CastleCops® [MIRT#767] Trojan-Downloader on 85.255.114.165 AS36445

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

[MIRT#767] Trojan-Downloader on 85.255.114.165 AS36445

All -> FavForums -> MIRT Reports

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

tetak

MIRT Team Lead
Premium Member

Joined: Jan 19, 2007
Posts: 5879

Posted: Sat Nov 03, 2007 7:33 pm Post subject: [MIRT#767] Trojan-Downloader on 85.255.114.165 AS36445

Malware Alert

Full Report: CastleCops Link /Trojan_Downloader_malware767.html

Changed status to confirmed malware.

IP Converted: 85.255.114.165

dword = 1442804389
hex1 = 0x55ff72a5
hex2 = 0x55.0xff.0x72.0xa5
oct = 0125.0377.0162.0245

View CIDR AS36445 Report: http://www.cidr-report.org/cgi-bin/as-report?as=36445

"36445 | US | arin | 2006-01-05 | CERNEL-ASN - Cernel, Inc"<br />

Extended information for AS36445:
State/Province: ca
Country: us
Responsible Domain: cernel.net
Abuse Email: abuse@cernel.net

in.php at this location is malware known as Trojan-Downloader.JS.Psyme.cz (Kaspersky)

Quote:

http://85.255.114.165/itcall/in.php?adv=20

tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Posted: Sun Nov 04, 2007 9:50 pm Post subject:

Ref CastleCops Link /Trojan_Downloader_malware767.html
The WHOIS shows this as an IP in Europe

Quote:

country: EU

but the ASN lookups indicate it is in the US

Quote:

"36445 | 85.255.112.0/20 | BY | ripencc | 2005-06-16"
"27595 | 85.255.114.0/23 | BY | ripencc | 2005-06-16"

A whois lookup on the IP address gives the abuse address in the Ukraine

Quote:

person: Andrew Sotov
address: Mechnikova 58/5 65029 Odessa
abuse-mailbox: abuse@ukrtelegroup.com.ua
phone: +380487311011

The traceroutes to the site indicates it is in the US.

Something is fishy.

tembow

Blue Angel
Premium Member

Joined: Oct 10, 2005
Posts: 2945

Posted: Mon Nov 05, 2007 12:09 am Post subject:

A recent analysis of the Apple OSX malware located these DNS IPs procodec1000: s1=85.255.116.61 s2=85.255.112.103 ultracodec1000: s1=85.255.115.34 s2=85.255.112.158 Whois lookup gives a Ukraine contact person: Andrew Sotov address: Mechnikova 58/5 65029 Odessa abuse-mailbox: abuse@ukrtelegroup.com.ua Smells fishier still _________________ Recommended - EU Spam Database - Especially the wiki Also Blog and site exposes spammers And Hijacked machines recovery

	All -> FavForums -> MIRT Reports	All times are GMT
Page 1 of 1

You cannot post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 136ppm 0.207s (0.039s) Making cybercriminals unhappy since 2002*