It's 2010 and I've recently came across to yet another currently active scareware-serving campaign courtesy of the Koobface gang this time successfully introducing a CAPTCHA-breaking module potentially improving the propagation and distribution scale within major social networks.
In this post I'll discuss the campaign and provide actionable intelligence on the infrastructure behind it.
Related malicious domains known to have participated in the campaign:
hxxp://goscandir.com/?uid=13301 - 91.212.107.103 - hosting courtesy of AS29550 - EUROCONNEX-AS Blueconnex Networks Ltd Formally Euroconnex Networks
hxxp://ebeoxuw.cn/?uid=13301
hxxp://ebiezoj.cn/22/?uid=13301
hxxp://goscanhand.com/?uid=13301
hxxp://byxzeq.cn/22/?uid=13301
Sample malicious MD5 known to have participated in the campaign:
MD5: 16575a1d40f745c2e39348c1727b8552
Once executed a sample malware phones back to:
hxxp://in5it.com/download/Ipack.jpg - the actual executable
Related malicious MD5 known to have participated in the campaign:
MD5: 1d5e3d78dd7efd8878075e5dbaa5c4fd
Related malicious MD5 known to have participated in the campaign:
MD5: 6262c0cb1459adc8f278136f3cff2777
It's worth pointing out that prior to analyzing the campaign it appears that the Koobface gang has recently introduced a CAPTCHA-breaking module which basically relies on the active outsourcing of the CAPTCHA-breaking process potentially improving the Koobface spreading and propagation effectiveness.
Sample malicious URL known to have participated in the campaign:
http://peacockalleyantiques.com/.sys/?getexe=v2googlecheck.exe
Sample malicious MD5 known to have participated in the campaign:
MD5: cf9729bf3969df702767f3b9a131ec2c
Sample malicious URL known to have participated in the campaign:
http://peacockalleyantiques.com/.sys/?getexe=v2captcha.exe
Sample malicious MD5 known to have participated in the campaign:
MD5: f2d0dbf1b11c5c2ff7e5f4c655d5e43e
Once executed a sample phones back to the following C&C server IPs:
hxxp://capthcabreak.com/captcha/?a=get&i=0&v=14 - 67.212.69.230
hxxp://captchastop.com/captcha/?a=get&i=1&v=14 - 67.212.69.230
It's 2010 and I've recently intercepted a currently circulating malicious and fraudulent scareware-serving campaign courtesy of the Koobface Gang this time successfully typosquatting my name within its command and control infrastructure.
In this post I'll provide actionable intelligence behind the campaign and will discuss in-depth the infrastructure behind it.
Sample malicious and fraudulent domains known to have participated in the campaign:
hxxp://qjcleaner.eu/hitin.php?affid=02979
Sample malicious MD5 known to have participated in the campaign:
MD5: 8df3e9c50bb4756f4434a9b7d6c23c8c
Once executed a sample malware phones back to:
hxxp://212.117.160.18/install.php?id=02979
which is basically our dear friends at AS44042 ROOT-AS root eSolutions
Parked at the same IP where Crusade Affiliates continue serving a diverse set of fake security software are also more scareware domains.
It's also worth pointing out that the Koobface gang has recently started typosquatting various domains using my name. Koobface gang is typosquatting my name for registering domains (for instance Rancho Ranchev; Pancho Panchev etc.) including hxxp://mayernews.com - which is registered to Danchev Danch (1andruh.a1@gmail.com).
With scareware continuing to proliferate I've recently intercepted a currently active malicious and fraudulent blackhat SEO campaign successfully enticing thousands of users into interacting with the rogue and malicious software with the scareware behind the campaign successfully modifying the HOSTS on the affected host potentially exposing the user to a variety of fake search engines type of rogue and fraudulent and malicious activity.
In this post I'll provide actionable intelligence on the infrastructure behind the campaign.
