Mocbot spam analysis - Revision history

Eric.freyssinet: Text replacement - "/ www." to "/ |Site=www."

2015-07-31T10:46:34Z

Text replacement - "/ www." to "/ |Site=www."

← Older revision		Revision as of 10:46, 31 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Link=http://www.secureworks.com/cyber-threat-intelligence/threats/mocbot-spam/ www.secureworks.com		\|Link=http://www.secureworks.com/cyber-threat-intelligence/threats/mocbot-spam/
			\|Site=www.secureworks.com
	\|Author=Joe Stewart		\|Author=Joe Stewart
	\|NomRevue=DELL SecureWorks Threat Analyses		\|NomRevue=DELL SecureWorks Threat Analyses

Eric.freyssinet: 1 revision imported

2015-02-07T14:28:43Z

1 revision imported

← Older revision		Revision as of 14:28, 7 February 2015
(No difference)

Eric.freyssinet at 16:00, 24 November 2012

2012-11-24T16:00:46Z

New page

{{Publication
|Link=http://www.secureworks.com/cyber-threat-intelligence/threats/mocbot-spam/ www.secureworks.com
|Author=Joe Stewart
|NomRevue=DELL SecureWorks Threat Analyses
|Date=2006-08-15
|Editor=DELL SecureWorks
|Year=2006
|Botnet=Mocbot, Ranky
|Abstract=The recent Mocbot variant found exploiting the vulnerability described in MS06-040 is not especially unique. Many different malware variants use IRC as a command-and-control (C&C) channel. In this article we explore the Mocbot C&C in order to gain a better understanding of the reason for Mocbot's existence.<br/><br/>

The C&C servers, bniu.househot.com and ypgw.wallloan.com have been published in most writeups of Mocbot. But, even if we know the correct port number for the IRC server (18067), it is inadvisable to simply connect to the server using a standard IRC client to poke around. This kind of action might get you banned from the server (if you're lucky) or DDoSsed.
}}