// #MalwareMustDie! Zeus Variant Payloads
// Please help to CleanUp
// Are UP ad LIVE!
---------------------------------------------------
URL + Machine Phycial GeoIP
---------------------------------------------------
molipack.it/kNbC8q4.exe (Italy)
el-padrino.com/elpatio/rch.exe (USA)
www.antonow2.de/ciozh.exe (GERMANY)
www.jatw.pacificsocial.com/rJRwh.exe (USA)
supplydivision.com/MJT2.exe (UK)
nasap.net/config/8mo.exe (USA)
ttms.org/config/UKo8.exe (USA)(USA)
hot-buys.org/error/9mor.exe (USA)
lasub-hasta.com/hasta/ho7.exe (USA)
www.c3dsolutions.com/set/do6.exe (USA)
eqi.edu.hk/eaJ.exe (HK)
dcanscapital.co.uk/jNRtwAHX.exe (USA)
glyphs-design.com/files/banners/glips_logo_n.exe (IL)
thisisyourwife.co.uk/images/cancel.exe (USA)
www.baufie.com/images/banner.exe (USA)
hortonnovak.com/wp-content/uploads/2011/02/2011-01-26-Australia-Day-2011.exe (UKRAINE)
ramasports.com/products/large_153.exe (UKRAINE)
delanecanada.ca/images/014-600.exe (UKRAINE)
allisontravels.com/wp-content/uploads/2010/02/atlantis1-150x150.exe (USA)
dinromania.ro/ZRSjXCwa.exe (ROMANIA)
lawottawa.com/portrait.exe (UKRAINE)
---------------------------------------------------
IP Info
---------------------------------------------------
195.110.124.133,||39729 | 195.110.124.0/22 | REGISTER | IT | DADA.EU | DADANET ITALIA
205.251.152.178|server20.tudns7.info.|27413 | 205.251.152.0/22 | DALLASNAP-AS | US | GNAX.NET | GLOBAL NET ACCESS LLC
82.165.53.205|kundenserver.de.|8560 | 82.165.0.0/16 | ONEANDONE | DE | 1AND1.CO.UK | 1&1 INTERNET AG
208.113.241.82|ds3152.dreamservers.com.|26347 | 208.113.224.0/19 | DREAMHOST-AS | US | NEWDREAM.NET | NEW DREAM NETWORK LLC
109.169.79.177||20860 | 109.169.64.0/19 | IOMART | GB | IOMARTHOSTING.COM | IOMART HOSTING LIMITED
75.126.218.114|hosting.andisites.com.|36351 | 75.126.208.0/20 | SOFTLAYER | US | SOFTLAYER.COM | SOFTLAYER TECHNOLOGIES INC.
75.126.218.114|hosting.andisites.com.|36351 | 75.126.208.0/20 | SOFTLAYER | US | SOFTLAYER.COM | SOFTLAYER TECHNOLOGIES INC.
74.221.210.124|| | | | US | DMEHOSTING.COM | DME HOSTING LLC
205.251.152.178|server20.tudns7.info.|27413 | 205.251.152.0/22 | DALLASNAP-AS | US | GNAX.NET | GLOBAL NET ACCESS LLC
173.229.1.89|cpanel02.5ninesdata.com.|16842 | 173.229.0.0/19 | 5DL-AS | US | 5NINESDATA.COM | 5NINES DATA LLC
123.242.226.10|123-242-226-10.sunnyvision.com.|38478 | 123.242.226.0/24 | SUNNYVISION-AS | HK | SUNNYVISION.COM | NETWORK INFINITY TECHNOLOGY LIMITED
212.1.212.89|srv212-89.hosting24.com.|47583 | 212.1.208.0/21 | HOSTINGER | US | HOSTPRINCE.COM | HOSTINGER INTERNATIONAL LIMITED
212.199.115.173|cp.simply-smart.com.|9116 | 212.199.112.0/20 | GOLDENLINES | IL | 012.NET.IL | 012 SMILE COMMUNICATIONS LTD.
64.50.166.122|dss00076.lunarbreeze.com.|15244 | 64.50.166.0/23 | ADDD2NET-COM-INC-DBA | US | LUNARPAGES.COM | LUNAR PAGES
173.203.199.241|173-203-199-241.static.cloud-ips.com.|33070 | 173.203.192.0/18 | RMH-14 | US | RACKSPACE.COM | RACKSPACE CLOUD SERVERS
194.28.87.121|mail.ct13.fastbighost.net.|21219 | 194.28.84.0/22 | DATAGROUP | UA | HOSTPRO.COM.UA | HOSTPRO LTD.
195.191.24.153|ct13.fastbighost.net.|21219 | 195.191.24.0/23 | DATAGROUP | UA | HOSTPRO.COM.UA | HOSTPRO LTD.
195.191.25.158,||21219 | 195.191.24.0/23 | DATAGROUP | UA | HOSTPRO.COM.UA | HOSTPRO LTD.
69.26.171.181|unknown.xeex.net.|27524 | 69.26.160.0/19 | XEEX-COMMUNICATIONS | US | XEEX.COM | XEEX
85.204.69.245|245.69.204.85.clausweb.ro.|47602 | 85.204.69.0/24 | PROFISOL | RO | CLAUSWEB.RO | SC CLAUS WEB SRL
195.191.24.153|ct13.fastbighost.net.|21219 | 195.191.24.0/23 | DATAGROUP | UA | HOSTPRO.COM.UA | HOSTPRO LTD.
#MalwareMustDie!
Comments