[leeno]

Live CnC Guest Login url for smokeloader

regmexicooo1.ru/ura/guest.php
razorbladesfuture.ru/images/guest.php
beaufortseaa139.ru/qad/guest.php

[Xylitol]

Admin login: /control.php
The header of razorbladesfuture.ru and regmexicooo1.ru are different "smoke bot"

Code: Select all

http://razorbladesfuture.ru/images/imgs/header.png

this one is a smoke bot:

Code: Select all

http://beaufortseaa139.ru/qad/imgs/header.png

Anyway smoke bot or smoke loader have the same structure, or a difference.. smoke loader have a 'footer.png' when smoke bot don't have one.

[Xylitol]

Smoke Bot from Gold Installs affiliate.

[Xylitol]

GET /tmp/index.php?cmd=getload&login=783083C3BA00BE137&file=0&sel=77777
Host: italydveris.eu
• dns: 1 ›› ip: 91.217.162.45 - adresse: ITALYDVERIS.EU

https://www.virustotal.com/file/857fc7a ... /analysis/
Smoke Loader

[leeno]

http://derpderpderp.com/adminpanel/control.php
http://swellclub.com/stats/control.php

[marnie]

smoke 04.2016 leak (exe; plugins; panel)

[defiance.ssl]

smoke 04.2016 leak (exe; plugins; panel)

Attach pass: infected
smoke.7z pass: B_I_R_T_H_D_A_Y