3 replies to this topic

[MysteryFCM]

Sunbelt tried hiding the URL, but I found it anyway ......

Init:

http://mjackson.1ffli.com.mx/x-files/

Payload:

http://mjackson.1ffli.com.mx/x-files/x-file-MJacksonsKiller.exe

Exploit:

http://ogzhnsltk.com/plugins/index.php
http://ogzhnsltk.com/plugins/getexe.php
http://ogzhnsltk.com/plugins/pdf.php

Ref:
http://sunbeltblog.blogspot.com/2009/06/mi...ot-dont-go.html

[Fatdcuk]

Thanks Steven,

Have added the URL for harvesting, will checkout the Z-bot variant to see if it has new install pattern.

Usually we hold extremely high sucess rate against the installed z-bots which mitigates chasing the millions of custom packed droppers

[Fatdcuk]

Is sdra64.exe variant and the cat ate it

[MysteryFCM]

hehe cool