SPAM - IRS themed e-mails w/malicious attachment
FYI...
SPAM - IRS themed e-mails w/malicious attachment
- http://blog.webroot.com/2012/03/22/s...s-and-malware/
March 22, 2012 - "Cybercriminals are currently spamvertising with IRS themed emails, enticing end -and- corporate users into downloading and viewing a malicious .htm attachment.
> https://webrootblog.files.wordpress....ts_malware.png
More details: Spamvertised subject: Your tax return appeal is declined...
Malicious attachment: IRS_H11832502.htm *
Malicious iFrame URL found in the attachment...
Upon downloading and viewing the malicious attachment, an iFrame tag attempts to load, ultimately serving client-side exploits such as the Libtiff integer overflow in Adobe Reader and Acrobat (CVE-2010-0188), and Trusted method chaining remote code execution (CVE-2010-0840)... the malicious iFrame is hosted within a fast-flux botnet, and is therefore currently responding to multiple IPs, in an attempt by cybercriminals to make it harder for security researchers to take it down. End users are advised to ensure that they’re not running outdated versions of their third-party software and browser plugins, as well as to avoid interacting with the malicious emails..."
* https://www.virustotal.com/file/d854...f65e/analysis/
File name: IRS_U774510.htm0
Detection ratio: 13/43
Analysis date: 2012-03-23 09:17:40 UTC
:mad:
1x1 pixel drive-by-malware...
FYI...
1x1 pixel drive-by-malware...
evilcode.class
- https://isc.sans.edu/diary.html?storyid=12838
Last Updated: 2012-03-25 17:04:16 UTC - "Exploit authors sometimes like to be cute... A Java archive called "fun.jar" containing an "evilcode.class" file that runs as an applet of 1x1 pixels size ... well, this can't be anything good. And it indeed isn't. This code snippet was lurking on quite a few web sites over the past days. Sending fun.jar to Virustotal shows* that only 10 of 43 anti-virus tools actually recognize the exploit code, whereas 27/43 recognize the d.exe malware file** that the exploit currently downloads and runs. Evilcode.class exploits the Java Rhino Engine vulnerability (CVE-2011-3544), published back in October 2011 and affecting -all- Java Runtime Engines up to JRE 1.6_27. The exploit still seems to work well enough for the bad guys that they don't see any need to re-tool to newer exploits. In slight modification of Oracle's own words: 'We highly recommend users remove all older versions of Java from your system. Keeping old and unsupported versions of Java on your system presents a serious security risk...' ..."
* Latest: https://www.virustotal.com/file/a425...2a38/analysis/
File name: kr.jar
Detection ratio: 11/43
Analysis date: 2012-03-26 12:09:54 UTC
** Latest: https://www.virustotal.com/file/b7e0...0cf6/analysis/
File name: 60685cf9afc3e4f95097aa219ecb6da0
Detection ratio: 28/40
Analysis date: 2012-03-27 16:01:57 UTC
- http://web.nvd.nist.gov/view/vuln/de...=CVE-2011-3544 - 10.0 (HIGH)
Critical Java hole being exploited on a large scale ...
- http://atlas.arbor.net/briefs/index#-1937641784
Severity: High Severity
Published: Wednesday, March 28, 2012 19:20
Java security vulnerability patched in February is now being used widely by criminals to install malware.
Analysis: Patch! Watch for outdated Java on the network as the presence of old Java User-Agents is often a sign that a system has been exploited and Java is now doing the attackers bidding, typically downloading something evil.
Source: http://h-online.com/-1485681
Update 29-03-12: "... Until an update is released that addresses the vulnerability, Mac OS X users can turn off Java. Users can disable Java via Java Preferences (Applications > Utilities > Java Preferences) by unchecking the installed version. Alternatively, users can disable Java in each of their browsers; in Apple's Safari browser, this can be done by unchecking the "Enable Java" and "Enable JavaScript" under the Security tab in Safari's Preferences..."
* http://www.h-online.com/open/news/it...ew=zoom;zoom=2
:mad:
MacOS X targeted w/MS Office exploit in the wild...
FYI...
MacOS X targeted w/MS Office exploit in the wild...
