We've recently came across to a Google Sponsored scareware campaign successfully enticing users into installing fake security software on their hosts further earning fraudulent revenue in the process of monetizing access to malware-infected hosts largely relying on the utilization of an affiliate-network based type of revenue sharing scheme.
In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure, behind it and discuss in-depth, the tactics techniques and procedures of the cybercriminals behind it.
hxxp://www.google.com/aclk?sa=l&ai=Czd4NEnlLS-pWlrS1A-jBmIwO9pfjnQHOjKCvEI2B8woQAigIUPjA4pz8_____wFgyZajiqSkxBGgAabhse4DyAEBqgQhT9
CjnzChYHf5zQB4c8FB-fW9WUzgcUTQ4c7ciD4Gyxs0&num=5&sig=AGiWqty0Uq3Kr6U1Sb10olrq6C22JfNR_w&q=http://www.adwarepronow.com
hxxp://www.google.com/aclk?sa=L&ai=COLk5EnlLS-pWlrS1A-jBmIwO0YGZmwGz9aqwDbiw8bcBEAUoCFCnyNGE______8BYMmWo4qkpMQRyAEBqgQZT9
CTvAGhbX_5PQN_7QaAIk7HT3dQfrqLJQ&num=8amp;sig=AGiWqtyHmo4mgVkszSWtDUcT4dMRUAQnXg&q=http://www.antimalware-2010.com
Known malicious domains known to have participated in the campaign:
hxxp://www.adwarepronow.com/?gclid=CJ6d8LSGnZ8CFRMqagodmR_KaA - 209.216.193.112
Known malicious domains known to have participated in the campaign:
hxxp://www.antimalware-2010.com/ - 209.216.193.119
Sample detection rate for a sample malware:
MD5: 8328da91c8eba6668b3e72d547157ac7
Sample detection rate for a sample malware:
MD5: b74412ea403241c9c60482fd13540505
Once, executed, a, sample, malware, phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://72.167.164.199/definitions/configuration.txt
hxxp://72.167.164.199/latestversion/AntiMalwarePro_appversion.txt
We'll continue monitoring the campaign and post updates as soon as new developments take place.
