[nsp-sec] Clients infected with trojan dropper trying to download Zbot malware

Dirk Stander dst+nsp-sec at glaskugel.org
Thu Apr 30 07:41:43 EDT 2009


.: Hi,

I'm relaying another report by courtesy of Thomas Hungenberg
(CERT_BUND / BSI).  Please find the complete list at
https://asn.cymru.com/nsp-sec/upload/1241091043.whois.txt
(timestamps are in UTC) and a summary attached to this mail.

    Kind regards, Dirk Stander (1&1) :.

--------------------------------------------------------

Hi teams,

there was a Zbot malware binary at <hXXp://crew.abnc-portal.com/tpmgs.exe>.
Among other infection vectors, this binary is downloaded by a trojan dropper
using "ie" as User-Agent.

For an unknown reason, the IP address for crew.abnc-portal.com was changed
to 88.80.216.114 last week.
88.80.216.114 is hosting the Swiss security blog 'abuse.ch'.
This server is not malicious and has not been compromised!

By analyzing the requests for crew.abnc-portal.com/tpmgs.exe with User-Agent "ie"
that hit 88.80.216.114, clients infected with the trojan dropper could be identified.

Please find attached a list of the logged requests with IP and timestamp (UTC).

#requests  country
161860     US
 31192     GB
 20586     UA
 11601     RU
  1121     EU
   244     N/A
   110     GE
    91     BA
    44     CA
    12     CY

Maybe you would like to inform the customers within the networks of your responsibility
about the infections.

