Date: Wed, 5 Feb 2014 03:02:52 -0500 [03:02:52 EST]Attached is a file Payment receipt Barclays PA77392733.zip which is turn contains a malicious executable Payment receipt Barclays PA77392733.exe with a surprisingly poor VirusTotal detection rate of just 1/51 (only Sophos detects it). Automated analysis tools are pretty inconclusive about the payload [1] [2] [3] with only the Malwr report having any real detail.
From: Barclays Bank [support@barclays.net]
Subject: Barclays transaction notification #002601
Transaction is completed. £9685 has been successfully transfered.
If the transaction was made by mistake please contact our customer service.
Receipt of payment is attached.
Barclays is a trading name of Barclays Bank PLC and its subsidiaries. Barclays Bank PLC is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority (Financial Services Register No. 122702). Registered in England. Registered Number is 1026167 with registered office at 1 Churchill Place, London E14 5HP.
Wednesday, 5 February 2014
"Barclays transaction notification" spam
This fake Barclays spam comes with a malicious payload:
Labels:
EXE-in-ZIP,
Malware,
Spam,
Viruses
Tuesday, 4 February 2014
WTF? WFP.org spam? Or is it emailciti.com?
This spam is promoting the UN's World Food Programme. I'm surprised the the WFP should sink so low, but perhaps they engaged the services of spammers without realising.
The email itself is digitally signed, so we can be reasonable assure that it originates from loyaltyciti.com who are in Dubai:
Registry Registrant ID:
Registrant Name: mohammad Lahlouh
Registrant Organization: Emailciti
Registrant Street: Dubai Media City, Building #8
Registrant City: Dubai
Registrant State/Province: Dubai
Registrant Postal Code: 502382
Registrant Country: United Arab Emirates
Registrant Phone: +971.507735717
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: mlahlouh@emailciti.com
Registry Admin ID:
These people are persistent spammers who usually send through some unsolicited crap several times a week, using an email address that is effectively a spamtrap. What is really annoying is the the WFP is paying these spammers to run a campaign of dubious value when they could be helping to fee starving people.
From: World Food Programme newsletter@newsletter.loyaltyciti.comThe email originates from 208.95.135.84 [mail3345.emailciti.mkt3942.com] (Silverpop Systems, US) and spamvertises an intermediate site at links.emailciti.mkt3941.com on 74.112.69.20 (Silverpop again) and then forwards to www.wfp.org/hunger-hot-spots if you click through.
Reply-To: newsletter@newsletter.loyaltyciti.com
Date: 4 February 2014 09:58
Subject: 60% of people here don't have food
Signed by: newsletter.loyaltyciti.com
If you are unable to see the message below, click here to view.
Share: Delicious Digg Facebook LinkedIn Twitter
world food programme
There’s a common link between a mother in Central African Republic, a father in South Sudan, and a child in Syria. Hunger. Fortunately, there’s also a common solution – The World Food Programme (WFP)..
WFP provides food assistance so families can break the cycle of poverty and hunger. Our goal? Zero hunger. We rely on the support of our online community to make this a reality.
Will you join us? Sign up at wfp.org/join to receive monthly updates and info about how you can help achieve a zero hunger world.
When conflict erupts, hunger soon follows. In CAR, South Sudan, and Syria, WFP is fighting for families who are being pushed to the brink. Find out how we’re responding to ensure families have the security that comes with a daily meal.
central african republic
level 3 emergency
See where we’re sounding the alarm.
remembering what matters delivering despite
WFP’s Rasmus Egendal reflects on what really matters in Syria: The People. Thanks to our supporters like you, WFP has been able to deliver food in South Sudan rom the start.
starting stars from car reporting from damascus
Get the facts & figures you should know: 60% of families in Central African Republic have no food. Watch an update from WFP’s Executive Director who met Syrian families relying on WFP assistance.
follow wfp facebook twitter
You have received this email message from EmailCiti, the leading Email Behavior and Lead Generation Company in the GCC & Middle East. Your email address has been recorded because you have subscribed to one of our email &newsletters services or are registered with one of our Partner and affiliate sites. For more information, visit www.emailciti.com
If you don't wish to receive these emails anymore please click here.
