Monday, November 04, 2013
Malicious Script Artifacts at China Green Dot Gov Dot Cn - A Reminiscence of Asprox's Multi-Tasking Activities
Malware artifacts, abandoned mass iframe embedded/injected campaigns, and low Quality Assurance (QA) campaigns, continue popping up on everyone's radar, raising eyebrows as to the extend of incompetence, possible evasive tactics, plain simple lack of applied QA when maintaining these campaigns, or the end of a campaign's life cycle.
What's the value of assessing such a non-active campaign? Can the analysis provide any clues into related currently active malicious campaigns that typically for such type of campaigns, continue relying on the same malicious infrastructure? But of course.
Let's assess the malicious artifacts at hxxp://chinagreen.gov.cn, connect them to the multi-tasking activities conducted on behalf of the Asprox botnet, as well as several spamvertised malware campaigns circa 2010, and most importantly provide actionable intelligence on currently active campaigns that continue using the very same infrastructure for command and control purposes.
Malicious scripts at China Green Dot Gov Dot CN:
update.webserviceftp.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
gdi.webserviceftp.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
ver.webserivcekota.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
batch.webserviceaan.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
nemohuildiin.ru/tds/go.php?sid=1 - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
parkperson.ru:8080/index.php?pid=13 - seen in "Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware/Exploits Serving Campaign"
nutcountry.ru:8080/index.php?pid=13 - seen in "Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware/Exploits Serving Campaign"
What's so special about the spamvertised XeroxWorkCentre Pro campaign is that, back in 2010, it used to drop an Asprox sample, naturally phoning back to well known Asprox C&Cs at the time.
nemohuildiin.ru is known to have responded to 188.8.131.52 and most recently to 184.108.40.206
Known to have responded to the same IP (220.127.116.11) are also the following malicious domains:
Moreover, we also got a decent number of malicious MD5s known to have used the same IP as C&C ove the last couple of months, indicating that the artifact is still part of the C&C infrastructure of active campaigns.
The following malicious MD5s are also known to have phoned back to the same IP over the last couple of months:
Known to have responded to 18.104.22.168 are also the following malicious domains:
In a cybercrime ecosystem dominated by leaked DIY mass Web site hacking tools, and sophisticated iframe-ing platforms, malicious artifacts are a great reminder that as long as the Web site remains susceptible to remote exploitation, it's only a matter of time before a potential cybercriminal embeds/injects malicious script on it. That's cybercrime-friendly common sense.
This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.