mjackson.1ffli.com.mx + ogzhnsltk.com

[MysteryFCM]

Sunbelt tried hiding the URL, but I found it anyway ......

Init:

Code: [Select]

http://mjackson.1ffli.com.mx/x-files/
Payload:

Code: [Select]

http://mjackson.1ffli.com.mx/x-files/x-file-MJacksonsKiller.exe
Exploit:

Code: [Select]

http://ogzhnsltk.com/plugins/index.php
http://ogzhnsltk.com/plugins/getexe.php
http://ogzhnsltk.com/plugins/pdf.php
Ref:
http://sunbeltblog.blogspot.com/2009/06/michael-jackson-spam-loads-zbot-dont-go.html