[nsp-sec] Heads-up BT (2856): Nasty DDoS Botnet C&C in your neck of the IP Woods

[White, Gerard]

Greetings

Check for flows to:

AS      | IP               | AS Name
2856    | 86.158.74.89     | BT-UK-AS BTnet UK Regional network

on a variety of TCP ports...  Currently using TCP/3070 right now
with this rather unique (to me) malware identified as:
http://www.virustotal.com/analisis/c1f289289aba5238f294e91ae165d3cf

What makes this Bot unique to me is the ASCII based comms it employs:

Bot> Status*(Idle...)*
C&C< kill-77.74.196.203 :27016%
Bot> Status*(UDP Attack Running!)*
C&C< stop-kill
Bot> Status*(Idle...)*

Meanwhile this poor UKSERVERS server in this example proceeded to take
quite the spankin' afterwards...  There is an appropriate UDP payload
of "X-R own you bitch!"

DNS-RRs include:
de9.no-ip.info       (This unique Bot)
dxcvg94.scrapping.cc ("Traditional" IRC Bot on TCP/8334 using
msn-spreading
                      techniques for propagation)

I have strong reason to believe this "Agent.BL" bot was involved in the
"shadowserver" spanking
in the past several days...

GW
855 - Bell Aliant