp://DAVAYMNOGOSEXARU.RU/s12o/video/videos12.avi.exe
hxxp://DAVAYMNOGOSEXARU.RU/s17v/video/videos17.avi.exe
hxxp://MEGAAVIPORN0VIDEO.RU/s11l/video/videos11.avi.exe
hxxp://MEGAAVIPORN0VIDEO.RU/s12o/video/videos12.avi.exe
hxxp://MEGAAVIPORN0VIDEO.RU/s17v/video/videos17.avi.exe
hxxp://PORNOXXXJURNAL.RU/s11l/video/videos11.avi.exe
hxxp://PORNOXXXJURNAL.RU/s12o/video/videos12.avi.exe
hxxp://PORNOXXXJURNAL.RU/s17v/video/videos17.avi.exe
hxxp://TRAHDVAPORNO.RU/s11l/video/videos11.avi.exe
hxxp://TRAHDVAPORNO.RU/s12o/video/videos12.avi.exe
hxxp://TRAHDVAPORNO.RU/s17v/video/videos17.avi.exe
hxxp://CU4KUPOLNIYULET.RU/s11l/video/videos11.avi.exe
hxxp://CU4KUPOLNIYULET.RU/s12o/video/videos12.avi.exe
hxxp://CU4KUPOLNIYULET.RU/s17v/video/videos17.avi.exe
hxxp://MEGAARHIVYPORNO.RU/s11l/video/videos11.avi.exe
hxxp://MEGAARHIVYPORNO.RU/s12o/video/videos12.avi.exe
hxxp://MEGAARHIVYPORNO.RU/s17v/video/videos17.avi.exe
hxxp://PORNOSUKASOSI.RU/s11l/video/videos11.avi.exe
hxxp://PORNOSUKASOSI.RU/s12o/video/videos12.avi.exe
hxxp://PORNOSUKASOSI.RU/s17v/video/videos17.avi.exe
hxxp://SKOLKOVASKOGOPORNO.RU/s11l/video/videos11.avi.exe
hxxp://SKOLKOVASKOGOPORNO.RU/s12o/video/videos12.avi.exe
hxxp://SKOLKOVASKOGOPORNO.RU/s17v/video/videos17.avi.exe
hxxp://COKEVPISKUJJET.RU/s11l/video/videos11.avi.exe
hxxp://COKEVPISKUJJET.RU/s12o/video/videos12.avi.exe
hxxp://COKEVPISKUJJET.RU/s17v/video/videos17.avi.exe
hxxp://MARINAHO4ETSPERMI.RU/s11l/video/videos11.avi.exe
hxxp://MARINAHO4ETSPERMI.RU/s12o/video/videos12.avi.exe
hxxp://MARINAHO4ETSPERMI.RU/s17v/video/videos17.avi.exe
hxxp://PORNOLENTASEX.RU/s11l/video/videos11.avi.exe
hxxp://PORNOLENTASEX.RU/s12o/video/videos12.avi.exe
hxxp://PORNOLENTASEX.RU/s17v/video/videos17.avi.exe
hxxp://SEXMNOGOO4ENRU.RU/s11l/video/videos11.avi.exe
hxxp://SEXMNOGOO4ENRU.RU/s12o/video/videos12.avi.exe
hxxp://SEXMNOGOO4ENRU.RU/s17v/video/videos17.avi.exe
hxxp://BERYVSEXNASEX.RU/s11l/video/videos11.avi.exe
hxxp://BERYVSEXNASEX.RU/s12o/video/videos12.avi.exe
hxxp://BERYVSEXNASEX.RU/s17v/video/videos17.avi.exe
hxxp://LOVYTRAXNOWONLINE.RU/s11l/video/videos11.avi.exe
hxxp://LOVYTRAXNOWONLINE.RU/s12o/video/videos12.avi.exe
hxxp://LOVYTRAXNOWONLINE.RU/s17v/video/videos17.avi.exe
hxxp://PORNOJURNAL4U.RU/s11l/video/videos11.avi.exe
hxxp://PORNOJURNAL4U.RU/s12o/video/videos12.avi.exe
hxxp://PORNOJURNAL4U.RU/s17v/video/videos17.avi.exe
hxxp://RUSU44KIPORNO.RU/s11l/video/videos11.avi.exe
hxxp://RUSU44KIPORNO.RU/s12o/video/videos12.avi.exe
hxxp://RUSU44KIPORNO.RU/s17v/video/videos17.avi.exe

Another ransom
Quote
hxxp://girlzp.ru/porn_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 27, 2011, 11:09:09 am: Pornorolik

Quote
hxxp://XXXENERGYPORNOAVI.RU/s11l/video/videos11.avi.exe
hxxp://XXXENERGYPORNOAVI.RU/s12o/video/videos12.avi.exe
hxxp://XXXENERGYPORNOAVI.RU/s17v/video/videos17.avi.exe

they allocated much more domains but currently (or already) they are inactive.
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 27, 2011, 02:15:36 pm: New pornoroliks

Quote
hxxp://veryhardrusporno.ru/s11l/video/videos11.avi.exe
hxxp://veryhardrusporno.ru/s12o/video/videos12.avi.exe
hxxp://veryhardrusporno.ru/s14t/video/videos14.avi.exe
hxxp://veryhardrusporno.ru/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 28, 2011, 09:54:51 am: LockEmAll Ransom

Quote
hxxp://mgvvideo7.ru/x.php?f=399&e=2
hxxp://mgvvideo7.ru/x.php?f=400&e=2
hxxp://mgvvideo7.ru/x.php?f=401&e=2

Redirects to LockEmAll
Quote
hxxp://bnzrtuu.ru/ -> hxxp://bnzrtuu.ru/video.htm -> hxxp://kamstddska.ru/in.cgi?2 -> hxxp://qemporn4.ru/985/ -> hxxp://qemporn4.ru/985/xxx_video.exe

Blackhole
Quote
hxxp://mgvvideo7.ru/indexx.php?tp=a07bda11d4c71fe6

System Antivirus Microsoft 2011 Ransom
Quote
hxxp://zawebporn.ru/porn_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 28, 2011, 01:58:22 pm: Pornorolik moved to new IP 31.192.109.210.

Quote
hxxp://glavniypornoclubstrany.ru/s11l/video/videos11.avi.exe
hxxp://glavniypornoclubstrany.ru/s12o/video/videos12.avi.exe
hxxp://glavniypornoclubstrany.ru/s14t/video/videos14.avi.exe
hxxp://glavniypornoclubstrany.ru/s17v/video/videos17.avi.exe
hxxp://vkontakte-porevoonline.ru/s11l/video/videos11.avi.exe
hxxp://vkontakte-porevoonline.ru/s12o/video/videos12.avi.exe
hxxp://vkontakte-porevoonline.ru/s17v/video/videos17.avi.exe
hxxp://jivoysexporno.ru/s11l/video/videos11.avi.exe
hxxp://jivoysexporno.ru/s12o/video/videos12.avi.exe
hxxp://jivoysexporno.ru/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 29, 2011, 03:26:30 am: Pornorolik allocated domains 28 August (at moment of post - all operational)

Also pornorolik moved to new IP again (77.91.231.193).

Quote
hxxp://odnoklasssosut4len.ru/s11l/video/videos11.avi.exe
hxxp://odnoklasssosut4len.ru/s12o/video/videos12.avi.exe
hxxp://odnoklasssosut4len.ru/s17v/video/videos17.avi.exe
hxxp://stoithoroshokruto.ru/s11l/video/videos11.avi.exe
hxxp://stoithoroshokruto.ru/s12o/video/videos12.avi.exe
hxxp://stoithoroshokruto.ru/s17v/video/videos17.avi.exe
hxxp://SUKIDAYUTVPOPUIPIZDU.RU/s11l/video/videos11.avi.exe
hxxp://SUKIDAYUTVPOPUIPIZDU.RU/s12o/video/videos12.avi.exe
hxxp://SUKIDAYUTVPOPUIPIZDU.RU/s17v/video/videos17.avi.exe
hxxp://RUSVIDEORUSBABYXXX.RU/s11l/video/videos11.avi.exe
hxxp://RUSVIDEORUSBABYXXX.RU/s12o/video/videos12.avi.exe
hxxp://RUSVIDEORUSBABYXXX.RU/s17v/video/videos17.avi.exe
hxxp://PORNRU-MEGAARCHIV.RU/s11l/video/videos11.avi.exe
hxxp://PORNRU-MEGAARCHIV.RU/s12o/video/videos12.avi.exe
hxxp://PORNRU-MEGAARCHIV.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOJIVOGOVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOJIVOGOVIDEO.RU/s12o/video/videos12.avi.exe
hxxp://MNOGOJIVOGOVIDEO.RU/s17v/video/videos17.avi.exe
hxxp://JIVOYSEXPORNO.RU/s11l/video/videos11.avi.exe
hxxp://JIVOYSEXPORNO.RU/s12o/video/videos12.avi.exe
hxxp://JIVOYSEXPORNO.RU/s17v/video/videos17.avi.exe
hxxp://HO4UNOVOEPORNORU.RU/s11l/video/videos11.avi.exe
hxxp://HO4UNOVOEPORNORU.RU/s12o/video/videos12.avi.exe
hxxp://HO4UNOVOEPORNORU.RU/s17v/video/videos17.avi.exe
hxxp://HARDSEXXXSEXPORNO.RU/s11l/video/videos11.avi.exe
hxxp://HARDSEXXXSEXPORNO.RU/s12o/video/videos12.avi.exe
hxxp://HARDSEXXXSEXPORNO.RU/s17v/video/videos17.avi.exe
hxxp://VKONTAKTE-POREVOONLINE.RU/s11l/video/videos11.avi.exe
hxxp://VKONTAKTE-POREVOONLINE.RU/s12o/video/videos12.avi.exe
hxxp://VKONTAKTE-POREVOONLINE.RU/s17v/video/videos17.avi.exe
hxxp://GLAVNIYPORNOCLUBSTRANY.RU/s11l/video/videos11.avi.exe
hxxp://GLAVNIYPORNOCLUBSTRANY.RU/s12o/video/videos12.avi.exe
hxxp://GLAVNIYPORNOCLUBSTRANY.RU/s17v/video/videos17.avi.exe
hxxp://VIEWPORNOSEXRUS.RU/s11l/video/videos11.avi.exe
hxxp://VIEWPORNOSEXRUS.RU/s12o/video/videos12.avi.exe
hxxp://VIEWPORNOSEXRUS.RU/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 29, 2011, 06:44:42 am: More pornorolik domains revealed. All operational.

Quote
hxxp://MEGAARCHIVXXXPORNORU.RU/s11l/video/videos11.avi.exe
hxxp://MEGAARCHIVXXXPORNORU.RU/s12o/video/videos12.avi.exe
hxxp://MEGAARCHIVXXXPORNORU.RU/s17v/video/videos17.avi.exe
hxxp://SEXMEGAPORNORU.RU/s11l/video/videos11.avi.exe
hxxp://SEXMEGAPORNORU.RU/s12o/video/videos12.avi.exe
hxxp://SEXMEGAPORNORU.RU/s17v/video/videos17.avi.exe
hxxp://DVDPORNOVIDEORU.RU/s11l/video/videos11.avi.exe
hxxp://DVDPORNOVIDEORU.RU/s12o/video/videos12.avi.exe
hxxp://DVDPORNOVIDEORU.RU/s17v/video/videos17.avi.exe
hxxp://KON4ILNASISKIRRR.RU/s11l/video/videos11.avi.exe
hxxp://KON4ILNASISKIRRR.RU/s12o/video/videos12.avi.exe
hxxp://KON4ILNASISKIRRR.RU/s17v/video/videos17.avi.exe
hxxp://SEXEXLUSIVEXXX.RU/s11l/video/videos11.avi.exe
hxxp://SEXEXLUSIVEXXX.RU/s12o/video/videos12.avi.exe
hxxp://SEXEXLUSIVEXXX.RU/s17v/video/videos17.avi.exe
hxxp://BONUSXXXXRUSAVI.RU/s11l/video/videos11.avi.exe
hxxp://BONUSXXXXRUSAVI.RU/s12o/video/videos12.avi.exe
hxxp://BONUSXXXXRUSAVI.RU/s17v/video/videos17.avi.exe
hxxp://JESTSEXXXXHARD.RU/s11l/video/videos11.avi.exe
hxxp://JESTSEXXXXHARD.RU/s12o/video/videos12.avi.exe
hxxp://JESTSEXXXXHARD.RU/s17v/video/videos17.avi.exe
hxxp://SATPORNOCLUBRU.RU/s11l/video/videos11.avi.exe
hxxp://SATPORNOCLUBRU.RU/s12o/video/videos12.avi.exe
hxxp://SATPORNOCLUBRU.RU/s17v/video/videos17.avi.exe
hxxp://XXXLOVISEXONLINE.RU/s11l/video/videos11.avi.exe
hxxp://XXXLOVISEXONLINE.RU/s12o/video/videos12.avi.exe
hxxp://XXXLOVISEXONLINE.RU/s17v/video/videos17.avi.exe
hxxp://AVIFILMPORNOSEX.RU/s11l/video/videos11.avi.exe
hxxp://AVIFILMPORNOSEX.RU/s12o/video/videos12.avi.exe
hxxp://AVIFILMPORNOSEX.RU/s17v/video/videos17.avi.exe
hxxp://VSESOSUT4LENRU.RU/s11l/video/videos11.avi.exe
hxxp://VSESOSUT4LENRU.RU/s12o/video/videos12.avi.exe
hxxp://VSESOSUT4LENRU.RU/s17v/video/videos17.avi.exe
hxxp://ANYAKON4AETSTRASSTNORU.RU/s11l/video/videos11.avi.exe
hxxp://ANYAKON4AETSTRASSTNORU.RU/s12o/video/videos12.avi.exe
hxxp://ANYAKON4AETSTRASSTNORU.RU/s17v/video/videos17.avi.exe
hxxp://JESTPORNOSEXHARD.RU/s11l/video/videos11.avi.exe
hxxp://JESTPORNOSEXHARD.RU/s12o/video/videos12.avi.exe
hxxp://JESTPORNOSEXHARD.RU/s17v/video/videos17.avi.exe
hxxp://PORNORUSXXXVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://PORNORUSXXXVIDEO.RU/s12o/video/videos12.avi.exe
hxxp://PORNORUSXXXVIDEO.RU/s17v/video/videos17.avi.exe
hxxp://VKONTPORNOMNOGO.RU/s11l/video/videos11.avi.exe
hxxp://VKONTPORNOMNOGO.RU/s12o/video/videos12.avi.exe
hxxp://VKONTPORNOMNOGO.RU/s17v/video/videos17.avi.exe
hxxp://ALEXADAYETVPOPU.RU/s11l/video/videos11.avi.exe
hxxp://ALEXADAYETVPOPU.RU/s12o/video/videos12.avi.exe
hxxp://ALEXADAYETVPOPU.RU/s17v/video/videos17.avi.exe
hxxp://HARDSEXPOREVOXXX.RU/s11l/video/videos11.avi.exe
hxxp://HARDSEXPOREVOXXX.RU/s12o/video/videos12.avi.exe
hxxp://HARDSEXPOREVOXXX.RU/s17v/video/videos17.avi.exe
hxxp://PARTERPORNORU.RU/s11l/video/videos11.avi.exe
hxxp://PARTERPORNORU.RU/s12o/video/videos12.avi.exe
hxxp://PARTERPORNORU.RU/s17v/video/videos17.avi.exe
hxxp://VERYHARDRUSPORNO.RU/s11l/video/videos11.avi.exe
hxxp://VERYHARDRUSPORNO.RU/s12o/video/videos12.avi.exe
hxxp://VERYHARDRUSPORNO.RU/s17v/video/videos17.avi.exe
hxxp://HARDMEGACOOLPORNO.RU/s11l/video/videos11.avi.exe
hxxp://HARDMEGACOOLPORNO.RU/s12o/video/videos12.avi.exe
hxxp://HARDMEGACOOLPORNO.RU/s17v/video/videos17.avi.exe
hxxp://ODNOKLASSSOSUT4LEN.RU/s11l/video/videos11.avi.exe
hxxp://ODNOKLASSSOSUT4LEN.RU/s12o/video/videos12.avi.exe
hxxp://ODNOKLASSSOSUT4LEN.RU/s17v/video/videos17.avi.exe
hxxp://TELKIVKONTAKTERUSPORN.RU/s11l/video/videos11.avi.exe
hxxp://TELKIVKONTAKTERUSPORN.RU/s12o/video/videos12.avi.exe
hxxp://TELKIVKONTAKTERUSPORN.RU/s17v/video/videos17.avi.exe
hxxp://FILEPORNOCLUBBERS.RU/s11l/video/videos11.avi.exe
hxxp://FILEPORNOCLUBBERS.RU/s12o/video/videos12.avi.exe
hxxp://FILEPORNOCLUBBERS.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOXXXSEXA4U.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOXXXSEXA4U.RU/s12o/video/videos12.avi.exe
hxxp://MNOGOXXXSEXA4U.RU/s17v/video/videos17.avi.exe
hxxp://STOITHOROSHOKRUTO.RU/s11l/video/videos11.avi.exe
hxxp://STOITHOROSHOKRUTO.RU/s12o/video/videos12.avi.exe
hxxp://STOITHOROSHOKRUTO.RU/s17v/video/videos17.avi.exe
hxxp://EXLUSIVEPORNOSEXVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://EXLUSIVEPORNOSEXVIDEO.RU/s12o/video/videos12.avi.exe
hxxp://EXLUSIVEPORNOSEXVIDEO.RU/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 29, 2011, 12:01:24 pm: Ransom "System Antivirus Microsoft 2011"

Complete list of allocated domains.

Quote
hxxp://DEDISXAPORN.RU/porn_video.exe
hxxp://SMARTYLUXY.RU/porn_video.exe
hxxp://BRIDEND.RU/porn_video.exe
hxxp://PUPO4EK.RU/porn_video.exe
hxxp://BELAFFKA.RU/porn_video.exe
hxxp://MSJNGSKGJSK.RU/porn_video.exe
hxxp://BARBUKED.RU/porn_video.exe (Active)
hxxp://MIGASERD.RU/porn_video.exe
hxxp://BALCEG.RU/porn_video.exe
hxxp://MAL29849284.RU/porn_video.exe
hxxp://ABRIDLAS.RU/porn_video.exe
hxxp://LESSONPORNO.RU/porn_video.exe (Active)
hxxp://39DKJFKDJDD.RU/porn_video.exe
hxxp://KSFJKJI3UR93R3R3R.RU/porn_video.exe
hxxp://ZELENKAXXX.RU/porn_video.exe
hxxp://IKJU3KUJR3DKF.RU/porn_video.exe
hxxp://ZADRYBADAN.RU/porn_video.exe (Active)

Currently active only 3

Quote
hxxp://BARBUKED.RU/porn_video.exe
hxxp://LESSONPORNO.RU/porn_video.exe
hxxp://ZADRYBADAN.RU/porn_video.exe

Active domains also equipped with Blackhole
Quote
hxxp://qqwfddgtgfbfgnhnsmz.cx.cc/forum.php?tp=de9ba0d2cc3af7bb

Blackhole main payload
Quote
hxxp://qqwfddgtgfbfgnhnsmz.cx.cc/k.php?f=30&e=2

They distributes this http://www.virustotal.com/file-scan/report.html?id=7dd7c9e8e443c4ac4e1a62c929dc9f9ae98f5fb31e301b6c1f610ab4ef808b7f-1314615246

All active domains located on IP 91.220.0.35 (SIA Business Aviation Services) which was previously used to distribute MBRLock ransoms.
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 30, 2011, 03:18:22 am: Ransom "System Antivirus Microsoft 2011"

Complete list of allocated domains.

Quote
hxxp://ERECTTION.RU/porn_video.exe
hxxp://AVIUNO.RU/porn_video.exe
hxxp://ZEREKC.RU/porn_video.exe
hxxp://RUADULTARH.RU/porn_video.exe
hxxp://POSTLASTXX.RU/porn_video.exe
hxxp://A434343.RU/porn_video.exe (Active)
hxxp://A343434.RU/porn_video.exe (Active)
hxxp://A242424.RU/porn_video.exe (Active)
hxxp://A141414.RU/porn_video.exe (Active)
hxxp://2424244.RU/porn_video.exe (Active)

Pornorolik allocated domains 29-30 August, all operational.

Quote
hxxp://PORNOLINKONLINESEX.RU/s11l/video/videos11.avi.exe
hxxp://PORNOLINKONLINESEX.RU/s12o/video/videos12.avi.exe
hxxp://PORNOLINKONLINESEX.RU/s17v/video/videos17.avi.exe
hxxp://XXXILIKEPORNOSEX.RU/s11l/video/videos11.avi.exe
hxxp://XXXILIKEPORNOSEX.RU/s12o/video/videos12.avi.exe
hxxp://XXXILIKEPORNOSEX.RU/s17v/video/videos17.avi.exe
hxxp://INDUSTRYSEXXXPORNO.RU/s11l/video/videos11.avi.exe
hxxp://INDUSTRYSEXXXPORNO.RU/s12o/video/videos12.avi.exe
hxxp://INDUSTRYSEXXXPORNO.RU/s17v/video/videos17.avi.exe
hxxp://PORNOINDUSTRYRUSEX.RU/s11l/video/videos11.avi.exe
hxxp://PORNOINDUSTRYRUSEX.RU/s12o/video/videos12.avi.exe
hxxp://PORNOINDUSTRYRUSEX.RU/s17v/video/videos17.avi.exe
hxxp://TRAHSEXRUSTELKI.RU/s11l/video/videos11.avi.exe
hxxp://TRAHSEXRUSTELKI.RU/s12o/video/videos12.avi.exe
hxxp://TRAHSEXRUSTELKI.RU/s17v/video/videos17.avi.exe
hxxp://ELLASU4KAEBETSYA.RU/s11l/video/videos11.avi.exe
hxxp://ELLASU4KAEBETSYA.RU/s12o/video/videos12.avi.exe
hxxp://ELLASU4KAEBETSYA.RU/s17v/video/videos17.avi.exe
hxxp://PORNOGROUPVKONTAKTE.RU/s11l/video/videos11.avi.exe
hxxp://PORNOGROUPVKONTAKTE.RU/s12o/video/videos12.avi.exe
hxxp://PORNOGROUPVKONTAKTE.RU/s17v/video/videos17.avi.exe
hxxp://SKOLKOMNOGOKRUTOGOPORNO.RU/s11l/video/videos11.avi.exe
hxxp://SKOLKOMNOGOKRUTOGOPORNO.RU/s12o/video/videos12.avi.exe
hxxp://SKOLKOMNOGOKRUTOGOPORNO.RU/s17v/video/videos17.avi.exe
hxxp://AVIPORNFILFORYOU.RU/s11l/video/videos11.avi.exe
hxxp://AVIPORNFILFORYOU.RU/s12o/video/videos12.avi.exe
hxxp://AVIPORNFILFORYOU.RU/s17v/video/videos17.avi.exe
hxxp://ONINESMOTRISEXRUAVI.RU/s11l/video/videos11.avi.exe
hxxp://ONINESMOTRISEXRUAVI.RU/s12o/video/videos12.avi.exe
hxxp://ONINESMOTRISEXRUAVI.RU/s17v/video/videos17.avi.exe
hxxp://SEXVKONTAKTEXXXVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://SEXVKONTAKTEXXXVIDEO.RU/s12o/video/videos12.avi.exe
hxxp://SEXVKONTAKTEXXXVIDEO.RU/s17v/video/videos17.avi.exe
hxxp://RUSSKOEPORNOXXXSEXVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://RUSSKOEPORNOXXXSEXVIDEO.RU/s12o/video/videos12.avi.exe
hxxp://RUSSKOEPORNOXXXSEXVIDEO.RU/s17v/video/videos17.avi.exe
hxxp://NEVERBEALONESEXXX.RU/s11l/video/videos11.avi.exe
hxxp://NEVERBEALONESEXXX.RU/s12o/video/videos12.avi.exe
hxxp://NEVERBEALONESEXXX.RU/s17v/video/videos17.avi.exe
hxxp://PORNOZA4ETNOTRAX.RU/s11l/video/videos11.avi.exe
hxxp://PORNOZA4ETNOTRAX.RU/s12o/video/videos12.avi.exe
hxxp://PORNOZA4ETNOTRAX.RU/s17v/video/videos17.avi.exe
hxxp://MNOGORUSSKIHBABDAYUT.RU/s11l/video/videos11.avi.exe
hxxp://MNOGORUSSKIHBABDAYUT.RU/s12o/video/videos12.avi.exe
hxxp://MNOGORUSSKIHBABDAYUT.RU/s17v/video/videos17.avi.exe
hxxp://PORNOZA4ET4U.RU/s11l/video/videos11.avi.exe
hxxp://PORNOZA4ET4U.RU/s12o/video/videos12.avi.exe
hxxp://PORNOZA4ET4U.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOPORNORUSXXX.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOPORNORUSXXX.RU/s12o/video/videos12.avi.exe
hxxp://MNOGOPORNORUSXXX.RU/s17v/video/videos17.avi.exe
hxxp://PORNOTOGETHERCLUB.RU/s11l/video/videos11.avi.exe
hxxp://PORNOTOGETHERCLUB.RU/s12o/video/videos12.avi.exe
hxxp://PORNOTOGETHERCLUB.RU/s17v/video/videos17.avi.exe
hxxp://ZA4ETNOEPORNOVIDEO.RU/s11l/video/videos11.avi.exe
hxxp://ZA4ETNOEPORNOVIDEO.RU/s12o/video/videos12.avi.exe
hxxp://ZA4ETNOEPORNOVIDEO.RU/s17v/video/videos17.avi.exe
hxxp://KRUTOEVIDEOPORNOXXX.RU/s11l/video/videos11.avi.exe
hxxp://KRUTOEVIDEOPORNOXXX.RU/s12o/video/videos12.avi.exe
hxxp://KRUTOEVIDEOPORNOXXX.RU/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 30, 2011, 02:57:11 pm: Ransom "System Antivirus Microsoft 2011"

New allocated domains - all previous undelegated.

Quote
hxxp://EROKAMZER.RU/porn_video.exe
hxxp://ANAANANI.RU/porn_video.exe
hxxp://WEBEROXXX.RU/porn_video.exe
hxxp://PUPKOVINKA.RU/porn_video.exe (Active)
hxxp://PROMEZHBULOK.RU/porn_video.exe
hxxp://MEZDIPECI.RU/porn_video.exe
hxxp://OTSOSPORNOOTSOS.RU/porn_video.exe
hxxp://FIGASEPORNO.RU/porn_video.exe
hxxp://ZAWEBPORN.RU/porn_video.exe
hxxp://TRESTPORN.RU/porn_video.exe
hxxp://SEKSISAKI.RU/porn_video.exe
hxxp://SALAKISAKI.RU/porn_video.exe
hxxp://PORKAGNEDO.RU/porn_video.exe
hxxp://PODROSTIITRAHNI.RU/porn_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 31, 2011, 11:56:02 am: Pornorolik moved to new IP 89.208.141.139

Quote
hxxp://bigpornoxxvideo.ru/s11l/video/videos11.avi.exe
hxxp://bigpornoxxvideo.ru/s12o/video/videos12.avi.exe
hxxp://bigpornoxxvideo.ru/s17v/video/videos17.avi.exe
hxxp://ruspornosexxxx.ru/s11l/video/videos11.avi.exe
hxxp://ruspornosexxxx.ru/s12o/video/videos12.avi.exe
hxxp://ruspornosexxxx.ru/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 31, 2011, 03:21:23 pm: Ransom LockEmAll

Quote
hxxp://bnzrtuu.ru/ - >
hxxp://bnzrtuu.ru/video.htm ->
hxxp://kamstddska.ru/in.cgi?2 ->
hxxp://iajyuyz.ru/12/xxx_video.exe

Ransom Pornorolik one more domain

Quote
hxxp://pornodvdka4estvoru.ru/s11l/video/videos11.avi.exe
hxxp://pornodvdka4estvoru.ru/s12o/video/videos12.avi.exe
hxxp://pornodvdka4estvoru.ru/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 01, 2011, 03:51:40 am: Pornorolik allocated domains 31 Aug - 01 Sept (all operational)

Quote
hxxp://EBISU4KUNASTUXXX.RU/s11l/video/videos11.avi.exe
hxxp://EBISU4KUNASTUXXX.RU/s12o/video/videos12.avi.exe
hxxp://EBISU4KUNASTUXXX.RU/s17v/video/videos17.avi.exe
hxxp://PORNORIVSEXFFF.RU/s11l/video/videos11.avi.exe
hxxp://PORNORIVSEXFFF.RU/s12o/video/videos12.avi.exe
hxxp://PORNORIVSEXFFF.RU/s17v/video/videos17.avi.exe
hxxp://DVDPORNOSEXRU.RU/s11l/video/videos11.avi.exe
hxxp://DVDPORNOSEXRU.RU/s12o/video/videos12.avi.exe
hxxp://DVDPORNOSEXRU.RU/s17v/video/videos17.avi.exe
hxxp://PORNORIOSEXAVI.RU/s11l/video/videos11.avi.exe
hxxp://PORNORIOSEXAVI.RU/s12o/video/videos12.avi.exe
hxxp://PORNORIOSEXAVI.RU/s17v/video/videos17.avi.exe
hxxp://DOMENSEXPORNOCOOL.RU/s11l/video/videos11.avi.exe
hxxp://DOMENSEXPORNOCOOL.RU/s12o/video/videos12.avi.exe
hxxp://DOMENSEXPORNOCOOL.RU/s17v/video/videos17.avi.exe
hxxp://BIGSEXAVICIDEO.RU/s11l/video/videos11.avi.exe
hxxp://BIGSEXAVICIDEO.RU/s12o/video/videos12.avi.exe
hxxp://BIGSEXAVICIDEO.RU/s17v/video/videos17.avi.exe
hxxp://MNOGOSPERMIVPOPKUYES.RU/s11l/video/videos11.avi.exe
hxxp://MNOGOSPERMIVPOPKUYES.RU/s12o/video/videos12.avi.exe
hxxp://MNOGOSPERMIVPOPKUYES.RU/s17v/video/videos17.avi.exe
hxxp://USAPOREVOONLINENOW.RU/s11l/video/videos11.avi.exe
hxxp://USAPOREVOONLINENOW.RU/s12o/video/videos12.avi.exe
hxxp://USAPOREVOONLINENOW.RU/s17v/video/videos17.avi.exe
hxxp://MEGAVIDEOBIGCOLLECTIONRU.RU/s11l/video/videos11.avi.exe
hxxp://MEGAVIDEOBIGCOLLECTIONRU.RU/s12o/video/videos12.avi.exe
hxxp://MEGAVIDEOBIGCOLLECTIONRU.RU/s17v/video/videos17.avi.exe
hxxp://TRAXBIG4LENVPOPU.RU/s11l/video/videos11.avi.exe
hxxp://TRAXBIG4LENVPOPU.RU/s12o/video/videos12.avi.exe
hxxp://TRAXBIG4LENVPOPU.RU/s17v/video/videos17.avi.exe
hxxp://BALANSESEXRUPORNO.RU/s11l/video/videos11.avi.exe
hxxp://BALANSESEXRUPORNO.RU/s12o/video/videos12.avi.exe
hxxp://BALANSESEXRUPORNO.RU/s17v/video/videos17.avi.exe
hxxp://KAMASUTRAPORNOONLINE.RU/s11l/video/videos11.avi.exe
hxxp://KAMASUTRAPORNOONLINE.RU/s12o/video/videos12.avi.exe
hxxp://KAMASUTRAPORNOONLINE.RU/s17v/video/videos17.avi.exe
hxxp://SMOTRIBIGCOLLECTIONAVIPORN.RU/s11l/video/videos11.avi.exe
hxxp://SMOTRIBIGCOLLECTIONAVIPORN.RU/s12o/video/videos12.avi.exe
hxxp://SMOTRIBIGCOLLECTIONAVIPORN.RU/s17v/video/videos17.avi.exe
hxxp://ANNADAYETVIDEOPORNO.RU/s11l/video/videos11.avi.exe
hxxp://ANNADAYETVIDEOPORNO.RU/s12o/video/videos12.avi.exe
hxxp://ANNADAYETVIDEOPORNO.RU/s17v/video/videos17.avi.exe
hxxp://HQSEXPORNOSEX.RU/s11l/video/videos11.avi.exe
hxxp://HQSEXPORNOSEX.RU/s12o/video/videos12.avi.exe
hxxp://HQSEXPORNOSEX.RU/s17v/video/videos17.avi.exe
hxxp://FORMULASEXGOOD.RU/s11l/video/videos11.avi.exe
hxxp://FORMULASEXGOOD.RU/s12o/video/videos12.avi.exe
hxxp://FORMULASEXGOOD.RU/s17v/video/videos17.avi.exe
hxxp://RIOPOREVONOW4U.RU/s11l/video/videos11.avi.exe
hxxp://RIOPOREVONOW4U.RU/s12o/video/videos12.avi.exe
hxxp://RIOPOREVONOW4U.RU/s17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 01, 2011, 11:04:24 am: Note:

After one of usual daily updates Pornorolik distribution path slightly changed.

I.e.

was: hxxp://balansesexruporno.ru/s11l/video/videos11.avi.exe
now: hxxp://balansesexruporno.ru/ss11l/video/videos11.avi.exe

Difference highlighted. Domains and their payload are still operational.
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 01, 2011, 01:46:51 pm: Pornorolik new domain

Quote
hxxp://gogoporevolinexxx.ru/ss11l/video/videos11.avi.exe
hxxp://gogoporevolinexxx.ru/ss12o/video/videos12.avi.exe
hxxp://gogoporevolinexxx.ru/ss17v/video/videos17.avi.exe

Redirector path to Pornorolik

Quote
hxxp://protizer.net -> hxxp://protizer.net/click_new.php -> hxxp://rit-zizo.ru/in.cgi?12 -> hxxp://gogoporevolinexxx.ru/ss12o/fp-index.html -> hxxp://gogoporevolinexxx.ru/ss12o/video/videos12.avi.exe

Redirectors (SUTRA TDS used)

Quote
hxxp://rit-zizo.ru/in.cgi?11
hxxp://rit-zizo.ru/in.cgi?12
hxxp://rit-zizo.ru/in.cgi?17
hxxp://FAG-JAKA.RU/in.cgi?11
hxxp://FAG-JAKA.RU/in.cgi?12
hxxp://FAG-JAKA.RU/in.cgi?17
hxxp://SAN-DALO.RU/in.cgi?11
hxxp://SAN-DALO.RU/in.cgi?12
hxxp://SAN-DALO.RU/in.cgi?17
hxxp://PRO-DIZA.RU/in.cgi?11
hxxp://PRO-DIZA.RU/in.cgi?12
hxxp://PRO-DIZA.RU/in.cgi?17
hxxp://PIZ-NANI.RU/in.cgi?11
hxxp://PIZ-NANI.RU/in.cgi?12
hxxp://PIZ-NANI.RU/in.cgi?17
hxxp://NAS-BADO.RU/in.cgi?11
hxxp://NAS-BADO.RU/in.cgi?12
hxxp://NAS-BADO.RU/in.cgi?17
hxxp://MOR-SOLA.RU/in.cgi?11
hxxp://MOR-SOLA.RU/in.cgi?12
hxxp://MOR-SOLA.RU/in.cgi?17
hxxp://TEL-TAKI.RU/in.cgi?11
hxxp://TEL-TAKI.RU/in.cgi?12
hxxp://TEL-TAKI.RU/in.cgi?17
hxxp://LAD-ZAPA.RU/in.cgi?11
hxxp://LAD-ZAPA.RU/in.cgi?12
hxxp://LAD-ZAPA.RU/in.cgi?17
hxxp://TAN-NAKA.RU/in.cgi?11
hxxp://TAN-NAKA.RU/in.cgi?12
hxxp://TAN-NAKA.RU/in.cgi?17
hxxp://KRI-TAKO.RU/in.cgi?11
hxxp://KRI-TAKO.RU/in.cgi?12
hxxp://KRI-TAKO.RU/in.cgi?17
hxxp://SAP-MANO-RU.RU/in.cgi?11
hxxp://SAP-MANO-RU.RU/in.cgi?12
hxxp://SAP-MANO-RU.RU/in.cgi?17

Protizer.net we believe this is partner program affiliated with Pornorolik distribution team. Or they are the same.
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 02, 2011, 03:26:53 am: Pornorolik allocated domains 01 - 02 Sept

Quote
hxxp://DOWNLOADSSPORNOCLUBYEAH.RU/ss11l/video/videos11.avi.exe
hxxp://DOWNLOADSSPORNOCLUBYEAH.RU/ss12o/video/videos12.avi.exe
hxxp://DOWNLOADSSPORNOCLUBYEAH.RU/ss17v/video/videos17.avi.exe
hxxp://OPENPOREVOXXXKLASS.RU/ss11l/video/videos11.avi.exe
hxxp://OPENPOREVOXXXKLASS.RU/ss12o/video/videos12.avi.exe
hxxp://OPENPOREVOXXXKLASS.RU/ss17v/video/videos17.avi.exe
hxxp://TRAXTRAXSEXPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://TRAXTRAXSEXPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://TRAXTRAXSEXPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://BESTMEGAHARDPOREVO.RU/ss11l/video/videos11.avi.exe
hxxp://BESTMEGAHARDPOREVO.RU/ss12o/video/videos12.avi.exe
hxxp://BESTMEGAHARDPOREVO.RU/ss17v/video/videos17.avi.exe
hxxp://MNOGOPORNOSEXRUSHARD.RU/ss11l/video/videos11.avi.exe
hxxp://MNOGOPORNOSEXRUSHARD.RU/ss12o/video/videos12.avi.exe
hxxp://MNOGOPORNOSEXRUSHARD.RU/ss17v/video/videos17.avi.exe
hxxp://TRAXFISHKIMNGOVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://TRAXFISHKIMNGOVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://TRAXFISHKIMNGOVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://ALLABLYATIZMOSKVIPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://ALLABLYATIZMOSKVIPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://ALLABLYATIZMOSKVIPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://MNOGONOVOGOVIDEOSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://MNOGONOVOGOVIDEOSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://MNOGONOVOGOVIDEOSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://THEBESTPORNORUXX.RU/ss11l/video/videos11.avi.exe
hxxp://THEBESTPORNORUXX.RU/ss12o/video/videos12.avi.exe
hxxp://THEBESTPORNORUXX.RU/ss17v/video/videos17.avi.exe
hxxp://LI4NIYSEXONLINE.RU/ss11l/video/videos11.avi.exe
hxxp://LI4NIYSEXONLINE.RU/ss12o/video/videos12.avi.exe
hxxp://LI4NIYSEXONLINE.RU/ss17v/video/videos17.avi.exe
hxxp://SOSTOYANIESEXAPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://SOSTOYANIESEXAPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://SOSTOYANIESEXAPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://HUYTEBESEXPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://HUYTEBESEXPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://HUYTEBESEXPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://SEXSEXKRUTODA.RU/ss11l/video/videos11.avi.exe
hxxp://SEXSEXKRUTODA.RU/ss12o/video/videos12.avi.exe
hxxp://SEXSEXKRUTODA.RU/ss17v/video/videos17.avi.exe
hxxp://HARDPOPOLNENIEVPIZDU.RU/ss11l/video/videos11.avi.exe
hxxp://HARDPOPOLNENIEVPIZDU.RU/ss12o/video/videos12.avi.exe
hxxp://HARDPOPOLNENIEVPIZDU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOCLUBYESSEX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOCLUBYESSEX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOCLUBYESSEX.RU/ss17v/video/videos17.avi.exe
hxxp://POPOLNIPOPKUSPERMOYCOOL.RU/ss11l/video/videos11.avi.exe
hxxp://POPOLNIPOPKUSPERMOYCOOL.RU/ss12o/video/videos12.avi.exe
hxxp://POPOLNIPOPKUSPERMOYCOOL.RU/ss17v/video/videos17.avi.exe
hxxp://VERYHARDSEXONLINEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://VERYHARDSEXONLINEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://VERYHARDSEXONLINEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://FISHKINTRAXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://FISHKINTRAXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://FISHKINTRAXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PARLIAMENTPORNOCOOL.RU/ss11l/video/videos11.avi.exe
hxxp://PARLIAMENTPORNOCOOL.RU/ss12o/video/videos12.avi.exe
hxxp://PARLIAMENTPORNOCOOL.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 02, 2011, 09:49:24 am: Ransom "System Antivirus Microsoft 2011"

Complete list of newly allocated domains - active highlighted.

Quote
hxxp://MSTREXHA.RU/porn_video.exe (Active)
hxxp://AMFPORKA.RU/porn_video.exe
hxxp://SUKISUNXXX.RU/porn_video.exe (Active)
hxxp://SANDIRKA.RU/porn_video.exe (Active)
hxxp://PYXXXPYPORN.RU/porn_video.exe
hxxp://POSOSIOTSOSI.RU/porn_video.exe
hxxp://PORNODEBUT.RU/porn_video.exe
hxxp://PIYXXX.RU/porn_video.exe
hxxp://SMOTRIXEROTV.RU/porn_video.exe
hxxp://PEREEZDNADOM.RU/porn_video.exe
hxxp://OTKOSZASMOTR.RU/porn_video.exe
hxxp://EROKAMZI.RU/porn_video.exe
hxxp://AUTOSM0TR.RU/porn_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 02, 2011, 04:05:22 pm: New Pornorolik domain

Quote
hxxp://pornofreshhardru.ru/ss11l/video/videos11.avi.exe
hxxp://pornofreshhardru.ru/ss12o/video/videos12.avi.exe
hxxp://pornofreshhardru.ru/ss17v/video/videos17.avi.exe

Pornorolik redirectors

Quote
hxxp://9sarkov.ru/in.cgi?11
hxxp://9sarkov.ru/in.cgi?12
hxxp://9sarkov.ru/in.cgi?17
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 03, 2011, 03:22:08 am: Pornorolik allocated domains 02-03 Sept.

