[nsp-sec] ZeuS botnet (s288421667.onlinehome.us)

[Smith, Donald]

Thanks Tom, I wish we could get this for all of the reports but I realize it isn't generally available.


(coffee != sleep) & (!coffee == sleep)
Donald.Smith at qwest.com gcia   

> -----Original Message-----
> From: Tom Fischer [mailto:tfischer at bfk.de] 
> Sent: Wednesday, June 10, 2009 5:13 AM
> To: Smith, Donald; nsp-security at puck.nether.net
> Subject: Re: [nsp-sec] ZeuS botnet (s288421667.onlinehome.us)
> 
> Hi,
> 
> On Tue, Jun 09, 2009 at 03:24:11PM -0600, Smith, Donald wrote:
> > Dirk, your "unique bot ID" appears to be windows host names 
> is that correct?
> 
> yes, the first part of the ZeuS unique bot ID is the windows host name
> 
> -- 
> Tom Fischer
> BFK edv-consulting GmbH                  tel: +49 721 962 01-1
> Kriegsstr. 100, D-76133 Karlsruhe        fax: +49 721 962 01-99
>