The email itself is digitally signed, so we can be reasonable assure that it originates from loyaltyciti.com who are in Dubai:
Registry Registrant ID:
Registrant Name: mohammad Lahlouh
Registrant Organization: Emailciti
Registrant Street: Dubai Media City, Building #8
Registrant City: Dubai
Registrant State/Province: Dubai
Registrant Postal Code: 502382
Registrant Country: United Arab Emirates
Registrant Phone: +971.507735717
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: mlahlouh@emailciti.com
Registry Admin ID:
These people are persistent spammers who usually send through some unsolicited crap several times a week, using an email address that is effectively a spamtrap. What is really annoying is the the WFP is paying these spammers to run a campaign of dubious value when they could be helping to fee starving people.
Monday, 3 February 2014
Something evil on 192.95.43.160/28
More badness hosted by OVH Canada, this time 192.95.43.160/28 which contains pretty much the same set of evil described here. Here is a typical IP flagged by VirusTotal and a failed resolution by URLquery which frankly gives enough information to make it suspicious.
However, the key thing is the registrant details which have been used in many malware attacks before.
CustName: Private Customer
Address: Private Residence
City: Penziatki
StateProv:
PostalCode: 30000
Country: RU
RegDate: 2014-01-24
Updated: 2014-01-24
Ref: http://whois.arin.net/rest/customer/C04859116
I can see the following .pw domains active in this range:
basecoach.pw
crewcloud.pw
boomerangfair.pw
kickballmonsoon.pw
martialartsclub.pw
runningracer.pw
All those domains are flagged by Google as malicious and I recommend that you block them along with 192.95.43.160/28.
(Hat tip to my source, you know who you are!)
However, the key thing is the registrant details which have been used in many malware attacks before.
CustName: Private Customer
Address: Private Residence
City: Penziatki
StateProv:
PostalCode: 30000
Country: RU
RegDate: 2014-01-24
Updated: 2014-01-24
Ref: http://whois.arin.net/rest/customer/C04859116
I can see the following .pw domains active in this range:
basecoach.pw
crewcloud.pw
boomerangfair.pw
kickballmonsoon.pw
martialartsclub.pw
runningracer.pw
All those domains are flagged by Google as malicious and I recommend that you block them along with 192.95.43.160/28.
(Hat tip to my source, you know who you are!)
Something evil on 64.120.137.32/27
64.120.137.32/27 is a range of IP addresses belonging to Network Operations Center Inc in the US and suballocated to a customer which is currently being used in malware attacks as an intermediate step in sending victims to this malicious OVH range.You can see an example of some of the badness in action here.
The range was formerly used by a company called TixDepot but may have been hijacked or reassigned. NOC report the following contact details for the block:
%rwhois V-1.5:003fff:00 rwhois.hostnoc.net (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:NET-64.120.137.32/27
network:Auth-Area:64.120.128.0/17
network:network:NET-64.120.137.32/27
network:block:64.120.137.32/27
network:organization;I:T0000027307
network:address:1205 Oneill Highway
network:city:Dunmore
network:state:PA
network:postalcode:18512
network:country:US
network:admin-c;I:A9000000001
network:tech-c;I:T0000027307
network:abuse-c;I:I9000000001
network:created:20120208221612
network:Updated:20140203010039
About half the domains in this /27 have been flagged as malicious by Google, concentrated on the three IP addresses:
64.120.137.53
64.120.137.55
64.120.137.56
I would recommend blocking the entire /27, but this is the breakdown by IP address with domains tagged by Google highlighted (there's a plain list here)
64.120.137.34
kasorla.biz
kolyamba.biz
64.120.137.35
verybery.biz
dristohren.biz
vedmedical.biz
teasertease.biz
64.120.137.38
koshak.biz
64.120.137.39
meef.biz
www.meef.biz
chubanak.biz
64.120.137.41
jinkee.biz
tongpo.biz
kunuki.biz
omlette.biz
64.120.137.42
war-fear.biz
sleeping-rough.biz
www.war-fear.biz
64.120.137.47
searchsecurely.biz
whitehestence.com
64.120.137.48
webconnection.biz
trafficstatsanalytics.com
64.120.137.51
lohotron.biz
domainishere.biz
happygreentree.biz
plomaternia.com
greendo.biz
continuedomain.biz
personaldomain.biz
trafficqualitycheck.biz
64.120.137.52
swint.biz
elhooase.biz
fazatron.biz
peperrony.biz
pistorios.biz
papabudet.biz
papazdesj.biz
paparjadom.biz
besthitbotfilter.biz
64.120.137.53
hairyegg.biz
eegogo.biz
ilanus.biz
baldball.biz
moisturre.biz
mongoloid.biz
barbarisus.biz
damoinster.biz
horseinwood.biz
64.120.137.54
swineherd.biz
traffzilla.biz
blackfatcat.biz
trafficstation.biz
64.120.137.55
smokeme.biz
domentus.biz
yyynetlop.biz
goodweather.biz
hellparadise.biz
blog.bitcareer.com
bitewixibib.com
cuqerexejef.com
xocysibekyn.com
25blv.xocysibekyn.com
buy.si8a.net
tejedinehyh.net
68qn.tejedinehyh.net
vynifyqicedy.net
7dww.vynifyqicedy.net
vyzogosukoqy.net
ekc63s.vyzogosukoqy.net
bitewixibib.org
qyzuliponag.org
4ah781.qyzuliponag.org
xinuvytevem.org
s6pnl.xinuvytevem.org
xocysibekyn.org
ee5.xocysibekyn.org
hcm.xocysibekyn.org
vynifyqicedy.org
tejedinehyh.info
w0r4n.tejedinehyh.info
vyzogosukoqy.info
n45p6.vyzogosukoqy.info
nolericutis.com
qyzuliponag.com
xinuvytevem.com
cuqerexejef.org
nolericutis.org
tejedinehyh.org
iu1wxx.tejedinehyh.org
nvlrlh.tejedinehyh.org
vyzogosukoqy.org
wotunelurex.info
vynifyqicedy.info
64.120.137.56
en.xzhao.cc
us.yongbao.cc
ca.zhengerle.cc
me.transportesmelladogutierrez.cl
br.youu-and.me
dns.v9v8.com
gr.wew444.com
ls.wew999.com
dns.thejpg1.com
dns.acidcrud.com
dns.agoteenak.com
qajadyhizuli.com
fr.whenisthenextnhllockout.com
dns.uhgy.net
banewyjubuk.net
1qcz.banewyjubuk.net
diwopiroseq.net
7zz.diwopiroseq.net
gulumegesus.net
daij.gulumegesus.net
jadivyludal.net
pnps.jadivyludal.net
kafitetysyr.net
71sdqa.kafitetysyr.net
bucupyfomome.net
8q7.bucupyfomome.net
byqyrabewuti.net
iv3oj.byqyrabewuti.net
qajadyhizuli.net
symirijibimu.net
tusudygonipo.net
qjcd.tusudygonipo.net
banewyjubuk.org
9s33.banewyjubuk.org
ycooet.banewyjubuk.org
gulumegesus.org
8jek7.gulumegesus.org
jadivyludal.org
k64yx9.jadivyludal.org
kafitetysyr.org
hida.kafitetysyr.org
jyc8i.kafitetysyr.org
bucupyfomome.org
rdjjnh.bucupyfomome.org
byqyrabewuti.org
3v7opv.byqyrabewuti.org
qajadyhizuli.org
k8gcj.qajadyhizuli.org
symirijibimu.orgjadivyludal.com
pumiqudiqer.com
vemusiwubixe.com
kecynikamoc.net
3srjc.kecynikamoc.net
komikuxoced.net
pumiqudiqer.net
lejyvicuvagi.net
vemusiwubixe.net
kecynikamoc.org
komikuxoced.org
pumiqudiqer.org
lejyvicuvagi.org
vemusiwubixe.org
The range was formerly used by a company called TixDepot but may have been hijacked or reassigned. NOC report the following contact details for the block:
%rwhois V-1.5:003fff:00 rwhois.hostnoc.net (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:NET-64.120.137.32/27
network:Auth-Area:64.120.128.0/17
network:network:NET-64.120.137.32/27
network:block:64.120.137.32/27
network:organization;I:T0000027307
