Andromeda bot

Come from a Keitaro TDS: http://urlquery.net/report.php?id=756624

 Lead on: ald-facebook.co.uk/operations/outer_band_remote.php
Payload: http://vxvault.siri-urz.net/ViriFiche.php?ID=22729

Andromeda 2.6, probably made by the Andromeda builder

Bots:

Blacklist:

Task:

output.exe is SpyEye, pass for config: FD0CCB937D91AD7355A4B072D91EB1B8
Second file is Sirefef CLSID edition.

Edit task:

Service:

Socks:

Formgrabber:

Nothing really interesting at all.

SUTRA TDS v3.4

This TDS is used to lead on BlackHole exploit kit (and BH lead on FakePoliceAlert)

Edition:

Global variables:

Pre-rule:

Settings:

Statistics:

BlackHole 1.2.1: 6gf5d6gs896f5gd.nl.ai
• dns:1 » ip: 109.236.81.243 - adresse: 6GF5D6GS896F5GD.NL.AI
• dns:1 » ip: 109.236.81.243 - adresse: GF6S896GS76GS07676666.NL.AI

A file of October:

66k hits mainly from USA/UK in one day (And the guys did 2 stats resets before):

another (hacked) SUTRA TDS v3.3, Leading also on Blackhole:

Uptime bot:

Total:

1003k hits in one day.

Simple TDS v1.3beta

TDS found on a pornsite.
Appear 5 times in Clean-mx

Main:

Stats:

Daily stats:

Settings: