CNC analysis of Citadel Trojan Bot-Agent - Part 2: Understanding its stealer functionalities by decoding the configs
25 Apr 2013 Following the previous Citadel Analysis we wrote-->>[HERE], we received so many requests & questions like:What encryption was used?
What is actually written in the config?
What has been downloaded? and sent?
And most of all, where's the CnC?
Friends, thank you very much for asking the above questions, and for your patience in waiting the answer. Once dealing with the Trojan banker the sensitivity of information is higher than other PWS, specially to the real "live" case like this disclosure. But don't worry, we won't leave the analysis unfinished & this case is followed properly.
Let's make it short, after long discussion with authority involved + with anonymous malware crusaders (which I respect very much, with thank's for the great help) finally we have every permission needed to release these "limited" information due to answering the questions and for raising malware awareness purpose.
Please bear with my writings, I a not a writer by default.. Well, OK. here we go..
How was it decoded?
What I can explain in answering this is: Dealing with encryption, the key must be saved in the system overall as a binary form somewhere, which is accessible to the malware in exact-unchanged location, hopefully unnoticed to researchers. So, by the possibility, the only legendary place used to save those kind of data is the registry. And, seeing the binary reversing result showing so many registry and crypto access used to a certain place, making this deduction becoming a solid hint.
Moving forward, in our case that data had been saved in the registry as per Cryptography RNG Seed data of the below rows
↑This is going to be the 8 rows of 32bits data(key) which lead to the AES/256 encryption used for the configuration files of citadel. This is a little surprising me since my reference showing me the usage of AES/128 instead.. well, things are indeed evolved, so does malware.
1F 01 A1 E2 6D 40 DD A2 F0 E5 7C B3 7C FA 8A 14
93 89 C1 90 F9 F2 CE DB 72 D3 C9 79 C7 2E FA 14
[...]
[...]
[...]
5E FA 48 5A D4 32 F7 25 CC C3 AD 03 ED 07 EC 4F
// I am forbidden to point the exact location (yet)
For the data sent to the motherships is the different story, the additionally RC4 is used to crypt the those sent data.
The reason for these encrypted method is predictable, first, for not making the config & sent information so crack-able unless you understand Citadel (or ZeuS) encryption concept, and, secondly is, to prevent the binary RE & Forensics analysis for decoding the "SHOWN" data.
For instance, what I saw in Citadel's binary is practically not so many info can be used as crime investigation evidence itself, thus as we went to the memory analysis to find that memory was fed up with config encrypted data and transmission data (was handled by same binary) which was hard to separate which goes to where,
Yes, I know you have another "more" tons of questions for this section. We are very sorry, that we cannot write more info in the blog, but please follow to the next sections and you will see how the logic flow, OR just contact us by email.
Config File
Please refer to the previous post, you'll find the config file which was in the mentioned folder with the quick snapshot picture over there, after being downloaded soon on post-infection stage.
Depends on your timing in downloading the configuration file (see the downloaded binary data in traffic captured AFTER infection), there is possibility you get the different config data.
The config data itself WE separated into settings, handles upon captures TAG & JSON format, with additionally injected stealer/phishing forms.
Additionally, please be noted that "Both the JSON and Configuration headers were generated by a research tool which outputs the configuration headers, field descriptions, and JSON code. To avoid confusion (for those familiar with Zeus/Citadel already) this is not a new Citadel version and Citadel itself doesn't use JSON format internally. "
In our case, the config data was decoded to have the below explanatory summary by our analysis, please see well row by row for it may contain important information for you.
The configuration headers
[LAST_VERSION: versionid] 1.3.5.1
The series of CnC with separated functions
The trojan updated setting:
[LAST_VERSION_URL: UpdateEXE] h00p://www.keihingroup.co.jp/libraries/joomla/access/file.php|file=4mar.exeList of the CnC urls/landing page:
[URL_SERVER_0: C&C_URL] h00p://keximvlc.com.vn/administrator/modules/mod_menu/tmpl/content.php↑you see that we deal with the legendary "file.php" & "content.php" hacked sites...
[URL_SERVER_0: C&C_URL] h00p://oklodfmmm.com/pro/file.php
List of the configuration file download urls:
[URL_ADV_SERVERS:BackupConfig] h00p://k-k131.co.jp/administrator/templates/system/html/file.php|file=conf.binThe executed shell prompt command list:
[URL_ADV_SERVERS:BackupConfig] h00p://www.keihingroup.co.jp/libraries/joomla/access/file.php|file=conf.bin
[URL_ADV_SERVERS:BackupConfig] h00p://mobileindexstats.net/pro/file.php|file=conf.bin
[LOCAL_COMMANDS:data] hostname
[LOCAL_COMMANDS:data] tasklist
[LOCAL_COMMANDS:data] ipconfig /all
[LOCAL_COMMANDS:data] netsh firewall set opmode disable
Capture, Ignore, Keylogging,
This part is very important, the "capture functionality" of this trojan, Citadel defines which URL to be logged/captured or which others to be ignored here, also in addition: which URL to get the screenshot are also defined too.
There are mis-perception between researchers who stated that this part has ACL functionalities, but after decoded this part, is clearly proved the real actual function. In our case, this part of config was decoded as follows:
[HTTP_FILTER:capture] #*wellsfargo.com/*What we can analyze after seeing the config above?
[HTTP_FILTER:screen_capture] @*payment.com/*
[HTTP_FILTER:ignore] !http://*.com/*.jpg
[HTTP_FILTER:capture] #*adelaidebank.com/*
[HTTP_FILTER:capture] #*anz.com/*
[HTTP_FILTER:capture] #*boq.com.au/*
[HTTP_FILTER:capture] #*banksa.com.au/*
[HTTP_FILTER:capture] #*bankwest.com.au/*
[HTTP_FILTER:capture] #*westpac.com.au/*
[HTTP_FILTER:capture] #*citibank.com.au/*
[HTTP_FILTER:capture] #*colonialfirststate.com.au/*
[HTTP_FILTER:capture] #*commbank.com.au/*
[HTTP_FILTER:capture] #*australia.db.com/*
[HTTP_FILTER:capture] #*ezypay.com.au/*
[HTTP_FILTER:capture] #*nab.com.au/*
[HTTP_FILTER:capture] #*suncorp.com.au/*
[HTTP_FILTER:capture] #*ibanking.stgeorge.com.au/*
[HTTP_FILTER:capture] #*ingdirect.com.au/*
[HTTP_FILTER:capture] #*mebank.com.au/*
[HTTP_FILTER:capture] #*bankers.asn.au/*
[HTTP_FILTER:capture] #*hsbc.com.au/*
[HTTP_FILTER:capture] #*macquarie.com.au/*
[HTTP_FILTER:capture] #*rba.gov.au/*
[HTTP_FILTER:capture] #*www.bankmecu.com.au/*
[HTTP_FILTER:capture] #*etrade.com.au/*
[HTTP_FILTER:capture] #*maitlandmutual.com/*
[HTTP_FILTER:capture] #*aussie.com.au/*
[HTTP_FILTER:capture] #*virginmoney.com.au/*
[HTTP_FILTER:capture] #*paydaymate.com.au/*
[HTTP_FILTER:capture] #*cashdoctors.com.au/*
[HTTP_FILTER:capture] #*cua.com.au/*
[HTTP_FILTER:capture] #*peopleschoicecu.com.au/*
[HTTP_FILTER:capture] #*cufa.com.au/*
[HTTP_FILTER:capture] #*cbh.com.au/*
[HTTP_FILTER:capture] #*hbf.com.au/*
[HTTP_FILTER:capture] #*australianunity.com.au/*
[HTTP_FILTER:capture] #*racv.com.au/*
[HTTP_FILTER:capture] #*namoicotton.com.au/*
[HTTP_FILTER:capture] #*australianunityinvestments.com.au/*
[HTTP_FILTER:capture] #*dfmc.org.au/*
[HTTP_FILTER:capture] bank.exe;java.exe
[HTTP_FILTER:capture] *facebook.com/*
Yes, Facebook, Wellsfargo.com and Australian banks were aimed, their url is clearly written in the capture function, moreover the access related to the site with URI: *payment.com will be captured and it was written the rule to ignore the ,JPG extension files of the .COM sites. The first and second deducted analysis result is self-explanatory while why Ctadel ignore the JPG is for not flooding transmitted traffic with useless image files.
