Fake Chrome/Firefox/Internet Explorer/Safari Updates Expose Users to Android Malware

A currently ongoing malicious campaign using compromised sites as the primary traffic acquisition tactic, is attempting to socially engineer users (English and Russian speaking) into thinking that they're using an outdated version of their browser, and need to apply a bogus (security/antivirus) update. In reality though, the update is a variant of Trojan:Android/Fakeinst.EQ/Android.SmsSend.

Sample screenshots of the fake browser update landing pages:

Social engineering redirection chain: hxxp://france-leasebacks.com/includes/domit/1.php -> hxxp://advertcliks.net/ir/28/1405/56e9ca1335c2773445a79d5ddf75a755/ (93.115.82.239; Email: maxaxaha@gmail.com) -> hxxp://newupdateronline.org (109.163.230.182; Email: vbistrih@yandex.com).

Known to have responded to 109.163.230.182 are also the following domains:
1mc8.asia
anglecultivatep.in
appallinglyndiscoveries.in
bilious-6biros.in
boathire.pw
cvwv87.pro
dlsdcncnew1.pw
efuv77.pro
familye-perspex.in
farting-meagre.in
flvupdate.in
fringeclamberedk.in
hopefully-great8.in
investment-growsa.asia
money-tree.pw
moon-media.pw
moontree.pw
mountainlake.pw
movingv-relation.in
new-updateronline.org

Sample Android samples pushed by the campaign:
MD5: da7fffa08bdeb945ca8237c2894aedd0 - detected by 11 out of 46 antivirus scanners as Android.SmsSend.809.origin; Android.Trojan.FakeInst.HE
MD5: 1e1f57f6c8c9fb39da8965275548174f - detected by 17 out of 46 antivirus scanners as HEUR:Trojan-SMS.AndroidOS.FakeInst.fe; Andr/RuSms-AL
MD5: b0f597636859b7f5b2c1574d7a8bbbbb - detected by 13 out of 47 antivirus scanners as HEUR:Trojan-SMS.AndroidOS.FakeInst.fe; Andr/RuSms-AL
MD5: b40aebc327e1bc6aabe5ccb4f18e8ea4 - detected by 16 out of 48 antivirus scanners as Android:FakeIns-AF; Trojan:Android/Fakeinst.EQ

All samples phone back to dlsdcncnew.net (109.163.230.182; Email: constantin.zawyalov@yandex.ru). Responding to the same IP is also newapk-flv.org.

The same email is also known to have been previously used to register the following domains:
downloader8days.in
open-filedownload4.in (known to have responded to 188.95.159.30)
upweight.in
bestnewbrowsers.in
bestowedcomedyb.org (known to have responded to 109.163.230.180)
expandload.in
2012internet-load.in
4interfilefolder.in
99030.in
admitted-6crept.org
rufileserver.in

It appears that the traffic is not segmented -- to affect mobile device users only -- at any point of the redirection chain, an indication of what I believe is a boutique cybercrime-friendly operation. In comparison, the relatively more sophisticated ones would segment the traffic, usually acquired through the active exploitation of tens of thousands of legitimate Web sites, or the direct purchase of segmented mobile traffic.

Interestingly, both novice players in this market segment, and the experienced ones, are implementing basic evasive tactics, such as, for instance, the need to provide a valid mobile number, where a potential victim will receive a confirmation code for accessing the inventory of rogue games and applications, thereby preventing automatic acquisition of the apps for further analysis. Moreover, providing a valid mobile number to the cybercriminals behind the campaign, is naturally prone to be abused in ways largely based on the preferences of those who obtained them through such a way, therefore users are advised not to treat their mobile number in a privacy conscious way.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Fake Chrome/Firefox/Internet Explorer/Safari Updates Expose Users to Android Malware

A currently ongoing malicious campaign using compromised sites as the primary traffic acquisition tactic, is attempting to socially engineer users (English and Russian speaking) into thinking that they're using an outdated version of their browser, and need to apply a bogus (security/antivirus) update. In reality though, the update is a variant of Trojan:Android/Fakeinst.EQ/Android.SmsSend.

Sample screenshots of the fake browser update landing pages:

Social engineering redirection chain: hxxp://france-leasebacks.com/includes/domit/1.php -> hxxp://advertcliks.net/ir/28/1405/56e9ca1335c2773445a79d5ddf75a755/ (93.115.82.239; Email: maxaxaha@gmail.com) -> hxxp://newupdateronline.org (109.163.230.182; Email: vbistrih@yandex.com).

Known to have responded to 109.163.230.182 are also the following domains:
1mc8.asia
anglecultivatep.in
appallinglyndiscoveries.in
bilious-6biros.in
boathire.pw
cvwv87.pro
dlsdcncnew1.pw
efuv77.pro
familye-perspex.in
farting-meagre.in
flvupdate.in
fringeclamberedk.in
hopefully-great8.in
investment-growsa.asia
money-tree.pw
moon-media.pw
moontree.pw
mountainlake.pw
movingv-relation.in
new-updateronline.org

Sample Android samples pushed by the campaign:
MD5: da7fffa08bdeb945ca8237c2894aedd0 - detected by 11 out of 46 antivirus scanners as Android.SmsSend.809.origin; Android.Trojan.FakeInst.HE
MD5: 1e1f57f6c8c9fb39da8965275548174f - detected by 17 out of 46 antivirus scanners as HEUR:Trojan-SMS.AndroidOS.FakeInst.fe; Andr/RuSms-AL
MD5: b0f597636859b7f5b2c1574d7a8bbbbb - detected by 13 out of 47 antivirus scanners as HEUR:Trojan-SMS.AndroidOS.FakeInst.fe; Andr/RuSms-AL
MD5: b40aebc327e1bc6aabe5ccb4f18e8ea4 - detected by 16 out of 48 antivirus scanners as Android:FakeIns-AF; Trojan:Android/Fakeinst.EQ

All samples phone back to dlsdcncnew.net (109.163.230.182; Email: constantin.zawyalov@yandex.ru). Responding to the same IP is also newapk-flv.org.