network:address:1205 Oneill Highway
network:city:Dunmore
network:state:PA
network:postalcode:18512
network:country:US
network:admin-c;I:A9000000001
network:tech-c;I:T0000027307
network:abuse-c;I:I9000000001
network:created:20120208221612
network:Updated:20140203010039
About half the domains in this /27 have been flagged as malicious by Google, concentrated on the three IP addresses:
64.120.137.53
64.120.137.55
64.120.137.56
I would recommend blocking the entire /27, but this is the breakdown by IP address with domains tagged by Google highlighted (there's a plain list here)
64.120.137.34
kasorla.biz
kolyamba.biz
64.120.137.35
verybery.biz
dristohren.biz
vedmedical.biz
teasertease.biz
64.120.137.38
koshak.biz
64.120.137.39
meef.biz
www.meef.biz
chubanak.biz
64.120.137.41
jinkee.biz
tongpo.biz
kunuki.biz
omlette.biz
64.120.137.42
war-fear.biz
sleeping-rough.biz
www.war-fear.biz
64.120.137.47
searchsecurely.biz
whitehestence.com
64.120.137.48
webconnection.biz
trafficstatsanalytics.com
64.120.137.51
lohotron.biz
domainishere.biz
happygreentree.biz
plomaternia.com
greendo.biz
continuedomain.biz
personaldomain.biz
trafficqualitycheck.biz
64.120.137.52
swint.biz
elhooase.biz
fazatron.biz
peperrony.biz
pistorios.biz
papabudet.biz
papazdesj.biz
paparjadom.biz
besthitbotfilter.biz
64.120.137.53
hairyegg.biz
eegogo.biz
ilanus.biz
baldball.biz
moisturre.biz
mongoloid.biz
barbarisus.biz
damoinster.biz
horseinwood.biz
64.120.137.54
swineherd.biz
traffzilla.biz
blackfatcat.biz
trafficstation.biz
64.120.137.55
smokeme.biz
domentus.biz
yyynetlop.biz
goodweather.biz
hellparadise.biz
blog.bitcareer.com
bitewixibib.com
cuqerexejef.com
xocysibekyn.com
25blv.xocysibekyn.com
buy.si8a.net
tejedinehyh.net
68qn.tejedinehyh.net
vynifyqicedy.net
7dww.vynifyqicedy.net
vyzogosukoqy.net
ekc63s.vyzogosukoqy.net
bitewixibib.org
qyzuliponag.org
4ah781.qyzuliponag.org
xinuvytevem.org
s6pnl.xinuvytevem.org
xocysibekyn.org
ee5.xocysibekyn.org
hcm.xocysibekyn.org
vynifyqicedy.org
tejedinehyh.info
w0r4n.tejedinehyh.info
vyzogosukoqy.info
n45p6.vyzogosukoqy.info
nolericutis.com
qyzuliponag.com
xinuvytevem.com
cuqerexejef.org
nolericutis.org
tejedinehyh.org
iu1wxx.tejedinehyh.org
nvlrlh.tejedinehyh.org
vyzogosukoqy.org
wotunelurex.info
vynifyqicedy.info
64.120.137.56
en.xzhao.cc
us.yongbao.cc
ca.zhengerle.cc
me.transportesmelladogutierrez.cl
br.youu-and.me
dns.v9v8.com
gr.wew444.com
ls.wew999.com
dns.thejpg1.com
dns.acidcrud.com
dns.agoteenak.com
qajadyhizuli.com
fr.whenisthenextnhllockout.com
dns.uhgy.net
banewyjubuk.net
1qcz.banewyjubuk.net
diwopiroseq.net
7zz.diwopiroseq.net
gulumegesus.net
daij.gulumegesus.net
jadivyludal.net
pnps.jadivyludal.net
kafitetysyr.net
71sdqa.kafitetysyr.net
bucupyfomome.net
8q7.bucupyfomome.net
byqyrabewuti.net
iv3oj.byqyrabewuti.net
qajadyhizuli.net
symirijibimu.net
tusudygonipo.net
qjcd.tusudygonipo.net
banewyjubuk.org
9s33.banewyjubuk.org
ycooet.banewyjubuk.org
gulumegesus.org
8jek7.gulumegesus.org
jadivyludal.org
k64yx9.jadivyludal.org
kafitetysyr.org
hida.kafitetysyr.org
jyc8i.kafitetysyr.org
bucupyfomome.org
rdjjnh.bucupyfomome.org
byqyrabewuti.org
3v7opv.byqyrabewuti.org
qajadyhizuli.org
k8gcj.qajadyhizuli.org
symirijibimu.orgjadivyludal.com
pumiqudiqer.com
vemusiwubixe.com
kecynikamoc.net
3srjc.kecynikamoc.net
komikuxoced.net
pumiqudiqer.net
lejyvicuvagi.net
vemusiwubixe.net
kecynikamoc.org
komikuxoced.org
pumiqudiqer.org
lejyvicuvagi.org
vemusiwubixe.org
Labels:
Evil Network,
Malware,
Viruses
Something evil on 192.95.7.224/28