Phishing code injection.
If the URL ssuccessfully captured and then what happen next? The trojan will log and additionally INJECT the malicious codes stated in the JSON format in the configuration files, with noted: if it found previously defined TARGET-ed url ones. Actually this function was seen in ZeuS (and its variant), and Citadel just keep the ZeuS original code for this part.
OK. Please see the below decoded config data:
[HTTP_INJECTS:target] *.ebay.com/*eBayISAPI.dll?*Which linked to the below next config format in JSON (showing the TARGET and logged functions:
[HTTP_INJECTS:target] */my.ebay.com/*CurrentPage=MyeBayPersonalInfo*
[HTTP_INJECTS:target] *commbiz.commbank.com.au*
[HTTP_INJECTS:target] h00ps://*.anz.com/IBAU/BANKAWAYTRAN*
[HTTP_INJECTS:target] h00ps://*.westpac.com.au/esis/Login/SrvPage*
[HTTP_INJECTS:target] h00ps://*.westpac.com.au/wtwt/startpage*
[HTTP_INJECTS:target] h00ps://*internetbanking.suncorpbank.com.au*
[HTTP_INJECTS:target] h00ps://banking*.anz.com/*
[HTTP_INJECTS:target] h00ps://ib.nab.com.au/nabib/acctInfo_acctBal.ctl*
[HTTP_INJECTS:target] h00ps://ibanking.stgeorge.com.au/InternetBanking/viewAccountPortfolio.do*
[HTTP_INJECTS:target] h00ps://internetbanking.suncorpbank.com.au*
{ "zeustargets": [{
"id": 1,
"target": "h00ps://*.westpac.com.au/esis/Login/SrvPage*"}, {
"id": 2,
"target": "h00ps://*.westpac.com.au/wtwt/startpage*"}, {
"id": 3,
"target": "h00ps://*internetbanking.suncorpbank.com.au*"}, {
"id": 4,
"target": "h00ps://banking*.anz.com/*"}, {
"id": 5,
"target": "h00ps://*.anz.com/IBAU/BANKAWAYTRAN*"}, {
"id": 6,
"target": "h00ps://*.anz.com/IBAU/BANKAWAYTRAN*"}, {
"id": 7,
"target": "h00ps://ibanking.stgeorge.com.au/InternetBanking/viewAccountPortfolio.do*"}, {
"id": 8,
"target": "h00ps://internetbanking.suncorpbank.com.au*"}, {
"id": 9,
"target": "h00ps://ib.nab.com.au/nabib/acctInfo_acctBal.ctl*"}, {
"id": 10,
"target": "*commbiz.commbank.com.au*"}, {
"id": 11,
"target": "*/my.ebay.com/*CurrentPage=MyeBayPersonalInfo*"}, {
"id": 12,
"target": "*.ebay.com/*eBayISAPI.dll?*"} ],
"c2s": ["h00p://www.keihingroup.co.jp/libraries/joomla/access/file.php|file=4mar.exe",
"h00p://keximvlc.com.vn/administrator/modules/mod_menu/tmpl/content.php",
"h00p://oklodfmmm.com/pro/file.php",
"h00p://k-k131.co.jp/administrator/templates/system/html/file.php|file=conf.bin",
"h00p://www.keihingroup.co.jp/libraries/joomla/access/file.php|file=conf.bin",
"h00p://mobileindexstats.net/pro/file.php|file=conf.bin"
],
"keylog":
["#*wellsfargo.com/*",
"#*adelaidebank.com/*",
"#*anz.com/*",
"#*boq.com.au/*",
"#*banksa.com.au/*",
"#*bankwest.com.au/*",
"#*westpac.com.au/*",
"#*citibank.com.au/*",
"#*colonialfirststate.com.au/*",
"#*commbank.com.au/*",
"#*australia.db.com/*",
"#*ezypay.com.au/*",
"#*nab.com.au/*",
"#*suncorp.com.au/*",
"#*ibanking.stgeorge.com.au/*",
"#*ingdirect.com.au/*",
"#*mebank.com.au/*",
"#*bankers.asn.au/*",
"#*hsbc.com.au/*",
"#*macquarie.com.au/*",
"#*rba.gov.au/*",
"#*www.bankmecu.com.au/*",
"#*etrade.com.au/*",
"#*maitlandmutual.com/*",
"#*aussie.com.au/*",
"#*virginmoney.com.au/*",
"#*paydaymate.com.au/*",
"#*cashdoctors.com.au/*",
"#*cua.com.au/*",
"#*peopleschoicecu.com.au/*",
"#*cufa.com.au/*",
"#*cbh.com.au/*",
"#*hbf.com.au/*",
"#*australianunity.com.au/*",
"#*racv.com.au/*",
"#*namoicotton.com.au/*",
"#*australianunityinvestments.com.au/*",
"#*dfmc.org.au/*",
"bank.exe;java.exe",
"*facebook.com/*"],
"screenshot": ["@*payment.com/*"] }
↑Wee see the java.exe or bank.exe is the filename used for the malware downloads for the targeted sites. we should noted this naming thingies, as so we note the URL used for these access, for mitigation purpose. OK. So what had been injected? The code of phishing forms like we used to see in Cridex/Fareit PWS kind of format was used to be injected upon the targeted sites, see the partial decoded TRAFFIC downloaded as per snipped codes below:
The online banking account's credential phishing traces..
[...]And..Online account's phishing traces..
"label": "current password",
"brand": 1,
"type": "pwd"
}],
Primary Email Address:
[...]
[...]
＜id="IBSum_accountName "＞
＜B＞Pending Payments＜/B＞ ＜FORM formButton=...size:90＞
＜a href="h00p://w.suncCpb4k[..]m.au/[..]/personal/i
[..]// + other URLs are all mentioned above..
＜td class="actionHeaderTopPadding" ＞Balances and Transactions("
＜!--This is required for bway:button＞
＜a href='h00p://www.anz.com/internet-banking/help/glossary/#available_funds'＞
＜td class="impInfoHeader"＞Important Information＜/td＞
Your daily Pay Anyone limit＜br＞
[..]headers="Account Name"＞
＜h2＞Payments that I have scheduled＜/h2＞
click for transaction history
＜A title="Sort by Account"＞
[..]// + other URLs are all mentioned above..
What else? AntiVirus product's updates URL Redirector
Citadel has the function to redirect the DNS request of the certain sites to be redirected into a certain IP, in the main configuration this function is often spotted to be used to redirect the antivirus upates/download urls into the Citadel's pointed sites.
