# ------------------------------------------- # MalwareMustDie | Cridex Infection Source # Case: http://pastebin.com/raw.php?i=DQ7G0Vz0 # Please block the below IP address: # 94.76.240.56, 212.7.219.46, 5.135.71.226 (UK, PL and FR) # To void Cridex infection at this moment. # Domains are all registered via REG.RU (Russia Federation) # @unixfreaxjp /malware/checkdomains]$ date Thu Jan 16 23:53:06 JST 2014 # ------------------------------------------- # --------------------------- # REPORTED CRIDEX CNC DOMAINS # Since Nov 2013 - Jan 17th 2014 # --------------------------- $ cat checkru.txt|sort|uniq beliyvolkalak.ru buriymishka.ru deepandtouch.ru djubkafriend.ru glebstark.ru jvrdwnload.ru kolodavoloda.ru kuchereneltd.ru masterupdate.ru micrupdaserv.ru montierco.ru pianiykrolik.ru portasible.ru renataltd.ru securesrvr8.ru softsysdnl.ru ssshsecur.ru toolsdownloads17.ru updatecheck.co.ua updote-serv3.ru uppdate-servs.ru upper-service.ru # ---------------------- # Alive IP for CNC checks # ---------------------- $ bash checkru.sh DOMAINS A RECORD DNS ---------------------------------------------------------- kuchereneltd.ru. 94.76.240.56, ns1.reg.ru. ns2.reg.ru. jvrdwnload.ru, 212.7.219.46, ns1.reg.ru. ns2.reg.ru. renataltd.ru, 5.135.71.226, ns1.reg.ru. ns2.reg.ru. # Geo Location: # -------------- $ cat ip.txt|bash origin.sh Thu Jan 16 23:52:08 JST 2014|94.76.240.56|vpsxen7.gbservers.co.uk.|29550 | 94.76.192.0/18 | SIMPLYTRANSIT | GB | EUROCONNEX.NET | SIMPLY TRANSIT LTD Thu Jan 16 23:52:11 JST 2014|212.7.219.46||198156 | 212.7.216.0/21 | DEDISERV | PL | DEDISERV.EU | DEDISERV DEDICATED SERVERS SP. Z O.O. Thu Jan 16 23:52:13 JST 2014|5.135.71.226|5-135-71-226.cinfuserver.com.|16276 | 5.135.0.0/16 | OVH | FR | OVH.COM | OVH SYSTEMS # ----------------------------------- # Internet registration summary check # Registrar source, dates # (domain alphabethical sorted) # ----------------------------------- NS+WHOIS checker script by @unixfreaxjp Thu Jan 16 23:43:52 JST 2014 >>> beliyvolkalak.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.26 free-date: 2015.01.26 >>> buriymishka.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.26 free-date: 2015.01.26 >>> deepandtouch.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.24 free-date: 2015.01.24 >>> djubkafriend.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.24 free-date: 2015.01.24 >>> glebstark.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN free-date: 2015.02.06 >>> jvrdwnload.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.25 free-date: 2014.12.26 >>> kolodavoloda.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.10.28 free-date: 2014.11.28 >>> kuchereneltd.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN free-date: 2015.02.06 >>> masterupdate.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.13 free-date: 2014.12.14 >>> micrupdaserv.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.12 free-date: 2015.01.12 >>> montierco.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.13 free-date: 2014.12.14 >>> pianiykrolik.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.13 free-date: 2014.12.14 >>> portasible.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN free-date: 2015.02.06 >>> renataltd.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.13 free-date: 2014.12.14 >>> securesrvr8.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.25 free-date: 2014.12.26 >>> softsysdnl.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.25 free-date: 2014.12.26 >>> ssshsecur.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN free-date: 2015.02.06 >>> toolsdownloads17.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.11.25 free-date: 2014.12.26 >>> updatecheck.co.ua|Created On:13-Nov-2013 13:08:33 UTC Last Updated On:13-Nov-2013 13:08:33 UTC Expiration Date:13-Nov-2014 13:08:33 UTC Sponsoring Registrar:Reg RU (reg-ru-mnt-cunic) Registrant Email:sasadsa@mailinator.com Admin Email:sasadsa@mailinator.com Billing Email:sasadsa@mailinator.com Tech Email:sasadsa@mailinator.com Name Server:NS2.REG.RU Name Server:NS1.REG.RU >>> updote-serv3.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.12 free-date: 2015.01.12 >>> uppdate-servs.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.12 free-date: 2015.01.12 >>> upper-service.ru|nserver: ns1.reg.ru. nserver: ns2.reg.ru. registrar: REGRU-REG-RIPN created: 2013.12.12 free-date: 2015.01.12 Thu Jan 16 23:44:02 JST 2014 # ------------------------------- # Malware Verdict per IP in VT: # ------------------------------- https://www.virustotal.com/en/ip-address/94.76.240.56/information/ https://www.virustotal.com/en/ip-address/5.135.71.226/information/ https://www.virustotal.com/en/ip-address/212.7.219.46/information/ --- #malwaremustdie @unixfreaxjp /malware/checkdomains]$ date Thu Jan 16 23:53:06 JST 2014