Cybercriminals continue actively spreading malicious software while looking for alternative ways to acquire and monetize legitimate traffic successfully earning fraudulent revenue in the process of spreading malicious software.
We've recently came across to a Google Sponsored scareware campaign successfully enticing users into installing fake security software on their hosts further earning fraudulent revenue in the process of monetizing access to malware-infected hosts largely relying on the utilization of an affiliate-network based type of revenue sharing scheme.
In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure, behind it and discuss in-depth, the tactics techniques and procedures of the cybercriminals behind it.
hxxp://www.google.com/aclk?sa=l&ai=Czd4NEnlLS-pWlrS1A-jBmIwO9pfjnQHOjKCvEI2B8woQAigIUPjA4pz8_____wFgyZajiqSkxBGgAabhse4DyAEBqgQhT9
CjnzChYHf5zQB4c8FB-fW9WUzgcUTQ4c7ciD4Gyxs0&num=5&sig=AGiWqty0Uq3Kr6U1Sb10olrq6C22JfNR_w&q=http://www.adwarepronow.com
hxxp://www.google.com/aclk?sa=L&ai=COLk5EnlLS-pWlrS1A-jBmIwO0YGZmwGz9aqwDbiw8bcBEAUoCFCnyNGE______8BYMmWo4qkpMQRyAEBqgQZT9
CTvAGhbX_5PQN_7QaAIk7HT3dQfrqLJQ&num=8amp;sig=AGiWqtyHmo4mgVkszSWtDUcT4dMRUAQnXg&q=http://www.antimalware-2010.com
Known malicious domains known to have participated in the campaign:
hxxp://www.adwarepronow.com/?gclid=CJ6d8LSGnZ8CFRMqagodmR_KaA - 209.216.193.112
Known malicious domains known to have participated in the campaign:
hxxp://www.antimalware-2010.com/ - 209.216.193.119
Sample detection rate for a sample malware:
MD5: 8328da91c8eba6668b3e72d547157ac7
Sample detection rate for a sample malware:
MD5: b74412ea403241c9c60482fd13540505
Once, executed, a, sample, malware, phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://72.167.164.199/definitions/configuration.txt
hxxp://72.167.164.199/latestversion/AntiMalwarePro_appversion.txt
We'll continue monitoring the campaign and post updates as soon as new developments take place.