NoVirusThanks Blog

Phishing: Compromised Account (PayPal)

admin — Thu, 23 Feb 2012 11:11:46 +0000

We received another suspicious email that spreads a phishing URL:

The A HREF link redirects to the phishing URL:

hxxp:// restore.account.sysadmin-center .com/paypal/restore/webscrcmd=_login-run/webscrcmd=_account-run/confirm-paypal/restore=_paypal-account/updates-paypal/

Email header details:

Received: from main.pensativo.nl (main.benefiet.eu [141.138.139.44])
Received: from [202.175.132.8] (helo=administrator) by main.pensativo.nl with esmtpa (Exim 4.77)
From: "Paypal Department"
Subject: Compromised Account
Date: Thu, 23 Feb 2012 15:55:40 +1300
To: undisclosed-recipients:;

Phishing: Skype Incident Updating Your Information To the new security

admin — Thu, 16 Feb 2012 14:17:15 +0000

New phishing email used to steal Skype login details:

The A HREF link:

Please click here to verify your identity

Redirects users to the malicious URL:

hxxp://login.skype.com.kad-s .com/

Find out who visits your Facebook profile: it is a fake, the link redirects to malicious websites

admin — Tue, 14 Feb 2012 00:44:02 +0000

We have noted recently various messages posted by Facebook users that promote few methods to find out who visits your Facebook profile. At the end of the message there is a link to a Bit.ly shortened URL, as you can see from this image:

The shortened URL redirects the users to a malicious URL:

HTTP/1.1 301 Moved
Server: nginx
Date: Mon, 13 Feb 2012 23:18:08 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Set-Cookie: _bit=4f399a30-002d0-041e9-281cf10a;domain=.bit.ly;expires=Sat Aug 11 23:18:08 2012;path=/; HttpOnly
Cache-control: private; max-age=90
Location: hxxp:// pabulums .info/nukiy.bnw
MIME-Version: 1.0
Content-Length: 122

Extracted malicious URL:

hxxp:// pabulums .info/nukiy.bnw

Domain details:

The website pabulums .info is hosted at SingleHop and its current IP address is 184.154.106.126 (r90.servebyte.com). The server machine is located in – (-) and in the same server there are hosted other 1 websites. The domain is registered with the suffix INFO and the name pabulums. The organization is Servebyte.

URLVoid report:

http://urlvoid.com/scan/pabulums.info

When the malicious URL is visited, there is a new redirect:

HTTP/1.1 302 OK
Date: Mon, 13 Feb 2012 23:18:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 4.0.30319
Location: hxxp:// alexins .co.cc/170588/nukiy.bnw
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 786

Extracted malicious URL:

hxxp:// alexins .co.cc/170588/nukiy.bnw

Domain details:

The website alexins .co.cc is hosted at SingleHop and its current IP address is 184.154.106.125 (r90.servebyte.com). The server machine is located in – (-) and in the same server there are hosted other 1 websites. The domain is registered with the suffix CO.CC and the name alexins. The organization is Servebyte.

URLVoid report:

http://urlvoid.com/scan/alexins.co.cc

Remember to do not click in unknown URLs, posted by known and unknown Facebook users, even if they are in your friends list. Most of the Facebook virus can hijack with javascript the login session and they can automatically put “Likes” on malicious Facebook pages or they can post a message containing malicious link in your profile or in the profile of all your friends, so pay attention when you click with the mouse!

Malware: Cotacao solicitada (relatorio.scr)

admin — Sun, 12 Feb 2012 14:07:39 +0000

We have received a suspicious email:

Received: from unknown (HELO userb) (***@globaltires.es@177.0.120.119)
Subject: Cotacao solicitada.
MIME-Version: 1.0
Date: Sat, 11 Feb 2012 17:56:37 -0300

Email message is in HTML and the page source looks like:

As you can see, from this code:

relatorio1379-pdf. (63kb)

The A HREF link redirects the user to an external (malicious) website:

hxxp://groupnetvect .co.de

Domain details:

The website groupnetvect .co.de is hosted at Hetzner Online AG and its current IP address is 78.46.102.86 (www8.subdomain.com). The server machine is located in Germany (DE) and in the same server there are hosted other 1 websites. The domain is registered with the suffix CO.DE and the name groupnetvect. The organization is Hetzner Online AG.

URLVoid report:

http://www.urlvoid.com/scan/roupnetvect .co.de

HTTP response:

HTTP/1.1 302 Found
Date: Sun, 12 Feb 2012 13:01:07 GMT
Server: Apache
X-Powered-By: PHP/5.3.6
Location: hxxp:// consumer-electronics .junderhilltherapy .com//wp-content/themes/aurora/options-link.php
Vary: Accept-Encoding
Content-Length: 21
Content-Type: text/html; charset=iso-8859-1

The user is redirected again to another external (malicious) link:

hxxp:// consumer-electronics .junderhilltherapy .com//wp-content/themes/aurora/options-link.php

Domain details:

The website consumer-electronics .junderhilltherapy .com is hosted at HostDime.com and its current IP address is 66.7.193.50 (west.superdomainzone.com). The server machine is located in United States (US) and in the same server there are hosted other 1 websites. The domain is registered with the suffix COM and the name junderhilltherapy. The organization is HostDime.com.

URLVoid report:

http://www.urlvoid.com/scan/consumer-electronics .junderhilltherapy .com

HTTP response:

HTTP/1.1 200 OK
Date: Sun, 12 Feb 2012 13:03:05 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Content-Disposition: attachment; filename="relatorio.scr"
Connection: close
Content-Type: application/log

Now we can see that a file “relatorio.scr” is prompted to be downloaded:

File details:

File: relatorio_scr
Size: 23042 bytes
MD5: BFE2E1EB1C8780149C40FAE98C353BCA
SHA1: 4C69371B15E9738FC663A381C1841315FAC030A0
SHA256: 2DF1080C551E9603F2B8F197DE62D4A643B12BF31F6D3CEE47C0649037C51CF6
SHA384: E30FBFFAD035E7F35BA62B4C6689438ED9A66C3D2F494F4896387EE89C63E445F9AA07FF0D0BF4D1C84EAE282D3F5040
SHA512: 8D9D7B7D4FBF3ACBF984B88CB027D44E98EE997915E2823D61A882B1FDD6D7DD4F5630B518D2C602649D4D42D74DAF863804924D57AC30E8B0D33161D31F706C

The file is detected by Antivirus as Suspect.Trojan.Generic.FD-1 (ClamAV), Trojan-Banker.Win32.VB!IK (Emsisoft), Trojan-Banker.Win32.VB (Ikarus).

New Malicious Iframe Code, Trojan.Java.Downloader and VBScript

admin — Sat, 04 Feb 2012 18:01:41 +0000

Honeypots have reported another case of malicious iframe code that is generally added after the end of the HTML tag, at the end of the website page, as you can see from the image below:

We have also noted another website that redirects users to a fake porn video streaming website with the main objective to install a VBScript (using a Java applet downloader) in the user’s system and use cmd.exe to download and execute a keylogger:

hxxp:// habbo-sluts-exposed .tk

The URL uses an iframe code to redirect the users to another website:

Extracted malicious URL:

hxxp:// b0ss.getenjoyment .net/two/

And now, there is another redirect:


 
   Please wait while the application is loading...