[R136a1]

Hi there,

for info see:
https://www.securelist.com/en/blog/861/ ... _Trojans_2
https://www.symantec.com/security_respo ... 99&tabid=2

Samples:
https://www.virustotal.com/en/file/1872 ... /analysis/
https://www.virustotal.com/en/file/516d ... /analysis/
https://www.virustotal.com/en/file/10f4 ... /analysis/
https://www.virustotal.com/en/file/afa1 ... /analysis/
https://www.virustotal.com/en/file/c625 ... /analysis/
https://www.virustotal.com/en/file/1047 ... /analysis/

C&C servers (URLs):
_http://176.53.17.46/site1/client.php (176-53-17-46.turkrdns.com)
_http://31.210.110.228/site1/client.php (comintbcst.info)
_http://5.135.188.15/site1/client.php (ks3292799.kimsufi.com)


Maybe someone has the samples.

[Xylitol]

C&C login: _http://5.135.188.15/site1/k/login
open dir: _http://5.135.188.15/site1/models/
pma: _http://5.135.188.15/phpmyadmin/setup/