SHARE
TWEET

BHEK2 PluginDetect 0.7.9 IP base History: reff: hamasutra.ru

MalwareMustDie Nov 22nd, 2012 156 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ===========================================================================
  2. #MalwareMustDie | Thu Nov 22 19:26:39 JST 2012
  3. Title: BHEK2 PluginDetect 0.7.9 IP base History: reff: hamasutra.ru
  4. Following Case: Blackhole v2
  5. w/ Obfuscated PluginDetect 0.7.9
  6. Infection by email case: http://pastebin.com/raw.php?i=JLeHk54m
  7. Starting by domain of: http://pastebin.com/raw.php?i=ALkcHW2B
  8. Leading IPs: 82.165.193.26, 202.180.221.186, 203.80.16.81, 216.24.196.66
  9. Cross Reference check with the UrlQuerry Database
  10. ===========================================================================
  11.  
  12. ====================================
  13. 202.180.221.186 [Mongolia]
  14. ====================================
  15. 2012-11-21 23:28:53/ http://hamasutra.ru:8080/forum/links/column.php?cqziigb=33:2v:1h:2w:1m     202.180.221.186 [Mongolia]
  16. 2012-11-21 20:04:55/ http://hamasutra.ru:8080/forum/links/column.php                            202.180.221.186 [Mongolia]
  17. 2012-11-21 00:39:18/ http://ionalio.ru:8080/forum/links/public_version.php                      202.180.221.186 [Mongolia]
  18. 2012-11-20 23:08:29/ http://investinindia.ru:8080/forum/links/news.php                          202.180.221.186 [Mongolia]
  19. 2012-11-20 21:45:05/ http://hamasutra.ru                                                        202.180.221.186 [Mongolia]
  20. 2012-11-20 13:17:27/ http://hamasutra.ru:8080/forum/links/column.php                            202.180.221.186 [Mongolia]
  21. 2012-11-20 12:32:06/ http://hamasutra.ru:8080/forum/links/column.php                            202.180.221.186 [Mongolia]
  22. 2012-11-17 00:36:14/ http://202.180.221.186:8080/forum/links/column.php                         202.180.221.186 [Mongolia]
  23. 2012-11-15 19:49:33/ http://investomanio.ru/forum/links/public_version.php                      202.180.221.186 [Mongolia]
  24. 2012-11-15 16:19:58/ http://feronialopam.ru:8080/forum/links/column.php                         202.180.221.186 [Mongolia]
  25. 2012-11-15 16:15:32/ http://feronialopam.ru:8080/forum/links/column.php                         202.180.221.186 [Mongolia]
  26. 2012-11-15 15:59:56/ http://feronialopam.ru:8080/forum/links/column.php                         202.180.221.186 [Mongolia]
  27. 2012-11-15 14:51:36/ http://feronialopam.ru/                                                    202.180.221.186 [Mongolia]
  28. 2012-11-15 04:40:06/ http://veneziolo.ru/forum/links/column.php                                 202.180.221.186 [Mongolia]
  29. 2012-11-15 03:18:07/ http://lentuiax.ru:8080/forum/links/column.php                             202.180.221.186 [Mongolia]
  30. 2012-11-15 00:56:50/ http://monacofrm.ru:8080/forum/links/column.php                            202.180.221.186 [Mongolia]
  31. 2012-11-14 02:17:35/ http://veneziolo.ru:8080/forum/links/column.php                            202.180.221.186 [Mongolia]
  32. 2012-11-13 19:57:44/ http://monacofrm.ru                                                        202.180.221.186 [Mongolia]
  33. 2012-11-13 16:02:24/ http://monacofrm.ru                                                        202.180.221.186 [Mongolia]
  34. 2012-11-13 15:22:53/ http://monacofrm.ru:8080/forum/links/column.php                            202.180.221.186 [Mongolia]
  35. 2012-11-12 10:58:07/ http://canadianpanakota.ru:8080/forum/links/column.php                     202.180.221.186 [Mongolia]
  36. 2012-11-11 00:32:29/ http://canadianpanakota.ru:8080/forum/links/column.php                     202.180.221.186 [Mongolia]
  37. 2012-11-11 00:09:02/ http://canadianpanakota.ru:8080/forum/links/column.php?atcpv=1n:1h:1f:1o:1g 202.180.221.186[Mongolia]
  38. 2012-11-10 21:52:51/ http://canadianpanakota.ru:8080/forum/links/column.php                     202.180.221.186 [Mongolia]
  39. 2012-11-09 21:39:11/ http://canadianpanakota.ru:8080/forum/links/column.php                     202.180.221.186 [Mongolia]
  40. 2012-11-09 16:07:07/ http://canadianpanakota.ru:8080/forum/links/column.php                     202.180.221.186 [Mongolia]
  41. 2012-11-09 15:00:17/ http://canadianpanakota.ru:8080/forum/links/column.php                     202.180.221.186 [Mongolia]
  42. 2012-11-08 18:08:20/ http://moneymakergrow.ru:8080/forum/links/column.php                       202.180.221.186 [Mongolia]
  43.  
