Pushdo Injecting Bogus Swine Flu Vaccine

In the spirit of systematically introducing new themes in order to serve the ubiquitous crimeware releases, the Pushdo botnet has now switched to a State Vaccination H1N1 Program campaign, serving vacc_profile.exe sample.

Sample subject: State Vaccination Program; Governmental registration program on the H1N1 vaccination
Sample message: "You have received this e-mail because of the launching of State Vaccination H1N1 Program. You need to create your personal H1N1 (swine flu) Vaccination Profile on the cdc.gov website. The Vaccination is not obligatory, but every person that has reached the age of 18 has to have his personal Vaccination Profile on the cdc.gov site. This profile has to be created both for the vaccinated people and the not-vaccinated ones. This profile is used for the registering system of vaccinated and not-vaccinated people. Create your Personal H1N1 Vaccination Profile using the link."

Subdomain structure used:

online.cdc.gov .lykasf.be
online.cdc.gov .lykasm.be
online.cdc.gov .lykasv.be
online.cdc.gov .lykasz.be
online.cdc.gov .nyugewc.be
online.cdc.gov .nyugewd.be
online.cdc.gov .nyugewm.be
online.cdc.gov .nyugewn.be
online.cdc.gov .nyugewq.be
online.cdc.gov .nyugewt.be
online.cdc.gov .nyugeww.be
online.cdc.gov .nyugewy.be
online.cdc.gov .nyugewz.be
online.cdc.gov .yhnbad.co.im
online.cdc.gov .yhnbad.com.im
online.cdc.gov .yhnbad.im
online.cdc.gov .yhnbad.net.im
online.cdc.gov .yhnbad.org.im
online.cdc.gov .yhnbak.co.im
online.cdc.gov .yhnbak.com.im
online.cdc.gov .yhnbak.im
online.cdc.gov .yhnbak.net.im
online.cdc.gov .yhnbak.org.im
online.cdc.gov .yhnbam.co.im
online.cdc.gov .yhnbam.com.im
online.cdc.gov .yhnbam.im
online.cdc.gov .yhnbam.net.im
online.cdc.gov .yhnbam.org.im

Actual domains involved:

feccxz.co .uk; feccxz.me .uk; ficcxz.co .uk; gerfase .be; gerfasi .be; gerfaso .be; gerfasq .be; gerfasr .be; gerfast .be; gerfasu .be; gerfasw .be; gerfasx .be; gerfasy  .be; hssaze .be; hssazg .be; hssazh .be; hssazi  .be; hssaz j.be; hssazl .be; hssazo .be; hssazp .be; hssazq .be; hssazr .be; hssazt .be; hssazu .be; hssazw .be; hssazy .be; kioooj1 .be; kioooj2 .be; kioooj3 .be; kioooja .be; kiooojb .be; kiooojc .be; kiooojf .be; kiooojg .be; kiooojh .be; kiooojn .be; kiooojq .be; kiooojv .be; kiooojx .be; kiooojz .be; yhnbad.co .im; yhnbad.com .im; yhnbad .im; yhnbad.net .im; yhnbad.org .im; yhnbak.co .im; yhnbak .com.im; yhnbak .im; yhnbak.net .im; yhnbak.org .im; yhnbam.co .im; yhnbam.com .im; yhnbam .im; yhnbam.net .im; yhnbam.org .im; yurbzc.co .im; yurbzc.com .im; yurbzc .im; yurbzc.net .im; yurbzc.org .im; yurtzc .im; yuvtzc.co .im; yuvtzc.com .im; yuvtzc .im; yuvtzc.net .im

DNS SERVERS OF NOTICE:
ns1.elkins-realty .org - Email: HR2000@gmail.com
ns1.a-personalhire .com - Email: personalhire@mail.com
ns1.iceagestrem .com
ns1.poolandmonster .com
ns1.autotanscorp .net
ns1.shuzmen .com

Upon execution, the sample phones back to 193.104.41.75/kissme /rec.php and 193.104.41.75 /ip.php, while attempting to download promed-net .com/css/absderce2.exe and 193.104.41.75/ cbd/75.bro, with the IP itself already blacklisted by the Zeus Tracker, as well as related activity on the same netblock - AS49934 (VVPN-AS PE Voronov Evgen Sergiyovich).

Related posts:
"Your mailbox has been deactivated" Spam Campaign Serving Crimeware
Ongoing FDIC Spam Campaign Serves Zeus Crimeware
The Multitasking Fast-Flux Botnet that Wants to Bank With You

This post has been reproduced from Dancho Danchev's blog.