The same email is also known to have been previously used to register the following domains:
downloader8days.in
open-filedownload4.in (known to have responded to 188.95.159.30)
upweight.in
bestnewbrowsers.in
bestowedcomedyb.org (known to have responded to 109.163.230.180)
expandload.in
2012internet-load.in
4interfilefolder.in
99030.in
admitted-6crept.org
rufileserver.in

It appears that the traffic is not segmented -- to affect mobile device users only -- at any point of the redirection chain, an indication of what I believe is a boutique cybercrime-friendly operation. In comparison, the relatively more sophisticated ones would segment the traffic, usually acquired through the active exploitation of tens of thousands of legitimate Web sites, or the direct purchase of segmented mobile traffic.

Interestingly, both novice players in this market segment, and the experienced ones, are implementing basic evasive tactics, such as, for instance, the need to provide a valid mobile number, where a potential victim will receive a confirmation code for accessing the inventory of rogue games and applications, thereby preventing automatic acquisition of the apps for further analysis.

Moreover, providing a valid mobile number to the cybercriminals behind the campaign, is naturally prone to be abused in ways largely based on the preferences of those who obtained them through such a way, therefore users are advised not to treat their mobile number in a privacy conscious way.

Updates will be posted as soon as new developments take place.

New Commercially Available Modular Malware Platform Released On the Underground Marketplace

Cybercriminals have recently released a new (v3 to be more precise indicating possible beneath the radar operation until now), commercially available, modular malware platform, including such cybercrime-friendly features like DNS Changer, Loaders, Injects, and Ransomware features -- completely blocking the Internet access of the affected user in this particular case -- with several upcoming modules such as stealth VNC, and Remote IE (a feature which would allow them to completely hijack any sort of encrypted session taking place on the affected host, naturally including the cookies).

Sample screenshots of the command and control interface+DNS Changer in action:

With prices for the standard package starting from $1,500, I expect that the malware bot will quickly gain market share thanks to its compatibility with existing/working crimeware concepts/releases, as well as thanks to the general availability of 24/7/365 managed malware crypting services, applying the necessary degree of QA (Quality Assurance) to a potential campaign before launching it. Moreover, yet another factor that would greatly contribute to the success of such type of newly released platforms is the the ease of acquisition of legitimate traffic -- think blackhat SEO, compromised FTP accounts, or mass SQL injection campaigns -- to be later on converted into malware-infected hosts, most commonly through social engineering, or the client-side exploitation of outdated and already patched vulnerabilities in browser plugins/third-party applications.

Furthermore, with or without the full scale modularity in place -- some of the modules are currently in the works, as well as the lack of built-in renting/reselling/traffic acquisition/affiliate network type of monetization elements, typical for what can be best described as platform type of underground market release compared to a standalone modular malware bot, the bot's worth keeping an eye on.

The DNS Changer IP seen in the screenshot 62.76.176.214 (62-76-176-214.clodo.ru), can also be connected to related malicious activity. For instance, MD5: cef012fb4fa7cd55f04558ecee04cd4e is known to have previously phoned back to 62.76.176.214.

And most interestingly, according to this assessment, next to phoning back to 62.76.176.214, the following malicious domains are also known to have been used as C&Cs by the same sample:
6r3u8874dfd9.com - known to have responded to 31.170.179.179
r55u87799hd39.com - known to have responded to 31.170.179.179
r95u8114dfd9.com

The following malicious MD5s are also known to have phoned back to the same C&C IP (31.170.179.179) since the beginning of the month:
MD5: 56f05611ec91f010d015536b7e9fe1a5
MD5: 49aeaa9fad5649d20a9c56e611e81d96
MD5: bf4fa138741ec4af0a0734b28142f7ae
MD5: cd92df2172a40ebb507fa701dcb14fea
MD5: 1d51cde1ab7a1d3d725e507089d3ba5e
MD5: a00695df0a50b3d3ffeb3454534d97a8
MD5: ea8340c95589ca522dac1e04839a9ab9
MD5: f2933ca59e8453a2b50f6d38a9ad9709
MD5: dd9c4ba82de8dcf0f3e440b302e223e8
MD5: d92ad37168605579319c3dff4d6e8c26
MD5: 004bf3f6b7f49d5c650642dde3255b16
MD5: deb8bcd6c7987ee4e0a95273e76feccd
MD5: 1791cb3e3da28aec11416978f415dcd3
MD5: 7eae6322c9dcaa0f12a99f2c52b70224
MD5: 0027511d25a820bcdc7565257fd61ba4
MD5: 294edcdaab9ce21cb453dc40642f1561
MD5: b414d9f54a723e8599593503fe0de4f1
MD5: 20ee0617e7dc03c571ce7d5c2ee6a0a0
MD5: e1059ae3fb9c62cf3272eb6449de23cf

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

New Commercially Available Modular Malware Platform Released On the Underground Marketplace

Cybercriminals have recently released a new (v3 to be more precise indicating possible beneath the radar operation until now), commercially available, modular malware platform, including such cybercrime-friendly features like DNS Changer, Loaders, Injects, and Ransomware features -- completely blocking the Internet access of the affected user in this particular case -- with several upcoming modules such as stealth VNC, and Remote IE (a feature which would allow them to completely hijack any sort of encrypted session taking place on the affected host, naturally including the cookies).

