New files for Zeus servers

[jackberri]

IP Location: Romania - SA-NOVA-TELECOM-GRUP-SRL
IP  188.229.90.158
AS49469
ns3.cnmsn.com
ns4.cnmsn.com
Registrant/Email Registrant: Whois Privacy Protection Service/huilpaukul@whoisservices.cn

Code: [Select]

hxxp://candiayadservices.com/all/all.binmd5sum ===> 44f720bd3178bb03501aece305778538

Code: [Select]

hxxp://candiayadservices.com/all/all.exemd5sum ===> ccdffe66084ecb4902f2bdc084f2fc9c
http://www.virustotal.com/file-scan/report.html?id=f60d0c8a8c5e0459a95320731cf6ac5440e7875380f637479320bebfc7049d8f-1293799392
VT 8/43 (18.6%)

[jackberri]

Code: [Select]

hxxp://suba555.com/gold/load/cfg2.binmd5sum ===> c298613a985728671740ed3021b6ecc8

[jackberri]

Code: [Select]

hxxp://forum.worldwideplasticsforum.com/forum/image2.jpgmd5sum ===> 3045fd5bd59c01d8e5a91f514e8e9262

Code: [Select]

hxxp://forum.worldwideplasticsforum.com/forum/post.asp

[jackberri]

Code: [Select]

hxxp://flashspan.net/vvx2222/xxzz.jpgmd5sum ===> 876f8acf9a6ae465c4728e62a485c0d8

Code: [Select]

hxxp://nolif3-clan.org/ishigo/sama.php
hxxp://nolif3-clan.org/ishigo/index.php
hxxp://nolif3-clan.org/ishigo/index.php?b=b&v=test

[jackberri]

new md5sum

Code: [Select]

hxxp://elliota.com/sas/crdqargrxn8.exemd5sum ===> e2ac5ab3a6d80b7a8194f3a72066fbba
http://www.virustotal.com/file-scan/report.html?id=98579a3c3fca795347ecba4e0029c08b67289ee8271e37a43fd1a87427b51afb-1295451827
VT 15/43 (34.9%)

[jackberri]

Code: [Select]

hxxp://ustunoto.com.tr/FLA/Default2.flamd5sum ===> b04ee0dd31de6d86904de0a08d1a54ca

Code: [Select]

hxxp://ustunoto.com.tr/data/set.php

[jackberri]

Code: [Select]

hxxp://microsupdates.com/_crfsz/crzp3
md5sum ===> d37cf8631a68a1a650f063b4200c9454

Code: [Select]

hxxp://microsupdates.com/_crfsz/crzp3.exe
md5sum ===> e2f69ca7a04f6efb79f3bb9c4c428a89
http://www.virustotal.com/file-scan/report.html?id=b1cf2ce76469c429a378d26df2327d0a0336a55146627bc604a29b6207d09fbc-1295884658
VT 22/42 (52.4%)

Code: [Select]

hxxp://microsupdates.com/_crfsz/crzp3

[jackberri]

Code: [Select]

hxxp://microsupdates.com/_crfsz/crzpsukmd5sum ===> 7cacae19eed6a5cb28db2c2916a5d140

Code: [Select]

hxxp://microsupdates.com/_crfsz/crzpsuk.exemd5sum ===> 24b77a35182885498908ad1dac8be183
http://www.virustotal.com/file-scan/report.html?id=26ac3ac86d4ee595263fcd1b1ffa17813c208695058260a0ab0ac7ae98b89c51-1296669264
VT 14/42 (33.3%)

[jackberri]

Code: [Select]

hxxp://oneboy.ru/de.cpmmd5sum ===> 9ecfa5f1e91d9e851fa9c0ec82225794

Code: [Select]

hxxp://oneboy.ru/de.exemd5sum ===> 0f7d581dfa08f3b981eebbf0f785b3f3
http://www.virustotal.com/file-scan/report.html?id=43a96a20e378596340b449a8ce389b2691851a6c3ac839891f33d9e4dd928fd0-1296722165
VT 4/43 (9.3%)

[jackberri]

Code: [Select]

hxxp://fastgoal.ru/de.cpmmd5sum ===> 9ecfa5f1e91d9e851fa9c0ec82225794

Code: [Select]

hxxp://fastgoal.ru/au.cpm
hxxp://fastgoal.ru/22oct_bir.cpm
hxxp://fastgoal.ru/22oct_ic3.cpm
hxxp://fastgoal.ru/22oct_pac.cpm
hxxp://fastgoal.ru/22oct_dmi.cpm
hxxp://fastgoal.ru/22oct_den.cpm
hxxp://fastgoal.ru/14oct_usa.cpmmd5sum ===> bd25942f77779476a2e77c710c0cf518

