Just a quick note to say that if you see an email referring to the site ipma2014.org then this is a new domain for the so-called Institute of Project Management America. Beware.
It is NOT related to the 28th IPMA World Congress which uses the domain ipma2014.com or any other legitimate professional organisation. You can read my research on the activities of the people behind this outfit here.
Saturday 2 August 2014
Friday 1 August 2014
"Corporate eFax message from "unknown" - 3 page(s)" spam
Date: Fri, 1 Aug 2014 09:45:45 -0700 [12:45:45 EDT]
From: eFax Corporate [message@inbound.efax.com]
Subject: Corporate eFax message from "unknown" - 3 page(s)
You have received a 3 page fax at 2014-08-01 10:55:05. * The
reference number for this fax is p2_did1-4724072401-8195088665-159. Thank you for
using the eFax Corporate service! 2014 j2 Global, Inc. All rights reserved. eFax
Corporate is a registered trademark of j2 Global, Inc. This account is subject to the
terms listed in the eFax Corporate Customer Agreement.
Attached is an archive file Fax_912_391233111_941.zip which in turn contains a malicious executable Fax_912_391233111_941.scr which has a VirusTotal detection rate of 10/54.
The Comodo CAMAS report shows the malware reaching out to the following locations:
94.23.247.202/0108us1/SANDBOXA/0/51-SP2/0/
94.23.247.202/0108us1/SANDBOXA/1/0/0/
theyungdrungbon.com/wp-includes/images/0108us1.zip
101romanticcheapdates.com/wp-includes/images/0108us1.zip
Recommended blocklist:
94.23.247.202
theyungdrungbon.com
101romanticcheapdates.com
Labels:
EXE-in-ZIP,
Fax Spam,
Malware,
Spam,
Viruses
"Payroll Received by Intuit" spam / Cryptowall
I haven't seen any fake Intuit spam for a while. This one comes with a malicious attachment:
According to the evidence of this very detailed ThreatTrack report [pdf], this is a version of Cryptowall. It makes network connections to various sites including the now-familiar 94.23.247.202.
I recommend that you block the following domains and IPs:
94.23.247.202
theothersmag.com
poroshenkogitler.com
kpai7ycr7jxqkilp.onion2web.com
Date: Fri, 1 Aug 2014 07:59:12 -0600 [09:59:12 EDT]The attachment in this case is called Remittance.zip and it contains a malicious executable Remittance.exe which has a VirusTotal detection rate of 9/53.
From: Intuit Payroll Services [IntuitPayrollServices@payrollservices.intuit.com]
Subject: Payroll Received by Intuit
Dear, [redacted]
We received your payroll on August 01, 2014 at 09:01 AM EST.
Attached is a copy of your Remittance. Please click on the attachment in order to view it.
Please note the deadlines and status instructions below: If your payroll is received
BEFORE 5 p.m., your Direct Deposit employees will be paid two (2) banking days from the
date received or on your paycheck date, whichever is later. If your payroll is received
AFTER 5 p.m., your employees will be paid three (3) banking days from the date received
or on your paycheck date, whichever is later. YOUR BANK ACCOUNT WILL BE DEBITED THE DAY
BEFORE YOUR CHECKDATE. Funds are typically withdrawn before normal banking hours so
please make sure you have sufficient funds available by 12 a.m. on the date funds are to
be withdrawn. Intuit must receive your payroll by 5 p.m., two banking days before your
paycheck date or your employees will not be paid on time. Intuit does not process
payrolls on weekends or federal banking holidays. A list of federal banking holidays can
be viewed at the Federal Reserve website. Thank you for your business.
Sincerely, Intuit Payroll Services
IMPORTANT NOTICE: This notification is being sent to inform you of a critical matter
concerning your current service, software, or billing. Please note that if you previously
opted out of receiving marketing materials from Intuit, you may continue to receive
notifications similar to this communication that affect your service or software. If you
have any questions or comments about this email, please DO NOT REPLY to this email. If
you need additional information please contact us.
If you receive an email message that appears to come from Intuit but that you suspect is
a phishing email, please forward it to immediately to spoof@intuit.com. © 2014 Intuit
Inc. All rights reserved. Intuit and the Intuit Logo are registered trademarks and/or
registered service marks of Intuit Inc. in the United States and other countries. All
other marks are the property of their respective owners, should be treated as such, and
may be registered in various jurisdictions.
Intuit Inc. Customer Communications
2800 E. Commerce Center Place, Tucson, AZ 85706
According to the evidence of this very detailed ThreatTrack report [pdf], this is a version of Cryptowall. It makes network connections to various sites including the now-familiar 94.23.247.202.
I recommend that you block the following domains and IPs:
94.23.247.202
theothersmag.com
poroshenkogitler.com
kpai7ycr7jxqkilp.onion2web.com
Labels:
EXE-in-ZIP,
INTUIT,
Malware,
Spam,
Viruses
New York City Police "Homicide Suspect" spam using goo.gl shortener to spread malware
The bad guys are enjoying the goo.gl URL shortening service at the moment (remember, you can report goo.gl spam to goo.gl/spam-report). This spam is slightly unusual..
Adding a "+" to the end of the URL reveals the click statistics
Blocking unionlawgroup.com is probably a good idea.
From: ALERT@nyc.gov [ALERT@static-23-106-230-77.ipcom.comunitel.net]The link in the email is goo.gl/RwNKEA which goes to unionlawgroup.com/wp-content/images/Documents-43632.zip which is exactly the same payload as used in this spam.
Date: 1 August 2014 10:43
Subject: Homicide Suspect
Bulletin Headline: HOMICIDE SUSPECT
Sending Agency: New York City Police
Sending Location: NY - New York - New York City Police
Bulletin Case#: 14-10078
Bulletin Author: BARILLAS #9075
Sending User #: 94265
APBnet Version: 287320
The bulletin is a pdf file. To download please follow the link below (Google Disk Drive service):
https://goo.gl/RwNKEA
The Adobe Reader (from Adobe.com) will display and print the bulletin best.
You can Not reply to the bulletin by clicking on the Reply button in your email software.
Adding a "+" to the end of the URL reveals the click statistics
Blocking unionlawgroup.com is probably a good idea.
NatWest "You have a new Secure Message" spam uses goo.gl links to spread malware
From: NatWest [secure.message@natwest.com]The link in the email goes to goo.gl/dGDi7l and the downloads a ZIP file from berkleyequine.com/wp-includes/images/Documents-43632.zip, containing a malicious executable Documents-43632.scr which has a VirusTotal detection rate of just 1/54. The CAMAS report shows that the malware calls out to the following URLs;
Date: 24 July 2014 10:39
Subject: You have a new Secure Message
You have received a secure message from NatWest Bank
To read your secure message please click here. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it in a Web browser.
If you have concerns about the validity of this message, contact the sender directly.
First time users - will need to register after opening the attachment.
Help - https://securemail.natwest.com/websafe/ml/help?topic=RegEnvelope
94.23.247.202/0108uk1/SANDBOXA/0/51-SP2/0/
94.23.247.202/0108uk1/SANDBOXA/1/0/0/
94.23.247.202/0108hk1/SANDBOXA/1/0/0/
94.23.247.202/0108ok1/SANDBOXA/1/0/0/
acanthe.be/css/01u1.rar
dirbeen.com/misc/01u1.rar
porfintengoweb.com/css/heap_61_id3.rar
sso-unidadfinanzas.com/images/heap_61_id3.rar
theothersmag.com/covers/opened.rar
firstfiresystems.com/css/slimbox/opened.rar
The characteristics of this malware are very similar to this one seen yesterday, and you can be assured that there are other goo.gl URLs and download locations in addition to the one listed here.
Because you can see the stats for any goo.gl URL just by adding a "+" on the end, it is possible to see who is clicking through. Oddly, there is not a single clickthrough from the UK where the NatWest bank is actually based.
Google don't make it easy to report spammy links and they are awfully slow to respond to reports, but their reporting form is at goo.gl/spam-report if you want to try it (I would recommend giving it a go).
Recommended blocklist:
94.23.247.202
acanthe.be
dirbeen.com
porfintengoweb.com
sso-unidadfinanzas.com
theothersmag.com
firstfiresystems.com
berkleyequine.com
Thursday 31 July 2014
"Scanned Image from a Xerox WorkCentre" spam
This is a thoroughly old school spam with a malicious attachment.
Guess what.. it isn't an image at all, but a ZIP file with the unusual name of Image_[_var=partorderb].zip which contain a malicious executable Image_07312014.scr, scoring a measly 1/54 at VirusTotal.
