From #mdl

[sowhat-x]

hxxp://196.32.220.3/0.exe
hxxp://196.32.220.3/m/1.php
hxxp://89.223.13.242/asg234/g124.php?p=30817&uid=1350591802&aid=301&t=L
hxxp://89.223.13.242/rep.php?uid=1350591802&aid=301&d=0
hxxp://89.223.13.242/rep.php?uid=1350591802&aid=301&d=1
hxxp://89.223.13.242/rep.php?uid=1350591802&aid=301&d=2
hxxp://89.223.13.242/rep.php?uid=1350591802&aid=301&d=3
hxxp://89.223.13.242/rep.php?uid=1350591802&aid=301&d=4
hxxp://89.223.13.242/update/ip.txt
hxxp://91.121.102.38/~fleming/Nothing/Setup_ver1.1567.0.exe
hxxp://axalay.info/ts/index.php
hxxp://correiobr.bravehost.com/br/nat.jpg
hxxp://dns.db884829.info/ttt.gif
hxxp://dreamtds.info/ts/in.cgi?reyden
hxxp://first-reason.com/up.php?advid=0000004683&ver=le_1
hxxp://gremit.com/ico462.ico
hxxp://juegosmier.googlepages.com/csrss.gtr
hxxp://lntop.info/get_update2.php?uid=462&v=4&lid=6919012b003665ba000f00070001000f&sv=1
hxxp://reboot87.web.cedant.com/house/index/w87.exe
hxxp://reboot87.web.cedant.com/logs/state/reboot87x587.exe
hxxp://showroxpower.smtp.ru/pinga01.jpg
hxxp://showroxpower.smtp.ru/pinga02.jpg
hxxp://showroxpower.smtp.ru/pinga03.jpg
hxxp://tj.db884829.info/ttt.asp?action=update&version=0
hxxp://updatesofware.googlepages.com/updatesoftware.exe
hxxp://www.amizades40.kit.net/jupitar.xml
hxxp://www.amizades40.kit.net/sql.xml
hxxp://www.aslidost.com/plugins/calendar/calendar_lang/auto.gif
hxxp://www.aslidost.com/plugins/calendar/calendar_lang/bn.gif
hxxp://www.aslidost.com/plugins/calendar/calendar_lang/vala.gif
hxxp://www.geocities.com/cccqqmnmf/hotmail-hacker-download.html
hxxp://myrelevantsearch.com/
hxxp://www.pharmacyonlinenet.com/search.php?said=pharm&q=tramadol

[JohnC]

Thanks.

[sowhat-x]

Credits for this go to Kayrac 

hxxp://nitrocodec.net/download/nitrocodec.v.1.000.exe

Nsis installer,contains 3 executables...Zlob ralated.The .exes contact the following addresses:

hxxp://64.28.183.12/
hxxp://216.255.186.238/

[Kayrac]

more so credits goto john i think

stole it off mdl's list, just ran it to find exactly what it did

-Brian

[Kayrac]

Code: [Select]

hxxp://91.121.102.38/~fleming/Nothing/Setup_ver1.1567.0.exe
this file does alot

check it

[sowhat-x]

hxxp://91.121.102.38/~fleming/ -> Open dir...

hxxp://stat.av-xp-2008.com/download/AntivirusXP2008Installer.exe
hxxp://77.91.227.179/s1265/WebSoftCodecDrivern.exe
hxxp://softsiteinc.com/scan/67b16b273103ae910ef7ee6c9e70701d/15/
hxxp://64.247.39.247/confirm.php
hxxp://74.50.107.165/confirm.php
hxxp://74.50.107.159/confirm.php

[JohnC]

Thanks.

[sowhat-x]

hxxp://paypalli.com/soft/software.exe
hxxp://paypalli.com/soft/film%20xman.exe
hxxp://paypalli.com/tool/toolcheck.exe
hxxp://paypalli.com/vip/film%20xman.exe
hxxp://www.xp-shield.com/download.html
hxxp://download.pcprivacycleaner.com/PCPC_Setup_Free.exe
hxxp://antispywareexpert-scanner.com/2009/5/?a=site&l=load
hxxp://antispywareexpert.com/ASE_Setup_Free.exe
hxxp://antimalwareguard.com/AntiMalwareGuard_Free.exe
hxxp://errordoctor.com/downloads/ErrorDoctorSetup.exe
hxxp://spyremover.com/downloads/SpyRemoverSetup.exe
hxxp://flashdollars.com/software/AntivirusProtection/SpyBase/spydb.exe
hxxp://antivirusprotectionsite.com/download/platinumpartner/AntivirusProtection.exe
hxxp://adwareprotectionsite.com/download/platinumpartner/AdwareRemover.exe
hxxp://download.fast-pc-scanner-online.com/download/AntvrsInstall.exe
hxxp://download8.antispycheck.com/downloads/1012/asc_2_setup.exe
hxxp://dnld.av2008dl.com/load/setup_110095_3_.exe
hxxp://88.191.13.180/~pri/msgr/8.5/msgr8.5us.exe
hxxp://www.qljgsfb9601.com/max1.exe

[JohnC]

Thanks.