Back to the Citi malware

显示全部楼层 · 发表于 2012-5-11 10:20:42

http://blog.sparktrust.com/?p=986

VT

0/42

A successful infection loads the following:
tradifrance.net/NGxo03v6/index.html
urbannex.co.za/SVVsEJwY/js.js
shokani.net/YvKDGVwn/js.js
69.194.194.90/showthread.php?t=4a6d866826776084
69.194.194.90/favicon.ico
69.194.194.90/Cal.jar
69.194.194.90/data/hcp_vbs.php?f=0cf26&d=0
69.194.194.90/q.php?f=0cf26&e=0
69.194.194.90/q.php?e=5&f=0cf26

显示全部楼层 · 发表于 2012-5-11 10:51:25

显示全部楼层 · 发表于 2012-5-11 10:52:28

jack827 发表于 2012-5-11 10:51

5 hours, 8 minutes ago

显示全部楼层 · 发表于 2012-5-11 10:56:05

360Tencent 发表于 2012-5-11 10:52
5 hours, 8 minutes ago

69.194.194.90/Cal.jar 現在已失效,無法下載

要不你把檔案貼上來

[转载] Back to the Citi malware