daily something......

[sowhat-x]

hxxp://ghthchinalimited.com.cn/admin/controller.php?action=bot&entity_list=
hxxp://turokgame.cn/bm/controller.php?action=bot&entity_list=

hxxp://attmyjoker.com/if/index.php

[CkreM]

Waledac:

Code: [Select]

http://bestjournalguide.com/run.exe
http://urbanfear.com/run.exe
http://globalantiterror.com/run.exe

Redirects to exploits:

Code: [Select]

paintball2.by.ruhttp://wepawet.iseclab.org/view.php?hash=8e522d049a6411492d6ddea2013a3c47&t=1238017604&type=js

Contain iframe of pdf exploit:

Code: [Select]

http://29ka.by.ru/http://wepawet.iseclab.org/view.php?hash=5ba619da85a609ec2942b6e0417a728b&t=1238018761&type=js

the pfd exploit:

Code: [Select]

http://expresstv.co.il/un/pdf.phphttp://wepawet.iseclab.org/view.php?hash=98a40fb7fd2a5a04cb12d788d2c4665c&t=1238018870&type=js

the trojan he download:

Code: [Select]

http://expresstv.co.il/un/load.phphttp://www.virustotal.com/analisis/8f452239eb342ba3decd28a6ff241465

AV fraud:

Code: [Select]

vistastabilitynow.com
vistastabilitynow.net
scanalertspage.com
onlinescanservice.com
getscanonline.com
bestfiresfull.com
fuckmoneycash.com
bestfiresfull.com
yourstabilitysystem.com
popularpcscan.com
mostpopularscan.com
scanvistanow.net


[CM_MWR]

the trojan he download:

What happens if its a transexual piece of malware     

[CkreM]

the trojan he download:

What happens if its a transexual piece of malware     

i will change it to "it" for all the feminists here

[CkreM]

Redirect to exploits:

Code: [Select]

http://baltstroi-spb.by.ruhttp://wepawet.iseclab.org/view.php?hash=d99f501d81c87b6e690fcd9147b6118e&t=1238072608&type=js

redirect to exploits:

Code: [Select]

http://hotjob.by.ruhttp://wepawet.iseclab.org/view.php?hash=dd67f744942bd4dfb62ca592269c85f7&t=1238072560&type=js

exploits and waledac Trojan in the end at:

Code: [Select]

http://dolpassgiven.ru/3/pdf.php
http://dolpassgiven.ru/3/load.php?id=3
http://www.virustotal.com/analisis/88095c3f38020917145ca045f5adbc60
http://anubis.iseclab.org/?action=result&task_id=120a06c16ed33fec4b9fb4b2a80db328e&format=html

[CkreM]

Redirects to exploits:

Code: [Select]

http://vniic.by.ruhttp://wepawet.iseclab.org/view.php?hash=8578df10b9d0f8b53bb43a7b193b68c4&t=1238083841&type=js

exploits/Trojan Waledac:

Code: [Select]

http://dasretokfin.com/include/spl.phphttp://wepawet.iseclab.org/view.php?hash=d8ebd3a3d6bf7c41126a81b490f96294&t=1238084290&type=js

Code: [Select]

http://dasretokfin.com/load.phphttp://www.virustotal.com/analisis/c91540f8abbf3f49e981edb486790a25
---------------------------------------------
Redirects to exploits:

Code: [Select]

http://rootastic.by.ruhttp://wepawet.iseclab.org/view.php?hash=94d6673b07ddb8e91f85b0885415ab56&t=1238083887&type=js

Redirects to exploits:

Code: [Select]

http://gav-posad.by.ruhttp://wepawet.iseclab.org/view.php?hash=a137e822fc9460ba0006c09b97c5483e&t=1238084673&type=js

Redirects to exploits:

Code: [Select]

http://fastfood.by.ruhttp://wepawet.iseclab.org/view.php?hash=0f14d3e37ad232de59cd7b7b686486ae&t=1238085115&type=js

Redirects to exploits:

Code: [Select]

http://nemiroff.by.ruhttp://wepawet.iseclab.org/view.php?hash=5a96bc55863a40a5cbc20e87fda449b7&t=1238087155&type=js

Redirects to exploits:

Code: [Select]

http://kkff.by.ruhttp://wepawet.iseclab.org/view.php?hash=61bf7c4aae87094f6ff6d3b9b419f130&t=1238087090&type=js

Redirects to exploits:

Code: [Select]

http://amirag.by.ruhttp://wepawet.iseclab.org/view.php?hash=67052be5d4655c2ee3aca176fde97b25&t=1238087608&type=js

[SysAdMini]

Redirects to exploits:

Code: [Select]

http://vniic.by.ru

Code: [Select]

http://rootastic.by.ru

Code: [Select]

http://gav-posad.by.ru

Code: [Select]

http://fastfood.by.ru

Code: [Select]

http://nemiroff.by.ru

Code: [Select]

http://kkff.by.ru

Code: [Select]

http://amirag.by.ru

All of them are at the same host :

http://www.malwaredomainlist.com/mdl.php?inactive=&sort=Date&search=87.242.78.57&colsearch=All&ascordesc=DESC&quantity=50&page=0

Whos has time to check more domains from this ip ?

http://www.bfk.de/bfk_dnslogger.html?query=87.242.78.57#result

[CkreM]

Redirects to exploits:

Code: [Select]

http://vniic.by.ru

Code: [Select]

http://rootastic.by.ru

Code: [Select]

http://gav-posad.by.ru

Code: [Select]

http://fastfood.by.ru

Code: [Select]

http://nemiroff.by.ru

Code: [Select]

http://kkff.by.ru

Code: [Select]

http://amirag.by.ru

All of them are at the same host :

http://www.malwaredomainlist.com/mdl.php?inactive=&sort=Date&search=87.242.78.57&colsearch=All&ascordesc=DESC&quantity=50&page=0

Whos has time to check more domains from this ip ?

http://www.bfk.de/bfk_dnslogger.html?query=87.242.78.57#result

thats what ive been doing in the last few days
think i covered like 70%

[XiTri]

Code: [Select]

http://rifnasax.cn/nuc/index.php
http://rifnasax.cn/nuc/spl/pdf.pdf
http://rifnasax.cn/nuc/exe.php
may be offline

Code: [Select]

http://livestats.co.cc/script.js


[SysAdMini]

Code: [Select]

http://krona98.biz/opi/http://wepawet.cs.ucsb.edu/view.php?hash=03236ee924ddc9d03c2f11d176e3775c&t=1238262446&type=js

Code: [Select]

http://krona98.biz/opi/load.php?id=4http://www.virustotal.com/analisis/0f51acface4b59ccc14b48cd92beaaac 1/39
VBA32    3.12.10.1    2009.03.27    Worm.Win32.AutoRun.oik

[XiTri]

Code: [Select]

http://ru98.biz/cgi-bin/wtsin.cgi?id=4
http://krona98.biz/ins/index.php
http://krona98.biz/myy/cache/readme.pdf
http://krona98.biz/myy/cache/flash.swf
http://krona98.biz/myy/load.php?id=4
http://krona98.biz/myy/load.php?id=5


[CkreM]

rogue:

Code: [Select]

http://systemsecuritytool.com
http://system-tuner.net
http://getpcguard.com
http://systemsecurityonline.com
exploits+trojan:

Code: [Select]

http://blufda.com/
http://wepawet.iseclab.org/view.php?hash=9f5b70106e995d5f7a4e842f54cc3c29&t=1238414305&type=js

[CM_MWR]

Code: [Select]

http://216.12.168.138/1/getexe.php?h=11
http://216.12.168.138/1/getfile.php?f=pdf
http://216.12.168.138/1/helper.xml
http://66.90.101.177/ldr/files/part.exe
http://66.90.101.177/ldr/files/minisvr4.exe
http://66.90.101.177/ldr/files/zchMiB.exe
http://basesrv.net/base/install.lib
http://basesrv.net/base/ntdll.exe
http://basesrv.net/bin/in.php
http://basesrv.net/bin/load.php?id=1
http://basesrv.net/bin/load.php?id=6
http://basesrv.net/bin/pdf.php
http://basesrv.net/load/ld.php?v=1&rs=76487-OEM-0083836-249893693295087&n=1&uid=1
http://basesrv.net/load/ld.php?v=1&rs=76487-OEM-0083836-249893693295087&n=1&uid=1&cc=0
http://basesrv.net/load/ld.php?v=1&rs=76487-OEM-0083836-249893693295087&n=1&uid=1&cc=0&cc=0
http://basesrv.net/load/ld.php?v=1&rs=76487-OEM-0083836-249893693295087&n=1&uid=1&cc=0&cc=0&cc=0
http://basesrv.net/update/delcache.exe
http://basesrv.net/update/load.exe
http://basesrv.net/update/loader_del.exe
http://basesrv.net/update/svchost.exe
http://bestfindahome.cn/findmeale.html
http://bestfindahome.cn/home.html
http://bestfindahome.cn/searchn.html
http://bizoplata.ru/monitoring.html
http://bizoplata.ru/onservice.html
http://bizoplata.ru/pay.html
http://nameashop.cn/in.cgi?income13
http://newsantimalware.com/720/load.php
http://nikodomain.info/in/init.php
http://pakras.com/c6p7fnqd/404.php
http://pakras.com/c6p7fnqd/flash.php
http://pakras.com/c6p7fnqd/getexe.php?h=11
http://pakras.com/c6p7fnqd/info.php
http://pakras.com/c6p7fnqd/pdf.exp.php
http://pakras.com/las/3rkour.dat
http://pakras.com/las/mp.dat
http://pakras.com/las/tos.dat
http://rec.bestrevenue.net/get_93.php?p=148
http://rec.bestrevenue.net/get_93.php?p=152
http://rec.bestrevenue.net/get_93.php?p=155
http://rec.bestrevenue.net/get_93.php?p=156
http://rec.bestrevenue.net/get_93.php?p=157
http://rec.bestrevenue.net/get_93.php?p=162
http://reddii.ru/traffic/sploit1/?263bYYYbaYtbt
http://reddii.ru/traffic/sploit1/getexe.php?h=11
http://reddii.ru/traffic/sploit1/getfile.php?f=swf
http://rifnasax.cn/nuc/exe.php
http://rifnasax.cn/nuc/index.php
http://rifnasax.cn/nuc/spl/pdf.pdf
http://sadcwed.hostindianet.com/cache/flash.swf
http://sadcwed.hostindianet.com/cache/readme.pdf
http://sadcwed.hostindianet.com/index.php
http://teleporn.net/fix.exe?id=EB52EAEE-B8A4-45F1-AE06-1918472E1B0D
http://teleporn.net/rep.php?id=EB52EAEE-B8A4-45F1-AE06-1918472E1B0D
http://teleporn.net/stat/cache/flash.swf
http://teleporn.net/stat/cache/readme.pdf
http://teleporn.net/stat/index.php
http://teleporn.net/stat/load.php?id=0
http://teleporn.net/stat/load.php?id=4
http://ultradant.cn/dis9/index.php
http://ultradant.cn/dis9/load.php
http://zzzz.hostindianet.com/load.php?id=0
http://zzzz.hostindianet.com/load.php?id=4

