Vulnerable Disclosures: Info: 216.146.38.70 being used by malware to get current IP address

Sunday, May 17, 2015

Info: 216.146.38.70 being used by malware to get current IP address

Malware MD5's associated with this dynamic DNS domain checkip.dyndns.com and checkip9.dyndns.com.

May 11th 2015, 13:33:04.358 iocs-slcmaster fc0af5d923b7988fe9ba24f440a10929734a2050', '2015-05-01 03:13:53')"
May 11th 2015, 13:33:04.332 iocs-slcmaster 8234df6eb626e024a625bd8f56c2163a5eac81cc', '2015-05-01 03:14:00')"
May 11th 2015, 13:33:04.329 iocs-slcmaster e447039272c445c4d7fc267aa40f171ff41c8776', '2015-05-01 03:14:11')"
May 11th 2015, 13:33:04.327 iocs-slcmaster b7abd0f35f1fe95824bf06713dd9e843c6a5591f', '2015-05-01 03:14:12')"
May 11th 2015, 13:33:04.324 iocs-slcmaster 84ee1fbf48c42603363ebf90a39e4510ec5101c6', '2015-05-01 03:14:41')"
May 11th 2015, 13:33:04.322 iocs-slcmaster bb5f649a820c430a259483cd9d2a115fe914b45b', '2015-05-01 03:15:01')"
May 11th 2015, 13:33:04.279 iocs-slcmaster c2680a7c46835edf6f611eb4138994e68ec9ef16', '2015-05-01 03:15:16')"
May 11th 2015, 13:33:04.275 iocs-slcmaster 7eb1dfb485b6983b35e9e44c8e33e40e07ace90c', '2015-05-01 03:15:17')"
May 11th 2015, 13:33:04.269 iocs-slcmaster 0763172dd8ba0fc48909dbe756f9ef876869d385', '2015-05-01 03:15:24')"
May 11th 2015, 13:33:04.263 iocs-slcmaster 9060966a2db161ca466a1c6ed391429ec1668e86', '2015-05-01 03:16:13')"
May 11th 2015, 13:33:04.256 iocs-slcmaster a57ff42c44cc36241bf6510bfd30891b5dd874f8', '2015-05-01 03:17:36')"
May 11th 2015, 13:33:04.251 iocs-slcmaster d0cad125c5f192aabab217dc2180bb710bbe74b9', '2015-05-01 03:17:44')"
May 11th 2015, 13:33:04.230 iocs-slcmaster 2680e0ae5bcc7858e03907ccacae4e4acd6ee400', '2015-05-01 03:18:29')"
May 11th 2015, 13:33:04.211 iocs-slcmaster 87b3d7aec495b971cf501c2776f2540b40dd24e6', '2015-05-01 03:18:57')"
May 11th 2015, 13:33:04.204 iocs-slcmaster 90776a7645c6d005f2cc238fbce10d392f1026f8', '2015-05-01 03:20:25')"
May 11th 2015, 13:33:04.197 iocs-slcmaster b35b2dc00dd216581f91f56c5c25f5559f7cfcf0', '2015-05-01 03:20:38')"
May 11th 2015, 13:33:04.192 iocs-slcmaster 184f89c5a6443774a212c1e1eaa6dddb13710774', '2015-05-01 03:20:38')"
May 11th 2015, 13:33:04.187 iocs-slcmaster 37fa1251617a0f5b88dca55ac1efd33a0a66f95b', '2015-05-01 03:21:45')"
May 11th 2015, 13:33:04.183 iocs-slcmaster d80a5b67b2b5199528c27af18ac5086238330e16', '2015-05-01 03:24:46')"
May 11th 2015, 13:33:04.178 iocs-slcmaster ac148f94cc80ca5ba6e5d086006b6b33da526174', '2015-05-01 03:29:21')"

No comments:

About SLC Security

The driving factor in us deciding to provide this service to consumers is the growing cost of cybersecurity defense and notification systems. We are providing an RSS feed of content as a public service. It is our policy to only release the full details of data breach information directly to the companies or entity that was the target of the breach or attack. If you need assistance researching the source of the breach or leak please visit SLC Security Services LLC to obtain assistance.

NOTICE: All information posted to this blog is derived from open source intelligence systems developed by SLC Security Services LLC. The OSINT-X platform is available via subscription and via a paid RSS Feed. The OSINT-X system only maintains 90 days but this timeframe may and will change without notice depending on the amount of data we are processing. We also provide a delayed RSS feed that may not contain all feed sources. The public RSS feed is on this page on the right hand side and is provided without charge. The moderators of this site are all volunteers and are not paid for their services.

If your company needs a TSCM Sweep or Vulnerability assessment feel free to contact us through the contact form on this page or call us at (717) 831-TSCM to schedule an audit.

NOTICE: Starting in January 2015 we will only discuss issues on the blog or in our feeds with the clients directly. We receive upward of 200+ calls per day requesting information. It is impossible for our volunteers to field that number of calls and still get our work done. While we would love to help every person that calls remember we are a for profit business and answering calls takes time. If we are not busy you may get in touch with us. The best approach is to email us at soc@slcsecurity.com instead of calling. Please include your name, telephone number and a brief reason for the call or communication and we will get back to you as soon as possible time permitting.

About this Page

The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. We will include information on what type of information is being leaked but we will not release the methods in which the information is being leaked unless we are under non-disclosure agreements with the organization. The information posted on this site will contain scrubbed information if we release it to protect the information source and to ensure that the person or persons being affected are not farther harmed by the disclosure of their personal information.

Before a breach is reported it is reported to the entity affected and we normally wait at least 5 days for a response. We only post disclosures whenever there have been no response by the organization or when it involves confirmed leaks or we can verify that the security issue has not been resolved by the organization. Certain items will remain on the blog if they are a major release or new information is being posted frequently concerning the incident.

We do NOT maintain data on the leaked information as we would not want to create a second incident. Reports are submitted by security researchers, patients, clients, corporations and through open source identification as well as through passive monitoring of open source systems and proprietary algorithms.

The information on this site is provided by SLC Security Services LLC a leading cyber security and investigation company located in Raleigh, NC. If your company appears on this list and you would like additional information you may contact us by mail at 2664 Timber Dr Suite 342 Garner NC 27529 or by email via the contact form available at www.slcsecurity.com or by phone at (717)831-8726.

The Stats

Reporting Stats are available upon written request.

Please report all known security issues to soc@slcsecurity.com. We will review each report manually whenever possible. Please note that not all reports will be published to the disclosure list. Also you can specifically request that the data NOT be posted during your submission.

RSS OSINT-X FEED PERMALINK
Feed Delayed 30-60 Minutes
Not all sources we monitor are in this RSS feed. This feed contains mostly news sites but does not include IRC, Darknet or File Dump site monitoring that our commercial products monitor for your organization. This feed is limited in scope. For full access you must be a customer under a service contract. If interested in a full service contract call (919)441-7353 to inquire about pricing and services available.

TWITTER FEED

Sunday, May 17, 2015

Info: 216.146.38.70 being used by malware to get current IP address

No comments:

Post a Comment