Quote
hxxp://FEELYOURPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://FEELYOURPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://FEELYOURPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://REGSEXPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://REGSEXPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://REGSEXPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://VIPPORNOSEXCLIPSS.RU/ss11l/video/videos11.avi.exe
hxxp://VIPPORNOSEXCLIPSS.RU/ss12o/video/videos12.avi.exe
hxxp://VIPPORNOSEXCLIPSS.RU/ss17v/video/videos17.avi.exe
hxxp://EKATERINAPORNORUSSKAYA.RU/ss11l/video/videos11.avi.exe
hxxp://EKATERINAPORNORUSSKAYA.RU/ss12o/video/videos12.avi.exe
hxxp://EKATERINAPORNORUSSKAYA.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOFRESHHARDRU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOFRESHHARDRU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOFRESHHARDRU.RU/ss17v/video/videos17.avi.exe
hxxp://VASHEPORNOVKONTAKTEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://VASHEPORNOVKONTAKTEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://VASHEPORNOVKONTAKTEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://DLINNYPORNOR0LIK.RU/ss11l/video/videos11.avi.exe
hxxp://DLINNYPORNOR0LIK.RU/ss12o/video/videos12.avi.exe
hxxp://DLINNYPORNOR0LIK.RU/ss17v/video/videos17.avi.exe
hxxp://POPULARRUSPORNOVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://POPULARRUSPORNOVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://POPULARRUSPORNOVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://VAMKATIALIJETYAIZARU.RU/ss11l/video/videos11.avi.exe
hxxp://VAMKATIALIJETYAIZARU.RU/ss12o/video/videos12.avi.exe
hxxp://VAMKATIALIJETYAIZARU.RU/ss17v/video/videos17.avi.exe
hxxp://DANCEPORNOSEXTRUE.RU/ss11l/video/videos11.avi.exe
hxxp://DANCEPORNOSEXTRUE.RU/ss12o/video/videos12.avi.exe
hxxp://DANCEPORNOSEXTRUE.RU/ss17v/video/videos17.avi.exe
hxxp://PAGEPORNOSEXKRUTO.RU/ss11l/video/videos11.avi.exe
hxxp://PAGEPORNOSEXKRUTO.RU/ss12o/video/videos12.avi.exe
hxxp://PAGEPORNOSEXKRUTO.RU/ss17v/video/videos17.avi.exe
hxxp://SOSETPORNOHARDSCHOOLXX.RU/ss11l/video/videos11.avi.exe
hxxp://SOSETPORNOHARDSCHOOLXX.RU/ss12o/video/videos12.avi.exe
hxxp://SOSETPORNOHARDSCHOOLXX.RU/ss17v/video/videos17.avi.exe
hxxp://ARCH1VEPORNOSEXHARD.RU/ss11l/video/videos11.avi.exe
hxxp://ARCH1VEPORNOSEXHARD.RU/ss12o/video/videos12.avi.exe
hxxp://ARCH1VEPORNOSEXHARD.RU/ss17v/video/videos17.avi.exe
hxxp://MNOGOORUPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://MNOGOORUPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://MNOGOORUPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://SEXP0RNOVIDEORU.RU/ss11l/video/videos11.avi.exe
hxxp://SEXP0RNOVIDEORU.RU/ss12o/video/videos12.avi.exe
hxxp://SEXP0RNOVIDEORU.RU/ss17v/video/videos17.avi.exe
hxxp://ALISAVDOMASHNEMP0RNO.RU/ss11l/video/videos11.avi.exe
hxxp://ALISAVDOMASHNEMP0RNO.RU/ss12o/video/videos12.avi.exe
hxxp://ALISAVDOMASHNEMP0RNO.RU/ss17v/video/videos17.avi.exe
hxxp://GORIPORNOVIDEOSEXHARD.RU/ss11l/video/videos11.avi.exe
hxxp://GORIPORNOVIDEOSEXHARD.RU/ss12o/video/videos12.avi.exe
hxxp://GORIPORNOVIDEOSEXHARD.RU/ss17v/video/videos17.avi.exe
hxxp://SEXONLI1NEPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXONLI1NEPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXONLI1NEPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://1SENTYBRAVSCHOOLEPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://1SENTYBRAVSCHOOLEPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://1SENTYBRAVSCHOOLEPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://GENERA1PORNOCLUB.RU/ss11l/video/videos11.avi.exe
hxxp://GENERA1PORNOCLUB.RU/ss12o/video/videos12.avi.exe
hxxp://GENERA1PORNOCLUB.RU/ss17v/video/videos17.avi.exe
hxxp://SEXHARDFRESHPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXHARDFRESHPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXHARDFRESHPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://VKXXXPORNOGOOOD.RU/ss11l/video/videos11.avi.exe
hxxp://VKXXXPORNOGOOOD.RU/ss12o/video/videos12.avi.exe
hxxp://VKXXXPORNOGOOOD.RU/ss17v/video/videos17.avi.exe
hxxp://FRESHGIRLSARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://FRESHGIRLSARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://FRESHGIRLSARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://RUSPOREVOCOMPLECTXXX.RU/ss11l/video/videos11.avi.exe
hxxp://RUSPOREVOCOMPLECTXXX.RU/ss12o/video/videos12.avi.exe
hxxp://RUSPOREVOCOMPLECTXXX.RU/ss17v/video/videos17.avi.exe
hxxp://VKONTAKTESOSETPOREVO.RU/ss11l/video/videos11.avi.exe
hxxp://VKONTAKTESOSETPOREVO.RU/ss12o/video/videos12.avi.exe
hxxp://VKONTAKTESOSETPOREVO.RU/ss17v/video/videos17.avi.exe
hxxp://DOWNLOADSSPORNOCLUBYEAH.RU/ss11l/video/videos11.avi.exe
hxxp://DOWNLOADSSPORNOCLUBYEAH.RU/ss12o/video/videos12.avi.exe
hxxp://DOWNLOADSSPORNOCLUBYEAH.RU/ss17v/video/videos17.avi.exe

Ransom "System Antivirus Microsoft 2011"

Previously active domains deactivated and new from old list activated.

Quote
hxxp://AMFPORKA.RU/porn_video.exe
hxxp://PIYXXX.RU/porn_video.exe

Redirects to ransom LockEmAll
Quote
hxxp://ponatdsj.ru/in.cgi?2
hxxp://ponatdsj.ru/in.cgi?12

LockEmAll

Quote
hxxp://khnporn2.ru/42/xxx_video.exe

Blackhole

Quote
hxxp://pwn1jxz.ru/main.php?page=3a932b85aca13d53

LockEmAll from Blackhole

Quote
hxxp://pwn1jxz.ru/w.php?f=428&e=2
hxxp://pwn1jxz.ru/w.php?f=429&e=2
hxxp://pwn1jxz.ru/w.php?f=430&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 04, 2011, 12:03:20 am: Pornorolik allocated domains 03-04 Sept.

Quote
hxxp://RECORDTWIXARCHIVSSS.RU/ss11l/video/videos11.avi.exe
hxxp://RECORDTWIXARCHIVSSS.RU/ss12o/video/videos12.avi.exe
hxxp://RECORDTWIXARCHIVSSS.RU/ss14t/video/videos14.avi.exe
hxxp://RECORDTWIXARCHIVSSS.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOTWIXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOTWIXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOTWIXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOTWIXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOMARSSEXXRU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOMARSSEXXRU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOMARSSEXXRU.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOMARSSEXXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORKASEXXXBOUNTY.RU/ss11l/video/videos11.avi.exe
hxxp://PORKASEXXXBOUNTY.RU/ss12o/video/videos12.avi.exe
hxxp://PORKASEXXXBOUNTY.RU/ss14t/video/videos14.avi.exe
hxxp://PORKASEXXXBOUNTY.RU/ss17v/video/videos17.avi.exe
hxxp://FARAWAYPORNOSEXVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://FARAWAYPORNOSEXVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://FARAWAYPORNOSEXVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://FARAWAYPORNOSEXVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://VIPTWIXBESPLATNOPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://VIPTWIXBESPLATNOPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://VIPTWIXBESPLATNOPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://VIPTWIXBESPLATNOPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://DOWNLOADTWIXXXSEX.RU/ss11l/video/videos11.avi.exe
hxxp://DOWNLOADTWIXXXSEX.RU/ss12o/video/videos12.avi.exe
hxxp://DOWNLOADTWIXXXSEX.RU/ss14t/video/videos14.avi.exe
hxxp://DOWNLOADTWIXXXSEX.RU/ss17v/video/videos17.avi.exe
hxxp://TWIXSEXXXPOREVOONLINE.RU/ss11l/video/videos11.avi.exe
hxxp://TWIXSEXXXPOREVOONLINE.RU/ss12o/video/videos12.avi.exe
hxxp://TWIXSEXXXPOREVOONLINE.RU/ss14t/video/videos14.avi.exe
hxxp://TWIXSEXXXPOREVOONLINE.RU/ss17v/video/videos17.avi.exe
hxxp://SEXXXTWIXXXGO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXXXTWIXXXGO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXXXTWIXXXGO.RU/ss14t/video/videos14.avi.exe
hxxp://SEXXXTWIXXXGO.RU/ss17v/video/videos17.avi.exe
hxxp://SAJEGAEMPORNORUSS.RU/ss11l/video/videos11.avi.exe
hxxp://SAJEGAEMPORNORUSS.RU/ss12o/video/videos12.avi.exe
hxxp://SAJEGAEMPORNORUSS.RU/ss14t/video/videos14.avi.exe
hxxp://SAJEGAEMPORNORUSS.RU/ss17v/video/videos17.avi.exe

Ransom LockEmAll

Quote
hxxp://zsb4wbg.ru/401/xxx_video.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 04, 2011, 11:01:24 am: Ransoms

LockEmAll
Fake Spain Police warning

Quote
jerkieclient.com/w.php?f=17&e=2
jerkieclient.com/w.php?f=19&e=2

(http://img853.imageshack.us/img853/8444/1234hs.th.png) (http://imageshack.us/photo/my-images/853/1234hs.png/)

Quote
jerkieclient.com/w.php?f=30&e=2
This is WordPad from Windows XP SP2.

Ransom Pornorolik

Quote
hxxp://vipvkpornovideoarchive.ru/ss11l/video/videos11.avi.exe
hxxp://vipvkpornovideoarchive.ru/ss12o/video/videos12.avi.exe
hxxp://vipvkpornovideoarchive.ru/ss14t/video/videos14.avi.exe
hxxp://vipvkpornovideoarchive.ru/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: mc0blck on September 05, 2011, 07:47:27 am: Pornorolik domains allocated for Sept. 4
Quote
NEWSUPERMEGAPORNOXXX.RU
VK0NTAKTRERUPORNO.RU
MUSICPORNOARCHIVEXXX.RU
VIPVKPORNOVIDEOARCHIVE.RU
MEGASUPERHARDPORNOVIDEO.RU
VIPSEXXXPORNOGO.RU
JVCPORNORUXXXCLUB.RU
TELO4KIIZSETEYPORNOXXX.RU
IJUSTWANTTSEXPORNO.RU
SUPERVKONTAKTEPORNORU.RU
EBLYAPORNOXXXRUS.RU
SEXXGOGOPORNOURA.RU
BITCHPORNOSEXRU.RU
SATSEXPORNOXXX.RU
ONTHEBEACHSEXPORNORU.RU
VKSEXJESTPOREVOSEX.RU
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 05, 2011, 08:43:47 am: Direct links to Pornoroliks

Quote
hxxp://NEWSUPERMEGAPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://NEWSUPERMEGAPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://NEWSUPERMEGAPORNOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://NEWSUPERMEGAPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://VK0NTAKTRERUPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://VK0NTAKTRERUPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://VK0NTAKTRERUPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://VK0NTAKTRERUPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://MUSICPORNOARCHIVEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://MUSICPORNOARCHIVEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://MUSICPORNOARCHIVEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://MUSICPORNOARCHIVEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://VIPVKPORNOVIDEOARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://VIPVKPORNOVIDEOARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://VIPVKPORNOVIDEOARCHIVE.RU/ss14t/video/videos14.avi.exe
hxxp://VIPVKPORNOVIDEOARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://MEGASUPERHARDPORNOVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://MEGASUPERHARDPORNOVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://MEGASUPERHARDPORNOVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://MEGASUPERHARDPORNOVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://VIPSEXXXPORNOGO.RU/ss11l/video/videos11.avi.exe
hxxp://VIPSEXXXPORNOGO.RU/ss12o/video/videos12.avi.exe
hxxp://VIPSEXXXPORNOGO.RU/ss14t/video/videos14.avi.exe
hxxp://VIPSEXXXPORNOGO.RU/ss17v/video/videos17.avi.exe
hxxp://JVCPORNORUXXXCLUB.RU/ss11l/video/videos11.avi.exe
hxxp://JVCPORNORUXXXCLUB.RU/ss12o/video/videos12.avi.exe
hxxp://JVCPORNORUXXXCLUB.RU/ss14t/video/videos14.avi.exe
hxxp://JVCPORNORUXXXCLUB.RU/ss17v/video/videos17.avi.exe
hxxp://TELO4KIIZSETEYPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://TELO4KIIZSETEYPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://TELO4KIIZSETEYPORNOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://TELO4KIIZSETEYPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://IJUSTWANTTSEXPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://IJUSTWANTTSEXPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://IJUSTWANTTSEXPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://IJUSTWANTTSEXPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://SUPERVKONTAKTEPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://SUPERVKONTAKTEPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://SUPERVKONTAKTEPORNORU.RU/ss14t/video/videos14.avi.exe
hxxp://SUPERVKONTAKTEPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://EBLYAPORNOXXXRUS.RU/ss11l/video/videos11.avi.exe
hxxp://EBLYAPORNOXXXRUS.RU/ss12o/video/videos12.avi.exe
hxxp://EBLYAPORNOXXXRUS.RU/ss14t/video/videos14.avi.exe
hxxp://EBLYAPORNOXXXRUS.RU/ss17v/video/videos17.avi.exe
hxxp://SEXXGOGOPORNOURA.RU/ss11l/video/videos11.avi.exe
hxxp://SEXXGOGOPORNOURA.RU/ss12o/video/videos12.avi.exe
hxxp://SEXXGOGOPORNOURA.RU/ss14t/video/videos14.avi.exe
hxxp://SEXXGOGOPORNOURA.RU/ss17v/video/videos17.avi.exe
hxxp://BITCHPORNOSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://BITCHPORNOSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://BITCHPORNOSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://BITCHPORNOSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://SATSEXPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://SATSEXPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://SATSEXPORNOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://SATSEXPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://ONTHEBEACHSEXPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://ONTHEBEACHSEXPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://ONTHEBEACHSEXPORNORU.RU/ss14t/video/videos14.avi.exe
hxxp://ONTHEBEACHSEXPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://VKSEXJESTPOREVOSEX.RU/ss11l/video/videos11.avi.exe
hxxp://VKSEXJESTPOREVOSEX.RU/ss12o/video/videos12.avi.exe
hxxp://VKSEXJESTPOREVOSEX.RU/ss14t/video/videos14.avi.exe
hxxp://VKSEXJESTPOREVOSEX.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 06, 2011, 02:27:45 am: Pornorolik

Quote
hxxp://xxxvippornovideoru.ru/ss11l/video/videos11.avi.exe
hxxp://xxxvippornovideoru.ru/ss12o/video/videos12.avi.exe
hxxp://xxxvippornovideoru.ru/ss14t/video/videos14.avi.exe
hxxp://xxxvippornovideoru.ru/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 06, 2011, 06:16:35 am: Complete list of domains with direct links 5-6 Sept

Quote
hxxp://DOMASHNEEVIDEOXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://DOMASHNEEVIDEOXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://DOMASHNEEVIDEOXXXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://DOMASHNEEVIDEOXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://MEPORNOINDUSTRYSEX.RU/ss11l/video/videos11.avi.exe
hxxp://MEPORNOINDUSTRYSEX.RU/ss12o/video/videos12.avi.exe
hxxp://MEPORNOINDUSTRYSEX.RU/ss14t/video/videos14.avi.exe
hxxp://MEPORNOINDUSTRYSEX.RU/ss17v/video/videos17.avi.exe
hxxp://SHARPPORNOFILMSZZ.RU/ss11l/video/videos11.avi.exe
hxxp://SHARPPORNOFILMSZZ.RU/ss12o/video/videos12.avi.exe
hxxp://SHARPPORNOFILMSZZ.RU/ss14t/video/videos14.avi.exe
hxxp://SHARPPORNOFILMSZZ.RU/ss17v/video/videos17.avi.exe
hxxp://CUCUPORNOSEXVIDEOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://CUCUPORNOSEXVIDEOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://CUCUPORNOSEXVIDEOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://CUCUPORNOSEXVIDEOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://JESTPORNOHARDRRRVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://JESTPORNOHARDRRRVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://JESTPORNOHARDRRRVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://JESTPORNOHARDRRRVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://SEXSYSTEMXXXPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXSYSTEMXXXPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXSYSTEMXXXPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://SEXSYSTEMXXXPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://COKEPORNORUSGIRLLS.RU/ss11l/video/videos11.avi.exe
hxxp://COKEPORNORUSGIRLLS.RU/ss12o/video/videos12.avi.exe
hxxp://COKEPORNORUSGIRLLS.RU/ss14t/video/videos14.avi.exe
hxxp://COKEPORNORUSGIRLLS.RU/ss17v/video/videos17.avi.exe
hxxp://HARDDPORNOVLDEO.RU/ss11l/video/videos11.avi.exe
hxxp://HARDDPORNOVLDEO.RU/ss12o/video/videos12.avi.exe
hxxp://HARDDPORNOVLDEO.RU/ss14t/video/videos14.avi.exe
hxxp://HARDDPORNOVLDEO.RU/ss17v/video/videos17.avi.exe
hxxp://SEXAPORNOMEGAKRUTO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXAPORNOMEGAKRUTO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXAPORNOMEGAKRUTO.RU/ss14t/video/videos14.avi.exe
hxxp://SEXAPORNOMEGAKRUTO.RU/ss17v/video/videos17.avi.exe
hxxp://CALIBRIPORNOSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://CALIBRIPORNOSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://CALIBRIPORNOSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://CALIBRIPORNOSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://GRABPORNO4USMOTRI.RU/ss11l/video/videos11.avi.exe
hxxp://GRABPORNO4USMOTRI.RU/ss12o/video/videos12.avi.exe
hxxp://GRABPORNO4USMOTRI.RU/ss14t/video/videos14.avi.exe
hxxp://GRABPORNO4USMOTRI.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOSEXASMNOGORU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOSEXASMNOGORU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOSEXASMNOGORU.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOSEXASMNOGORU.RU/ss17v/video/videos17.avi.exe
hxxp://XXXVIPPORNOVIDEORU.RU/ss11l/video/videos11.avi.exe
hxxp://XXXVIPPORNOVIDEORU.RU/ss12o/video/videos12.avi.exe
hxxp://XXXVIPPORNOVIDEORU.RU/ss14t/video/videos14.avi.exe
hxxp://XXXVIPPORNOVIDEORU.RU/ss17v/video/videos17.avi.exe
hxxp://GLABNIYARCHIVSEXXPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://GLABNIYARCHIVSEXXPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://GLABNIYARCHIVSEXXPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://GLABNIYARCHIVSEXXPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOJESTSEXVIPRU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOJESTSEXVIPRU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOJESTSEXVIPRU.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOJESTSEXVIPRU.RU/ss17v/video/videos17.avi.exe
hxxp://XXXCELLYOURPORNO4FREE.RU/ss11l/video/videos11.avi.exe
hxxp://XXXCELLYOURPORNO4FREE.RU/ss12o/video/videos12.avi.exe
hxxp://XXXCELLYOURPORNO4FREE.RU/ss14t/video/videos14.avi.exe
hxxp://XXXCELLYOURPORNO4FREE.RU/ss17v/video/videos17.avi.exe
hxxp://FORMATGOODPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://FORMATGOODPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://FORMATGOODPORNOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://FORMATGOODPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOIZDOMARRRKRUTO.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOIZDOMARRRKRUTO.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOIZDOMARRRKRUTO.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOIZDOMARRRKRUTO.RU/ss17v/video/videos17.avi.exe
hxxp://VKPORNOXXXARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://VKPORNOXXXARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://VKPORNOXXXARCHIVE.RU/ss14t/video/videos14.avi.exe
hxxp://VKPORNOXXXARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://ENERGYXXXPORNOHARD.RU/ss11l/video/videos11.avi.exe
hxxp://ENERGYXXXPORNOHARD.RU/ss12o/video/videos12.avi.exe
hxxp://ENERGYXXXPORNOHARD.RU/ss14t/video/videos14.avi.exe
hxxp://ENERGYXXXPORNOHARD.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOARCHLVEPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOARCHLVEPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOARCHLVEPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOARCHLVEPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://TONOWNIGHTSEXYGIRLS.RU/ss11l/video/videos11.avi.exe
hxxp://TONOWNIGHTSEXYGIRLS.RU/ss12o/video/videos12.avi.exe
hxxp://TONOWNIGHTSEXYGIRLS.RU/ss14t/video/videos14.avi.exe
hxxp://TONOWNIGHTSEXYGIRLS.RU/ss17v/video/videos17.avi.exe
hxxp://DOWNLOADFFFINDYOUPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://DOWNLOADFFFINDYOUPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://DOWNLOADFFFINDYOUPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://DOWNLOADFFFINDYOUPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOSHARPSVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOSHARPSVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOSHARPSVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://POREVOSHARPSVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://STOREPORNOVIPRUSEX.RU/ss11l/video/videos11.avi.exe
hxxp://STOREPORNOVIPRUSEX.RU/ss12o/video/videos12.avi.exe
hxxp://STOREPORNOVIPRUSEX.RU/ss14t/video/videos14.avi.exe
hxxp://STOREPORNOVIPRUSEX.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: DnlMrx on September 06, 2011, 08:38:09 am: Did somebody notice one of these urls (in past) or got a idea of their function/behaviour?

