[nsp-sec] Koobface C&Cs

[Thomas Hungenberg]

Forwarded to nsp-sec with permission from Morten:

----------------------------------------------------------------
Hi all,

I've attached a list of urls that setup.exe/ld14.exe phones home to
(POST /.sys/?action=ldgen&v=14).

All hosts were confirmed active few minutes ago.


Best regards,
Morten
----------------------------------------------------------------

Format: ASN | CC | IP | Koobface C&C URL


     - Thomas

CERT-Bund Incident Response & Anti-Malware Team

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: koobface_20090917.txt
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20090917/0ef01214/attachment-0001.txt>