Don't Play Poker on an Infected Table - Part Four

A currently spamvertised campaign is enticing users into downloading and executing a fraudulent online gambling application known as VegasVIP_setup.exe.

Detection rate:
VegasVIP_setup.exe - Win32/CazinoSilver - Result:16/42 (38.1%)
MD5   : 8680fa2868dd068f3c1d3995df105243
SHA1  : 4f3ecd72c223cf6e130377a3ecd9149232dc848b
SHA256: 68ded50bf7c9b7f6961e6334b25fdad5d2369e461051d5a9fa1f1ebaadeb1d0e

Upon execution, the sample phones back to:
www.onlinevegas.com/download/update.php?dl=0af374526b7b6eb6c54bf92cb1d1a236&status=10

The spammers are earning revenue by participating in the BestCasinoPartner.com Affiliate Program. More details:
"Turn Your Traffic Into BIG Monthly Cash! Join the BestCasinoPartner.com Affiliate Program and from the very start you will earn a HUGE 30% of ALL player GROSS losses EVERY month, no matter what your volume is! That’s ALL player GROSS losses for the life of your referred players, with No Loss Carry-Forward!

Refer an Affiliate: Get Even More. Earn 7% override on the Casino Gross Revenue payment made to the referred Affiliate for all players referred by your directly referred Affiliates - for the life of the player! Earn 5% override on the Casino Gross Revenue payment made from your Web masters’ referrals! AND…we even go One Step Further — a THIRD tier!

Here are the THREE levels that will earn you profits for the life EACH player:

• Tier 1: 7% override on the Casino Gross Revenue

• Tier 2: 5% override on the Casino Gross Revenue

•  Tier 3: 3% override on the Casino Gross Revenue"

Participating affiliate domains are: OnlineVegas.com; GoCasino.com; CrazySlots.com and GrandVegas.com

Related fraudulent online gambling domains part of the campaign:
777fashionplays.ru
777playsfashion.ru
bankpremiumplays.ru
bank-premium-plays.ru
bestfortuneplays.ru
best-fortune-plays.ru
bestplaysfortune.ru
best-plays-fortune.ru
bingobonusplays.ru
bonus-bingo-plays.ru
bonusplaysbingo.ru
bonus-plays-bingo.ru
class-plays-world.ru
class-world-plays.ru
crazyplaysroulette.ru
crazy-plays-roulette.ru
crazyrouletteplays.ru
crazy-roulette-plays.ru
elit-grand-games.ru
elit-plays-king.ru
fashion-plays-vegas.ru
fashion-vegas-plays.ru
fiveplaysstar.ru
fortunebestplays.ru
fortune-best-plays.ru
fortuneplaysbest.ru
fortune-plays-best.ru
fortune-plays-land.ru
fortuneplaysparty.ru
fortune-plays-party.ru
games-elit-king.ru
games-king-elit.ru
gamespremiumbank.ru
jokerplaysvegas.ru
online-games-luxory.ru
palaceplayscrystal.ru
playsbankpremium.ru
plays-bank-premium.ru
playsbestfortune.ru
plays-best-fortune.ru
plays-bingo-bonus.ru
playsbonusbingo.ru
plays-bonus-bingo.ru
playsclassworld.ru
playscrazyroulette.ru
plays-crazy-roulette.ru
playscrystalpalace.ru
plays-crystal-palace.ru
playsfashion777.ru
playsfivestar.ru
playsfortunebest.ru
plays-fortune-party.ru
playsonlineextra.ru
plays-plaza-west.ru
playspremiumbank.ru
playsroulettecrazy.ru
plays-roulette-crazy.ru
plays-royal-classic.ru
plays-star-five.ru
playsvegasjoker.ru
playswestplaza.ru
plays-world-win.ru
plaza-plays-west.ru
plazawestplays.ru
plaza-west-plays.ru
premium-bank-plays.ru
premiumplaysbank.ru
roulette-crazy-plays.ru
starfiveplays.ru
star-five-plays.ru
starplaysfive.ru
vegas-fashion-plays.ru
vegasjokergames.ru
vegasjokerplays.ru
vegas-joker-plays.ru
vegas-plays-joker.ru
westplaysplaza.ru
west-plays-plaza.ru
westplazaplays.ru
west-plaza-plays.ru
win-plays-world.ru
winworldplays.ru
win-world-plays.ru
world-class-plays.ru
world-plays-class.ru

Related posts:
Don't Play Poker on an Infected Table - Part Three
Don't Play Poker on an Infected Table - Part Two
Don't Play Poker on an Infected Table

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.