Code: [Select]

http://66.90.101.177/ldr/files/minisvr4.exe
http://66.90.101.177/ldr/files/part.exe
http://66.90.101.177/ldr/files/zchMiB.exe
http://74.55.52.170/p1212/2.0/w.bin?226179
http://92.62.101.118/40E8001430303030303030303030303030303030303031306C0000003766000000007600000642EB0005302663788C
http://92.62.101.118/40E8001430303030303030303030303030303030303031306C0000016666000000007600000642EB0005301D414F5C
http://94.247.2.122/2.gif?nocache=0.3735362
http://94.247.2.122/2.gif?nocache=0.9495566
http://94.247.2.122/2.gif?nocache=1.401764E-02

Code: [Select]

forwrd.h15.ru.e09f1b7882de0743.beencn.cn/china.cn/
forwrd.h15.ru.e09f1b7882de0743.beencn.cn/cp/l/15/02c9be1ab189280058cd0585b0abebc8
forwrd.h15.ru.e09f1b7882de0743.beencn.cn/cp/l/3/275eefe4b40b934bedd87eb81b293bfd
forwrd.h15.ru.e09f1b7882de0743.beencn.cn/cp/r/15/02c9be1ab189280058cd0585b0abebc8
forwrd.h15.ru.e09f1b7882de0743.beencn.cn/cp/r/3/275eefe4b40b934bedd87eb81b293bfd
forwrd.h15.ru.e09f1b7882de0743.beencn.cn/cp/t
forwrd.h15.ru.e09f1b7882de0743.beencn.cn/g/g.php?1
forwrd.h15.ru/
forwrd.h15.ru/g/ch.gif?funnyst8

oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/l/13/85cd1675de836a8cbe767019adf63929
oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/l/15/6e107936d7e25cee0060e938e9b23a2a
oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/l/3/fa49ddccad9bc56cd081c69078d04b8e
oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/r/13/85cd1675de836a8cbe767019adf63929
oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/r/15/6e107936d7e25cee0060e938e9b23a2a
oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/r/3/fa49ddccad9bc56cd081c69078d04b8e
oligarh.territory.ru.b3675abf54988eef.axa3.cn/cp/t
oligarh.territory.ru.b3675abf54988eef.axa3.cn/elanguage.cn/
oligarh.territory.ru.b3675abf54988eef.axa3.cn/g/g.php?1

[CkreM]

exploits/trojan:

Code: [Select]

pro100biz.cn/yes/index.phphttp://wepawet.iseclab.org/view.php?hash=56cb05532164e0c797b9860ec0bd7f9b&t=1238446331&type=js

[GmG]

Code: [Select]

http://steer2.co.uk/im/172.exe
http://steer2.co.uk/im/88.exe
http://steer2.co.uk/im/adv.exe
http://steer2.co.uk/im/avscan.exe
http://steer2.co.uk/im/podmena.exe