In our case we found this function is used to redirect the huge list of AV products updates to the IP address: 209.85.229.104 (Google), let's see the following codes:
[DNS_REDIRECTION:data] *antivirus*=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] download.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] update.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] wfbs51-p.activeupdate.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] wfbs60-p.activeupdate.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] iau.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] licenseupdate.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] csm-as.activeupdate.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] wfbs6-icss-p.activeupdate.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] oc.activeupdate.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] update.avg.com=209.85.229.104
[DNS_REDIRECTION:data] update.grisoft.com=209.85.229.104
[DNS_REDIRECTION:data] backup.avg.cz=209.85.229.104
[DNS_REDIRECTION:data] backup.grisoft.cz=209.85.229.104
[DNS_REDIRECTION:data] files2.grisoft.cz=209.85.229.104
[DNS_REDIRECTION:data] files2.avg.cz=209.85.229.104
[DNS_REDIRECTION:data] download.grisoft.cz=209.85.229.104
[DNS_REDIRECTION:data] download.avg.cz=209.85.229.104
[DNS_REDIRECTION:data] akamai.grisoft.cz=209.85.229.104
[DNS_REDIRECTION:data] akamai.grisoft.cz.edgesuite.net=209.85.229.104
[DNS_REDIRECTION:data] akamai.avg.cz=209.85.229.104
[DNS_REDIRECTION:data] akamai.avg.cz.edgesuite.net=209.85.229.104
[DNS_REDIRECTION:data] akamai.grisoft.com=209.85.229.104
[DNS_REDIRECTION:data] akamai.avg.com=209.85.229.104
[DNS_REDIRECTION:data] akamai.grisoft.com.edgesuite.net=209.85.229.104
[DNS_REDIRECTION:data] akamai.avg.com.edgesuite.net=209.85.229.104
[DNS_REDIRECTION:data] data-cdn.mbamupdates.com=209.85.229.104
[DNS_REDIRECTION:data] su.pctools.com=209.85.229.104
[DNS_REDIRECTION:data] pctools.com=209.85.229.104
[DNS_REDIRECTION:data] download.lavasoft.com=209.85.229.104
[DNS_REDIRECTION:data] secure.lavasoft.com=209.85.229.104
[DNS_REDIRECTION:data] lavasoft.com=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.nl=209.85.229.104
[DNS_REDIRECTION:data] virustotal.com=209.85.229.104
[DNS_REDIRECTION:data] trendmicro.nl=209.85.229.104
[DNS_REDIRECTION:data] trendmicro.com.au=209.85.229.104
[DNS_REDIRECTION:data] www.trendmicro.com.au=209.85.229.104
[DNS_REDIRECTION:data] securesoft.com.au=209.85.229.104
[DNS_REDIRECTION:data] avira.com.au=209.85.229.104
[DNS_REDIRECTION:data] gratissoftwaresite.nl=209.85.229.104
[DNS_REDIRECTION:data] nod32.com.au=209.85.229.104
[DNS_REDIRECTION:data] pandasecurity.com.au=209.85.229.104
[DNS_REDIRECTION:data] lavasoft.com.au=209.85.229.104
[DNS_REDIRECTION:data] avg.com.au=209.85.229.104
[DNS_REDIRECTION:data] symantec-norton.com=209.85.229.104
[DNS_REDIRECTION:data] housecall.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] forums.malwarebytes.org=209.85.229.104
[DNS_REDIRECTION:data] malwarebytes.org=209.85.229.104
[DNS_REDIRECTION:data] pchelpforum.com=209.85.229.104
[DNS_REDIRECTION:data] pchelpforum.com=209.85.229.104
[DNS_REDIRECTION:data] forums.cnet.com=209.85.229.104
[DNS_REDIRECTION:data] techsupportforum.com=209.85.229.104
[DNS_REDIRECTION:data] gratissoftware.nu=209.85.229.104
[DNS_REDIRECTION:data] majorgeeks.com=209.85.229.104
[DNS_REDIRECTION:data] forums.pcworld.com=209.85.229.104
[DNS_REDIRECTION:data] antivirus.microbe.com.au=209.85.229.104
[DNS_REDIRECTION:data] avast.com.au=209.85.229.104
[DNS_REDIRECTION:data] avg-antivirus.com.au=209.85.229.104
[DNS_REDIRECTION:data] nortonantiviruscenter.com=209.85.229.104
[DNS_REDIRECTION:data] threatmetrix.com=209.85.229.104
[DNS_REDIRECTION:data] www.zonealarm.com=209.85.229.104
[DNS_REDIRECTION:data] firewallguide.com=209.85.229.104
[DNS_REDIRECTION:data] auditmypc.com=209.85.229.104
[DNS_REDIRECTION:data] comodo.com=209.85.229.104
[DNS_REDIRECTION:data] free-firewall.org=209.85.229.104
[DNS_REDIRECTION:data] schoonepc.nl=209.85.229.104
[DNS_REDIRECTION:data] iopus.com=209.85.229.104
[DNS_REDIRECTION:data] tucows.com=209.85.229.104
[DNS_REDIRECTION:data] avg-antivirus-plus-firewall.en.softonic.com=209.85.229.104
[DNS_REDIRECTION:data] superantispyware.com.au=209.85.229.104
[DNS_REDIRECTION:data] superantispyware.com=209.85.229.104
[DNS_REDIRECTION:data] harveynorman.com.au=209.85.229.104
[DNS_REDIRECTION:data] ca-store.com.au=209.85.229.104
[DNS_REDIRECTION:data] netfreighters.com.au=209.85.229.104
[DNS_REDIRECTION:data] securetec.com.au=209.85.229.104
[DNS_REDIRECTION:data] anti-spyware.com.au=209.85.229.104
[DNS_REDIRECTION:data] virusscan.jotti.org=209.85.229.104
[DNS_REDIRECTION:data] virscan.org=209.85.229.104
[DNS_REDIRECTION:data] antivir.ru=209.85.229.104
[DNS_REDIRECTION:data] analysis.avira.com=209.85.229.104
[DNS_REDIRECTION:data] hijackthis.de=209.85.229.104
[DNS_REDIRECTION:data] uploadmalware.com=209.85.229.104
[DNS_REDIRECTION:data] emsisoft.com=209.85.229.104
[DNS_REDIRECTION:data] kaspersky.co.uk=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.co.uk=209.85.229.104
[DNS_REDIRECTION:data] eset.co.uk=209.85.229.104
[DNS_REDIRECTION:data] webroot.com=209.85.229.104
[DNS_REDIRECTION:data] gdatasoftware.co.uk=209.85.229.104
[DNS_REDIRECTION:data] pcpro.co.uk=209.85.229.104
[DNS_REDIRECTION:data] webroot.co.uk=209.85.229.104
[DNS_REDIRECTION:data] cyprotect.com=209.85.229.104
[DNS_REDIRECTION:data] cloudantivirus.com=209.85.229.104
[DNS_REDIRECTION:data] drweb-antivir.it=209.85.229.104
[DNS_REDIRECTION:data] escanav.com=209.85.229.104
[DNS_REDIRECTION:data] clamwin.com=209.85.229.104
[DNS_REDIRECTION:data] nod32.nl=209.85.229.104
[DNS_REDIRECTION:data] webroot.nl=209.85.229.104
[DNS_REDIRECTION:data] av.eu=209.85.229.104
[DNS_REDIRECTION:data] vergelijk.nl=209.85.229.104
[DNS_REDIRECTION:data] antivirusvergelijk.nl=209.85.229.104
[DNS_REDIRECTION:data] virussen.upc.nl=209.85.229.104
[DNS_REDIRECTION:data] antivirus.startpagina.nl=209.85.229.104
[DNS_REDIRECTION:data] avastav.nl=209.85.229.104
[DNS_REDIRECTION:data] defenx.nl=209.85.229.104
[DNS_REDIRECTION:data] gdata.nl=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.nl=209.85.229.104
