Hey all, im Anghios, Admin from

and DEV from
One friend have analized this programm ("Granuja")
This tool send our info to: 69.175.121.66, another host from Blaster (admin from

)
with this dates.
Name of DB: blasterh_servertool
user DB: blasterh
name of table: Datos
Example of query is executed when you save your dates with "granuja.exe"
Quote:
INSERT INTO blasterh_servertool.Datos (`nombre_server`,`string_conexion`,`usuario_ssh`,` password_ssh`,`direccion_ssh`,`puerto_ssh`,`ruta_a rchivos`) VALUES ('1234', 'server=1.2.3.4;user id=root;password=root;database=account', 'root', 'root', '1.2.3.4', '22', '/')
|
It's happened when I have created a test server, with fake dates. I put this IP: 1.2.3.4
and user: "root" in both cases, same with password.
All is sended to external database.
My friend have scanned a comunications with "granuja.exe". I got rare packets, with this destination: 69.175.121.66
Here a screen:
Regrettable that a manager engages this ...
I recommend all concerned to conduct the appropriate report. Steal private data is a crime. We know who the author of the program, and we have proof that is the program itself.
GTFO blaster.
have something to say now?