Sample malicious URL known to have participated in the campaign:
hxxp://guardsys-zone.com/?p=WKmimHVmaWyHjsbIo22EeXZe0KCfZlbVoKDb2YmHWJjOxaCbkX1%2Bal6orKWekJXIZWhimmVummWIo6THodjXoGJdpqmikpVuZ21uaHFtb1%2FEkKE%3D
Sample malicious MD5 known to have participated in the campaign:
MD5: 665480a64d4f72a33120251c968e9c28
Once executed the sample modifies the HOSTS and redirects them to the following domains:
hxxp://google-reseach.com/gfeed/click.php?q=&p=1 - 66.36.243.201
hxxp://google-reseach.com/search.php?&aff=32210&saff=0&q=
Related malicious rogue and fraudulent URL known to have participated in the campaign:
hxxp://88.85.73.139/landing/
Sample rogue and fraudulent payment processed used in the campaign:
hxxp://safetyself.com/safereports/ - 88.85.73.139
Remember loads.cc? In this post I'll provide actionable intelligence on the popular DDoS for hire service circa 2008 and offer in-depth perspective on the tactics utilized by the gang behind the service for the purpose of earning fraudulent revenue in the process of monetizing access to malware-infected hosts.
Sample malicious and fraudulent infrastructure known to have participated in the campaign:
hxxp://loads.cc - hxxp://ns1.udnska.cn (72.21.52.99), interestingly, hxxp://sateliting.cn is the C&C for hxxp://loads.cc service.
Related malicious and fraudulent URLs known to have participated in the campaign:
hxxp://sateliting.cn/?&v=exp6&lid=1033
hxxp://sateliting.cn/?&v=iron&lid=1033
hxxp://sateliting.cn/?&v=1810kj&lid=1033
hxxp://sateliting.cn/?&v=Loko&lid=1033
hxxp://sateliting.cn/?&v=mporlova&lid=1033
hxxp://satelit-ing.cn/?&v=mporlova&lid=1033
hxxp://sateliting.cn/?&v=gto&lid=1033
Related malicious IPs known to have responded to sateliting.cn:
hxxp://50.117.116.117
hxxp://216.172.154.34
hxxp://50.117.122.90
hxxp://205.164.24.45
hxxp://50.117.116.205
hxxp://50.117.116.204
hxxp://65.19.157.227
Related malicious MD5s known to have participated in the campaign:
MD5: eb0e25f2ac8f50590e3a00dcf766ef02
MD5: 48cf9b8b063715bb53e691da61601a73
MD5: 0b63dc08da40fcaf532847cfa5d9fc12
MD5: 0abaffe7d19c382d6dc94e40b27f199b
MD5: 0844b755c7e26c8051ab23369f720a4b
MD5: 2f3e270c37b48523e3e89ab76a012092
Love them or hate them - the ubiquitous beautiful girl utilizing fake bogus and rogue Facebook accounts scam campaign courtesy of Hamas targeting Israeli soldiers has to come to an end.
In this post I'll provide actionable intelligence on a currently active Pro-Hamas malicious and fraudulent infrastructure and will discuss in-depth the tactics techniques and procedures of the cybercriminals behind it and will offer in-depth perspective on a currently active Pro-Hamas hosting provider - "Nepras for Media & IT" which is basically a legitimate front-end company currently involved in a variety of Pro-Hamas malicious and fraudulent malware-serving and propaganda spreading online infrastructure provider directly related to yet another Pro-Hamas franchise - "Modern Tech Corp".
Sample Facebook Profile Names involved in the campaign:
Elianna Amer
Aitai Yosef
Karen Cohen
Amit Cohen
Loren Ailan
Verena Sonner
Lina Kramer
Sample profile photos of Pro-Hamas fake and rogue Facebook accounts:
UPDATE: Flashpoint Intel issued a response to my research.
UPDATE: SCMagazine picked up the story.
UPDATE: Anti-Malware.name picked up the story.
UPDATE: EnterpriseTimes picked up the story
UPDATE: Rambler News picked up the story.
It appears that Flashpoint's official Web site is currently embedded with malware-serving malicious script potentially exposing its visitors to a multi-tude of malicious software.
UPDATE: I can be reached at dancho.danchev@hush.com or at +359 87 68 93 890 in case of an emergency.
