Friday, May 9, 2014

saudeodontos.com.br - Citadel

Citadel botnet C&C server listed on ZeuS Tracker

https://zeustracker.abuse.ch/monitor.php?host=saudeodontos.com.br

saudeodontos.com.br
200.98.246.214
inetnum:     200.98/16
aut-num:     AS15201
abuse-c:     SEO50
owner:       Universo Online S.A.
ownerid:     001.109.184/0001-95
responsible: Contato da Entidade UOL
country:     BR




Login:


Home 
(132 bots)







Scripts
user_execute hxxp://hopper.nl/images/2014/1/droper.exe
user_execute hxxp://hopper.nl/images/2014/1/1.exe


https://malwr.com/analysis/MWYyOGZkYTA0N2FhNDE4YmI4NjljZGU5Nzc0Mjc3Yjc/
https://malwr.com/analysis/ZjJmZWU0NzNhNDZlNDdlZDhlNTRlYzBjYzEzNzY1ODM/



Encryption Key:
78fghrYU%^&$ER

Same encryption key observed here:
http://protectyournet.blogspot.com/2014/05/saudevitalsuplementoscom-citadel.html

No comments:

Post a Comment