Mr Clean's dirt

[Mr Clean]

Code: [Select]

hxxp://twofinestutilites.com/liteplayer.45206.exe

$ dig twofinestutilites.com +short
64.120.141.5

$ md5sum liteplayer.45206.exe
a405340f40532107fbd7558f5cee0bcc  liteplayer.45206.exe

http://www.virustotal.com/analisis/580c78de2c3cd5ae1f605be5a9ce6bbde0c227729e6b8fb047896dca6a6f89ed-1261165900 6/40
http://anubis.iseclab.org/?action=result&task_id=1c9e34154bdb26cb49542ee690ef63944
https://cwsandbox.org/?page=report&analysisid=1904100&password=lsoqgsxtki
http://anubis.iseclab.org/?action=result&task_id=1c9e34154bdb26cb49542ee690ef63944&format=html


twofinestutilites.com

[Mr Clean]

Code: [Select]

hxxp://thescandan.com/downloader.php?affid=92003

$ dig thescandan.com +short
193.169.234.19

$ md5sum install.exe
00974b36ca8876cde9eee334150707e8  install.exe

http://www.virustotal.com/analisis/957c5ca099bf719a8683774f5e1c0d349fdacd21b9e60035e268741faeb45b69-1261194495 8/40
http://wepawet.iseclab.org/view.php?hash=91a87dcbb8a14d99be5e57467881c9ab&t=1261195430&type=js

thescandan.com

[Mr Clean]

Code: [Select]

hxxp://networksecurityinfo.com/downloader.php?affid=91109

$ dig networksecurityinfo.com +short
94.102.63.245

$ md5sum install.exe
8d997dc279887fb3e04fea8d085a9aee  install.exe

http://www.virustotal.com/analisis/bc874ddbc5467481b40cc6b5a9f0cdb290ba9ccb989a3865cf23e8c1b4d75ebe-1261407699 10/40
https://cwsandbox.org/?page=report&analysisid=1977185&password=nhzqvmjobf
http://www.threatexpert.com/report.aspx?md5=8d997dc279887fb3e04fea8d085a9aee


networksecurityinfo.com

[Mr Clean]

Code: [Select]

hxxp://virusexamine.com/downloader.php?affid=34100

$ dig virusexamine.com +short
193.169.13.15

$ md5sum install.exe
6a4c8beae1aefa86a87b0795e267cb24  install.exe

http://www.virustotal.com/analisis/4e67a4948a3a08c6699fed5b25af5ed4a33764bca966a02919b6dccfec189137-1261413328 12/40
https://cwsandbox.org/?page=report&analysisid=1978525&password=phkjpjgnuu
http://www.threatexpert.com/report.aspx?md5=6a4c8beae1aefa86a87b0795e267cb24


virusexamine.com

[Mr Clean]

Code: [Select]

hxxp://www.thumser-online.de/store/images/large/install_flash_player.exe

$ dig www.thumser-online.de +short
81.169.145.82

$ md5sum install_flash_player.exe
fa168bb0e6cf2e0cc937888b92f63416  install_flash_player.exe

http://www.virustotal.com/analisis/79e9a54d15d4e74c2674c778ed33700e2718766a1f98020c3889438957aaee7a-1261416462 5/41
http://anubis.iseclab.org/?action=result&task_id=1dd5e0e7ce59d94b40d27c8b4801b0979&format=html
https://cwsandbox.org/?page=report&analysisid=1979532&password=oncymhnwmz
http://www.threatexpert.com/report.aspx?md5=fa168bb0e6cf2e0cc937888b92f63416


thumser-online.de

[Mr Clean]

Code: [Select]

hxxp://free-scanner-spyware.biz/get.php?sc=1&id=259b4c25aa08557e7c8892c5d64253db

$ dig free-scanner-spyware.biz +short
193.106.32.40

http://www.virustotal.com/analisis/4e6286bc34b5c6fb92f1571760d304186c759eb24fdd008ca14a4949bb9e9e04-1261440681 24/40


free-scanner-spyware.biz

[Mr Clean]

