
Within the first five minutes, thirty three (33) phishing emails attempted to be delivered out of a sample infected host, all of them targeting NatWest or The National Westminster Bank Plc. Here are some samples, that of course never made it out to their recipient :
- Sender Address: "NatWest Internet Banking '2008" to Recipient: <@fs1.ge.man.ac.uk>Subject: Natwest Bank Bankline: Confirm Your Login Email Content: //ver2.natwest-commercial3.com/customerupdate?tag=3D19ecygtKZDzrozrznhOzn These directives are to be sent and followed by all members of the NatWest Private and Corporate Natwest does apologize for any problems caused, and is very thankful for your cooperation. If you are not client of Natwest OnLine Banking please ignore this notice! *** This is robot generated message please do not reply *** (C) 2008 Natwest Bankline. All Rights Reserved. Attached File: "ods096.gif" (image/gif)

- Sender Address: "Natwest Bank Internet Banking Support"
- Sender Address: "Natwest Private and Corporate Support"

What is making an impression besides the malicious economies of scale achieved on behalf of the malware infected hosts used for sending, and as we've already seen, hosting and phishing pages and the malware itslef? It's the campaing's targeted nature in respect to the segmented emails database used for achieving a better response rate. The National Westminster Bank Plcis a U.K bank, and 10 out of 15 email recepient are of U.K citizens, the rest are targeting Italian users. Malware variants signal their presence to 66.199.241.98/forum.php and try to obtain campaigns to participate in, this is a sample detection rate for the latest fake news items one, and more details on the domains and nameservers used in the latest campaign :
news_report-pdf_content.exe
Scanners result : 14/31 (45.17%)Backdoor.Win32.Agent.gvk; Backdoor:Win32/Agent.ACG
File size: 45056 bytesMD5...: c4849207a94d1db4a0211f88e84b0b59
SHA1..: 32ef2a074d563370f46738565ecf9bb53c75909cSHA256: 12a124cc2352f3ef68ddf06e0ed111c617d95cffd807dc502ae474960a60411c
ns1.ns4.ns2.ns3.id759.com
ns3.ns1.id759.com
ns1.ns2.ns1.ns4.ns2.ns3.id759.comns1.ns2.ns3.id759.com
ns1.ns2.ns4.id759.comns1.ns4.ns4.ns2.ns3.id759.com
ns2.id759.comns2.ns1.ns2.ns3.id759.com
ns2.ns1.ns2.ns4.id759.comns3.ns2.ns1.ns2.ns3.id759.com
ns4.ns1.ns1.ns2.ns3.id759.comYet another internal nameservers ecosystem within the botnet :
ns2.serial43.in
ns3.serial43.in
ns4.serial43.inns1.ns1.ns1.serial43.in
ns1.ns2.ns1.ns1.serial43.inns1.ns2.ns2.serial43.in
ns1.ns4.ns1.ns1.serial43.inns2.ns1.ns2.serial43.in
ns2.ns1.ns4.ns1.ns1.serial43.inns2.ns2.ns1.ns1.serial43.in
server52.org
set45.netsite83.net
sid95.comshell54.com
siteid64.comsetup36.com
share73.comservice28.biz
No comments:
Post a Comment