UPDATE: It appears that recently a car belonging to local police department (hxxp://troyan-police.com; police_troyan@abv.bg) was stopped somewhere around my place with the lights turned on with the idea to provoke a possible local police visit.
UPDATE: It appears that my place was visited for a second time by local police officers (hxxp://troyan-police.com; police_troyan@abv.bg) with third-party doctors (http://mbal-troyan.com; mbal_troyan@abv.bg) for the purpose of apparently injecting me and a document for the injection was signed by someone that I know.
UPDATE: It appears that someone managed to twist my arm and therefore pressed a pressure on my eye without my knowledge with random people attempting to communicate with me behind a wall.
UPDATE: It appears that prior to my presentation at InfoSec 2012 someone managed to place a plaque on the wall in Earl's Court and therefore I experienced a pressure on my head while making a presentation.
UPDATE: It appears that prior to my presentation visit in Lyon in 2010 someone managed to wound my mouth with something that can be described as wall interference.
UPDATE: It appears that someone managed to open my eye and therefore I'm currently experiencing a pressure behind a wall with random people attempting to communicate with me.
UPDATE: It appears that I'm currently persistently experiencing a pressure on my mouth including something in the lines of a toxic chemical on my nose.
UPDATE: It appears that someone managed to map my place including my head and body using rubber and is persistently trying to communicate with me.
UPDATE: In case you're interested in contacting me in terms of my law enforcement issues and potential kidnapping and harassment attempts including possible interview requests - feel free to approach me at dancho.danchev@hush.com as I'm currently busy looking for a full time cybercrime researcher security blogger and threat intelligence analyst type of position.
I would be also definitely looking forward to sharing some of my sensitive projects including related work in various other sensitive areas with the idea to end the ongoing IP (Intellectual Property) robbery courtesy of a variety of industry-leading companies and individuals. Has the time come to work hard and set them straight? It appears so. Feel free to approach me at dancho.danchev@hush.com
UPDATE: Prior, to, my, stay, at, this, particular, apartment, I, contacted, Nart Villeneuve, (n.villeneuve@secdev.ca), seeking, assistance, signaling, potential, trouble.
UPDATE: Prior, to, my, attendance, at, this, particular, apartment, I, was, invited, by, Briana Papa (Briana@crenshawcomm.com), to, visit, Prague, on, behalf, of, Avast! Software, where, I, met, with, Vince Steckler (steckler@avast.com), and, Miloslav, Korenko (korenko@avast.com), where, I, met, with, Lucian Constantin (hxxp://twitter.com/lconstantin). 
Prior, to, my, attendance, at, this, apartment, I, was, also, invited, to, another, event, held, at, INTERPOL, by, Steve Santorelli
Dear, blog, readers, I, feel, it's, about, time, I, post, an, honest, response, regarding, my, disappearance, in, 2010, with, the, purpose, of, information, my, readers, on, my, current, situation, and, to, continue, posting, and, contributing, valuable, threat, intelligence, to, the, security, community.
After, a, persistent, chase, down, and, harassment, courtesy, of, the, person, responsible, for, hiring, the, apartment, I, received, a, notice, to, leave, and, had, my, apartment, visited, by, the, person, responsible, for, hiring, including, another, man, including, another, man, that, was, supposedly, supposed, to, take, care, of, my, belongings.
Prior, to, returning, to, my, place, in, 2011, my, house, was, vandalized, by, three, police, officers (hxxp://troyan-police.com; police_troyan@abv.bg), from, the, local, police, department, who, entered, my, house, in, particular, my, bedroom, and, unpolitely, asked, my, to, dress, while, showing, me, a, copy, of, my, personal, ID, that, I, haven't, presented, and, taking, me, to, an, unknown, car, without, explaining, the, reason, for, taking, me.
A, few, hours, later, I, find, myself, located, in, an, institution (dpblovech@abv.bg), for, a, period, of, three, months, without, anyone, explaining, the, reason, for, holding, me, there.
In case you're aware of someone looking to hire full-time threat intelligence analyst cybercrime researcher or a security blogger feel free to approach me at dancho.danchev@hush.com