- http://labs.alienvault.com/labs/inde...c-control-rat/
March 27, 2012 - "... The doc files seem to exploit MS09-027 and target Microsoft Office for Mac. This is one of the few times that we have seen a malicious Office file used to deliver malware on Mac OS X... An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
> When the victim opens the malicious Word file using Office for Mac, the shellcode writes the malicious payload on disk and executes it, and then opens a benign office file... The C&C server this time is:
- 2012 .slyip .net: 173.255.160.234
173.255.160.128 – 173.255.160.255
Black Oak Computers Inc – New York – 75 Broad Street...
> The second trojan found is a new one never seen. We have found several versions compiled for different architectures (ppc, i386..). We have also found a version that has paths to debugging symbols... The C&C domain resolves to:
- freetibet2012 .xicp .net: 114.249.207.194
114.240.0.0 – 114.255.255.255
China Unicom Beijing province network...
All the samples we have found have 0/0 rate antivirus detection, it includes the malicious doc files..."
___
- http://www.intego.com/mac-security-b...doors-on-macs/
March 29, 2012 - "... These Word documents exploit a Word vulnerability that was corrected in June, 2009, but also take advantage of the fact that many users don’t update such software. Word 2004 and 2008 are vulnerable, but the latest version, Word 2011 is not. Also, this vulnerability only works with .doc files, and not the newer .docx format..."
:mad:
Android bot attacks rooted smartphones
FYI...
Android bot attacks rooted smartphones
- http://h-online.com/-1499244
3 April 2012 - "Antivirus company NQ Mobile has discovered a variant of the DroidKungFu Android malware called DKFBootKit* that targets users who have rooted their smartphones. The malware piggybacks on apps that would otherwise ask for root privileges anyway – and, once the user has agreed, sets up camp deep in the smartphone's boot sequence and replaces commands such as ifconfig and mount to help ensure it is started early in the boot sequence..."
* http://research.nq.com/?p=391
"... DKFBootKit makes use of the granted root privilege for other malicious purposes, namely comprising the system integrity... the malware itself contains a bot payload that phones home to several remote C&C servers and waits for further commands...
1) Only download applications from trusted sources...
2) Never accept application requests from unknown sources...
3) Be alert for unusual behavior on the part of mobile phones and be sure to download a trusted security application that can scan the applications being downloaded onto your mobile device..."
(More detail at the URLs above.)
- http://www.darkreading.com/taxonomy/...e/id/232800310
Apr 04, 2012
___
android malware
- https://encrypted.google.com/
... About 29,400,000 results
:mad:
Credit Card fraud/malware attacks Facebook users
FYI...
Credit Card fraud/malware attacks Facebook users
- https://www.trusteer.com/blog/facebo...dit-card-fraud
April 03, 2012 - "... new configuration of the Ice IX malware that attacks Facebook users after they have logged in to their account and steals credit card and other personal information... discovered a “marketing” video used by the creators of the malware to demonstrate how the web injection works. The global reach and scale of the Facebook service has made it a favorite target of fraudsters... This latest attack uses a web injection to present a fake web page in the victim’s browser. The form requests the user provide their cardholder name, credit/debit card number, expiry date, CID and billing address. The attackers claim the information is needed to verify the victim’s identity and provide additional security for their Facebook account... This pop up* presents virtually the same message used in the Ice IX configuration our researchers discovered and analyzed. The only difference is the version in the video requests a social security number and date of birth, in addition to the information mentioned earlier... We contacted Facebook to advise them that they would be mentioned in this blog. Facebook requested that we pass on some information about their site’s security measures. Here’s a summary of their response:
i) Facebook actively detects known malware on users' devices to provide Facebook users with a self-remediation procedure including the Scan-And-Repair malware scan. To self-enroll in this check point please visit – on.fb.me/AVCheckpoint
ii) Please advise your readers to report to Facebook any spam they find on the Facebook site, and remember Facebook will never ask for your credit card, social security, or any other sensitive information other than your username and password while logging in."