Sample screenshots of the command and control interface+DNS Changer in action:

With prices for the standard package starting from $1,500, I expect that the malware bot will quickly gain market share thanks to its compatibility with existing/working crimeware concepts/releases, as well as thanks to the general availability of 24/7/365 managed malware crypting services, applying the necessary degree of QA (Quality Assurance) to a potential campaign before launching it. Moreover, yet another factor that would greatly contribute to the success of such type of newly released platforms is the the ease of acquisition of legitimate traffic -- think blackhat SEO, compromised FTP accounts, or mass SQL injection campaigns -- to be later on converted into malware-infected hosts, most commonly through social engineering, or the client-side exploitation of outdated and already patched vulnerabilities in browser plugins/third-party applications.

Furthermore, with or without the full scale modularity in place -- some of the modules are currently in the works, as well as the lack of built-in renting/reselling/traffic acquisition/affiliate network type of monetization elements, typical for what can be best described as platform type of underground market release compared to a standalone modular malware bot, the bot's worth keeping an eye on.

The DNS Changer IP seen in the screenshot 62.76.176.214 (62-76-176-214.clodo.ru), can also be connected to related malicious activity. For instance, MD5: cef012fb4fa7cd55f04558ecee04cd4e is known to have previously phoned back to 62.76.176.214.

And most interestingly, according to this assessment, next to phoning back to 62.76.176.214, the following malicious domains are also known to have been used as C&Cs by the same sample:
6r3u8874dfd9.com - known to have responded to 31.170.179.179
r55u87799hd39.com - known to have responded to 31.170.179.179
r95u8114dfd9.com

The following malicious MD5s are also known to have phoned back to the same C&C IP (31.170.179.179) since the beginning of the month:
MD5: 56f05611ec91f010d015536b7e9fe1a5
MD5: 49aeaa9fad5649d20a9c56e611e81d96
MD5: bf4fa138741ec4af0a0734b28142f7ae
MD5: cd92df2172a40ebb507fa701dcb14fea
MD5: 1d51cde1ab7a1d3d725e507089d3ba5e
MD5: a00695df0a50b3d3ffeb3454534d97a8
MD5: ea8340c95589ca522dac1e04839a9ab9
MD5: f2933ca59e8453a2b50f6d38a9ad9709
MD5: dd9c4ba82de8dcf0f3e440b302e223e8
MD5: d92ad37168605579319c3dff4d6e8c26
MD5: 004bf3f6b7f49d5c650642dde3255b16
MD5: deb8bcd6c7987ee4e0a95273e76feccd
MD5: 1791cb3e3da28aec11416978f415dcd3
MD5: 7eae6322c9dcaa0f12a99f2c52b70224
MD5: 0027511d25a820bcdc7565257fd61ba4
MD5: 294edcdaab9ce21cb453dc40642f1561
MD5: b414d9f54a723e8599593503fe0de4f1
MD5: 20ee0617e7dc03c571ce7d5c2ee6a0a0
MD5: e1059ae3fb9c62cf3272eb6449de23cf

Updates will be posted as soon as new developments take place.

A Peek Inside a Customer-ized API-enabled DIY Online Lab for Generating Multi-OS Mobile Malware

The exponential growth of mobile malware over the last couple of years, can be attributed to a variety of 'growth factors', the majority of which continue playing an inseparable role in the overall success and growth of the cybercrime ecosystem in general.

Tactics like standardization, efficiency-oriented monetization, systematic bypassing of industry accepted/massively adopted security measures like signatures-based antivirus scanning, affiliate networks helping cybercriminals secure revenue streams for their malicious/fraudulent tactics, techniques and procedures (TTPs), as well as pseudo legal distribution of deceptive software -- think scaware with long EULAs and ToS-es -- as well as mobile applications -- think subscription based premium rate SMS malware with long EULAs and ToS-es -- continue dominating the arsenal of tactics that any cybercriminal aspiring the occupy a market share in any market segment within the cybercrime ecosystem, can easily take advantage of in 2013.

What has changed over the last couple of years, in terms of concepts? A lot. For instance, back in 2007, approximately one year after I (publicly) anticipated the upcoming and inevitable monetization of mobile malware, the Red Browser started making its rounds, proving that I was sadly wrong, and once again, money and greed -- or plain simple profit maximization to others -- would play a crucial role in this emerging back then, cybercrime ecosystem market segment for mobile malware. Similar monetization attempts on behalf of cybercriminals, then followed, to further strengthen the ambitions of cybercriminals into this emerging market segment.

With "malicious economies of scale" just starting to materialize at the time, it didn't take long before the concept started getting embedded into virtually each and every cybercrime-friendly product/service advertised on the market. Thanks to Symbian OS dominating the mobile operating system at the time, opportunistic cybercriminals quickly adapted to steal a piece of the pie, by releasing multiple Symbian based malware variants. Sharing is caring, therefore, here are some MD5s from the Symbian malicious code that used to dominate the threat landscape, back then.

