Author Topic: Trojan Ransom  (Read 392279 times)

0 Members and 1 Guest are viewing this topic.

July 21, 2011, 11:01:05 am
Reply #45

EP_X0FF

  • Guest
Current active Pornorolik locations (with fresh new binaries and new unlock code "NASTYA", w/o quotes)

Quote
hxxp://FREEARCHVIVIDEOFORU.ru/video/porno-rolik.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/7/video/porno-rolik7.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/8/video/porno-rolik8.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/9/video/porno-rolik9.avi.exe (46.251.237.240)
hxxp://FREEARCHVIVIDEOFORU.ru/10/video/porno-rolik10.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/video/porno-rolik.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/7/video/porno-rolik7.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/8/video/porno-rolik8.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/9/video/porno-rolik9.avi.exe (46.251.237.240)
hxxp://MNOGOPORNOVIDEONOW.ru/10/video/porno-rolik10.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/video/porno-rolik.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/1/video/porno-rolik1.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/2/video/porno-rolik2.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/3/video/porno-rolik3.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/4/video/porno-rolik4.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/6/video/porno-rolik6.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/7/video/porno-rolik7.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/8/video/porno-rolik8.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/9/video/porno-rolik9.avi.exe (46.251.237.240)
hxxp://NADA4EPORNODLYATEBYA.ru/10/video/porno-rolik10.avi.exe (46.251.237.240)


The following domain names are reserved (some already active) by gang for future use. Some of them will be used to host MBRLocker, others Pornorolik.
This list is courtesy of mc0blck :)

Quote
hxxp://DACHAPOREVODA4NIZXXX.ru/
hxxp://DACHAPOREVODA4NIZXXX.ru/video/porno-rolik.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/1/video/porno-rolik1.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/2/video/porno-rolik2.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/3/video/porno-rolik3.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/4/video/porno-rolik4.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/6/video/porno-rolik6.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/7/video/porno-rolik7.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/8/video/porno-rolik8.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/9/video/porno-rolik9.avi.exe
hxxp://DACHAPOREVODA4NIZXXX.ru/10/video/porno-rolik10.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/video/porno-rolik.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/1/video/porno-rolik1.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/2/video/porno-rolik2.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/3/video/porno-rolik3.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/4/video/porno-rolik4.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/6/video/porno-rolik6.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/7/video/porno-rolik7.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/8/video/porno-rolik8.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/9/video/porno-rolik9.avi.exe
hxxp://DAVAYEBATDEVUSHEKCLUB.ru/10/video/porno-rolik10.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/
hxxp://DOMAEBUTSYAKRITO.ru/video/porno-rolik.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/1/video/porno-rolik1.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/2/video/porno-rolik2.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/3/video/porno-rolik3.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/4/video/porno-rolik4.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/6/video/porno-rolik6.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/7/video/porno-rolik7.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/8/video/porno-rolik8.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/9/video/porno-rolik9.avi.exe
hxxp://DOMAEBUTSYAKRITO.ru/10/video/porno-rolik10.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/
hxxp://KAKEBALINASTUDOMA.ru/video/porno-rolik.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/1/video/porno-rolik1.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/2/video/porno-rolik2.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/3/video/porno-rolik3.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/4/video/porno-rolik4.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/6/video/porno-rolik6.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/7/video/porno-rolik7.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/8/video/porno-rolik8.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/9/video/porno-rolik9.avi.exe
hxxp://KAKEBALINASTUDOMA.ru/10/video/porno-rolik10.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/
hxxp://PORNOXXXONLINEFREE.ru/video/porno-rolik.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/1/video/porno-rolik1.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/2/video/porno-rolik2.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/3/video/porno-rolik3.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/4/video/porno-rolik4.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/6/video/porno-rolik6.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/7/video/porno-rolik7.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/8/video/porno-rolik8.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/9/video/porno-rolik9.avi.exe
hxxp://PORNOXXXONLINEFREE.ru/10/video/porno-rolik10.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/
hxxp://SOCHIEBLYADOMASMOTRET.ru/video/porno-rolik.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/1/video/porno-rolik1.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/2/video/porno-rolik2.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/3/video/porno-rolik3.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/4/video/porno-rolik4.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/6/video/porno-rolik6.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/7/video/porno-rolik7.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/8/video/porno-rolik8.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/9/video/porno-rolik9.avi.exe
hxxp://SOCHIEBLYADOMASMOTRET.ru/10/video/porno-rolik10.avi.exe

Seems without taking down that EXETEL server they will continue generate numerous domains each day.

update

seems they all already working. At least I can get payload from each.

July 21, 2011, 05:15:41 pm
Reply #46

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem
at lease exetel's upstream provider has blocked this host !

just got a email...

-- gerhard
Quote
Hi Marcel,


super !!!!!!!!!!!


das problem schein zu sein das sich exetel einen absolut obscuren kunden angelacht hat, der mit seinen malwareseiten rund um den globus zieht.

das ärgerliche an der sache ist das der telefon kontakt von deren class-c netzt nicht geht und auch abuse bei denen sich absolut nicht cooperativ  gezeigt hat ....

-- gerhard


Am 21.07.2011 15:44, schrieb Optimate-Server.de (Support):
> Guten Tag,
>
> danke für den Hinweis, die IP ist nun geblockt.
>
> Mit freundlichen Grüßen,
> Optimate-Server.de
>
> http://www.optimate-server.de
> Bei den Pflanzenländern 3; 61191 Rosbach
>
>
> "abuse@clean-mx.de" <abuse@clean-mx.de> schrieb:
>
>> hallo exetel ist
>> nicht erreichbar,
>> wenn sie der
>> upstream sind, bitte
>> die malwaresites
>> schliessen lassen.
>> übersicht auf:
>> http://support.clean
>> -mx.de/clean-
>> mx/viruses.php?
>> email=abuse@exetel.d
>> e&sort=id%20desc&res
>> ponse=alive
>>
>> tel 0171 4802507
>>
>> es ist wirklich
>> eilig !
>>
>> Gruß Gerhard Recher
>>
>>

July 21, 2011, 05:23:33 pm
Reply #47

EP_X0FF

  • Guest
Thank you very much :) This is wonderful news. You did a great job!

July 21, 2011, 05:25:14 pm
Reply #48

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem
Thank you very much :) This is wonderful news. You did a great job!

if you ever have a problem related to german providers, feel free to contact me !


-- gerhard

July 21, 2011, 05:52:55 pm
Reply #49

EP_X0FF

  • Guest
Ah, they are quick.

They moved to new IP. Not accessible for me through DNS name but opens with IP. Check this out.

hxxp://31.214.145.191/

Quote
hxxp://31.214.145.191/video/porno-rolik.avi.exe
hxxp://31.214.145.191/video/1/porno-rolik1.avi.exe
hxxp://31.214.145.191/video/2/porno-rolik2.avi.exe
hxxp://31.214.145.191/video/3/porno-rolik3.avi.exe
hxxp://31.214.145.191/video/4/porno-rolik4.avi.exe
hxxp://31.214.145.191/video/6/porno-rolik6.avi.exe
hxxp://31.214.145.191/video/7/porno-rolik7.avi.exe
hxxp://31.214.145.191/video/8/porno-rolik8.avi.exe
hxxp://31.214.145.191/video/9/porno-rolik9.avi.exe
hxxp://31.214.145.191/video/10/porno-rolik10.avi.exe

update All binaries except first are inaccessible for me, up to current time.

July 21, 2011, 06:06:22 pm
Reply #50

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335

They moved to new IP. Not accessible for me through DNS name but opens with IP. Check this out.

hxxp://31.214.145.191/


Same provider as before.

@Gerhard : Would you please contact Exetel's upstream provider again ?
Ruining the bad guy's day

July 21, 2011, 07:30:36 pm
Reply #51

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
hxxp://sdomankor.info/gierqwwn.cgi?13 is still alive.
I have sent the abuse to GoDaddy two times - no success.
 

July 21, 2011, 07:33:11 pm
Reply #52

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
Amazon
Quote
Blocker: hxxp://xxx-mixxi.ru/ (95.211.111.80) -> hxxp://morexporno.ru/in.cgi?2 (95.211.111.80) -> hxxp://llz3porn.s3.amazonaws.com/index.htm (72.21.194.16) -> hxxp://llz3porn.s3.amazonaws.com/xxx_video.exe (72.21.194.16)

Porno-rolik
Quote
New Blocker: hxxp://sdomankor.info/gierqwwn.cgi?16 (88.208.33.155) -> hxxp://sexlifeclubxxx.info/6/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/6/video/porno-rolik6.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/1/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/1/video/porno-rolik1.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/2/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/2/video/porno-rolik2.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/4/ (31.214.145.191) -> hxxp://sexlifeclubxxx.info/4/video/porno-rolik4.avi.exe (31.214.145.191)
Blocker: hxxp://sexlifeclubxxx.info/3/video/porno-rolik3.avi.exe (31.214.145.191)

July 21, 2011, 07:55:40 pm
Reply #53

cleanmx

  • Special Members
  • Hero Member

  • Offline
  • *

  • 3405
    • Spam-Filter Anti-Spam Virenschutz - CLEAN MX Managed Anti-Spam Service ist die Lösung für Ihr Spam-Problem
I just send another complain to them and  request to null-route this ip! (31.214.145.191)


-- gerhard

btw:

another nice finding...

http://support.clean-mx.de/clean-mx/viruses.php?review=173.242.114.45&sort=id%20desc

update just got a confirmation from marcel, they null-routed them. on this ip (22:56 CEST)


our conversation... just in german....

Quote
Hi Marcel,


klingt ja gut...

aber warum ist dann euer Kunde Exetel nicht wirklich kommunikativ ?

1) tel in ripe gibt es nicht
2) keine reaktion auf mails ...

ich belästige ungern den Upstream....


-- Gerhard

Am 21.07.2011 23:02, schrieb Optimate-Server.de (Support):
> Ja, vorher hatten wir nur IP gesperrt.
> Jetzt ist der ganze Server dicht und der Kunde von exetel gekündigt.
>
> Mit freundlichen Grüßen,

> Optimate-Server.de
>
> http://www.optimate-server.de
> Bei den Pflanzenländern 3; 61191 Rosbach
> Tel.: 06003 / 9344144
> Fax: 06003 / 9344143
>
>
> "Gerhard W. Recher (abuse)" <abuse@clean-mx.de> schrieb:
>
>> Hi Marcel,
>>
>> danke für die super-sonic-schnell reaktion.
>>
>>
>> habt ihr mit euerem down-stream kunden exetel mal ein wörtchen gewechselt ?
>>
>> ich glaube das das noch nicht das ende war...
>>
>>
>> -- gerhard
>>
>> Am 21.07.2011 22:51, schrieb Optimate-Server.de (Support):
>>> Guten Tag,
>>>
>>> danke nochmal, IP geblockt
>>>
>>> Mit freundlichen Grüßen,

>>> Optimate-Server.de
>>>
>>> http://www.optimate-server.de
>>> Bei den Pflanzenländern 3; 61191 Rosbach
>>> Tel.: 06003 / 9344144
>>> Fax: 06003 / 9344143
>>>
>>>
>>> "Gerhard W. Recher (abuse)" <abuse@clean-mx.de> schrieb:
>>>
>>>> hi Marcel,
>>>>
>>>>
>>>> die nomaden sind innerhalb exetel weitergezogen !
>>>>
>>>> auf "AS197043"  "31.214.145.191"
>>>>
>>>> bitte auch diese ip sofort blocken sprich null-routen !
>>>>
>>>> -- gerhard

July 22, 2011, 02:34:43 am
Reply #54

EP_X0FF

  • Guest
Amazon ransom trace, previous all dead.

Quote
hxxp://mixxporkaa.ru/ (95.211.111.80) -> hxxp://porno-vsetut.com/in.cgi?2 (95.211.111.80) -> hxxp://zx1uporn.s3.amazonaws.com/index.htm (72.21.203.149) -> hxxp://zx1uporn.s3.amazonaws.com/xxx_video.exe (72.21.203.149)

MBRLocker

Quote
hxxp://prostituytka.ru/xxxvideo.avi.exe

update Amazon taken down the host.

New trace bellow.

Quote
hxxp://eroticzporn.ru/ (95.211.111.80) -> hxxp://eroticzporn.ru/video.htm (95.211.111.80) -> hxxp://uspornno.ru/in.cgi?2 -> hxxp://w2biporn.s3.amazonaws.com/index.htm (72.21.203.146) -> hxxp://w2biporn.s3.amazonaws.com/xxx_video.exe (72.21.203.146)

Seems they are now quickly changing whole redirectors path with every locker update.

July 22, 2011, 06:00:41 am
Reply #55

SysAdMini

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 3335
hxxp://sdomankor.info/gierqwwn.cgi?13 is still alive.
I have sent the abuse to GoDaddy two times - no success.
 

It has been taken now by GoDaddy.
Ruining the bad guy's day

July 22, 2011, 09:54:05 am
Reply #56

EP_X0FF

  • Guest
Amazon ransom

Quote
hxxp://eroticzporn.ru/ (95.211.111.80) -> hxxp://eroticzporn.ru/video.htm (95.211.111.80) -> hxxp://uspornno.ru/in.cgi?2 (95.211.111.80) -> hxxp://frtnnbc.s3.amazonaws.com/index.htm (72.21.214.39) -> hxxp://frtnnbc.s3.amazonaws.com/xxx_video.exe (72.21.214.39)


MBRLocker (still 91.220.0.35 SIA Business Aviation Services)
Quote
hxxp://zhopaseksporno.ru/xxxvideo.avi.exe

July 22, 2011, 01:34:59 pm
Reply #57

EP_X0FF

  • Guest
Amazon, trace path the same.

Quote
hxxp://ndcporka.s3.amazonaws.com/xxx_video.exe

MBRLocker

Quote
hxxp://anusanalzhopa.ru/xxxvideo.avi.exe

July 22, 2011, 08:15:20 pm
Reply #58

mc0blck

  • Jr. Member

  • Offline
  • **

  • 14
Quote
Blocker: hxxp://askpornkas.ru/ (95.211.111.80) -> hxxp://jjkpornoz.ru/in.cgi?2 (95.211.111.80) -> hxxp://cbipoxf.s3.amazonaws.com/index.htm (72.21.214.42) -> hxxp://cbipoxf.s3.amazonaws.com/xxx_video.exe (72.21.214.42)

July 23, 2011, 01:21:33 am
Reply #59

EP_X0FF

  • Guest
Amazon, trace path the same
Quote
hxxp://sukazporka.s3.amazonaws.com/xxx_video.exe

MBRLocker new

Quote
hxxp://mossdamozxxx.ru/xxxvideo.avi.exe

We believe gang who stand for Pornorolik preparing to migrate to some Russian hoster. Probably soon they will back online.