Gold Installs Affiliate

Advert:

ICQ:

Login:

News:

EXE:

AV test (FUD):

Withdraw:

Profile:

FAQ:

0/42 according to VT:

The EXE downloaded from the panel "653b009465_127_u.exe" is a downloader/loader with a primitive RunPE and some anti-vm:

 Download files:

Downloaded file 'id.exe' is just here to update gold installs statistic:

'sm.exe' is a Smoke Bot and for asd.exe the file don't exist on the server...

• dns: 1 ›› ip: 91.218.38.153 - adresse: GAMEFANS.EU
• dns: 1 ›› ip: 91.218.38.153 - adresse: BCIOJEZTEUUEBX.IN
http://bciojezteuuebx.in/syst/guest.php
http://bciojezteuuebx.in/syst/control.php
http://bciojezteuuebx.in/ftp/ppi/127/id.exe
http://bciojezteuuebx.in/ftp/ppi/127/sm.exe
http://bciojezteuuebx.in/asd.exe

• dns: 1 ›› ip: 46.4.51.177 - adresse: GOLDINSTALLS.ORG

End of Eva... "what the f@#$ did i just watch?!"