[nsp-sec] Clients infected with trojan dropper trying to download Zbot malware
Dirk Stander
dst+nsp-sec at glaskugel.org
Thu Apr 30 07:41:43 EDT 2009
.: Hi,
I'm relaying another report by courtesy of Thomas Hungenberg
(CERT_BUND / BSI). Please find the complete list at
https://asn.cymru.com/nsp-sec/upload/1241091043.whois.txt
(timestamps are in UTC) and a summary attached to this mail.
Kind regards, Dirk Stander (1&1) :.
--------------------------------------------------------
Hi teams,
there was a Zbot malware binary at <hXXp://crew.abnc-portal.com/tpmgs.exe>.
Among other infection vectors, this binary is downloaded by a trojan dropper
using "ie" as User-Agent.
For an unknown reason, the IP address for crew.abnc-portal.com was changed
to 88.80.216.114 last week.
88.80.216.114 is hosting the Swiss security blog 'abuse.ch'.
This server is not malicious and has not been compromised!
By analyzing the requests for crew.abnc-portal.com/tpmgs.exe with User-Agent "ie"
that hit 88.80.216.114, clients infected with the trojan dropper could be identified.
Please find attached a list of the logged requests with IP and timestamp (UTC).
#requests country
161860 US
31192 GB
20586 UA
11601 RU
1121 EU
244 N/A
110 GE
91 BA
44 CA
12 CY
Maybe you would like to inform the customers within the networks of your responsibility
about the infections.
--------------------------------------------------------
IPs ASN
---+---
412 6849
213 7132
187 2856
97 19262
92 6389
90 9105
90 8997
89 4589
88 13285
75 5089
66 22773
64 25229
57 8359
51 43234
49 5591
44 20115
42 8402
42 6128
41 5462
38 6167
38 21497
36 41440
34 35736
31 209
29 34661
27 33651
25 3356
25 33287
25 11426
22 5388
22 3239
22 11427
22 11351
20 42825
20 34058
19 6828
19 20214
18 5668
18 33491
18 12714
18 11955
16 8636
16 6703
15 8594
15 35228
15 31343
15 25008
15 19864
15 19108
14 31272
14 26642
14 20001
14 10994
13 7725
13 6871
13 6478
13 42833
13 25515
13 25082
13 21219
13 13343
12 786
12 7018
12 7015
12 39229
12 33668
12 12332
12 12271
11 10507
10 6621
10 31094
10 24955
10 16586
9 6876
9 33657
9 31148
9 13118
8 701
8 3255
8 30822
8 28719
8 21332
7 7029
7 7011
7 4355
7 33652
7 33650
7 25490
7 15500
7 14910
7 12705
7 11492
7 10796
6 7065
6 6939
6 5600
6 36727
6 29328
6 21508
5 7757
5 7016
5 6767
5 6181
5 4574
5 41733
5 35531
5 28702
5 25513
5 25133
5 22258
5 21479
5 18566
5 12530
5 11456
4 9142
4 52
4 4181
4 3737
4 35123
4 33588
4 31224
4 25405
4 25100
4 21256
4 21017
4 20231
4 13432
4 13367
4 12390
4 12380
4 12262
4 11530
3 8615
3 7843
3 6300
3 6079
3 42471
3 39660
3 39084
3 38951
3 34143
3 33660
3 33490
3 26611
3 25521
3 2379
3 20485
3 20057
3 174
3 17184
3 15582
3 12576
3 1239
3 12270
3 11272
3 11060
2 8897
2 8732
2 8622
2 855
2 8426
2 8401
2 7849
2 7459
2 7385
2 5778
2 47165
2 44775
2 44552
2 4323
2 42610
2 42574
2 42396
2 42387
2 39608
2 39054
2 39047
2 35816
2 35728
2 34797
2 34092
2 33934
2 33662
2 3261
2 3216
2 31499
2 31133
2 30955
2 30263
2 29737
2 25994
2 25436
2 2529
2 25135
2 24810
2 2386
2 23504
2 21488
2 21438
2 21327
2 20875
2 18712
2 18494
2 1785
2 17049
2 15658
2 15206
2 14390
2 14051
2 13188
2 12668
2 12247
2 11976
2 11650
2 11525
2 11509
1 8920
1 8744
1 8681
1 8595
1 8570
1 8546
1 8492
1 8342
1 8334
1 8291
1 8190
1 8001
1 7397
1 72
1 7017
1 6983
1 6854
1 6423
1 6372
1 6325
1 6106
1 600
1 5760
1 5742
1 5563
1 5056
1 4922
1 48711
1 47582
1 46262
1 46115
1 4511
1 45044
1 43967
1 43815
1 43103
1 43022
1 43011
1 42945
1 42765
1 42714
1 42590
1 42512
1 42335
1 41925
1 41875
1 41302
1 4043
1 40385
1 40312
1 40309
1 40307
1 40285
1 39696
1 39633
1 39027
1 38958
1 3801
1 3729
1 35891
1 35810
1 35807
1 35510
1 35389
1 35320
1 35154
1 34974
1 34865
1 34743
1 34700
1 34331
1 34323
1 34266
1 34248
1 34187
1 34168
1 34137
1 34056
1 34038
1 33749
1 33636
1 33545
1 3354
1 33444
1 32855
1 32806
1 32554
1 3226
1 32119
1 32107
1 31514
1 31213
1 30977
1 30749
1 3058
1 30305
1 30251
1 29895
1 29456
1 29209
1 29190
1 29124
1 29107
1 29034
1 28840
1 2878
1 2828
1 27364
1 27288
1 27264
1 27202
1 26935
1 26860
1 26554
1 26292
1 25969
1 2572
1 25671
1 25500
1 25478
1 25386
1 25310
1 24932
1 22759
1 22561
1 22318
1 22192
1 21745
1 21694
1 21565
1 21414
1 21127
1 21106
1 21011
1 20950
1 20934
1 20895
1 20807
1 20257
1 19792
1 19779
1 19464
1 18990
1 18687
1 1761
1 1751
1 17014
1 17
1 16966
1 16904
1 16810
1 1678
1 16718
1 16526
1 16424
1 16399
1 16223
1 16064
1 15738
1 15713
1 15595
1 15463
1 15105
1 14855
1 14710
1 14676
1 14543
1 14161
1 13760
1 13576
1 13208
1 13122
1 13056
1 13037
1 12998
1 12788
1 12742
1 1273
1 12708
1 12593
1 12513
1 12389
1 12208
1 12177
1 12097
1 12083
1 12064
1 11961
1 11796
1 11606
1 11279
1 11215
1 10823
1 10311
1 10242
More information about the nsp-security
mailing list