Quote
http:/ergwtrhjetyjrtgbefwed.cz.cc/main.php
http:/xf5h.redirectme.net/main.php
http:/buipqzacronyms.info/main.php
Title: Re: Trojan Ransom
Post by: SysAdMini on September 06, 2011, 08:46:19 am: Quote from: DnlMrx on September 06, 2011, 08:38:09 am
Did somebody notice one of these urls (in past) or got a idea of their function/behaviour?

Quote
http:/ergwtrhjetyjrtgbefwed.cz.cc/main.php
http:/xf5h.redirectme.net/main.php
http:/buipqzacronyms.info/main.php

All Blackhole kits

http://www.malwaredomainlist.com/mdl.php?search=ergwtrhjetyjrtgbefwed.cz.cc&colsearch=All&quantity=50&inactive=on
http://www.malwaredomainlist.com/mdl.php?search=xf5h.redirectme.net&colsearch=All&quantity=50&inactive=on
http://www.malwaredomainlist.com/mdl.php?search=buipqzacronyms.info&colsearch=All&quantity=50&inactive=on
Title: Re: Trojan Ransom
Post by: DnlMrx on September 06, 2011, 09:19:34 am: Thanks a lot!
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 07, 2011, 03:33:19 am: Pornorolik allocated domains 6-7 Sept

Quote
hxxp://ALBOMSPORNORUXXX.RU/ss11l/video/videos11.avi.exe
hxxp://ALBOMSPORNORUXXX.RU/ss12o/video/videos12.avi.exe
hxxp://ALBOMSPORNORUXXX.RU/ss14t/video/videos14.avi.exe
hxxp://ALBOMSPORNORUXXX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNONUMBERRUXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNONUMBERRUXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNONUMBERRUXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNONUMBERRUXXX.RU/ss17v/video/videos17.avi.exe
hxxp://XXXNUMBERSPORNOSEX.RU/ss11l/video/videos11.avi.exe
hxxp://XXXNUMBERSPORNOSEX.RU/ss12o/video/videos12.avi.exe
hxxp://XXXNUMBERSPORNOSEX.RU/ss14t/video/videos14.avi.exe
hxxp://XXXNUMBERSPORNOSEX.RU/ss17v/video/videos17.avi.exe
hxxp://ACTIONPORNOXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://ACTIONPORNOXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://ACTIONPORNOXXXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://ACTIONPORNOXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOTRAXSTAT.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOTRAXSTAT.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOTRAXSTAT.RU/ss14t/video/videos14.avi.exe
hxxp://POREVOTRAXSTAT.RU/ss17v/video/videos17.avi.exe
hxxp://TRAXXXXPORNOSEXSTART.RU/ss11l/video/videos11.avi.exe
hxxp://TRAXXXXPORNOSEXSTART.RU/ss12o/video/videos12.avi.exe
hxxp://TRAXXXXPORNOSEXSTART.RU/ss14t/video/videos14.avi.exe
hxxp://TRAXXXXPORNOSEXSTART.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOTRAXSPRINGXXX.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOTRAXSPRINGXXX.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOTRAXSPRINGXXX.RU/ss14t/video/videos14.avi.exe
hxxp://POREVOTRAXSPRINGXXX.RU/ss17v/video/videos17.avi.exe
hxxp://TRAXSPRINGPORNOSEXX.RU/ss11l/video/videos11.avi.exe
hxxp://TRAXSPRINGPORNOSEXX.RU/ss12o/video/videos12.avi.exe
hxxp://TRAXSPRINGPORNOSEXX.RU/ss14t/video/videos14.avi.exe
hxxp://TRAXSPRINGPORNOSEXX.RU/ss17v/video/videos17.avi.exe
hxxp://NUMBERYOURPORNXXX.RU/ss11l/video/videos11.avi.exe
hxxp://NUMBERYOURPORNXXX.RU/ss12o/video/videos12.avi.exe
hxxp://NUMBERYOURPORNXXX.RU/ss14t/video/videos14.avi.exe
hxxp://NUMBERYOURPORNXXX.RU/ss17v/video/videos17.avi.exe
hxxp://TATPORNOSEXRUXXX.RU/ss11l/video/videos11.avi.exe
hxxp://TATPORNOSEXRUXXX.RU/ss12o/video/videos12.avi.exe
hxxp://TATPORNOSEXRUXXX.RU/ss14t/video/videos14.avi.exe
hxxp://TATPORNOSEXRUXXX.RU/ss17v/video/videos17.avi.exe
hxxp://LIKELIKESEXPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://LIKELIKESEXPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://LIKELIKESEXPORNORU.RU/ss14t/video/videos14.avi.exe
hxxp://LIKELIKESEXPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://SPRINGPORNOXXXSEX.RU/ss11l/video/videos11.avi.exe
hxxp://SPRINGPORNOXXXSEX.RU/ss12o/video/videos12.avi.exe
hxxp://SPRINGPORNOXXXSEX.RU/ss14t/video/videos14.avi.exe
hxxp://SPRINGPORNOXXXSEX.RU/ss17v/video/videos17.avi.exe
hxxp://HISTORYPORNOSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://HISTORYPORNOSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://HISTORYPORNOSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://HISTORYPORNOSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://SEXNUMBERPORNARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://SEXNUMBERPORNARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://SEXNUMBERPORNARCHIVE.RU/ss14t/video/videos14.avi.exe
hxxp://SEXNUMBERPORNARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://HARDXXXVERYGOODPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://HARDXXXVERYGOODPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://HARDXXXVERYGOODPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://HARDXXXVERYGOODPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOXXXSEXACTION.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOXXXSEXACTION.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOXXXSEXACTION.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOXXXSEXACTION.RU/ss17v/video/videos17.avi.exe
hxxp://ZIGIPORNOSEXALBOMS.RU/ss11l/video/videos11.avi.exe
hxxp://ZIGIPORNOSEXALBOMS.RU/ss12o/video/videos12.avi.exe
hxxp://ZIGIPORNOSEXALBOMS.RU/ss14t/video/videos14.avi.exe
hxxp://ZIGIPORNOSEXALBOMS.RU/ss17v/video/videos17.avi.exe
hxxp://BERDPORNOXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://BERDPORNOXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://BERDPORNOXXXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://BERDPORNOXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOXXXHISTORY.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOXXXHISTORY.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOXXXHISTORY.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOXXXHISTORY.RU/ss17v/video/videos17.avi.exe
hxxp://XXXPORNOSEXHISTORYNOW.RU/ss11l/video/videos11.avi.exe
hxxp://XXXPORNOSEXHISTORYNOW.RU/ss12o/video/videos12.avi.exe
hxxp://XXXPORNOSEXHISTORYNOW.RU/ss14t/video/videos14.avi.exe
hxxp://XXXPORNOSEXHISTORYNOW.RU/ss17v/video/videos17.avi.exe

Up to current date hosting provider has ignored all abuses we have sent.
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 07, 2011, 10:10:51 am: Ransom LockEmAll

Quote
hxxp://pornoxnx-conline3a.ru/99/xxx_video.exe

Redirects to LockEmAll

Quote
hxxp://pornozporkkas.ru/
hxxp://muoporkka.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 07, 2011, 12:46:20 pm: New pornorolik domain (operational).

Quote
hxxp://avlpornosexfilms.ru/ss11l/video/videos11.avi.exe
hxxp://avlpornosexfilms.ru/ss12o/video/videos12.avi.exe
hxxp://avlpornosexfilms.ru/ss14t/video/videos14.avi.exe
hxxp://avlpornosexfilms.ru/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 07, 2011, 03:25:17 pm: More pornoroliks

Quote
hxxp://alcporevotraxsexru.ru/ss11l/video/videos11.avi.exe
hxxp://alcporevotraxsexru.ru/ss12o/video/videos12.avi.exe
hxxp://alcporevotraxsexru.ru/ss14t/video/videos14.avi.exe
hxxp://alcporevotraxsexru.ru/ss17v/video/videos17.avi.exe

Ransom LockEmAll

Quote
hxxp://ptl1ruk.ru/p.php?f=448&e=2
hxxp://ptl1ruk.ru/p.php?f=449&e=2
hxxp://ptl1ruk.ru/p.php?f=450&e=2
hxxp://ptl1ruk.ru/p.php?f=451&e=2
hxxp://ptl1ruk.ru/p.php?f=452&e=2
hxxp://ptl1ruk.ru/p.php?f=453&e=2
Title: Re: Trojan Ransom
Post by: Xylitol on September 07, 2011, 07:12:52 pm: Code: [Select]
86400 position 21923445 i &antibot_status=disabled&geoipcity_status=disabled&p3p= location 1 100 1 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://filmspornoxxxsexru.ru/ss12o/vu-index.html location 2 100 2 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://filmspornoxxxsexru.ru/ss12o/b-index.html location 3 100 3 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://filmspornoxxxsexru.ru/ss12o/npv-index.html location 4 100 4 0 '' 1 1 1 1 1 1 1 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://filmspornoxxxsexru.ru/ss12o/fp-index.html location 0 0 10000 0 '' 1 1 1 1 1 1 1 c 1 0 0 '0 ' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' sutra:default
Code: [Select]
86400 position 21923525 i &antibot_status=disabled&geoipcity_status=disabled&p3p= location 1 100 1 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://alcporevotraxsexru.ru/ss12o/vu-index.html location 2 100 2 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://alcporevotraxsexru.ru/ss12o/b-index.html location 3 100 3 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://alcporevotraxsexru.ru/ss12o/npv-index.html location 4 100 4 0 '' 1 1 1 1 1 1 1 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://alcporevotraxsexru.ru/ss12o/fp-index.html location 0 0 10000 0 '' 1 1 1 1 1 1 1 c 1 0 0 '0 ' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' sutra:default
Code: [Select]
86400 position 21923535 i &antibot_status=disabled&geoipcity_status=disabled&p3p= location 1 100 1 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://superxxxpornotraxsex.ru/ss12o/vu-index.html location 2 100 2 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://superxxxpornotraxsex.ru/ss12o/b-index.html location 3 100 3 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://superxxxpornotraxsex.ru/ss12o/npv-index.html location 4 100 4 0 '' 1 1 1 1 1 1 1 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://superxxxpornotraxsex.ru/ss12o/fp-index.html location 0 0 10000 0 '' 1 1 1 1 1 1 1 c 1 0 0 '0 ' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' sutra:default
Code: [Select]
86400 position 21923710 i &antibot_status=disabled&geoipcity_status=disabled&p3p= location 1 100 1 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://archpornosuperhitsxxx.ru/ss12o/vu-index.html location 2 100 2 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://archpornosuperhitsxxx.ru/ss12o/b-index.html location 3 100 3 0 '' 1 1 1 1 1 1 2 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://archpornosuperhitsxxx.ru/ss12o/npv-index.html location 4 100 4 0 '' 1 1 1 1 1 1 1 i 1 0 0 '2 RU' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' http://archpornosuperhitsxxx.ru/ss12o/fp-index.html location 0 0 10000 0 '' 1 1 1 1 1 1 1 c 1 0 0 '0 ' '0 ' '0 ' '0 ' '0 ' '0 ' '' '0 ' '0 ' sutra:defaultpornorolik locs, hacked redirector.

Code: [Select]
hXXp://filmspornoxxxsexru.ru/ss12o/video/videos12.avi.exe hXXp://archpornosuperhitsxxx.ru/ss12o/videos12.avi.exe hXXp://superxxxpornotraxsex.ru/ss12o/videos12.avi.exe hXXp://filmspornoxxxsexru.ru/ss12o/videos12.avi.exe hXXp://jestsexpornoxxxruxxx.ru/ss12o/video/videos12.avi.exe hXXp://smotripornoclipsfromnewarchive.ru/ss12o/video/videos12.avi.exe hXXp://filmspornoxxxsexru.ru/ss17v/video/videos17.avi.exe hXXp://archpornosuperhitsxxx.ru/ss17v/video/videos17.avi.exe hXXp://superxxxpornotraxsex.ru/ss17v/video/videos17.avi.exe hXXp://filmspornoxxxsexru.ru/ss17v/video/videos17.avi.exe hXXp://jestsexpornoxxxruxxx.ru/ss17v/video/videos17.avi.exe hXXp://smotripornoclipsfromnewarchive.ru/ss17v/video/videos17.avi.exe hXXp://filmspornoxxxsexru.ru/ss11l/video/videos11.avi.exe hXXp://archpornosuperhitsxxx.ru/ss11l/video/videos11.avi.exe hXXp://superxxxpornotraxsex.ru/ss11l/video/videos11.avi.exe hXXp://filmspornoxxxsexru.ru/ss11l/video/videos11.avi.exe hXXp://jestsexpornoxxxruxxx.ru/ss11l/video/videos11.avi.exe hXXp://smotripornoclipsfromnewarchive.ru/ss11l/video/videos11.avi.exe
Not sure but the redirector seem giving new link each hours.

-rw-rw-rw- 1 admin admin 745 Sep 7 15:00 12.redirects.log = jestsexpornoxxxruxxx.ru
-rw-rw-rw- 1 admin admin 785 Sep 7 16:20 12.redirects.log = smotripornoclipsfromnewarchive.ru
will try to monitor
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 08, 2011, 07:33:30 am: Ransom LockEmAll

FUD - 0/44 static detections
(http://www.virustotal.com/file-scan/report.html?id=465a32320fd2dcc91dad5d0e7127ae72c45e6fc55a0546af5bde5528cadf0eb8-1315466419)

Quote
hxxp://porkaxmx-conline4b.ru/69/xxx_video.exe
hxxp://kakydtz.ru/l.php?f=455&e=2
hxxp://kakydtz.ru/l.php?f=456&e=2
hxxp://kakydtz.ru/l.php?f=457&e=2
hxxp://kakydtz.ru/l.php?f=458&e=2

LockEmAll redirectors

Quote
hxxp://vidosxnx-conline5e.ru/
hxxp://videoxcx-freex3b.ru/in.cgi?2
hxxp://videoxcx-freex3b.ru/in.cgi?9

Blackhole
Quote
hxxp://kakydtz.ru/main.php?page=1e3c7de7534820d5

Ransom Pornorolik

Quote
hxxp://pornoverrsexru.ru/ss11l/video/videos11.avi.exe
hxxp://pornoverrsexru.ru/ss12o/video/videos12.avi.exe
hxxp://pornoverrsexru.ru/ss14t/video/videos14.avi.exe
hxxp://pornoverrsexru.ru/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 08, 2011, 11:09:47 am: Complete list of allocated Pornorolik domains 7 - 8 Sept.

Quote
hxxp://HO4USMOTRETMNOGOXXXPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://HO4USMOTRETMNOGOXXXPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://HO4USMOTRETMNOGOXXXPORNORU.RU/ss14t/video/videos14.avi.exe
hxxp://HO4USMOTRETMNOGOXXXPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://RUSOLUTIONPORNOSEX.RU/ss11l/video/videos11.avi.exe
hxxp://RUSOLUTIONPORNOSEX.RU/ss12o/video/videos12.avi.exe
hxxp://RUSOLUTIONPORNOSEX.RU/ss14t/video/videos14.avi.exe
hxxp://RUSOLUTIONPORNOSEX.RU/ss17v/video/videos17.avi.exe
hxxp://VSEPORNORUNETADLYATEBYA.RU/ss11l/video/videos11.avi.exe
hxxp://VSEPORNORUNETADLYATEBYA.RU/ss12o/video/videos12.avi.exe
hxxp://VSEPORNORUNETADLYATEBYA.RU/ss14t/video/videos14.avi.exe
hxxp://VSEPORNORUNETADLYATEBYA.RU/ss17v/video/videos17.avi.exe
hxxp://FORMATYOURXXXSEXPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://FORMATYOURXXXSEXPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://FORMATYOURXXXSEXPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://FORMATYOURXXXSEXPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://RUPOREVOSMOTRIKA4AYSEX.RU/ss11l/video/videos11.avi.exe
hxxp://RUPOREVOSMOTRIKA4AYSEX.RU/ss12o/video/videos12.avi.exe
hxxp://RUPOREVOSMOTRIKA4AYSEX.RU/ss14t/video/videos14.avi.exe
hxxp://RUPOREVOSMOTRIKA4AYSEX.RU/ss17v/video/videos17.avi.exe
hxxp://VIEWSUPERPORNOSEXPOREVO.RU/ss11l/video/videos11.avi.exe
hxxp://VIEWSUPERPORNOSEXPOREVO.RU/ss12o/video/videos12.avi.exe
hxxp://VIEWSUPERPORNOSEXPOREVO.RU/ss14t/video/videos14.avi.exe
hxxp://VIEWSUPERPORNOSEXPOREVO.RU/ss17v/video/videos17.avi.exe
hxxp://FILMSPORNOXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://FILMSPORNOXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://FILMSPORNOXXXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://FILMSPORNOXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://SUPERXXXPORNOTRAXSEX.RU/ss11l/video/videos11.avi.exe
hxxp://SUPERXXXPORNOTRAXSEX.RU/ss12o/video/videos12.avi.exe
hxxp://SUPERXXXPORNOTRAXSEX.RU/ss14t/video/videos14.avi.exe
hxxp://SUPERXXXPORNOTRAXSEX.RU/ss17v/video/videos17.avi.exe
hxxp://DATASEXXXPORNOXXXRU.RU/ss11l/video/videos11.avi.exe
hxxp://DATASEXXXPORNOXXXRU.RU/ss12o/video/videos12.avi.exe
hxxp://DATASEXXXPORNOXXXRU.RU/ss14t/video/videos14.avi.exe
hxxp://DATASEXXXPORNOXXXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOTABLE4USEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOTABLE4USEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOTABLE4USEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOTABLE4USEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://SMOTRIPORNOCLIPSFROMNEWARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://SMOTRIPORNOCLIPSFROMNEWARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://SMOTRIPORNOCLIPSFROMNEWARCHIVE.RU/ss14t/video/videos14.avi.exe
hxxp://SMOTRIPORNOCLIPSFROMNEWARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://AVLPORNOSEXFILMS.RU/ss11l/video/videos11.avi.exe
hxxp://AVLPORNOSEXFILMS.RU/ss12o/video/videos12.avi.exe
hxxp://AVLPORNOSEXFILMS.RU/ss14t/video/videos14.avi.exe
hxxp://AVLPORNOSEXFILMS.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOSOLUTIONONLINEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOSOLUTIONONLINEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOSOLUTIONONLINEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOSOLUTIONONLINEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://SEXSESGOGOPORNORUSS.RU/ss11l/video/videos11.avi.exe
hxxp://SEXSESGOGOPORNORUSS.RU/ss12o/video/videos12.avi.exe
hxxp://SEXSESGOGOPORNORUSS.RU/ss14t/video/videos14.avi.exe
hxxp://SEXSESGOGOPORNORUSS.RU/ss17v/video/videos17.avi.exe
hxxp://ARCHPORNOSUPERHITSXXX.RU/ss11l/video/videos11.avi.exe
hxxp://ARCHPORNOSUPERHITSXXX.RU/ss12o/video/videos12.avi.exe
hxxp://ARCHPORNOSUPERHITSXXX.RU/ss14t/video/videos14.avi.exe
hxxp://ARCHPORNOSUPERHITSXXX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOMNOGOSEXXXRUSBABS.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOMNOGOSEXXXRUSBABS.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOMNOGOSEXXXRUSBABS.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOMNOGOSEXXXRUSBABS.RU/ss17v/video/videos17.avi.exe
hxxp://SEXPOREVOTRAXXXPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXPOREVOTRAXXXPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXPOREVOTRAXXXPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://SEXPOREVOTRAXXXPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://ALCPOREVOTRAXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://ALCPOREVOTRAXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://ALCPOREVOTRAXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://ALCPOREVOTRAXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://MEGASUPERCOOLSEXTRAX.RU/ss11l/video/videos11.avi.exe
hxxp://MEGASUPERCOOLSEXTRAX.RU/ss12o/video/videos12.avi.exe
hxxp://MEGASUPERCOOLSEXTRAX.RU/ss14t/video/videos14.avi.exe
hxxp://MEGASUPERCOOLSEXTRAX.RU/ss17v/video/videos17.avi.exe
hxxp://SEXINETOLKKOVPORNO4U.RU/ss11l/video/videos11.avi.exe
hxxp://SEXINETOLKKOVPORNO4U.RU/ss12o/video/videos12.avi.exe
hxxp://SEXINETOLKKOVPORNO4U.RU/ss14t/video/videos14.avi.exe
hxxp://SEXINETOLKKOVPORNO4U.RU/ss17v/video/videos17.avi.exe
hxxp://XXXONLINESOLUTIONPOREVO.RU/ss11l/video/videos11.avi.exe
hxxp://XXXONLINESOLUTIONPOREVO.RU/ss12o/video/videos12.avi.exe
hxxp://XXXONLINESOLUTIONPOREVO.RU/ss14t/video/videos14.avi.exe
hxxp://XXXONLINESOLUTIONPOREVO.RU/ss17v/video/videos17.avi.exe
hxxp://JESTSEXPORNOXXXRUXXX.RU/ss11l/video/videos11.avi.exe
hxxp://JESTSEXPORNOXXXRUXXX.RU/ss12o/video/videos12.avi.exe
hxxp://JESTSEXPORNOXXXRUXXX.RU/ss14t/video/videos14.avi.exe
hxxp://JESTSEXPORNOXXXRUXXX.RU/ss17v/video/videos17.avi.exe
hxxp://SEXDIVANKUHNYAKRUTO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXDIVANKUHNYAKRUTO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXDIVANKUHNYAKRUTO.RU/ss14t/video/videos14.avi.exe
hxxp://SEXDIVANKUHNYAKRUTO.RU/ss17v/video/videos17.avi.exe
hxxp://WEDPORNOXXXMNOGOFILMS.RU/ss11l/video/videos11.avi.exe
hxxp://WEDPORNOXXXMNOGOFILMS.RU/ss12o/video/videos12.avi.exe
hxxp://WEDPORNOXXXMNOGOFILMS.RU/ss14t/video/videos14.avi.exe
hxxp://WEDPORNOXXXMNOGOFILMS.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 09, 2011, 04:04:19 am: Pornorolik domains 8 - 9 Sept.

