Thursday, July 30, 2009

Social Engineering Driven Web Malware Exploitation Kit

The standardization through template-ization of bogus codec/flash player/video pages, taking place during the past two years, has exponentially increased the efficiency levels of malware campaigns relying exclusively on social engineering.

Just like phishing pages being commodity, these commodity spoofs of legitimate software/plugins relying on "visual social engineering" represent a market segment by themselves, one that some cybercriminals have been attempting to monetize for a while.

Case in point - their latest attempt to do so comes in the form of the first social engineering driven web malware exploitation kit.

Despite that the kit's author has ripped off a well known exploits-serving malware kit's statistics interface, what's unique about this release is the fact that the exploit modules come in the form of "Missing Flash Player", "Outdated Flash Player", "Missing Video Codec", "Outdated Video Codec", "Codec Required" modules.

These very same modules represent the dominant social engineering attack vector on the Internet due to the quality of the spoofs and the end users' gullibility while self-infecting themselves. For the time being, the author appears to be an opportunist rather than someone interested in setting new benchmarks for standardization social engineering by using the efficiency and delivery methods offered by a web malware exploitation kit.

Interestingly, a huge number of fake codec serving web sites are already detecting the OS/Browser of the visitor, and serving Mac OS X based malware or Windows based malware based on the detection. This fact, as well as the fact that visual spoofs of OS X like dialogs are also getting template-ized are not a coincidence - it's a signal for an efficient and social engineering driven malware delivery mechanism in the works. The development of the kit will be monitored and updates posted - if any.

Meanwhile, the recent blackhat SEO campaign which attempted to hijack 'Harry Potter and the Half-Blood Prince' related traffic is a good example on how despite the magnitude of the campaign -- hundreds of thousands of indexed and malware serving pages -- due to the manual campaign management, its centralized nature makes it easier to shut down.

Upon clicking on a link, the end user was redirected to usa-top-news .info - - Email:, then to world-news-scandals .com Email:, and finally to tubesbargain .com/xplay.php?id=40018 - - where the codec was served from exefreefiles .com - - Email:  More coded serving domains are parked on the same IPs:
sunny-tube-world .com - Email:
the-blue-tube  .com - Email: - Email:
thecooltube .com - Email:
etesttube .com - Email:
thegrouttube .com - Email:
fllcorp .com
exe-load-2009 .com - Email:
exefiledata .com - Email:
exereload .com - Email:
load-exe-world .com - Email:
cool-exe-file .com - Email:
last-home-exe .com - Email:
exefreefiles .com - Email:
boardexefiles .com - Email:
exeloadsite .com - Email:

The gang maintains another domain portfolio with pretty descriptive nature for phone back, direct fake codec serving purposes:
agro-files-archive .com
alkbbs-files .com
all-tube-world .com
best-light-search .com
besttubetech .com
chamitron .com
cheappharmaad .com
dipexe .com
downloadnativeexe .com
ebooks-archive .org
etesttube .com
exedownloadfull .com
exefiledata .com
exe-paste .com
exe-soft-development .com
exe-xxx-file .com
eyeexe .com
go-exe-go .com
greattubeamp .com
green-tube-site .com
hotexedownload .com
hot-exe-load .com
imagescopybetween .com
isyouimageshere .com
labsmedcom .com
last-exe-portal .com
lost-exe-site .com
lyy-exe .com
main-exe-home .com
mchedlishvili .name
metro-tube .net
my-exe-load .com
newfileexe .com
protectionimage .com
robo-exe .com
rube-exe .com
securetaxexe .com
softportal-extrafiles .com
softportal-files .com
storeyourimagehere .com
super0tube .com
super-exe-home .com
supertubetop .com
sysreport1 .com
sysreport2 .com
testtubefilms .com
texasimages2009 .com
thecooltube .com
thegrouttube .com
thetubeamps .com
thetubesmovie .com
tiaexe .com
tube-best-4free .com
tube-collection .com
tvtesttube .com
yourtubetop .com

Who's behind these domains and the Harry Potter blackhat SEO campaign? But, "of course", it's the "fan club" with the Koobface connection, continuing to use the same phone back locations that they've been using during the past couple of months - myart-gallery .com/senm.php - - Email:; robert-art .com/senm.php - - Email:; superarthome .com/senm.php - - Email:

This post has been reproduced from Dancho Danchev's blog.

Wednesday, July 29, 2009

5th SMS Ransomware Variant Offered for Sale

"Your system has been blocked because it is running a pirated copy of Windows. In order to unblock it, enter the activation code sent to you by SMS-ing the following number."

Demand and emerging business models based on micro-payment ransom meet supply, with yet another SMS-based ransomware variant offered for sale ($25). Just like in previous underground market propositions, this one comes with a value-added service in the form of managed undetected binaries on a daily basis for an extra $5 for an undetected copy. It's worth pointing out that due to the customization offered, their original layouts and the error messages will look a lot different once their customers get hold of the ransomware.

Key features include:
- protecting against repeated infection through Mutex
- pops-up on the top of all windows
- disables safe mode, as well as possible key combinations attempting to bypass the window
- adds itself as a trusted executable/excluded one in Windows Firewall
- variety of non-intrusive auto-starting/executable injecting capabilities
- Rotx encryption for the activation codes
- ability to embedd more than one activation code
- monitors and automatically blocks process names of tools that could allow removal
- complete removal of the code from the system once the correct activation code is entered
- zero detection rate of a sampled binary -- of course the advertiser is biased and he didn't bother including reference to the service he used (Virustotal, etc.)

Despite several isolated cases where the originally Russian-based ransomware is affecting international English-speaking users, the campaigns are primarily targeting Russian speaking users -- at least for the time being until the malware authors or their customers start localizing it. This emerging micro-payment ransomware business model is the direct result of largely unregulated market segments allowing literally anyone to get hold of a premium and automatically managed number in order to facilitate it.

Related posts:
4th SMS Ransomware Variant Offered for Sale
3rd SMS Ransomware Variant Offered for Sale
SMS Ransomware Source Code Now Offered for Sale
New ransomware locks PCs, demands premium SMS for removal

This post has been reproduced from Dancho Danchev's blog.

Monday, July 27, 2009

A Diverse Portfolio of Fake Security Software - Part Twenty Three

Part twenty three of the diverse portfolio of fake security software series, will once again summarize the scareware domains currently in circulation, delivered through the usual channels - blackhat SEO, compromises of legitimate web sites, comment spam and bogus adult web sites, with an emphasis on a yet another bogus company acting as a front-end to an affiliate network - AK Network Commerce Ltd.

Scareware remains the dominant monetization tactic applied by cybercriminals automatically abusing Web 2.0 properties.

The latest scareware domains are as follows:
scanyourcomputeronlinev1 .com -;;;; - Email:
promalwarescannerv2 .com - Email:
spywarefolderscannerv2 .com Email:
antivirusscannerv10 .com - Email:
scanyourcomputeronlinev1 .com - Email:
folder-antivirus-scanv1 .com - Email:
personalfolderscanv2 .com - Email:
spywarefolderscannerv2 .com - Email:
privatevirusscannerv2 .com - Email:
secure-antivirus-scanv3 .com - Email:
bestfoldervirusscanv3 .com - Email:
antispyware-scannerv3 .com - Email:
liveantimalwarescannerv3 .com - Email:
onlinespywarescannerv3 .com - Email:
onlineantivirusscanv4 .com - Email:
onlineantispywarescanv6 .com - Email:
antivirus-scannerv6 .com - Email:
antivirusonlinescanv9 .com - Email:
antimalwarescannerv9 .com - Email:
antispywarescannerv9 .com - Email:
bestcomputerscanv7 .com - Email:

in5id .com - - Email:
goscantune .com - Email:
in5ch .com - Email:
goscanback .com - Email:
goscanlook .com - Email:
gotunescan .com - Email:
gofatescan .com - Email:
gobackscan .com - Email:
goparkscan .com - Email:
in5st .com - Email:
gagtemple .info - Email:
strelyk .info - Email:
mixsoul .info - Email:
loacher .info - Email:
unvelir .info - Email:
lendshaft .info - Email:

goironscan .com - - Email:
metascan4 .com - Email:
notescan4 .com - Email:
genscan4 .com - Email:
scanlist6 .com - Email:
goscanpark .com - Email:
gobackscan .com - Email:
gomapscan .com - Email:
scan4gen .com - Email:
namearra .info - Email:
xtraroom .info - Email:
sundalet .info - Email:

privacy-centre .org - - Email:
prvacy-centre .org - Email:
privacy-centar .org - Email:
prvacy-centar .org - Email:
privacy-ceter .org - Email:
prvacy-ceter .org - Email:
privacy-center .org - Email:
prvacy-center .org - Email:
privacy-centor .org - Email:
privacy-centr .org - Email:
prvacy-centr .org - Email:
pcenter56 .com
privacyupdate447 .com - Email:
pcenter57 .com

personalonlinescanv3 .com - - Email:
antivirusfolderscanv5. com - Email:
antivirusfolderscannerv5 .com - Email:
privatevirusscannerv5 .com - Email:
antivirusforcomputrerv5 .com - Email:
spywarefastscannerv6 .com - Email:
antimalwarescanv7 .com - Email:
antimalwareproscannerv8 .com - Email:
antimalwareproscannerv9 .com - Email:
antivirusscannerv9 .com - Email:
advanedspywarescan .com - Email:
securedvirusscan .com - Email:
secured-virus-scanner .com - Email:

free-spyware-cleaner .com - - Email:
free-spyware-checker .org - Email:
fast-spyware-cleaner .org - Email:
clean-pc-now .org - Email:
spyware-scaner .com - Email:
free-spyware-cleaner .com - Email:
free-tube-orgasm .net - Email:
free-spyware-cleaner .net - Email:
clean-pc-now .net - Email:
spyware-killer .biz - Email:

protectionsystemlab .com -;
ez-scanner-online .com
smart-antivirus-online .com
uptodatesystem .com
checks-files-now .com
download-filez-now .us
files-download-now .net
check-files-now .net

antispyware2009 .com -
remover .org
antispyware  .com
regsweep .com
registryclear .com
adwarebot .com

cleanmalwarefree .com - - Email:
killlabs .com - Email:
cleanmalwarefast .com - Email:
cleanmalwareeasy .com - Email:

adware-2010 .com -
adware-2009.comantispyware2013 .com -;
antispyware2012 .com
securityscanweb .com - - Email:
securitytestavailable .com - - Email:
liveantivirusinfov2 .com -; - Email:
antivirus-scannerv9 .com - Email:
purchuaseonlinedefence .com - - Email:
purchuaseliveprotection .com - Email:

windowssecurityinfo .com - - Email:
antimalwarescanner-v2 .com - Email:
maliciousbaseupdates .com - Email:
ieprotectionlist .com - Email:

personalcleaner2009 .com - - Email:
ak-networkcommerce .com - Email:
pc-antimalwaresuite .com - Email:
basepayment .com - Email:

Sampled malware phones back to od32qjx6meqos .cn/ua.php, more phone back locations are also parked there:
0ni9o1s3feu60 .cn - - Email:
mf6gy4lj79ny5 .cn - Email:
84u9wb2hsh4p6 .cn - Email:
7bs5nfzfkp8q8 .cn - Email:
kt4lwumfhjb7a .cn - Email:
q2bf0fzvjb5ca .cn - Email:
rncocnspr44va .cn - Email:
t1eayoft9226b .cn - Email:
4go4i9n76ttwd .cn - Email:
kzvi4iiutr11e .cn - Email:
hxc7jitg7k57e .cn - Email:
mt3pvkfmpi7de .cn - Email:
fyivbrl3b0dyf .cn - Email:
z6ailnvi94jgg .cn - Email:
p7keflvui9fkl .cn - Email:
f1uq1dfi3qkcm .cn - Email:
p0umob9k2g7mp .cn - Email:
7zju2l82i2zhz .cn - Email:

One of the latest front-ends to scareware affiliate networks is AK Network Commerce Ltd (ak-networkcommerce .com) :

"Implementing latest anti-hacker technology based on expert and user reviews AK Network Commerce Ltd enables hacker-proof defense, blocks unauthorized access to your private information, and hides your identity. Having combined latest features of cutting-edge privacy protection technologies our knowledgeable team designed products to easily and effectively fight perilous cyber attempts. Thorough selection and step-by-step application of elements and tools required for comprehensive protection of your personal data helped us achieve success and become industry leading representatives. We did our best to prove that the time has come to leave behind worries about private data theft."

The company is the very latest attempt of a bogus company to build legitimacy into their "latest anti-hacker technology". Meanwhile, the blacklisting , sample distribution, and shutting down the scareware domains not only undermines the effectiveness of their largely centralized malware campaigns, costs them missed revenue projections, but also, it increases the opportunity costs for the gang.

Related posts:
A Diverse Portfolio of Fake Security Software - Part Twenty Two
A Diverse Portfolio of Fake Security Software - Part Twenty One
A Diverse Portfolio of Fake Security Software - Part Twenty
A Diverse Portfolio of Fake Security Software - Part Nineteen
A Diverse Portfolio of Fake Security Software - Part Eighteen
A Diverse Portfolio of Fake Security Software - Part Seventeen
A Diverse Portfolio of Fake Security Software - Part Sixteen
A Diverse Portfolio of Fake Security Software - Part Fifteen
A Diverse Portfolio of Fake Security Software - Part Fourteen
A Diverse Portfolio of Fake Security Software - Part Thirteen
A Diverse Portfolio of Fake Security Software - Part Twelve
A Diverse Portfolio of Fake Security Software - Part Eleven
A Diverse Portfolio of Fake Security Software - Part Ten
A Diverse Portfolio of Fake Security Software - Part Nine
A Diverse Portfolio of Fake Security Software - Part Eight
A Diverse Portfolio of Fake Security Software - Part Seven
A Diverse Portfolio of Fake Security Software - Part Six
A Diverse Portfolio of Fake Security Software - Part Five
A Diverse Portfolio of Fake Security Software - Part Four
A Diverse Portfolio of Fake Security Software - Part Three
A Diverse Portfolio of Fake Security Software - Part Two
Diverse Portfolio of Fake Security Software

This post has been reproduced from Dancho Danchev's blog.

Wednesday, July 22, 2009

Koobface - Come Out, Come Out, Wherever You Are

UPDATE2: New binaries are hosted at web.reg .md/1/pdrv.exe; web.reg .md/1/pp.10.exe and at web.reg .md/1/fb.49.exe.

UPDATE: The Koobface gang is upgrading the command and control infrastructure in response to the positive ROI out of the takedown activities. This of course doesn't mean that enough evidence on "who's who" behind Koobface and a huge percentage of the currently active malware campaigns targeting Web 2.0 properties hasn't been gathered already.

Especially now that it's apparent we know each other's names. A recent Koobface update includes the following message: (thanks to TrendMicro for pinging me) : 

We express our high gratitude to Dancho Danchev ( for the help in bug fixing, researches and documentation for our software.

The ROI of several abuse notices during the weekend, quick response from China's CERT which took care of (thanks Patrick!), and Oc3 Networks & Web Solutions Llc abuse team which took care of the Koobface activity at -- cgpay-re-230609 .com still responds to the IP -- looks pretty positive and managed to increase the opportunity cost for the Koobface gang since it caused them some troubles during the weekend.

With Koobface worm's Twitter campaign currently in a stand by mode due to the publicity it attracted, as well as the fact that the central redirection points used in the campaign are down, let's assess the current Koobface hosting infrastructure, with an emphasis on UKSERVERS-MNT (AS42831) which stopped responding to abuse notifications as of Sunday.

How did the Koobface gang/fan club responded to the downtime anyway? By introducing several new domains, and parking them at - UKSERVERS-MNT (AS42831), whose abuse department remains unreachable ever since.

Following the first abuse notice sent to UKSERVERS-MNT the company temporarily closed the account ( of the "customer", then brought it back online. Asked why, they responded that the "customer" claimed he's been compromised and that he needs to clean up the mess and secure the server.  In reality that means "give us some time to smoothly update DNS records and migrate operations now that all of our command and control locations are offline".

Since they presumed I don't take lying personally, half an hour later I checked again and the Koobface command and control servers were operational again. The company forwarded the responsibility to the customer and said they closed down the account.

However, what the Koobface gang did was to register a new domain and use it as Koobface C&C again parked at the same IP, which remains active - zaebalinax .com Email: - - in particular zaebalinax .com/the/?pid=14010 which is redirecting to the Koobface botnet. Two more domains were also registered and parked there, u15jul .com and umidsummer .com - Email: which remain in stand by mode at least for the time being.

Upon execution the Koobface binary phones back to upr0306 .com/achcheck.php; upr0306 .com/ld/gen.php ( and attempts to download upload.octopus-multimedia .be/1/pdrv.exe; upload.octopus-multimedia .be/1/pp.10.exe.

UKSERVERS-MNT (AS42831) is also known with its connections to malware campaigns, as well as having hosted a domain ( part of a Photobucket malvertising campaign.

Related posts:
Dissecting Koobface Worm's Twitter Campaign
Dissecting the Koobface Worm's December Campaign
Dissecting the Latest Koobface Facebook Campaign 
The Koobface Gang Mixing Social Engineering Vectors

This post has been reproduced from Dancho Danchev's blog.

Thursday, July 16, 2009

From Ukraine with Bogus Twitter, LinkedIn and Scribd Accounts

Could a dysfunctional abuse department facilitate cybercrime? Appreciate my rhetoric with an emphasis on Layered Technologies, Inc.

Exactly one month ago, the Ukrainian gang that I've been extensively monitoring due to their apparent involvement in literally each and every malware campaign targeting Web 2.0 properties -- that's of course next to the Koobface connection in general -- intensified their automatic abuse of Twitter, Scribd and LinkedIn using plain simple social engineering tactics.

Since the campaign seems to be ongoing, it's time to spill some coffee on their latest scareware domains, see how the campaign's quality degraded upon notifying the affected parties, and emphasize on the fact that since Layered Technologies, Inc. abuse department wasn't available for comment prior to this post, the Ukrainian "fan club" continues using their services.

Bogus Twitter accounts serving scareware part of their campaign:
twitter .com/carmenelectrapn
twitter .com/LilKimUncensord
twitter .com/KimKardashian11
twitter .com/KateWinsletNude
twitter .com/DeniseRichardsK
twitter .com/KendraWilkinso1
twitter .com/CHristinaRicciN
twitter .com/Shakira_nude

twitter .com/BritneySpears11
twitter .com/PamelaAnderson0
twitter .com/kimkardashian3
twitter .com/BritneySpearse
twitter .com/LindsayLohannn
twitter .com/KatieHolmesNud
twitter .com/LilKimUncensord
twitter .com/britneyspearst
twitter .com/LindsayLohanee
twitter .com/JenniferLovew
twitter .com/AnnaFarisNnude
twitter .com/MileyCyrusnud
twitter .com/carmenelectrasx
twitter .com/adulttrishstrat

As in previous campaign, their redirectors continue working -- excluding oymomahon .com which is down -- and serving newly typosquatted scareware domains. For instance showmealltube .com/fathulla/13.html (; which is exclusively used on all the bogus accounts redirects to myhealtharea .cn/in.cgi?14 (;, again Layered Technologies, Inc.

The same goes for the second domain, delshikandco .com/paqi-video/30.html ( Email: (multiple scareware domains registered under the same email) as well as another redirector maintained by them used in previous campaign, ntlligent .info/tds/in.cgi ( also both hosted at Layered Technologies, Inc..

The new scareware domains used in the first redirection:
nusecurityshields .com - - FakeAlert-WinwebSecurity.gen
besecurepctrue .com
wesecurepcs .com
securityverpcs .com
allsecuredpcshields .com
myrealsecuritys .com
realsecurityspot .com
allentruesecurity .com

The second redirection leads to thetubesmovie .com/xplaymovie.php?id=40012 - - Email: where onlinemovies.40012.exe (Trojan.Crypt.ZPACK.Gen) is served, which upon execution phones back to myart-gallery .com/senm.php?data= ( Email:; robert-art .com/senm.php?data= ( Email:; and superarthome .com/senm.php?data= ( Email: Yet another redirector at showmeall-tube-xx .com/xtube.htm - - Email: attempts to download more scareware from showmeall-tube-xx .com/setup.exe - Trojan:Win32/Winwebsec.

Parked on are also: - Email: - Email: - Email: - Email: - Email: - Email: - Email: -

The newly registered Scribd and LinkedIn accounts also point to these very same domains. Bogus Scribd accounts -- approximately a thousand -- participating in the campaign:
scribd .com/Eva_Mendes%20naked
scribd .com/Kim_Kardashian%20sex%20tape%20free
scribd .com/Nude%20wrestling
scribd .com/KimKardashianSex%20Tape
scribd .com/BritneySpears%20Sex%20Tape
scribd .com/HollyMadison_Naked
scribd .com/Free%20Animal%20Sex%20Videos
scribd .com/Emma%20Watson%20kissingsomeone
scribd .com/Paris%20Hilton%20%20sex%20tape
scribd .com/Ellen%20degeneresgay
scribd .com/Gallery%20of%20Lindsay_Lohan
scribd .com/Amy_Smart%20nude
scribd .com/Stacy_Keibler%20in%20a%20bikini
scribd .com/Jennifer%20Aniston%20sexiest1
scribd .com/HelenMirren%20nudity
scribd .com/Vida_Guerra%20butt
scribd .com/Paris%20Hilton%20in%20bed

scribd .com/Paris%20Hilton%20sex%20video
scribd .com/Paris%20Hilton%20%20movie
scribd .com/ParisHiltonnaked1
scribd .com/Jessica%20Rabbitadult

scribd .com/Maria_Kanellis%20playboy
scribd .com/Anna_Nicole_uncensored
scribd .com/Kim+Kardashian%20sex%20video
scribd .com/keeleyhazellsextape
scribd .com/Britney-Spears-womanizer2
scribd .com/BRITNEY%20SPEARS%20DESNUDA%201
scribd .com/JenniferLopez%20desnuda
scribd .com/BritneySpears%20comix
scribd .com/MUJERES%20NEGRAS%20DESNUDAS%201
scribd .com/John%20Cena's%20%20dick
scribd .com/Hilary%20Duff%20naked%201

scribd .com/MaribelGuardia%20desnuda
scribd .com/Jessica%20Simpsonnude

scribd .com/Amanda-Bynes-nip-slip1
scribd .com/Tara-Reid-desnuda1
scribd .com/Jessica%20Albanude
scribd .com/Mujeres%20famosas%20%20desnudas
scribd .com/AngelinaJolie%20Naked
scribd .com/Lindsay_Lohan%20naked
scribd .com/Niurka_Marcos%20desnuda

scribd .com/INGRID%20CORONADO%20DESNUDA%201
scribd .com/NINEL%20CONDE%20DESNUDA1

scribd .com/Paris%20Hilton%20movie%201
scribd .com/Free%20Kim%20Kardashian%20%20Sex%20%20Tape
scribd .com/Pamela%20anderson%20nude
scribd .com/Vanessa-Williams-Penthouse-pictorial2
scribd .com/Natalie%20Portman%20sunbathing%201
scribd .com/Anne%20Hathaway%20naked%201
scribd .com/Stacy_Keibler%20nude
scribd .com/Scarlett_Johansson%20galleryx

Bogus LinkedIn accounts participating in the campaign:
linkedin .com/pub/anneliese-van-der-pol-nude/14/150/371
linkedin .com/pub/disney-s-raven-symone-nude/14/150/604
linkedin .com/pub/jennifer-love-hewitt/13/ab6/396
linkedin .com/pub/free-nude-celebs/14/6b/65b
linkedin .com/in/nudetubee
linkedin .com/in/nudepics2
linkedin .com/in/freenudecelebrities1
linkedin .com/in/nudecelebrities1
linkedin .com/in/nudephotos1
linkedin .com/pub/nude-art/14/6b/6a

The statistics from two of the URLs showcase how the campaign scaled due to the number of bogus accounts, and they virtually disappeared upon notifying the affected parties which removed the accounts in less than an hour. The gang keeps making a point that I made a while ago - a single group can dominate the entire Web 2.0 threatscape, automatically if they want to.

This post has been reproduced from Dancho Danchev's blog.

4th SMS Ransomware Variant Offered for Sale

Locking down an infected Windows-based host and demanding a premium rate SMS message for the unlock code (SMS Ransomware Source Code Now Offered for Sale; New ransomware locks PCs, demands premium SMS for removal; 3rd SMS Ransomware Variant Offered for Sale), is slowly becoming a trend, that despite its current geographical prevalence evident in Russia, it could easily become an international issue due to the cost-effective localization services available on demand these days.

Yet another SMS-based ransomware variant is offered for sale ($10), making this the 3rd such variant available for purchase during the past couple of months. The author appears to be a Moscow-based opportunist, clearly interested in making a quick buck and lacking any long-term ambitions - at least for the time being. Despite that the message and the visual interface can be changed on request, the default version is once again insisting that Microsoft locked down this copy of Windows because it detected it as pirated copy, and in order to unlock it the user has to send an SMS in order to receive the unlock code.

What bothers me is not the potential "spread-ibility" of his campaigns that is if he turns into a user of his own code, but how easily and cost-effectively his customers can push the ransomware to a huge number of already infected malware hosts.

This post has been reproduced from Dancho Danchev's blog.

Wednesday, July 15, 2009

Dissecting Koobface Worm's Twitter Campaign

My "fan club" is at it again - abusing Web 2.0 in an automated fashion. A new Koobface variant, modified by a Cyrillic-aware cybercriminal going under the handle of "floppy" -- it has also been injected within legitimate sites -- has started using Twitter as a distribution channel for the group as of last week.

Hundreds of users infected with Koobface and using Twitter, are now automatically tweeting links to their followers in an attempt by the Koobface gang -- evidence on my fan club's involvement keeps popping up like mushrooms -- to abuse the much more insecure micro-blogging service in comparison with their original traffic acquisition Facebook, where they had to adapt and outsource the CAPTCHA-solving process.

The Twitter campaign is different in the sense that the Koobface serving URLs generate random strings in an attempt to defeat generic detection which is still possible due to the template-ization of malware serving sites.

The Koobface serving links themselves are a combination of purely malicious and compromised legitimate web sites, serving a slightly modified fake YouTube page, and using a well known -- maintained by the fan club -- command and control/redirector domains (119.110.107 .137/redirectsoft/go/tw.php; 61.235.117 .71/redirectsoft/go/tw.php) found in their previous campaigns. This particular campaign provided factual evidence on the direct connection between the group and several Twitter, LinkedIn and Scribd malware campaigns, where scareware and Koobface variants were served.

The following is a complete list of the Koobface URLs used in the Twitter campaign:
64.37.106 .170/myfilm/
66.206.9 .169/privateaction/index.php
asachi.evolink .ro/bestdvd/
aspompierul.zzl .org/freeperformans/
aspompierul.zzl .org/publicclips/ w4ITQ
bodegasjalisco .com/bestfilms/
brentsmusic .com/publicaction/
cadcam.tecnoceram .it/privatedvd/
carolslinks .com/fantastictube/
caruso89.netsons .org/bestaction/ .com/uncensoredvids/ .my/besttube/
chriscubed .com/cooldemonstration/
costafarilya .com/extrimetv/ .ua/extrimevids/
dalaa3.110mb .com/extrimeaction/
deathschildren .com/extrimeclips/ .au/megatube/
download.rmes .ru/uncensoredclip/
dplive.webserwer .pl/besttv/
dramat.ilive .ro/extrimeclips/

filipicsr .biz/youtube/
flaviusrize .com/uncensoredclips/index.php
gandhiinternational. in/extrimetv/
igorbrasil .com/freetv/
itprospecialists .com/cooldvd/
kawalkimp3.yoyo .pl/yourtv/
kuzmi4.110mb .com/yourshow/index.php
lemujeme .cz/myshow/
lepk.yoyo .pl/privatevids/
matt.freehost .pl/privatefilms/ .ua/extrimedemonstration/
oceanacompany .com/bestvids/
oceanacompany .com/yourshow/
piuk-chow .dk/megafilms/
promo-door .ru/mymovie/
rksrouby .cz/funnyaction/
sekurpaslanmaz .com/amaizingdvd/

sekurpaslanmaz .com/bestfilms/
siam9 .com/bestfilms/
siam9 .com/coolclip/
siam9 .com/publicmovies/
skywebupload.freeweb7 .com/funnyclips/
srbijafest .org/privatefilm/
subject.freehost .pl/extrimefilms/
subject.freehost .pl/publicvids/
supreeme .com/megademonstration/
teatrall.dramat.ilive .ro/extrimeclips/

tenminutemedia .com/funnyclip/
thegoodhand .com/yourmovie/
thelambda.php5 .cz/privatemovies/
tinyurl .com/l48o9v
webxtreme.evolink .ro/uncensoredtube/
wiedzmin06.lua .pl/myvids/ .mx/megafilm/
yarentextil .com/funnyvideo/ .tr/yourvideo/
zoomtox .com/youtube/

Interestingly, I was able to take a peek at the statistics used exclusively for the Twitter campaign on two of the command and control/redirectors domains maintained by the gang. The results? Thankfully, pretty modest as you can see in the attached screenshots.

What all of these URLs have in common are the Koobface command and control/redirector (r-d-cgpay-090709 .com/go/tw.php) domains that they point to, including several new additions prior to their original ones described in previous posts.

Command and control domains sharing the same IPs -;;;
upr0306 .com - Email:
red-dir-cgpay-0307 .com
cgpay-re-230609 .com
r-d-cgpay-090709 .com
rjulythree .com
trisem .com - Email:
uprtrishest .com - Email:
uthreejuly .com
rd040609-cgpay .net
newcounters .cn - Email:
rd040609-cgpay .net
r2606 .com
er20090515 .com
redir2404 .com
wn20090504 .com - Email:
redir0705 .com
redir0805 .com
er20090515 .com

On the these very same command and control domains, we can also also seen Koobface worm's captcha7.dll component in action:
rd040609-cgpay .net/cap/?a=get&i=1&v=7
upr0306 .com/cap/?a=get&i=2&v=7
rjulythree .com/cap/?a=get&i=3&v=7
uthreejuly .com/cap/?a=get&i=4&v=7
er20090515 .com/cap/?a=get&i=0&v=7 

In this particular case, obtaining the CAPTCHA image from nua06032009 .biz/cap/temp - Email:

A complete list of command and control domains courtesy of FireEye, is once again emphasizing on the fact that the Koobface gang may be aware of each and every malicious traffic acquisition tactic there is, but has centralized their infrastructure making it easy to deal with it.

Who's providing them with the hosting infrastructure? - China Beijing Chinanet Jiangsu Province Network - United States Los Angeles Oc3 Networks & Web Solutions Llc - Russian Federation Limit-surehost-ip/UK Dedicated Servers Limited - China Shenzhen China Railcom Guangdong Shenzhen Subbranch - Malaysia Kuala Lumpur Tm Net Sdn Bhd

Compared to the money they make out of scareware, since they diversify on multiple revenue-generation fronts, they money they pay for the anti-abuse hosting looks like pocket change.

Related posts:
Dissecting the Koobface Worm's December Campaign
Dissecting the Latest Koobface Facebook Campaign 
The Koobface Gang Mixing Social Engineering Vectors

Ukrainian "fan club" and the Koobface connection:
Dissecting a Swine Flu Black SEO Campaign
Massive Blackhat SEO Campaign Serving Scareware
From Ukrainian Blackhat SEO Gang With Love
From Ukrainian Blackhat SEO Gang With Love - Part Two
From Ukraine with Scareware Serving Tweets, Bogus LinkedIn/Scribd Accounts, and Blackhat SEO Farms
Fake Web Hosting Provider - Front-end to Scareware Blackhat SEO Campaign at Blogspot

This post has been reproduced from Dancho Danchev's blog.

Wednesday, July 08, 2009

Transmitter.C Mobile Malware in the Wild

A currently spreading mobile malware known as Transmitter.C (sexySpace.sisx; MD5: 3e9b026a92583c77e7360cd2206fbfcd), has brandjacked a legitimate application in an attempt to infect the initial number of devices that would later on further disseminate it by aggressively SMS-ing messaged to the web site hosting it - megac1jck .com ( Email:

Upon execution it drops the following files in an attempt to infect S60 3rd Edition devices:
"c_sys\bin\Installer_0x20026CA6.exe"-"c:\sys\bin\Installer_0x20026CA6.exe", FR, RI, RW
"c_sys\bin\AcsServer.exe"-"c:\sys\bin\AcsServer.exe", FR, RI

What's sad is that just like the majority of mobile malware incidents, this one is also digitally signed using a certificate issued by Symbian to the name of XinZhongLi Kemao Co. Ltd or vendor name "Play Boy".

The sample (Sexy Space or SYMBOS_YXES.B) has been distributed to vendors, and the ISP hosting it has been informed.

