Monthly compendium of information. March 2009

Pistus Malware Intelligence Blog
30.03.09 Visual social engineering to spread malware
29.03.09 A recent tour of scareware V
27.03.09 Financial institutions targeted by the botnet Zeus. Part Two
26.03.09 Barracuda Bot. Botnet actively exploited
25.03.09 Financial institutions targeted by the botnet Zeus. Part One
23.03.09 Automating processes anti-analysis through of crimeware
13.03.09 Campaign scareware infection through false Windows...
11.03.09 Russian prices Crimeware
09.03.09 Strategy aggressive infection Police XP Antivirus....
07.03.09 Exploiting vulnerabilities with PDF files
06.03.09 Unique Sploits Pack. Crimeware to automate the exp...
05.03.09 Strategy aggressive infection Police XP Antivirus
03.03.09 Phishing Kit automatic spammers creator
01.03.09 Campaign Police Antivirus XP spreading through soc...

EvilFingers Blog
30.03.09 Financial institutions targeted by the botnet Zeus. Part two
27.03.09 Financial institutions targeted by the botnet Zeus. Part one
26.03.09 Automating processes through analysis of anti-crimeware
22.03.09 Campaign scareware false infection through Windows Explorer
13.03.09 Russian prices of crimeware
11.03.09 Police Aggressive Strategy of Antivirus XP infection. Second part
08.03.09 Exploitation of vulnerabilities through PDFs
06.03.09 Police Aggressive Strategy of Antivirus XP infection
04.03.09 automatic Phishing Kit Creator of fraudulent sites
02.03.09 Whitepaper. Analysis of an attack of web-based malware
01.03.09 Police Campaign through spreading XP Antivirus Visual Social Engineering

ESET Latinoamérica Blog (Spanish)
27.03.09 Download malware through cracks pages
25.03.09 ESET Presence in Central
12.03.09 Fake mails Movistar and Claro spread malware
04.03.09 Suspected malware download music sites
02.03.09 Tour starts ESET Antivirus 2009 Internet Security

Related information
Monthly compendium of information. February 2009
Monthly compendium of information. January 2009

Jorge Mieres

Ver más

Visual social engineering to spread malware

The methods of deception are a fundamental piece of strategies for dissemination of malicious code, above all, the trojans because they need the intervention of the human factor to meet its objectives effectively.

While the use of visual social engineering isn't an innovative method for anything, remains highly exploited by computer criminals in the hope of getting unsuspecting users to activate (double click) the malware.

Given these characteristics, the question that rings in my head immediately is, if it is not a novel method why is there a high rate of infection through this sort of cheating?

Perhaps one of the keys that allow answering the question whether the high demand of pornography over the Internet. "How well" tell a friend Central :-)

One of the main features of the visual social engineering lies in the operation of websites that promise multimedia content being pornography one of the most searched topics on the Internet and therefore, one of the most common exploit through this technique.

A concrete example pages represent the fake PornTube, which promises to display a video course, using as bait a picture of the alleged video, along with the need to install a codec that, of course, this is a malware and not a codec.

Below I discuss some of the URLs used to disseminate this strategy, but must take into account the number of domains used by the criminals behind it, is considerably longer.

watch-videos. cn
7wmv. In
alll-online.com/pl/pl. php
stumbulepon. com
video.stumbulepon. com
watch-video. info
yuotnbe. com
yuotuhe. com
world-tube. biz
hothotvideo. com
video-go. net
get-new.mee.fgu.name/sudofe. html
sandpaper-type.mee.fgu.name/qurer. html
free-avg.mee.fgu.name/qusthalyene. html

A question of supply and demand, who tend to visit pornographic sites they want to consume pornography. Never mind that the material is present in image or video format, or that in the middle of the video course requested the installation of ten "codec" who wants to pornography will do everything possible to get without measuring the potential security risks, so many sometimes implies.

Related information
Strategies of deception, spam and malicious code
Social Engineering and Waledac Valentine
Deception techniques that do not go out of style

Jorge Mieres

Ver más

A recent tour of scareware V

This summary is not available. Please click here to view the post.

Ver más

Financial institutions targeted by the botnet Zeus. Part two

The structure consists of ZeuS in php modules from which it controls and executes all the fraudulent and harmful for which it was conceived. For example, it's very common to find files of type s.php, sS.php, x.php or similar which would command control (C&C) of the bot.

Once infected, ZeuS download an encrypted file type. bin (usually cfg.bin) which is the file that specifies the configuration with a set of instructions that indicate the type of information to be collected and where to send.

