topic Weird Malware URL Reporting in General Topics

Weird Malware URL Reporting

BPry — Wed, 01 Mar 2017 17:21:39 GMT

Has anybody else noticed that their botnet report is triggering on weird URLs that couldn't actually exist. I've listed some examples but I can't figure out why some of the URLs being reported are so clearly 'wrong'.

Visited malware URL 8M{zy!ces{~yeo{au?qfg.>Kcf~%7fwze%7fm%20}crzfeg!~znbe?mk%7fi%20}%7feca$lbkez|5#T82<:59<#%207;L-`bm2xefy/8M(<I5#T~}|~znbe``h~bh%20l%7f|7;Lfec`jc~fh'x!~mg%7f~~$y%7fm%7fztpfl'x|x||=w{nb%7f%7f(<I!)%?2<?>?*W4z7bv}`~v#v$8j=<m?$r

Visited malware URL 8Miczjbes`dficz*Ws{~x)?Hcq<w}'ha%20a|sp`z'ecykm%7f~y$geoxb{i<%209;<<?<8=bffxrezb|7~fi6dyz%7f5S,8M)?Hxgf<ek%7fe`k|>r}d/9Jh`{ucfhceah`{5#Thx%7f%7f(<I|p?l~&o`#`crs{y&bbzjr~}b'fbn{cdh?;::;=<='<a}eyu#f{}}4z7bv}c{w!t$2<oh?6)'

Visited malware URL 9J)?B%204A|~cxxdp|(dgd/9J`kkosg{n%7f?#tmv;Oc.?It6Y5-;<~~a!6Bo|}z.?L!7@:O~|e~plr~&jef)?Bqnb%ek%7fi~p(oi%kojyy}(rumgnx)?B#jhk4b%7fx}!6G:O/9Jyslusa}s%obi%204A|ao&`lp`us%`d&nhepr~%}xnbiw%204A

Visited malware URL 3@'1B%204A%7f~w/pf`aos&jol'1Bw#5Nhlm'1B#jhk4huvs!6G:O=tsr(nfmeqgm``hs&jo/wh!7@im~s$0Esjtkl,2Gcnawodiz=tllrb%aotqf)aiiied,vqqhv*xeaovf`(`fcl-rvlv|+telas/skiosajo,pftjtsm{-mgbov+pizhhldpjh*mqalkmaw+f??02235+nsee&r?j~ukqbz3,f:6`b>ih

Re: Weird Malware URL Reporting

pulukas — Sun, 19 Mar 2017 16:24:44 GMT

I've not seen these personally, but they look like they are worth reporting in an official support ticket. Seems likely to be a bug they will need to work on.

Re: Weird Malware URL Reporting

BPry — Mon, 20 Mar 2017 14:30:17 GMT

Actually this appears to have vanished with time. I'm not sure why it started reporting correctly again since it corrected itself prior to any interaction from myself. I have restarted since then and haven't seen it come back at all.

Re: Weird Malware URL Reporting

GHoffman — Mon, 20 Mar 2017 19:52:18 GMT

I agree. Mine has also corrected on its own. Not sure why.

Re: Weird Malware URL Reporting

BPry — Mon, 20 Mar 2017 20:03:46 GMT

@GHoffman glad to know I wasn't the only one affected, hadn't seen it getting reported anywhere.

Re: Weird Malware URL Reporting

GHoffman — Tue, 21 Mar 2017 15:22:12 GMT

I was also glad that someone else was experiencing the problem. I reported yesterday that the problem seemed to have gone away, but I had some pop up in this morning's botnet report. I sent in a ticket.

Re: Weird Malware URL Reporting

BPry — Tue, 21 Mar 2017 16:31:23 GMT

@GHoffman, That's awesome as this morning I actually saw them pop back up again as well. The funny thing is they report perfectly fine this time in my logs, and the same URL was fine for other clients, so not exactly sure what's going on with it.

Re: Weird Malware URL Reporting

Brandon_Wertz — Wed, 22 Mar 2017 14:55:44 GMT

My botnet reporting is still showing the crazy URL syntax as well. Not on every suspected entry though.

Re: Weird Malware URL Reporting

BPry — Wed, 22 Mar 2017 15:43:50 GMT

@Brandon_Wertz ya it appears to have come back within the last few days for some reason. I would say likely 70% of my entires show fine and the rest will be crazy and unusable; however I can look in my logs and see that it records the correct data for the entry.

Re: Weird Malware URL Reporting

BPry — Thu, 23 Mar 2017 13:25:09 GMT

Hey all; so i've been looking through this and it appears that all of my weird entires are from fqtag.com, and it's only listing the last section of the URL which is why it looks so god awfully weird. I've open a case to see why it's doing this and not showing fqtag.com/whatever so we can at least verify what domain they are going to.