[DNS_REDIRECTION:data] removevirus.org=209.85.229.104
[DNS_REDIRECTION:data] windows.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] answers.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] myantispyware.com=209.85.229.104
[DNS_REDIRECTION:data] krebsonsecurity.com=209.85.229.104
[DNS_REDIRECTION:data] antivirus.about.com=209.85.229.104
[DNS_REDIRECTION:data] cleanuninstall.com=209.85.229.104
[DNS_REDIRECTION:data] staples.com=209.85.229.104
[DNS_REDIRECTION:data] esetindia.com=209.85.229.104
[DNS_REDIRECTION:data] mcafee.free-trials.net=209.85.229.104
[DNS_REDIRECTION:data] antivir-2012.com=209.85.229.104
[DNS_REDIRECTION:data] panda-antivirus.en.softonic.com=209.85.229.104
[DNS_REDIRECTION:data] softonic.com=209.85.229.104
[DNS_REDIRECTION:data] freeantivirushelp.com=209.85.229.104
[DNS_REDIRECTION:data] scanwith.com=209.85.229.104
[DNS_REDIRECTION:data] bestantivirusreviewed.com=209.85.229.104
[DNS_REDIRECTION:data] virus-help.net=209.85.229.104
[DNS_REDIRECTION:data] cleanallspyware.com=209.85.229.104
[DNS_REDIRECTION:data] kingsoftsecurity.com=209.85.229.104
[DNS_REDIRECTION:data] threatfire.com=209.85.229.104
[DNS_REDIRECTION:data] freeavg.com=209.85.229.104
[DNS_REDIRECTION:data] clamav.net=209.85.229.104
[DNS_REDIRECTION:data] pcthreat.com=209.85.229.104
[DNS_REDIRECTION:data] 2-viruses.com=209.85.229.104
[DNS_REDIRECTION:data] trojan-killer.ne=209.85.229.104
[DNS_REDIRECTION:data] virusinfo.info=209.85.229.104
[DNS_REDIRECTION:data] www.virusinfo.info=209.85.229.104
[DNS_REDIRECTION:data] projecthoneypot.org=209.85.229.104
[DNS_REDIRECTION:data] www.projecthoneypot.org=209.85.229.104
[DNS_REDIRECTION:data] novirus.ru=209.85.229.104
[DNS_REDIRECTION:data] www.novirus.ru=209.85.229.104
[DNS_REDIRECTION:data] anti-malware.com=209.85.229.104
[DNS_REDIRECTION:data] www.anti-malware.com=209.85.229.104
[DNS_REDIRECTION:data] offensivecomputing.net=209.85.229.104
[DNS_REDIRECTION:data] www.offensivecomputing.n=209.85.229.104et
[DNS_REDIRECTION:data] zeustracker.abuse.ch=209.85.229.104
[DNS_REDIRECTION:data] www.zeustracker.abuse.ch=209.85.229.104
[DNS_REDIRECTION:data] www.malekal.com=209.85.229.104
[DNS_REDIRECTION:data] www3.malekal.com=209.85.229.104
[DNS_REDIRECTION:data] forum.malekal.com=209.85.229.104
[DNS_REDIRECTION:data] www.threatexpert.com=209.85.229.104
[DNS_REDIRECTION:data] threatexpert.com=209.85.229.104
[DNS_REDIRECTION:data] www.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] update.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] www.virustotal.com=209.85.229.104
[DNS_REDIRECTION:data] virusscan.jotti.org=209.85.229.104
[DNS_REDIRECTION:data] www.av-comparatives.org=209.85.229.104
[DNS_REDIRECTION:data] av-comparatives.org=209.85.229.104
[DNS_REDIRECTION:data] av-test.org=209.85.229.104
[DNS_REDIRECTION:data] www.av-test.org=209.85.229.104
[DNS_REDIRECTION:data] www.scanwith.com=209.85.229.104
[DNS_REDIRECTION:data] trendmicro.com.au=209.85.229.104
[DNS_REDIRECTION:data] kasperskyanz.com.au=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.com.au=209.85.229.104
[DNS_REDIRECTION:data] eset.com.au=209.85.229.104
[DNS_REDIRECTION:data] vet.com.au=209.85.229.104
[DNS_REDIRECTION:data] sm.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] home.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] toolbar.avg.com=209.85.229.104
[DNS_REDIRECTION:data] stats.avg.com=209.85.229.104
[DNS_REDIRECTION:data] www.virusbtn.com=209.85.229.104
[DNS_REDIRECTION:data] adwarereport.com=209.85.229.104
[DNS_REDIRECTION:data] avg.com.au=209.85.229.104
[DNS_REDIRECTION:data] www.adwarereport.com=209.85.229.104
[DNS_REDIRECTION:data] malwarebytes.org=209.85.229.104
[DNS_REDIRECTION:data] www.malwarebytes.org=209.85.229.104
[DNS_REDIRECTION:data] dw.com.com=209.85.229.104
[DNS_REDIRECTION:data] nss-shasta-rrs.symantec.com=209.85.229.104
[DNS_REDIRECTION:data] spywarewarrior.com=209.85.229.104
[DNS_REDIRECTION:data] www.spywarewarrior.com=209.85.229.104
[DNS_REDIRECTION:data] avsoft.ru=209.85.229.104
[DNS_REDIRECTION:data] www.avsoft.ru=209.85.229.104
[DNS_REDIRECTION:data] onecare.live.com=209.85.229.104
[DNS_REDIRECTION:data] anubis.iseclab.org=209.85.229.104
[DNS_REDIRECTION:data] wepawet.iseclab.org=209.85.229.104
[DNS_REDIRECTION:data] iseclab.org=209.85.229.104
[DNS_REDIRECTION:data] www.iseclab.org=209.85.229.104
[DNS_REDIRECTION:data] www.freespaceinternetsec=209.85.229.104urity.com
[DNS_REDIRECTION:data] freespaceinternetsecurit=209.85.229.104y.com
[DNS_REDIRECTION:data] sunbelt-software.com=209.85.229.104
[DNS_REDIRECTION:data] www.sunbelt-software.com=209.85.229.104
[DNS_REDIRECTION:data] www.prevx.com=209.85.229.104
[DNS_REDIRECTION:data] prevx.com=209.85.229.104
[DNS_REDIRECTION:data] analysis.seclab.tuwien.a=209.85.229.104c.at
[DNS_REDIRECTION:data] www.joebox.org=209.85.229.104
[DNS_REDIRECTION:data] joebox.org=209.85.229.104
[DNS_REDIRECTION:data] gmer.net=209.85.229.104
[DNS_REDIRECTION:data] www.gmer.net=209.85.229.104
[DNS_REDIRECTION:data] antirootkit.com=209.85.229.104
[DNS_REDIRECTION:data] www.antirootkit.com=209.85.229.104
[DNS_REDIRECTION:data] sectools.org=209.85.229.104
[DNS_REDIRECTION:data] www.sandboxie.com=209.85.229.104
[DNS_REDIRECTION:data] sandboxie.com=209.85.229.104
[DNS_REDIRECTION:data] nepenthes.mwcollect.org=209.85.229.104
[DNS_REDIRECTION:data] mwcollect.org=209.85.229.104
[DNS_REDIRECTION:data] www.amtso.org=209.85.229.104
[DNS_REDIRECTION:data] amtso.org=209.85.229.104
[DNS_REDIRECTION:data] www.nsslabs.com=209.85.229.104
[DNS_REDIRECTION:data] nsslabs.com=209.85.229.104
[DNS_REDIRECTION:data] www.icsalabs.com=209.85.229.104
[DNS_REDIRECTION:data] icsalabs.com=209.85.229.104
[DNS_REDIRECTION:data] www.checkvir.com=209.85.229.104
[DNS_REDIRECTION:data] checkvir.com=209.85.229.104
[DNS_REDIRECTION:data] www.check-mark.com=209.85.229.104
[DNS_REDIRECTION:data] check-mark.com=209.85.229.104
[DNS_REDIRECTION:data] www.protectstar-testlab.=209.85.229.104org
[DNS_REDIRECTION:data] protectstar-testlab.org=209.85.229.104
[DNS_REDIRECTION:data] www.anti-malware-test.co=209.85.229.104m
[DNS_REDIRECTION:data] anti-malware-test.com=209.85.229.104
[DNS_REDIRECTION:data] av-test.de=209.85.229.104