The Comodo CAMAS report shows that the malware downloads components from the following locations:
94.23.247.202/3107us2/SANDBOXA/0/51-SP2/0/
94.23.247.202/3107us2/SANDBOXA/1/0/0/
94.23.247.202/3107h2/SANDBOXA/1/0/0/
94.23.247.202/3107op2/SANDBOXA/1/0/0/
globe-runners.com/fichier_pdf/31u2.zip
lucantaru.it/docs/31u2.zip
mediamaster-2000.de/img/heap.zip
ig-engenharia.com/wp-content/uploads/2014/02/heap.zip
upscalebeauty.com/img/colors/teal/opened.zip
lagrimas.tuars.com/css/opened.zip
There are some further clues in the VirusTotal comments as to what the malware does. Sophos has also seen the 94.23.247.202 (OVH, France) IP before.
Recommended blocklist:
94.23.247.202
globe-runners.com
lucantaru.it
mediamaster-2000.de
ig-engenharia.com
upscalebeauty.com
lagrimas.tuars.com
Date: Thu, 31 Jul 2014 18:16:08 +0000 [14:16:08 EDT]
From: Local Scan [scan.614@victimdomain]
Subject: Scanned Image from a Xerox WorkCentre
You have a received a new image from Xerox WorkCentre.
Sent by: victimdomain
Number of Images: 5
Attachment File Type: ZIP [PDF]
WorkCentre Pro Location: Machine location not set
Device Name: victimdomain
Attached file is scanned image in PDF format.
Adobe(R)Reader(R) can be downloaded from the following URL: http://www.adobe.com/
Guess what.. it isn't an image at all, but a ZIP file with the unusual name of Image_[_var=partorderb].zip which contain a malicious executable Image_07312014.scr, scoring a measly 1/54 at VirusTotal.
The Comodo CAMAS report shows that the malware downloads components from the following locations:
94.23.247.202/3107us2/SANDBOXA/0/51-SP2/0/
94.23.247.202/3107us2/SANDBOXA/1/0/0/
94.23.247.202/3107h2/SANDBOXA/1/0/0/
94.23.247.202/3107op2/SANDBOXA/1/0/0/
globe-runners.com/fichier_pdf/31u2.zip
lucantaru.it/docs/31u2.zip
mediamaster-2000.de/img/heap.zip
ig-engenharia.com/wp-content/uploads/2014/02/heap.zip
upscalebeauty.com/img/colors/teal/opened.zip
lagrimas.tuars.com/css/opened.zip
There are some further clues in the VirusTotal comments as to what the malware does. Sophos has also seen the 94.23.247.202 (OVH, France) IP before.
Recommended blocklist:
94.23.247.202
globe-runners.com
lucantaru.it
mediamaster-2000.de
ig-engenharia.com
upscalebeauty.com
lagrimas.tuars.com
Labels:
EXE-in-ZIP,
France,
Malware,
OVH,
Printer Spam,
Spam,
Viruses
Evernote "File has been sent" spam
I've never understood Evernote. Something to do with elephants I think. But this spam isn't from them anyway..
utilatas.com/333
sdi-ppe.com/333
shahlon.com/333
croydonsog.org/333
pc2print.co.uk/333
geo.num.edu.mn/333
hendredestate.co.uk/333
kelias.com/~anonimas/333
168.144.179.82/333
alperacarli.com/333
thecolabnetwork.com/333
www.deltaplus.com.sg/333
george-bergsig.co.za/333
qatthailand.com/333
deltaplus.com.sg/333
elegantscreens.com/333
drkeithrix.co.uk/333
w3stest.webuda.com/333
www.divine-paradise.com/333
www.langrace.com/333
avengingarden.com/333
These download locations are the same as yesterday's Amazon spam run. The downloaded file has a VT detection rate of 3/53.
The recommended blocklist is the same as yesterday.
Date: Thu, 31 Jul 2014 12:26:53 +0200 [06:26:53 EDT]The file attached is actually DSC_9426679.zip and not .jpg, containing a malicious executable DSC_8832966.exe with a VirusTotal detection rate of 7/53. The CAMAS report shows that the malware attempts to download an additional component from the following locations:
From: EVERNOTE [lcresknpwz@business.telecomitalia.it]
Subject: File has been sent [redacted]
DSC_9426679.jpg attached to the letter
Copyright 2014 Evernote Corporation. All rights reserved
utilatas.com/333
sdi-ppe.com/333
shahlon.com/333
croydonsog.org/333
pc2print.co.uk/333
geo.num.edu.mn/333
hendredestate.co.uk/333
kelias.com/~anonimas/333
168.144.179.82/333
alperacarli.com/333
thecolabnetwork.com/333
www.deltaplus.com.sg/333
george-bergsig.co.za/333
qatthailand.com/333
deltaplus.com.sg/333
elegantscreens.com/333
drkeithrix.co.uk/333
w3stest.webuda.com/333
www.divine-paradise.com/333
www.langrace.com/333
avengingarden.com/333
These download locations are the same as yesterday's Amazon spam run. The downloaded file has a VT detection rate of 3/53.
The recommended blocklist is the same as yesterday.
Labels:
EXE-in-ZIP,
Malware,
Spam,
Viruses
"New fax" spam using goo.gl shortening service
From: Fax [fax@victimdomain]There seems to be an uptick of goo.gl spam.. if you receive something like this you can report it to goo.gl/spam-report as malware.
Date: 31 July 2014 11:23
Subject: You've received a new fax
New fax at SCAN5735232 from EPSON by https://victimdomain
Scan date: Thu, 31 Jul 2014 19:23:11 +0900
Number of pages: 2
Resolution: 400x400 DPI
You can download your fax message at:
https://goo.gl/1rBYjl
(Google Disk Drive is a file hosting service operated by Google, Inc.)
------------------------------
From: FAX [fax@qcom.co.uk]
Reply-to: FAX [fax@qcom.co.uk]
fax@localhost
Date: 31 July 2014 10:53
Subject: You have received a new fax message
You have received fax from EPS76185555 at victimdomain
Scan date: Thu, 31 Jul 2014 16:53:10 +0700
Number of page(s): 2
Resolution: 400x400 DPI
Download file at google disk drive service - dropbox.
https://goo.gl/t8jteI
_________________________________
File is scanned image in PDF format.
Adobe(A) Reader(R) can be downloaded from the following URL: https://www.adobe.com/
I've seen three different URLs:
goo.gl/1rBYjl
goo.gl/t8jteI
goo.gl/RmGnbr
These lead to the following download locations:
pinkfeatherproductions.com/wp-content/uploads/2014/06/Document-95722.zip
autoescuelajoaquin.com/images/Document-95722.zip
esys-comm.ro/images/Document-95722.zip
Obviously, this is a ZIP file. It contains a malicious executable Document-95722.scr which has a VirusTotal detection rate of just 1/54. The CAMAS report shows that the malware reaches out to the following locations to download further components:
andribus.com/images/images.rar
owenscrandall.com/images/images.rar
Incidentally, if you add a "+" to the end of the goo.gl URL you can see how many people have clicked through. For example:
164 clicks isn't a lot, but there are multiple URLs in use.
Recommended blocklist:
andribus.com
owenscrandall.com
esys-comm.ro
autoescuelajoaquin.com
pinkfeatherproductions.com
Wednesday 30 July 2014
"Payslip" spam
Presumably terseness works with this kind of message:
Clicking OK downloads an executable from www.greenexpress.ge/swift//payslip.exe which your are presumably meant to run. It's a bit of an odd way to do it, so perhaps there's a reason. The HTML is simple enough..
..but why bother doing it this way at all? Well, it makes it just a bit harder for email security software to find the link because the attachment is Base 64 encoded.
From: Richard Mason [richardm254@gmail.com]Attached is a file swift copy-Payment-Slip-$70,000.html which when it is opened up in your browser comes up with a popup box.
Date: 30 July 2014 21:23
Subject: Payslip
Please find attached the payment slip.
Clicking OK downloads an executable from www.greenexpress.ge/swift//payslip.exe which your are presumably meant to run. It's a bit of an odd way to do it, so perhaps there's a reason. The HTML is simple enough..
..but why bother doing it this way at all? Well, it makes it just a bit harder for email security software to find the link because the attachment is Base 64 encoded.