Another OVH Canada range hosting criminal activity, 192.95.7.224/28 is being used for several malicious .pw domains being used to distribute malware (as used in this attack). The malware domains seem to rotate through subdomains very quickly, possibly in an attempt to block analysis of their payload. This block is carrying out the same malicious activity that I wrote about a few days ago.
OVH have suballocated this IP block to an entity that I believe is connected with black hat host r5x.org.
CustName: Private Customer
Address: Private Residence
City: Penziatki
StateProv:
PostalCode: 30000
Country: RU
RegDate: 2014-01-24
Updated: 2014-01-24
Ref: http://whois.arin.net/rest/customer/C04859114
These IPs are particularly active:
192.95.7.232
192.95.7.233
192.95.7.234
There is nothing of value in this /28 block and I recommend that you block the entire IP range plus the following domains (which are all already flagged as being malicious by Google)
Recommended blocklist:
192.95.7.224/28
archerbocce.pw
athleticsmove.pw
battingrelay.pw
bicyclecompete.pw
bicyclingcrew.pw
billiardsdiver.pw
bronzecatcher.pw
competitionathletics.pw
competitionexercise.pw
dartboardolympics.pw
dartfield.pw
divebicycling.pw
divingrelay.pw
fieldergymnast.pw
golferboomerang.pw
hardballkayaker.pw
hockeyarchery.pw
hoopjudo.pw
javelinbowler.pw
leaguehockey.pw
netarcher.pw
playingriding.pw
racerathlete.pw
racerbronze.pw
runrafting.pw
OVH have suballocated this IP block to an entity that I believe is connected with black hat host r5x.org.
CustName: Private Customer
Address: Private Residence
City: Penziatki
StateProv:
PostalCode: 30000
Country: RU
RegDate: 2014-01-24
Updated: 2014-01-24
Ref: http://whois.arin.net/rest/customer/C04859114
These IPs are particularly active:
192.95.7.232
192.95.7.233
192.95.7.234
There is nothing of value in this /28 block and I recommend that you block the entire IP range plus the following domains (which are all already flagged as being malicious by Google)
Recommended blocklist:
192.95.7.224/28
archerbocce.pw
athleticsmove.pw
battingrelay.pw
bicyclecompete.pw
bicyclingcrew.pw
billiardsdiver.pw
bronzecatcher.pw
competitionathletics.pw
competitionexercise.pw
dartboardolympics.pw
dartfield.pw
divebicycling.pw
divingrelay.pw
fieldergymnast.pw
golferboomerang.pw
hardballkayaker.pw
hockeyarchery.pw
hoopjudo.pw
javelinbowler.pw
leaguehockey.pw
netarcher.pw
playingriding.pw
racerathlete.pw
racerbronze.pw
runrafting.pw
Sunday, 2 February 2014
Times Now covers the Somnath Bharti story
Labels:
Somnath Bharti,
Video
Somnath Bharti's allwebhunt.com site exposes inner working of spam outfit
I was interested to see Mr Bharti's response to these accusations:
Denying involvement in spamming, Bharti emailed TOI saying: "Back in early 2000, server of Madgen Solutions Pvt Ltd was entrusted with an associate by me who misused it without my consent/knowledge. When the matter cropped up, I came to know that the said associate had generated mass emails soliciting business and had also impersonated me on multiple occasions. On exploring I found out that the emails generated were for a legitimate business, originating from a valid traceable IP address and in proper compliance with the laws applicable in the US, ie CANSPAM Act, then... hence this breach of trust between me and this associate of mine was not pursued in a court of law."I have to rely on the accuracy of the Times of India with this quote, although the way the TOI has presented it this does like a direct quote from Mr Bharti himself.
Before I start picking apart what Somath Bharti said, it is worth pointing out that the only time I have ever heard anything from him was when he made a flat-out lie claiming that he had never ever heard of the company involved (TopSites LLC), despite having his name listed as CEO on the company business card.
Just for good luck, the person sending me that information also sent me a copy of a very young looking Mr Bharti to prove his identity.
He looks a bit different today (source)
The evidence linking Mr Bharti's Madgen solutions with spam is overwhelming and does not seem to have been denied in the TOI interview, although you can see the reports made at the time here.
But let's look at Mr Bharti's statement to the TOI more closely..
"Back in early 2000, server of Madgen Solutions Pvt Ltd was entrusted with an associate by me who misused it without my consent/knowledge."Well, this is kind of odd because the TopSites LLC spam did not start until 2002 at the earliest, and and Bharti's outfit was only identified much later than that (see this example). So Mr Bharti's memory is either faulty, or this is just an poorly though-out excuse, or maybe he meant the "early 2000s"?
But Mr Bharti's fingers have always been all over the TopSites business, such as the WHOIS details for the original domain used in the spam, topsites.us:
However, that is just a name on the WHOIS records. We can also see his name on the internal databases of one of the many clone sites of TopSites that was set up:
That information comes from a poorly-secured TopSites clone called allwebhunt.com hosted on a server at 119.82.71.132 (Citycom Networks, India) along with Mr Bharti's own personal website of somnathbharti.com.
allwebhunt.com was rapidly taken down after it was exposed in the Times of India, but you can still see an archived copy here, indicating that the operation was running until at least 2011.
The website was exceptionally poorly coded and exposed all of its internal details to the internet. Here's a screenshot of some of the code listing internal users.
The names of Mr Bharti are all over this particular operation, so it is unlikely that he did not know exactly what was happening. He even went as far as to use a TopSites domain on his somnathbharti.com home page back in 2003.
My conclusion is that despite Mr Bharti's protests, I believe that he was intimately involved in the spamming operation that his company Madgen Solutions was performing on behalf of TopSites LLC.
But there remains one further unanswered question. Back in 2005 the TopSites business was put up for sale claiming an annual turnover of 1.8 million US dollars. And although Mr Bharti's business partners would probably have pocketed the majority of that money, it would seem highly unlikely that Mr Bharti himself did not share in some of those profits.
Exactly how much did Mr Bharti make from this spamming operation? Even the people who did payment processing got a 9% cut..
..I have no idea. But perhaps somebody might like to find out :)
Labels:
India,
Somnath Bharti,
Spam
Saturday, 1 February 2014
"Unsure if you qualify for a refund of PPI paid on a loan or credit card?" SMS spam
This scumbag scammers are still at it, pumping away lead generation spam to persuade people to make PPI claims to which they are not entitled.
If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.
You can also report persistent spam like this via the ICO's page on the subject. With any luck these spammers will end up on the receiving end of a massive fine.
Unsure if you qualify for a refund of PPI paid on a loan or credit card? Reply PPI and we will run a no obligation check or reply STOP to opt out. TPPCOIn this case the scammers used the contact number +447743623103 but they burn through dozens of SIM cards every day with their illegal spamming operations.
If you get one of these, you should forward the spam and the sender's number to your carrier. In the came of T-Mobile, O2 and Orange the number to report to is 7726 ("SPAM"). Vodafone customers should use 87726 ("VSPAM") and Three customers should use 37726 ("3SPAM"). Hopefully the carriers will act if there are enough complaints.
You can also report persistent spam like this via the ICO's page on the subject. With any luck these spammers will end up on the receiving end of a massive fine.
Subscribe to:
Posts (Atom)