from a downloader list | 0305

[jimmyleo]

hxxp://diyedbank.cn/hb/*.exe

*=1~26

[JohnC]

Thank you, this will be listed soon.

[tjs]

Wow, i was going to post the exact same thing and for some reason I was going to do it by replying to this thread.

btw 22 and 25 are 404s.

[tjs]

from:

a.zuiyige.com/weba.txt

[CONTROL]
VERSION=2008-2-3

[DOWN]
NEWVERSION=

hxxp://11.com/1a.exe

hxxp://67.198.194.26/ha/1.exe
hxxp://67.198.194.26/ha/2.exe
hxxp://67.198.194.26/ha/3.exe
hxxp://67.198.194.26/ha/4.exe
hxxp://67.198.194.26/ha/5.exe
hxxp://67.198.194.26/ha/6.exe
hxxp://67.198.192.26/ha/7.exe
hxxp://67.198.192.26/ha/8.exe
hxxp://67.198.192.26/ha/9.exe
hxxp://67.198.192.26/ha/10.exe
hxxp://67.198.192.26/ha/11.exe
hxxp://67.198.192.26/ha/12.exe
hxxp://67.198.192.26/ha/13.exe
hxxp://67.198.192.26/ha/14.exe
hxxp://67.198.192.26/ha/15.exe
hxxp://67.198.192.26/ha/16.exe

Verified 1-16 as valid malware.. 1a.exe is a 404 at the time of this posting.

thanks,
TJS

[tjs]

from:

hxxp://www.ip540.com/url.txt

hxxp://58.211.8.15/a1.exe
hxxp://58.211.8.15/a2.exe
hxxp://58.211.8.15/a3.exe
hxxp://58.211.8.15/a4.exe
hxxp://58.211.8.15/a5.exe
hxxp://58.211.8.15/a6.exe
hxxp://58.211.8.15/a7.exe
hxxp://58.211.8.15/a8.exe
hxxp://58.211.8.15/a9.exe
hxxp://58.211.8.15/a10.exe
hxxp://58.211.8.15/a11.exe
hxxp://58.211.8.15/a12.exe
hxxp://58.211.8.15/a13.exe
hxxp://58.211.8.15/a14.exe
hxxp://58.211.8.15/a15.exe
hxxp://58.211.8.15/a16.exe
hxxp://58.211.8.15/a17.exe
hxxp://58.211.8.15/a18.exe
hxxp://58.211.8.15/a19.exe
hxxp://58.211.8.15/a20.exe
hxxp://58.211.8.15/a21.exe
hxxp://58.211.8.15/a22.exe
hxxp://58.211.8.15/a23.exe
hxxp://58.211.8.15/a24.exe

Many of these are still valid:

6d60b6d6bf502c5e7c57fd9c855c59ca *a1.exe
c3be0ce69aa678a892b7b228a5e97055 *a14.exe
92a777a144a337c32d074aea4d4341e9 *a16.exe
cdcd7ebbb8b7395f66ba11498fe94b24 *a2.exe
e82dfa9913ef19f6a07539e5cbe33051 *a20.exe
3c2d5e7cc0623e1aa8f247d773d9f7cb *a21.exe
7f5a731244199c7f29623cc1f106b6c4 *a24.exe
6f7ffda4c1fe8533481f654567d85b55 *a3.exe
3a446354534239eabdd349b9c109d508 *a4.exe
20fee6d7eb55881dd30964b7016b6a71 *a5.exe
45c719b307e028d7ed8ca80b0ce41d12 *a6.exe
e5628952fbcca5bd4857fbe29a39284c *a7.exe
09046b6609b9cb571ed51feadef85f84 *a9.exe

Thanks,
TJS

[tjs]

From:

down.malasc.cn/plmm.txt

hxxp://59.34.216.110/m/001.exe
hxxp://59.34.216.110/m/002.exe
hxxp://59.34.216.110/m/003.exe
hxxp://59.34.216.110/m/004.exe
hxxp://59.34.216.110/m/005.exe
hxxp://59.34.216.110/m/006.exe
hxxp://59.34.216.110/m/007.exe
hxxp://59.34.216.110/m/008.exe
hxxp://59.34.216.110/m/009.exe
hxxp://59.34.216.110/m/10.exe
hxxp://59.34.216.110/m/11.exe
hxxp://59.34.216.110/m/12.exe
hxxp://59.34.216.110/m/13.exe
hxxp://59.34.216.110/m/14.exe
hxxp://59.34.216.110/m/15.exe
hxxp://59.34.216.110/m/16.exe
hxxp://59.34.216.110/m/17.exe
hxxp://59.34.216.110/m/18.exe
hxxp://59.34.216.110/m/19.exe
hxxp://59.34.216.110/m/20.exe
hxxp://59.34.216.110/m/21.exe
hxxp://59.34.216.110/m/22.exe
hxxp://59.34.216.110/m/23.exe
hxxp://59.34.216.110/m/24.exe
hxxp://59.34.216.110/m/25.exe
hxxp://59.34.216.110/f.exe
hxxp://59.34.216.110/k.exe
hxxp://59.34.216.110/a.exe
hxxp://59.34.216.110/d.exe

At the time of posting, 10.exe is the only 404:

22e4779acecadb625455d6717e0ed943 *001.exe
089aa8bec1a18ce59349b9dda5dc8f15 *002.exe
5d322179ad31efa1d3af6d5fb35756b3 *003.exe
d2b7be54740f7b73b3dbe40e64c20fde *004.exe
70fb0ab13290bc9e346d80138ff8d835 *005.exe
b1a4501c14e92a0785413328f3b1527a *006.exe
69a08b7e899ec73f18e4bc2d4268c702 *007.exe
7e1670f45f153b646f44a42161e22121 *008.exe
5d93e8dba1c0156ec4e02b6b05670445 *009.exe
1901f88c807e2b659fe181695d4d4993 *11.exe
a9928f12752b6b8bc2b530ad230af79f *12.exe
c29d34638d50a07a96d0372ad39b6277 *13.exe
e4254fdfd40e61b227879417fd4b008e *14.exe
9f7af331b252767f7c1b97f86ff87d32 *15.exe
6a41f55608f635316a4f7bba8c79ace9 *16.exe
cbaadcf72ebb262ab26ee20c09b313c3 *17.exe
27be13591224ea0dcb942519893006e5 *18.exe
7717e996de4d1444c76b3ab4432027b2 *19.exe
e2e6ddd9e493b568f41d782294e30bee *20.exe
d54d42a933f390c30c8d54b5f9df5d4f *21.exe
1620f2e1bebddbcf933aca9a3592b603 *22.exe
5aeef118736c4d564c84d04cc36d05fa *23.exe
62d64ed6124053a257a8d05df435e9be *24.exe
209ed807e3d19e9d6dff57528b6a624d *25.exe
d4e9314d9659b65805cbe96733a253cd *a.exe
520a45d1c99a715095819cef05f170d3 *d.exe
093121189b5f46574d18d56e5f87f8b7 *f.exe
67b85aa272a7b42de634f79d1f2f406b *k.exe

Thanks,
TJS