Quote
hxxp://RAVEARCHIVEPORNOVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://RAVEARCHIVEPORNOVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://RAVEARCHIVEPORNOVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://RAVEARCHIVEPORNOVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOTOPRUBESPLATNO.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOTOPRUBESPLATNO.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOTOPRUBESPLATNO.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOTOPRUBESPLATNO.RU/ss17v/video/videos17.avi.exe
hxxp://PORNORAVEGOODXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNORAVEGOODXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNORAVEGOODXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNORAVEGOODXXX.RU/ss17v/video/videos17.avi.exe
hxxp://MNJGOPORNORAVEXXXFILMS.RU/ss11l/video/videos11.avi.exe
hxxp://MNJGOPORNORAVEXXXFILMS.RU/ss12o/video/videos12.avi.exe
hxxp://MNJGOPORNORAVEXXXFILMS.RU/ss14t/video/videos14.avi.exe
hxxp://MNJGOPORNORAVEXXXFILMS.RU/ss17v/video/videos17.avi.exe
hxxp://TOPPORNOSEXXXARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://TOPPORNOSEXXXARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://TOPPORNOSEXXXARCHIVE.RU/ss14t/video/videos14.avi.exe
hxxp://TOPPORNOSEXXXARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://CMONPORNOLIKEXXXRU.RU/ss11l/video/videos11.avi.exe
hxxp://CMONPORNOLIKEXXXRU.RU/ss12o/video/videos12.avi.exe
hxxp://CMONPORNOLIKEXXXRU.RU/ss14t/video/videos14.avi.exe
hxxp://CMONPORNOLIKEXXXRU.RU/ss17v/video/videos17.avi.exe
hxxp://TOPDOWNLOADPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://TOPDOWNLOADPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://TOPDOWNLOADPORNOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://TOPDOWNLOADPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://SEXRAVEPORNOHARD.RU/ss11l/video/videos11.avi.exe
hxxp://SEXRAVEPORNOHARD.RU/ss12o/video/videos12.avi.exe
hxxp://SEXRAVEPORNOHARD.RU/ss14t/video/videos14.avi.exe
hxxp://SEXRAVEPORNOHARD.RU/ss17v/video/videos17.avi.exe
hxxp://RAVEYOURPORNXXX.RU/ss11l/video/videos11.avi.exe
hxxp://RAVEYOURPORNXXX.RU/ss12o/video/videos12.avi.exe
hxxp://RAVEYOURPORNXXX.RU/ss14t/video/videos14.avi.exe
hxxp://RAVEYOURPORNXXX.RU/ss17v/video/videos17.avi.exe
hxxp://RAVERUPOREVOTRAX.RU/ss11l/video/videos11.avi.exe
hxxp://RAVERUPOREVOTRAX.RU/ss12o/video/videos12.avi.exe
hxxp://RAVERUPOREVOTRAX.RU/ss14t/video/videos14.avi.exe
hxxp://RAVERUPOREVOTRAX.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 09, 2011, 07:18:40 am: Ransom LockEmAll

Quote
hxxp://pi5iemd.ru/u.php?f=465&e=2
hxxp://pi5iemd.ru/u.php?f=466&e=2
hxxp://pi5iemd.ru/u.php?f=467&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 09, 2011, 02:21:25 pm: Ransom LockEmAll

Quote
hxxp://videoxmx-freex2g.ru/49/xxx_video.exe
hxxp://ae29nrh.ru/f.php?f=468&e=2
hxxp://ae29nrh.ru/f.php?f=469&e=2
hxxp://ae29nrh.ru/f.php?f=470&e=2
hxxp://ae29nrh.ru/f.php?f=471&e=2

Starting from 1 Sept 2011 LockEmAll registered 72 domain names.

Overall since moving from Amazon WS in the July they allocated 544 names.

Pornoroliks

Quote
hxxp://golovasukapornosex.ru/ss11l/video/videos11.avi.exe
hxxp://golovasukapornosex.ru/ss12o/video/videos12.avi.exe
hxxp://golovasukapornosex.ru/ss14t/video/videos14.avi.exe
hxxp://golovasukapornosex.ru/ss17v/video/videos17.avi.exe
hxxp://shallporevotraxru.ru/ss11l/video/videos11.avi.exe
hxxp://shallporevotraxru.ru/ss12o/video/videos12.avi.exe
hxxp://shallporevotraxru.ru/ss14t/video/videos14.avi.exe
hxxp://shallporevotraxru.ru/ss17v/video/videos17.avi.exe

Overall 813 domain names since July.
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 10, 2011, 03:43:15 am: Pornorolik allocated domains 9 - 10 Sept.
All operational at moment of this post.

Quote
hxxp://CURRENTXXXPORNOARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://CURRENTXXXPORNOARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://CURRENTXXXPORNOARCHIVE.RU/ss14t/video/videos14.avi.exe
hxxp://CURRENTXXXPORNOARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOTRAXSTYLESSS.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOTRAXSTYLESSS.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOTRAXSTYLESSS.RU/ss14t/video/videos14.avi.exe
hxxp://POREVOTRAXSTYLESSS.RU/ss17v/video/videos17.avi.exe
hxxp://SEXPORNORUULETXXX.RU/ss11l/video/videos11.avi.exe
hxxp://SEXPORNORUULETXXX.RU/ss12o/video/videos12.avi.exe
hxxp://SEXPORNORUULETXXX.RU/ss14t/video/videos14.avi.exe
hxxp://SEXPORNORUULETXXX.RU/ss17v/video/videos17.avi.exe
hxxp://CLIPPORNOXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://CLIPPORNOXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://CLIPPORNOXXXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://CLIPPORNOXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://POLOPORNOSEXPOP.RU/ss11l/video/videos11.avi.exe
hxxp://POLOPORNOSEXPOP.RU/ss12o/video/videos12.avi.exe
hxxp://POLOPORNOSEXPOP.RU/ss14t/video/videos14.avi.exe
hxxp://POLOPORNOSEXPOP.RU/ss17v/video/videos17.avi.exe
hxxp://SEXPODVINOPORNOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://SEXPODVINOPORNOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://SEXPODVINOPORNOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://SEXPODVINOPORNOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://YOURPORNOHARDVIDEOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://YOURPORNOHARDVIDEOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://YOURPORNOHARDVIDEOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://YOURPORNOHARDVIDEOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://NEYOPORNOSEXTRAX.RU/ss11l/video/videos11.avi.exe
hxxp://NEYOPORNOSEXTRAX.RU/ss12o/video/videos12.avi.exe
hxxp://NEYOPORNOSEXTRAX.RU/ss14t/video/videos14.avi.exe
hxxp://NEYOPORNOSEXTRAX.RU/ss17v/video/videos17.avi.exe
hxxp://SEXDOWNLOADXXXTRAXVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://SEXDOWNLOADXXXTRAXVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://SEXDOWNLOADXXXTRAXVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://SEXDOWNLOADXXXTRAXVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://XXXDOWNLOADNEWHARDPORNO.RU/ss11l/video/videos11.avi.exe
hxxp://XXXDOWNLOADNEWHARDPORNO.RU/ss12o/video/videos12.avi.exe
hxxp://XXXDOWNLOADNEWHARDPORNO.RU/ss14t/video/videos14.avi.exe
hxxp://XXXDOWNLOADNEWHARDPORNO.RU/ss17v/video/videos17.avi.exe
hxxp://NEWSTYLEPORNOHARDXXX.RU/ss11l/video/videos11.avi.exe
hxxp://NEWSTYLEPORNOHARDXXX.RU/ss12o/video/videos12.avi.exe
hxxp://NEWSTYLEPORNOHARDXXX.RU/ss14t/video/videos14.avi.exe
hxxp://NEWSTYLEPORNOHARDXXX.RU/ss17v/video/videos17.avi.exe
hxxp://RUNETPORNOXXXVIDEOCLIPS.RU/ss11l/video/videos11.avi.exe
hxxp://RUNETPORNOXXXVIDEOCLIPS.RU/ss12o/video/videos12.avi.exe
hxxp://RUNETPORNOXXXVIDEOCLIPS.RU/ss14t/video/videos14.avi.exe
hxxp://RUNETPORNOXXXVIDEOCLIPS.RU/ss17v/video/videos17.avi.exe
hxxp://VKPORNOONLLNEVIDEOHARD.RU/ss11l/video/videos11.avi.exe
hxxp://VKPORNOONLLNEVIDEOHARD.RU/ss12o/video/videos12.avi.exe
hxxp://VKPORNOONLLNEVIDEOHARD.RU/ss14t/video/videos14.avi.exe
hxxp://VKPORNOONLLNEVIDEOHARD.RU/ss17v/video/videos17.avi.exe
hxxp://HOSTPORNOCLUBBERSXXX.RU/ss11l/video/videos11.avi.exe
hxxp://HOSTPORNOCLUBBERSXXX.RU/ss12o/video/videos12.avi.exe
hxxp://HOSTPORNOCLUBBERSXXX.RU/ss14t/video/videos14.avi.exe
hxxp://HOSTPORNOCLUBBERSXXX.RU/ss17v/video/videos17.avi.exe
hxxp://READERPORNOSEXPOPKA.RU/ss11l/video/videos11.avi.exe
hxxp://READERPORNOSEXPOPKA.RU/ss12o/video/videos12.avi.exe
hxxp://READERPORNOSEXPOPKA.RU/ss14t/video/videos14.avi.exe
hxxp://READERPORNOSEXPOPKA.RU/ss17v/video/videos17.avi.exe
hxxp://VIDEOTRAXXXPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://VIDEOTRAXXXPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://VIDEOTRAXXXPORNORU.RU/ss14t/video/videos14.avi.exe
hxxp://VIDEOTRAXXXPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://HARDSEXMNOGOVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://HARDSEXMNOGOVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://HARDSEXMNOGOVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://HARDSEXMNOGOVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOCMONJESTSEX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOCMONJESTSEX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOCMONJESTSEX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOCMONJESTSEX.RU/ss17v/video/videos17.avi.exe
hxxp://ULETRUSEXVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://ULETRUSEXVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://ULETRUSEXVIDEO.RU/ss14t/video/videos14.avi.exe
hxxp://ULETRUSEXVIDEO.RU/ss17v/video/videos17.avi.exe
hxxp://GOLOVASUKAPORNOSEX.RU/ss11l/video/videos11.avi.exe
hxxp://GOLOVASUKAPORNOSEX.RU/ss12o/video/videos12.avi.exe
hxxp://GOLOVASUKAPORNOSEX.RU/ss14t/video/videos14.avi.exe
hxxp://GOLOVASUKAPORNOSEX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOCLUB4UPORNOSEX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOCLUB4UPORNOSEX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOCLUB4UPORNOSEX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOCLUB4UPORNOSEX.RU/ss17v/video/videos17.avi.exe
hxxp://STYLENEWHARDPOREVO.RU/ss11l/video/videos11.avi.exe
hxxp://STYLENEWHARDPOREVO.RU/ss12o/video/videos12.avi.exe
hxxp://STYLENEWHARDPOREVO.RU/ss14t/video/videos14.avi.exe
hxxp://STYLENEWHARDPOREVO.RU/ss17v/video/videos17.avi.exe
hxxp://FICHKIPOREVOTRAXSMOTRI.RU/ss11l/video/videos11.avi.exe
hxxp://FICHKIPOREVOTRAXSMOTRI.RU/ss12o/video/videos12.avi.exe
hxxp://FICHKIPOREVOTRAXSMOTRI.RU/ss14t/video/videos14.avi.exe
hxxp://FICHKIPOREVOTRAXSMOTRI.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOVIEWONLINEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOVIEWONLINEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOVIEWONLINEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://POREVOVIEWONLINEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://SHALLPOREVOTRAXRU.RU/ss11l/video/videos11.avi.exe
hxxp://SHALLPOREVOTRAXRU.RU/ss12o/video/videos12.avi.exe
hxxp://SHALLPOREVOTRAXRU.RU/ss14t/video/videos14.avi.exe
hxxp://SHALLPOREVOTRAXRU.RU/ss17v/video/videos17.avi.exe

Ransom LockEmAll

Quote
hxxp://pornoxmx-freex1e.ru/125/xxx_video.exe
hxxp://pemtead.ru/v.php?f=469&e=2
hxxp://pemtead.ru/v.php?f=470&e=2
hxxp://pemtead.ru/v.php?f=471&e=2
hxxp://pemtead.ru/v.php?f=472&e=2
hxxp://pemtead.ru/v.php?f=473&e=2
hxxp://pemtead.ru/v.php?f=474&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 10, 2011, 11:57:59 am: Ransom LockEmAll

Quote
hxxp://pornoxmx-onlina3f.ru/18/xxx_video.exe
hxxp://mjmeyxs.ru/v.php?f=474&e=2
hxxp://mjmeyxs.ru/v.php?f=473&e=2
hxxp://mjmeyxs.ru/v.php?f=472&e=2
hxxp://mjmeyxs.ru/v.php?f=471&e=2
hxxp://mjmeyxs.ru/v.php?f=470&e=2
hxxp://mjmeyxs.ru/v.php?f=469&e=2

LockEmAll redirectors
Quote
hxxp://porkaxnx-freex5e.ru/
hxxp://porkaxcx-conline2g.ru/in.cgi?2
hxxp://porkaxcx-conline2g.ru/in.cgi?8

Blackhole exploit kit
Quote
hxxp://mjmeyxs.ru/main.php?page=2a3b4807e176d26e
Title: Re: Trojan Ransom
Post by: SysAdMini on September 10, 2011, 02:17:11 pm: Xylitol has written an article about Pornorolik.

http://xylibox.blogspot.com/2011/09/trojanransom-porno-rolikaviexe.html
Title: Re: Trojan Ransom
Post by: Xylitol on September 10, 2011, 05:19:27 pm: Code: [Select]
hxxp://discpornosexhistoryru.ru/ss12o/video/videos12.avi.exe hxxp://discpornosexhistoryru.ru/ss17v/video/videos17.avi.exe hxxp://discpornosexhistoryru.ru/ss11l/video/videos11.avi.exe hxxp://discpornosexhistoryru.ru/ss14t/video/videos14.avi.exe
new locs:
Quote
hxxp://pornotraxsexilikexxx.ru/ss12o/video/videos12.avi.exe
hxxp://pornotraxsexilikexxx.ru/ss17v/video/videos17.avi.exe
hxxp://pornotraxsexilikexxx.ru/ss11l/video/videos11.avi.exe
hxxp://pornotraxsexilikexxx.ru/ss14t/video/videos14.avi.exe
hxxp://athleticpornclubxxx.ru/ss12o/video/videos12.avi.exe
hxxp://athleticpornclubxxx.ru/ss17v/video/videos17.avi.exe
hxxp://athleticpornclubxxx.ru/ss11l/video/videos11.avi.exe
hxxp://athleticpornclubxxx.ru/ss14t/video/videos14.avi.exe
hxxp://ineednewpornovideoxxx.ru/ss12o/video/videos12.avi.exe
hxxp://ineednewpornovideoxxx.ru/ss17v/video/videos17.avi.exe
hxxp://ineednewpornovideoxxx.ru/ss11l/video/videos11.avi.exe
hxxp://ineednewpornovideoxxx.ru/ss14t/video/videos14.avi.exe
hxxp://pornoxxxvideoneeded.ru/ss12o/video/videos12.avi.exe
hxxp://pornoxxxvideoneeded.ru/ss17v/video/videos17.avi.exe
hxxp://pornoxxxvideoneeded.ru/ss11l/video/videos11.avi.exe
hxxp://pornoxxxvideoneeded.ru/ss14t/video/videos14.avi.exe
hxxp://xxxsexporevoneedru.ru/ss12o/video/videos12.avi.exe
hxxp://xxxsexporevoneedru.ru/ss17v/video/videos17.avi.exe
hxxp://xxxsexporevoneedru.ru/ss11l/video/videos11.avi.exe
hxxp://xxxsexporevoneedru.ru/ss14t/video/videos14.avi.exe
hxxp://rustraxneedpopkaru.ru/ss12o/video/videos12.avi.exe
hxxp://rustraxneedpopkaru.ru/ss17v/video/videos17.avi.exe
hxxp://rustraxneedpopkaru.ru/ss11l/video/videos11.avi.exe
hxxp://rustraxneedpopkaru.ru/ss14t/video/videos14.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 11, 2011, 03:33:34 am: Pornorolik allocated domains 10 - 11 Sept.
All operational at moment of this post.