Code: [Select]

hxxp://fastgoal.ru/de.exemd5sum ===> 0f7d581dfa08f3b981eebbf0f785b3f3
http://www.virustotal.com/file-scan/report.html?id=43a96a20e378596340b449a8ce389b2691851a6c3ac839891f33d9e4dd928fd0-1296726440
VT 5/43 (11.6%)

Code: [Select]

hxxp://fastgoal.ru/au.exemd5sum ===> a30f7446024ad8aea2b0be6f6f6b2598
http://www.virustotal.com/file-scan/report.html?id=f8e1fa6a790117c5d699c0b633dc439d5697cb4b5eabbdfeaedc3e419f9bd029-1296726429
VT 37/43 (86.0%)

Code: [Select]

hxxp://fastgoal.ru/22oct_bir.exemd5sum ===> f508e43496c078f71953487232c3ac73
http://www.virustotal.com/file-scan/report.html?id=50663abc87834f967231b886344546cc870b0ed54fffbec1b0f7936a53e8b14e-1296726293
VT 34/43 (79.1%)

Code: [Select]

hxxp://fastgoal.ru/22oct_ic3.exemd5sum ===> ee68283c0c8494c322c8f6d41aa4e8d6
http://www.virustotal.com/file-scan/report.html?id=ef70f2a7fc9c987e9d1420f12dcc83899e822cf68f86a4f6006e4553faa7c9d2-1296726211
VT 39/42 (92.9%)

Code: [Select]

hxxp://fastgoal.ru/22oct_pac.exemd5sum ===> eefbe4c73a25a44bcc0d5df146b13fce
http://www.virustotal.com/file-scan/report.html?id=b68072cc74f356106fc638ce0d912a1fe4f6573da26336e80aabea89cbebca2c-1296726080
VT 41/43 (95.3%)

Code: [Select]

hxxp://fastgoal.ru/22oct_dmi.exemd5sum ===> add058a4f13c3b5f2a97ecc80933cfff
http://www.virustotal.com/file-scan/report.html?id=6266922df8b6574a0e6c4a8049e691fbc86673764c908f107eb479dacc485a4a-1296725929
VT 42/43 (97.7%)

Code: [Select]

hxxp://fastgoal.ru/22oct_den.exemd5sum ===> 16f092ac72fa89def619e7e45c1b023d
http://www.virustotal.com/file-scan/report.html?id=1c5731ed76ec501dd41504269d56b1b374163de3c48626c5205f02b8e728fc39-1296725799
VT 34/43 (79.1%)

Code: [Select]

hxxp://fastgoal.ru/14oct_usa.exemd5sum ===> 70734b55ab2fe874e44706be389dc77b
http://www.virustotal.com/file-scan/report.html?id=c3a0d72b6c2d1d885117685d0548d976a00e7a5b9efb6c30e0edd8cd16431960-1296725580
VT 42/43 (97.7%)

[jackberri]

updated trojan:

Code: [Select]

hxxp://hotupdate.ru/yUPHexefru7ruqABEw7t/FrlA9r.exemd5sum ===> fb818f7e0c8c772178bca8e2dfcbd975
http://www.virustotal.com/file-scan/report.html?id=696299e76e15d6e1e9ec9497e8f2c11c5d19787d1ce17d9a9e4927aee2245498-1297541617
VT 10/43 (23.3%)

[jackberri]

updated trojan:

Code: [Select]

hxxp://hotupdate.ru/yUPHexefru7ruqABEw7t/FrlA9r.exemd5sum ===> ebf9d306f5c7311d1d2a3826085566f7
http://www.virustotal.com/file-scan/report.html?id=5963bf335d63d4950754cd429576547527cfe9b5ce21407b529a228302043cc8-1297670505
VT 6/41 (14.6%)

[jackberri]

Code: [Select]

hxxp://hotupdate.ru/yUPHexefru7ruqABEw7t/FrlA9r.exemd5sum ===> 24b8a8d2fb5ea637a74fa598d46d79dc
http://www.virustotal.com/file-scan/report.html?id=28fb1a92266fc1caa823c615daa703023e6475a5a73b26916b8b56501bc9d196-1297769916
VT 5/43 (11.6%)

[jackberri]

updated trojan:

Code: [Select]

hxxp://hotupdate.ru/yUPHexefru7ruqABEw7t/FrlA9r.exemd5sum ===> 9f6cb203dff9df6aa5ccfdebdbb9c794
http://www.virustotal.com/file-scan/report.html?id=5b9e94b2919d8de58a9cb3ae466139406ed4d64c4c2469628575e6a78e9b70d1-1297797720
VT 2/43 (4.7%)

[jackberri]

Code: [Select]

hxxp://iu7nq6br5w.com/k45hjh354234h/2354k2j34hk23hg4.exemd5sum ===> 89f66908b4f76486dfef2507cf768e94
http://www.virustotal.com/file-scan/report.html?id=11d60c2ad400274922d1291bf81430d92a970f2f435945c99759a8902d6455ec-1297930754
VT 17/43 (39.5%)