212.154.211.]81/download.exe vps-1050414-945.cp.]idhost].kz/download.exe https://www.virustotal.com/en/file/304911c667bb55d8e1a1bb85eb3217b0e5fb1e06d8de39ad8bd6f273d2e6b192/analysis/1487684743/ …
Sage 2.2 sample (at 11/58): https://www.virustotal.com/en/file/c2e3fc20721f3811daee052b8c4a28723437ddcd35f7e9574b84027d921b7083/analysis/1487681631/ …
From: nrcommerce[.]com/system/config/spam1.exe - that filename... 
More samples:pic.twitter.com/a2J157kjJk
-
-
-
backdoor are still there hxxp://nrcommerce\.com/system/tempfs\.php
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.