[DNS_REDIRECTION:data] www.av-test.de=209.85.229.104
[DNS_REDIRECTION:data] www.wildlist.org=209.85.229.104
[DNS_REDIRECTION:data] wildlist.org=209.85.229.104
[DNS_REDIRECTION:data] www.aavar.org=209.85.229.104
[DNS_REDIRECTION:data] aavar.org=209.85.229.104
[DNS_REDIRECTION:data] centralops.net=209.85.229.104
[DNS_REDIRECTION:data] www.staysafeonline.info=209.85.229.104
[DNS_REDIRECTION:data] staysafeonline.info=209.85.229.104
[DNS_REDIRECTION:data] www.rokop-security.de=209.85.229.104
[DNS_REDIRECTION:data] rokop-security.de=209.85.229.104
[DNS_REDIRECTION:data] www.wilderssecurity.com=209.85.229.104
[DNS_REDIRECTION:data] wilderssecurity.com=209.85.229.104
[DNS_REDIRECTION:data] www.superantispyware.com=209.85.229.104
[DNS_REDIRECTION:data] superantispyware.com=209.85.229.104
[DNS_REDIRECTION:data] update.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] www.kaspersky.com=209.85.229.104
[DNS_REDIRECTION:data] www.kaspersky.ru=209.85.229.104
[DNS_REDIRECTION:data] kaspersky.ru=209.85.229.104
[DNS_REDIRECTION:data] www.avp.ru=209.85.229.104
[DNS_REDIRECTION:data] avp.ru=209.85.229.104
[DNS_REDIRECTION:data] www.viruslist.com=209.85.229.104
[DNS_REDIRECTION:data] viruslist.com=209.85.229.104
[DNS_REDIRECTION:data] www.viruslist.ru=209.85.229.104
[DNS_REDIRECTION:data] www.kaspersky-antivirus.ru=209.85.229.104
[DNS_REDIRECTION:data] kaspersky-antivirus.ru=209.85.229.104
[DNS_REDIRECTION:data] downloads1.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads2.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads3.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads4.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads5.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads-us1.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads-us2.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads-us3.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads-eu1.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] downloads-eu2.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] kavdumps.kaspersky.com=209.85.229.104
[DNS_REDIRECTION:data] www.kasperskyclub.com=209.85.229.104
[DNS_REDIRECTION:data] forum.kasperskyclub.com=209.85.229.104
[DNS_REDIRECTION:data] forum.kasperskyclub.ru=209.85.229.104
[DNS_REDIRECTION:data] kasperskyclub.ru=209.85.229.104
[DNS_REDIRECTION:data] kasperskyclub.com=209.85.229.104
[DNS_REDIRECTION:data] ftp.kasperskylab.ru=209.85.229.104
[DNS_REDIRECTION:data] ftp.kaspersky.ru=209.85.229.104
[DNS_REDIRECTION:data] ftp.kaspersky-labs.com=209.85.229.104
[DNS_REDIRECTION:data] data.kaspersky.ru=209.85.229.104
[DNS_REDIRECTION:data] z-oleg.com=209.85.229.104
[DNS_REDIRECTION:data] www.z-oleg.com=209.85.229.104
[DNS_REDIRECTION:data] drweb.com=209.85.229.104
[DNS_REDIRECTION:data] www.drweb.com=209.85.229.104
[DNS_REDIRECTION:data] freedrweb.com=209.85.229.104
[DNS_REDIRECTION:data] www.freedrweb.com=209.85.229.104
[DNS_REDIRECTION:data] drweb.com.ua=209.85.229.104
[DNS_REDIRECTION:data] www.drweb.com.ua=209.85.229.104
[DNS_REDIRECTION:data] drweb.ru=209.85.229.104
[DNS_REDIRECTION:data] www.drweb.ru=209.85.229.104
[DNS_REDIRECTION:data] av-desk.com=209.85.229.104
[DNS_REDIRECTION:data] www.av-desk.com=209.85.229.104
[DNS_REDIRECTION:data] drweb.net=209.85.229.104
[DNS_REDIRECTION:data] www.drweb.net=209.85.229.104
[DNS_REDIRECTION:data] ftp.drweb.com=209.85.229.104
[DNS_REDIRECTION:data] dr-web.ru=209.85.229.104
[DNS_REDIRECTION:data] www.dr-web.ru=209.85.229.104
[DNS_REDIRECTION:data] download.drweb.com=209.85.229.104
[DNS_REDIRECTION:data] support.drweb.com=209.85.229.104
[DNS_REDIRECTION:data] updates.sald.com=209.85.229.104
[DNS_REDIRECTION:data] sald.com=209.85.229.104
[DNS_REDIRECTION:data] www.sald.com=209.85.229.104
[DNS_REDIRECTION:data] drweb.imshop.de=209.85.229.104
[DNS_REDIRECTION:data] safeweb.norton.com=209.85.229.104
[DNS_REDIRECTION:data] www.safeweb.norton.com=209.85.229.104
[DNS_REDIRECTION:data] www.symantec.com=209.85.229.104
[DNS_REDIRECTION:data] shop.symantecstore.com=209.85.229.104
[DNS_REDIRECTION:data] liveupdate.symantec.com=209.85.229.104
[DNS_REDIRECTION:data] liveupdate.symantecliveu=209.85.229.104pdate.com
[DNS_REDIRECTION:data] service1.symantec.com=209.85.229.104
[DNS_REDIRECTION:data] www.service1.symantec.co=209.85.229.104m
[DNS_REDIRECTION:data] security.symantec.com=209.85.229.104
[DNS_REDIRECTION:data] liveupdate.symantec.d4p.=209.85.229.104net
[DNS_REDIRECTION:data] securityresponse.symante=209.85.229.104c.com
[DNS_REDIRECTION:data] sygate.com=209.85.229.104
[DNS_REDIRECTION:data] www.sygate.com=209.85.229.104
[DNS_REDIRECTION:data] esetnod32.ru=209.85.229.104
[DNS_REDIRECTION:data] www.esetnod32.ru=209.85.229.104
[DNS_REDIRECTION:data] eset.com=209.85.229.104
[DNS_REDIRECTION:data] www.eset.com=209.85.229.104
[DNS_REDIRECTION:data] eset.com.ua=209.85.229.104
[DNS_REDIRECTION:data] www.eset.com.ua=209.85.229.104
[DNS_REDIRECTION:data] nod32.com.ua=209.85.229.104
[DNS_REDIRECTION:data] www.nod32.com.ua=209.85.229.104
[DNS_REDIRECTION:data] download.eset.com=209.85.229.104
[DNS_REDIRECTION:data] update.eset.com=209.85.229.104
[DNS_REDIRECTION:data] eset.eu=209.85.229.104
[DNS_REDIRECTION:data] www.eset.eu=209.85.229.104
[DNS_REDIRECTION:data] nod32.it=209.85.229.104
[DNS_REDIRECTION:data] www.nod32.it=209.85.229.104
[DNS_REDIRECTION:data] nod32.su=209.85.229.104
[DNS_REDIRECTION:data] www.nod32.su=209.85.229.104
[DNS_REDIRECTION:data] nod-32.ru=209.85.229.104
[DNS_REDIRECTION:data] www.nod-32.ru=209.85.229.104
[DNS_REDIRECTION:data] allnod.com=209.85.229.104
[DNS_REDIRECTION:data] www.allnod.com=209.85.229.104
[DNS_REDIRECTION:data] allnod.info=209.85.229.104
[DNS_REDIRECTION:data] www.allnod.info=209.85.229.104
[DNS_REDIRECTION:data] virusall.ru=209.85.229.104
[DNS_REDIRECTION:data] www.virusall.ru=209.85.229.104
[DNS_REDIRECTION:data] nod32eset.org=209.85.229.104
[DNS_REDIRECTION:data] www.nod32eset.org=209.85.229.104
[DNS_REDIRECTION:data] eset.sk=209.85.229.104
[DNS_REDIRECTION:data] www.eset.sk=209.85.229.104
[DNS_REDIRECTION:data] nod32.nl=209.85.229.104
[DNS_REDIRECTION:data] www.nod32.nl=209.85.229.104
[DNS_REDIRECTION:data] dl1.antivir.de=209.85.229.104
[DNS_REDIRECTION:data] dl2.antivir.de=209.85.229.104
