ParallaxRAT botnet controller @51.195.57.232

The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.

Malware botnet controller located at 51.195.57.232 on port 6080 TCP:
$ telnet 51.195.57.232 6080
Trying 51.195.57.232…
Connected to 51.195.57.232.
Escape character is ‘^]’

$ nslookup 51.195.57.232
ip232.ip-51-195-57.eu

Other malicious domain names hosted on this IP address:
allplainbartatibotr.com 51.195.57.232
amimegutadowntown.com 51.195.57.232
bazerasedazacnetw139.xyz 51.195.57.232
caxxospmparllxmigo.nl 51.195.57.232
inpsaslimutari.com 51.195.57.232
xaoxiamiokongtantwrspm.pro 51.195.57.232

Referencing malware samples (MD5 hash):
0efa8a4dc07cb2c18fa24035bf9388cf — AV detection: 2 / 67 (2.99%)
3232987f96ad8580ed62455d1e95df42 — AV detection: 7 / 68 (10.29%)
51d43d2127ed77d3067acd0e91c45dcc — AV detection: 19 / 66 (28.79%)
52245de0b67a49befe656dec74b9344f — AV detection: 5 / 70 (7.14%)
65a0ec476aaefcf6aeb328ac1641ed29 — AV detection: 38 / 68 (55.88%)
69113dd327820ae7bff3419bfdb28873 — AV detection: 7 / 67 (10.45%)

Опубликовано
В рубрике ovh.net

Добавить комментарий

Ваш адрес email не будет опубликован. Обязательные поля помечены *