Thread about Exchanger sites

[bobby]

Code: [Select]

http://agdarbud.pl/index7.php
>http://agdarbud.pl/main34.html
>>http://agdarbud.pl/pindex.php  <<-- fake 404, JavaScript
>>http://agdarbud.pl/wamkl.gif
>>http://agdarbud.pl/porno_new.exe  <<-- payload

http://agdarbud.pl/pindex.php
>http://agdarbud.pl//load.php  <<-- payload

[JohnC]

Thanks.

[bobby]

Code: [Select]

http://hokejforum.sk/index3.php
>>http://hokejforum.sk/arch.exe
>>http://hokejforum.sk//load.php
Same scheme like the previous one. I gave here just the spammed link, and the exe files.

[bobby]

Code: [Select]

http://impresalavoro.it/video.exe
http://impresalavoro.it/video1.exeDoubleclick redirection used in mail, but it is not working if you click it over doubleclick.
If you try the links in the form I gave here (direct) - it will download the files.

[JohnC]

Thanks.

[bobby]

Code: [Select]

http://worldchinesewriters.com/index1.php
>http://worldchinesewriters.com/free_vid.exe
>http://worldchinesewriters.com/load.php

[bobby]

Code: [Select]

http://glamsmile.fr/index1.php
>http://glamsmile.fr/lite_porno.exe
>http://glamsmile.fr/load.php

[JohnC]

Thanks.

[bobby]

Code: [Select]

http://morethir.at/index1.php
>http://morethir.at/new_mpg.exe
>http://morethir.at/load.php

New redirector, old malware site:

Code: [Select]

http://www.dogpile.com/clickserver/_iceUrlFlag=1?rawURL=http://impresalavoro.it/video1.exe&0=&1=0&4=244.732.085.037&5=912.605.906.658&9=3959244732085&1

[bobby]

From here: http://www.malwaredomainlist.com/forums/index.php?topic=1765.msg3517#msg3517

Code: [Select]

http://durantiluminacao.com.br/index.php
>http://durantiluminacao.com.br/shok_video.exe
>http://durantiluminacao.com.br/load.php

Code: [Select]

http://karate-passirano.it/video1.exe
http://karate-passirano.it/video.exe

[JohnC]

Thanks.

[bobby]

Code: [Select]

http://www.dinekeluring.nl/index.php
>http://www.dinekeluring.nl/free_vid.exe
>http://www.dinekeluring.nl/load.php

[JohnC]

Thanks.

[bobby]

Code: [Select]

http://www.wmrt2008.org/video1.exe
http://www.wmrt2008.org/video.exeOriginal spam link with redirection:

Code: [Select]

http://www.dogpile.com/clickserver/_iceUrlFlag=1?rawURL=http://www.wmrt2008.org/video1.exe&0=&1=0&4=915.796.210.076&5=805.573.728.746&9=5004915796210&1

[JohnC]

Thanks.