One of our readers informs that a site called Fireboys.com is spewing some banking Trojan attacks.
The malware site fireboys.com has one IP number (66.96.130.133) , but the reverse is 133.130.96.66.static.eigbox.net, Berner.org and fabcor.com point to the same IP and also shares name servers. Bizfit.net, atmainteractive.com, vitalwellnessinc.com, mybimmer.com, reincarnationforte.net and at least 200 other hosts point to the same IP.
Malware Site:
hxxp://fireboys.com
IP: 66.96.130.133
Malware Found:
- Trojans Zeus/Zbot
- Backdoor attacks.
- Command and Control
Suspicious Files:
- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer
- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012009070220090703\index.dat
- c:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\disclaimer-reg_09[1].gif
- c:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WDUF49AN\fireboys[1].htm
Host names sharing IP with A records (219) - go to Robtex to see the entire list.
- aboutlimo.com
- abstractbay.com
- adventuresofary.net
- allchoiceins.com
- americanhominsp.com
- andeverythingnice.net
- arenalrealestatedevelopment.com
- bioaspect.com
- bizfit.net
- bluegrasspainmanagement.com
- bulldoghockey.net
- buyahomeinbocaraton.com
- commentsusa.com
- crosspaint.com
- davidfhardy.com
- designfordesign.net
- disenoyfotos.com
- dlnews.net
- editorialnote.net
- filmasylum.net
- fireboys.com
- firewok.com
- floridasleepinns.com
- frankwykoff1.com
- frederickprecast.com
- mtinstruments.com
- nrgpublications.com
- oceaner.net
- oceangrovecondos.com
- offdutycharters.net
- officeanesthesiology.com
- officialsos.net
- robertmoylan.com
- rollyrichert.com
- rslfinancial.com
- seankirklin.com
- secretpokerclub.net
- tangfamily.net
- taxkool.com
- unlimitedsightandsound.com
- webpagesbybob.com
- winkinglizardproductions.com
- wiraonline.com
- wonalancet.net
- www.swat-clan.net
- yahooindian.com
- zebella.com
Advertisement
