Malware Domain List

Malware Related => Malware Analysis => Topic started by: cleanmx on July 06, 2011, 08:30:09 pm

Title: honypot/trap of blackhats ?
Post by: cleanmx on July 06, 2011, 08:30:09 pm

I encounter many urls made with nonsense (but existing domain...) and a numerical part like this one.

Code: [Select]

http://wucucudizo.com/1006000112
response is only "ok"

example on threatexpert:
http://www.threatexpert.com/report.aspx?md5=3827b463edf321d3e673e90aea0a5a11

-- gerhard

Title: Re: honypot/trap of blackhats ?
Post by: SysAdMini on July 10, 2011, 10:20:38 pm

Is is typical for some fake av (trojan FakeRean). I don't know the purpose of this url,
but this malware requests this style of urls. I suspect that the malware reports a successful installation.