Page 60 of 70 FirstFirst ... 1050565758596061626364 ... LastLast
Results 591 to 600 of 694

Thread: SPAM frauds, fakes, and other MALWARE deliveries - archive

  1. #591
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down SPAM - IRS themed e-mails w/malicious attachment

    FYI...

    SPAM - IRS themed e-mails w/malicious attachment
    - http://blog.webroot.com/2012/03/22/s...s-and-malware/
    March 22, 2012 - "Cybercriminals are currently spamvertising with IRS themed emails, enticing end -and- corporate users into downloading and viewing a malicious .htm attachment.
    > https://webrootblog.files.wordpress....ts_malware.png
    More details: Spamvertised subject: Your tax return appeal is declined...
    Malicious attachment: IRS_H11832502.htm *
    Malicious iFrame URL found in the attachment...
    Upon downloading and viewing the malicious attachment, an iFrame tag attempts to load, ultimately serving client-side exploits such as the Libtiff integer overflow in Adobe Reader and Acrobat (CVE-2010-0188), and Trusted method chaining remote code execution (CVE-2010-0840)... the malicious iFrame is hosted within a fast-flux botnet, and is therefore currently responding to multiple IPs, in an attempt by cybercriminals to make it harder for security researchers to take it down. End users are advised to ensure that they’re not running outdated versions of their third-party software and browser plugins, as well as to avoid interacting with the malicious emails..."
    * https://www.virustotal.com/file/d854...f65e/analysis/
    File name: IRS_U774510.htm0
    Detection ratio: 13/43
    Analysis date: 2012-03-23 09:17:40 UTC

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #592
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down 1x1 pixel drive-by-malware...

    FYI...

    1x1 pixel drive-by-malware...
    evilcode.class
    - https://isc.sans.edu/diary.html?storyid=12838
    Last Updated: 2012-03-25 17:04:16 UTC - "Exploit authors sometimes like to be cute... A Java archive called "fun.jar" containing an "evilcode.class" file that runs as an applet of 1x1 pixels size ... well, this can't be anything good. And it indeed isn't. This code snippet was lurking on quite a few web sites over the past days. Sending fun.jar to Virustotal shows* that only 10 of 43 anti-virus tools actually recognize the exploit code, whereas 27/43 recognize the d.exe malware file** that the exploit currently downloads and runs. Evilcode.class exploits the Java Rhino Engine vulnerability (CVE-2011-3544), published back in October 2011 and affecting -all- Java Runtime Engines up to JRE 1.6_27. The exploit still seems to work well enough for the bad guys that they don't see any need to re-tool to newer exploits. In slight modification of Oracle's own words: 'We highly recommend users remove all older versions of Java from your system. Keeping old and unsupported versions of Java on your system presents a serious security risk...' ..."
    * Latest: https://www.virustotal.com/file/a425...2a38/analysis/
    File name: kr.jar
    Detection ratio: 11/43
    Analysis date: 2012-03-26 12:09:54 UTC
    ** Latest: https://www.virustotal.com/file/b7e0...0cf6/analysis/
    File name: 60685cf9afc3e4f95097aa219ecb6da0
    Detection ratio: 28/40
    Analysis date: 2012-03-27 16:01:57 UTC

    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2011-3544 - 10.0 (HIGH)

    Critical Java hole being exploited on a large scale ...
    - http://atlas.arbor.net/briefs/index#-1937641784
    Severity: High Severity
    Published: Wednesday, March 28, 2012 19:20
    Java security vulnerability patched in February is now being used widely by criminals to install malware.
    Analysis: Patch! Watch for outdated Java on the network as the presence of old Java User-Agents is often a sign that a system has been exploited and Java is now doing the attackers bidding, typically downloading something evil.
    Source: http://h-online.com/-1485681
    Update 29-03-12: "... Until an update is released that addresses the vulnerability, Mac OS X users can turn off Java. Users can disable Java via Java Preferences (Applications > Utilities > Java Preferences) by unchecking the installed version. Alternatively, users can disable Java in each of their browsers; in Apple's Safari browser, this can be done by unchecking the "Enable Java" and "Enable JavaScript" under the Security tab in Safari's Preferences..."
    * http://www.h-online.com/open/news/it...ew=zoom;zoom=2

    Last edited by AplusWebMaster; 2012-03-30 at 12:38.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #593
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down MacOS X targeted w/MS Office exploit in the wild...

    FYI...

    MacOS X targeted w/MS Office exploit in the wild...
    - http://labs.alienvault.com/labs/inde...c-control-rat/
    March 27, 2012 - "... The doc files seem to exploit MS09-027 and target Microsoft Office for Mac. This is one of the few times that we have seen a malicious Office file used to deliver malware on Mac OS X... An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
    > When the victim opens the malicious Word file using Office for Mac, the shellcode writes the malicious payload on disk and executes it, and then opens a benign office file... The C&C server this time is:
    - 2012 .slyip .net: 173.255.160.234
    173.255.160.128 – 173.255.160.255
    Black Oak Computers Inc – New York – 75 Broad Street...
    > The second trojan found is a new one never seen. We have found several versions compiled for different architectures (ppc, i386..). We have also found a version that has paths to debugging symbols... The C&C domain resolves to:
    - freetibet2012 .xicp .net: 114.249.207.194
    114.240.0.0 – 114.255.255.255
    China Unicom Beijing province network...
    All the samples we have found have 0/0 rate antivirus detection, it includes the malicious doc files..."
    ___

    - http://www.intego.com/mac-security-b...doors-on-macs/
    March 29, 2012 - "... These Word documents exploit a Word vulnerability that was corrected in June, 2009, but also take advantage of the fact that many users don’t update such software. Word 2004 and 2008 are vulnerable, but the latest version, Word 2011 is not. Also, this vulnerability only works with .doc files, and not the newer .docx format..."

    Last edited by AplusWebMaster; 2012-04-02 at 13:43.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #594
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Blackhole exploits...

    FYI...

    Blackhole exploits ...
    - https://www.f-secure.com/weblog/archives/00002342.html
    April 2, 2012 - "... an exploit for CVE-2011-0559*, which is one of the two Flash exploits being used by Blackhole currently. Compared to other exploits, this one has been used by Blackhole for quite some time and yet the coverage using different security products is very low**.
    ** https://www.f-secure.com/weblog/archives/vt_scan.png
    With very -low- antivirus coverage, -no- Metasploit module, and PoCs being extremely difficult to find, this increases the chances of exploitation. Blackhole targets to exploit Adobe Flash 10.0 and earlier versions, 10.1, and 10.0.x (where x is later than 40). The vulnerability has been patched since March 2011. Detection has been added to F-Secure Anti-Virus as Exploit:W32/CVE-2011-0559.A..."
    * http://web.nvd.nist.gov/view/vuln/de...=CVE-2011-0559 - 9.3 (HIGH)
    Last revised: 01/27/2012

    - http://nakedsecurity.sophos.com/expl...xploit-kit-19/
    March 29, 2012 - "... over the past 12-18 months we have seen Blackhole become the most prevalent and notorious of the exploit kits used to infect people with malware..."

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #595
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Android bot attacks rooted smartphones

    FYI...

    Android bot attacks rooted smartphones
    - http://h-online.com/-1499244
    3 April 2012 - "Antivirus company NQ Mobile has discovered a variant of the DroidKungFu Android malware called DKFBootKit* that targets users who have rooted their smartphones. The malware piggybacks on apps that would otherwise ask for root privileges anyway – and, once the user has agreed, sets up camp deep in the smartphone's boot sequence and replaces commands such as ifconfig and mount to help ensure it is started early in the boot sequence..."
    * http://research.nq.com/?p=391
    "... DKFBootKit makes use of the granted root privilege for other malicious purposes, namely comprising the system integrity... the malware itself contains a bot payload that phones home to several remote C&C servers and waits for further commands...
    1) Only download applications from trusted sources...
    2) Never accept application requests from unknown sources...
    3) Be alert for unusual behavior on the part of mobile phones and be sure to download a trusted security application that can scan the applications being downloaded onto your mobile device..."
    (More detail at the URLs above.)

    - http://www.darkreading.com/taxonomy/...e/id/232800310
    Apr 04, 2012
    ___

    android malware
    - https://encrypted.google.com/
    ... About 29,400,000 results

    Last edited by AplusWebMaster; 2012-04-09 at 15:46.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #596
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Credit Card fraud/malware attacks Facebook users

    FYI...

    Credit Card fraud/malware attacks Facebook users
    - https://www.trusteer.com/blog/facebo...dit-card-fraud
    April 03, 2012 - "... new configuration of the Ice IX malware that attacks Facebook users after they have logged in to their account and steals credit card and other personal information... discovered a “marketing” video used by the creators of the malware to demonstrate how the web injection works. The global reach and scale of the Facebook service has made it a favorite target of fraudsters... This latest attack uses a web injection to present a fake web page in the victim’s browser. The form requests the user provide their cardholder name, credit/debit card number, expiry date, CID and billing address. The attackers claim the information is needed to verify the victim’s identity and provide additional security for their Facebook account... This pop up* presents virtually the same message used in the Ice IX configuration our researchers discovered and analyzed. The only difference is the version in the video requests a social security number and date of birth, in addition to the information mentioned earlier... We contacted Facebook to advise them that they would be mentioned in this blog. Facebook requested that we pass on some information about their site’s security measures. Here’s a summary of their response:
    i) Facebook actively detects known malware on users' devices to provide Facebook users with a self-remediation procedure including the Scan-And-Repair malware scan. To self-enroll in this check point please visit – on.fb.me/AVCheckpoint
    ii) Please advise your readers to report to Facebook any spam they find on the Facebook site, and remember Facebook will never ask for your credit card, social security, or any other sensitive information other than your username and password while logging in."
    * http://www.trusteer.com/sites/default/files/Faceb.png
    ___

    - http://google.com/safebrowsing/diagn...=facebook.com/
    "... Part of this site was listed for suspicious activity 336 time(s) over the past 90 days... Of the 113053 pages we tested on the site over the past 90 days, 186 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-04-03, and the last time suspicious content was found on this site was on 2012-04-03. Malicious software includes 63 trojan(s), 62 exploit(s), 60 scripting exploit(s). Successful infection resulted in an average of 7 new process(es) on the target machine... Malicious software is hosted on 138 domain(s)... 28 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site... Over the past 90 days, facebook.com appeared to function as an intermediary for the infection of 56 site(s)... It infected 8 domain(s)..."

    Last edited by AplusWebMaster; 2012-04-04 at 12:34.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #597
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Olympic SPAM arrives...

    FYI...

    Olympic SPAM arrives...
    - http://blog.trendmicro.com/cybercrim...2012-olympics/
    Apr 5, 2012 - "... Users dreaming of watching the closing ceremonies of the London 2012 Olympics live may find the said offer hard to resist as Visa Golden Space is supposedly inviting users to join a lottery for a chance to win a travel package for the said event. Note that the said offer is non-existent. We also spotted a malware that arrives as a file named Early Check-In 2012 London Olympics.doc. This file, detected as TROJ_ARTIEF.XPL, exploits the RTF Stack Buffer Overflow Vulnerability found in several versions of Microsoft Office components. If it’s successful, it drops several other -malware- on your system, which Trend Micro detects as TROJ_DROPHIN.A and TROJ_PHINDOLP.A. This is not the first scam that uses this event to get users clicking. As early as 2008, Trend Micro has spotted a spammed message purporting to be a lottery drawn by the London 2012 Olympics committee. In May 2011, we also reported on a -spam- campaign that used London 2012 Olympics as bait. In addition, our social engineering e-guide mentions seasons and events as jump off points used by crooks. Online deals that look like they’re too good to be true, suspicious email messages promoting great but non-existent offers are also some of the tools used to lure users. All these tactics may lead to you inadvertently giving out your personal information, or for malware to be downloaded on your computer. Your personal information is not worth the risk of a chance to win a non-existent chance to win a lottery. Before clicking on that email link, investigate."
    ___

    Fake AT&T wireless bill links to malware
    - http://blog.commtouch.com/cafe/web-s...nk-to-malware/
    Apr 5, 2012 - "Large outbreaks of phony AT&T wireless emails* have been distributed in the last 2 days. The emails describe very large balances ($943 in example), that are sure to get aggravated customers clicking on the included links... Every link in the email leads to a different compromised site that has malware hidden inside. In the example below** this means -9- (!) different URLS – most emails with links to email limit themselves to one or two links.
    ** http://blog.commtouch.com/cafe/wp-co...mised-site.jpg
    The index.html file tries to exploit at least the following known vulnerabilities:
    Libtiff integer overflow in Adobe Reader and Acrobat – CVE-2010-0188
    Help Center URL Validation Vulnerability – CVE-2010-1885
    Recipients who are unsure whether the email they have received is genuine or not (the malicious version is a very accurate copy) should mouse-over the links. Genuine emails from AT&T will include AT&T website links. For example the “att.com” link will be the same in both places that it appears in the email – unlike the malicious version which uses 2 very different URLs. The fully functional homepage of one of the compromised sites is shown below. For more information about compromised websites see Commtouch’s report*** compiled in association with StopBadware."
    * http://blog.commtouch.com/cafe/wp-co...to-malware.jpg

    *** http://www.commtouch.com/compromised...es-report-2012
    ___

    Verizon-themed SPAM emails lead to ZeuS
    - http://blog.webroot.com/2012/03/29/s...eus-crimeware/
    March 29, 2012

    Last edited by AplusWebMaster; 2012-04-08 at 15:11.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #598
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake HP scan SPAM email leads to malware

    FYI...

    Fake HP scan SPAM email leads to malware
    - http://blog.dynamoo.com/2012/04/scan...njet-spam.html
    6 April 2012 - "Another fake HP scan spam email leading to malware. This one follows the new technique of putting a malicious HTML (HP_Scan.htm) file inside a ZIP file to reduce the risk of it being blocked, and then it has multiple payload sites to try to get a higher infection rate. Nasty.
    'Date: Fri, 6 Apr 2012 08:29:34 +0200
    From: "Hewlett-Packard Officejet 70419A" [JaysonGritten@ estout .com]
    Subject: Scan from a Hewlett-Packard ScanJet #02437326
    Attachments: HP_Document-12-Z1380.zip
    Attached document was scanned and sent
    to you using a Hewlett-Packard HP Officejet 45211A.'
    The payload can be found at:
    hxxp :// 211.44.250.173 :8080/navigator/jueoaritjuir.php
    hxxp :// 62.85.27.129 :8080/navigator/jueoaritjuir.php
    hxxp :// 219.94.194.138 :8080/navigator/jueoaritjuir.php
    hxxp :// 78.83.233.242 :8080/navigator/jueoaritjuir.php
    ... Anti-virus detection* is pretty poor at the moment...."
    * https://www.virustotal.com/file/fa20...fb09/analysis/
    File name: HP_Scan.htm
    Detection ratio: 10/42
    Analysis date: 2012-04-06 10:24:37 UTC
    ___

    - http://blog.webroot.com/2012/03/31/s...s-and-malware/
    March 31, 2012
    > https://webrootblog.files.wordpress....malware_01.png
    * https://www.virustotal.com/file/8169...65f0/analysis/
    File name: Invoice_NO_Mailen.htm
    Detection ratio: 21/42
    Analysis date: 2012-04-02 05:40:03 UTC

    Last edited by AplusWebMaster; 2012-04-08 at 15:07.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #599
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down EU tax invoice trojan ...

    FYI...

    EU tax invoice trojan...
    - http://blog.mxlab.eu/2012/04/08/tax-...ntains-trojan/
    April 8, 2012 - "... started to intercept a new trojan distribution campaign by email with the subject “invioce” and is sent from the spoofed address “European Commissions’s Office<info@infoeu.eu>” and has the following body:

    Please open the attached file for your income tax invoice.From the European
    Commission’s office .This message is for all the European Union citizens.
    Note: European Union citizens Tax invoices are provided Once a year.
    please refer to your tax Confirmation email. Attachment: Tax Invoice.
    For Better Understanding.
    Regards
    Mr Jeff Black

    The attached file is named invoice.exe and is approx. 170 kB large. The trojan is known as a variant of Win32/Injector.PWG (NOD32), W32/Obfuscated.D!genr (Norman), Trojan.Win32.Generic.pak!cobra ( VIPRE). At the time of writing, only 6 of the 42 AV engines did detect the trojan at Virus Total*..."
    * https://www.virustotal.com/file/327c...is/1333886755/
    File name: invoice.exe
    Detection ratio: 9/41
    Analysis date: 2012-04-08 12:05:55 UTC

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #600
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Dutch phishing emails target domains in Belgium/Netherlands

    FYI...

    Dutch phishing emails target domains in Belgium/Netherlands
    - http://blog.mxlab.eu/2012/04/10/dutc...e-netherlands/
    April 10, 2012 - "... increase of phishing emails, compared to the previous days, weeks and month, in the Dutch language that is sent to domains .be and .nl in Belgium and the Netherlands. The phishing emails are sent on behalf of ABN Amro and ING.
    Here are some subjects for ING phishing emails:
    - Mijn ING Breidt
    - Belangerijk Mijn ING Nieuws
    - Je hebt 1 ongelezen beveiligd Alert.
    Here are some subjects for the ABN AMRO Bank:
    - Beveiliging Message Alert van ABN AMRO Bank
    - 2012 ABN AMRO VERIFICATIE ..."
    (Examples of complete phish text at the URL above.)

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •