Author Topic: 2 URLs that appeared on yahoo groups today  (Read 4753 times)

0 Members and 1 Guest are viewing this topic.

July 15, 2009, 10:02:01 pm
Read 4753 times

tom_

  • Newbie

  • Offline
  • *

  • 5
patipezy.freehostking.com

dulofady.hostevo.com

These were in posts made by an account we know to be compromised.

July 15, 2009, 10:11:40 pm
Reply #1

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
Both load a script from;

Code: [Select]
http://3ttman.com/ok2.htm
Which loads;

Code: [Select]
http://lipesr.com/update/?eb70c8bc3e184ffe5a98905e484546d9
Which I'm working on decoding :)
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 15, 2009, 10:23:09 pm
Reply #2

MysteryFCM

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 1693
  • Personal Text
    Phishing Phanatic
    • I.T. Mate
JSUnpack, Wepawet and Malzilla have all sadly failed to decode it :( manual decoding has also failed.
Regards

Steven Burn
I.T. Mate / hpHosts
it-mate.co.uk / hosts-file.net

July 15, 2009, 11:56:20 pm
Reply #3

CM_MWR

  • Special Members
  • Hero Member

  • Offline
  • *

  • 319
Odd one....mystery check the priv section