A recent tour of scareware X

Again, the domains outlined in the present form only a tiny portion of the total volume of web addresses used to propagate scareware.

Our goal is channeled to expose a set of domains that can be used for research purposes, blocking them or just know what the threats of this kind that have emerged (or reemerged) in recent days.


Virus Remover Professional
MD5: 19f19c24e0b065696bec1906bc8f0961
IP: 213.182.197.229
Latvia Riga Real_host_net
Domains associated:
avpro-labs .com

Result: 2/41 (4.88%)

MalwareDoc +
IP: 72.9.108.26
United States New York Ezzi.net
Domains associated:
mal-warexls .net
malware-safe .com
kingpinservers .info
internetware-safe .com



Antivirus Agent Pro
MD5: 24176f08a13e09495b163ac3343ebba8
IP: 83.133.126.46
Germany Lncde-greatnet-newmedia
Domains associated:
avagent-pro .com, actupdate .net, download-123 .cn, downloads-123 .com, t230.1paket .com, www.downloads-123 .com
Result: 15/41 (36.59%)

Personal Antivirus
IP: 208.76.56.56
United States Burlingame Everydns Llc
Domains associated:
folderantispywarescanner .com
123vuilen .net
A1pro .hn
Bestlaostours .com

areascan4.info/download/install.php, finescan4.info/download/install .php, goalscan4.info/download/install.php, hardscan4.info/download/install .php, modescan4.info/download/install.php, onescan4.info/download/install .php, pagescan4.info/download/install.php, portscan4.info/download/install .php, scan4into.info/download/install.php (209.44.126.102) - Laval Netelligent Hosting Services Inc

Download "install.exe" (MD5: 6f4488dcb648054f3cf2a7a1bdbb44bf)
Result: 11/39 (28.21%)

av4best .net/?uid=106&pid=3, 7security.info/?uid=102&pid=3 (64.86.17.47) - Brampton Velcom
best-adultnet .com/promo2 (91.212.132.11) - Serbia Interforum Ltd
fastpcscan3 .com/download.php?id=2022 (91.212.65.125) - Eurohost Llc
fastpcscan3 .com/download/Setup-398_02022.exe (92.62.98.19) - Tallinn Collocation
powerantivirusscannerv2 .com/download/Setup-a5320fa_02018.exe (88.198.41.170) - Gunzenhausen Hetzner-rz-nbg-net

safetywwwtools .com/hitin.php?land=98&affid=16100 (209.44.126.36) - Laval Netelligent Hosting Services Inc
Result: 12/41 (29.27%)

avprotectionstat .com/index.php (74.50.99.236) - Tampa Noc4hosts Inc
registerantivirus .com (74.50.98.152) - Tampa Noc4hosts Inc
youravprotection .com/support (74.50.98.162) - Tampa Noc4hosts Inc
allfet .info/antispyware (208.100.34.148) - Chicago Nozone Inc
suprotect .com/hitin.php?land=20&affid=02909 (89.149.212.218) - Netdirect-net-exportal
activeantivir .com (78.159.114.189) - Berlin Netdirekt E.k
antivirusfolderscanner .com (69.4.230.205) - Chicago Hosting Services Inc
apoiweh .cn/x_private_backtraffnail.php/?uid=102 (222.73.219.74) - Beijing Chinanet Shanghai Province Network
blanket.bitelere.us (93.190.142.134) - Schiedam Worldstream

Antivirus Best
MD5: eba5ca538be5b69f59f4de9ae8a21f5f
IP: 174.142.113.205
Canada Montreal Iweb Technologies Inc
Domains associated:
best-protect .info, av-protect.info
run.best-protect.info, scanner.av-protect.info
scanner.best-protect.info, download.best-protec.info

Result: 20/41 (48.78%)


Related information this Blog
Una recorrida por los últimos scareware IX
Una recorrida por los últimos scareware VIII
Una recorrida por los últimos scareware VII
Una recorrida por los últimos scareware VI
Una recorrida por los últimos scareware V
Una recorrida por los últimos scareware IV
Una recorrida por los últimos scareware III
Una recorrida por los últimos scareware II
Una recorrida por los últimos scareware

Jorge Mieres

Ver más

ElFiesta. Recruitment zombie across multiple threats

ElFiesta is another member of the family of web applications, created by Russian developer and made available to cyber-criminals, who can't only monitor and manage each of the infected computers as part of its network (zombies), but also execute attacks via the web through various techniques that involve the exploitation of vulnerabilities.

One of the modules has ElFiesta precisely target the spread/infection via PDF (Portable Document Format) looking for vulnerabilities in some versions of Adobe Acrobat Reader.

In this case, the downloaded file is called 4573.pdf (MD5: b7b7d52a205e950adf4795c14c7f7178), whose name is random, has a detection rate of almost 50%, thus a very important infection rate at the moment.

As mentioned above, exploits a vulnerability (the CVE-2007-5659) multiple causes a buffer overflow through the pdf file previously handled by embedding a malicious script in the same JavaScript that downloads and executes a binary called load.exe (MD5: 5ee26f43139a2cdb3a79a835574285a0) from /load.php?id=1118&spl=3.

Another focuses ElFiesta modules incorporating a method of attack scripting subject to an obfuscation technique.

Making a deeper analysis of the case, we found a newly implemented version ElFiesta. In the following screen shows that the statistical information corresponds to our data.

These methods are common to most of crimeware applications of this style, but we appreciate a more interesting detail: the domain used is a known scareware called XP Police Antivirus.

Consequently, the first question that comes to mind is: XP Police Antivirus working with the recruitment ElFiesta zombie? 

Related information this Blog
Fusión. Un concepto adoptado por el crimeware actual
Estrategia de infección agresiva de XP Police Antivirus
Campaña de propagación de XP Police Antivirus a través de Ingeniería Social Visual

Jorge Mieres

Ver más

Symbiosis malware present. Koobface

Koobface is a worm designed to exploit the user profiles of popular social networks like MySpace and FaceBook in order to obtain sensitive and confidential information of their victims, although the latest versions limiting their goal FaceBook. In fact, the word Koobface is a transposition of the word Facebook.

His early versions date back to late 2008 and since then continues In-the-Wild with an infection rate of concern. Thus, the same company released a series of preventive measures to minimize the potential risk of infection, which is constantly latent for users who use the social network.

In principle, the usual means of dissemination used Koobface is via web through visual Social Engineering and is the first facet of propagation.

The second facet (infection) channeled their malicious actions in a very common at present, based on a combination of malware, creating a symbiosis where each component of ambient display instructions to seek a common objective and comprehensive.

But let's see which are these components that form a part of the stage of infection of the variant Koobface. NBO. This worm, detected nowadays by approximately 31 companies antivirus of 41 (75.61 %), on having infected the system establishes connection with the following URL's:

http://oberaufseher.net/img/cmd.php 
http://pornfat.net/img/cmd.php

It also downloads the following malware:

TrojanDownloader.Small.OCS Troyano 
Tinxy.AD Troyano 
Tinxy.AF Troyano 
BHO.NOE Troyano 
Koobface.NBH gusano 
PSW.LdPinch.NEL Troyano

From the technical point of view, some data can be collected in the brief preliminary analysis of each of the malicious code downloaded by Koobface:

The trojan TrojanDownloader.Small.OCS has a detection rate of 35/40 (87.5%) creates keys in the registry and backs himself. 

HKLM\SOFTWARE\Microsoft\MSSMGR\   
HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\winccf32   
C:\WINDOWS\system32\winccf32.dll (copy of itself). 

Tinxy.AF, another trojan, it also creates files in the system and has a detection rate of slightly less than the previous 30/40 (75.00%). 

C:\windows\ld09.exe   
C:\docume~1\user\locals~1\temp\podmena.bat 

The trojan Tinxy.AD has a detection rate of 35/40, was detected by approximately 87.50% of the virus. Creates a copy of itself and makes use of the tool to enable a NetShell DLL, open ports, and specify a proxy. 

C:\WINDOWS\system32\SYSDLL.exe (copy of itself)   
netsh add allowedprogram "SYSDLL" C:\WINDOWS\System32\SYSDLL.exe ENABLE   
netsh firewall add portopening TCP 80 SYSDLL ENABLE   
netsh firewall add portopening TCP 7171 SYSDLL ENABLE   
netsh winhttp set proxy proxy-server="http=localhost:7171" Agrega la información del proxy en:HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /d "http=localhost:7171" /f 

BHO.NOE is another of the trojans as part of the process of infection Koobface, with a detection rate of 92.11% (35/38), create a folder and a file. 

C:\WINDOWS\system32\796525   
C:\WINDOWS\system32\796525\796525.dll

As to PSW.LdPinch.NEL trojan, detected by 34 antivirus of 40 (85.00%), is designed to steal passwords from different web browsers, mail clients, IM clients and other services.

Finally, download a variant of the family, the worm Koobface.NBH, in this case, the detection rate was 27/40 (approx. 67.50%).

As we can see, the infection of this malware isn't just limited to malicious instructions they have, but it goes beyond that and download another. This action is a common behavior in the present, where the fusion of Web applications and control of botnets and the administration of different types of malware, joining forces with a common goal: improving the economics of crime. 

Jorge Mieres

Ver más

Monthly compendium of information. March 2009

Pistus Malware Intelligence Blog
30.03.09 Visual social engineering to spread malware
29.03.09 A recent tour of scareware V
27.03.09 Financial institutions targeted by the botnet Zeus. Part Two
26.03.09 Barracuda Bot. Botnet actively exploited
25.03.09 Financial institutions targeted by the botnet Zeus. Part One
23.03.09 Automating processes anti-analysis through of crimeware
13.03.09 Campaign scareware infection through false Windows...
11.03.09 Russian prices Crimeware
09.03.09 Strategy aggressive infection Police XP Antivirus....
07.03.09 Exploiting vulnerabilities with PDF files
06.03.09 Unique Sploits Pack. Crimeware to automate the exp...
05.03.09 Strategy aggressive infection Police XP Antivirus
03.03.09 Phishing Kit automatic spammers creator
01.03.09 Campaign Police Antivirus XP spreading through soc...

EvilFingers Blog
30.03.09 Financial institutions targeted by the botnet Zeus. Part two
27.03.09 Financial institutions targeted by the botnet Zeus. Part one
26.03.09 Automating processes through analysis of anti-crimeware
22.03.09 Campaign scareware false infection through Windows Explorer
13.03.09 Russian prices of crimeware
11.03.09 Police Aggressive Strategy of Antivirus XP infection. Second part
08.03.09 Exploitation of vulnerabilities through PDFs
06.03.09 Police Aggressive Strategy of Antivirus XP infection
04.03.09 automatic Phishing Kit Creator of fraudulent sites
02.03.09 Whitepaper. Analysis of an attack of web-based malware
01.03.09 Police Campaign through spreading XP Antivirus Visual Social Engineering

ESET Latinoamérica Blog (Spanish)
27.03.09 Download malware through cracks pages
25.03.09 ESET Presence in Central
12.03.09 Fake mails Movistar and Claro spread malware
04.03.09 Suspected malware download music sites
02.03.09 Tour starts ESET Antivirus 2009 Internet Security

Related information
Monthly compendium of information. February 2009
Monthly compendium of information. January 2009

Jorge Mieres

Ver más

Visual social engineering to spread malware

The methods of deception are a fundamental piece of strategies for dissemination of malicious code, above all, the trojans because they need the intervention of the human factor to meet its objectives effectively.

While the use of visual social engineering isn't an innovative method for anything, remains highly exploited by computer criminals in the hope of getting unsuspecting users to activate (double click) the malware.

Given these characteristics, the question that rings in my head immediately is, if it is not a novel method why is there a high rate of infection through this sort of cheating?

Perhaps one of the keys that allow answering the question whether the high demand of pornography over the Internet. "How well" tell a friend Central :-)

One of the main features of the visual social engineering lies in the operation of websites that promise multimedia content being pornography one of the most searched topics on the Internet and therefore, one of the most common exploit through this technique.

A concrete example pages represent the fake PornTube, which promises to display a video course, using as bait a picture of the alleged video, along with the need to install a codec that, of course, this is a malware and not a codec.

Below I discuss some of the URLs used to disseminate this strategy, but must take into account the number of domains used by the criminals behind it, is considerably longer.

watch-videos. cn
7wmv. In
alll-online.com/pl/pl. php
stumbulepon. com
video.stumbulepon. com
watch-video. info
yuotnbe. com
yuotuhe. com
world-tube. biz
hothotvideo. com
video-go. net
get-new.mee.fgu.name/sudofe. html
sandpaper-type.mee.fgu.name/qurer. html
free-avg.mee.fgu.name/qusthalyene. html

A question of supply and demand, who tend to visit pornographic sites they want to consume pornography. Never mind that the material is present in image or video format, or that in the middle of the video course requested the installation of ten "codec" who wants to pornography will do everything possible to get without measuring the potential security risks, so many sometimes implies.

Related information
Strategies of deception, spam and malicious code
Social Engineering and Waledac Valentine
Deception techniques that do not go out of style

Jorge Mieres

Ver más