From: messages-noreply@bounce.linkedin.com [mailto:messages-noreply@bounce.linkedin.com] On Behalf Of LinkedIn PasswordThe malicious payload is at [donotclick]eziponoma.ru:8080/forum/links/column.php which is hosted on:
Sent: 25 January 2013 04:12
Subject: UPS Tracking Number H0931698016
You can use UPS Services to:
Ship Online
Schedule a Pickup
Open a UPS Services Account
Welcome to UPS .com Customer Services
Hi, [redacted].
DEAR CLIENT , RECIPIENT'S ADDRESS IS WRONG
PLEASE PRINT OUT THE INVOICE COPY ATTACHED AND COLLECT THE PACKAGE AT OUR DEPARTMENT.
With Respect , Your UPS Customer Services.
________________________________________
Copyright 2011 United Parcel Service of America, Inc. UNITED STATES POSTAL SERVICES, the Your USPS TEAM brandmark, and the color brown are trademarks of United Parcel Service of America, Inc. All rights reserved.
Please do not reply directly to this e-mail. USPS CUSTOMER SERVICES will not receive any reply message. For questions or comments, visit Contact UPS.
We understand the importance of privacy to our customers. For more information, please consult the USPS Team Privacy Policy.
This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.
94.23.3.196 (OVH, France)
195.210.47.208 (PS Internet Company, Kazakhstan)
202.72.245.146 (Railcom, Mongolia)
Hello Conrad,
ReplyDeleteI made the as comprehensive as possible the malware analysis of this infection of Blackhole eziponoma,ru:8080.
I also put samples, captured data of registry, file accessed, network/PCAP data including the cracked data like landing page & config of the stealer itself.
The CnC and panel of the credential stealer portal also exposed, a lot of domains and IP can be put for blocked.
Hope this helps
Access: http://malwaremustdie.blogspot.jp/2013/01/when-tte-pws-stealer-try-to-improve.html
Hello Conrad,
ReplyDeletePopped the hood of the malware saved credential server & we passed it to authority.
PoC: http://malwaremustdie.blogspot.jp/2013/01/when-tte-pws-stealer-try-to-improve.html#crack
It showed:
Total bots: 85 // Alive infected PC
Total finished: 58 // dunno this..
Total opened: 332 // infection case
I guess we will not seeing spams coming from these guys for quite some time. But if you spot it please kindly let us know quickly?
My best regards, keep on the good work!
#MalwareMustDie!