* http://www.trusteer.com/sites/default/files/Faceb.png
___
- http://google.com/safebrowsing/diagn...=facebook.com/
"... Part of this site was listed for suspicious activity 336 time(s) over the past 90 days... Of the 113053 pages we tested on the site over the past 90 days, 186 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-04-03, and the last time suspicious content was found on this site was on 2012-04-03. Malicious software includes 63 trojan(s), 62 exploit(s), 60 scripting exploit(s). Successful infection resulted in an average of 7 new process(es) on the target machine... Malicious software is hosted on 138 domain(s)... 28 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site... Over the past 90 days, facebook.com appeared to function as an intermediary for the infection of 56 site(s)... It infected 8 domain(s)..."
:sad: :mad:
Fake HP scan SPAM email leads to malware
FYI...
Fake HP scan SPAM email leads to malware
- http://blog.dynamoo.com/2012/04/scan...njet-spam.html
6 April 2012 - "Another fake HP scan spam email leading to malware. This one follows the new technique of putting a malicious HTML (HP_Scan.htm) file inside a ZIP file to reduce the risk of it being blocked, and then it has multiple payload sites to try to get a higher infection rate. Nasty.
'Date: Fri, 6 Apr 2012 08:29:34 +0200
From: "Hewlett-Packard Officejet 70419A" [JaysonGritten@ estout .com]
Subject: Scan from a Hewlett-Packard ScanJet #02437326
Attachments: HP_Document-12-Z1380.zip
Attached document was scanned and sent
to you using a Hewlett-Packard HP Officejet 45211A.'
The payload can be found at:
hxxp :// 211.44.250.173 :8080/navigator/jueoaritjuir.php
hxxp :// 62.85.27.129 :8080/navigator/jueoaritjuir.php
hxxp :// 219.94.194.138 :8080/navigator/jueoaritjuir.php
hxxp :// 78.83.233.242 :8080/navigator/jueoaritjuir.php
... Anti-virus detection* is pretty poor at the moment...."
* https://www.virustotal.com/file/fa20...fb09/analysis/
File name: HP_Scan.htm
Detection ratio: 10/42
Analysis date: 2012-04-06 10:24:37 UTC
___
- http://blog.webroot.com/2012/03/31/s...s-and-malware/
March 31, 2012
> https://webrootblog.files.wordpress....malware_01.png
* https://www.virustotal.com/file/8169...65f0/analysis/
File name: Invoice_NO_Mailen.htm
Detection ratio: 21/42
Analysis date: 2012-04-02 05:40:03 UTC
:mad:
EU tax invoice trojan ...
FYI...
EU tax invoice trojan...
- http://blog.mxlab.eu/2012/04/08/tax-...ntains-trojan/
April 8, 2012 - "... started to intercept a new trojan distribution campaign by email with the subject “invioce” and is sent from the spoofed address “European Commissions’s Office<info@infoeu.eu>” and has the following body:
Please open the attached file for your income tax invoice.From the European
Commission’s office .This message is for all the European Union citizens.
Note: European Union citizens Tax invoices are provided Once a year.
please refer to your tax Confirmation email. Attachment: Tax Invoice.
For Better Understanding.
Regards
Mr Jeff Black
The attached file is named invoice.exe and is approx. 170 kB large. The trojan is known as a variant of Win32/Injector.PWG (NOD32), W32/Obfuscated.D!genr (Norman), Trojan.Win32.Generic.pak!cobra ( VIPRE). At the time of writing, only 6 of the 42 AV engines did detect the trojan at Virus Total*..."
* https://www.virustotal.com/file/327c...is/1333886755/
File name: invoice.exe
Detection ratio: 9/41
Analysis date: 2012-04-08 12:05:55 UTC
:mad:
Dutch phishing emails target domains in Belgium/Netherlands
FYI...
Dutch phishing emails target domains in Belgium/Netherlands
- http://blog.mxlab.eu/2012/04/10/dutc...e-netherlands/
April 10, 2012 - "... increase of phishing emails, compared to the previous days, weeks and month, in the Dutch language that is sent to domains .be and .nl in Belgium and the Netherlands. The phishing emails are sent on behalf of ABN Amro and ING.
Here are some subjects for ING phishing emails:
- Mijn ING Breidt
- Belangerijk Mijn ING Nieuws
- Je hebt 1 ongelezen beveiligd Alert.
Here are some subjects for the ABN AMRO Bank:
- Beveiliging Message Alert van ABN AMRO Bank
- 2012 ABN AMRO VERIFICATIE ..."
(Examples of complete phish text at the URL above.)
:mad: