Fake AV - Malware sites to block 19/12/12
FYI...
Fake AV - Malware sites to block 19/12/12
-
http://blog.dynamoo.com/2012/12/malware-sites-to-block-191212.html
19 Dec 2012 - "This group of sites appears to be using a
fake AV applications to download a malicious file
scandsk.exe (report here*) via
79.133.196.103 (eTop, Poland) and
82.103.140.100 (Easyspeedy, Denmark) which then attempts to call home to
46.105.131.126 (OVH, Ireland).
*
https://www.virustotal.com/file/5c6...c37895e88cc0e7e87398b307b4e98d4bc70/analysis/
Detection ratio:
14/45
This is a screenshot of the fake AV in action:
>
https://lh3.ggpht.com/-D3JYfW2LwH8/UNGNBXwma4I/AAAAAAAAA1I/tyIDs4EZIcc/s1600/fakeav.png
From this point, the scandsk.exe gets download either through an exploit or social engineering. This executable looks like some sort of downloader, which attempt to pull down additional data from these non-responding domains:
report.q7ws17sk1ywsk79g .com
report.7ws17sku7myws931u .com
report.u79i1qgmywskuo9o .com
There's some sort of trickery here, perhaps it requires exactly the right kind of factors to hit a valid URL, the automated analysis tools are inconsistent... but seem to indicate a C&C on
46.105.131.126. This IP belongs to OVH (no surprises there) but seems to have been suballocated:
inetnum: 46.105.131.120 - 46.105.131.127
netname: marysanders1
descr: marysanders1net
country: IE
org: ORG-OH5-RIPE
admin-c: OTC9-RIPE
tech-c: OTC9-RIPE
status: ASSIGNED PA
mnt-by: OVH-MNT
source: RIPE # Filtered
I suspect that this whole block is being used for malicious purposes,
46.105.131.123 hosts a site called find-and-go .com registered in China which has been fingered as an attack site before.... I would recommend blocking the entire
46.105.131.120/29 to be on the safe side. The infection sites are on
82.103.140.100 and 79.133.196.103, they make extensive use of subdomains of mooo .com, ez .lv and zyns .com. There are probably legitimate sites making use of these domains, but blocking them completely should give you few headaches. 79.133.196.103 is part of small block of IPs,
79.133.196.96/27, that I have seen malware on before, specifically 79.133.196.105 and 79.133.196.124. Blocking the entire /27 is probably a good idea.
Recommended blocklist:
46.105.131.120/29
82.103.140.100
79.133.196.97/27
mooo .com
ez .lv
zyns .com
Alternatively, these are some of the subdomains in use..
there are a lot of them, and probably more than I have listed here..."
(More detail at the dynamoo URL above.)
___
Fake Facebook SPAM / 46.249.58.211 and 84.200.77.218
-
http://blog.dynamoo.com/2012/12/facebook-spam-4624958211-and-8420077218.html
19 Dec 2012 - "There are
various Facebook spams doing the rounds
pointing to a variety of malware sites on
46.249.58.211 and
84.200.77.218, for example:
From: FB.Team
Sent: 19 December 2012 14:30
Subject: Re-activate account
Hi [redacted],
Your account has been blocked due to spam activity.
To verify account, please follow this link:
http ://www.facebook .com/confirmemail.php?e=[redacted]
You may be asked to enter this confirmation code: [redacted]
The Facebook Team
Didn't sign up for Facebook? Please let us know.
46.249.58.211 (Serverius Holding, Netherlands)...
84.200.77.218 (Misterhost, Germany)...
GFI has some more details on this one here*."
*
http://gfisoftware.tumblr.com/post/38303266759/your-facebook-account-is-blocked-due-to-spam-activity
Your Facebook Account is Blocked due to Spam Activity
Dec 19, 2012
___
Fake ‘Change Facebook Color Theme’ events lead to rogue Chrome extensions
-
http://blog.webroot.com/2012/12/19/...theme-events-lead-to-rogue-chrome-extensions/
Dec 19, 2012 - "Cybercriminals have recently launched a privacy-violating campaign spreading across Facebook in an attempt to trick Facebook’s users into installing
a rogue Chrome extension. Once installed,
it will have access to all the data on all web sites, as well as access to your tabs and browsing history...
Sample screenshot of one of the few currently active Facebook Events promoting the rogue Chrome extension:
>
https://webrootblog.files.wordpress...me_02_rogue_google_chrome_extension.png?w=702
The campaign is relying on automatically registered Tumblr accounts, where the actual redirection takes place. Users are exposed to the following page, enticing them into changing their Facebook color theme:
>
https://webrootblog.files.wordpress...rogue_google_chrome_extension.png?w=477&h=289
Once users accept the EULA and Privacy Policy, they will become victims of the privacy-violating Chrome extension:
>
https://webrootblog.files.wordpress...rogue_google_chrome_extension.png?w=555&h=355
... the cybercriminals behind the campaign not only hosted it on Amazon’s cloud, they also featured it in Chrome’s Web Store:
>
https://webrootblog.files.wordpress...rogue_google_chrome_extension.png?w=614&h=324
In case users choose -not- to accept the EULA and the Privacy Policy, the cybercriminals behind the campaign will once again attempt to monetize the hijacked Facebook traffic by asking them to participate in surveys, part of CPA (Cost-Per-Action) affiliate network, earning -them- money:
>
https://webrootblog.files.wordpress...rogue_google_chrome_extension.png?w=554&h=310
... Users are advised to
be extra cautious when accepting EULAs and Privacy Policies,
in particular when installing browser extensions that have the capacity to access sensitive and personally identifiable data on their PCs..."
___
Google Docs SPAM/PHISH...
-
https://isc.sans.edu/diary.html?storyid=14731
Last Updated: 2012-12-19 - "... Scams where the attacker's data-collection form resides at a Google Docs (now Google Drive) are especially difficult to warn users about. After all, the
malicious webpage resides at the -trusted- google .com domain. The effect is especially severe for organizations using Google Apps as a collaboration platform...
such scams aren't going away any time soon..."
> F-secure:
http://www.f-secure.com/weblog/archives/00002168.html
> GFI:
http://www.gfi.com/blog/google-docs-phishing/
> Sophos:
http://nakedsecurity.sophos.com/2012/05/30/phishing-with-help-from-google-docs/
... Recipients who clicked the "CLICK HERE" link were directed to the following "IT HELPDESK SERVICE" page, which prompted for
logon credentials that the attacker wanted to capture...
>
https://isc.sans.edu/diaryimages/images/it-helpdesk-service-3.png
... The attacker was likely using a
-compromised- Google Apps account of another organization to create a Google Docs spreadsheet and expose its data entry form...
Avoid clicking on email links when you need to take important actions that require logging in. Relying on a previously-saved bookmark is safer..."
___
LinkedIn Spam: The Repeat
-
http://www.gfi.com/blog/linkedin-spam-the-repeat/
Dec 19, 2012 - "Another slew of
spam claiming to originate from LinkedIn has hit the wild Internet in less than 24 hours, according* to the real time recording and tracking of email threats by our researchers in the AV Labs.
*
http://gfisoftware.tumblr.com/post/38238165249/malicious-linkedin-invitation-spam-returns
... Here’s what the email looks like:
>
http://www.gfi.com/blog/wp-content/uploads/2012/12/LinkedIn_1218-wm.png
From: {bogus email address}
To: {random}
Subject: Join my network on LinkedIn
Message body:
{redacted} has indicated you are a Friend
I’d like to add you to my professional network on LinkedIn.
[Allow button] View invitation from {redacted}
WHY MIGHT CONNECTING WITH {redacted} BE A GOOD IDEA?
{redacted} connections could be useful to you
After accepting {redacted} invitation, check {redacted} connections to see who else you may know and who you might want an introduction to. Building these connections can create opportunities in the future.
Clicking the Allow button or the link on the message body directs users to
several Web pages of compromised sites, which all look like this:
>
http://www.gfi.com/blog/wp-content/uploads/2012/12/linkedin-01-wm-300x105.png
This page laced with the
Blackhole Exploit Kit code then
auto-redirects users to a Russian website where the Cridex info-stealer payload can be downloaded.
>
http://www.gfi.com/blog/wp-content/uploads/2012/12/linkedin-02-wm-300x131.png
when in doubt, users should simply visit their LinkedIn pages and check their profile mailbox for invites..."
___
Wire Transfer SPAM / angelaonfl .ru
-
http://blog.dynamoo.com/2012/12/wire-transfer-spam-angelaonflru.html
19 Dec 2012 - "This
fake Wire Transfer spam leads to malware on angelaonfl .ru:
Date: Wed, 19 Dec 2012 11:26:24 -0500
From: "Myspace" [noreply @message .myspace .com]
Subject: Wire Transfer (3014YZ20)
Welcome,
Your Wire Transfer Amount: USD 45,429.29
Transfer Report: View
EULALIA Henry,
The Federal Reserve Wire Network
The malicious payload is at [donotclick]angelaonfl .ru:8080/forum/links/column.php hosted on the following IPs:
91.224.135.20 (Proservis UAB, Lithunia)
210.71.250.131 (Chunghwa Telecom, Taiwan)
217.112.40.69 (Utransit, UK)
The following domains and IPs are all related and
should be blocked if you can:
91.224.135.20
210.71.250.131
217.112.40.69 ..."
(More detail at the dynamoo URL above.)
___
Threat Outbreak Alerts
-
http://tools.cisco.com/security/center/threatOutbreak.x?i=77
Home > Security Intelligence Operations > Latest Threat Information > Threat Outbreak Alerts
Fake Order Request E-mail Messages - December 19, 2012
Fake Party Invitation E-mail Messages - December 19, 2012
Fake Sample Product Quote E-mail Messages - December 19, 2012
Fake Scanned Image E-mail Messages - December 19, 2012
Fake Unspecified E-mail Messages - December 18, 2012
Fake Payment Invoice E-mail Messages - December 18, 2012
Fake Funds Transfer Notification E-mail Message - December 18, 2012
Fake Airline Ticket Order Notification E-mail Messages - December 18, 2012
Fake Product Order Quotation Attachment E-mail Message - December 18, 2012
Fake Tax Invoice E-mail Messages - December 18, 2012
Fake Order Invoice Notification E-mail Messages - December 18, 2012
Fake Sales Request E-mail Messages - December 18, 2012 ...
:fear:
