This summary is not available. Please
click here to view the post.
Continue reading →
Scarewere continues occupying the top spots for malicious monetization tactics courtesy of the cybercrime ecosystem. Disruption of this monetization chain can take place through multiple processes. For instance:
- Share data with the affected ISP whose customers participate in the black hat SEO campaign
- Target the payment processing gateways, or inform the legitimate one
- Target the the redirector URLs of the campaign
- Target the affiliate network itself
- Target the "final output" in the form of scareware domains
- Detecrion rate for systemwrecksavertingsystem.com /scan1/92/freesystemscan.exe
freesystemscan.exe - Trojan.Win32.FakeAV
Result: 17/ 43 (39.5%)
MD5 : a69a7f1992ed4607ac0a163d66984f56
SHA1 : ef089f92881ff6835b76562febdcbc3328340adb
SHA256: 993026853e2bbc8846dbda5a90c4f06a9a18b83c9f97fe7b1557b03975ebeaff
- Detection rate for pornhugevideo.com /video3/88/freevideoplugin.exe
freevideoplugin.exe - Rogue:Win32/FakePAV
Result: 4/ 42 (9.5%)
MD5 : 8a688d6ebb838f66f16720f4066cf6c6
SHA1 : 845e43ad946048346b3d9150ae41fd8f7766ac53
SHA256: db6e3e7a72305d8b36861ed90753555d519bdca5a36aa0581ed363ac264cfbce
Responding to 94.23.105.248 (AS16276): One active ZeuS C&C within the AS monasteriodeboltana.es
accidentspreventingcenter.com - Email: contact@privacyprotect.org
antibreakingsystem.com - Email: contact@privacyprotect.org
antivirusesshield.com - Email: contact@privacyprotect.org
bigvideocams.com - Email: contact@privacyprotect.org
componentsprotector.com - Email: contact@privacyprotect.org
hugebigpornmovie.com - Email: contact@privacyprotect.org
hugebigred.com - Email: contact@privacyprotect.org
hugemoviecams.com - Email: contact@privacyprotect.org
pcactivitydebugger.com - Email: contact@privacyprotect.org
pcautomaticproblemssolver.com - Email: contact@privacyprotect.org
pccustodianutility.com - Email: contact@privacyprotect.org
pcinspectionutility.com - Email: contact@privacyprotect.org
pcprecautionscenter.com - Email: contact@privacyprotect.org
pcprotectionservant.com - Email: contact@privacyprotect.org
pcriskspreventionscenter.com - Email: contact@privacyprotect.org
pcstabilitymaximizer.com - Email: contact@privacyprotect.org
pctroublessolver.com - Email: contact@privacyprotect.org
pcwardingsystem.com - Email: contact@privacyprotect.org
pornhugevideo.com - Email: contact@privacyprotect.org
systemanticrashesutility.com - Email: contact@privacyprotect.org
systemattentionutility.com - Email: contact@privacyprotect.org
systemshieldingutility.com - Email: contact@privacyprotect.org
systemsupervisioncenter.com - Email: contact@privacyprotect.org
systemtasksoptimizer.com - Email: contact@privacyprotect.org
systemwrecksavertingsystem.com - Email: contact@privacyprotect.org
taskstweakingutility.com - Email: contact@privacyprotect.org
tubemovievideo.com - Email: contact@privacyprotect.org
Responding to 76.76.117.101 (AS21793); 78.46.105.205 (AS24940); 207.58.177.96 (AS25847) and 64.64.3.125 (AS25847)
212156dnfgdn.co.cc - Email: audiodius@hotmail.com
32fdsg3gsg.vv.cc
androlhala.cz.cc
bdfnfebne3nf.vv.cc
bfbf3bfb.vv.cc
cebandis.cz.cc
centrihelm.cz.cc
drelagda.vv.cc
f23f21fafae.vv.cc
fdf2fafaf.vv.cc
gdezdeskto.co.cc
gdsg342gsgs.vv.cc
gewheheh4.co.cc - Email: audiodius@hotmail.com
gfsdg4gs.co.cc - Email: audiodius@hotmail.com
graninis.cz.cc
gsdg24gshgr.vv.cc
gsdg43hsweh.co.cc - Email: audiodius@hotmail.com
gsegf3gstg3g.vv.cc
gsg3gsdgseg.co.cc - Email: audiodius@hotmail.com
gsgsv2vds.vv.cc
gsgwegweg23g.vv.cc
hdfg43hshf.co.cc - Email: audiodius@hotmail.com
hdfh34hdrfhf.co.cc - Email: audiodius@hotmail.com
hdhfdhdfhdfhdfh.vv.cc
hfehe3hdfhf.co.cc - Email: audiodius@hotmail.com
hh3hfdnfdh.co.cc - Email: audiodius@hotmail.com
hndfdfnfdnxdnf.vv.cc
ht4hdfgjcjgt.vv.cc
hu587tiugi.vv.cc
malakelv.cz.cc
maridora.vv.cc
morlunaya.vv.cc
nvmtymvm.vv.cc
oghmalak.vv.cc
oijqujnnnsu1.co.cc - Email: audiodius@hotmail.com
shalillador.cz.cc
vsegwgewg.vv.cc
wefge3g1tg1g.vv.cc
yeryeshsdhdhjfdhj.vv.cc
This post has been reproduced from Dancho Danchev's blog.
Related posts on scareware and blackhat SEO monetization:
A Diverse Portfolio of Scareware/Blackhat SEO Redirectors Courtesy of the Koobface Gang
Dissecting a Scareware-Serving Black Hat SEO Campaign Using Compromised .NL/.CH Sites
Dissecting the 100,000+ Scareware Serving Fake YouTube Pages Campaign
Dissecting the Ongoing U.S Federal Forms Themed Blackhat SEO Campaign - Part Two
Blackhat SEO Campaign Hijacks U.S Federal Form Keywords, Serves Scareware
U.S Federal Forms Blackhat SEO Themed Scareware Campaign Expanding
Dissecting the Ongoing U.S Federal Forms Themed Blackhat SEO Campaign
The ultimate guide to scareware protection
A Diverse Portfolio of Scareware/Blackhat SEO Redirectors Courtesy of the Koobface Gang
Massive Scareware Serving Blackhat SEO, the Koobface Gang Style
A Peek Inside the Managed Blackhat SEO Ecosystem
Dissecting a Swine Flu Black SEO Campaign
Massive Blackhat SEO Campaign Serving Scareware
From Ukrainian Blackhat SEO Gang With Love
From Ukrainian Blackhat SEO Gang With Love - Part Two
From Ukraine with Scareware Serving Tweets, Bogus LinkedIn/Scribd Accounts, and Blackhat SEO Farms
From Ukraine with Bogus Twitter, LinkedIn and Scribd Accounts
Fake Web Hosting Provider - Front-end to Scareware Blackhat SEO Campaign at Blogspot
The Ultimate Guide to Scareware Protection
A Diverse Portfolio of Fake Security Software - Part Twenty Four
A Diverse Portfolio of Fake Security Software - Part Twenty Three
A Diverse Portfolio of Fake Security Software - Part Twenty Two
A Diverse Portfolio of Fake Security Software - Part Twenty One
A Diverse Portfolio of Fake Security Software - Part Twenty
A Diverse Portfolio of Fake Security Software - Part Nineteen
A Diverse Portfolio of Fake Security Software - Part Eighteen
A Diverse Portfolio of Fake Security Software - Part Seventeen
A Diverse Portfolio of Fake Security Software - Part Sixteen
A Diverse Portfolio of Fake Security Software - Part Fifteen
A Diverse Portfolio of Fake Security Software - Part Fourteen
A Diverse Portfolio of Fake Security Software - Part Thirteen
A Diverse Portfolio of Fake Security Software - Part Twelve
A Diverse Portfolio of Fake Security Software - Part Eleven
A Diverse Portfolio of Fake Security Software - Part Ten
A Diverse Portfolio of Fake Security Software - Part Nine
A Diverse Portfolio of Fake Security Software - Part Eight
A Diverse Portfolio of Fake Security Software - Part Seven
A Diverse Portfolio of Fake Security Software - Part Six
A Diverse Portfolio of Fake Security Software - Part Five
A Diverse Portfolio of Fake Security Software - Part Four
A Diverse Portfolio of Fake Security Software - Part Three
A Diverse Portfolio of Fake Security Software - Part Two
Diverse Portfolio of Fake Security Software Continue reading →
Just in time for Saint Valentin's days, pharmaceutical scammers have switched their localized templates to a more romantic theme.
The domains have been registered using three separate Yahoo! Mail accounts, and are all responding to a single IP - 115.239.229.196; AS4134, CHINA-TELECOM China Telecom with four currently active ZeuS C&Cs within the same AS - aiyanxinxi.com; wawnet.net; www.zuihouyi.com; nascetur.com.
abpillsw.ru - Email: nikitapetuhov@yahoo.com
alpillsw.ru - Email: nikitapetuhov@yahoo.com
alypillsw.ru - Email: nikitapetuhov@yahoo.com
annpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
asapillsm.ru - Email: alexeycheremisinov@yahoo.com
barpillsw.ru - Email: nikitapetuhov@yahoo.com
bazpillso.ru - Email: muzalevskayaekaterina@yahoo.com
bupillsp.ru - Email: muzalevskayaekaterina@yahoo.com
capillso.ru - Email: muzalevskayaekaterina@yahoo.com
carpillsw.ru - Email: nikitapetuhov@yahoo.com
celpillsw.ru - Email: nikitapetuhov@yahoo.com
chapillsm.ru - Email: alexeycheremisinov@yahoo
chapillso.ru - Email: muzalevskayaekaterina@yahoo.com
chpillso.ru - Email: muzalevskayaekaterina@yahoo.com
cinpillsp.ru - Email: nikitapetuhov@yahoo.com
conpillsw.ru - Email: alexeycheremisinov@yahoo.com
copillsm.ru - Email: alexeycheremisinov@yahoo.com
copillsp.ru - Email: muzalevskayaekaterina@yahoo.com
corpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
crpillsm.ru - Email: alexeycheremisinov@yahoo.com
depillsm.ru - Email: alexeycheremisinov@yahoo.com
depillso.ru - Email: muzalevskayaekaterina@yahoo.com
despillsw.ru - Email: nikitapetuhov@yahoo,cim
dipillsm.ru - Email: alexeycheremisinov@yahoo.com
dipillsw.ru - Email: nikitapetuhov@yahoo.com
duppillsp.ru - Email: muzalevskayaekaterina@yahoo.com
enkpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
estpillsm.ru - Email: alexeycheremisinov@yahoo.com
ethpillsm.ru - Email: alexeycheremisinov@yahoo.com
exapillsw.ru - Email: nikitapetuhov@yahoo.com
flipillso.ru - Email: alexeycheremisinov@yahoo.com
flpillso.ru - Email: alexeycheremisinov@yahoo.com
funpills.ru - Email: muzalevskayaekaterina@yahoo.com
glpillso.ru - Email: alexeycheremisinov@yahoo.com
haupillso.ru - Email: alexeycheremisinov@yahoo.com
hipills.ru - Email: muzalevskayaekaterina@yahoo.com
invpillso.ru - Email: alexeycheremisinov@yahoo.com
isapillsp.ru - Email: muzalevskayaekaterina@yahoo.com
itepillsw.ru - Email: nikitapetuhov@yahoo.com
jopillso.ru - Email: alexeycheremisinov@yahoo.com
kipillsp.ru - Email: muzalevskayaekaterina@yahoo.com
kipillsw.ru - Email: nikitapetuhov@yahoo.com
krpillsw.ru - Email: nikitapetuhov@yahoo.com
lopillso.ru - Email: alexeycheremisinov@yahoo.com
lopillsw.ru - Email: nikitapetuhov@yahoo.com
mapillso.ru - Email: alexeycheremisinov@yahoo.com
marpillsw.ru - Email: nikitapetuhov@yahoo.com
metpillso.ru - Email: alexeycheremisinov@yahoo.com
monpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
nopillsp.ru - Email: muzalevskayaekaterina@yahoo.com
odpillsw.ru - Email: nikitapetuhov@yahoo.com
panpillsw.ru - Email: nikitapetuhov@yahoo.com
phpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
pillsbi.ru - Email: simakovs@yahoo.com
pillsly.ru - Email: alexeycheremisinov@yahoo.com
pillsnk.ru - Email: alexeycheremisinov@yahoo.com
pillsoep.ru - Email: alexeycheremisinov@yahoo.com
pillsoes.ru - Email: alexeycheremisinov@yahoo.com
pillsoff.ru - Email: alexeycheremisinov@yahoo.com
pillsogn.ru - Email: alexeycheremisinov@yahoo.com
pillsois.ru - Email: alexeycheremisinov@yahoo.com
pillsoke.ru - Email: alexeycheremisinov@yahoo.com
pillsokt.ru - Email: alexeycheremisinov@yahoo.com
pillsong.ru - Email: alexeycheremisinov@yahoo.com
pillsont.ru - Email: alexeycheremisinov@yahoo.com
pillsooc.ru - Email: alexeycheremisinov@yahoo.com
pillsopa.ru - Email: alexeycheremisinov@yahoo.com
pillsore.ru - Email: alexeycheremisinov@yahoo.com
pillsosa.ru - Email: alexeycheremisinov@yahoo.com
pillsosl.ru - Email: alexeycheremisinov@yahoo.com
pillsoti.ru - Email: alexeycheremisinov@yahoo.com
pillsouc.ru - Email: alexeycheremisinov@yahoo.com
pillsove.ru - Email: alexeycheremisinov@yahoo.com
pillspba.ru - Email: muzalevskayaekaterina@yahoo.com
pillsper.ru - Email: muzalevskayaekaterina@yahoo.com
pillspiz.ru - Email: muzalevskayaekaterina@yahoo.com
pillspnc.ru - Email: muzalevskayaekaterina@yahoo.com
pillspne.ru - Email: muzalevskayaekaterina@yahoo.com
pillspno.ru - Email: muzalevskayaekaterina@yahoo.com
pillspns.ru - Email: muzalevskayaekaterina@yahoo.com
pillsppp.ru - Email: muzalevskayaekaterina@yahoo.com
pillsppt.ru - Email: muzalevskayaekaterina@yahoo.com
pillspra.ru - Email: muzalevskayaekaterina@yahoo.com
pillspre.ru - Email: muzalevskayaekaterina@yahoo.com
pillsprg.ru - Email: muzalevskayaekaterina@yahoo.com
pillspsa.ru - Email: muzalevskayaekaterina@yahoo.com
pillspss.ru - Email: muzalevskayaekaterina@yahoo.com
pillspst.ru - Email: muzalevskayaekaterina@yahoo.com
pillspti.ru - Email: muzalevskayaekaterina@yahoo.com
pillsqu.ru - Email: alexeycheremisinov@yahoo.com
pillswal.ru - Email: nikitapetuhov@yahoo.com
pillswam.ru - Email: nikitapetuhov@yahoo.com
pillswar.ru - Email: nikitapetuhov@yahoo.com
pillswau.ru - Email: nikitapetuhov@yahoo.com
pillswcu.ru - Email: nikitapetuhov@yahoo.com
pillswed.ru - Email: nikitapetuhov@yahoo.com
pillswep.ru - Email: nikitapetuhov@yahoo.com
pillswer.ru - Email: nikitapetuhov@yahoo.com
pillswet.ru - Email: nikitapetuhov@yahoo.com
pillswey.ru - Email: nikitapetuhov@yahoo.com
pillswis.ru - Email: nikitapetuhov@yahoo.com
pillswng.ru - Email: nikitapetuhov@yahoo.com
pillswol.ru - Email: nikitapetuhov@yahoo.com
See also:
- Inside an affiliate spam program for pharmaceuticals
- Survey: Millions of users open spam emails, click on links
- Microsoft's Bing invaded by pharmaceutical scammers
pillswss.ru - Email: nikitapetuhov@yahoo.com
pillswti.ru - Email: nikitapetuhov@yahoo.com
pillswtt.ru - Email: nikitapetuhov@yahoo.com
pillswwa.ru - Email: nikitapetuhov@yahoo.com
pillszva.ru - Email: nikitapetuhov@yahoo.com
pillszzi.ru - Email: nikitapetuhov@yahoo.com
propillsp.ru - Email: muzalevskayaekaterina@yahoo.com
puppillso.ru - Email: alexeycheremisinov@yahoo.com
rempillso.ru - Email: alexeycheremisinov@yahoo.com
repillso.ru - Email: alexeycheremisinov@yahoo.com
sipillsw.ru - Email: nikitapetuhov@yahoo.com
stapillso.ru - Email: alexeycheremisinov@yahoo.com
supillsp.ru - Email: muzalevskayaekaterina@yahoo.com
tilpillso.ru - Email: alexeycheremisinov@yahoo.com
tilpillsw.ru - Email: nikitapetuhov@yahoo.com
towpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
trpillsp.ru - Email: muzalevskayaekaterina@yahoo.com
uncpillso.ru - Email: alexeycheremisinov@yahoo.com
vipillsp.ru - Email: muzalevskayaekaterina@yahoo.com
whapillsw.ru - Email: nikitapetuhov@yahoo.com
Name servers of notice, respoding to 115.239.229.196 (AS4134); 113.23.142.119 (AS38182) and 78.46.105.205 (AS24940 - active SpyEye C&Cs at www.privathosting.eu; spl.privathosting.eu)
ns1.advidns.ru
ns1.alemedicp.ru
ns1.annudns.com
ns1.bacdns.ru
ns1.bacmedicp.ru
ns1.bestworlddns.com
ns1.botedns.com
ns1.boxdns.ru
ns1.camdns.ru
ns1.cashdns.ru
ns1.caulsdns.com
ns1.comtdns.com
ns1.crouadns.ru
ns1.culldns.com
ns1.delmedicv.ru
ns1.dns4work.ru
ns1.dnsbest.ru
ns1.dnsbestfind.com
ns1.dnsoper.com
ns1.dnsorbi.com
ns1.dnsroomo.ru
ns1.dnswork.ru
ns1.doctorci.ru
ns1.doctorngee.ru
ns1.doctorrfix.com
ns1.doctorude.ru
ns1.doctorxst.ru
ns1.doctorxve.ru
ns1.drdoctorx.ru
ns1.dromedicp.ru
ns1.eagreadns.ru
ns1.elmendns.ru
ns1.feldns.ru
ns1.glisdns.com
ns1.gurndns.ru
ns1.hardns.ru
ns1.psidns.com
ns1.rxshopsmor.ru
ns1.sighost.ru
ns1.standns.com
ns1.subrdns.ru
ns1.tiodns.com
ns1.twdoctor.com
ns1.vodoctorx.ru
This post has been reproduced from Dancho Danchev's blog. Continue reading →
Whatever the cybercrime marketplace demands, the cybercrime marketplace supplies. Continue reading →
With money mule recruitment continuing to represent the most actively used risk-forwarding tactic within the cybercrime ecosystem for the purpose of securely distribution fraudulently obtained funds, part five of the "Keeping Money Mule Recruiters on a Short Leash" series are here to stay.
What's particularly interesting about the money mule recruitment domain portfolio that I'll expose, is the logical progression from bogus companies offering financial services, to a diverse set of companies occupying multiple markets/covering different market segments.
-Current trends - Localization and standardization/template-tization
A great example of this trend -- largely driven by the standardization and template-zation of money mule recruitment sites as a service- is Schwartz & Brothers LLC (schwartz-brothers.cc).
"Schwartz & Brothers LLC is the first choice for artists and buyers alike! Schwartz & Brothers LLC is an effective tool for the artist and emerging artist to market and promote their art in a professional and inexpensive manner. We will market your art to the international community of art buyers. Whether you are looking to buy or sell original art, Schwartz & Brothers LLC is the premier art site for those seeking to buy or sell original art online."
From financial services to an entirely new market segment, whereas the entire recruitment process remains pretty static, excluding several time quality assurance oriented details. For instance, every potential mule is required to download a entry level job psychological test, which surprisingly asks directly whether the mule is from Australia, next to automatically choosing Australia as a country of origin at a later stage throughout the registration process.
Moreover, in the context of quality assurance, the recruiters also ask the applicant "Are you/were you convicted?" in an attempt to combine the survey results with other details such the opening date of the bank account, as well as the average daily/weekly/monthly amount transferred.
- The Terms of Service
The Contractor undertakes the responsibility to receive payments from the Clients of the Company to his personal bank account, withdraw cash and to process payments to the Company's partners by Western Union or MoneyGram money transfer system within one (1) day. He/she will report directly to the senior manager and to any other party designated by the senior manager in connection with the performance of the duties under this Agreement and shall fulfill any other duties reasonably requested by the Company and agreed to by the Contractor.
CONFIDENTIALITY:
The Contractor acknowledges that during the engagement he will have access to and become acquainted with various trade secrets, inventions, innovations, processes, information, records and specifications owned or licensed by the Company and/or used by the Company in connection with the operation of its business including, without limitation, the Company's business and product processes, methods, customer lists, accounts and procedures.
The Contractor agrees that he will not disclose any of the aforesaid, directly or indirectly, or use any of them in any manner, either during the term of this Agreement or at any time thereafter. All files, records, documents, blueprints, specifications, information, letters, notes, media lists, original artwork/creative, notebooks, and similar items relating to the business of the Company, whether prepared by the Contractor or otherwise coming into his possession, shall remain the exclusive property of the Company.
The Contractor shall not retain any copies of the foregoing without the Company's prior written permission. The Contractor further agrees that he will not disclose his retention as an independent contractor or the terms of this Agreement to any person without the prior written consent of the Company and shall at all times preserve the confidential nature of his relationship to the Company and of the services hereunder.
If the Contractor releases any of the above information to any parties outside of this company, such as personal friend, close relatives or other Financial Institutions such as a Bank or other Financial Firms, such could be considered grounds for immediate termination. If the Contractor is ever in doubt of what information can be released and when, the Contractor will contact their superior right away.
TERMS OF ENGAGEMENT:
The Contractor is engaged by the Company on terms of thirty-days (30) probationary period. During the probationary period the Company undertakes to pay to the Contractor the base salary amounting to AUD 2300 per month plus 8% commission from each payment processing operation. After the probationary period the Company agrees to revise and raise the base salary to 3000 USD. The Company has the right to cancel this Agreement at any time within the probationary period or refuse to extend it after that, should the Contractor refuse to fulfill his/her obligations under this Agreement or fulfills them not in good faith.The Contractor has the right to terminate the Agreement at any time on condition that he/she has processed all previous payments and has no new instructions.
COMPENSATION:
The Company undertakes to pay taxes accrued in connection with money transfer.The Company shall also reimburse part of expenses which are incurred in connection with money transfer by Western Union or MoneyGram systems (should money transfer charges exceed 3%, i.e. commission for payment processing operation).The above difference will be automatically added to the base salary of the Contractor and paid once per month together with the base salary.
The Company shall have the right to decrease the Contractor's commission in case the payment processing terms were violated by the Contractor. Should the Contractor delays re-sending money accepted to his bank account for the period exceeding one (1) day without any explicit reason, the Company shall have the right to impose sanctions on the Contractor if only the delay has not been caused by the Force Majeur circumstances and to apply to the arbitration and claim for the reimburse of the amount transferred to his account or for compensation for other damage if any, evicted due to the delay.
The Contractor may take days off at any time and at his/her option upon giving five (5) working days advance notice in writing or three (3) working days advance notice via e-mail or fax to the Company in order that the latter may abstain from charging the Contractor with new instructions. However, salary for each day-off is deducted from the Contractor's base salary."
- OSINT data for money mule recruitment sites
The following portfolio of money mule recruitment domains appears to have been registered using automated email registration tools, with the potential for CAPTCHA outsourcing clearly considered by the malicious parties, taking into consideration the even decreasing price for solving CAPTCHA challenges.
4STAR-SOLUTIONS.CC - Email: urge@bz3.ru
ACOON-GROUPLLC.CC - Email: bombay@yourisp.ru
ACOONGROUP-LLC.CO - Email: jx@ppmail.ru
AIMIC-GROUPLLC.CC - 98.141.220.118 - Email: aryan@ppmail.ru
AMINA-GROUPCO.CO - Email: beige@ca4.ru
AMINA-GROUPINC.CC - Email: zowie@yourisp.ru
AMINAORG.CC - Email: range@ppmail.ru
ARPHIS-GOLDGROUP.CC - Email: rook@ca4.ru
ARPHIS-GOLDGROUP.CC - Email: rook@ca4.ru
ARPHISGOLDGROUP-INC.CO - Email: ira@bz3.ru
AUS-FINANCE.CC - Email: ours@ca4.ru
BREDGAR-GROUPLLC.CC - Email: zoe@ca4.ru
BREDGARGROUP-LLC.CO - Email: judo@free-id.ru
CESIS-GROUPLLC.CC - Email: el@cheapbox.ru
CESISGROUP-LLC.CC - Email: flip@free-id.ru
CESIS-GROUPLLC.CO - Email: our@ca4.ru
COCOONGROUP-LLC.HK - Email: most@cheapbox.ru
CORES-GROUP.CC - Email: jaunt@cheapbox.ru
CORESGROUP-INC.CO - Email: yule@cheapbox.ru
CORES-GROUPLTD.CO - Email: liszt@bz3.ru
CRAFT-GROUPNET.CC - Email: room@yourisp.ru
DILIGENCE-GROUP.CO - Email: twig@ppmail.ru
DILIGENCE-GROUPINC.CC - Email: till@cheapbox.ru
DUNCROFT-GROUP-INC.CC - Email: swiss@ca4.ru
DUNCROFTGROUP-INC.CO - Email: shoot@ppmail.ru
ELSDEN-GROUPINC.HK - Email: lost@ppmail.ru
FARLINE-FIN.CO - Email: pecks@free-id.ru
FARLINE-FININC.CC - Email: cynic@free-id.ru
FILEGROUP-LLC.CO - Email: knelt@ca4.ru
FINTEC-LTD.CC - Email: w@yourisp.ru
FINTEC-UK.CO - Email: sons@bz3.ru
GLEICHFALLS-GROUPINC.CO - Email: tents@ppmail.ru
I-COMPASS-GROUP.CO - Email: wolf@ca4.ru
IM-SYSGROUP.CO - Email: truce@free-id.ru
IMSYSTEMS-GROUP.CC - Email: agate@bz3.ru
INCOGROUP-USA.CO - Email: beams@free-id.ru
JOURNEY-FINANCIAL.CC - Email: lulu@ca4.ru
LBMGROUPCO.CC - Email: dreamy@ppmail.ru
LBM-GROUPINC.CO - Email: coma@ca4.ru
LCD-FIN.CO - Email: salt@free-id.ru
LCD-FINANCE.CC - Email: fritz@bz3.ru
MACROTECHINC.CC - Email: cv@yourisp.ru
MACROTECH-UK.CO - Email: curl@cheapbox.ru
MALLOW-GROUP.CC - Email: cues@ppmail.ru
MALLOW-GROUPINC.CO - Email: hn@bz3.ru
MONEY-VISUALUK.CC - Email: hn@bz3.ru
MONEYVISUAL-LLC.CO - Email: yam@free-id.ru
MARFYGROUP.CC - Email: thorny@cheapbox.ru
MICHAELESGROUP-USA.CO - Email: knelt@ca4.ru
OLIVER-SONSINC.CC - Email: drub@cheapbox.ru
ONLINE-SOLUTIONSLLC.CC - Email: coma@ca4.ru
PEGASLTDUNION.cc - Email: prim@bz3.ru
PHYSIS-GROUPLLC.CC - Email: tt@ca4.ru
PHYSISGROUP-LLC.CO - Email: opals@free-id.ru
PINFOLD-GROUPINC.CO - Email: beams@free-id.ru
RADIUM-GROUP.CC - Email: spy@yourisp.ru
RADIUMUK-LTD.CC - Email: socks@cheapbox.ru
REDISCO-GROUPINC.HK - Email: wimp@ca4.ru
SANTORINI-FIN.CC - Email: gill@cheapbox.ru
SANTORINI-FINANCE.CO - Email: foul@yourisp.ru
SCHNELLER-GROUPINC.CO - Email: foul@yourisp.ru
SCHWARTZ-BROTHERS.cc - Email: oozed@bz3.ru
SILVERSUNGROUP-INC.CC - Email: cp@ca4.ru
SILVERSUN-GROUPUK.CO - Email: cheer@ca4.ru
SOLUTIONSLTD.CC - Email: h2o@ca4.ru
STILE-GROUPLLC.CC - Email: ma@free-id.ru
SUNRISEPR-GROUPLTD.CC - Email: cough@ppmail.ru
TECHADVINC.CC - Email: chance@cheapbox.ru
TECHADV-INC.CC - Email: chance@cheapbox.ru
TECHOUSE-GROUP.CC - Email: scale@yourisp.ru
UKTECH-GROUPLLC.CC - Email: cap@ca4.ru
USGROUP-AMINA.CO - Email: cap@ca4.ru
USGROUP-REIGN.CO - Email: w@ppmail.ru
YESGROUP-LLC.CO - Email: twig@ppmail.ru
Name servers of notice:
NS1.LIBUNITAU.CC - 178.162.152.76 (AS28753) - Email: ached@yourisp.ru
NS1.NNSQUE.CC - Email: amok@cheapbox.ru
NS1.OLIVAU.CC - Email: bop@cheapbox.ru
NS1.PAGEREDNS.CC - 178.162.152.77 (AS28753) - Email: freer@free-id.ru
NS1.SURPLUSUSA.CC - 209.159.156.162 (AS19318) - Email: skulk@ppmail.ru
NS1.TVSILVAU.CC - Email: fact@ppmail.ru
NS1.UKNSSPACE.CC - 69.10.44.190 (AS19318) - Email: gravy@ca4.ru
ns1.uksource.cc - 69.10.44.189 (AS19318) - Email: liver@cheapbox.ru
NS1.USABONDS.CC - Email: bart@cheapbox.ru
NS2.AUSTDEC.CC - 66.199.236.114 (AS15149) - Email: bold@yourisp.ru
NS2.COUKSNS.CC - 122.70.148.179 (AS55462) - Email: preen@ppmail.ru
ns2.gbtrade.cc - 66.199.236.114 (AS15149) - Email: ct@yourisp.ru
NS2.OLIVAU.CC - Email: bop@cheapbox.ru
NS2.RINGTONS.CC - 66.199.236.115 (AS15149) - Email: aaron@cheapbox.ru
NS2.TVSILVAU.CC - Email: fact@ppmail.ru
NS2.USAFUNDS.CC - 76.73.47.28 (AS30058) - Email: tile@yourisp.ru
NS2.ZONENSUK.CC - 178.162.181.11 (AS28753) - Email: rooms@ppmail.ru
NS3.AUSTDEC.CC - 178.162.181.11 (AS28753) - Email: bold@yourisp.ru
NS3.FOLOWDNS.CC - 178.162.181.11 (AS28753) - Email: dyed@bz3.ru
NS3.SDNSAU.CC - Email: level@cheapbox.ru
NS3.SURPLUSUSA.CC - 69.50.192.97 (AS18866) - Email: skulk@ppmail.ru
NS3.TVSILVAU.CC - Email: fact@ppmail.ru
NS3.UKCCONS.CC - 178.162.181.11 (AS28753) - Email: ted@cheapbox.ru
NS3.UKDNS.CC - 66.199.236.116 (AS15149) - Email: append@free-id.ru
ns3.ukearnings.cc - 178.162.181.11 (AS28753) - Email: bf@free-id.ru
ASs of notice using standart ns1;ns2; ns3 structure:
AS28753 - NETDIRECT AS NETDIRECT Frankfurt, DE
AS19318 - NJIIX-1 NJIIX.net 110B Meadowlands Pkwy Secaucus, NJ 07094 +1.201.605.1425
AS28753 - NETDIRECT AS NETDIRECT Frankfurt, DE
AS15149 - EZZI-101-BGP EZZI
- Long term trends - "from mule inventory to transactions inventory"
With the localization and standardization/template-tization of the entire money mule recruitment process an every day's reality, quality assurance and diversification of the markets/market segments in order to increase the probability of successful social engineering attack, will start taking place. Moreover, the current template driven recruitment ecosystem will inevitably start taking advantage of basic concepts such as geolocation and content cloaking, in order to once again increase the probability for converting a web site visitor into a mule.
At an invite-only conference that I attended in September, 2010, someone from the audience asked me a rather interesting question. Does it really matter how many mules are recruited by a particular syndicate, and most importantly, can we talk about average number of days/weeks/hours by the time the mule gets busted, and can no longer offer his/her services?
In the long term, we're inevitably going to witness the migration from building inventories of mules to transaction-driven mule recruitment model where the capability-driven mentality surpasses the mule inventory building one. The number of possible transactions with success rates based on historical performance, combined with an infinite loop of recruitment is what will drive the entire mule recruitment ecosystem.
Related posts:
The DNS Infrastructure of the Money Mule Recruitment Ecosystem
Keeping Money Mule Recruiters on a Short Leash - Part Four
Money Mule Recruitment Campaign Serving Client-Side Exploits
Keeping Money Mule Recruiters on a Short Leash - Part Three
Money Mule Recruiters on Yahoo!'s Web Hosting
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002
This post has been reproduced from Dancho Danchev's blog. Continue reading →
With money mule recruitment continuing to represent the most actively used risk-forwarding tactic within the cybercrime ecosystem for the purpose of securely distribution fraudulently obtained funds, part five of the "Keeping Money Mule Recruiters on a Short Leash" series are here to stay.
What's particularly interesting about the money mule recruitment domain portfolio that I'll expose, is the logical progression from bogus companies offering financial services, to a diverse set of companies occupying multiple markets/covering different market segments.
-Current trends - Localization and standardization/template-tization
A great example of this trend -- largely driven by the standardization and template-zation of money mule recruitment sites as a service- is Schwartz & Brothers LLC (schwartz-brothers.cc).
"Schwartz & Brothers LLC is the first choice for artists and buyers alike! Schwartz & Brothers LLC is an effective tool for the artist and emerging artist to market and promote their art in a professional and inexpensive manner. We will market your art to the international community of art buyers. Whether you are looking to buy or sell original art, Schwartz & Brothers LLC is the premier art site for those seeking to buy or sell original art online."
From financial services to an entirely new market segment, whereas the entire recruitment process remains pretty static, excluding several time quality assurance oriented details. For instance, every potential mule is required to download a entry level job psychological test, which surprisingly asks directly whether the mule is from Australia, next to automatically choosing Australia as a country of origin at a later stage throughout the registration process.
Moreover, in the context of quality assurance, the recruiters also ask the applicant "Are you/were you convicted?" in an attempt to combine the survey results with other details such the opening date of the bank account, as well as the average daily/weekly/monthly amount transferred.
- The Terms of Service
The Contractor undertakes the responsibility to receive payments from the Clients of the Company to his personal bank account, withdraw cash and to process payments to the Company's partners by Western Union or MoneyGram money transfer system within one (1) day. He/she will report directly to the senior manager and to any other party designated by the senior manager in connection with the performance of the duties under this Agreement and shall fulfill any other duties reasonably requested by the Company and agreed to by the Contractor.
CONFIDENTIALITY:
The Contractor acknowledges that during the engagement he will have access to and become acquainted with various trade secrets, inventions, innovations, processes, information, records and specifications owned or licensed by the Company and/or used by the Company in connection with the operation of its business including, without limitation, the Company's business and product processes, methods, customer lists, accounts and procedures.
The Contractor agrees that he will not disclose any of the aforesaid, directly or indirectly, or use any of them in any manner, either during the term of this Agreement or at any time thereafter. All files, records, documents, blueprints, specifications, information, letters, notes, media lists, original artwork/creative, notebooks, and similar items relating to the business of the Company, whether prepared by the Contractor or otherwise coming into his possession, shall remain the exclusive property of the Company.
The Contractor shall not retain any copies of the foregoing without the Company's prior written permission. The Contractor further agrees that he will not disclose his retention as an independent contractor or the terms of this Agreement to any person without the prior written consent of the Company and shall at all times preserve the confidential nature of his relationship to the Company and of the services hereunder.
If the Contractor releases any of the above information to any parties outside of this company, such as personal friend, close relatives or other Financial Institutions such as a Bank or other Financial Firms, such could be considered grounds for immediate termination. If the Contractor is ever in doubt of what information can be released and when, the Contractor will contact their superior right away.
TERMS OF ENGAGEMENT:
The Contractor is engaged by the Company on terms of thirty-days (30) probationary period. During the probationary period the Company undertakes to pay to the Contractor the base salary amounting to AUD 2300 per month plus 8% commission from each payment processing operation. After the probationary period the Company agrees to revise and raise the base salary to 3000 USD. The Company has the right to cancel this Agreement at any time within the probationary period or refuse to extend it after that, should the Contractor refuse to fulfill his/her obligations under this Agreement or fulfills them not in good faith.The Contractor has the right to terminate the Agreement at any time on condition that he/she has processed all previous payments and has no new instructions.
COMPENSATION:
The Company undertakes to pay taxes accrued in connection with money transfer.The Company shall also reimburse part of expenses which are incurred in connection with money transfer by Western Union or MoneyGram systems (should money transfer charges exceed 3%, i.e. commission for payment processing operation).The above difference will be automatically added to the base salary of the Contractor and paid once per month together with the base salary.
The Company shall have the right to decrease the Contractor's commission in case the payment processing terms were violated by the Contractor. Should the Contractor delays re-sending money accepted to his bank account for the period exceeding one (1) day without any explicit reason, the Company shall have the right to impose sanctions on the Contractor if only the delay has not been caused by the Force Majeur circumstances and to apply to the arbitration and claim for the reimburse of the amount transferred to his account or for compensation for other damage if any, evicted due to the delay.
The Contractor may take days off at any time and at his/her option upon giving five (5) working days advance notice in writing or three (3) working days advance notice via e-mail or fax to the Company in order that the latter may abstain from charging the Contractor with new instructions. However, salary for each day-off is deducted from the Contractor's base salary."
- OSINT data for money mule recruitment sites
The following portfolio of money mule recruitment domains appears to have been registered using automated email registration tools, with the potential for CAPTCHA outsourcing clearly considered by the malicious parties, taking into consideration the even decreasing price for solving CAPTCHA challenges.
4STAR-SOLUTIONS.CC - Email: urge@bz3.ru
ACOON-GROUPLLC.CC - Email: bombay@yourisp.ru
ACOONGROUP-LLC.CO - Email: jx@ppmail.ru
AIMIC-GROUPLLC.CC - 98.141.220.118 - Email: aryan@ppmail.ru
AMINA-GROUPCO.CO - Email: beige@ca4.ru
AMINA-GROUPINC.CC - Email: zowie@yourisp.ru
AMINAORG.CC - Email: range@ppmail.ru
ARPHIS-GOLDGROUP.CC - Email: rook@ca4.ru
ARPHIS-GOLDGROUP.CC - Email: rook@ca4.ru
ARPHISGOLDGROUP-INC.CO - Email: ira@bz3.ru
AUS-FINANCE.CC - Email: ours@ca4.ru
BREDGAR-GROUPLLC.CC - Email: zoe@ca4.ru
BREDGARGROUP-LLC.CO - Email: judo@free-id.ru
CESIS-GROUPLLC.CC - Email: el@cheapbox.ru
CESISGROUP-LLC.CC - Email: flip@free-id.ru
CESIS-GROUPLLC.CO - Email: our@ca4.ru
COCOONGROUP-LLC.HK - Email: most@cheapbox.ru
CORES-GROUP.CC - Email: jaunt@cheapbox.ru
CORESGROUP-INC.CO - Email: yule@cheapbox.ru
CORES-GROUPLTD.CO - Email: liszt@bz3.ru
CRAFT-GROUPNET.CC - Email: room@yourisp.ru
DILIGENCE-GROUP.CO - Email: twig@ppmail.ru
DILIGENCE-GROUPINC.CC - Email: till@cheapbox.ru
DUNCROFT-GROUP-INC.CC - Email: swiss@ca4.ru
DUNCROFTGROUP-INC.CO - Email: shoot@ppmail.ru
ELSDEN-GROUPINC.HK - Email: lost@ppmail.ru
FARLINE-FIN.CO - Email: pecks@free-id.ru
FARLINE-FININC.CC - Email: cynic@free-id.ru
FILEGROUP-LLC.CO - Email: knelt@ca4.ru
FINTEC-LTD.CC - Email: w@yourisp.ru
FINTEC-UK.CO - Email: sons@bz3.ru
GLEICHFALLS-GROUPINC.CO - Email: tents@ppmail.ru
I-COMPASS-GROUP.CO - Email: wolf@ca4.ru
IM-SYSGROUP.CO - Email: truce@free-id.ru
IMSYSTEMS-GROUP.CC - Email: agate@bz3.ru
INCOGROUP-USA.CO - Email: beams@free-id.ru
JOURNEY-FINANCIAL.CC - Email: lulu@ca4.ru
LBMGROUPCO.CC - Email: dreamy@ppmail.ru
LBM-GROUPINC.CO - Email: coma@ca4.ru
LCD-FIN.CO - Email: salt@free-id.ru
LCD-FINANCE.CC - Email: fritz@bz3.ru
MACROTECHINC.CC - Email: cv@yourisp.ru
MACROTECH-UK.CO - Email: curl@cheapbox.ru
MALLOW-GROUP.CC - Email: cues@ppmail.ru
MALLOW-GROUPINC.CO - Email: hn@bz3.ru
MONEY-VISUALUK.CC - Email: hn@bz3.ru
MONEYVISUAL-LLC.CO - Email: yam@free-id.ru
MARFYGROUP.CC - Email: thorny@cheapbox.ru
MICHAELESGROUP-USA.CO - Email: knelt@ca4.ru
OLIVER-SONSINC.CC - Email: drub@cheapbox.ru
ONLINE-SOLUTIONSLLC.CC - Email: coma@ca4.ru
PEGASLTDUNION.cc - Email: prim@bz3.ru
PHYSIS-GROUPLLC.CC - Email: tt@ca4.ru
PHYSISGROUP-LLC.CO - Email: opals@free-id.ru
PINFOLD-GROUPINC.CO - Email: beams@free-id.ru
RADIUM-GROUP.CC - Email: spy@yourisp.ru
RADIUMUK-LTD.CC - Email: socks@cheapbox.ru
REDISCO-GROUPINC.HK - Email: wimp@ca4.ru
SANTORINI-FIN.CC - Email: gill@cheapbox.ru
SANTORINI-FINANCE.CO - Email: foul@yourisp.ru
SCHNELLER-GROUPINC.CO - Email: foul@yourisp.ru
SCHWARTZ-BROTHERS.cc - Email: oozed@bz3.ru
SILVERSUNGROUP-INC.CC - Email: cp@ca4.ru
SILVERSUN-GROUPUK.CO - Email: cheer@ca4.ru
SOLUTIONSLTD.CC - Email: h2o@ca4.ru
STILE-GROUPLLC.CC - Email: ma@free-id.ru
SUNRISEPR-GROUPLTD.CC - Email: cough@ppmail.ru
TECHADVINC.CC - Email: chance@cheapbox.ru
TECHADV-INC.CC - Email: chance@cheapbox.ru
TECHOUSE-GROUP.CC - Email: scale@yourisp.ru
UKTECH-GROUPLLC.CC - Email: cap@ca4.ru
USGROUP-AMINA.CO - Email: cap@ca4.ru
USGROUP-REIGN.CO - Email: w@ppmail.ru
YESGROUP-LLC.CO - Email: twig@ppmail.ru
Name servers of notice:
NS1.LIBUNITAU.CC - 178.162.152.76 (AS28753) - Email: ached@yourisp.ru
NS1.NNSQUE.CC - Email: amok@cheapbox.ru
NS1.OLIVAU.CC - Email: bop@cheapbox.ru
NS1.PAGEREDNS.CC - 178.162.152.77 (AS28753) - Email: freer@free-id.ru
NS1.SURPLUSUSA.CC - 209.159.156.162 (AS19318) - Email: skulk@ppmail.ru
NS1.TVSILVAU.CC - Email: fact@ppmail.ru
NS1.UKNSSPACE.CC - 69.10.44.190 (AS19318) - Email: gravy@ca4.ru
ns1.uksource.cc - 69.10.44.189 (AS19318) - Email: liver@cheapbox.ru
NS1.USABONDS.CC - Email: bart@cheapbox.ru
NS2.AUSTDEC.CC - 66.199.236.114 (AS15149) - Email: bold@yourisp.ru
NS2.COUKSNS.CC - 122.70.148.179 (AS55462) - Email: preen@ppmail.ru
ns2.gbtrade.cc - 66.199.236.114 (AS15149) - Email: ct@yourisp.ru
NS2.OLIVAU.CC - Email: bop@cheapbox.ru
NS2.RINGTONS.CC - 66.199.236.115 (AS15149) - Email: aaron@cheapbox.ru
NS2.TVSILVAU.CC - Email: fact@ppmail.ru
NS2.USAFUNDS.CC - 76.73.47.28 (AS30058) - Email: tile@yourisp.ru
NS2.ZONENSUK.CC - 178.162.181.11 (AS28753) - Email: rooms@ppmail.ru
NS3.AUSTDEC.CC - 178.162.181.11 (AS28753) - Email: bold@yourisp.ru
NS3.FOLOWDNS.CC - 178.162.181.11 (AS28753) - Email: dyed@bz3.ru
NS3.SDNSAU.CC - Email: level@cheapbox.ru
NS3.SURPLUSUSA.CC - 69.50.192.97 (AS18866) - Email: skulk@ppmail.ru
NS3.TVSILVAU.CC - Email: fact@ppmail.ru
NS3.UKCCONS.CC - 178.162.181.11 (AS28753) - Email: ted@cheapbox.ru
NS3.UKDNS.CC - 66.199.236.116 (AS15149) - Email: append@free-id.ru
ns3.ukearnings.cc - 178.162.181.11 (AS28753) - Email: bf@free-id.ru
ASs of notice using standart ns1;ns2; ns3 structure:
AS28753 - NETDIRECT AS NETDIRECT Frankfurt, DE
AS19318 - NJIIX-1 NJIIX.net 110B Meadowlands Pkwy Secaucus, NJ 07094 +1.201.605.1425
AS28753 - NETDIRECT AS NETDIRECT Frankfurt, DE
AS15149 - EZZI-101-BGP EZZI
- Long term trends - "from mule inventory to transactions inventory"
With the localization and standardization/template-tization of the entire money mule recruitment process an every day's reality, quality assurance and diversification of the markets/market segments in order to increase the probability of successful social engineering attack, will start taking place. Moreover, the current template driven recruitment ecosystem will inevitably start taking advantage of basic concepts such as geolocation and content cloaking, in order to once again increase the probability for converting a web site visitor into a mule.
At an invite-only conference that I attended in September, 2010, someone from the audience asked me a rather interesting question. Does it really matter how many mules are recruited by a particular syndicate, and most importantly, can we talk about average number of days/weeks/hours by the time the mule gets busted, and can no longer offer his/her services?
In the long term, we're inevitably going to witness the migration from building inventories of mules to transaction-driven mule recruitment model where the capability-driven mentality surpasses the mule inventory building one. The number of possible transactions with success rates based on historical performance, combined with an infinite loop of recruitment is what will drive the entire mule recruitment ecosystem.
Related posts:
The DNS Infrastructure of the Money Mule Recruitment Ecosystem
Keeping Money Mule Recruiters on a Short Leash - Part Four
Money Mule Recruitment Campaign Serving Client-Side Exploits
Keeping Money Mule Recruiters on a Short Leash - Part Three
Money Mule Recruiters on Yahoo!'s Web Hosting
Dissecting an Ongoing Money Mule Recruitment Campaign
Keeping Money Mule Recruiters on a Short Leash - Part Two
Keeping Reshipping Mule Recruiters on a Short Leash
Keeping Money Mule Recruiters on a Short Leash
Standardizing the Money Mule Recruitment Process
Inside a Money Laundering Group's Spamming Operations
Money Mule Recruiters use ASProx's Fast Fluxing Services
Money Mules Syndicate Actively Recruiting Since 2002
This post has been reproduced from Dancho Danchev's blog. Continue reading →
A currently ongoing spamvertised campaign, attempts to impersonate the most popular social networking site, Facebook.Using a well proven "Your password has been stolen!" theme, the campaign entices the end user into downloading and executing the malware. Social engineering-driven campaigns targeting Facebook, remain among the popular malware campaign spreading techniques due to the ease of execution.
Subject: Facebook Support. Your password has been stolen! ID50888
Message: Good afternoon.
A Spam is sent from your FaceBook account.
Your password has been changed for safety. Information regarding your account and a new password is attached to the letter.Read this information thoroughly and change the password to complicated one. Please do not reply to this email, it's automatic mail notification! Thank you for your attention. Your Facebook!
Spamvertised filedname: Facebook_details_ID76803.zip (32,458 bytes)
Detecrion rate:
Facebook_details.exe - Trojan-Downloader:W32/Koobface.HV - 12/ 43 (27.9%)
MD5 : f0e7a8c264fe14562ca8ac98abb35840
SHA1 : f68d15e66590c69ac75c46a09ae495be8bbf231f
SHA256: 3ca757bfdecbee20ec10d5af770700041f4bc1b17ee3123f4d85acfd19e1bb74
Upon execution, the sample phones back to:
Phones back to:
interviewbuy.ru /forum/document.doc
interviewbuy.ru /forum/load.php?file=0
interviewbuy.ru /forum/load.php?file=1
interviewbuy.ru /forum/load.php?file=2
interviewbuy.ru /forum/load.php?file=3
interviewbuy.ru /forum/load.php?file=4
interviewbuy.ru /forum/load.php?file=5
interviewbuy.ru /forum/load.php?file=6
interviewbuy.ru /forum/load.php?file=7
interviewbuy.ru /forum/load.php?file=8
interviewbuy.ru /forum/load.php?file=9
interviewbuy.ru /forum/load.php?file=ftpgrabber
interviewbuy.ru /forum/load.php?file=pokergrabber
interviewbuy.ru - 91.204.48.96 (AS24965); 124.217.248.229 (AS45839) Email: servman1976@yandex.ru
ZeuS crimeware activity at AS24965 (SPOINT-AS S.Point LTD) as well as SpyEye malicious activity is also observed.
This post has been reproduced from Dancho Danchev's blog. Continue reading →
01. Seven myths about zero day vulnerabilities debunked
02. Should a targeted country strike back at the cyber attackers?
03. 5 reasons why the proposed ID scheme for Internet users is a bad idea
04. Hotmail's new security features vs Gmail's old security features
05. Attack of the Opt-In Botnets
06. From Russia with (objective) spam stats
07. The current state of the crimeware threat - Q&A
08. Mac OS X SMS ransomware - hype or real threat?
09. 10 things you didn't know about the Koobface gang
10. Google-China cyber espionage saga - FAQ
This post has been reproduced from Dancho Danchev's blog. Continue reading →
02. AS50215 Troyak-as Taken Offline, Zeus C&Cs Drop from 249 to 181
03. The DNS Infrastructure of the Money Mule Recruitment Ecosystem
04. The Avalanche Botnet and the TROYAK-AS Connection
05. Koobface Gang Responds to the "10 Things You Didn't Know About the Koobface Gang Post"
06. Sampling Malicious Activity Inside Cybercrime-Friendly Search Engines
07. GazTransitStroy/GazTranZitStroy: From Scareware to Zeus Crimeware and Client-Side Exploits
08. Dissecting Northwestern Bank's Client-Side Exploits Serving Site Compromise
09. U.S. Treasury Site Compromise Linked to the NetworkSolutions Mass WordPress Blogs Compromise
10. TorrentReactor.net Serving Crimeware, Client-Side Exploits Through a Malicious Ad
This post has been reproduced from Dancho Danchev's blog. Continue reading →
From the "been there, actively researched that" department.
- Tracking Down Internet Terrorist Propaganda
- Arabic Extremist Group Forum Messages' Characteristics
- Cyber Terrorism Communications and Propaganda
- A Cost-Benefit Analysis of Cyber Terrorism
- Current State of Internet Jihad
- Analysis of the Technical Mujahid - Issue One
- Full List of Hezbollah's Internet Sites
- Steganography and Cyber Terrorism Communications
- Hezbollah's DNS Service Providers from 1998 to 2006
- Mujahideen Secrets Encryption Tool
- Analyses of Cyber Jihadist Forums and Blogs
- Cyber Traps for Wannabe Jihadists
- Inshallahshaheed - Come Out, Come Out Wherever You Are
- GIMF Switching Blogs
- GIMF Now Permanently Shut Down
- GIMF - "We Will Remain"
- Wisdom of the Anti Cyber Jihadist Crowd
- Cyber Jihadist Blogs Switching Locations Again
- Electronic Jihad v3.0 - What Cyber Jihad Isn't
- Electronic Jihad's Targets List
- Teaching Cyber Jihadists How to Hack
- A Botnet of Infected Terrorists?
- Infecting Terrorist Suspects with Malware
- The Dark Web and Cyber Jihad
- Cyber Jihadist Hacking Teams
- Two Cyber Jihadist Blogs Now Offline
- Characteristics of Islamist Websites
- Cyber Traps for Wannabe Jihadists
- Mujahideen Secrets Encryption Tool
- An Analysis of the Technical Mujahid - Issue Two
- Terrorist Groups' Brand Identities
- A List of Terrorists' Blogs
- Jihadists' Anonymous Internet Surfing Preferences
- Sampling Jihadists' IPs
- Cyber Jihadists' and TOR
- A Cyber Jihadist DoS Tool
- GIMF Now Permanently Shut Down
- Mujahideen Secrets 2 Encryption Tool Released
- Terror on the Internet - Conflict of Interest
Campaigns of notice include: spamvertised "Celebrities death-themed emails", "Fedex shipment status themed invoices", and "Office-themed documents".
Sample subjects:
Angelina Jolie died; Gwen Stefani died; Oprah Winfrey died; Tom Cruise died; Application; Thursday Journal Club; End Of Rotation; Abstracts; Project Declaration; Residency Happy Hour: SOP_POLICIES; Fwd: Updated Journal Club Handout
Sample attachments:
journal club articles.zip; Rotation Input Sheet.zip; ppi and c dif.zip; MSpeck.zip; ResidencyPrep.zip; speck Case presentation draft.zip; journal club template.zip
Detection rates, phone back URLs, and connections with previously profiled campaigns:
- news.exe - Trojan.Bredolab-993 - 40/ 43 (93.0%)
MD5: 44522def7cf2a42aa26f59c2ac4ced58
SHA1: 2f60531b6e33d842eba505f3c3cb81a3ff6e3e6a
- journal club articles.exe - Backdoor/Bredolab.edb - 41/ 43 (95.3%)
MD5: 72e90fd1264e731109d1b6b977b2c744
SHA1: 0a36b882d1b4d8b42cc466ec286e95bbb2e77d49
Upon execution, the samples phone back to:
188.65.74.161 /mrmun_sgjlgdsjrthrtwg.exe - AS42473 - DOWN
194.28.112.3 /outlook.exe - AS48691 - ACTIVE
- outlook.exe - TrojanSpy:Win32/Fitmu.A - 17/ 43 (39.5%)
MD5: 8f4eca49b87e36daae14b8549071dece
SHA1: 1d390e9f8d6e744ead58dd6c424581419f732498
Upon execution, the dropped sample phones back to:
cuscuss.com - 188.65.74.164 - Email: info@blackry.com
Responding to 188.65.74.164 at AS42473 are also:
wiggete.com - Email: info@blackry.com
depenam.com - Email: info@blackry.com
fishum.com - Email: info@blackry.com
blackry.com - Email: info@blackry.com
Two of the domains are know to have been serving client-side exploits, but the redirection is currently returning an error "Connect to 188.40.232.254 on port 80 ... failed".
- depenam .com/count22.php
- blackry .com/count21.php
- vseohuenno .com/trans/b3/ - 188.40.232.254 - Email: latertrans@gmail.com
Responding to 188.40.232.254, AS24940 are also the following command and control, client-side exploit serving domains:
gurgamer.com - (New IP: 86.155.172.30) Email: latertrans@gmail.com
moneybeerers.com - Email: latertrans@gmail.com
daeshnew.com - (New IP: 86.145.158.90) Email: latertrans@gmail.com
volosatyhren.com - Email: latertrans@gmail.com
vyebyvglaz.com - Email: latertrans@gmail.com
---------------------------------------------------------------------------------
- FedexInvoice_EE776129.exe - Win32/Oficla.LK - 41/ 43 (95.3%)
MD5: d4e2875127f5cbdf797de7f1417f96a7
SHA1: c2df8d8c178142ba7bee48dbf9a9f68c32a14f5e
Upon execution, the sample phones back to:
ilovelasvegas .ru/web/St/bb.php?v=200&id=636608811&b=24augNEW&tm= - 109.196.134.44, AS39150 - Email: vadim.rinatovich@yandex.ru with x5vsm5.ru - Email: vadim.rinatovich@yandex.ru also parked there.
Where do we know the vadim.rinatovich@yandex.ru email from? From two previously profiled campaigns "Spamvertised iTunes Gift Certificates and CV Themed Malware Campaigns"; and "Dissecting the Xerox WorkCentre Pro Scanned Document Themed Campaign" having a direct relationship with the Asprox botnet.
This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter. Continue reading →
This summary is not available. Please
click here to view the post.
Continue reading →
Subscribe to:
Comments (Atom)
RSS Feed