[DNS_REDIRECTION:data] dl3.antivir.de=209.85.229.104
[DNS_REDIRECTION:data] dl4.antivir.de=209.85.229.104
[DNS_REDIRECTION:data] free-av.com=209.85.229.104
[DNS_REDIRECTION:data] www.free-av.com=209.85.229.104
[DNS_REDIRECTION:data] free-av.de=209.85.229.104
[DNS_REDIRECTION:data] www.free-av.de=209.85.229.104
[DNS_REDIRECTION:data] avira.com=209.85.229.104
[DNS_REDIRECTION:data] www.avira.com=209.85.229.104
[DNS_REDIRECTION:data] avira.de=209.85.229.104
[DNS_REDIRECTION:data] www.avira.de=209.85.229.104
[DNS_REDIRECTION:data] www1.avira.com=209.85.229.104
[DNS_REDIRECTION:data] dlpro.antivir.com=209.85.229.104
[DNS_REDIRECTION:data] forum.avira.com=209.85.229.104
[DNS_REDIRECTION:data] www.forum.avira.com=209.85.229.104
[DNS_REDIRECTION:data] avirus.ru=209.85.229.104
[DNS_REDIRECTION:data] www.avirus.ru=209.85.229.104
[DNS_REDIRECTION:data] avira-antivir.ru=209.85.229.104
[DNS_REDIRECTION:data] www.avira-antivir.ru=209.85.229.104
[DNS_REDIRECTION:data] avirus.com.ua=209.85.229.104
[DNS_REDIRECTION:data] www.avirus.com.ua=209.85.229.104
[DNS_REDIRECTION:data] mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] www.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] home.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] us.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] ru.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] de.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] ca.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] fr.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] au.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] es.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] it.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] uk.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] mx.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] ru.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] mcafee-online.com=209.85.229.104
[DNS_REDIRECTION:data] www.mcafee-online.com=209.85.229.104
[DNS_REDIRECTION:data] mcafeesecurity.com=209.85.229.104
[DNS_REDIRECTION:data] www.mcafeesecurity.com=209.85.229.104
[DNS_REDIRECTION:data] mcafeesecure.com=209.85.229.104
[DNS_REDIRECTION:data] www.mcafeesecure.com=209.85.229.104
[DNS_REDIRECTION:data] avertlabs.com=209.85.229.104
[DNS_REDIRECTION:data] www.avertlabs.com=209.85.229.104
[DNS_REDIRECTION:data] download.nai.com=209.85.229.104
[DNS_REDIRECTION:data] nai.com=209.85.229.104
[DNS_REDIRECTION:data] www.nai.com=209.85.229.104
[DNS_REDIRECTION:data] secure.nai.com=209.85.229.104
[DNS_REDIRECTION:data] eu.shopmcafee.com=209.85.229.104
[DNS_REDIRECTION:data] shop.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] siblog.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] mcafeestore.com=209.85.229.104
[DNS_REDIRECTION:data] www.mcafeestore.com=209.85.229.104
[DNS_REDIRECTION:data] service.mcafee.com=209.85.229.104
[DNS_REDIRECTION:data] siteadvisor.com=209.85.229.104
[DNS_REDIRECTION:data] www.siteadvisor.com=209.85.229.104
[DNS_REDIRECTION:data] scanalert.com=209.85.229.104
[DNS_REDIRECTION:data] www.drsolomon.com=209.85.229.104
[DNS_REDIRECTION:data] mcafee-at-home.com=209.85.229.104
[DNS_REDIRECTION:data] wwww.mcafee-at-home.com=209.85.229.104
[DNS_REDIRECTION:data] networkassociates.com=209.85.229.104
[DNS_REDIRECTION:data] www.networkassociates.com=209.85.229.104
[DNS_REDIRECTION:data] avast.ru=209.85.229.104
[DNS_REDIRECTION:data] www.avast.ru=209.85.229.104
[DNS_REDIRECTION:data] avast.com=209.85.229.104
[DNS_REDIRECTION:data] www.avast.com=209.85.229.104
[DNS_REDIRECTION:data] onlinescan.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download1.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download2.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download3.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download4.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download5.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download6.avast.com=209.85.229.104
[DNS_REDIRECTION:data] download7.avast.com=209.85.229.104
[DNS_REDIRECTION:data] free.avg.com=209.85.229.104
[DNS_REDIRECTION:data] au.norton.com=209.85.229.104
[DNS_REDIRECTION:data] trustdefender.com=209.85.229.104
[DNS_REDIRECTION:data] avg.com=209.85.229.104
[DNS_REDIRECTION:data] www.avg.com=209.85.229.104
[DNS_REDIRECTION:data] sshop.avg.com=209.85.229.104
[DNS_REDIRECTION:data] pctools.com=209.85.229.104
[DNS_REDIRECTION:data] www.grisoft.cz=209.85.229.104
[DNS_REDIRECTION:data] www.grisoft.com=209.85.229.104
[DNS_REDIRECTION:data] free.grisoft.com=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] www.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] msecn.net=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.de=209.85.229.104
[DNS_REDIRECTION:data] www.bitdefender.de=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.com.ua=209.85.229.104
[DNS_REDIRECTION:data] www.bitdefender.com.ua=209.85.229.104
[DNS_REDIRECTION:data] bitdefender.ru=209.85.229.104
[DNS_REDIRECTION:data] www.bitdefender.ru=209.85.229.104
[DNS_REDIRECTION:data] myaccount.bitdefender.co,=209.85.229.104
[DNS_REDIRECTION:data] download.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] ftp.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] forum.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] upgrade.bitdefender.com=209.85.229.104
[DNS_REDIRECTION:data] agnitum.ru=209.85.229.104
[DNS_REDIRECTION:data] www.agnitum.ru=209.85.229.104
[DNS_REDIRECTION:data] agnitum.com=209.85.229.104
[DNS_REDIRECTION:data] www.agnitum.com=209.85.229.104
[DNS_REDIRECTION:data] agnitum.de=209.85.229.104
[DNS_REDIRECTION:data] www.agnitum.de=209.85.229.104
[DNS_REDIRECTION:data] outpostfirewall.com=209.85.229.104
[DNS_REDIRECTION:data] www.outpostfirewall.com=209.85.229.104
[DNS_REDIRECTION:data] dl1.agnitum.com=209.85.229.104
[DNS_REDIRECTION:data] dl2.agnitum.com=209.85.229.104
[DNS_REDIRECTION:data] antivirus.comodo.com=209.85.229.104
[DNS_REDIRECTION:data] comodo.com=209.85.229.104
[DNS_REDIRECTION:data] www.comodo.com=209.85.229.104
[DNS_REDIRECTION:data] forums.comodo.com=209.85.229.104
[DNS_REDIRECTION:data] comodogroup.com=209.85.229.104
[DNS_REDIRECTION:data] www.comodogroup.com=209.85.229.104