Related posts:
Proof of Concept Symbian Malware Courtesy of the Academic World
Commercializing Mobile Malware
Mobile Malware Scam iSexPlayer Wants Your Money
SMS Ransomware Source Code Now Offered for Sale
3rd SMS Ransomware Variant Offered for Sale

This post has been reproduced from Dancho Danchev's blog.

Tuesday, July 07, 2009

Legitimate Software Typosquatted in SMS Micro-Payment Scam

Operating since 2008, the fraudulent tactics applied by Soletto Group, S.A also known as Netlink Network Corp, greatly remind of those applied by Interactive Brands also known as IBSOFTWARE CYPRUS; IB Softwares and most recently Euclid Networks Ltd -- you have to appreciate the irony here since they too multitask on multiple fronts through their official phone number since 2007 -- in particular their massive typosquatted domain farms where they'd would change and repeatedly charge without permission once someone falls victim into the fraudulent practice.

What Soletto Group, S.A or Netlink Network Corp (phone (0) 2071939823) does differently is the use of micro sms payment scam having operated the SMS numbers 78881 and 81039 in the past in order to offer a download service for legitimate software in the following way:


Who's typosquatted anyway? Pretty much each and every popular piece of software there is. From Kaspersky, NOD32, Malware Bytes, Avira, AVAST, BitDefender, to Firefox, BitTorrent, Microsoft Office, Winzip, Winrar, and Internet Explorer - for starters.

Here's a complete list of their domains farm, with hosting services courtesy of Rapidswitch Ltd:

nod32soft .info
malware-bytes .info
www-avasthome .com
www.www-avasthome .com
kaspersky-full .info
www-kaspersky .info
malware-bytes .info
www.avira-antivir .info
bitdefender-plus .info
office2007-full .info
sopcast-full .info
lphant-plus .info

adobeacrobat-plus .info
bitcomet-plus .info
bitdefender-plus .info
bittorrent-plus .info
elisoft-plus .info
mediaplayer-plus .info
messenger-msn-9 .com
messenger-msn-9 .info
messenger-msn-9 .org
messenger-msn .org
messenger-plus .net
moviemaker-plus .info
msn-messenger-9 .com
msn-messenger-9 .info
msn-messenger-9 .net
msn-messenger-9 .org
openoffice-plus .info
photoscape-plus .info
sopcast-plus .info
utorrent-plus .info
3gpconverter-plus .info
3gpconvertersoft .info
ares-2008 .org
ares-2009 .com

ares-2009 .net
ares-net .org
avira-net .info
bitcomet-plus .info
bitorrent .cc
bittorrent-net .info
bittorrent-plus .info
direct-x .cc
divx-player-plus .info
e-mule .nu
elisoft-plus .info
emule-2008 .net
emule-proyect .info
emulenet .net
iexplorer-full .info
iphonefull .com
javaruntime .net
lyrics2 .me
malware-bytes .info
mediaplayer-full .info
mediaplayer-plus .info
mesengerplus .org
messenger-9 .net
messenger-plus .net
messenger-soft .info

moviemaker-plus .info
msn-messenger-9 .net
msn-messenger-9 .org
nero-2008 .com
nerohome .net
nod-32 .net
nod32-net .info
openoffice-plus .info
photoscape-plus .info
photoscapesoft .info
pspvideo9 .info
sorpresor .com
spybotsearch-full .info
utorrent-net .info
virtualdj-soft .info
vlc-full .info
vvinrar .com

vvinrar .info
winamp-2009 .net
winamp .ws
windows-movie-maker .info
winrar-2008 .com
wiinzip .info
cdburnerxpsoft .info
www-emule .us
ultradefrag .us
bearflix .us
guitar-pro .us
messenger-2009 .us
emule-telecharger .us
aresnet .us
emulenet .us
emulepro .us
nerohome .us
vvinrar .us
aresfull .us
avastt .us
biaze .us
e-bitdefender .us

e-bitorrent .us
e-mule .us
flrefox .us
messengerhome .us
utorent .us
utorren .us
winzipp .us
cccpcodecs .org
ares-2008 .org
pdf-creator .org
limevvire .org
mesengerplus .org
w-ares .org
w-emule .org
www-3gpconverter .org
www-advanced .org
www-emule .org
www-messenger .org
www-realplayer .org
www-windowsmediaplayer .org
ares-3 .org
ares-net .org
chroome .org
emule-pro .org
messenger-msn-9 .org

A similar fraudulent Google AdWords scheme was exposed and taken care of in January. The fraudster back then was using a legitimate third-party revenue sharing toolbar installation program which was bundled within the legitimate software. In Soletto Group, S.A's case they aim to cut any intermediaries on their way to generate profit.

Rapidswitch Ltd has been informed of Soletto Group, S.A's brandjacking activities.

This post has been reproduced from Dancho Danchev's blog.