SPAM frauds, fakes, and other MALWARE deliveries - archive

[AplusWebMaster]

FYI...

m86 Security Report - 1H 2011
- http://www.m86security.com/documents...ort_1h2011.pdf
July 20, 2011 - "... During this period, Web-based threats continued to grow more sophisticated. However, email threats such as spam decreased markedly following the takedown of major spam operations. Key Points:
• Many of the vulnerabilities targeted today are found in the Adobe and Java platforms. This highlights the fact that these applications often remain unpatched. Organizations and individuals should ensure that these software applications are patched promptly.
• Although spam volumes have declined since the closure of Spamit.com and takedown of the Rustock botnet, spam remains a problem for most organizations. The volume of malicious spam has returned to previous levels. Attackers continue to craft more legitimate looking messages in order to coax users into executing malicious files.
• Cybercriminals continue to experiment with combined attacks, evidenced by the recent spate of “spear-phishing” (target attacks that used Microsoft Office document files with embedded shockwave files that exploit vulnerabilities in Adobe Flash).
• There has been an increase in phishing attacks that include an HTML attachment, which is used to bypass anti-spam an anti-phishing filters in the browser.
• Facebook scams surged in the first half of 2011, as cybercriminals experimented with different ways to dupe social networkers into helping them earn a profit. One scam led users to trojans and fake anti-virus software for the Mac..."
(More detail in the PDF at the URL above.)

[AplusWebMaster]

FYI...

Fake Java Update uses victim PC's in DDoS...
- http://www.malwarecity.com/blog/fake...sive-1113.html
20 July 2011 - "Software patches, allegedly missing codecs and Flash Player or Java updates have been quite often used as baits in order to lure computer users into installing malware. We have recently come across this type of malware dissembling as a regular update to the Java platform. Closer investigation on the file revealed more than meets the eye: a carefully-crafted piece of malware that is extremely viral (i.e. spreads using an array of media) and can be used as a powerful tool to initiate distributed denial-of-service attacks. This e-threat seems to be in-sync with the canvas of on-line attacks we’ve been witnessing lately, especially those attributed to the independent hacktivist groups, such as Anonymous or their spin-off (and now defunct) organization called LulzSec. Both groups made a habit of targeting a wide range of institutions, including companies and government organizations not as much for money but as part of their “Antisec” credo. Backdoor.IRCBot.ADEQ is a Trojan disguised as a Java update. It is extremely “contagious”, as it can be downloaded from a multitude of locations, most of them being legit websites that have been infected by the tool... Backdoor.IRCBot.ADEQ uses private messages in order to communicate with its master, who sends the bot an assortment of commands, including the URL of a particular website the malware needs to flood... On top of that, the bot proceeds to uninstalling other bots such as Cerberus, Blackshades, CyberGate, or OrgeneraL DDoS Bot Cryptosuite if found injected into winlogon.exe, csrss.exe and services.exe. This is an essential step for the bot to ensure that the user doesn’t suspect any malicious activity on the computer, as well as to ensure that all the other pieces of malware racing for network bandwidth won’t get it. Plus, the bot also tries to prevent the user from noticing that the Trojan is constantly sending data to the Internet. It successfully adds itself to the list of authorized applications in the Windows Firewall, and tries to kill firewall alerts issued by antivirus solutions when they pop up. This makes Backdoor.IRCBot.ADEQ an efficient DDoS tool to be used by an attacker to take down sites or hinder the activity of a particular company...In the recent security landscape, Anmonymous and LulzSec have launched a couple of DDoS attacks against high-profile institutions. While the open-source Low-Orbit Ion Cannon tools have played a role in orchestrating the incident, most of the power was provided by botnets, as most permanent members of the organization “herd” botnets ranging between 5 and 30,000 infected machines. Botnets are universal tools of trade... A company might also get blackmailed and asked to pay a specific amount of money, or their servers will automatically be flooded with connection requests which it will be unable to answer, causing it to collapse. In the meanwhile, the company loses potential customers and, implicitly, money."

Hat-tip to cnm @ spywareinfoforum.com for the link...

[AplusWebMaster]

FYI...

Fake Flash updates...
- http://sunbeltblog.blogspot.com/2011...-aversion.html
July 22, 2011 - "... they're hoping the victims they attract to a scam like this won't pay much attention to what they're clicking on, never mind confirm that the Flash numbering offered matches up with reality. We detect this as VirTool.Win32.Obfuscator.hg!b1 (v), another 2GCash clickfraud Trojan**, and the VirusTotal score is currently at 5/43*."
* http://www.virustotal.com/file-scan/...a77-1311346336
File name: install.52078.exe
Submission date: 2011-07-22 14:52:16 (UTC)
Result: 5/43 (11.6%)

** http://sunbeltblog.blogspot.com/2011...hrome-and.html

[AplusWebMaster]

FYI...