Quote
hxxp://DESCTOPTRAXSEXPORNUHA.RU/ss11l/video/videos11.avi.exe
hxxp://DESCTOPTRAXSEXPORNUHA.RU/ss12o/video/videos12.avi.exe
hxxp://DESCTOPTRAXSEXPORNUHA.RU/ss14t/video/videos14.avi.exe
hxxp://DESCTOPTRAXSEXPORNUHA.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOTRAXSEXPORNODDD.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOTRAXSEXPORNODDD.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOTRAXSEXPORNODDD.RU/ss14t/video/videos14.avi.exe
hxxp://POREVOTRAXSEXPORNODDD.RU/ss17v/video/videos17.avi.exe
hxxp://XXXPORNOSEXPORTALSS.RU/ss11l/video/videos11.avi.exe
hxxp://XXXPORNOSEXPORTALSS.RU/ss12o/video/videos12.avi.exe
hxxp://XXXPORNOSEXPORTALSS.RU/ss14t/video/videos14.avi.exe
hxxp://XXXPORNOSEXPORTALSS.RU/ss17v/video/videos17.avi.exe
hxxp://BUSTRERPORNORUSEX.RU/ss11l/video/videos11.avi.exe
hxxp://BUSTRERPORNORUSEX.RU/ss12o/video/videos12.avi.exe
hxxp://BUSTRERPORNORUSEX.RU/ss14t/video/videos14.avi.exe
hxxp://BUSTRERPORNORUSEX.RU/ss17v/video/videos17.avi.exe
hxxp://NOVPORNORUSSKOEPOREVO.RU/ss11l/video/videos11.avi.exe
hxxp://NOVPORNORUSSKOEPOREVO.RU/ss12o/video/videos12.avi.exe
hxxp://NOVPORNORUSSKOEPOREVO.RU/ss14t/video/videos14.avi.exe
hxxp://NOVPORNORUSSKOEPOREVO.RU/ss17v/video/videos17.avi.exe
hxxp://VIKIPORNOSEXHARDCONTROL.RU/ss11l/video/videos11.avi.exe
hxxp://VIKIPORNOSEXHARDCONTROL.RU/ss12o/video/videos12.avi.exe
hxxp://VIKIPORNOSEXHARDCONTROL.RU/ss14t/video/videos14.avi.exe
hxxp://VIKIPORNOSEXHARDCONTROL.RU/ss17v/video/videos17.avi.exe
hxxp://ATHLETICPORNCLUBXXX.RU/ss11l/video/videos11.avi.exe
hxxp://ATHLETICPORNCLUBXXX.RU/ss12o/video/videos12.avi.exe
hxxp://ATHLETICPORNCLUBXXX.RU/ss14t/video/videos14.avi.exe
hxxp://ATHLETICPORNCLUBXXX.RU/ss17v/video/videos17.avi.exe
hxxp://KRUTIEPORNOMNOGOXXXX.RU/ss11l/video/videos11.avi.exe
hxxp://KRUTIEPORNOMNOGOXXXX.RU/ss12o/video/videos12.avi.exe
hxxp://KRUTIEPORNOMNOGOXXXX.RU/ss14t/video/videos14.avi.exe
hxxp://KRUTIEPORNOMNOGOXXXX.RU/ss17v/video/videos17.avi.exe
hxxp://TRAXPORTALXXXPOREVOLIKE.RU/ss11l/video/videos11.avi.exe
hxxp://TRAXPORTALXXXPOREVOLIKE.RU/ss12o/video/videos12.avi.exe
hxxp://TRAXPORTALXXXPOREVOLIKE.RU/ss14t/video/videos14.avi.exe
hxxp://TRAXPORTALXXXPOREVOLIKE.RU/ss17v/video/videos17.avi.exe
hxxp://INEEDNEWPORNOVIDEOXXX.RU/ss11l/video/videos11.avi.exe
hxxp://INEEDNEWPORNOVIDEOXXX.RU/ss12o/video/videos12.avi.exe
hxxp://INEEDNEWPORNOVIDEOXXX.RU/ss14t/video/videos14.avi.exe
hxxp://INEEDNEWPORNOVIDEOXXX.RU/ss17v/video/videos17.avi.exe
hxxp://STARPORNOCLUBXXXRU.RU/ss11l/video/videos11.avi.exe
hxxp://STARPORNOCLUBXXXRU.RU/ss12o/video/videos12.avi.exe
hxxp://STARPORNOCLUBXXXRU.RU/ss14t/video/videos14.avi.exe
hxxp://STARPORNOCLUBXXXRU.RU/ss17v/video/videos17.avi.exe
hxxp://GALINAVPORNOPERVIYRAZ.RU/ss11l/video/videos11.avi.exe
hxxp://GALINAVPORNOPERVIYRAZ.RU/ss12o/video/videos12.avi.exe
hxxp://GALINAVPORNOPERVIYRAZ.RU/ss14t/video/videos14.avi.exe
hxxp://GALINAVPORNOPERVIYRAZ.RU/ss17v/video/videos17.avi.exe
hxxp://RUSTRAXNEEDPOPKARU.RU/ss11l/video/videos11.avi.exe
hxxp://RUSTRAXNEEDPOPKARU.RU/ss12o/video/videos12.avi.exe
hxxp://RUSTRAXNEEDPOPKARU.RU/ss14t/video/videos14.avi.exe
hxxp://RUSTRAXNEEDPOPKARU.RU/ss17v/video/videos17.avi.exe
hxxp://FAXEPORNOHARDGOOOD.RU/ss11l/video/videos11.avi.exe
hxxp://FAXEPORNOHARDGOOOD.RU/ss12o/video/videos12.avi.exe
hxxp://FAXEPORNOHARDGOOOD.RU/ss14t/video/videos14.avi.exe
hxxp://FAXEPORNOHARDGOOOD.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOXXXVIDEONEEDED.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOXXXVIDEONEEDED.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOXXXVIDEONEEDED.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOXXXVIDEONEEDED.RU/ss17v/video/videos17.avi.exe
hxxp://EXPORNOLIKESEXGOVPERED.RU/ss11l/video/videos11.avi.exe
hxxp://EXPORNOLIKESEXGOVPERED.RU/ss12o/video/videos12.avi.exe
hxxp://EXPORNOLIKESEXGOVPERED.RU/ss14t/video/videos14.avi.exe
hxxp://EXPORNOLIKESEXGOVPERED.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOTRAXSEXILIKEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOTRAXSEXILIKEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOTRAXSEXILIKEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOTRAXSEXILIKEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://DISCPORNOSEXHISTORYRU.RU/ss11l/video/videos11.avi.exe
hxxp://DISCPORNOSEXHISTORYRU.RU/ss12o/video/videos12.avi.exe
hxxp://DISCPORNOSEXHISTORYRU.RU/ss14t/video/videos14.avi.exe
hxxp://DISCPORNOSEXHISTORYRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOPORTALCONNECTSEX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOPORTALCONNECTSEX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOPORTALCONNECTSEX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOPORTALCONNECTSEX.RU/ss17v/video/videos17.avi.exe
hxxp://XXXSEXPOREVONEEDRU.RU/ss11l/video/videos11.avi.exe
hxxp://XXXSEXPOREVONEEDRU.RU/ss12o/video/videos12.avi.exe
hxxp://XXXSEXPOREVONEEDRU.RU/ss14t/video/videos14.avi.exe
hxxp://XXXSEXPOREVONEEDRU.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: Xylitol on September 11, 2011, 07:30:17 pm: Quote
hxxp://makemepornosexxx.ru/ss12o/video/videos12.avi.exe
hxxp://makemepornosexxx.ru/ss17v/video/videos17.avi.exe
hxxp://makemepornosexxx.ru/ss11l/video/videos11.avi.exe
hxxp://makemepornosexxx.ru/ss14t/video/videos14.avi.exe
hxxp://powerpornofilmxxx.ru/ss12o/video/videos12.avi.exe
hxxp://powerpornofilmxxx.ru/ss17v/video/videos17.avi.exe
hxxp://powerpornofilmxxx.ru/ss11l/video/videos11.avi.exe
hxxp://powerpornofilmxxx.ru/ss14t/video/videos14.avi.exe
grabbed with my TDS bot.

Edit: the tds look's down, here are the new domain:
Quote
hxxp://SMOTRIPOWERPOREVOTRAX.RU/ss12o/video/videos12.avi.exe
hxxp://SMOTRIPOWERPOREVOTRAX.RU/ss17v/video/videos17.avi.exe
hxxp://SMOTRIPOWERPOREVOTRAX.RU/ss11l/video/videos11.avi.exe
hxxp://SMOTRIPOWERPOREVOTRAX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss14t/video/videos14.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 12, 2011, 07:51:48 am: Pornorolik allocated domains 12 - 13 Sept (except already posted by Xylitol)

Quote
hxxp://PORNOPOWERHARDSEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOPOWERHARDSEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOMIXXXSEXRU.RU/ss14t/video/videos14.avi.exe
hxxp://MAKEMEPORNOSEXXX.RU/ss12o/video/videos12.avi.exe
hxxp://MAKEMEPORNOSEXXX.RU/ss17v/video/videos17.avi.exe
hxxp://MAKEMEPORNOSEXXX.RU/ss11l/video/videos11.avi.exe
hxxp://MAKEMEPORNOSEXXX.RU/ss14t/video/videos14.avi.exe
hxxp://INNADAVALKAPORNOSEX.RU/ss12o/video/videos12.avi.exe
hxxp://INNADAVALKAPORNOSEX.RU/ss17v/video/videos17.avi.exe
hxxp://INNADAVALKAPORNOSEX.RU/ss11l/video/videos11.avi.exe
hxxp://INNADAVALKAPORNOSEX.RU/ss14t/video/videos14.avi.exe
hxxp://XXXMIXPORNOSEXMIX.RU/ss12o/video/videos12.avi.exe
hxxp://XXXMIXPORNOSEXMIX.RU/ss17v/video/videos17.avi.exe
hxxp://XXXMIXPORNOSEXMIX.RU/ss11l/video/videos11.avi.exe
hxxp://XXXMIXPORNOSEXMIX.RU/ss14t/video/videos14.avi.exe
hxxp://ARCHIVEPOWERPORNORU.RU/ss12o/video/videos12.avi.exe
hxxp://ARCHIVEPOWERPORNORU.RU/ss17v/video/videos17.avi.exe
hxxp://ARCHIVEPOWERPORNORU.RU/ss11l/video/videos11.avi.exe
hxxp://ARCHIVEPOWERPORNORU.RU/ss14t/video/videos14.avi.exe
hxxp://STARSPORNOXXXXPOREVOMIX.RU/ss12o/video/videos12.avi.exe
hxxp://STARSPORNOXXXXPOREVOMIX.RU/ss17v/video/videos17.avi.exe
hxxp://STARSPORNOXXXXPOREVOMIX.RU/ss11l/video/videos11.avi.exe
hxxp://STARSPORNOXXXXPOREVOMIX.RU/ss14t/video/videos14.avi.exe
hxxp://SOGOODPORNOXXXSEX.RU/ss12o/video/videos12.avi.exe
hxxp://SOGOODPORNOXXXSEX.RU/ss17v/video/videos17.avi.exe
hxxp://SOGOODPORNOXXXSEX.RU/ss11l/video/videos11.avi.exe
hxxp://SOGOODPORNOXXXSEX.RU/ss14t/video/videos14.avi.exe
Title: Re: Trojan Ransom
Post by: SysAdMini on September 13, 2011, 01:29:52 pm: Trojan.Ransom (Pornoblocker)
http://xylibox.blogspot.com/2011/09/trojanransom-pornoblocker.html

(http://2.bp.blogspot.com/-4xQFpUInFYY/Tm9OZUL3CFI/AAAAAAAACMw/QhCYUjhIwI4/s400/ransom.PNG)

http://www.malwaredomainlist.com/mdl.php?search=2lkjdj.ru&colsearch=All&quantity=50&inactive=on
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 14, 2011, 09:45:55 am: Ransom LockEmAll

Quote
hxxp://hic9wid.ru/c.php?f=486&e=2
hxxp://hic9wid.ru/c.php?f=487&e=2
hxxp://hic9wid.ru/c.php?f=488&e=2

Blackhole exploit kit
Quote
hxxp://hic9wid.ru/main.php?page=8d8d41945c2dbf95

Pornorolik allocated domains 13 - 14 Sept.

Quote
hxxp://SEXTRUEPORVALITSELKU.RU/ss11l/video/videos11.avi.exe
hxxp://SEXTRUEPORVALITSELKU.RU/ss12o/video/videos12.avi.exe
hxxp://SEXTRUEPORVALITSELKU.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOTEAMXXXHARDSEX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOTEAMXXXHARDSEX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOTEAMXXXHARDSEX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOSMOTRIONLINEXXXMIX.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOSMOTRIONLINEXXXMIX.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOSMOTRIONLINEXXXMIX.RU/ss17v/video/videos17.avi.exe
hxxp://PORNOBESPLATNOMIXARCHIVE.RU/ss11l/video/videos11.avi.exe
hxxp://PORNOBESPLATNOMIXARCHIVE.RU/ss12o/video/videos12.avi.exe
hxxp://PORNOBESPLATNOMIXARCHIVE.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOTRAXNAPRIRODETRUE.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOTRAXNAPRIRODETRUE.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOTRAXNAPRIRODETRUE.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOPUFFXXXRUTELKI.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOPUFFXXXRUTELKI.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOPUFFXXXRUTELKI.RU/ss17v/video/videos17.avi.exe
hxxp://XXXTEAMPOREVOTRAXSMOTRY.RU/ss11l/video/videos11.avi.exe
hxxp://XXXTEAMPOREVOTRAXSMOTRY.RU/ss12o/video/videos12.avi.exe
hxxp://XXXTEAMPOREVOTRAXSMOTRY.RU/ss17v/video/videos17.avi.exe
hxxp://POREVOPRUTTELKUVPOPUXXX.RU/ss11l/video/videos11.avi.exe
hxxp://POREVOPRUTTELKUVPOPUXXX.RU/ss12o/video/videos12.avi.exe
hxxp://POREVOPRUTTELKUVPOPUXXX.RU/ss17v/video/videos17.avi.exe
hxxp://TRUEPORNOXXXRUCLUB.RU/ss11l/video/videos11.avi.exe
hxxp://TRUEPORNOXXXRUCLUB.RU/ss12o/video/videos12.avi.exe
hxxp://TRUEPORNOXXXRUCLUB.RU/ss17v/video/videos17.avi.exe
hxxp://TEAMPORNOXXXVIDEO.RU/ss11l/video/videos11.avi.exe
hxxp://TEAMPORNOXXXVIDEO.RU/ss12o/video/videos12.avi.exe
hxxp://TEAMPORNOXXXVIDEO.RU/ss17v/video/videos17.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 15, 2011, 11:44:06 am: Ransom LockEmAll

Quote
hxxp://iqjrqal.ru/mix/x_porn.exe

Redirects to LockEmAll

Quote
hxxp://pornoxmx-onlinee2d.ru
hxxp://pornoxmx-onlinee2d.ru/video.htm
hxxp://pornoxcx-onlina2h.ru/in.cgi?2
hxxp://pornoxcx-onlina2h.ru/in.cgi?2

There is also presumable Blackhole
Quote
hxxp://hukqqtd.ru/index.php?pagex=6f9c8e17194b9c3f
but it offline for us here.
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 16, 2011, 08:10:33 am: Ransom LockEmAll

Quote
hxxp://porkaxxx-onlina1c.ru/fre/x_porn.exe

LockEmAll redirectors

Quote
hxxp://pornoxcx-onlina2h.ru/in.cgi?10

Blackhole exploit kit

Quote
hxxp://xpjvid1.ru/indexx.php?pagexx=92950f572699fe11

Payload (Ransom LockEmAll)

Quote
hxxp://xpjvid1.ru/a.php?f=496&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 17, 2011, 08:33:42 am: Ransom LockEmAll

Quote
hxxp://porkaxxx-freex5f.ru/55/x_porn.exe

Redirects to Ransom LockEmAll

Quote
hxxp://porkaxmx-freex1c.ru/
hxxp://porkaxmx-freex1c.ru/video.htm
hxxp://porkaxmx-conline3b.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: mc0blck on September 17, 2011, 09:15:26 am: Quote

hxxp://tizerset.net/go.php?clk=aWQ9MTAyNDEmdGlkPTIyODYyNCZwYz1KMXhVcnVDeWlaJnQ9MiZ1aWQ9OTAwNTY3Nzg4JmJudW09YVY5NTRwZ1o0U05ibUg1Qk5TdjQmYmlkPTEzNTYyJm1jPTZmYWU2MmFiZmYxMTY3MWQ0OWEwMGVkY2VjMzhkYTkyJnBvcz0xJnNlc3M9Yjg5NWIwODQ3YTk0Y2RkY2VhNGUyYzNkOWNiYWVjYzYmdGlmPTEmcmVmMT0mdGI9 (78.46.34.78) -> hxxp://porkaxmx-freex1c.ru/ (91.220.0.6) -> hxxp://porkaxmx-freex1c.ru/video.htm (91.220.0.6) -> hxxp://porkaxmx-conline3b.ru/in.cgi?2 (91.220.0.6) -> hxxp://porkaxxx-onlina3f.ru/vip/ (91.220.0.70) -> hxxp://porkaxxx-onlina3f.ru/vip/x_porn.exe (91.220.0.70)
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 17, 2011, 02:59:55 pm: Ransom LockEmAll

Quote
hxxp://pornoxxx-freex2f.ru/vse/x_porn.exe
hxxp://iwcporn2.ru/q.php?f=502&e=2
hxxp://iwcporn2.ru/q.php?f=503&e=2
hxxp://iwcporn2.ru/q.php?f=504&e=2

Blackhole exploit kit

Quote
hxxp://iwcporn2.ru/indexx.php?pagexx=95a0fe7085b1f7de
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 22, 2011, 04:30:10 am: Ransom LockEmAll, all access can be very slow, they moved to new IP 141.136.17.37

Quote
hxxp://pornoxmx-onlina5c.ru/555/xxx_porno.exe

redirects to LockEmAll
Quote
hxxp://vidosxxx-conline1a.ru/video.htm
hxxp://vykyrth.ru/go.php?sid=1

Link to Blackhole is currently absent.
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 22, 2011, 02:10:59 pm: Ransom LockEmAll

Quote
hxxp://videoxxx-conline2b.ru/ew/xxx_porno.exe
hxxp://4.dqv4fzs.ru/i.php?f=525&e=2
hxxp://4.dqv4fzs.ru/i.php?f=526&e=2
hxxp://4.dqv4fzs.ru/i.php?f=527&e=2
hxxp://4.dqv4fzs.ru/i.php?f=528&e=2

Blackhole exploit kit

Quote
hxxp://4.dqv4fzs.ru/indexx.php?pagexx=06962e5fd8bd25c7
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 23, 2011, 12:37:25 am: Ransom LockEmAll

Quote
hxxp://vidosxnx-freex4e.ru/101/xxx_porno.exe
hxxp://3.xwxefed.ru/z.php?f=529&e=2
hxxp://3.xwxefed.ru/z.php?f=530&e=2
hxxp://3.xwxefed.ru/z.php?f=531&e=2

redirects to ransom LockEmAll

Quote
hxxp://porkaxmx-conline3b.ru/in.cgi?2
hxxp://porkaxmx-conline3b.ru/in.cgi?3

Blackhole exploit kit
Quote
hxxp://3.xwxefed.ru/indexx.php?pagexx=5591fdb1d59be4c6
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 23, 2011, 09:16:49 am: Ransom LockEmAll

Quote
hxxp://porkaxcx-freex5a.ru/52/xxx_porno.exe
hxxp://3.ghmtgmg.ru/z.php?f=529&e=2
hxxp://3.ghmtgmg.ru/z.php?f=530&e=2
hxxp://3.ghmtgmg.ru/z.php?f=531&e=2
hxxp://1.ly20dzf.ru/z.php?f=529&e=2
hxxp://1.ly20dzf.ru/z.php?f=530&e=2
hxxp://1.ly20dzf.ru/z.php?f=531&e=2
hxxp://1.ly20dzf.ru/z.php?f=532&e=2

Blackhole exploit kit
Quote
hxxp://3.ghmtgmg.ru/indexx.php?pagexx=a90c0f15b3ae3dbb
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 24, 2011, 04:17:13 am: Ransom LockEmAll

Quote
hxxp://videoxcx-onlinee4c.ru/75/xxx_porno.exe
hxxp://3.ejzettk.ru/q.php?f=534&e=2
hxxp://3.ejzettk.ru/q.php?f=535&e=2
hxxp://3.ejzettk.ru/q.php?f=536&e=2
hxxp://3.ejzettk.ru/q.php?f=537&e=2

Blackhole exploit kit

Quote
hxxp://3.ejzettk.ru/indexx.php?pagexx=f8d5cdfb24651f75
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 24, 2011, 11:49:50 am: Ransom LockEmAll

Quote
hxxp://vidosxcx-onlina5a.ru/tt/xxx_porno.exe
hxxp://2.qij4obd.ru/q.php?f=536&e=2
hxxp://2.qij4obd.ru/q.php?f=535&e=2
hxxp://2.qij4obd.ru/q.php?f=534&e=2
hxxp://2.qij4obd.ru/q.php?f=533&e=2

Blackhole exploit kit

Quote
hxxp://2.qij4obd.ru/indexx.php?pagexx=567448528224bcb6
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 25, 2011, 02:17:27 am: Ransom LockEmAll

Quote
hxxp://xjn1aqz.ru/50/xxx_porno.exe
hxxp://1.qszuteh.ru/k.php?f=542&e=2
hxxp://1.qszuteh.ru/k.php?f=543&e=2

Blackhole exploit kit

Quote
hxxp://1.qszuteh.ru/indexx.php?pagexx=cc05e45b8f773c6a
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 25, 2011, 10:28:14 am: Ransom LockEmAll

Quote
hxxp://porkaxmx-onlinee2g.ru/102/xxx_porno.exe
hxxp://1.psleewg.ru/c.php?f=542&e=2
hxxp://1.psleewg.ru/c.php?f=543&e=2
hxxp://1.psleewg.ru/c.php?f=544&e=2

Blackhole exploit kit

Quote
hxxp://1.psleewg.ru/indexx.php?pagexx=6eb4bab964d86b76
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 25, 2011, 09:51:01 pm: Ransom LockEmAll

Quote
hxxp://porkaxnx-conline2g.ru/50/xxx_porno.exe
hxxp://2.pdvyuvh.ru/n.php?f=542&e=2
hxxp://2.pdvyuvh.ru/n.php?f=543&e=2
hxxp://2.pdvyuvh.ru/n.php?f=544&e=2

Blackhole exploit kit

Quote
hxxp://2.pdvyuvh.ru/indexx.php?pagexx=8a834864d528bb50
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 28, 2011, 09:44:11 am: Ransom LockEmAll

Quote
hxxp://porkaxnx-onlina1e.ru/ddd/xxx_porno.exe
hxxp://2.lsv6dud.ru/t.php?f=555&e=2
hxxp://2.lsv6dud.ru/t.php?f=556&e=2

redirects to ransom LockEmAll

Quote
hxxp://pornoxmx-onlinee1d.ru/

Blackhole exploit kit

Quote
hxxp://2.lsv6dud.ru/indexx.php?pagexx=a8ab07880fc4e2f8
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 28, 2011, 01:38:59 pm: Ransom LockEmAll

Quote
hxxp://pornoxnx-onlinee5a.ru/x/xxx_porno.exe
hxxp://3.cam2and.ru/j.php?f=556&e=2
hxxp://3.cam2and.ru/j.php?f=557&e=2
hxxp://3.cam2and.ru/j.php?f=558&e=2
hxxp://3.cam2and.ru/j.php?f=559&e=2

redirects to ransom LockEmAll

Quote
hxxp://porkaxnx-onlinee4h.ru/
hxxp://porkaxnx-onlinee4h.ru/video.htm
hxxp://porkaxnx-freex2b.ru/in.cgi?2

Blackhole exploit kit

Quote
hxxp://3.cam2and.ru/indexx.php?pagexx=8d00307393f7789e
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 29, 2011, 08:31:51 am: Ransom LockEmAll

Quote
hxxp://videoxxx-onlina1c.ru/xm/xxx_porno.exe
hxxp://3.oa2rjzf.ru/i.php?f=560&e=2

Blackhole exploit kit

Quote
hxxp://3.oa2rjzf.ru/indexx.php?pagexx=be56ab7aa957d762
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 29, 2011, 03:00:52 pm: Ransom LockEmAll

Quote
hxxp://porkaxcx-onlinee5f.ru/kn/xxx_porno.exe
hxxp://2.fgliqbf.ru/a.php?f=560&e=2
hxxp://2.fgliqbf.ru/a.php?f=561&e=2
hxxp://2.fgliqbf.ru/a.php?f=562&e=2

redirects to ransom LockEmAll

Quote
hxxp://porkaxnx-freex2b.ru/in.cgi?13

Blackhole exploit kit

Quote
hxxp://2.fgliqbf.ru/indexx.php?pagexx=4c4d900fcfce5d76
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 30, 2011, 10:43:32 am: Ransom LockEmAll