[DNS_REDIRECTION:data] personalfirewall.comodo.com=209.85.229.104
[DNS_REDIRECTION:data] www.personalfirewall.com=209.85.229.104
[DNS_REDIRECTION:data] hackerguardian.com=209.85.229.104
[DNS_REDIRECTION:data] www.hackerguardian.com=209.85.229.104
[DNS_REDIRECTION:data] www.nsclean.com=209.85.229.104
[DNS_REDIRECTION:data] nsclean.com=209.85.229.104
[DNS_REDIRECTION:data] clamav.net=209.85.229.104
[DNS_REDIRECTION:data] www.clamav.net=209.85.229.104
[DNS_REDIRECTION:data] db.local.clamav.net=209.85.229.104
[DNS_REDIRECTION:data] clamsupport.sourcefire.com=209.85.229.104
[DNS_REDIRECTION:data] lurker.clamav.net=209.85.229.104
[DNS_REDIRECTION:data] wiki.clamav.net=209.85.229.104
[DNS_REDIRECTION:data] w32.clamav.net=209.85.229.104
[DNS_REDIRECTION:data] lists.clamav.net=209.85.229.104
[DNS_REDIRECTION:data] clamwin.com=209.85.229.104
[DNS_REDIRECTION:data] www.clamwin.com=209.85.229.104
[DNS_REDIRECTION:data] ru.clamwin.com=209.85.229.104
[DNS_REDIRECTION:data] gietl.com=209.85.229.104
[DNS_REDIRECTION:data] www.gietl.com=209.85.229.104
[DNS_REDIRECTION:data] clamav.dyndns.org=209.85.229.104
[DNS_REDIRECTION:data] f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] www.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] support.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] f-secure.ru=209.85.229.104
[DNS_REDIRECTION:data] www.f-secure.ru=209.85.229.104
[DNS_REDIRECTION:data] ftp.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] europe.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] www.europe.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] f-secure.de=209.85.229.104
[DNS_REDIRECTION:data] www.f-secure.de=209.85.229.104
[DNS_REDIRECTION:data] support.f-secure.de=209.85.229.104
[DNS_REDIRECTION:data] ftp.f-secure.de=209.85.229.104
[DNS_REDIRECTION:data] f-secure.co.uk=209.85.229.104
[DNS_REDIRECTION:data] www.f-secure.co.uk=209.85.229.104
[DNS_REDIRECTION:data] retail.sp.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] retail01.sp.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] retail02.sp.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] ftp.europe.f-secure.com=209.85.229.104
[DNS_REDIRECTION:data] norman.com=209.85.229.104
[DNS_REDIRECTION:data] www.norman.com=209.85.229.104
[DNS_REDIRECTION:data] download.norman.no=209.85.229.104
[DNS_REDIRECTION:data] sandbox.norman.no=209.85.229.104
[DNS_REDIRECTION:data] norman.no=209.85.229.104
[DNS_REDIRECTION:data] www.norman.no=209.85.229.104
[DNS_REDIRECTION:data] niuone.norman.no=209.85.229.104
[DNS_REDIRECTION:data] pandasecurity.com=209.85.229.104
[DNS_REDIRECTION:data] www.pandasecurity.com=209.85.229.104
[DNS_REDIRECTION:data] viruslab.ru=209.85.229.104
[DNS_REDIRECTION:data] www.viruslab.ru=209.85.229.104
[DNS_REDIRECTION:data] pandasoftware.com=209.85.229.104
[DNS_REDIRECTION:data] www.pandasoftware.com=209.85.229.104
[DNS_REDIRECTION:data] acs.pandasoftware.com=209.85.229.104
[DNS_REDIRECTION:data] www.pandasoftware.es=209.85.229.104
[DNS_REDIRECTION:data] anti-virus.by=209.85.229.104
[DNS_REDIRECTION:data] www.anti-virus.by=209.85.229.104
[DNS_REDIRECTION:data] virusblokada.ru=209.85.229.104
[DNS_REDIRECTION:data] www.virusblokada.ru=209.85.229.104
[DNS_REDIRECTION:data] vba32.de=209.85.229.104
[DNS_REDIRECTION:data] www.vba32.de=209.85.229.104
[DNS_REDIRECTION:data] ftp.nai.com=209.85.229.104
[DNS_REDIRECTION:data] secuser.com=209.85.229.104
[DNS_REDIRECTION:data] www.secuser.com=209.85.229.104
[DNS_REDIRECTION:data] tds.diamondcs.com.au=209.85.229.104
[DNS_REDIRECTION:data] windowsupdate.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] lavasoftusa.com=209.85.229.104
[DNS_REDIRECTION:data] www.lavasoftusa.com=209.85.229.104
[DNS_REDIRECTION:data] lavasoftusa.de=209.85.229.104
[DNS_REDIRECTION:data] www.lavasoftusa.de=209.85.229.104
[DNS_REDIRECTION:data] diamondcs.com.au=209.85.229.104
[DNS_REDIRECTION:data] shop.ca.com=209.85.229.104
[DNS_REDIRECTION:data] downloads.my-etrust.com=209.85.229.104
[DNS_REDIRECTION:data] v4.windowsupdate.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] v5.windowsupdate.microsoft.com=209.85.229.104
[DNS_REDIRECTION:data] noadware.net=209.85.229.104
[DNS_REDIRECTION:data] www.noadware.net=209.85.229.104
[DNS_REDIRECTION:data] zonelabs.com=209.85.229.104
[DNS_REDIRECTION:data] www.zonelabs.com=209.85.229.104
[DNS_REDIRECTION:data] moosoft.com=209.85.229.104
[DNS_REDIRECTION:data] www.moosoft.com=209.85.229.104
[DNS_REDIRECTION:data] secuser.model-fx.com=209.85.229.104
[DNS_REDIRECTION:data] pccreg.antivirus.com=209.85.229.104
[DNS_REDIRECTION:data] k-otik.com=209.85.229.104
[DNS_REDIRECTION:data] vupen.com=209.85.229.104
[DNS_REDIRECTION:data] www.vupen.com=209.85.229.104
[DNS_REDIRECTION:data] housecall.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] www.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] us.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] uk.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] de.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] fr.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] es.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] au.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] it.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] br.trendmicro.com=209.85.229.104
[DNS_REDIRECTION:data] antivirus.cai.com=209.85.229.104
[DNS_REDIRECTION:data] sophos.com=209.85.229.104
[DNS_REDIRECTION:data] www.sophos.com=209.85.229.104
[DNS_REDIRECTION:data] securitoo.com=209.85.229.104
[DNS_REDIRECTION:data] nordnet.com=209.85.229.104
[DNS_REDIRECTION:data] www.nordnet.com=209.85.229.104
[DNS_REDIRECTION:data] avgfrance.com=209.85.229.104
[DNS_REDIRECTION:data] www.avgfrance.com=209.85.229.104
[DNS_REDIRECTION:data] antivirus-online.de=209.85.229.104
[DNS_REDIRECTION:data] www.antivirus-online.de=209.85.229.104
[DNS_REDIRECTION:data] ftp.esafe.com=209.85.229.104
[DNS_REDIRECTION:data] ftp.microworldsystems.com=209.85.229.104
[DNS_REDIRECTION:data] ftp.ca.co=209.85.229.104
[DNS_REDIRECTION:data] files.trendmicro-europe.com=209.85.229.104
[DNS_REDIRECTION:data] inline-software.de=209.85.229.104
[DNS_REDIRECTION:data] ravantivirus.com=209.85.229.104
