Zbot - vinltd.com - Hacked

// zeus panel
http://vinltd.com/suz/cp.php 
user : admin 
pass : profyle187

// mysql
$config['mysql_host']          = '127.0.0.1';
$config['mysql_user']          = 'vinltdco_suz';
$config['mysql_pass']          = 'profyle187';
$config['mysql_db']            = 'vinltdco_suz';

// shell 
hxxp://vinltd.com/info.php
// note account suspended !

Zbot - ns2.ezhost.in - Login

// zeus panel 1
user : admin
pass : london
login : hxxp://ns2.ezhost.in/ca/serverphp/cp.php

// zeus panel 2
user : admin
pass : london
hxxp://ns2.ezhost.in/images/us/serverphp/cp.php

// zeus panel 3
user : admin
pass : london
hxxp://ns2.ezhost.in/images/online/serverphp/cp.php

// php panel 
hxxp://ns2.ezhost.in/ca.zip
hxxp://ns2.ezhost.in/images.zip

NOTE : added a second admin user to all panels 
user : its-ownz
pass : 123456

ZeusBot - newbetrrsearve.co.uk - Hacked

// Panel
hxxp://newbetrrsearve.co.uk/usa/serverphp/cp.php
// login 
user : admin
pass : london 
// have fun

rageBot - 1war.hopto.org - Owned ( lol )

* Connecting to 1war.hopto.org (94.75.255.77) port 6667...
* Connected. Now logging in...
* *** Checking ident...
* *** No ident response; username prefixed with ~
* You have not registered
* Received a CTCP VERSION from IRC
<< 332 [nLh-VNC]szedsp ##vampir## :+scan 60 1 201 -b 3
<< 333 [nLh-VNC]szedsp ##vampir## Vampir 1413995814
<< 353 [nLh-VNC]szedsp @ ##vampir## :[nLh-VNC]szedsp [nLh-VNC]edmhip [nLh-VNC]aueejn [nLh-VNC]zabbni [nLh-VNC]yffqig [nLh-VNC]lrstbw [nLh-VNC]camwpi [nLh-VNC]wikcfh [nLh-VNC]vtsgjy [nLh-VNC]gyryte [nLh-VNC]tkarol [nLh-VNC]pwzrlf +MissaK|NS| [nLh-VNC]idiswr @nitZ [nLh-VNC]hkzqij
<< 366 [nLh-VNC]szedsp ##vampir## :End of /NAMES list.
<< PRIVMSG [nLh-VNC]szedsp :\x01VERSION\x01
>> PRIVMSG ##vampir## :\x02[RAGE SCAN:]\x02 range: 201/60 threads.

Zeus Botnet - 46.22.173.133 - Owned

hxxp://46.22.173.133/boom/cp.php?letter=home
$config['mysql_host']          = 'localhost';
$config['mysql_user']          = 'root';
$config['mysql_pass']          = 'thanks22';
$config['mysql_db']            = 'prince';

$config['reports_path']        = '_fe
we are in 

// prince 
admin 607cbd481652995c869ca3d08252df0e = favour123
// doom
admin   0192023a7bbd73250516f069df18b500 = admin123

// zeus panel + builder found at his pc

hxxp://www.datafilehost.com/d/863b03f7
pass : itsownz

// malware 

c5b2ef451c3fc351401f07d12b48240a md5 hash 
serach at malwr.com

// extraced from Xylitol thanks

Malware family    ZEUS
MD5    0b68b3c971fb4109094b1437e15e258b
Version    2.1.0.1
RC4 Keystream    bdd55760218b4d697d5681297c15a928758e7619368c05544a1bfd077722ce31adb10e3b41df0861a8503045272e7fcf55bec623fb9d6df49e10ea7109b22c43b5682b639f3549a66f5aae3d5eedaa665cbf9a33975317a0c9a1d103da674613d2f8007a396e9cc2920f93b3fe940a89146bdca391983a424e590174b8eec0efa4baff3ec5e0f7e3cdab1c122db4dd0b485d0ce6378734858a3f0d52d9c872e244e47bf6e95196cc1124c4bbc16aec73fceb831fe1866c2fb726d316d6af4c474088c78499f52ad74fb6701ed4a2f120b9588dd05b8f62ca3cde6506789b804ba51dcbf2e8c379381a5f02e5f9f318f0320425e7d8b07efa8295bcdb9064a7ac
gate.php URLs    

    hxxp://46.22.173.133/prince/secure.php

URLs    

    hxxp://46.22.173.133/prince/config.bin