Symbian OS malware MD5s from that period of time, for historical OSINT purposes:
MD5: a4a70d9c3dbe955dd88ea6975dd909d8
MD5: 98f7cfd42df4a01e2c4f2ed6d38c1af1
MD5: 6fd6b68ed3a83b2850fe293c6db8d78d
MD5: 38837c60e2d87991c6c754f8a6fb5c2d
MD5: ace9c6c91847b29aefa0a50d3b54bac5
MD5: 3f1828f58d676d874a3473c1cd01a431
MD5: 2163ef88da9bd31f471087a55f49d1b1
MD5: 0a04f6fed68dec7507d7bf246aa265eb
MD5: ad4a9c68f631d257bd76490029227e41
MD5: 7a4639488b4698f131e42de56ceeb45d
MD5: fa3de591d3a7353080b724a294dca394
MD5: 5ba5fad8923531784cd06a1edc6e0001
MD5: 66abbd9a965b2213f895e297f40552e5
MD5: 92b069ef1fd9a5d9c78a2d3682c16b8f
MD5: a494da11f47a853308bfdb3c0705f4e1
MD5: 9f38eff6c58667880d1ff9feb9093dcb
MD5: a8a3ac5f7639d82b24e9eb4f9ec5981c
MD5: 0ebc8e9f5ec72a0ff73a73d81dc6807d
MD5: a3cd8f8302a69e786425e51467ad5f7c
MD5: 38837c60e2d87991c6c754f8a6fb5c2d
MD5: 522a8efdc382b38e336d4735a73e6b23
MD5: 052abb9b41f07192e8a02f0746e80280
MD5: 712a1184c5fc1811192cba5cc7feda51
MD5: bdae8a51d4f12762b823e42aa6c3fa0a
MD5: aec4b95aa8d80ee9a57d11cb16ce75ba
MD5: 6b854f2171cca50f49d1ace2d454065a
MD5: 945279ce239d2370e4a65b4f109b533b
MD5: cde433d371228fb7310849c03792479e
MD5: 957265e799246225e078a6d65bde5717
MD5: cde433d371228fb7310849c03792479e
MD5: 1f1074b709736fe4504302cbc06fd0f6
MD5: 1cd241a5ea55eb25baf50af25629af27
MD5: 60d9a75b5d3320635f9e33fe76b9b836
MD5: e23f69eea5fa000f259e417b64210d42
MD5: 36503b8a9e2c39508a50eb0bdbb66370
MD5: 1f1074b709736fe4504302cbc06fd0f6
MD5: da13e08a8778fa4ea1d60e8b126e27be
MD5: 642495185b4b22d97869007fcbc0e00f
MD5: 9af5d82f330bbc03f35436b3cc2fba3a
MD5: 6099516a39abb73f9d7f99167157d957
MD5: 6c75b3e9bf4625dc1b754073a2d0c4f1
MD5: e23f69eea5fa000f259e417b64210d42
MD5: ffb37b431ed1f0ac5764b57fa8d4cced
MD5: 1cd241a5ea55eb25baf50af25629af27
MD5: b3055e852b47979a774575c09978981a
MD5: 9f38eff6c58667880d1ff9feb9093dcb
MD5: 945279ce239d2370e4a65b4f109b533b
MD5: 66a0bbebbe14939706093aa5831b53a7
MD5: 30a2797f33ecb66524e01a63e49485dd
MD5: 785e921ea686c2fc8514fac94dd8a9cd
MD5: 69a68bdcbad227d5d8d1a27dd9c30ce7
MD5: f246b101bc66fe36448d0987a36c3e0a
MD5: 4fd086a236c2f3c70b7aa869fa73f762
MD5: 642495185b4b22d97869007fcbc0e00f
MD5: fd8b784df4bbb8082a7534841aa02f0e
MD5: 3ee70d31d0a3b6fab562c51d8ff70e6d
MD5: 3381d21f476d123dcf3b5cbc27b22ae1
MD5: 006b32148ce6747fddb6d89e5725573e
MD5: 7a4639488b4698f131e42de56ceeb45d
MD5: b9667e23bd400edcafde58b61ac05f96
MD5: 12527fd41dd6b172f8e28049011ebd05
MD5: c9baecb122bb6d58f765aaca800724d2
MD5: 799531e06e6aa19d569595d32d16f7cc
MD5: e301c2135724db49f4dd5210151e8ae9
MD5: 29d7c73bd737d5bb48f272468a98d673

In 2013, we can easily differentiate between the botnet building type of two-factor authentication bypassing mobile trojans, and the ubiquitous for the market segment, subscription based premium rate SMS malware, relying on deceptive advertising and successful 'visual social engineering' campaigns. The second, continue getting largely monetized through one of the primary growth factors of the mobile market segment, namely, affiliate networks for mobile malware.

In this post, I'll profile what can be best described as a sophisticated, customer-ized, customization and efficiency oriented, API-supporting, DIY mobile "lab" for generating, managing and operating multi-mobile-operating systems type of mobile malware campaigns. The service's unique value proposition (UVP) in comparison to that of competing "labs" for managing, operating and converting mobile traffic -- acquisition and selling of mobile traffic is a commoditized underground market item in 2013 -- orbits around the feature rich interface, offering 100% customization, monitoring and generally operating the campaigns, while efficiently earning fraudulently obtained revenue from unsuspecting mobile device users.

Sample screenshots featuring the administration panel of an affiliate network participant:

Sample "system" domains used for hosting/rotating the generated mobile malware samples courtesy of the service:
jmobi.net - 91.202.63.75
omoby.net - 91.202.63.75
rrmobi.net - 91.202.63.75
moby-aa.ru - 91.202.63.75
mobyc.net - 91.202.63.75
mobi-files.com - 91.202.63.75
mobyw.net - 91.202.63.75
mobyy.net - 91.202.63.75
mobyc.net - 91.202.63.75
mobyz.net - 91.202.63.75

Known to have responsed to the same IP are also the following malicious domains:
doklameno1.ru
doklameno2.ru
downloadakpinstall.ru
mobiy.net
moby-aa.ru
moby-ae.ru
mobyc.net
mobyw.com
mobyw.net
mobyy.net
mobyz.net
omoby.net
rrmobi.net
system-update.ru
telefontown.pp.ua

Sample Web sites serving multi-mobile-operating-system premium rate mobile malware, relying on the service:

Samples generated and currently distributed in the wild using the service:
MD5: ac69514f9632539f9e8ad7b944556ed8 - detected by 15 out of 48 antivirus scanners as HEUR:Trojan-SMS.AndroidOS.Stealer.a
MD5: e62f97a095ca15747bb529ee9f1b5057 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 0688dac2754cce01183655bbbe50a0b1 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 4062a77bda6adf6094f4ab209c71b801 - detected by 2 out of 44 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 42a6cf362dbff4fd1b5aa9e82c5b7b56 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 3bcbe78a2fa8c050ee52675d9ec931ad - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 53d3d35cf896938e897de002db6ffc68 - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 2f66735b37738017385cc2fb56c21357 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 0ec11bba4a6a86eb5171ecad89d78d05 - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 9f059c973637f105271d345a95787a5f - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: f179a067580014b1e16900b90d90a872 - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: aef4f659943cbc530e4e1b601e75b19e - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 8a00786ed6939a8ece2765d503c97ff8 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 868fcf05827c092fa1939930c2f50016 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: a6ef49789845ed1a66f94fd7cc089e1b - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 22aa473772b2dfb0f019dac3b8749bb6 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 52b74046d0c123772566d591524b3bf7 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: bbff61a2e3555a6675bc77621be19a73 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX

Cybercrime-friendly affiliate networks continue, and will continue to represent a major driving factor behind the growth of any market segment within the cybercrime system, as they result in a win-win-lose scenario for their operations, participants and the potential victims of the fraudulent/malicious propositions/releases courtesy of these networks. With mobile traffic acquisition available on demand based on any given preference a potential could have, cybercriminals would continue converting it into victims, cashing in on their overall lack of awareness of the TTPs of today's modern cybercriminals.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

A Peek Inside a Customer-ized API-enabled DIY Online Lab for Generating Multi-OS Mobile Malware

The exponential growth of mobile malware over the last couple of years, can be attributed to a variety of 'growth factors', the majority of which continue playing an inseparable role in the overall success and growth of the cybercrime ecosystem in general.

Tactics like standardization, efficiency-oriented monetization, systematic bypassing of industry accepted/massively adopted security measures like signatures-based antivirus scanning, affiliate networks helping cybercriminals secure revenue streams for their malicious/fraudulent tactics, techniques and procedures (TTPs), as well as pseudo legal distribution of deceptive software -- think scaware with long EULAs and ToS-es -- as well as mobile applications -- think subscription based premium rate SMS malware with long EULAs and ToS-es -- continue dominating the arsenal of tactics that any cybercriminal aspiring the occupy a market share in any market segment within the cybercrime ecosystem, can easily take advantage of in 2013.

What has changed over the last couple of years, in terms of concepts? A lot. For instance, back in 2007, approximately one year after I (publicly) anticipated the upcoming and inevitable monetization of mobile malware, the Red Browser started making its rounds, proving that I was sadly wrong, and once again, money and greed -- or plain simple profit maximization to others -- would play a crucial role in this emerging back then, cybercrime ecosystem market segment for mobile malware. Similar monetization attempts on behalf of cybercriminals, then followed, to further strengthen the ambitions of cybercriminals into this emerging market segment.

With "malicious economies of scale" just starting to materialize at the time, it didn't take long before the concept started getting embedded into virtually each and every cybercrime-friendly product/service advertised on the market. Thanks to Symbian OS dominating the mobile operating system at the time, opportunistic cybercriminals quickly adapted to steal a piece of the pie, by releasing multiple Symbian based malware variants. Sharing is caring, therefore, here are some MD5s from the Symbian malicious code that used to dominate the threat landscape, back then.

Symbian OS malware MD5s from that period of time, for historical OSINT purposes:
MD5: a4a70d9c3dbe955dd88ea6975dd909d8
MD5: 98f7cfd42df4a01e2c4f2ed6d38c1af1
MD5: 6fd6b68ed3a83b2850fe293c6db8d78d
MD5: 38837c60e2d87991c6c754f8a6fb5c2d
MD5: ace9c6c91847b29aefa0a50d3b54bac5
MD5: 3f1828f58d676d874a3473c1cd01a431
MD5: 2163ef88da9bd31f471087a55f49d1b1
MD5: 0a04f6fed68dec7507d7bf246aa265eb
MD5: ad4a9c68f631d257bd76490029227e41
MD5: 7a4639488b4698f131e42de56ceeb45d
MD5: fa3de591d3a7353080b724a294dca394
MD5: 5ba5fad8923531784cd06a1edc6e0001
MD5: 66abbd9a965b2213f895e297f40552e5
MD5: 92b069ef1fd9a5d9c78a2d3682c16b8f
MD5: a494da11f47a853308bfdb3c0705f4e1
MD5: 9f38eff6c58667880d1ff9feb9093dcb
MD5: a8a3ac5f7639d82b24e9eb4f9ec5981c
MD5: 0ebc8e9f5ec72a0ff73a73d81dc6807d
MD5: a3cd8f8302a69e786425e51467ad5f7c
MD5: 38837c60e2d87991c6c754f8a6fb5c2d
MD5: 522a8efdc382b38e336d4735a73e6b23
MD5: 052abb9b41f07192e8a02f0746e80280
MD5: 712a1184c5fc1811192cba5cc7feda51
MD5: bdae8a51d4f12762b823e42aa6c3fa0a
MD5: aec4b95aa8d80ee9a57d11cb16ce75ba
MD5: 6b854f2171cca50f49d1ace2d454065a
MD5: 945279ce239d2370e4a65b4f109b533b
MD5: cde433d371228fb7310849c03792479e
MD5: 957265e799246225e078a6d65bde5717
MD5: cde433d371228fb7310849c03792479e
MD5: 1f1074b709736fe4504302cbc06fd0f6
MD5: 1cd241a5ea55eb25baf50af25629af27
MD5: 60d9a75b5d3320635f9e33fe76b9b836
MD5: e23f69eea5fa000f259e417b64210d42
MD5: 36503b8a9e2c39508a50eb0bdbb66370
MD5: 1f1074b709736fe4504302cbc06fd0f6
MD5: da13e08a8778fa4ea1d60e8b126e27be
MD5: 642495185b4b22d97869007fcbc0e00f
MD5: 9af5d82f330bbc03f35436b3cc2fba3a
MD5: 6099516a39abb73f9d7f99167157d957
MD5: 6c75b3e9bf4625dc1b754073a2d0c4f1
MD5: e23f69eea5fa000f259e417b64210d42
MD5: ffb37b431ed1f0ac5764b57fa8d4cced
MD5: 1cd241a5ea55eb25baf50af25629af27
MD5: b3055e852b47979a774575c09978981a
MD5: 9f38eff6c58667880d1ff9feb9093dcb
MD5: 945279ce239d2370e4a65b4f109b533b
MD5: 66a0bbebbe14939706093aa5831b53a7
MD5: 30a2797f33ecb66524e01a63e49485dd
MD5: 785e921ea686c2fc8514fac94dd8a9cd
MD5: 69a68bdcbad227d5d8d1a27dd9c30ce7
MD5: f246b101bc66fe36448d0987a36c3e0a
MD5: 4fd086a236c2f3c70b7aa869fa73f762
MD5: 642495185b4b22d97869007fcbc0e00f
MD5: fd8b784df4bbb8082a7534841aa02f0e
MD5: 3ee70d31d0a3b6fab562c51d8ff70e6d
MD5: 3381d21f476d123dcf3b5cbc27b22ae1
MD5: 006b32148ce6747fddb6d89e5725573e
MD5: 7a4639488b4698f131e42de56ceeb45d
MD5: b9667e23bd400edcafde58b61ac05f96
MD5: 12527fd41dd6b172f8e28049011ebd05
MD5: c9baecb122bb6d58f765aaca800724d2
MD5: 799531e06e6aa19d569595d32d16f7cc
MD5: e301c2135724db49f4dd5210151e8ae9
MD5: 29d7c73bd737d5bb48f272468a98d673

In 2013, we can easily differentiate between the botnet building type of two-factor authentication bypassing mobile trojans, and the ubiquitous for the market segment, subscription based premium rate SMS malware, relying on deceptive advertising and successful 'visual social engineering' campaigns. The second, continue getting largely monetized through one of the primary growth factors of the mobile market segment, namely, affiliate networks for mobile malware.

In this post, I'll profile what can be best described as a sophisticated, customer-ized, customization and efficiency oriented, API-supporting, DIY mobile "lab" for generating, managing and operating multi-mobile-operating systems type of mobile malware campaigns. The service's unique value proposition (UVP) in comparison to that of competing "labs" for managing, operating and converting mobile traffic -- acquisition and selling of mobile traffic is a commoditized underground market item in 2013 -- orbits around the feature rich interface, offering 100% customization, monitoring and generally operating the campaigns, while efficiently earning fraudulently obtained revenue from unsuspecting mobile device users.

Sample screenshots featuring the administration panel of an affiliate network participant:

Sample "system" domains used for hosting/rotating the generated mobile malware samples courtesy of the service:
jmobi.net - 91.202.63.75
omoby.net - 91.202.63.75
rrmobi.net - 91.202.63.75
moby-aa.ru - 91.202.63.75
mobyc.net - 91.202.63.75
mobi-files.com - 91.202.63.75
mobyw.net - 91.202.63.75
mobyy.net - 91.202.63.75
mobyc.net - 91.202.63.75
mobyz.net - 91.202.63.75

Known to have responsed to the same IP are also the following malicious domains:
doklameno1.ru
doklameno2.ru
downloadakpinstall.ru
mobiy.net
moby-aa.ru
moby-ae.ru
mobyc.net
mobyw.com
mobyw.net
mobyy.net
mobyz.net
omoby.net
rrmobi.net
system-update.ru
telefontown.pp.ua

Sample Web sites serving multi-mobile-operating-system premium rate mobile malware, relying on the service:

Samples generated and currently distributed in the wild using the service:
MD5: ac69514f9632539f9e8ad7b944556ed8 - detected by 15 out of 48 antivirus scanners as HEUR:Trojan-SMS.AndroidOS.Stealer.a
MD5: e62f97a095ca15747bb529ee9f1b5057 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 0688dac2754cce01183655bbbe50a0b1 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 4062a77bda6adf6094f4ab209c71b801 - detected by 2 out of 44 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 42a6cf362dbff4fd1b5aa9e82c5b7b56 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 3bcbe78a2fa8c050ee52675d9ec931ad - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 53d3d35cf896938e897de002db6ffc68 - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 2f66735b37738017385cc2fb56c21357 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 0ec11bba4a6a86eb5171ecad89d78d05 - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 9f059c973637f105271d345a95787a5f - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: f179a067580014b1e16900b90d90a872 - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: aef4f659943cbc530e4e1b601e75b19e - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 8a00786ed6939a8ece2765d503c97ff8 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 868fcf05827c092fa1939930c2f50016 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: a6ef49789845ed1a66f94fd7cc089e1b - detected by 2 out of 47 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 22aa473772b2dfb0f019dac3b8749bb6 - detected by 2 out of 45 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: 52b74046d0c123772566d591524b3bf7 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX
MD5: bbff61a2e3555a6675bc77621be19a73 - detected by 2 out of 46 antivirus scanners as Java.SMSSend.780; J2ME/TrojanSMS.Agent.DX

Cybercrime-friendly affiliate networks continue, and will continue to represent a major driving factor behind the growth of any market segment within the cybercrime system, as they result in a win-win-lose scenario for their operations, participants and the potential victims of the fraudulent/malicious propositions/releases courtesy of these networks.

With mobile traffic acquisition available on demand based on any given preference a potential could have, cybercriminals would continue converting it into victims, cashing in on their overall lack of awareness of the TTPs of today's modern cybercriminals.

Updates will be posted as soon as new developments take place.

Money Mule Recruiters Trick Mules Into Installing Fake Transaction Certificates

What is more flattering than Ukrainian blackhat SEO gangs using name as redirectors, including offensive messages, the Koobface gang redirecting Facebook's IP space to your blog, or a plain simple danchodanchev admin panel within a Crime Pack kit?

It's the money mule recruiters who modify the HOSTS file of gullible mules to redirect ddanchev.blogspot.com and bobbear.co.uk to 127.0.0.1. Now that's flattering, considering the fact that my public money mule ecosystem related research represents a tiny percentage of the real profiling/activities taking place behind the curtains.







a

Related coverage of money laundering/recruitment in the context of cybercrime:
Keeping Money Mule Recruiters on a Short Leash - Part Four
Money Mule Recruitment Campaign Serving Client-Side Exploits
Keeping Money Mule Recruiters on a Short Leash - Part Three
Money Mule Recruiters on Yahoo!'s Web Hosting
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Scareware, Blackhat SEO, Spam and Google Groups Abuse, Courtesy of the Koobface Gang

The Koobface gang is known to have embraced the potential of the "underground multi-tasking" model a long time ago, in order to achieve the "malicious economies of scale" effect. This "underground multi-tasking" most commonly comes in the form of multiple monetization campaigns, which upon closer analysis always lead back to the Koobface gang's infrastructure. In fact, the gang is so obsessed with efficiency, that particular redirectors and key malicious domains for a particular campaign, are also, simultaneously rotated across all the campaigns that they manage.

For instance, throughout the past half an year, a huge percentage of the malicious infrastructure used simultaneously in multiple campaigns, was parked on the now shut down Riccom LTD - AS29550. From the massive blackhat SEO campaigns affecting millions of legitimate web sites managed by the gang,  to the malvertising attack at the New York Times web site, and the click-fraud facilitating Bahama botnet, the Koobface botnet is only the tip of the iceberg for the efficient and fraudulent money machine that the gang operates.

In this analysis, I'll once again establish a connection between the ongoing blackhat SEO campaigns managed by the gang (Blackhat SEO Campaign Hijacks U.S Federal Form Keywords, Serves Scareware; U.S Federal Forms Blackhat SEO Themed Scareware Campaign Expanding; Dissecting the Ongoing U.S Federal Forms Themed Blackhat SEO Campaign), with a spam campaign that's also syndicated across multiple Google Groups, and the Koobface botnet itself, with a particular emphasis on the scareware monetization taking place across all the campaigns.





Related Koobface research and analysis:
The Koobface Gang Wishes the Industry "Happy Holidays"
Koobface-Friendly Riccom LTD - AS29550 - (Finally) Taken Offline
Koobface Botnet Starts Serving Client-Side Exploits
Massive Scareware Serving Blackhat SEO, the Koobface Gang Style
Koobface Botnet's Scareware Business Model - Part Two
Koobface Botnet's Scareware Business Model - Part One
Koobface Botnet Redirects Facebook's IP Space to my Blog
New Koobface campaign spoofs Adobe's Flash updater
Social engineering tactics of the Koobface botnet
Koobface Botnet Dissected in a TrendMicro Report
Movement on the Koobface Front - Part Two
Movement on the Koobface Front
Koobface - Come Out, Come Out, Wherever You Are
Dissecting Koobface Worm's Twitter Campaign

This post has been reproduced from Dancho Danchev's blog.

Facebook FarmTown Malvertising Campaign Courtesy of the Koobface Gang

Earlier this week, another malvertising campaign affected a popular community, in the face of Facebook's FarmTown.

You have to analyze,  and cross-check it to believe it.

Key summary points:

• the email test@now.net.cn used to register all the domains involved in the malvertising campaign, is exclusively used by the Koobface gang for numerous scareware registrations seen -

a

Malicious Script Artifacts at China Green Dot Gov Dot Cn - A Reminiscence of Asprox's Multi-Tasking Activities

Malware artifacts, abandoned mass iframe embedded/injected campaigns, and low Quality Assurance (QA) campaigns, continue popping up on everyone's radar, raising eyebrows as to the extend of incompetence, possible evasive tactics, plain simple lack of applied QA when maintaining these campaigns, or the end of a campaign's life cycle.

What's the value of assessing such a non-active campaign? Can the analysis provide any clues into related currently active malicious campaigns that typically for such type of campaigns, continue relying on the same malicious infrastructure? But of course.

Let's assess the malicious artifacts at hxxp://chinagreen.gov.cn, connect them to the multi-tasking activities conducted on behalf of the Asprox botnet, as well as several spamvertised malware campaigns circa 2010, and most importantly provide actionable intelligence on currently active campaigns that continue using the very same infrastructure for command and control purposes.

Malicious scripts at China Green Dot Gov Dot CN:
update.webserviceftp.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
gdi.webserviceftp.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
ver.webserivcekota.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
batch.webserviceaan.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
nemohuildiin.ru/tds/go.php?sid=1 - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
parkperson.ru:8080/index.php?pid=13 - seen in "Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware/Exploits Serving Campaign"
nutcountry.ru:8080/index.php?pid=13 - seen in "Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware/Exploits Serving Campaign"

What's so special about the spamvertised XeroxWorkCentre Pro campaign is that, back in 2010, it used to drop an Asprox sample, naturally phoning back to well known Asprox C&Cs at the time.

nemohuildiin.ru is known to have responded to 31.31.204.61 and most recently to 5.63.152.19

Known to have responded to the same IP (31.31.204.61) are also the following malicious domains:
000sstd.com
02143.ru
03111991.ru
0414.ru
0424.ru
050175.ru
054ru.ru
06140.ru
0664346910.ru
0801.ru
08108.ru
087474.ru
08755.ru
0925.ru
0go.ru
1-androds.ru
10000taxi.ru
1001domains.ru
100yss.ru
124k.ru

Moreover, we also got a decent number of malicious MD5s known to have used the same IP as C&C ove the last couple of months, indicating that the artifact is still part of the C&C infrastructure of active campaigns.

The following malicious MD5s are also known to have phoned back to the same IP over the last couple of months:
MD5: 3e3d249c43950ac8bedb937f1ea347f5
MD5: 398b5f0c4b8f9adb1db8420801b52562
MD5: 9a1602a2693ae510339ef5f0d25be0b3
MD5: 9bc423773de47d95de1718173ec8485f
MD5: 637db36286b3e300c37e99a0b4772548
MD5: 9829c64613909fbb13fc402f23baff1b
MD5: f23562bafd94f7b836633f1fb7f9e18f
MD5: 7d263c93829447b2399c2e981d66c9df
MD5: 6ee37ead84906711cb2eed6d7f2fcc88
MD5: 54eb099176e7d65817d1b9789845ee4e
MD5: 723618efbd0d3627da09a770e5fd28c2
MD5: 151030c819209af9b7b2ecf2f5c31aa0
MD5: 279d390b9116f0f8ac80321e5fa43453
MD5: f78ff547ce388a403f5ba979025cd556
MD5: afa7090479ac49a3547931fe249c52e3
MD5: a2565684ae4c0af5a99214da83664927
MD5: ce4f032a3e478f4d4cac959b2e999b5a

Known to have responded to 5.63.152.19 are also the following malicious domains:
6tn.ru
azosi.ru
bi-news.ru
buygroup.ru
dnpsirius.ru
enterplus.ru
nemohuildiin.ru
nfs-worlds.ru
rassylka-na-doski.ru
santehnikaoptom.ru
v-odnoklassniki.ru

In a cybercrime ecosystem dominated by leaked DIY mass Web site hacking tools, and sophisticated iframe-ing platforms, malicious artifacts are a great reminder that as long as the Web site remains susceptible to remote exploitation, it's only a matter of time before a potential cybercriminal embeds/injects malicious script on it. That's cybercrime-friendly common sense.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Malicious Script Artifacts at China Green Dot Gov Dot Cn - A Reminiscence of Asprox's Multi-Tasking Activities

Malware artifacts, abandoned mass iframe embedded/injected campaigns, and low Quality Assurance (QA) campaigns, continue popping up on everyone's radar, raising eyebrows as to the extend of incompetence, possible evasive tactics, plain simple lack of applied QA when maintaining these campaigns, or the end of a campaign's life cycle.

What's the value of assessing such a non-active campaign? Can the analysis provide any clues into related currently active malicious campaigns that typically for such type of campaigns, continue relying on the same malicious infrastructure? But of course.

Let's assess the malicious artifacts at hxxp://chinagreen.gov.cn, connect them to the multi-tasking activities conducted on behalf of the Asprox botnet, as well as several spamvertised malware campaigns circa 2010, and most importantly provide actionable intelligence on currently active campaigns that continue using the very same infrastructure for command and control purposes.

Malicious scripts at China Green Dot Gov Dot CN:
update.webserviceftp.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
gdi.webserviceftp.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
ver.webserivcekota.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
batch.webserviceaan.ru/js.js - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
nemohuildiin.ru/tds/go.php?sid=1 - seen in "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign"
parkperson.ru:8080/index.php?pid=13 - seen in "Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware/Exploits Serving Campaign"
nutcountry.ru:8080/index.php?pid=13 - seen in "Spamvertised Best Buy, Macy's, Evite and Target Themed Scareware/Exploits Serving Campaign"

What's so special about the spamvertised XeroxWorkCentre Pro campaign is that, back in 2010, it used to drop an Asprox sample, naturally phoning back to well known Asprox C&Cs at the time.

nemohuildiin.ru is known to have responded to 31.31.204.61 and most recently to 5.63.152.19

Known to have responded to the same IP (31.31.204.61) are also the following malicious domains:
000sstd.com
02143.ru
03111991.ru
0414.ru
0424.ru
050175.ru
054ru.ru
06140.ru
0664346910.ru
0801.ru
08108.ru
087474.ru
08755.ru
0925.ru
0go.ru
1-androds.ru
10000taxi.ru
1001domains.ru
100yss.ru
124k.ru

Moreover, we also got a decent number of malicious MD5s known to have used the same IP as C&C ove the last couple of months, indicating that the artifact is still part of the C&C infrastructure of active campaigns.

The following malicious MD5s are also known to have phoned back to the same IP over the last couple of months:
MD5: 3e3d249c43950ac8bedb937f1ea347f5
MD5: 398b5f0c4b8f9adb1db8420801b52562
MD5: 9a1602a2693ae510339ef5f0d25be0b3
MD5: 9bc423773de47d95de1718173ec8485f
MD5: 637db36286b3e300c37e99a0b4772548
MD5: 9829c64613909fbb13fc402f23baff1b
MD5: f23562bafd94f7b836633f1fb7f9e18f
MD5: 7d263c93829447b2399c2e981d66c9df
MD5: 6ee37ead84906711cb2eed6d7f2fcc88
MD5: 54eb099176e7d65817d1b9789845ee4e
MD5: 723618efbd0d3627da09a770e5fd28c2
MD5: 151030c819209af9b7b2ecf2f5c31aa0
MD5: 279d390b9116f0f8ac80321e5fa43453
MD5: f78ff547ce388a403f5ba979025cd556
MD5: afa7090479ac49a3547931fe249c52e3
MD5: a2565684ae4c0af5a99214da83664927
MD5: ce4f032a3e478f4d4cac959b2e999b5a

Known to have responded to 5.63.152.19 are also the following malicious domains:
6tn.ru
azosi.ru
bi-news.ru
buygroup.ru
dnpsirius.ru
enterplus.ru
nemohuildiin.ru
nfs-worlds.ru
rassylka-na-doski.ru
santehnikaoptom.ru
v-odnoklassniki.ru

In a cybercrime ecosystem dominated by leaked DIY mass Web site hacking tools, and sophisticated iframe-ing platforms, malicious artifacts are a great reminder that as long as the Web site remains susceptible to remote exploitation, it's only a matter of time before a potential cybercriminal embeds/injects malicious script on it. That's cybercrime-friendly common sense.

Updates will be posted as soon as new developments take place.