[DNS_REDIRECTION:data] www.ravantivirus.com=209.85.229.104
[DNS_REDIRECTION:data] f-prot.com=209.85.229.104
[DNS_REDIRECTION:data] www.f-prot.com=209.85.229.104
[DNS_REDIRECTION:data] files.f-prot.com=209.85.229.104
[DNS_REDIRECTION:data] secure.f-prot.com=209.85.229.104
[DNS_REDIRECTION:data] vsantivirus.com=209.85.229.104
[DNS_REDIRECTION:data] www.vsantivirus.com=209.85.229.104
[DNS_REDIRECTION:data] openantivirus.org=209.85.229.104
[DNS_REDIRECTION:data] www.openantivirus.org=209.85.229.104
[DNS_REDIRECTION:data] www3.ca.com=209.85.229.104
[DNS_REDIRECTION:data] dialognauka.ru=209.85.229.104
[DNS_REDIRECTION:data] www.dialognauka.ru=209.85.229.104
[DNS_REDIRECTION:data] anti-virus-software-review.com=209.85.229.104
[DNS_REDIRECTION:data] www.anti-virus-software-review.com=209.85.229.104
[DNS_REDIRECTION:data] www.vet.com.au=209.85.229.104
[DNS_REDIRECTION:data] antiviraldp.com=209.85.229.104
[DNS_REDIRECTION:data] www.antiviraldp.com=209.85.229.104
[DNS_REDIRECTION:data] www.proantivirus.com=209.85.229.104
[DNS_REDIRECTION:data] pestpatrol.com=209.85.229.104
[DNS_REDIRECTION:data] www.pestpatrol.com=209.85.229.104
[DNS_REDIRECTION:data] simplysup.com=209.85.229.104
[DNS_REDIRECTION:data] www.simplysup.com=209.85.229.104
[DNS_REDIRECTION:data] misec.net=209.85.229.104
[DNS_REDIRECTION:data] www.misec.net=209.85.229.104
[DNS_REDIRECTION:data] www1.my-etrust.com=209.85.229.104
[DNS_REDIRECTION:data] authentium.com=209.85.229.104
[DNS_REDIRECTION:data] www.authentium.com=209.85.229.104
[DNS_REDIRECTION:data] finjan.com=209.85.229.104
[DNS_REDIRECTION:data] www.finjan.com=209.85.229.104
[DNS_REDIRECTION:data] www.ikarus-software.at=209.85.229.104
[DNS_REDIRECTION:data] www.ika-rus.com=209.85.229.104
[DNS_REDIRECTION:data] ika-rus.com=209.85.229.104
[DNS_REDIRECTION:data] tinysoftware.com=209.85.229.104
[DNS_REDIRECTION:data] www.tinysoftware.com=209.85.229.104
[DNS_REDIRECTION:data] visualizesoftware.com=209.85.229.104
[DNS_REDIRECTION:data] www.visualizesoftware.com=209.85.229.104
[DNS_REDIRECTION:data] kerio.com=209.85.229.104
[DNS_REDIRECTION:data] www.kerio.com=209.85.229.104
[DNS_REDIRECTION:data] www.kerio.eu=209.85.229.104
[DNS_REDIRECTION:data] www.zonelabs.com=209.85.229.104
[DNS_REDIRECTION:data] zonelog.co.uk=209.85.229.104
[DNS_REDIRECTION:data] www.zonelog.co.uk=209.85.229.104
[DNS_REDIRECTION:data] webroot.com=209.85.229.104
[DNS_REDIRECTION:data] www.webroot.com=209.85.229.104
[DNS_REDIRECTION:data] www.lavasoft.nu=209.85.229.104
[DNS_REDIRECTION:data] spywareguide.com=209.85.229.104
[DNS_REDIRECTION:data] www.spywareguide.com=209.85.229.104
[DNS_REDIRECTION:data] spyblocker-software.com=209.85.229.104
[DNS_REDIRECTION:data] www.spyblocker-software.com=209.85.229.104
[DNS_REDIRECTION:data] www.spamhaus.org=209.85.229.104
[DNS_REDIRECTION:data] spamcop.net=209.85.229.104
[DNS_REDIRECTION:data] www.spamcop.net=209.85.229.104
[DNS_REDIRECTION:data] bobbear.co.uk=209.85.229.104
[DNS_REDIRECTION:data] www.bobbear.co.uk=209.85.229.104
[DNS_REDIRECTION:data] domaintools.com=209.85.229.104
[DNS_REDIRECTION:data] www.domaintools.com=209.85.229.104
[DNS_REDIRECTION:data] centralops.net=209.85.229.104
[DNS_REDIRECTION:data] www.centralops.net=209.85.229.104
[DNS_REDIRECTION:data] www.robtex.com=209.85.229.104
[DNS_REDIRECTION:data] dnsstuff.com=209.85.229.104
[DNS_REDIRECTION:data] www.dnsstuff.com=209.85.229.104
[DNS_REDIRECTION:data] ripe.net=209.85.229.104
[DNS_REDIRECTION:data] www.ripe.net=209.85.229.104
[DNS_REDIRECTION:data] www.met.police.uk=209.85.229.104
[DNS_REDIRECTION:data] nbi.gov.ph=209.85.229.104
[DNS_REDIRECTION:data] www.nbi.gov.ph=209.85.229.104
[DNS_REDIRECTION:data] www.police.gov.hk=209.85.229.104
[DNS_REDIRECTION:data] treasury.gov=209.85.229.104
[DNS_REDIRECTION:data] www.treasury.gov=209.85.229.104
[DNS_REDIRECTION:data] cybercrime.gov=209.85.229.104
[DNS_REDIRECTION:data] www.cybercrime.gov=209.85.229.104
[DNS_REDIRECTION:data] www.cybercrime.ch=209.85.229.104
[DNS_REDIRECTION:data] enisa.europa.eu=209.85.229.104
[DNS_REDIRECTION:data] www.enisa.europa.eu=209.85.229.104
[DNS_REDIRECTION:data] www.interpol.int=209.85.229.104
[DNS_REDIRECTION:data] www.fsa.gov.uk=209.85.229.104
[DNS_REDIRECTION:data] www.companies-house.gov.uk=209.85.229.104
[DNS_REDIRECTION:data] fraudaid.com=209.85.229.104
[DNS_REDIRECTION:data] www.fraudaid.com=209.85.229.104
[DNS_REDIRECTION:data] scambusters.org=209.85.229.104
[DNS_REDIRECTION:data] www.scambusters.org=209.85.229.104
[DNS_REDIRECTION:data] spamtrackers.eu=209.85.229.104
[DNS_REDIRECTION:data] www.spamtrackers.eu=209.85.229.104
What had been sent?
Eventhough we are limited in answering this question, we can say that what had been logged and phished above was all encrypted and sent to the remote host. Phishing data will be sent to the defined gateway with the HTTP/POST method via form, with the URL like below: (this is shared for blocking purpose)
h00p://[domain-name]/panel/icq.phpWhile the PC info, logged data and Citadel botnet communication were sent as per recorded PCAP traffic in the previous post.
Moral of the story
Instead to pass the sample as per it is to the AV industry and let the industry does the work, we should also broaden ourself with the information of "which malware, does what, with what". I understand there are so few information of the banking trojans for the reading reference to end users, I hope this post is not only to answer fellow researcher's questions but as one of important reference to mitigate the infection of this trojan in the future.
If you find the specific malware match to the description, help the industry by providing your thoughts, ideas and reference related to the infection you handle/spot. Your concern is the best weapon to fight these stealers. And do not be afraid to make mistake in reporting the infection incident, there is no such EXACT criteria when we are dealing with these stuffs anyway, all people are learners here. I urgue you to explain incident with learning as much as you can too.
In our circle there are plenty good blog posts of malware analysis written by the very dedicated individual researchers, read & follow them is one of our best advise.
#MalwareMustDie!