--14dae94734a32fac0a04ff6eee7c--The malware itself has a VirusTotal detection rate of 31/53 which is frankly better than I'd expect. Automated analysis tools seem to time out or crash, which indicates that the malware is hardened against analysis, but the VT report does see traffic with a pattern that might be blockable if you have a webfilter:
--14dae94734a32fac0e04ff6eee7e
Content-Type: text/html; charset=US-ASCII; name="swift copy-Payment-Slip-$70,000.html"
Content-Disposition: attachment;
filename="swift copy-Payment-Slip-$70,000.html"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_hy93oezq0
DQo8c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0IiB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPiAN
CiAgICAgICBhbGVydCgnVG8gdmlldyB5b3VyIEJhbmstUGF5bWVudC1TbGlwLCBjbGljayBvayB0
byBjb250aW51ZS4nKTsNCiAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICdodHRwOi8vd3d3LmdyZWVu
ZXhwcmVzcy5nZS9zd2lmdC8vcGF5c2xpcC5leGUnOyANCiAgICA8L3NjcmlwdD4gDQoNCg0KDQo=
--14dae94734a32fac0e04ff6eee7e--
URL: http://www.greenexpress.ge/swift/config.bin
TYPE: GET
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
TYPE: GET
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
URL: http://www.greenexpress.ge/swift/gate.php
TYPE: POST
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
TYPE: POST
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
"AMAZON.CO.UK - Your Amazon order" spam
Another fake Amazon spam with a malicious payload:
There's a ZIP file attached (in this case Order-853-9908013-4362599.zip) which unzips to a folder Order details with a malicious file ORDER-992-5188991-000933.exe which has a VirusTotal detection rate of 9/53. The Comodo CAMAS report shows that it downloads a further component from these following locations:
utilatas.com/333
sdi-ppe.com/333
shahlon.com/333
croydonsog.org/333
pc2print.co.uk/333
geo.num.edu.mn/333
hendredestate.co.uk/333
kelias.com/~anonimas/333
168.144.179.82/333
alperacarli.com/333
thecolabnetwork.com/333
www.deltaplus.com.sg/333
george-bergsig.co.za/333
qatthailand.com/333
deltaplus.com.sg/333
elegantscreens.com/333
drkeithrix.co.uk/333
w3stest.webuda.com/333
www.divine-paradise.com/333
www.langrace.com/333
avengingarden.com/333
This second executable has a VT detection rate of 5/54. I recommend blocking the following sites:
utilatas.com
sdi-ppe.com
shahlon.com
croydonsog.org
pc2print.co.uk
geo.num.edu.mn
hendredestate.co.uk
alperacarli.com
thecolabnetwork.com
deltaplus.com.sg
george-bergsig.co.za
qatthailand.com
deltaplus.com.sg
elegantscreens.com
drkeithrix.co.uk
w3stest.webuda.com
divine-paradise.com
langrace.com
avengingarden.com
Date: Wed, 30 Jul 2014 18:08:43 +0800 [06:08:43 EDT]
From: "AMAZON.CO.UK" [ckggzphqu@Amazon.co.uk]
Subject: Your Amazon order #853-9908013-4362599
Hello,
Thank you for your order. We'll let you know once your item(s) have dispatched.You can check the status of your order or make changes to it by visiting Your Orders on Amazon.co.uk.
Order Details
Order #853-9908013-4362599 Placed on July 26, 2014
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon.
Amazon.co.uk
There's a ZIP file attached (in this case Order-853-9908013-4362599.zip) which unzips to a folder Order details with a malicious file ORDER-992-5188991-000933.exe which has a VirusTotal detection rate of 9/53. The Comodo CAMAS report shows that it downloads a further component from these following locations:
utilatas.com/333
sdi-ppe.com/333
shahlon.com/333
croydonsog.org/333
pc2print.co.uk/333
geo.num.edu.mn/333
hendredestate.co.uk/333
kelias.com/~anonimas/333
168.144.179.82/333
alperacarli.com/333
thecolabnetwork.com/333
www.deltaplus.com.sg/333
george-bergsig.co.za/333
qatthailand.com/333
deltaplus.com.sg/333
elegantscreens.com/333
drkeithrix.co.uk/333
w3stest.webuda.com/333
www.divine-paradise.com/333
www.langrace.com/333
avengingarden.com/333
This second executable has a VT detection rate of 5/54. I recommend blocking the following sites:
utilatas.com
sdi-ppe.com
shahlon.com
croydonsog.org
pc2print.co.uk
geo.num.edu.mn
hendredestate.co.uk
alperacarli.com
thecolabnetwork.com
deltaplus.com.sg
george-bergsig.co.za
qatthailand.com
deltaplus.com.sg
elegantscreens.com
drkeithrix.co.uk
w3stest.webuda.com
divine-paradise.com
langrace.com
avengingarden.com
Labels:
Amazon,
EXE-in-ZIP,
Malware,
Spam,
Viruses
"Order status -950533 30.07.2014.xls" spam
This body-text-less spam comes with a malicious attachment.
But the payload is the thing, in this case there is an archivecalled 950533-30.07.2014.zip containing a folder order-8301138-30.07.2014.xls which in turn contains a malicious executable order-8301138-30.07.2014.xls.exe which has a VirusTotal detection rate of 6/54.
The Comodo CAMAS report shows attempted downloads from the following connections:
jobengine.in/333
legusadvantage.com/333
davidtaylorartist.com/333
asustabletservisi.com/333
mycustomkidsbooks.com/333
redhorsesolutions.com/333
tencoolthings.com/333
wwwtokiodesign.com/333
extreme-bdsm-comics.com/333
A second file is downloaded from these locations with a VT detection rate of just 2/54. The CAMAS report is inconclusive.
I recommend the following blocklist:
jobengine.in
legusadvantage.com
davidtaylorartist.com
asustabletservisi.com
mycustomkidsbooks.com
redhorsesolutions.com
tencoolthings.com
wwwtokiodesign.com
extreme-bdsm-comics.com
Date: Wed, 30 Jul 2014 17:06:27 +0530 [07:36:27 EDT]Actually the body text isn't completely blank but does contain some bits of HTML.
From: Twila Garner [3f418d9@consolacionburriana.com]
Subject: Order status -950533 30.07.2014.xls
<html>
<head>
<XSSCleaned_taghttp-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
</
But the payload is the thing, in this case there is an archivecalled 950533-30.07.2014.zip containing a folder order-8301138-30.07.2014.xls which in turn contains a malicious executable order-8301138-30.07.2014.xls.exe which has a VirusTotal detection rate of 6/54.
The Comodo CAMAS report shows attempted downloads from the following connections:
jobengine.in/333
legusadvantage.com/333
davidtaylorartist.com/333
asustabletservisi.com/333
mycustomkidsbooks.com/333
redhorsesolutions.com/333
tencoolthings.com/333
wwwtokiodesign.com/333
extreme-bdsm-comics.com/333
A second file is downloaded from these locations with a VT detection rate of just 2/54. The CAMAS report is inconclusive.
I recommend the following blocklist:
jobengine.in
legusadvantage.com
davidtaylorartist.com
asustabletservisi.com
mycustomkidsbooks.com
redhorsesolutions.com
tencoolthings.com
wwwtokiodesign.com
extreme-bdsm-comics.com
Labels:
EXE-in-ZIP,
Malware,
Spam,
Viruses
QuickBooks "Important - Payment Overdue" spam has a malicious PDF attachment
This fake QuickBooks Invoice spam comes with a malicious payload:
From: QuickBooks Invoice [auto-invoice@quickbooks.com]The attached file (in this case invoice_7564675_07292014.pdf) contains an exploit with a VirusTotal detection rate of 7/53. I haven't had a chance to analyse the exploit myself yet.
Date: 29 July 2014 23:08
Subject: Important - Payment Overdue
Please find attached your invoices for the past months. Remit the payment by 07/30/2014 as outlines under our "Payment Terms" agreement.
Thank you for your business,
Sincerely,
Josephine Shirley
This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.
The information contained in this message may be privileged, confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify your representative immediately and delete this message from your computer. Thank you.
Tuesday 29 July 2014
Something evil on 31.210.96.155, 31.210.96.156, 31.210.96.157 and 31.210.96.158 (31.210.96.152/29)
[Note, an update to this can be found here]
I don't know quite what the exploit kit of the month is here, but the IP addresses 31.210.96.155, 31.210.96.156, 31.210.96.157 and 31.210.96.158 are currently serving up malware using hijacked GoDaddy domains, and are targeting victim websites by altering their .htaccess files to intercept traffic coming from search engines such as Google.
These IP addresses have been used for malware for some time and certainly historically they have been used for Ponmocup. I can't confirm that this is still the case, but given the bad IP and the obvious .htaccess hijack then it passed the Duck Test.
These IPs are allocated to Radore Veri Merkezi Hizmetleri A.S. in Turkey who control 31.210.64.0/18 which is a large block, so these IPs are probably a customer or even a customer of a customer.
VirusTotal reports for these IPs are pretty poor [1] [2] [3] [4]. I assume that they form part of an allocation 31.210.96.152/29 which I would very strongly recommend blocking that range, or indeed the entire /24 looks pretty worth
These domains all use the GoDaddy domaincontrol.com nameservers, which naturally means most of them are GoDaddy domains.. but not all of them, some are from other registrars. This list [pastebin] includes a selection of active subdomains that I can find.
I recommend permablocking the following IP range and temporarily blocking the following domains:
31.210.96.152/29
12stepdates.com
2cuonline.com
4runnerliftkits.com
8jutawan.com
advertisementdevil.com
allknowingpsychic.com
alloyfurnacerolls.com
alloymuffles.com
alloyradianttubes.com
allprodelta.com
alternateolympics.com
alternativeolympics.com
ancestorworshippublishing.com
antonzuponcic.com
aredietsok.com
assistlist.com
atvguidebooks.com
atvtrailguides.com
autoeventregistration.com
automotiveeventregistration.com
automotiveservicesavings.com
autoserviceevent.com
aylesburyironing.com
bahenasteel.com
barbeveragesla.com
basicmechanical.net
be3ne.com
be3ni.com
be3ny.com
benahavisrealestate.com
bestsilvercufflinks.com
blurlight.com
boeckman.net
bristolblog.com
buynewaz.com
bvvk.com
caninecolorgenetics.com
castlelawpa.com
charlesawells.com
chrisvessey.com
concept-kw.com
connectmetv.com
coreywasley.com
craigslistpads.com
cruzeonover.com
custom-chocolate-favors.com
customerdevil.com
dealerholidayevent.com
deliveredbythedevil.com
devilforacause.com
devilwithacause.com
djbobbyktoronto.com
drinkbluphoria.com
drinkcalories.net
dunstablekitchens.com
egunt.com
ellagphotography.com
encepha.net
enhancementlasers.com
enhancementlasers.net
e-squares.com
exceltoner.com
fantasyintro.com
fathersnsons.com
fatlosstoolkit.com
fortheloveofgadgets.com
gamezalot.com
gaybeefcake.com
gaybromance.com
gayconspiracy.com
gillspools.com
girlsgoneglamis.com
gliscastings.net
gliscentrifugal.com
glisfabrications.com
glisinc.com
golfironworks.com
golfnewsarkansas.com
golfnewscolorado.com
golfnewsconnecticut.com
golfnewsdelaware.com
golfnewsgeorgia.com
golfnewsindiana.com
golfnewsiowa.com
golfnewskansas.com
golfnewslouisiana.com
golfnewsmississippi.com
golfnewsmontana.com
golfnewsnebraska.com
golfnewsnewengland.com
golfnewsnewhampshire.com
golfnewsnewjersey.com
golfnewsnewyork.com
golfnewsohio.com
golfnewsoklahoma.com
golfnewssouthcarolina.com
golfnewstennessee.com
golfnewsutah.com
golfnewsvermont.com
golfnewswestvirginia.com
golfnewswisconsin.com
grafikcase.com
grafik-devils.com
gravittyproductions.com
greatserviceforless.com
gregorylknox.net
gryphonaz.com
gryphonus.com
gssportspics.com
hartford-capital.com
heattreatalloy.com
historyhobbybooks.com
hockeydoneright.com
hugesavingsevent.com
imfamousontheinternet.com
inboccaproductions.com
ingressgamer.com
inkandtonersale.com
italy-in-bocca.com
javaemulator.com
jaysonkrausenetwork.com
joannheilman.com
joeamericashow.com
joechenphoto.com
joeywilliamsdrums.com
jordandowney.com
jordandowney.net
juddnelsonstudio.com
kaitlinsplayground.com
killpoet.com
kokobon.com
ksupridewrestling.com
ksuwrestling.net
lakehousetimberranch.com
laser-enhancements.com
letseatinitaly.com
lifestylology.com
lindseytoothman.com
lionizetheworld.com
lions-mark.com
lsclinks.com
magicalmoods.com
makingwaves-salon.com
matthewstarner.com
memorialdaysavingsevent.com
menbeingsexy.com
middlefieldma.net
midnightastronomy.com
momsagainstmercury.com
mrsstyleseeker.com
musicjester.com
mwhiteman.com
myabadi.com
mycameraleash.com
myfuturephysique.com
mygaycrush.com
mystagingbox.com
myteacuppiggies.com
nacprint.com
newcarsat.com
newlogiq.com
newyorkjester.com
newyorkmascot.com
ngage-games.com
nutritionbydesign.com
oharvest.net
omobia.net
onlybetterdeal.com
organixharvest.com
panochevalleysolar.net
pascocountyhitmen.com
paxamericanaspirits.com
peekaboopumpkin.com
prestigehonda.net
propertiespain.com
realdealpsychic.com
reikisolar.com
renzograciemexico.com
restoremystuff.com
rled.net
roaringlion.com
room-depot.com
savedalyfield.com
schonbjj.com
sciencehunk.com
searchengineverified.com
secretmanclub.com
sellitandforgetittoday.com
snuffbottleworld.net
softmn.com
southvalleyrugby.com
sportdoneright.com
springcleaningevent.com
stainlessfabrications.com
strongpsychic.com
sullivan-county.com
tagdeed-translation.com
techsupportauction.com
telecomchicago.com
telecomillinois.com
telecomindiana.com
telecommichigan.com
thecinema6.com
thecollegeaddressshop.com
theeveningjoker.com
theknowledgekingdom.com
thenightlyjoker.com
thinkadmit.com
thisishowthisworks.com
thruellaseyes.com
timkennywebdesign.com
timsicecreamtruck.com
timsroadtrip.com
tri-swelding.com
uksportbook.com
usedcarsat.com
usedmobi.com
valentinesalesevent.com
vehicleexchangeprogram.com
vehicleservicediscount.com
vipoverload.com
virtualsofts.com
webrunchhard.com
wenerdhard.com
whhholdingusainc.com
whhusainc.net
whichcameratookthis.com
whybuyanewhome.com
workoutebook.com
worldblogsite.com
wrightdunbar.com
xn--80afcbdab0arg8e4c.com
xn--h1adlaje.net
yourcakedecoratingclass.com
yourcrystalball.com
yourspartanmovers.com
zoomtoner.com
zoopoints.com
z-sat.com
Note that the following domains have been cleaned up and are probably now safe.
apossibletruth.com
arrozconbeans.com
brads-test-site.com
casabodamia.com
catclinicgreensboro.com
charlestonremembered.com
chelseyfatula.com
creepyninja.com
ditchwindows.com
drdekloet.com
ebookleads.com
electhillary2016.com
evergentleonmymind.com
fasttwitterfollowers.com
foreverlivingon.com
gaycharacter.com
goldenpridewrestling.com
greensboroveterinarian.net
jcbsunglasses.com
jpcolton.com
kalkaneventfactory.com
newskase.com
pitstopmotorclub.com
registerforautoevent.com
remembercharleston.com
ridchinacne.com
saving53k.com
southernwakeautomotive.com
theneighborhoodaddressshop.com
ux-designer.com
williespage.com
windmuff.com
I don't know quite what the exploit kit of the month is here, but the IP addresses 31.210.96.155, 31.210.96.156, 31.210.96.157 and 31.210.96.158 are currently serving up malware using hijacked GoDaddy domains, and are targeting victim websites by altering their .htaccess files to intercept traffic coming from search engines such as Google.
These IP addresses have been used for malware for some time and certainly historically they have been used for Ponmocup. I can't confirm that this is still the case, but given the bad IP and the obvious .htaccess hijack then it passed the Duck Test.
These IPs are allocated to Radore Veri Merkezi Hizmetleri A.S. in Turkey who control 31.210.64.0/18 which is a large block, so these IPs are probably a customer or even a customer of a customer.
VirusTotal reports for these IPs are pretty poor [1] [2] [3] [4]. I assume that they form part of an allocation 31.210.96.152/29 which I would very strongly recommend blocking that range, or indeed the entire /24 looks pretty worth
These domains all use the GoDaddy domaincontrol.com nameservers, which naturally means most of them are GoDaddy domains.. but not all of them, some are from other registrars. This list [pastebin] includes a selection of active subdomains that I can find.
I recommend permablocking the following IP range and temporarily blocking the following domains:
31.210.96.152/29
12stepdates.com
2cuonline.com
4runnerliftkits.com
8jutawan.com
advertisementdevil.com
allknowingpsychic.com
alloyfurnacerolls.com
alloymuffles.com
alloyradianttubes.com
allprodelta.com
alternateolympics.com
alternativeolympics.com
ancestorworshippublishing.com
antonzuponcic.com
aredietsok.com
assistlist.com
atvguidebooks.com
atvtrailguides.com
autoeventregistration.com
automotiveeventregistration.com
automotiveservicesavings.com
autoserviceevent.com
aylesburyironing.com
bahenasteel.com
barbeveragesla.com
basicmechanical.net
be3ne.com
be3ni.com
be3ny.com
benahavisrealestate.com
bestsilvercufflinks.com
blurlight.com
boeckman.net
bristolblog.com
buynewaz.com
bvvk.com
caninecolorgenetics.com
castlelawpa.com
charlesawells.com
chrisvessey.com
concept-kw.com
connectmetv.com
coreywasley.com
craigslistpads.com
cruzeonover.com
custom-chocolate-favors.com
customerdevil.com
dealerholidayevent.com
deliveredbythedevil.com
devilforacause.com
devilwithacause.com
djbobbyktoronto.com
drinkbluphoria.com
drinkcalories.net
dunstablekitchens.com
egunt.com
ellagphotography.com
encepha.net
enhancementlasers.com
enhancementlasers.net
e-squares.com
exceltoner.com
fantasyintro.com
fathersnsons.com
fatlosstoolkit.com
fortheloveofgadgets.com
gamezalot.com
gaybeefcake.com
gaybromance.com
gayconspiracy.com
gillspools.com
girlsgoneglamis.com
gliscastings.net
gliscentrifugal.com
glisfabrications.com
glisinc.com
golfironworks.com
golfnewsarkansas.com
golfnewscolorado.com
golfnewsconnecticut.com
golfnewsdelaware.com
golfnewsgeorgia.com
golfnewsindiana.com
golfnewsiowa.com
golfnewskansas.com
golfnewslouisiana.com
golfnewsmississippi.com
golfnewsmontana.com
golfnewsnebraska.com
golfnewsnewengland.com
golfnewsnewhampshire.com
golfnewsnewjersey.com
golfnewsnewyork.com
golfnewsohio.com
golfnewsoklahoma.com
golfnewssouthcarolina.com
golfnewstennessee.com
golfnewsutah.com
golfnewsvermont.com
golfnewswestvirginia.com
golfnewswisconsin.com
grafikcase.com
grafik-devils.com
gravittyproductions.com
greatserviceforless.com
gregorylknox.net
gryphonaz.com
gryphonus.com
gssportspics.com
hartford-capital.com
heattreatalloy.com
historyhobbybooks.com
hockeydoneright.com
hugesavingsevent.com
imfamousontheinternet.com
inboccaproductions.com
ingressgamer.com
inkandtonersale.com
italy-in-bocca.com
javaemulator.com
jaysonkrausenetwork.com
joannheilman.com
joeamericashow.com
joechenphoto.com
joeywilliamsdrums.com
jordandowney.com
jordandowney.net
juddnelsonstudio.com
kaitlinsplayground.com
killpoet.com
kokobon.com
ksupridewrestling.com
ksuwrestling.net
lakehousetimberranch.com
laser-enhancements.com
letseatinitaly.com
lifestylology.com
lindseytoothman.com
lionizetheworld.com
lions-mark.com
lsclinks.com
magicalmoods.com
makingwaves-salon.com
matthewstarner.com
memorialdaysavingsevent.com
menbeingsexy.com
middlefieldma.net
midnightastronomy.com
momsagainstmercury.com
mrsstyleseeker.com
musicjester.com
mwhiteman.com
myabadi.com
mycameraleash.com
myfuturephysique.com
mygaycrush.com
mystagingbox.com
myteacuppiggies.com
nacprint.com
newcarsat.com
newlogiq.com
newyorkjester.com
newyorkmascot.com
ngage-games.com
nutritionbydesign.com
oharvest.net
omobia.net
onlybetterdeal.com
organixharvest.com
panochevalleysolar.net
pascocountyhitmen.com
paxamericanaspirits.com
peekaboopumpkin.com
prestigehonda.net
propertiespain.com
realdealpsychic.com
reikisolar.com
renzograciemexico.com
restoremystuff.com
rled.net
roaringlion.com
room-depot.com
savedalyfield.com
schonbjj.com
sciencehunk.com
searchengineverified.com
secretmanclub.com
sellitandforgetittoday.com
snuffbottleworld.net
softmn.com
southvalleyrugby.com
sportdoneright.com
springcleaningevent.com
stainlessfabrications.com
strongpsychic.com
sullivan-county.com
tagdeed-translation.com
techsupportauction.com
telecomchicago.com
telecomillinois.com
telecomindiana.com
telecommichigan.com
thecinema6.com
thecollegeaddressshop.com
theeveningjoker.com
theknowledgekingdom.com
thenightlyjoker.com
thinkadmit.com
thisishowthisworks.com
thruellaseyes.com
timkennywebdesign.com
timsicecreamtruck.com
timsroadtrip.com
tri-swelding.com
uksportbook.com
usedcarsat.com
usedmobi.com
valentinesalesevent.com
vehicleexchangeprogram.com
vehicleservicediscount.com
vipoverload.com
virtualsofts.com
webrunchhard.com
wenerdhard.com
whhholdingusainc.com
whhusainc.net
whichcameratookthis.com
whybuyanewhome.com
workoutebook.com
worldblogsite.com
wrightdunbar.com
xn--80afcbdab0arg8e4c.com
xn--h1adlaje.net
yourcakedecoratingclass.com
yourcrystalball.com
yourspartanmovers.com
zoomtoner.com
zoopoints.com
z-sat.com
Note that the following domains have been cleaned up and are probably now safe.
apossibletruth.com
arrozconbeans.com
brads-test-site.com
casabodamia.com
catclinicgreensboro.com
charlestonremembered.com
chelseyfatula.com
creepyninja.com
ditchwindows.com
drdekloet.com
ebookleads.com
electhillary2016.com
evergentleonmymind.com
fasttwitterfollowers.com
foreverlivingon.com
gaycharacter.com
goldenpridewrestling.com
greensboroveterinarian.net
jcbsunglasses.com
jpcolton.com
kalkaneventfactory.com
newskase.com
pitstopmotorclub.com
registerforautoevent.com
remembercharleston.com
ridchinacne.com
saving53k.com
southernwakeautomotive.com
theneighborhoodaddressshop.com
ux-designer.com
williespage.com
windmuff.com
Monday 28 July 2014
amazon.co.uk "Your Amazon order" spam
This fake Amazon spam comes with a malicious attachment:
Attached is a file Order-239-1744919-1697181.zip which in turn contains a malicious executable Order details 001-8821901-992107.exe which has a VirusTotal detection rate of 18/54.
The Comodo CAMAS analysis shows that the malware reaches out to a familiar set of URLs to download further components:
www.zag.com.ua/333
daisyblue.ru/333
www.ricebox.biz/333
brandsalted.com/333
fbcashmethod.ru/333
expositoresrollup.es/333
madrasahhusainiyahkl.com/333
sexyfoxy.ts6.ru/333
www.huework.com/333
siliconharbourng.com/333
www.martijnvanhout.nl/333
I would recommend blocking the following domains:
zag.com.ua
daisyblue.ru
ricebox.biz
brandsalted.com
fbcashmethod.ru
expositoresrollup.es
madrasahhusainiyahkl.com
sexyfoxy.ts6.ru
huework.com
siliconharbourng.com
martijnvanhout.nl
Date: Mon, 28 Jul 2014 13:15:57 +0200 [07:15:57 EDT]
From: "AMAZON.CO.UK" [egljlyzqv@Amazon.co.uk]
Subject: Your Amazon order #239-1744919-1697181
Hello,
Thank you for your order. We'll let you know once your item(s) have dispatched.You can check the status of your order or make changes to it by visiting Your Orders on Amazon.co.uk.
Order Details
Order #239-1744919-1697181 Placed on July 26, 2014
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon.
Amazon.co.uk
Attached is a file Order-239-1744919-1697181.zip which in turn contains a malicious executable Order details 001-8821901-992107.exe which has a VirusTotal detection rate of 18/54.
The Comodo CAMAS analysis shows that the malware reaches out to a familiar set of URLs to download further components:
www.zag.com.ua/333
daisyblue.ru/333
www.ricebox.biz/333
brandsalted.com/333
fbcashmethod.ru/333
expositoresrollup.es/333
madrasahhusainiyahkl.com/333
sexyfoxy.ts6.ru/333
www.huework.com/333
siliconharbourng.com/333
www.martijnvanhout.nl/333
I would recommend blocking the following domains:
zag.com.ua
daisyblue.ru
ricebox.biz
brandsalted.com
fbcashmethod.ru
expositoresrollup.es
madrasahhusainiyahkl.com
sexyfoxy.ts6.ru
huework.com
siliconharbourng.com
martijnvanhout.nl
Labels:
Amazon,
EXE-in-ZIP,
Malware,
Spam,
Viruses
Something evil on 88.198.252.168/29 (Ransomware)
88.198.252.168/29 (Hetzner, Germany) is infected with a whole bunch of ransomware landing pages, like this:
In the past this IP range has been used to host a number of legitimate Austrian sites, but at the moment it appears to be hosting ransomware landing pages exclusively.
The domains in use are a combination of crappy .in domains registered to a series of fake addresses, plus a bunch of subdomains of legitimate domains that have been hijacked. What is interesting about these hijacked domians is that they all use afraid.org as namerservers.
This hijacking at afraid.org is because these particular domain users are using the free afraid.org service which allows anyone to create a subdomain of your domain and point is where they like (explained in this FAQ). The bad news is that this sort of hijacking is a quick way to ruin your domain's reputation. A full list of the subdomains and domain I can find is here [pastebin].
Although this is a Hetzner IP, it is suballocated to a customer who may or may not know anything about this abuse of the IPs in the range:
inetnum: 88.198.252.168 - 88.198.252.175
netname: ANDY-CONTE
descr: Andy Conte
country: DE
admin-c: DS15036-RIPE
tech-c: DS15036-RIPE
status: ASSIGNED PA
mnt-by: HOS-GUN
source: RIPE # Filtered
person: Dmitry Seleznev
address: Ivana Franko 38-364
address: 121351 Moscow
address: RUSSIAN FEDERATION
phone: +79270473970
nic-hdl: DS15036-RIPE
mnt-by: HOS-GUN
source: RIPE # Filtered
Blocking these landing pages will probably not stop a PC from becoming infected with ransomware, but monitoring or blocking the following list may give you some intelligence as to what is happening on your own network.
Recommended blocklist:
88.198.252.168/29
fernandocoelho.net.br
duk66.com
cerone.com.ar
gigliotti.com.ar
clawmap.com
lareferencedentaire.com
izaksuljkic.tk
suulaav.com.np
iseoz.com
friendfamily.id.au
hamiltonewave.com
bandloudi.org
loware.com
private-checker.com
hewmet.eu
mightycoronanation.com
muzzu.com.ar
cuidadonatural.cl
acousauth.com
aybear.com
perthorthodontist.com.au
settleurdebt.com
irisstom.ru
quinha.com.br
tjma.tk
projectsmanaged.com.au
bonata.ro
seguy.cl
deepthots.com
kaki5.web.id
law-enforcement-dtwnourq.in
law-enforcement-dwygrbjz.in
ttx79.com
danielbyrnes.net
universalpeacesociety.org.au
law-enforcement-ebvcbwuw.in
tartsandcrafts.ca
snaggleboards.com
pata1.info
gomeansgo.com
blindsided.us
dlaurentfamily.com
thedrunction.com
bal-tazaar.be
rcs.gr
totten.co
tools-bejo.net
siecon.com.mx
johordt.tk
redstarsclub.su
andrewerdna.co.za
y2014.net
interkatsolutions.com
astrocode.ro
channings.me
utn88.com
hkhotspot.com
muzcgb-ural.ru
mwautomotriz.com
theclubpointbar.ch
jpsa.org.za
tonykohn.tk
takony.hu
grosiragen.com
latanska.com
myipo.pw
study7979.com
weisms.com
armturist.ru
aap73.com
ufaopen.ru
hmh.ro
acupuncturaveterinara.ro
123erp.net
s1.lv
law-enforcement-jjuawtsk.in
gloverhouse.co
comercialmontenegro.cl
ritterservices.net
ancilla.com.au
familiestogether.biz
e-forever.tk
pkp88.com
seppalat.fi
balticexperts.eu
emad.com.ar
iostardata.com
resultadoshumbertoabrao.com.br
ttgrules.com
ket87.com
thejobarena.com
wolf-tec.net
partirviajes.tur.ar
1729.su
pimpthesebums.com
satoshidaily.info
worldslegendshalloffame.com
bahosss.ru
besthub.ro
tsdnasaud.ro
alte.co
cuaca.co.id
smartzbloz.net
at-who.com
perciun.md
dubinkin.me
opoopoiso.com
wtr2.ro
sysmanager.ro
halfluke.info
greenhopetz.com
tucglam.com.ar
diegonunez.com.ar
extex-project.org
moserag.ch
rizahilmi.com
tattomasaj.ro
parabolaresear.ch
dreamstartups.com
morganvenable.com
tourismwelfare.org.np
caribgonewild.net
manausclass.com.br
thatsagreatshadeoflife.com
ymu88.com
cellotelecom.com
katamari.one.pl
excuse.ro
towelie.net
recursosmendoza.com.ar
znd88.com
fkmpp.web.id
niedermaier.li
law-enforcement-tugeyogn.in
bernardifinancial.com
jobvolume.ru
saints-eagle.ru
dextm.ro
rutahostal.cl
institutosinapsis.com.ve
hilinknet.ir
uac55.com
pablodelamaza.cl
szamajuanangel.com.ar
simpsons.com.ar
law-enforcement-vbzcqvfd.in
splashweave.com
megaorganizada.com.br
cliovirtual.cl
kancilja.si
prudentialworld.net
juegosychorradas.com
juancruzweb.com.ar
detectmobile.co.za
mpas.co.za
aapialang.co.id
album.web.tr
g24.ch
whereiszacbunch.com
preguntasconducir.com.ar
iwanacakadut.com
x-alps.com.ar
alexandrearsenaultj.tk
shockata.nl
vipny37.com
angrybirdsonline.com.ar
nursani.web.id
3hstudio.ro
freeebooksdownload.com.ar
getcash4bills.com
tqchoaphung.tk
aksoftware.ru
mol-ck.com
borrowedwine.com
jobvolume.bg
xn--leppnen-8wa.net
npa99.com
paysuper.com
nextclick.ro
scribetown.com
espertiseconsulting.com.ar
kitsune-sama.com.ar
system-check-adnfecjx.in
system-check-awppaaid.in
system-check-bfuljagg.in
system-check-cabhpfuv.in
system-check-dgaaixxq.in
system-check-efbxqcsa.in
system-check-elotpdux.in
system-check-etldvwxb.in
system-check-evkfmgay.in
system-check-faliyfse.in
system-check-fpkbcyot.in
system-check-fshknbfm.in
system-check-fyeltkhn.in
system-check-hiudyjbm.in
system-check-icrkskuc.in
system-check-lrimafgm.in
system-check-ndyihbuc.in
system-check-npgodwaj.in
system-check-nsgycsvo.in
system-check-nzsupdku.in
system-check-pjiosnkb.in
system-check-qufngsmj.in
system-check-rcabswpl.in
system-check-rrhoipny.in
system-check-udkoeulo.in
system-check-ukxmncwd.in
system-check-vbjiikcz.in
system-check-vorxvayt.in
system-check-vqypvqft.in
system-check-wxotxgwd.in
system-check-zagcqrhq.in
system-check-zfwwxmnq.in
In the past this IP range has been used to host a number of legitimate Austrian sites, but at the moment it appears to be hosting ransomware landing pages exclusively.
The domains in use are a combination of crappy .in domains registered to a series of fake addresses, plus a bunch of subdomains of legitimate domains that have been hijacked. What is interesting about these hijacked domians is that they all use afraid.org as namerservers.
This hijacking at afraid.org is because these particular domain users are using the free afraid.org service which allows anyone to create a subdomain of your domain and point is where they like (explained in this FAQ). The bad news is that this sort of hijacking is a quick way to ruin your domain's reputation. A full list of the subdomains and domain I can find is here [pastebin].
Although this is a Hetzner IP, it is suballocated to a customer who may or may not know anything about this abuse of the IPs in the range:
inetnum: 88.198.252.168 - 88.198.252.175
netname: ANDY-CONTE
descr: Andy Conte
country: DE
admin-c: DS15036-RIPE
tech-c: DS15036-RIPE
status: ASSIGNED PA
mnt-by: HOS-GUN
source: RIPE # Filtered
person: Dmitry Seleznev
address: Ivana Franko 38-364
address: 121351 Moscow
address: RUSSIAN FEDERATION
phone: +79270473970
nic-hdl: DS15036-RIPE
mnt-by: HOS-GUN
source: RIPE # Filtered
Blocking these landing pages will probably not stop a PC from becoming infected with ransomware, but monitoring or blocking the following list may give you some intelligence as to what is happening on your own network.
Recommended blocklist:
88.198.252.168/29
fernandocoelho.net.br
duk66.com
cerone.com.ar
gigliotti.com.ar
clawmap.com
lareferencedentaire.com
izaksuljkic.tk
suulaav.com.np
iseoz.com
friendfamily.id.au
hamiltonewave.com
bandloudi.org
loware.com
private-checker.com
hewmet.eu
mightycoronanation.com
muzzu.com.ar
cuidadonatural.cl
acousauth.com
aybear.com
perthorthodontist.com.au
settleurdebt.com
irisstom.ru
quinha.com.br
tjma.tk
projectsmanaged.com.au
bonata.ro
seguy.cl
deepthots.com
kaki5.web.id
law-enforcement-dtwnourq.in
law-enforcement-dwygrbjz.in
ttx79.com
danielbyrnes.net
universalpeacesociety.org.au
law-enforcement-ebvcbwuw.in
tartsandcrafts.ca
snaggleboards.com
pata1.info
gomeansgo.com
blindsided.us
dlaurentfamily.com
thedrunction.com
bal-tazaar.be
rcs.gr
totten.co
tools-bejo.net
siecon.com.mx
johordt.tk
redstarsclub.su
andrewerdna.co.za
y2014.net
interkatsolutions.com
astrocode.ro
channings.me
utn88.com
hkhotspot.com
muzcgb-ural.ru
mwautomotriz.com
theclubpointbar.ch
jpsa.org.za
tonykohn.tk
takony.hu
grosiragen.com
latanska.com
myipo.pw
study7979.com
weisms.com
armturist.ru
aap73.com
ufaopen.ru
hmh.ro
acupuncturaveterinara.ro
123erp.net
s1.lv
law-enforcement-jjuawtsk.in
gloverhouse.co
comercialmontenegro.cl
ritterservices.net
ancilla.com.au
familiestogether.biz
e-forever.tk
pkp88.com
seppalat.fi
balticexperts.eu
emad.com.ar
iostardata.com
resultadoshumbertoabrao.com.br
ttgrules.com
ket87.com
thejobarena.com
wolf-tec.net
partirviajes.tur.ar
1729.su
pimpthesebums.com
satoshidaily.info
worldslegendshalloffame.com
bahosss.ru
besthub.ro
tsdnasaud.ro
alte.co
cuaca.co.id
smartzbloz.net
at-who.com
perciun.md
dubinkin.me
opoopoiso.com
wtr2.ro
sysmanager.ro
halfluke.info
greenhopetz.com
tucglam.com.ar
diegonunez.com.ar
extex-project.org
moserag.ch
rizahilmi.com
tattomasaj.ro
parabolaresear.ch
dreamstartups.com
morganvenable.com
tourismwelfare.org.np
caribgonewild.net
manausclass.com.br
thatsagreatshadeoflife.com
ymu88.com
cellotelecom.com
katamari.one.pl
excuse.ro
towelie.net
recursosmendoza.com.ar
znd88.com
fkmpp.web.id
niedermaier.li
law-enforcement-tugeyogn.in
bernardifinancial.com
jobvolume.ru
saints-eagle.ru
dextm.ro
rutahostal.cl
institutosinapsis.com.ve
hilinknet.ir
uac55.com
pablodelamaza.cl
szamajuanangel.com.ar
simpsons.com.ar
law-enforcement-vbzcqvfd.in
splashweave.com
megaorganizada.com.br
cliovirtual.cl
kancilja.si
prudentialworld.net
juegosychorradas.com
juancruzweb.com.ar
detectmobile.co.za
mpas.co.za
aapialang.co.id
album.web.tr
g24.ch
whereiszacbunch.com
preguntasconducir.com.ar
iwanacakadut.com
x-alps.com.ar
alexandrearsenaultj.tk
shockata.nl
vipny37.com
angrybirdsonline.com.ar
nursani.web.id
3hstudio.ro
freeebooksdownload.com.ar
getcash4bills.com
tqchoaphung.tk
aksoftware.ru
mol-ck.com
borrowedwine.com
jobvolume.bg
xn--leppnen-8wa.net
npa99.com
paysuper.com
nextclick.ro
scribetown.com
espertiseconsulting.com.ar
kitsune-sama.com.ar
system-check-adnfecjx.in
system-check-awppaaid.in
system-check-bfuljagg.in
system-check-cabhpfuv.in
system-check-dgaaixxq.in
system-check-efbxqcsa.in
system-check-elotpdux.in
system-check-etldvwxb.in
system-check-evkfmgay.in
system-check-faliyfse.in
system-check-fpkbcyot.in
system-check-fshknbfm.in
system-check-fyeltkhn.in
system-check-hiudyjbm.in
system-check-icrkskuc.in
system-check-lrimafgm.in
system-check-ndyihbuc.in
system-check-npgodwaj.in
system-check-nsgycsvo.in
system-check-nzsupdku.in
system-check-pjiosnkb.in
system-check-qufngsmj.in
system-check-rcabswpl.in
system-check-rrhoipny.in
system-check-udkoeulo.in
system-check-ukxmncwd.in
system-check-vbjiikcz.in
system-check-vorxvayt.in
system-check-vqypvqft.in
system-check-wxotxgwd.in
system-check-zagcqrhq.in
system-check-zfwwxmnq.in
Saturday 26 July 2014
"PLEASE SEND PI" spam / something evil on 198.27.110.192/26
"PI" in this case seems to refer to a Proforma Invoice rather than Î - but in fact the attachment is malware.
Looking at the domains registered on 198.27.110.200 and the surrounding IPs there do seem to be a lot of malicious ones being used as malware C&Cs:
I think this is enough evidence to block the entire 198.27.110.192/26 as a precaution (although there do appear to be a small number of legitimate sites too). For the record, this is suballocated to:
NetRange: 198.27.110.192 - 198.27.110.255
CIDR: 198.27.110.192/26
OriginAS: AS16276
NetName: OVH-CUST-445017
NetHandle: NET-198-27-110-192-1
Parent: NET-198-27-64-0-1
NetType: Reassigned
RegDate: 2014-03-07
Updated: 2014-03-07
Ref: http://whois.arin.net/rest/net/NET-198-27-110-192-1
CustName: Big Kesh, LLC
Address: 1077 Jearsey ln ne
City: Palm Bay
StateProv: FL
PostalCode: 32905
Country: US
RegDate: 2014-03-07
Updated: 2014-03-07
Ref: http://whois.arin.net/rest/customer/C04889220
In the case of Big Kesh LLC I will be charitable and assume that this behaviour is happening without their consent.
The domains xiga.us and ddob.us appear to be used for purely malicious purposes, so I recommend that you block them. The registrant details are probably fake but here they are:
xiga.us
Registrant ID: 06BFAFB5641FA567
Registrant Name: Xieng Hyua
Registrant Address1: Red Bulevard
Registrant City: North Bergen
Registrant State/Province: NJ
Registrant Postal Code: 07047
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.6874598745
Registrant Email: xiga@fbi.al
Registrant Application Purpose: P1
Registrant Nexus Category: C11
ddob.us
Registrant ID: 0121C76442E2ED55
Registrant Name: Jackson Togan
Registrant Address1: Zhongzeng District 100
Registrant City: Zhongzeng District
Registrant State/Province: Zhongzeng District
Registrant Postal Code: 100
Registrant Country: TAIWAN, PROVINCE OF CHINA
Registrant Country Code: TW
Registrant Phone Number: +92.68974568
Registrant Email: jackson.togan@yahoo.com
Registrant Application Purpose: P1
Registrant Nexus Category: C11
Recommended blocklist:
198.27.110.192/26
xiga.us
ddob.us
Date: Fri, 25 Jul 2014 22:50:14 -0700 [01:50:14 EDT]It sounds like a fiendish maths question from an obscure exam. How much Î can you fit in a 40ft container? Anyway, the attachment Order.zip contains a malicious executable klopppp890.exe which has a VirusTotal detection rate of 18/53. The ThreatExpert report [pdf] and ThreatTrack report [pdf] show that the malware phones home to walex2.ddob.us/sddob/gate.php on 198.27.110.200 (OVH Canada reassigned to Big Kesh, LLC, US).
From: OLINMETALS TRADING CO
Subject: PLEASE SEND PI
Greetings,
Regarding our previous conversation about our urgent purchase, kindly
find attached PI and let us know if the quantity can fit in 40ft
container.
kindly revise the Proforma invoice so that we can proceed with an
advance payment as agreed.
We look forward to your urgent response with revised proforma invoice.