Google AdWords phishing attack...
- http://nakedsecurity.sophos.com/2011...rikes-inboxes/
July 26, 2011 - "Have you received an email from Google saying that your Google AdWords campaign may have stopped running?... The messages have been spammed out across the internet, attempting to trick users into visiting a bogus website that pretends to be the Google AdWords login page... It's a realistic replica of the main Google AdWords page, created with some care in an attempt to phish your credentials off you. And don't forget, your same username and password will be not just used by Google AdWords, but also Gmail, Google Docs, Google+ and so forth... In short, your Google username and password are a very attractive commodity to phishers..." (from google-oa .net) That's certainly not Google, and the fact that the domain has only just been registered makes it even more suspicious..."

[AplusWebMaster]

FYI...

Mass injection - willysy .com...
- http://www.malwaredomains.com/wordpress/?p=1956
July 26th, 2011 - "Armorize reports* on a mass injection of 90,000 infected pages (not sites). The injected iframe points to willysy .com. We’ll be adding those domains on tonight’s update, but please read the article and take immediate action if you can."
* http://blog.armorize.com/2011/07/wil...n-ongoing.html
7.25.2011

[AplusWebMaster]

FYI...

SpyEye's target list - US, UK, Canada, Germany, and Australia now on top
- http://www.trusteer.com/blog/us-uk-c...es-target-list
July 26, 2011 - "Research findings from the Trusteer Situation Room and our anomaly detection service Pinpoint indicate that the number of financial institutions targeted by the SpyEye Trojan is growing. In parallel with this, our risk analysis teams have also observed an increase in the number of countries where financial institutions are being targeted by fraudsters using SpyEye. Analyzing the SpyEye command and control centers that our risk analysis team reviews every month revealed that 60% of the SpyEye bots target financial institutions in the US. This is followed by the UK with 53%, Canada with 31%, Germany 29%, and Australia 20%... the percentage of SpyEye bots targeting Canadian banks has more than doubled from 14% in May to 31% in June... SpyEye continues to expand its “hit list”... SpyEye developers appear to have figured how these defenses operate and are now constantly trying to ensure their code activity flies under the radar of these detection systems. SpyEye seems to follow Agile software development practices, namely it is flexibly and simply coded, and new configurations are being rolled out as quickly as possible by its developers. At certain times, we have even seen two new versions of the malware released every week... A new version means that the program code itself has been modified, while a new variant is just new packing around the same code... early versions of the malware included a feature to remove Zeus from an infected host machine. This feature was, of course, in place to ensure that SpyEye is the only financial malware on the infected computer..."
___

SpyEye Tracker
- https://spyeyetracker.abuse.ch/
"... quick statistics about the SpyEye Trojan:
SpyEye C&C servers tracked: 381
SpyEye C&C servers online: 184
SpyEye C&C server with files online: 38
• Average SpyEye binary Antivirus detection: 26.14% ..."

ZeuS Tracker
- https://zeustracker.abuse.ch/
"... quick statistics about the ZeuS crimeware:
ZeuS C&C servers tracked: 659
ZeuS C&C servers online: 223
ZeuS C&C servers with files online: 53
ZeuS FakeURLs tracked: 19
ZeuS FakeURLs online: 6
• Average ZeuS binary Antivirus detection rate: 38.67% ..."

(... as of 2011.08.04)

[AplusWebMaster]

FYI...

SPAM/fraud aimed at credit card users...
- http://community.websense.com/blogs/...mpromised.aspx
28 Jul 2011 - "Websense... has been monitoring and tracking a recent wave of email attacks being spread and aimed at credit card users and holders. The attack comes in the form of a short email with fairly detailed text alerting the recipient that their credit card has been blocked, and that they should open the attached file to find out more. The format seems old, with the content and attached file properties being the distinctive factor. With the recent attacks and data breaches of organizations in the press, this seems to be worth the buzz as personal details and credit card details were part of the information leaked... There is less the wording within the message body and the header information with regards to sender address or connecting IP's which are listed in this blog post*... The file is also VM-Aware, as the resulting execution of a download for fake AV only works if host based analysis is used (as opposed to a guest virtual machine)..."
* http://garwarner.blogspot.com/2011/0...o-fake-av.html

- http://labs.m86security.com/2011/07/...nsaction-spam/
July 29, 2011

>> http://tools.cisco.com/security/cent...?alertId=23741
July 29, 2011
___

Sophisticated injection abuses the Twitter trend service
- http://community.websense.com/blogs/...d-service.aspx
27 Jul 2011 - "... Websense... has detected a mass injection campaign that has infected more than 10,000 Web sites. What is surprising is the size of injected code; it’s very big – over 6,000 kbs. Surely such a large injection code can contain a lot of malicious content. The attacker used 5 layers of obfuscated methods to conceal the final redirect code. The redirect target is determined based on Twitter trend services... The redirect target is different every day, and even different at day and at night... The URL redirects customers to the Blackhole Exploit Kit where a rogue AV application will be installed. Below are IP addresses that host the Blackhole Exploit Kit.
46.165.192.232
46.20.119.80
66.135.59.143
216.155.147.12
64.150.187.129
200.35.147.150
108.59.2.202 ..."

[AplusWebMaster]

FYI...

Zeus SPAM continues...
- http://garwarner.blogspot.com/2011/0...continues.html
Update: New Zeus distribution site, July 29th AM:
"We are receiving SPAM emails this morning from "nacha .org" From: addresses that direct us to this Zeus distribution site.
hxxp ://federalreserve-alert .com/transaction_report.pdf.exe
... VirusTotal report... (5 of 43) detections. Only 2 of those are calling this Zeus.
---
July 28, 2011 - "... new example of this capability in the form of the two most recent installments of a long-running "government-related" Zeus campaign.
One of the two spammed destinations is:
alert-irs .com /00000700973770US.exe MD5 = 0691a4856713edc97664e60db735747c
This malware is currently showing a (12 of 43) detection rate at VirusTotal...
The other spammed destination is:
fdic-updates .com .com /system_update_07_28.exe MD5 = 7a0303fdb809ac0c1a84123b106992c2
This malware is currently showing a (8 of 43) detection rate at VirusTotal...
Both files are 172,032 bytes in size, but currently the FDIC one is showing a dramatically wider distribution via email than the IRS one, which may be an indication of "targeting" by the latter.
The FDIC version has been seen almost 500 times, despite the fact that the campaign is less than 45 minutes old as of this writing..."
(Much more detail at the garwarner.blogspot URL above.)

> http://www.cis.uab.edu/forensics/

[AplusWebMaster]

FYI...

willysy .com mass injection... more than 3.8 million pages
- http://blog.armorize.com/2011/07/wil...-hit-more.html
7.31.2011 - "... As of July 31th, Google shows more than 3,410,000 (willysy) + 386,000 (exero) = 3.8 million infected pages. Note this number is for individual infected pages, -not- sites or domains. And so we've largely updated and reformatted (so new info appears at the front) the initial report*, adding to it the infection number, source IP of attack, log entries, osCommerce vulnerabilities used, and more."
* http://blog.armorize.com/2011/07/wil...n-ongoing.html
"... 5. Browser exploits used:
CVE-2010-0840 - Java Trust
CVE-2010-0188 - PDF LibTiff
CVE-2010-0886 - Java SMB
CVE-2006-0003 - IE MDAC
CVE-2010-1885 - HCP
6. Exploit domain:
arhyv .ru, counv .ru ...
IP: 46.16.240.18 (AS51632 Ukrain - Inet Ltd)
Related domains: xlamv .ru, vntum .ru
7. Malware URL:
hxxp ://46.16.240.18 /9VBMa76FFnB4VAYu0X5j755pMiSyVrcV?s=mdacot ..."
___

- http://www.google.com/safebrowsing/d...?site=AS:51632
"... last time suspicious content was found was on 2011-08-01..."

[AplusWebMaster]

FYI...

Fake Flash for Mac ...
- http://www.f-secure.com/weblog/archives/00002206.html
August 1, 2011 - "We've come across a fake FlashPlayer.pkg installer for Mac... Once installed, the trojan adds entries to the hosts file to hijack users visiting various Google sites (e.g., Google.com.tw, Google.com.tl, et cetera) to the IP address 91.224.160.26, which is located in Netherlands. The server at the IP address displays a fake webpage designed to appear similar to the legitimate Google site... Even though the page looks fairly realistic, clicking on any of the links does not take the user to any other sites. Clicking on the links does however open new pop-up pages, which are all pulled from a separate remote server... At the time of writing, the pop-up pages aren't displaying anything, though we presume they are ads of some sort. It appears that the remote server serving the pop-up pages is down. The other remote server returning fake search requests appears to be still active. We detect this trojan as Trojan:BASH/QHost.WB."
(Screenshots available at the f-secure URL above.)