When this file is decrypted, we can see shaping and financial institutions which carry out constant monitoring ZeuS from the zombie.

In this way, when the user accesses certain forms ZeuS intercepts the browser interaction in capturing all the information you need to realize their botmaster fraud.

The list of entities that are in the sights of ZeuS is really long, but some of them are:

myspace.com
gruposantander.es
vr-networld-ebanking.de
finanzportal.fiducia.de
bankofamerica.com
bbva.es
bancaja.es
olb2.nationet.com
online.lloydstsb.co.uk
pastornetempresas.bancopastor.es
bancopopular.es
ebay.com
us.hsbc.com
e-gold.com
online.wellsfargo.com
wellsfargo.com
paypal.com
usbank.com
citizensbankonline.com
onlinebanking.nationalcity.com
suntrust.com
53.com
web.da-us.citibank.com
bancaonline.openbank.es
extranet.banesto.es
empresas.gruposantander.es
bbvanetoffice.com
bancajaproximaempresas.com
citibank.de
probanking.procreditbank.bg
ibank.internationalbanking.barclays.com
online-offshore.lloydstsb.com
dab-bank.com
hsbc.co.uk
bancoherrero.com
intelvia.cajamurcia.es
caixasabadell.net
areasegura.banif.es
privati.internetbanking.bancaintesa.it
iwbank.it
cardsonline-consumer.com
money.yandex.ru
e-gold.com
paypal.com

These strategies represent malicious threats and make it clear that while email is still a channel used for the propagation of malware today is who works as an Internet-based attacks through various mass crimeware.

Related Information
Financial institutions targeted by the botnet Zeus...
Botnet Zeus. Mass propagation of his Trojan. Part Two
Botnet Zeus. Mass propagation of his Trojan. Part One

Jorge Mieres

Ver más

Barracuda Bot. Botnet actively exploited

Criminal processes carried out by cybercriminals through the exploitation of different crimeware applications designed for these purposes, are gaining notoriety because of the number of cases known at present, where malicious code spread via botnet are responsible for forming the way for further attacks and recruiting zombies.

Barracuda bot is a new alternative for offenders who also characterized by joint actions allow for any botnet, has special features which turn it into a "criminal tool" that allows "adapt to the needs of offenders".

Barracuda botnet is a bot, of Russian origin with English interface, completely modular with each module handles a specific task, offering the ability to update or add modules depending on the features you want to add to control zombies.

Thus, the offender may be buying the modules according to the criminal actions you want to commit, simply, through a control panel and administration via the web.

Moreover, it incorporates features of "security" as the encryption of the information transmitted by the bot, and the ability to restore their "business" via an emergency management system that reacts in case of a fall, allowing follow administration of the bot through IRC.

Among the most important features that incorporates this botnet are: the ability to download and run binaries. Exe and. Dll not infect previously infected machines again, encryption and polymorphism, among many others.

But undoubtedly, the striking of this, and reflecting that criminal activities conducted by the Internet is a real deal.

The crimeware is worth USD 1600 in the full version, ie all modules, but also offering a smaller version of USD 1000 that incorporates all the modules except the DDoS (Distributed Denial of Service).

Barracuda bot clients receive advice and support for free, even, also offers a licensing model atypical in these activities. The sale is limited to five (5) persons suffering updates a 60% discount with the purchase of two (2) modules accessing a 10% discount on the purchase of the next.

The modules are available at the moment are:

• DDoS Module. By which you can do: HTTP GET/POST flood, UDP flood, ICMP flood, TCP flood, IP spoofing. Its value is USD 900.
• Email Grabber module. Lets gather email addresses from the HD, gather email addresses from the address book from different customers, and capture real-time address each time you access the Internet. Its value is USD 600.
• Proxy Module. Increases the number of simultaneous connections for a more "efficient" sending spam, among other activities at the statistics. Its value is USD 500.
• PWDGRAB module. Clearly designed to steal sensitive information like passwords for websites, email accounts, FTP accounts, etc.. The value is USD 500.
  
• SSLSOCKS module. This module is in its beta stage and can "build a VPN" on the same bot. Its cost is USD 500.
  

Is it clear that for criminals is a business that makes significant gains?

Related information
Automating processes anti-analysis through of crim...
Russian prices Crimeware
Unique Sploits Pack. Crimeware to automate the exp...
LuckySploit, the right hand of ZeuS
Botnet ZeuS. Mass propagation of his Trojan. Part ...
Creating Online PoisonIvy based polymorphic malwar...