Thks & Rgds,
OLINMETALS TRADING CO., LTD
Tel : 0097143205171
Fax : 0097143377150
Looking at the domains registered on 198.27.110.200 and the surrounding IPs there do seem to be a lot of malicious ones being used as malware C&Cs:
frank.ddob.us | 198.27.110.196 | |
walex.ddob.us | 198.27.110.196 | [1] |
dino.ddob.us | 198.27.110.197 | [2] [3] |
mrson.ddob.us | 198.27.110.200 | |
walex2.ddob.us | 198.27.110.200 | [4] |
robert.xiga.us | 198.27.110.200 | [5] |
daniel.ddob.us | 198.27.110.201 | [6] |
robert.ddob.us | 198.27.110.201 | [7] |
326.xiga.us | 198.27.110.203 | |
frannky.ddob.us | 198.27.110.210 | [9] |
janet.ddob.us | 198.27.110.211 | |
sayee.ddob.us | 198.27.110.211 | [10] |
dino.ddob.us | 198.27.110.213 | [11] [12] |
biolo.xiga.us | 198.27.110.216 |
I think this is enough evidence to block the entire 198.27.110.192/26 as a precaution (although there do appear to be a small number of legitimate sites too). For the record, this is suballocated to:
NetRange: 198.27.110.192 - 198.27.110.255
CIDR: 198.27.110.192/26
OriginAS: AS16276
NetName: OVH-CUST-445017
NetHandle: NET-198-27-110-192-1
Parent: NET-198-27-64-0-1
NetType: Reassigned
RegDate: 2014-03-07
Updated: 2014-03-07
Ref: http://whois.arin.net/rest/net/NET-198-27-110-192-1
CustName: Big Kesh, LLC
Address: 1077 Jearsey ln ne
City: Palm Bay
StateProv: FL
PostalCode: 32905
Country: US
RegDate: 2014-03-07
Updated: 2014-03-07
Ref: http://whois.arin.net/rest/customer/C04889220
In the case of Big Kesh LLC I will be charitable and assume that this behaviour is happening without their consent.
The domains xiga.us and ddob.us appear to be used for purely malicious purposes, so I recommend that you block them. The registrant details are probably fake but here they are:
xiga.us
Registrant ID: 06BFAFB5641FA567
Registrant Name: Xieng Hyua
Registrant Address1: Red Bulevard
Registrant City: North Bergen
Registrant State/Province: NJ
Registrant Postal Code: 07047
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +1.6874598745
Registrant Email: xiga@fbi.al
Registrant Application Purpose: P1
Registrant Nexus Category: C11
ddob.us
Registrant ID: 0121C76442E2ED55
Registrant Name: Jackson Togan
Registrant Address1: Zhongzeng District 100
Registrant City: Zhongzeng District
Registrant State/Province: Zhongzeng District
Registrant Postal Code: 100
Registrant Country: TAIWAN, PROVINCE OF CHINA
Registrant Country Code: TW
Registrant Phone Number: +92.68974568
Registrant Email: jackson.togan@yahoo.com
Registrant Application Purpose: P1
Registrant Nexus Category: C11
Recommended blocklist:
198.27.110.192/26
xiga.us
ddob.us
Labels:
Evil Network,
EXE-in-ZIP,
Malware,
Spam,
Viruses
Friday 25 July 2014
"eFax message" spam
From: eFax Corporate [message@inbound.efax.com]
Date: 25 July 2014 14:25
Subject: eFax message - 4 pages
Fax Message [Caller-ID: 948-468-7596]
You have received a 4 pages fax at 2014-07-25 13:24:21 GMT.
* The reference number for this fax is latf1_did11-1187609582-1911573644-58.
View this fax using your PDF reader.
Click here to view this message
Please visit www.eFax.com/en/efax/twa/page/help if you have any questions regarding this message or your service.
Thank you for using the eFax service!
Home | Contact | Login |
Powered by j2
2014 j2 Global Communications, Inc. All rights reserved.
eFax is a registered trademark of j2 Global Communications, Inc.
This account is subject to the terms listed in the eFax Customer Agreement.
In this case the link in the email goes to verzaoficial.com/css/fax_390392029_072514.exe which downloads a file with a VirusTotal detection rate of just 1/45. Automated analysis [pdf] is fairly inconclusive as to what it does.
Tiffany & Co "invoice 0625859 July" spam
This fake Tiffany & Co email has a malicious attachment:
brandsalted.com/333
daisyblue.ru/333
expositoresrollup.es/333
fbcashmethod.ru/333
madrasahhusainiyahkl.com/333
sexyfoxy.ts6.ru/333
siliconharbourng.com/333
www.huework.com/333
www.martijnvanhout.nl/333
www.ricebox.biz/333
www.zag.com.ua/333
Those sites are similar to the one found in the recent "Birmingham Mail" spam run. I recommend that you block the following domains on your network:
brandsalted.com
daisyblue.ru
expositoresrollup.es
fbcashmethod.ru
madrasahhusainiyahkl.com
sexyfoxy.ts6.ru
siliconharbourng.com
huework.com
martijnvanhout.nl
ricebox.biz
zag.com.ua
Date: Fri, 25 Jul 2014 17:32:38 +0800 [05:32:38 EDT]Attached to the message is an archive invoice copy.zip which contains a folder invoice copy in which there is a malicious file invoice copy.exe which has a VirusTotal detection rate of 9/51. The CAMAS report shows that the malware downloads components from the following locations:
From: "J.Parker" [rcaukomti@tiffany.co.uk]
Subject: invoice 0625859 July
Kindly open to see export License and payment invoice attached, meanwhile we sent the balance payment yesterday.
Please confirm if it has settled in your account or you can call if there is any problem.
Thanks
J.parker
Tiffany & Co.
brandsalted.com/333
daisyblue.ru/333
expositoresrollup.es/333
fbcashmethod.ru/333
madrasahhusainiyahkl.com/333
sexyfoxy.ts6.ru/333
siliconharbourng.com/333
www.huework.com/333
www.martijnvanhout.nl/333
www.ricebox.biz/333
www.zag.com.ua/333
Those sites are similar to the one found in the recent "Birmingham Mail" spam run. I recommend that you block the following domains on your network:
brandsalted.com
daisyblue.ru
expositoresrollup.es
fbcashmethod.ru
madrasahhusainiyahkl.com
sexyfoxy.ts6.ru
siliconharbourng.com
huework.com
martijnvanhout.nl
ricebox.biz
zag.com.ua
Labels:
EXE-in-ZIP,
Malware,
Spam,
Viruses
"Help & Advice - Virgin Media Business" / Virginmedia Business spam
Date: Fri, 25 Jul 2014 19:57:24 +0700 [08:57:24 EDT]
From: Virginmedia Business [services@virginmediabusiness.co.uk]
Reply-To: Legal Aid Agency [re-LU-VTRBH-APSYPL@virginmediabusiness.co.uk]
Virgin Media Automated Billing Reminder
Date 25th July 2014
This e-mail has been sent you by Virgin Media to inform you that we were
unable to process your most recent payment of bill. This might be due to
one of the following reasons:
A recent change in your personal information such as Name or address.
Your Credit or Debit card has expired.
Insufficient funds in your account.
Cancellation of Direct Debit agreement.
Your Card issuer did not authorize this transaction.
To avoid Service interruption you will need to update your billing profile, failure to update your profile may lead in service cancellation and termination.
Please fulfill attached form and send it back to our email adress.
Please ensure all address and contact details are up to date, once submitted your account details will automatically be updated within 24 Hours.
Kind Regards,
Virgin Media
Customer Services Team
Ellis Willis
Attached is an archive file form_27429-070.zip which in turn contains a folder billing_form91_4352-2105.pdf which in turn contains a malicious executable billing_form91_4352-2105.pdf.scr which has a VirusTotal detection rate of 3/53. The Comodo CAMAS report indicates that is is largely the same in behaviour as this HMRC malware from earlier today.
Labels:
EXE-in-ZIP,
Malware,
Spam,
Viruses
HM Revenue and Customs "Notice of Underreported Income" spam
The second HMRC spam run of the day, this one contains a malicious link.
From: HM Revenue and Customs [noreply@hmrc.gov.uk]In this case the link in the email goes to ecanovas.com/boceto/hmrc.exe which the user is expected to download and run. It has a VirusTotal detection rate of 3/51. Automated analysis tools are pretty inconclusive [1] [2] [3] but do reveal some of the behavioural activity.
Reply-To: HM Revenue and Customs [noreply@hmrc.gov.uk]
Date: 25 July 2014 12:19
Subject: Notice of Underreported Income
Taxpayer ID: ufwsd-000007954108UK
Tax Type: Income Tax
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax income statement on HM Revenue and Customs ( HMRC ).Download your HMRC statement.
Please complete the form. You can download HMRC Form here.
Subscribe to:
Posts (Atom)