daily something......

[EP_X0FF]

Payloads of BH EK 91.201.4.114

FakeAV

hxxp://91.201.4.114/files/0aecb
hxxp://91.201.4.114/files/01438
hxxp://91.201.4.114/files/c3f92

ZeroAccess

hxxp://91.201.4.114/files/bbea0

[sursmurf]

FakeAV

VT [7/42]
https://www.virustotal.com/file/7f06cdf4659fce4d61702627326e4ea5431692c5982bf7408886bcf7d26d25c1/analysis/1336734836/

MD5:033af6a5044f50ea5878c4e9fbe8a4a5

Code: [Select]

hXXp://crashesscanningagent.info/68efd410a6a48b3c/2/download/
hXXp://taskscleanerinspection.info/68efd410a6a48b3c/2/setup.zip

[Xylitol]

Code: [Select]

ZeuS config hxxp://police-center.in/forum/config.bin
Citadel C&C http://stopwell.org/cp.php?m=login

[Xylitol]

Pony c&c

hxxp://sam-latrilogie.com:8080/pony/admin.php
hxxp://194.146.227.48:8080/pony/admin.php
hxxp://etsiunjour.fr:81/pony/admin.php

[kurzpc]

Code: [Select]

hxxp://www.thecoverversions.com/stats/bar/img/3.exe

[boston]

xttp://erfendirnand.net/adobe/update_flash_player.exe
xttp://corondorstrike.net/adobe/update_flash_player.exe
https://www.virustotal.com/file/dd8cc45e5a3b5689544a9af984576f51530c6a3019b2dc13199278ef7bccb613/analysis/1350659782/

[boston]

xttp://goatonhorseandcow.com/adobe/update_flash_player.exe
https://www.virustotal.com/file/d7644e5684d0c1e89f51b8e2ee17ac334734862b8002475b6472bd999496b9e4/analysis/1350669358/

[boston]

xttp://bigclawberkut.org/adobe/update_flash_player.exe
https://www.virustotal.com/file/03e8e93f821f5115ff93dcd094488af727d99277a2bac03cdbe52c9b2ab3742e/analysis/1350682326/

[boston]

xttp://corandomotorider.com/adobe/update_flash_player.exe
https://www.virustotal.com/file/60f638aeba4232108c2f4fcb4e1916047a4a9ec0f89e28cb88ee7f01382a5c4b/analysis/1350729011/

[Xylitol]

htxp://moneycloud.su/OkdIJdasled/d407b882eeabdba8b8ffd347a4f90329.zip (trojan inside zip file)
https://www.virustotal.com/file/6a9683f64045ac8c95f77544125d8127cb889e69787fdb0c2ee7ffc861c425e5/analysis/

htxp://www.dimmscrackles.net/video.php?id=1686 (mbrlock)
https://www.virustotal.com/file/df5747a6b1452cc4dbe6c5fbb6b30d981c9fdf50277ffdf2a4f2772ddbdf1e73/analysis/1356171785/

[boston]

xttp://mayorista-de-sexshop.com/987.pdf -> xttp://mayorista-de-sexshop.com/62.html
https://www.virustotal.com/file/aa0e1980e5096efc5de5b027d486b4eec5fd648853d375a0a8171a3ea0859c1e/analysis/1356817247/
https://www.virustotal.com/file/6c1b74f7fde5be345315c5122caf8697cdfaa1adbc091626fdb58d717a622908/analysis/1356817397/    

[XiTri]

something wrong
EXE name possible to change randomly

Code: [Select]

hxxp://dlc.fan-trafiks.ru/download2/67/Nys3NCImPWcmIH9jJyQlIml7ejA4Kjo/KHI/OywUTAUMCAEFCAQNRBkZQgkKBC4KHhhKBQMaREhdGBQaQra4sLG3tL%2BysK/s4uDo0eb0rAv5p5Q/mp4_4.exe


[XiTri]

another shit

http://dlc.myheads.ru/download2/0f//+P//Or+5b/++Ke7/+zt6qGzsvjw0sLH0IrHw9TchM3EwMnNwNzVnMHBmtHSzObC1tCCzcui/PDloKyi+v7w//38/P/94ve0uriwib685APurUU/77777.exe

[Xylitol]

ZeuS on TOR

Code: [Select]

hxtp://zxjfcvfvhqfqsrpz.onion/~ifybo/zeu5/r/ifybnow.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~friend/bitedoelikesuarez_tk/cit/files/soft.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~lemore/log-needed-asap_com/222/lemo.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~mekzi/ali-pay_com/1/mekz1.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~mekzi/log-bank_com/2/mekz2.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~mekzi/manuchimso_com/3/mekz3.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~mekzi/mekzi-logs_com/4/mekz4.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~mekzi/oluwa-involved_com/5/mekz5.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~mine/cloudns_org/1/myn1.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~nelson/crome/1/bot.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~new/paper-chasing-4lyf_com/2/new.exe
hxtp://zxjfcvfvhqfqsrpz.onion/~new/lmao/123/new2leo.exeip server is 46.149.111.10

[bobcrusader]

Cryptolocker here: auspost-track24.net