cbp7t.cn

this sql-injected domain retrieves iframe from www.jmlrmg.com/index.htm

The malicious iframe exploits a number of typical vulnerabilities.

The VT analysis of the malicious file www.jmlrmg.com/chanm/yahoo.exe is here. ThreatExpert here.

Other domains sharing the same IP are jsani.cn, woshow11.cn

cookie sql-injection domains

these 2 domains are used in the cookie sql-injection attacks

• hanrou7.cn
• me1me.cn

The above 2 domains will iframe to http://www.wow088.com/wang/index.htm where the exploits are located.

The malicious executable is at http://www.wow088.com/wang/ms.exe. The VT analysis is here.

www2.s800qn.cn/csrss/w.js

another round of sql-injection

bdydcketn.com/cgi-bin/index.cgi?mentat

the obfuscation method has been improved to defeat eval() overloading.
check out http://s3cwatch.wordpress.com/de-obfuscate-javascript-2/

The final decoded JS is as follows:

drmyy.cn

Hot on the heels of the new sql-injected domain in SANS report of ytgw123.cn
, there comes another domain that iframe back to the same IP address.