  44. ====================================
  45. 203.80.16.81    [Malaysia]
  46. ====================================
  47. 2012-11-22 03:09:08/ http://ionalio.ru:8080/forum/links/public_version.php                      203.80.16.81    [Malaysia]
  48. 2012-11-21 22:56:26/ http://hamasutra.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  49. 2012-11-21 20:41:32/ http://hamasutra.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  50. 2012-11-21 17:56:57/ http://analunakis.ru:8080/forum/data/spn2.jar                              203.80.16.81    [Malaysia]
  51. 2012-11-21 15:59:54/ http://analunakis.ru:8080/forum/links/column.php                           203.80.16.81    [Malaysia]
  52. 2012-11-20 16:54:26/ http://hamasutra.ru                                                        203.80.16.81    [Malaysia]
  53. 2012-11-20 04:10:34/ http://ionalio.ru:8080/forum/links/public_version.php                      203.80.16.81    [Malaysia]
  54. 2012-11-19 16:13:11/ http://bamanaco.ru:8080/forum/links/column.php                             203.80.16.81    [Malaysia]
  55. 2012-11-18 14:25:25/ http://203.80.16.81:8080/forum/data/t.pdf                                  203.80.16.81    [Malaysia]
  56. 2012-11-16 21:07:44/ http://investomanio.ru:8080/forum/links/public_version.php                 203.80.16.81    [Malaysia]
  57. 2012-11-16 20:43:40/ http://investomanio.ru:8080/forum/links/public_version.php                 203.80.16.81    [Malaysia]
  58. 2012-11-16 20:41:51/ http://investomanio.ru:8080/forum/links/public_version.php?hf=2w:32:2w:1i:3 (...)  203.80.16.81    [Malaysia]
  59. 2012-11-16 13:50:35/ http://feronialopam.ru/forum/links/column.php                              203.80.16.81    [Malaysia]
  60. 2012-11-16 10:00:17/ http://203.80.16.81/forum/links/column.php                                 203.80.16.81    [Malaysia]
  61. 2012-11-15 16:33:56/ http://feronialopam.ru/forum/links/column.php                              203.80.16.81    [Malaysia]
  62. 2012-11-15 11:20:20/ http://veneziolo.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  63. 2012-11-15 08:02:38/ http://veneziolo.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  64. 2012-11-14 20:29:29/ http://lentuiax.ru:8080/forum/links/column.php                             203.80.16.81    [Malaysia]
  65. 2012-11-14 18:55:38/ http://203.80.16.81:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  66. 2012-11-14 16:33:23/ http://monacofrm.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  67. 2012-11-14 14:54:58/ http://veneziolo.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  68. 2012-11-14 14:32:48/ http://veneziolo.ru/forum/links/column.php                                 203.80.16.81    [Malaysia]
  69. 2012-11-14 06:55:54/ http://veneziolo.ru:8080/forum/links/column.php                            203.80.16.81    [Malaysia]
  70. 2012-11-13 22:59:24/ http://monacofrm.ru/                                                       203.80.16.81    [Malaysia]
  71. 2012-11-13 22:47:07/ http://203.80.16.81                                                        203.80.16.81    [Malaysia]
  72. 2012-11-13 18:00:46/ http://monacofrm.ru                                                        203.80.16.81    [Malaysia]
  73. 2012-11-13 14:43:49/ http://monacofrm.ru:8080/forum//data/spn2.jar                              203.80.16.81    [Malaysia]
  74. 2012-11-13 13:54:03/ http://monacofrm.ru:8080/forum/data/spn2.jar                               203.80.16.81    [Malaysia]
  75. 2012-11-11 15:46:52/ http://lemonadiom.ru:8080/forum/links/news.php?wf=30:30:1o:32:1m&ye (...)      203.80.16.81    [Malaysia]
  76. 2012-11-11 02:20:31/ http://canadianpanakota.ru:8080/forum/links/column.php                     203.80.16.81    [Malaysia]
  77. 2012-11-08 18:33:49/ http://moneymakergrow.ru:8080/forum/links/column.php                       203.80.16.81    [Malaysia]
  78. 2012-11-07 16:58:44/ http://peneloipin.ru:8080/forum/links/column.php                           203.80.16.81    [Malaysia]
  79. 2012-11-06 03:15:45/ http://forumibiza.ru:8080                                                  203.80.16.81    [Malaysia]
  80. 2012-11-05 21:58:18/ http://lemonadiom.ru                                                       203.80.16.81    [Malaysia]
  81. 2012-11-05 20:44:01/ http://203.80.16.81                                                        203.80.16.81    [Malaysia]
  82. 2012-11-05 16:13:06/ http://forumibiza.ru                                                       203.80.16.81    [Malaysia]
  83. 2012-11-05 15:10:54/ http://forumibiza.ru:8080/forum/links/column.php?fwovihf=0b33073336        203.80.16.81    [Malaysia]
  84. 2012-11-05 13:27:48/ http://forumibiza.ru:8080/forum/links/column.php                           203.80.16.81    [Malaysia]
  85. 2012-11-02 21:48:23/ http://kiladopje.ru:8080                                                   203.80.16.81    [Malaysia]
  86. 2012-11-01 18:46:54/ http://fionadix.ru:8080/forum/links/column.php?skbm=3833043409             203.80.16.81    [Malaysia]
  87. 2012-11-01 17:06:56/ http://donkihotik.ru:8080/forum/links/column.php                           203.80.16.81    [Malaysia]
  88. 2012-11-01 15:52:36/ http://lemonadiom.ru:8080/forum/links/public_version.php?sipxpbtc=343734053 (...)  203.80.16.81    [Malaysia]
  89. 2012-11-01 14:33:33/ http://panacealeon.ru                                                      203.80.16.81    [Malaysia]
  90. 2012-11-01 14:30:56/ http://panacealeon.ru:8080/forum/links/column.php                          203.80.16.81    [Malaysia]
  91. 2012-11-01 14:24:41/ http://lemonadiom.ru:8080/forum/links/public_version.php                   203.80.16.81    [Malaysia]
  92. 2012-10-31 17:14:41/ http://panalkinew.ru:8080/forum/links/column.php                           203.80.16.81    [Malaysia]
  93. 2012-10-31 14:57:02/ http://203.80.16.81                                                        203.80.16.81    [Malaysia]
  94. 2012-10-31 12:47:44/ http://fionadix.ru:8080/forum/links/column.php                             203.80.16.81    [Malaysia]
  95. 2012-10-31 10:44:52/ http://panalkinew.ru:8080/forum/links/column.php                           203.80.16.81    [Malaysia]
  96. 2012-10-31 07:30:41/ http://fidelocastroo.ru:8080/forum/links/column.php                        203.80.16.81    [Malaysia]
  97.  
  98. ====================================
  99. 216.24.196.66   [United States]
  100. ====================================
  101. 2012-11-22 03:20:15/ http://ionalio.ru/forum/links/public_version.php                           216.24.196.66   [United States]
  102. 2012-11-22 00:39:32/ http://hamasutra.ru/                                                       216.24.196.66   [United States]
  103. 2012-11-21 23:02:43/ http://hamasutra.ru:8080/forum/links/column.php?zmx=33:32:31:30:1n& (...)      216.24.196.66   [United States]
  104. 2012-11-21 00:10:04/ http://ionalio.ru:8080/forum/links/public_version.php                      216.24.196.66   [United States]
  105. 2012-11-20 15:43:08/ http://216.24.196.66:8080/forum/links/public_version.php                   216.24.196.66   [United States]
  106. 2012-11-20 15:41:46/ http://216.24.196.66:8080/forum/links/public_version.php                   216.24.196.66   [United States]
  107. 2012-11-20 15:06:09/ http://hamasutra.ru:8080/forum/links/column.php                            216.24.196.66   [United States]
  108. 2012-11-19 23:34:30/ http://fanatiaono.ru:8080/forum/links/column.php                           216.24.196.66   [United States]
  109. 2012-11-19 21:08:47/ http://investinindia.ru:8080/forum/links/news.php                          216.24.196.66   [United States]
  110. 2012-11-19 20:48:51/ http://ionalio.ru:8080/forum/links/public_version.php                      216.24.196.66   [United States]
  111. 2012-11-19 16:46:39/ http://bamanaco.ru:8080/forum/links/column.php                             216.24.196.66   [United States]
  112. 2012-11-19 14:23:12/ http://bamanaco.ru:8080/forum/links/column.php                             216.24.196.66   [United States]
  113. 2012-11-19 12:44:46/ http://monacofrm.ru:8080/forum/links/column.php                            216.24.196.66   [United States]
  114. 2012-11-19 07:34:11/ http://investomanio.ru:8080/forum/links/public_version.php                 216.24.196.66   [United States]
  115.  
  116. ====================================
  117. 82.165.193.26   [Germany]
  118. ====================================
  119. 2012-11-22 10:04:41/ http://ionalio.ru:8080                                                     82.165.193.26   [Germany]
  120. 2012-11-21 18:43:29/ http://ionalio.ru:8080/forum/links/public_version.php                      82.165.193.26   [Germany]
  121. 2012-11-21 16:49:01/ http://analunakis.ru:8080/forum/links/column.php                           82.165.193.26   [Germany]
  122. 2012-11-21 16:47:43/ http://analunakis.ru:8080/forum/links/column.php                           82.165.193.26   [Germany]
  123. 2012-11-20 23:07:33/ http://investinindia.ru:8080/forum/links/news.php                          82.165.193.26   [Germany]
  124. 2012-11-20 19:38:32/ http://hamasutra.ru/                                                       82.165.193.26   [Germany]
  125. 2012-11-20 15:32:46/ http://hamasutra.ru                                                        82.165.193.26   [Germany]
  126. 2012-11-20 11:25:58/ http://ionalio.ru:8080/forum/links/public_version                          82.165.193.26   [Germany]
  127.  
  128. ---
  129. #MalwareMustDie
  130. @unixfreaxjp ~]$ date
  131. Thu Nov 22 19:26:39 JST 2012
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top