[unixfreaxjp]

GoARMBot for ARM x32 served by ChinaZ scums.
Attacker is 61.160.213.242 / AS23650 AS Number for CHINANET jiangsu

CNC is hostname basis:

Code: Select all

china.28zst.cn has address 61.160.213.242 port 6004
(same address as attacker) 

A chance to test my cnc cracker:

This is the asshole:

Code: Select all

$ checkreg 28zst.cn
Registrant Contact Email: scancesi@163.com

Sample: https://www.virustotal.com/en/file/361c ... 444862425/
#MalwareMUSTDie!

[unixfreaxjp]

The ChinaZ gangs is still playing w/ GoARM Bot:

Here's the attack IP & log, panel, & CNC IP domains/subdomains they use..

SUSPECTED ACTOR is at yumingchushou5@126.com < Yeah, I POINTED at you. It's time to change email address as usual is it? Go make some.

Sample:
https://www.virustotal.com/en/file/b27f ... /analysis/

#MalwareMustDie!

[unixfreaxjp]

all CNC are in port 6004 at below hosts:
scan1.28zst.cn(211.149.174.81)AS38283 CHINANET SiChuan TelecomIDC
scana.28zst.cn(222.186.15.16)AS23650 CHINANET jiangsu
scanb.28zst.cn(222.186.30.160)AS23650 CHINANET jiangsu

Samples & more details info in VT comments..
https://virustotal.com/en/file/2ac91f9b ... 446635967/ …
https://www.virustotal.com/en/file/b9c5 ... 446635984/ …
https://www.virustotal.com/en/file/0be9 ... 446635998/ …

[Blaze]

Three more.

xy.weimiii.com (222.186.3.218) AS23650 CHINANET jiangsu

https://www.virustotal.com/en/file/b320 ... 447344009/
https://www.virustotal.com/en/file/364f ... 447344014/
https://www.virustotal.com/en/file/4ccf ... 447344020/

[unixfreaxjp]

I bet is a same actor as http://www.kernelmode.info/forum/viewto ... =10#p27143
Port 6004. aiming ARM routers 32bit. Compiled in EABI5v1 mode. CNC is hardcoded ip.
https://www.virustotal.com/en/file/060a ... 455608935/

#MalwareMustDie!