Quote
hxxp://2.lrv9utd.ru/r.php?f=563&e=2
hxxp://2.lrv9utd.ru/r.php?f=564&e=2
hxxp://2.lrv9utd.ru/r.php?f=565&e=2

Blackhole exploit kit

Quote
hxxp://2.lrv9utd.ru/indexx.php?pagexx=0a87892c4059da70
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 30, 2011, 02:47:55 pm: Ransom LockEmAll

Quote
hxxp://vidosxmx-onlinee3g.ru/50/xxx_porno.exe
hxxp://2.eqj0uih.ru/r.php?f=564&e=2
hxxp://2.eqj0uih.ru/r.php?f=565&e=2
hxxp://2.eqj0uih.ru/r.php?f=566&e=2

Blackhole exploit kit

Quote
hxxp://2.eqj0uih.ru/indexx.php?pagexx=90ade8d898f53a4a
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 01, 2011, 12:25:33 pm: Ransom LockEmAll

Quote
hxxp://videoxcx-conline5a.ru/99/xxx_porno.exe
hxxp://1.gubeenl.ru/o.php?f=569&e=2
hxxp://1.gubeenl.ru/o.php?f=570&e=2

Blackhole exploit kit

Quote
hxxp://1.gubeenl.ru/indexx.php?pagexx=3719da91364117ba
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 02, 2011, 07:11:15 am: Ransom LockEmAll

Quote
hxxp://vidosxnx-onlina5e.ru/44/xxx_porno.exe
hxxp://1.mexwued.ru/v.php?f=571&e=2
hxxp://1.mexwued.ru/v.php?f=572&e=2
hxxp://1.mexwued.ru/v.php?f=573&e=2
hxxp://1.mexwued.ru/v.php?f=574&e=2
hxxp://1.mexwued.ru/v.php?f=575&e=2

Blackhole exploit kit

Quote
hxxp://1.mexwued.ru/indexx.php?pagexx=26183795c9b477b9
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 02, 2011, 04:24:32 pm: Ransom LockEmAll

Quote
hxxp://pornoxmx-conline1e.ru/qw/xxx_porno.exe
hxxp://3.btnihis.ru/v.php?f=575&e=2
hxxp://3.btnihis.ru/v.php?f=575&e=4

Blackhole exploit kit

Quote
hxxp://3.btnihis.ru/indexx.php?pagexx=122d81e92d20cb3e
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 04, 2011, 10:09:54 am: Ransom LockEmAll

Quote
hxxp://videoxxx-freex3e.ru/ee/xxx_porno.exe
hxxp://2.cib3qwk.ru/t.php?f=579&e=2
hxxp://2.cib3qwk.ru/t.php?f=580&e=2
hxxp://2.cib3qwk.ru/t.php?f=581&e=2
hxxp://2.cib3qwk.ru/t.php?f=582&e=2

Blackhole exploit kit

Quote
hxxp://2.cib3qwk.ru/indexx.php?pagexx=9120d5a48b455e06
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 05, 2011, 12:44:30 am: Ransom LockEmAll

Quote
hxxp://porkaxnx-onlina3b.ru/500/xxx_porno.exe
hxxp://pornoxxx-onlina3g.ru/101/xxx_porno.exe
hxxp://3.xy29fbf.ru/s.php?f=582&e=2
hxxp://3.xy29fbf.ru/s.php?f=583&e=2
hxxp://3.xy29fbf.ru/s.php?f=584&e=2
hxxp://3.xy29fbf.ru/s.php?f=585&e=2
hxxp://1.bdl7qwj.ru/s.php?f=584&e=2
hxxp://1.bdl7qwj.ru/s.php?f=585&e=2
hxxp://1.bdl7qwj.ru/s.php?f=586&e=2
hxxp://1.bdl7qwj.ru/s.php?f=587&e=2

redirects to Ransom LockEmAll

Quote
hxxp://videoxxx-conline1c.ru/video.htm
hxxp://lol0gcj.ru/in.cgi?2
hxxp://lol0gcj.ru/in.cgi?3

Blackhole exploit kit

Quote
hxxp://3.xy29fbf.ru/indexx.php?pagexx=61f9a55b47c24f50
hxxp://1.bdl7qwj.ru/indexx.php?pagexx=796cacefaf835257
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 06, 2011, 04:40:31 am: Ransom LockEmAll

Quote
hxxp://vidosxnx-onlinee1h.ru/yy/xxx_porno.exe
hxxp://1.ytvtgcg.ru/w.php?f=587&e=2
hxxp://1.ytvtgcg.ru/w.php?f=588&e=2
hxxp://1.ytvtgcg.ru/w.php?f=589&e=2
hxxp://1.fsl5scs.ru/w.php?f=587&e=2
hxxp://1.fsl5scs.ru/w.php?f=588&e=2
hxxp://1.fsl5scs.ru/w.php?f=589&e=2
hxxp://1.fsl5scs.ru/w.php?f=590&e=2

Blackhole exploit kit

Quote
hxxp://1.ytvtgcg.ru/indexx.php?pagexx=e126672cfbd436eb
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 07, 2011, 05:10:55 am: Ransom LockEmAll

Quote
hxxp://vidosxmx-onlina1e.ru/200/xxx_porno.exe
hxxp://1.pfn2jxz.ru/l.php?f=592&e=2

Blackhole exploit kit

Quote
hxxp://1.pfn2jxz.ru/indexx.php?pagexx=64488d05f55315d8
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 07, 2011, 03:11:04 pm: Ransom LockEmAll

Quote
hxxp://2.hjlwtwf.ru/l.php?f=592&e=2
hxxp://2.hjlwtwf.ru/l.php?f=593&e=2
hxxp://2.hjlwtwf.ru/l.php?f=594&e=2
hxxp://2.hjlwtwf.ru/l.php?f=595&e=2
hxxp://2.hjlwtwf.ru/l.php?f=596&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 09, 2011, 10:10:57 pm: Ransom LockEmAll

Quote
hxxp://porkaxmx-onlina1g.ru/46/xxx_porno.exe
hxxp://2.vazqqef.ru/o.php?f=604&e=2
hxxp://2.vazqqef.ru/o.php?f=605&e=2

redirects to Ransom LockEmAll

Quote
hxxp://pornoxmx-onlina1d.ru/video.htm
hxxp://porkaxcx-conline5g.ru/in.cgi?2
hxxp://porkaxcx-conline5g.ru/in.cgi?17

Blackhole exploit kit

Quote
hxxp://2.vazqqef.ru/indexx.php?pagexx=7a1ca68eb45a1f61
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 13, 2011, 03:58:01 pm: Ransom LockEmAll

Quote
hxxp://2.vazqqef.ru/q.php?f=619&e=2
hxxp://2.vazqqef.ru/q.php?f=620&e=2
hxxp://2.vazqqef.ru/q.php?f=621&e=2

Blackhole exploit kit

Quote
hxxp://2.vazqqef.ru/indexx.php?pagexx=d06615c37e7d4585
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 15, 2011, 10:37:04 am: Ransom LockEmAll

Quote
hxxp://2.vazqqef.ru/u.php?f=626&e=2
hxxp://2.vazqqef.ru/u.php?f=627&e=2
hxxp://2.vazqqef.ru/u.php?f=628&e=2
hxxp://2.vazqqef.ru/u.php?f=629&e=2

Blackhole exploit kit

Quote
hxxp://2.vazqqef.ru/indexx.php?pagexx=3a08fe45ba0f6898
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 16, 2011, 01:12:20 pm: Redirects to Ransom LockEmAll

Quote
hxxp://vidosxmx-conline5e.ru/video.htm
hxxp://videoxnx-onlinee3h.ru/in.cgi?2

Ransom LockEmAll

Quote
hxxp://porkaxmx-onlina3g.ru/xxx/xxx_porno.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 19, 2011, 02:15:49 am: Blackhole moved to new IP.

Ransom LockEmAll

Quote
hxxp://1.vp29uud.ru/u.php?f=629&e=2
hxxp://1.vp29uud.ru/u.php?f=630&e=2
hxxp://1.vp29uud.ru/u.php?f=631&e=2
hxxp://1.vp29uud.ru/u.php?f=632&e=2
hxxp://1.vp29uud.ru/c.php?f=634&e=2
hxxp://1.vp29uud.ru/c.php?f=635&e=2
hxxp://1.vp29uud.ru/c.php?f=636&e=2

Blackhole

Quote
hxxp://1.vp29uud.ru/indexx.php?pagexx=44a93b8187e8c4a5
hxxp://1.vp29uud.ru/indexx.php?pagexx=74f86fff9af7b3c0
hxxp://1.vp29uud.ru/indexx.php?pagexx=f51aaa7da9dc583e
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 20, 2011, 11:48:46 am: Ransom LockEmAll

Quote
hxxp://1.ooliqud.ru/l.php?f=637&e=2
hxxp://1.ooliqud.ru/l.php?f=638&e=2
hxxp://1.ooliqud.ru/l.php?f=639&e=2
hxxp://1.ooliqud.ru/l.php?f=640&e=2
hxxp://1.ooliqud.ru/l.php?f=641&e=2
hxxp://porkaxnx-conline2a.ru/45/xxx_porno.exe

Redirects to LockEmAll

Quote
hxxp://pornoxnx-freex2b.ru/video.htm
hxxp://vidosxmx-onlina4a.ru/in.cgi?2

Blackhole

Quote
hxxp://1.ooliqud.ru/indexx.php?pagexx=203575c11bbac58b
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 21, 2011, 11:09:08 am: Ransom LockEmAll

Quote
hxxp://1.iyk3rqh.ru/l.php?f=642&e=2
hxxp://1.iyk3rqh.ru/l.php?f=643&e=2
hxxp://1.iyk3rqh.ru/l.php?f=644&e=2
hxxp://1.iyk3rqh.ru/l.php?f=645&e=2
hxxp://1.iyk3rqh.ru/l.php?f=646&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 23, 2011, 09:37:28 am: Ransom LockEmAll

Quote
hxxp://videoxxx-onlina4a.ru/xxx/xxx_porno.exe
hxxp://1.nwnudbg.ru/a.php?f=647&e=2
hxxp://1.nwnudbg.ru/a.php?f=648&e=2
hxxp://1.nwnudbg.ru/a.php?f=649&e=2

Blackhole

Quote
hxxp://1.nwnudbg.ru/indexz.php?pagexxz=7c69fdf859649e5f

Blackhole admin panel

Quote
hxxp://1.nwnudbg.ru/bhadmin.php

Redirects to LockEmAll

Quote
hxxp://vidosxcx-freex2d.ru/video.htm
hxxp://videoxcx-conline5b.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 26, 2011, 10:54:16 am: Ransom LockEmAll

Quote
hxxp://vidosxcx-onlinee4d.ru/3/xxx_porno.exe
hxxp://ian6dqg.ru/q.php?f=666&e=2
hxxp://ian6dqg.ru/q.php?f=667&e=2
hxxp://ian6dqg.ru/q.php?f=668&e=2

Blackhole

Quote
hxxp://ian6dqg.ru/indexz.php?pagexxz=d85e5c4e6317ffd1

Redirects to LockEmAll

Quote
hxxp://vidosxcx-freex2d.ru/video.htm
hxxp://videoxcx-conline5b.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 26, 2011, 01:24:32 pm: Ransom LockEmAll updated (all 4 with different hash)

Quote
hxxp://ian6dqg.ru/q.php?f=669&e=2
hxxp://ian6dqg.ru/q.php?f=670&e=2
hxxp://ian6dqg.ru/q.php?f=671&e=2
hxxp://ian6dqg.ru/q.php?f=673&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 28, 2011, 01:01:23 pm: Redirects to LockEmAll

Quote
hxxp://iqz9hmh.ru/in.cgi?2

Blackhole

Quote
hxxp://byltrmh.ru/indexz.php?pagexxz=c308e5d752530453

Ransom LockEmAll

Quote
hxxp://porkaxcx-conline2a.ru/xxx/xxx_porno.exe
hxxp://byltrmh.ru/s.php?f=692&e=2
hxxp://byltrmh.ru/s.php?f=693&e=2
hxxp://byltrmh.ru/s.php?f=694&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on October 31, 2011, 11:22:57 am: Ransom LockEmAll

Quote
hxxp://jrk2hzd.ru/i.php?f=723&e=2
hxxp://jrk2hzd.ru/i.php?f=725&e=2
hxxp://jrk2hzd.ru/i.php?f=726&e=2
hxxp://porkaxnx-conline1f.ru/4/xxx_porno.exe

Blackhole

Quote
hxxp://jrk2hzd.ru/indexi.php?pagexxi=c04ccfaeb01c0db6

Redirects to LockEmAll

Quote
hxxp://videoxmx-onlina1f.ru/video.htm
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 02, 2011, 11:37:41 am: Ransom LockEmAll

Quote
hxxp://porkaxmx-freex3f.ru/xx/xxx_porno.exe
hxxp://vjl3dvj.ru/s.php?f=727&e=2
hxxp://vjl3dvj.ru/s.php?f=734&e=2

Blackhole

Quote
hxxp://vjl3dvj.ru/indexi.php?pagexxi=f859f0eac2794569
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 05, 2011, 11:29:47 am: Ransom LockEmAll

Quote
hxxp://cezvid6.ru/o.php?f=753&e=2
hxxp://cezvid6.ru/o.php?f=754&e=2
hxxp://videoxnx-freex4a.ru/5/xxx_porno.exe

Blackhole

Quote
hxxp://kplporn5.ru/indexi.php?pagexxi=8881297bbdfc1915

Redirects to LockEmAll

Quote
hxxp://pornoxcx-onlina3b.ru/video.htm
hxxp://hgjvid8.ru/in.cgi?2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 10, 2011, 09:03:23 am: Ransom LockEmAll

Quote
hxxp://pornoxxx-freex2c.ru/xx/xxx_porno.exe
hxxp://drj7oig.ru/d.php?f=789&e=2
hxxp://drj7oig.ru/d.php?f=790&e=2

Redirects to LockEmAll

Quote
hxxp://pornonob.ru/video.htm
hxxp://freetporn.ru/in.cgi?2

Blackhole

Quote
hxxp://drj7oig.ru/indexi.php?pagexxi=2499ccb7b7d34787
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 11, 2011, 01:44:33 pm: Ransom LockEmAll

Quote
hxxp://wrkvid3.ru/y.php?f=794&e=2
hxxp://wrkvid3.ru/y.php?f=795&e=2
hxxp://wrkvid3.ru/y.php?f=796&e=2
hxxp://wrkvid3.ru/y.php?f=802&e=2
hxxp://wrkvid3.ru/y.php?f=803&e=2
hxxp://videoxcx-conline2f.ru/x/xxx_porno.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 23, 2011, 02:07:22 pm: Ransom LockEmAll

Quote
hxxp://aacporn2.ru/d.php?f=877&e=2
hxxp://aacporn2.ru/d.php?f=878&e=2
hxxp://aacporn2.ru/d.php?f=879&e=2
hxxp://aacporn2.ru/d.php?f=880&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 24, 2011, 02:34:16 pm: Ransom LockEmAll

Quote
hxxp://zqjporn7.ru/s.php?f=884&e=2
hxxp://zqjporn7.ru/s.php?f=885&e=2
hxxp://zqjporn7.ru/s.php?f=886&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 25, 2011, 02:51:55 pm: Ransom LockEmAll

Quote
hxxp://wdbvideo4.ru/r.php?f=888&e=2
hxxp://wdbvideo4.ru/r.php?f=889&e=2
hxxp://vidosxxx-freex1a.ru/w/xxx_porno.exe

Redirects to LockEmAll

Quote
hxxp://pornoxcx-onlina3b.ru/video.htm
hxxp://hgjvid8.ru/in.cgi?2

Blackhole

Quote
hxxp://fplvid2.ru/indexi.php?pagexxi=1ed5de85ffecc923
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 25, 2011, 04:18:09 pm: Ransom LockEmAll

Quote
hxxp://wdbvideo4.ru/r.php?f=890&e=2
hxxp://wdbvideo4.ru/r.php?f=891&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 29, 2011, 09:51:37 am: Ransom LockEmAll

Quote
hxxp://cpxvideo3.ru/h.php?f=909&e=2
hxxp://cpxvideo3.ru/h.php?f=910&e=2
hxxp://cpxvideo3.ru/h.php?f=911&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 29, 2011, 05:32:22 pm: Blackhole

Quote
hxxp://bqlvid7.ru/indexi.php?pagexxi=6a991a2c4330e7ce

Redirects to LockEmAll

Quote
hxxp://vocporn6.ru/in.cgi?2

Ransom LockEmAll

Quote
hxxp://pornoxcx-freex4c.ru/w/xxx_porno.exe
hxxp://bqlvid7.ru/q.php?f=911&e=2
hxxp://bqlvid7.ru/q.php?f=912&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 30, 2011, 02:21:10 pm: Ransom LockEmAll

Quote
hxxp://ajmvideo4.ru/d.php?f=916&e=2
hxxp://ajmvideo4.ru/d.php?f=917&e=2
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 30, 2011, 05:41:38 pm: Redirects to LockEmAll

Quote
hxxp://porkaxmx-onlinee5b.ru/video.htm
hxxp://nd2video5.ru/in.cgi?2

Ransom LockEmAll

Quote
hxxp://porkaxnx-freex3e.ru/z/xxx_porno.exe
hxxp://panporn3.ru/v.php?f=917&e=2
hxxp://panporn3.ru/v.php?f=918&e=2
hxxp://panporn3.ru/v.php?f=919&e=2

Blackhole

Quote
hxxp://panporn3.ru/indexi.php?pagexxi=41459e627de6ae0d
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 02, 2011, 12:30:52 pm: Ransom LockEmAll

Quote
hxxp://vidosxnx-onlina2b.ru/s/xxx_porno.exe

Blackhole

Quote
hxxp://bexvid6.ru/indexi.php?pagexxi=cef5f37339f18467
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 07, 2011, 11:28:22 am: Ransom LockEmAll

Quote
hxxp://porkaxcx-onlina2c.ru/z/xxx_porno.exe

Redirects to LockEmAll

Quote
hxxp://videoxcx-onlina5g.ru/video.htm
hxxp://vocporn6.ru/in.cgi?2

Blackhole

Quote
hxxp://nu5vid3.ru/indexi.php?pagexxi=4f49f07a205c9d04
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 13, 2011, 02:46:45 pm: Ransom LockEmAll

Quote
hxxp://videoxxx-onlinee5g.ru/q/xxx_porno.exe

Redirects to LockEmAll

Quote
hxxp://hijvid6.ru/in.cgi?2

Blackhole

Quote
hxxp://boxvideo5.ru/indexi.php?pagexxi=0a1ab707a2cb18d0
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 15, 2011, 03:17:40 pm: Redirects to LockEmAll

Quote
hxxp://videoxxx-onlina3f.ru/video.htm
hxxp://wglporn1.ru/in.cgi?2

Ransom LockEmAll

Quote
hxxp://vidosxmx-freex5b.ru/f/xxx_porno.exe

Blackhole

Quote
hxxp://eakvideo6.ru/indexi.php?pagexxi=421487449e1cdb0b
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 16, 2011, 01:25:18 pm: Ransom LockEmAll

Quote
hxxp://videoxmx-onlina3e.ru/x/xxx_porno.exe

Blackhole

Quote
hxxp://qgcporn3.ru/indexi.php?pagexxi=8615b07a25fdcb74
Title: Re: Trojan Ransom
Post by: Xylitol on December 18, 2011, 08:39:40 pm: FakePoliceAlert C&C
Quote
hxxp://nmlietkbyuzd.com/gate.php?cmd=ping&botnet=fr4&userid=ei14b69hk8j2x4n7&os=V2luZG93cyBYUA=

Come from this winlock:
Quote
hxxp://git7868777777777.nl.ai/files/19
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 24, 2011, 02:38:42 pm: Ransom WindowsSecurity replacement of LockEmAll

(http://img412.imageshack.us/img412/3522/31311957.th.png) (http://imageshack.us/photo/my-images/412/31311957.png/)

Quote
hxxp://vuvvideo4.ru/files/1081
hxxp://vuvvideo4.ru/files/1082
hxxp://vuvvideo4.ru/files/1083
hxxp://vuvvideo4.ru/files/1087
hxxp://vuvvideo4.ru/files/1088
hxxp://vuvvideo4.ru/files/1089
hxxp://vuvvideo4.ru/files/1090
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 28, 2011, 11:25:03 am: Ransom WindowsSecurity

Quote
hxxp://vuvvideo4.ru/files/1113
hxxp://vuvvideo4.ru/files/1114
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 04, 2012, 09:12:48 am: Ransom WindowsSecurity

Quote
hxxp://videoxnx-onlina5b.ru/z/xxx_porno.exe
hxxp://ag6bhh.ru/files/1124

Redirects to Ransom WindowsSecurity

Quote
hxxp://ps42j1.ru/in.cgi?2
hxxp://ps42j1.ru/in.cgi?4
hxxp://porkaxcx-onlinee4c.ru/
hxxp://porkaxcx-onlinee4c.ru/video.htm

Blackhole

Quote
hxxp://ag6bhh.ru/indexi.php?pagexxi=a2fa65246d362318
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 05, 2012, 07:37:00 am: Ransom WindowsSecurity

Quote
hxxp://ag6bhh.ru/files/1128
hxxp://ag6bhh.ru/files/1129
hxxp://ag6bhh.ru/files/1130
hxxp://ag6bhh.ru/files/1131
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 06, 2012, 05:35:49 pm: Ransom WindowsSecurity

Quote
hxxp://ag6bhh.ru/files/1142
hxxp://ag6bhh.ru/files/1143
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 07, 2012, 04:52:24 am: Ransom WindowsSecurity

Quote
hxxp://rh0c43.ru/files/1146
hxxp://rh0c43.ru/files/1147
hxxp://rh0c43.ru/files/1148
hxxp://rh0c43.ru/files/1149
hxxp://rh0c43.ru/files/1150
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 14, 2012, 02:31:45 pm: Ransom WindowsSecurity

Quote
hxxp://if5mfn.ru/files/1171
hxxp://if5mfn.ru/files/1172
hxxp://if5mfn.ru/files/1173
hxxp://vidosxcx-onlina1b.ru/q/xxx_porno.exe

Redirects to WindowsSecurity

Quote
hxxp://qf2mha.ru/in.cgi?4
hxxp://qf2mha.ru/in.cgi?2

BlackHole EK

Quote
hxxp://yk8nh3.ru/indexi.php?pagexxi=c128c3dbf24d4eba
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 15, 2012, 03:11:48 pm: Ransom WindowsSecurity

Quote
hxxp://if5mfn.ru/files/1175
hxxp://if5mfn.ru/files/1176
hxxp://if5mfn.ru/files/1177
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 17, 2012, 09:54:42 am: Ransom WindowsSecurity

Quote
hxxp://if5mfn.ru/files/1184
hxxp://if5mfn.ru/files/1185
hxxp://if5mfn.ru/files/1186
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 20, 2012, 02:15:58 pm: Ransom WindowsSecurity

Quote
hxxp://if5mfn.ru/files/1198
hxxp://if5mfn.ru/files/1199
hxxp://if5mfn.ru/files/1200
Title: Re: Trojan Ransom
Post by: EP_X0FF on January 21, 2012, 10:52:33 am: Ransom WindowsSecurity

Quote
hxxp://porkaxnx-onlina3a.ru/z/xxx_porno.exe
hxxp://if5mfn.ru/files/1201
hxxp://if5mfn.ru/files/1202
hxxp://if5mfn.ru/files/1203
hxxp://if5mfn.ru/files/1204
hxxp://if5mfn.ru/files/1205
hxxp://os8128.ru/files/1201
hxxp://os8128.ru/files/1202
hxxp://os8128.ru/files/1203
hxxp://os8128.ru/files/1204
hxxp://os8128.ru/files/1205

Redirects to WindowsSecurity

Quote
hxxp://pl224n.ru/in.cgi?2

Blackhole EK

Quote
hxxp://os8128.ru/indexi.php?pagexxi=f87d095d332ed50d
Title: Re: Trojan Ransom
Post by: EP_X0FF on February 25, 2012, 03:50:11 am: Updated ransom WindowsSecurity

Quote
hxxp://videoxcx-onlinee4d.ru/z/xxx_porno.exe
hxxp://ez7v48.ru/c.php?f=3e6e1&e=5

Redirects to WindowsSecurity

Quote
hxxp://wg5xv.ru/in.cgi?2
hxxp://wg5xv.ru/in.cgi?4

BH EK

Quote
hxxp://ez7v48.ru/indexi.php?pagexxi=109967381b789a78
Title: Re: Trojan Ransom
Post by: EP_X0FF on March 05, 2012, 11:43:45 am: Redirects to ransom WindowsSecurity

Quote
hxxp://teaserxxx.ru/go.php?sid=1

Ransom WindowsSecurity

Quote
hxxp://pornoxmx-onlina4g.ru/a/xxx_porno.exe
hxxp://wk4z43.ru/c.php?f=20b41&e=1

BH EK

Quote
hxxp://wk4z43.ru/indexi.php?pagexxi=25c0c20c36e652d0
Title: Re: Trojan Ransom
Post by: Xylitol on March 06, 2012, 01:15:30 pm: (http://img822.imageshack.us/img822/2435/gema.th.png) (http://imageshack.us/photo/my-images/822/gema.png/)
GEMA winlock
Quote
hxxp://manualad.in/6.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on March 22, 2012, 10:26:06 am: Redirects to Ransom WindowsSecurity

Quote
hxxp://npornokq.ru/video.htm
hxxp://vtds5.ru/in.cgi?2

Ransom WindowsSecurity

Quote
hxxp://pornoxxx-conline5b.ru/a/xxx_porno.exe
hxxp://rl4328.ru/c.php?f=65c76

BH EK

Quote
hxxp://rl4328.ru/indexi.php?pagexxi=b69b091ad032a484
Title: Re: Trojan Ransom
Post by: SysAdMini on March 22, 2012, 10:49:30 am: Quote from: EP_X0FF on March 22, 2012, 10:26:06 am

Quote
hxxp://npornokq.ru/video.htm
hxxp://vtds5.ru/in.cgi?2

Quote
hxxp://pornoxxx-conline5b.ru/a/xxx_porno.exe

Don't respond. Are hosts down are or does it work for specific regions only ?
Title: Re: Trojan Ransom
Post by: EP_X0FF on March 22, 2012, 11:28:33 am: Hmm, re-checked, yes they don't respond for me too. And ransom binary is damaged - "Not valid win32 application".
Will look if I can get any other locations.
Title: Re: Trojan Ransom
Post by: EP_X0FF on March 22, 2012, 12:02:23 pm: Should be up and running.

Redirectors

Quote
hxxp://teaserxxx.ru/go.php?sid=1
hxxp://wg5xv.ru/in.cgi?4
hxxp://wg5xv.ru/in.cgi?2

Additionally

Quote
hxxp://teaserxxx.ru/go.php?sid=2
redirects to site with Java SMS trojan

Quote
hxxp://update3212.ru/d.php?a=y284q214z4z2x4u2w4t2t2r2y3q2x4b4x223b41364x2d4v2&nb

https://www.virustotal.com/file/2a200a51f1860014ba8a9f5386e3dea1fef375cc96fc586f6aa48c0b4b345822/analysis/1332417873/
Title: Re: Trojan Ransom
Post by: SysAdMini on March 22, 2012, 12:43:46 pm: Quote from: EP_X0FF on March 22, 2012, 12:02:23 pm
Should be up and running.

Redirectors

Quote
hxxp://teaserxxx.ru/go.php?sid=1
hxxp://wg5xv.ru/in.cgi?4
hxxp://wg5xv.ru/in.cgi?2

Additionally

Quote
hxxp://teaserxxx.ru/go.php?sid=2

Hmm. Don't redirect (http code 200 only) or don't redirect to malware.
Title: Re: Trojan Ransom
Post by: EP_X0FF on March 31, 2012, 12:15:54 pm: BH EK

Quote
hxxp://ac0c28.ru/indexi.php?pagexxi=1e3ec5b370028657

http://wepawet.iseclab.org/view.php?hash=2394fac9db3e644c2e1c4ec4f136676d&t=1333195951&type=js

Ransom WindowsSecurity

Quote
hxxp://videoxxx-onlinee1h.ru/a/xxx_porno.exe
hxxp://ac0c28.ru/data/ap2.php?f=fd54a
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 06, 2012, 12:21:11 pm: Ransom WindowsSecurity

Quote
hxxp://aa3bqc.ru/files/f624d

BH EK

Quote
hxxp://aa3bqc.ru/indexi.php?pagexxi=58816068d374b9fb
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 06, 2012, 04:42:29 pm: Ransom WindowsSecurity

Quote
hxxp://aa3bqc.ru/files/08d5e
hxxp://aa3bqc.ru/files/edd61
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 07, 2012, 10:19:34 am: Ransom WindowsSecurity

Quote
hxxp://ipornolw.ru/x/xxx_porno.exe
hxxp://ad9bja.ru/c.php?f=cf0b9&e=5
hxxp://ad9bja.ru/files/5ab4a

5ab4a is fresh

Quote
Content-Length: 65536
Last-Modified: Sat, 07 Apr 2012 09:55:06 GMT

BH EK

Quote
hxxp://ad9bja.ru/indexi.php?pagexxi=7fea5412ae399699
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 10, 2012, 10:19:44 am: Ransom WindowsSecurity

Quote
hxxp://rf3c73.ru/c.php?f=e5334&e=1

BH EK

Quote
hxxp://rf3c73.ru/indexi.php?pagexxi=677684c604189845

http://wepawet.iseclab.org/view.php?hash=72bfceee207052e58402fba58637d1bb&t=1334053049&type=js
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 11, 2012, 06:04:57 am: Ransom WindowsSecurity
Quote
hxxp://ul0cjn.ru/c.php?f=b172c&e=1

BH EK

Quote
hxxp://ul0cjn.ru/indexi.php?pagexxi=d53eca4de41a145a

http://wepawet.iseclab.org/view.php?hash=4713755341d09d9ad22176a121913f40&t=1334124105&type=js
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 12, 2012, 12:59:11 am: BH EK

Quote
hxxp://ul4bfq.ru/indexi.php?pagexxi=2e2ffbf4b3feed3b

http://wepawet.iseclab.org/view.php?hash=ca9782540902a200bd6e7a2c96f869e3&t=1334191911&type=js

Ransom WindowsSecurity

Quote
hxxp://ul4bfq.ru/c.php?f=61b0a&e=1
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 12, 2012, 11:53:41 am: Ransom WindowsSecurity

Quote
hxxp://91.202.244.89/files/a3b9f
hxxp://91.202.244.89/files/51d4d
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 25, 2012, 02:40:57 pm: Redirector

Quote
hxxp://btds0.ru/in.cgi?2

BH EK

Quote
hxxp://tz6xva.ru/index.php?page=17069665fd70fe76

Ransom WindowsSecurity

Quote
hxxp://tz6xva.ru/c.php?f=1a873&e=1
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 30, 2012, 02:36:32 pm: Ransom WindowsSecurity redirect page

Quote
hxxp://apornojw.ru/video.htm

Ransom WindowsSecurity

Quote
hxxp://ebutotuzitube.ru/x/video.scr
hxxp://pf2vq1.ru/c.php?f=e129f

https://www.virustotal.com/file/ae9a5216bffc2f7eb92868715d11df9e7f5a224b96636d5e13678282a175665a/analysis/1335796470/

BH EK

Quote
hxxp://pf2vq1.ru/index.php?page=daf4ce940a1f00e5

Ransom LockScreen

Quote
hxxp://ryactive.com/media/video.avi.exe
Title: Re: Trojan Ransom
Post by: EP_X0FF on May 07, 2012, 01:43:53 pm: Ransom WindowsSecurity

Quote
hxxp://91.202.244.89/files/957f2
hxxp://91.202.244.89/files/a69fa
hxxp://91.202.244.89/files/bdd35
Title: Re: Trojan Ransom
Post by: MysteryFCM on May 07, 2012, 09:35:35 pm: Cheers :)
Title: Re: Trojan Ransom
Post by: EP_X0FF on May 10, 2012, 04:55:06 am: Ransom WindowsSecurity

Quote
hxxp://91.202.244.89/files/920b8
hxxp://91.202.244.89/files/443aa
hxxp://pl122h.ru/c.php?f=fbf92&e=5

Redirector (probably filters non-russian IP)

Quote
hxxp://mtds5.ru/in.cgi?2

BH EK

Quote
hxxp://pl122h.ru/index.php?page=132fe37e97d99a65
Title: Re: Trojan Ransom
Post by: EP_X0FF on May 17, 2012, 01:39:56 am: Ransom WindowsSecurity is now masqueraded as Flash Update.

Quote
hxxp://porkaxcxafreexeh.ru/f/flash_play.exe
hxxp://eh8cja.ru/files/03bc9
hxxp://eh8cja.ru/files/5b260
hxxp://eh8cja.ru/files/be99d

landing page
Quote
hxxp://porkaxcxafreexeh.ru/f/

Redirector

Quote
hxxp://rtds6.ru/in.cgi?2

BH EK

Quote
hxxp://eh8cja.ru/index.php?page=113c7244d24b264f

http://wepawet.iseclab.org/view.php?hash=161510e36933c847f3a2152dd1631683&t=1337218418&type=js
Title: Re: Trojan Ransom
Post by: Xylitol on May 18, 2012, 06:33:47 pm: mbr ransomware
Code: [Select]
hxxp://police-center.in/forum/exe/4.exe
Title: Re: Trojan Ransom
Post by: dlipman on May 18, 2012, 06:45:37 pm: Quote from: Xylitol on May 18, 2012, 06:33:47 pm
mbr ransomware
Code: [Select]
hxxp://police-center.in/forum/exe/4.exe

Drops a file in German which translates to...

Quote
Antivirus v2.2 harddisk repair .. The computer has been infected with Trojan.Agent.ARVP. This computer virus was .. especially for the removal of information from the computer opponents .. geschaffen.Alle information encrypted on your hard drive for Verschlusselungs algorithm AES-256, this is impossible at this time is to decipher. .. Reinstall the operating system deletes all information for .. ever! The specialist forces of our company has succeeded, the weaknesses in the algorithm of the virus .. Trojan.Agent.ARVP identify and to your computer .. a special version of the antivirus HardDisk Repair v2 .2 to invite to your files .. wiederherzustellen.Unser Program is an important parameter HDDKEYbekommen that is needed to heal the disc to your computer and decode decodieren.Um all your disks, you must obtain a LizenzschlusselHardDiskRepair v2.2. you have to .. system www.paysafecard.com www.ukash.com a PIN or codeine to buy the high of 100 EUR, and reach us by e-mail: Send systemantivirus@yandex.rudie following data: 1 .... . PIN-code XXXX XXXX XXXX XXXX www.paysafecard.com www.ukash.com or (100 EUR) 2 Your unique HDDKEY: xxxxxxx .... let decrypt your password, we need 24 hours .. payment. A password will be sent to your e-mail address ... License activation: Your unique HDDKEY systemantivirus@yandex.ru ..: ...........
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 05, 2012, 11:32:58 am: Ransom WindowsSecurity

Quote
hxxp://91.202.244.122/files/2f646
hxxp://91.202.244.122/files/2c753
hxxp://91.202.244.122/files/36cf4
Title: Re: Trojan Ransom
Post by: EP_X0FF on July 10, 2012, 10:43:38 am: Ransom WindowsSecurity

Quote
hxxp://91.202.244.122/files/06d87
hxxp://91.202.244.122/files/0512d
hxxp://91.202.244.122/files/67fcb
Title: Re: Trojan Ransom
Post by: EP_X0FF on August 08, 2012, 12:17:42 pm: Ransom WindowsSecurity (former LockEmAll) moved to new IP 91.202.244.134

Redirector

Quote
hxxp://apumunav.ru/video.htm -> hxxp://og2cjn.ru/in.cgi?5 -> hxxp://x.fdeeeeroiitee.ru/x/

BH EK

Quote
hxxp://x.rk41qq.ru/indexx.php?pagex=aab27326c543cd88

Files

Quote
hxxp://91.202.244.134/files/1f747
hxxp://91.202.244.134/files/dd6b5
hxxp://91.202.244.134/files/6a513
Title: Re: Trojan Ransom
Post by: EP_X0FF on September 15, 2012, 01:33:01 pm: Ransom WindowsSecurity updated their Blackhole (I assume to v2)

BH EK (new format)

Quote
hxxp://wj8nfq.ru:8787/SgLolK?bZoQR=31

http://wepawet.iseclab.org/view.php?hash=d283de6e9f28e0ee27e069169fb29011&t=1347715382&type=js

Redirector (could be IP location aware)

Quote
hxxp://1traffxmd.ru/tds/in.cgi?15

Payload VT
https://www.virustotal.com/file/c8a0bb1589a2d7fc15b25cdcfd566e88148cda20858532fc03b42e59f3229397/analysis/

Nice forum update btw :)
Title: Re: Trojan Ransom
Post by: SysAdMini on September 15, 2012, 06:27:25 pm: Quote from: EP_X0FF on September 15, 2012, 01:33:01 pm
Ransom WindowsSecurity updated their Blackhole (I assume to v2)

BH EK (new format)

Quote
hxxp://wj8nfq.ru:8787/SgLolK?bZoQR=31

It's an exploit kit, but not Blackhole.

Quote from: EP_X0FF on September 15, 2012, 01:33:01 pm
Nice forum update btw :)

Thanks. It has been on my todo list a long time. I wasn't sure if SMF 2.0 is stable and secure enough.
But I noticed that support for version 1.x will end soon, so I had to upgrade. I like the Aqua Theme too.
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 09, 2012, 04:51:59 am: Redirects to Ransom LokoMoTo

Quote
hxxp://adavysalu.ru/ -> hxxp://xx0909093.ru/tds/in.cgi?15 -> hxxp://videoxmx-onlinee4b.ru/a/ -> hxxp://videoxmx-onlinee4b.ru/a/video.scr

https://www.virustotal.com/file/95bc53d14413d646c8adfcb4a9b213ce26431a3e33e50f20bb7a57d5d6359986/analysis/1352436481/

Exploit Kit (Sweet Orange?)

Quote
hxxp://ua2m43.ru:8787/shtgls?ZWtNH=139
Title: Re: Trojan Ransom
Post by: SysAdMini on November 09, 2012, 11:41:19 am: I'm sorry. None of the urls works for me here.

Quote from: EP_X0FF on November 09, 2012, 04:51:59 am
Redirects to Ransom LokoMoTo

Quote
hxxp://adavysalu.ru/ -> hxxp://xx0909093.ru/tds/in.cgi?15 -> hxxp://videoxmx-onlinee4b.ru/a/ -> hxxp://videoxmx-onlinee4b.ru/a/video.scr

https://www.virustotal.com/file/95bc53d14413d646c8adfcb4a9b213ce26431a3e33e50f20bb7a57d5d6359986/analysis/1352436481/

Exploit Kit (Sweet Orange?)

Quote
hxxp://ua2m43.ru:8787/shtgls?ZWtNH=139
Title: Re: Trojan Ransom
Post by: EP_X0FF on November 09, 2012, 02:04:05 pm: Russian IP required for redirector, otherwise nohow.
Title: Re: Trojan Ransom
Post by: EP_X0FF on December 21, 2012, 10:30:44 am: hxxp://pedencyclopaedia.asia/

all downloads lead to Trojan MBRlock
Title: Re: Trojan Ransom
Post by: EP_X0FF on February 11, 2013, 01:06:22 pm: hxxp://capitfoska.ru/

payload located at hxxp://mudoman.ru/codfullhdxavi.exe

use
Code: [Select]
http://capitfoska.ru as referer to access download.

Code: [Select]
GET /codfullhdxavi.exe HTTP/1.1 Host: mudoman.ru Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17 Referer: http://capitfoska.ru/ Accept-Encoding: gzip,deflate,sdch Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4 Accept-Charset: windows-1251,utf-8;q=0.7,*;q=0.3 HTTP/1.1 200 OK Server: nginx/1.2.6 Date: Mon, 11 Feb 2013 13:03:18 GMT Content-Type: application/x-msdos-program Content-Length: 1742695 Connection: keep-alive Last-Modified: Mon, 11 Feb 2013 07:10:04 GMT ETag: "38c0fe3-1a9767-4d56d991feb00" Accept-Ranges: bytes
Title: Re: Trojan Ransom
Post by: EP_X0FF on April 30, 2013, 12:10:50 pm: Code: [Select]
hxxp://df.pizdafyqib.ru/administrator/weather.php?browse=151
Sweet Orange EK, payload trojan ransom.

http://wepawet.iseclab.org/view.php?hash=81bf0f995a58bb166945671fc638681a&t=1367323769&type=js
Title: Re: Trojan Ransom
Post by: EP_X0FF on May 02, 2013, 05:51:32 pm: Sweet Orange EK, serving trojan ransom as payload.
Quote
hxxp://wsd.nuwazy.ru/sites/oplata/codestariff/themes.php?strategy=154

http://wepawet.iseclab.org/view.php?hash=ac261ed869a63d3224d021f64ce04757&t=1367516936&type=js
Title: Re: Trojan Ransom
Post by: EP_X0FF on May 03, 2013, 05:52:05 pm: Sweet Orange EK, payload trojan ransom.
Code: [Select]
hxxp://za.omovigminet.ru/bugs/books/partner/themes.php?strategy=156
http://wepawet.iseclab.org/view.php?hash=59e133adcb8a8d34197cbc4f789e5549&t=1367603453&type=js
Title: Re: Trojan Ransom
Post by: Gnomo on April 04, 2016, 12:39:03 pm: www.moorelegacygroup.com/ZNru8f.exe

Ransom Locky loaded by email malware.

Site owner has been contacted on 3/29/16 no answer yet, link is active.

Regards
Title: Re: Trojan Ransom
Post by: Joukahainen on August 26, 2016, 07:07:49 am: Locky distribution site.

hxxp://www.halloweenparty.go.ro/4GBrdf6 Ransomware

Ditributed by email (word macro downloader)
Title: Re: Trojan Ransom
Post by: dlipman on August 26, 2016, 01:27:36 pm: Joukahainen (http://www.malwaredomainlist.com/forums/index.php?action=profile;u=11371):

Please reference: IMPORTANT: READ BEFORE POSTING (http://www.malwaredomainlist.com/forums/index.php?topic=2888.0)
Title: Re: Trojan Ransom
Post by: Joukahainen on August 27, 2016, 07:54:06 pm: Another mail based ransomware distribution.

http://www.saumi.jazztel.es/jkGYYU03gd Ransomware