Jorge Mieres

Ver más

Financial institutions targeted by the botnet Zeus. Part one

This summary is not available. Please click here to view the post.

Ver más

Automating processes anti-analysis through of crimeware

The automation of malicious code is a life philosophy and a business round its creators as every day should focus their efforts on devising new "tools" that can "jump" detection methods proposed by the antivirus signatures.

Constantly appear new "proposals", increasingly professionalized, which help to delay the detection of malicious code through techniques anti-analysis and at the same time increase the profits of developers.

Polymorphic Cryptor Crum is one of many programs that are part of this category. It's a program used to encrypt malware environments; development in Russia for people who are on the mischievous side of the field to broaden the horizon of returns.


This is a new version of this crypter, just 1.1, which offers capabilities for handling polymorphic malicious code.

Among the features proposed by the polymorphic implementation are also of the same polymorphism:

• Using random
• Figures for imports and resources
• 128 for each section
• Overwriting the "Rich" and "Time / Date Stamp" on the header files
• Provides capabilities anti-debugger
• Avoid having to conduct a memory dump
• Avoid performance in controlled environments
• Change or delete the icon for the malicious binary

Here you will meet some of the functionality offered by the program, but sufficient to determine the degree of professionalism and hazardousness reached, in this case by Russian developers, the creation of malware is disturbing.

This implementation costs USD 100 on the black market. However, to complete the array of applications of this style, the same creator offers "only" a USD 50 joiner (used merging files) called Crum Joiner Polymorphic and USD 20 accessing updates same.

The interface of this program, which allows to merge several files such as a .jpg merge a binary .exe, is as follows:

In this case, some of the features that includes the application are:

• Capacities polymorphic
• Allows unlimited union files
• Supports multiple file extensions like .doc, .mp3, .avi, .jpg, .bmp and .exe
• File encryption of 256 bytes
• Ability to carry not only files .exe files but also .dll

In both cases, the creator recommends certain "security measures" to protect the "integrity" of development as the application does not refer to services such as VirusTotal, be ordered to encrypt the files and not sharing any of the components that constitute the applications.

Related Information
Russian prices Crimeware
Creating Online PoisonIvy based polymorphic malwar...

Jorge Mieres

Ver más

Campaign scareware infection through false Windows Explorer

Deception strategies are the main feature that uses the scareware to create fear in the user and ensure the implementation of your installer. While the excuses that are used for the deceptions are many, some more prominent than others, increasingly are being more clearly increased efforts to design and create more sophisticated strategies.

In this case, deception is focused on online scans produce a team that always found problems with infection, offering the download of the alleged security tool that will solve the problems. All completely false.

When the user first accesses the malicious page, an alert warns of the potential possibility that our team has been the victim of malicious code.

At this time there is a simulated scans of the team that is represented by a fake windows explorer and an animated gif that shows the progress bar indicating the progress of the scan, and then displays a popup with the nomenclature of alleged threats found in the system.

This image, which offers two options ("Remove all" and "Cancel") is another layer of deception, because no matter what sector of the image is clicked, the same effect: download the installer of malware. A file called install.exe MD5 which is 8eed59709de00e8862d6ce3d5e19cb4a.

Some of the web addresses that are actively exploiting this malicious activity are:

stabilityaudit.com (209.44.126.22)
websscan.com
goscanbay.com (78.159.101.27)
goanyscan.com

goscanever.com
goscanfuse.com
goscanit.com
goscanonly.com
goscanslot.com
gowayscan.com
in4co.com
in4ik.com
megascan4.com
www.goscanonly.com
www.homescan4.com
easywinscanner17.com (209.249.222.48)
fast-antimalware-scanner.com (194.165.4.7)
fastantimalwarescan.com (78.47.91.153)

However, professionals seeking to refine their creators will try to cover as much of the "public" as possible by deploying the strategy of infection in several languages.

Even downloading malware variantsthereof. Thus, the creators of scareware try to cover the two main languages used worldwide such as English and Spanish.

Related information
Strategy aggressive infection Police XP Antivirus....
Strategy aggressive infection Police XP Antivirus
Campaign Police Antivirus XP spreading through soc...
A recent tour of scareware IV
AntiSpyware 2009 has expanded its offers malicious...
New strategy to disseminate scareware IS
Attacking Mac systems through false security tool

Jorge Mieres

Ver más