85.234.190.22 - cruelgay.ru - Help Identifying Drive By

[eoin.miller]

Don't know what kind this is and its not in any list either currently.

Also, this netblock = evil:
85.234.190.0/24

http://cruelgay.ru/zmb/index.php - drive by

[MysteryFCM]

http://wepawet.cs.ucsb.edu/view.php?hash=2125ac85a8ea07f4db1dd58960a785fa&type=js

[SysAdMini]

It's a Zombie kit.

http://www.malwaredomainlist.com/forums/index.php?topic=4241.msg18535#msg18535

[Amishrabbit]

Payloads:

08fd53e0ece9f84f.jar   73cfe10de2d0fd6f6bb064a17a970b1b (JAR downloader)
bb84cc1695aa5a51.pdf   22fc8c57a7287b3a7c87fb001c95df64 (PDF downloader)

load.php.exe   3c462c74a90cd3496b89baf4dc647fc2 (Oficla/Sasfis/Tacticlol) (origin: hxxp://cruelgay.ru/zmb/load.php?f=1&e=4) which drops
   goap.cmo   55b7bdfcd6af5ef36106ce21030aa3e0  (Oficla/Sasfis/Tacticlol)

15.tmp   7b9d1d6254044186478dd1cfa6f5cb74  (Hiloti) (origin: hxxp://imlady.ru/atx.exe) which drops
   msraufte.dll   7bba413842d21cd09377e5ac40998cd9 (Hiloti/Virtumonde)

CnC:

hxxp://mylote.com/test/bb.php

Alternate CnC:

hxxp://asusmac.org/original/s.php

[eoin.miller]

It's a Zombie kit.

http://www.malwaredomainlist.com/forums/index.php?topic=4241.msg18535#msg18535

the /zmb/ in the URI now makes a lot of sense. Thanks all!