--------------------------------------------------------
    IPs ASN
    ---+---
    412 6849
    213 7132
    187 2856
     97 19262
     92 6389
     90 9105
     90 8997
     89 4589
     88 13285
     75 5089
     66 22773
     64 25229
     57 8359
     51 43234
     49 5591
     44 20115
     42 8402
     42 6128
     41 5462
     38 6167
     38 21497
     36 41440
     34 35736
     31 209
     29 34661
     27 33651
     25 3356
     25 33287
     25 11426
     22 5388
     22 3239
     22 11427
     22 11351
     20 42825
     20 34058
     19 6828
     19 20214
     18 5668
     18 33491
     18 12714
     18 11955
     16 8636
     16 6703
     15 8594
     15 35228
     15 31343
     15 25008
     15 19864
     15 19108
     14 31272
     14 26642
     14 20001
     14 10994
     13 7725
     13 6871
     13 6478
     13 42833
     13 25515
     13 25082
     13 21219
     13 13343
     12 786
     12 7018
     12 7015
     12 39229
     12 33668
     12 12332
     12 12271
     11 10507
     10 6621
     10 31094
     10 24955
     10 16586
      9 6876
      9 33657
      9 31148
      9 13118
      8 701
      8 3255
      8 30822
      8 28719
      8 21332
      7 7029
      7 7011
      7 4355
      7 33652
      7 33650
      7 25490
      7 15500
      7 14910
      7 12705
      7 11492
      7 10796
      6 7065
      6 6939
      6 5600
      6 36727
      6 29328
      6 21508
      5 7757
      5 7016
      5 6767
      5 6181
      5 4574
      5 41733
      5 35531
      5 28702
      5 25513
      5 25133
      5 22258
      5 21479
      5 18566
      5 12530
      5 11456
      4 9142
      4 52
      4 4181
      4 3737
      4 35123
      4 33588
      4 31224
      4 25405
      4 25100
      4 21256
      4 21017
      4 20231
      4 13432
      4 13367
      4 12390
      4 12380
      4 12262
      4 11530
      3 8615
      3 7843
      3 6300
      3 6079
      3 42471
      3 39660
      3 39084
      3 38951
      3 34143
      3 33660
      3 33490
      3 26611
      3 25521
      3 2379
      3 20485
      3 20057
      3 174
      3 17184
      3 15582
      3 12576
      3 1239
      3 12270
      3 11272
      3 11060
      2 8897
      2 8732
      2 8622
      2 855
      2 8426
      2 8401
      2 7849
      2 7459
      2 7385
      2 5778
      2 47165
      2 44775
      2 44552
      2 4323
      2 42610
      2 42574
      2 42396
      2 42387
      2 39608
      2 39054
      2 39047
      2 35816
      2 35728
      2 34797
      2 34092
      2 33934
      2 33662
      2 3261
      2 3216
      2 31499
      2 31133
      2 30955
      2 30263
      2 29737
      2 25994
      2 25436
      2 2529
      2 25135
      2 24810
      2 2386
      2 23504
      2 21488
      2 21438
      2 21327
      2 20875
      2 18712
      2 18494
      2 1785
      2 17049
      2 15658
      2 15206
      2 14390
      2 14051
      2 13188
      2 12668
      2 12247
      2 11976
      2 11650
      2 11525
      2 11509
      1 8920
      1 8744
      1 8681
      1 8595
      1 8570
      1 8546
      1 8492
      1 8342
      1 8334
      1 8291
      1 8190
      1 8001
      1 7397
      1 72
      1 7017
      1 6983
      1 6854
      1 6423
      1 6372
      1 6325
      1 6106
      1 600
      1 5760
      1 5742
      1 5563
      1 5056
      1 4922
      1 48711
      1 47582
      1 46262
      1 46115
      1 4511
      1 45044
      1 43967
      1 43815
      1 43103
      1 43022
      1 43011
      1 42945
      1 42765
      1 42714
      1 42590
      1 42512
      1 42335
      1 41925
      1 41875
      1 41302
      1 4043
      1 40385
      1 40312
      1 40309
      1 40307
      1 40285
      1 39696
      1 39633
      1 39027
      1 38958
      1 3801
      1 3729
      1 35891
      1 35810
      1 35807
      1 35510
      1 35389
      1 35320
      1 35154
      1 34974
      1 34865
      1 34743
      1 34700
      1 34331
      1 34323
      1 34266
      1 34248
      1 34187
      1 34168
      1 34137
      1 34056
      1 34038
      1 33749
      1 33636
      1 33545
      1 3354
      1 33444
      1 32855
      1 32806
      1 32554
      1 3226
      1 32119
      1 32107
      1 31514
      1 31213
      1 30977
      1 30749
      1 3058
      1 30305
      1 30251
      1 29895
      1 29456
      1 29209
      1 29190
      1 29124
      1 29107
      1 29034
      1 28840
      1 2878
      1 2828
      1 27364
      1 27288
      1 27264
      1 27202
      1 26935
      1 26860
      1 26554
      1 26292
      1 25969
      1 2572
      1 25671
      1 25500
      1 25478
      1 25386
      1 25310
      1 24932
      1 22759
      1 22561
      1 22318
      1 22192
      1 21745
      1 21694
      1 21565
      1 21414
      1 21127
      1 21106
      1 21011
      1 20950
      1 20934
      1 20895
      1 20807
      1 20257
      1 19792
      1 19779
      1 19464
      1 18990
      1 18687
      1 1761
      1 1751
      1 17014
      1 17
      1 16966
      1 16904
      1 16810
      1 1678
      1 16718
      1 16526
      1 16424
      1 16399
      1 16223
      1 16064
      1 15738
      1 15713
      1 15595
      1 15463
      1 15105
      1 14855
      1 14710
      1 14676
      1 14543
      1 14161
      1 13760
      1 13576
      1 13208
      1 13122
      1 13056
      1 13037
      1 12998
      1 12788
      1 12742
      1 1273
      1 12708
      1 12593
      1 12513
      1 12389
      1 12208
      1 12177
      1 12097
      1 12083
      1 12064
      1 11961
      1 11796
      1 11606
      1 11279
      1 11215
      1 10823
      1 10311
      1 10242



More information about the nsp-security mailing list