Code: [Select]

hxxp://softwaredate.net/flash-HQ-plugin.40069.exe

$ dig softwaredate.net +short
64.120.141.5

$ md5sum flash-HQ-plugin.40069.exe
e7838570a8f92d863f3d3af9baccfdab  flash-HQ-plugin.40069.exe

http://www.virustotal.com/analisis/55d7e75df1746493c92443734238677d1488096bc9089e0b52ca5b2261b2ddc5-1261513824 5/40
https://cwsandbox.org/?page=report&analysisid=1993816&password=ctepcqwsyz
http://anubis.iseclab.org/?action=result&task_id=1711b7bbdd8a12574319ce2973cf32b98&format=html
http://www.threatexpert.com/report.aspx?md5=e7838570a8f92d863f3d3af9baccfdab


softwaredate.net

[Mr Clean]

Code: [Select]

hxxp://statcstat.com//news/ld.php?e=pdf

$ dig statcstat.com +short
193.104.22.153

$ md5sum op.exe
a7e33d767b2f39ddba372dadf4dfd057  op.exe

http://www.virustotal.com/analisis/7dab670b14c34a577f47371b1bb8a4854b6bf7ccfad7cd720f309ca00bf002c2-1261514926 2/41
http://anubis.iseclab.org/?action=result&task_id=1afb9aafbb22de4343db974bd3bdbdefd
https://cwsandbox.org/?page=report&analysisid=1993940&password=fggfzwljnj
http://www.threatexpert.com/report.aspx?md5=a7e33d767b2f39ddba372dadf4dfd057


statcstat.com

[Mr Clean]

Code: [Select]

hxxp://cjbtiybcpnf.com/nte/trest11.py/eH999a4551V0100f070006R00000000102Td2a93f54201l0409320

$ dig cjbtiybcpnf.com +short
72.51.47.21

http://www.malwaredomainlist.com/mdl.php?search=72.51.47&colsearch=All&quantity=50

http://www.virustotal.com/analisis/495b848a01b5fee685508d4782ba099cd60156fad3aaec694f4b97c8a023421c-1261646823 6/41


cjbtiybcpnf.com

[Mr Clean]

Code: [Select]

hxxp://spywareremovediretto.com/downloader.php?affid=93101

$ dig spywareremovediretto.com +short
193.104.153.2

http://www.virustotal.com/analisis/e5ea0ebb4d0bd98882eb4a40a8c6dc372217ec65aa9360fc18418b0c99cb9077-1261844636 2/41
http://anubis.iseclab.org/?action=result&task_id=1efe6552a82c1af745dc365da0f748dc0


spywareremovediretto.com

[Mr Clean]

Code: [Select]

hxxp://macaples.in/my_usa/load.php?spl=ActiveX_pack

$ dig macaples.in +short
115.100.250.114

http://www.virustotal.com/analisis/c0582cdd20e4c9dd0787d95f3f4178bc3ad9312389b1c5ca211b1db2e6a3ed48-1262021030 5/40
http://anubis.iseclab.org/?action=result&task_id=179293bcca358eeb4794c20bdc637dd75&format=html


macaples.in

[Mr Clean]

Code: [Select]

hxxp://macaples.in/my_usa/pdf.php

http://www.virustotal.com/analisis/5faf913b0e252afadeb738543450b3d579ee25cb1e8e6eb4f88cfac89f975314-1262021303 2/41

(see previous post)

[Mr Clean]

Code: [Select]

hxxp://malwaretake.com/downloader.php?affid=93101

$ dig malwaretake.com +short
193.104.153.2

http://anubis.iseclab.org/?action=result&task_id=130fa5ef209cf627481879761f409a686
http://www.virustotal.com/analisis/71b5ffe784f21955ebf3b8dfa483a09249cc209466e904ccba259f078ca4f26c-1262116493 9/41


malwaretake.com

[Mr Clean]

Code: [Select]

hxxp://antivirusscanstore.com/downloader.php?affid=93101

$ dig antivirusscanstore.com +short
193.104.153.2

http://anubis.iseclab.org/?action=result&task_id=15d241f0ebc17262415f5922d50104894
http://www.virustotal.com/analisis/d844f07b019d3d82f012e2210a68765db3353d4951ee0842cc9c8aabefad664e-1262193852 14/41


antivirusscanstore.com

[Mr Clean]

Code: [Select]

hxxp://scanlifetimeonline.com/downloader.php?affid=05300

$ dig scanlifetimeonline.com +short
62.90.136.210

http://www.virustotal.com/analisis/62638a1beb60e047ab5e77fad3958ba1e828aae16a96a192b665eebbd1ecc998-1262272427 13/36
http://anubis.iseclab.org/?action=result&task_id=18d2e0223df70eda4452b3caa969362cc


scanlifetimeonline.com