The Multitasking Fast-Flux Botnet that Wants to Bank With You

The Multitasking Fast-Flux Botnet that Wants to Bank With You

From a Chase phishing campaign, to a bogus Microsoft update, and an exploit serving spam campaign using a "Who Killed Michael Jackson?" theme prior to his death (go through related Michael Jackson malware campaigns), to a currently ongoing phishing campaign impersonating the United Services Automobile Association (USAA), the gang behind this botnet has been actively multitasking during the past two months.

The spam message is as follows:
"Michael Jackson Was Killed... But Who Killed Michael Jackson? Visit X-Files to see the answer: MJackson.kilijj .com/x-files", upon clicking on it the user is redirected to two exploit serving domains - ogzhnsltk .com/plugins/index.php (94.199.200.125 Email: osaltik@windowslive.com); and dogankomurculuk .com/stil/index.php (91.191.164.100 - Email: by.yasin@msn.com).

Through the use of an Office Snapshot Viewer exploit the user is the exposed to a downloader (x-file-MJacksonsKiller.exe) which attempts to drop a copy of the Zeus malware from labormi .com/lbrc/lbr.bin (91.206.201.6). The following is an extensive list of the participating domains, as well as the currently active and fast-fluxing DNS servers part of the botnet:


List of participating domains:
kilij1 .com
ilkil1 .com
ilkifi .com
kili1j .com
kil1jj .com
ki1ijj .com
kikijj .com
k1lijj .com
kilijj .com
1ilikj .com
ilki1k .com
ilk1lk .com
i1kilk .com
ilkilk .com

kilij1 .net
ilkil1 .net
kili1j .net
kil1jj .net
ki1ijj .net
k1lijj .net
kilijj .net
1ilikj .net
ilki1k .net
ilk1lk .net
i1kilk .net
ilkilk .net
ilifi.com .mx
1ffli.com .mx
iljihli.com .mx
hhili.com .mx
hilli.com .mx
kiffil.com .mx

Michael Jackson related subdomains:
mjackson.ijjik1 .com
mjackson.ijjil1. com
mjackson.kjjil1 .com
mjackson.ikjil1 .com
mjackson.ijkil1 .com
mjackson.ijjkl1 .com
mjackson.ikilij .com
mjackson.ikklij .com
mjackson.ikilkj .com
mjackson.ikilfk .com

mjackson.ijjilk .com
mjackson.ijjill .com
mjackson.ijjik1 .net
mjackson.ijjil1 .net
mjackson.ikjil1 .net
mjackson.ijkil1 .net
mjackson.ijjkl1 .net
mail.ikilij .net
mjackson.ikilij .net
mjackson.ilifi .com.mx
mjackson.iljihli .com.mx
mjackson.hhili .com.mx
mjackson.hilli .com.mx

Microsoft related subdomains:
update.microsoft.com .h1hili.com
update.microsoft.com .ijlk1j.com
update.microsoft.com .hillij.com
update.microsoft.com .hillkj.com
update.microsoft.com .ikillif.net
update.microsoft.com .jikikji.net
update.microsoft.com .hillij.net
update.microsoft.com .hillik.net
update.microsoft.com .ikihill.net
update.microsoft.com .ilifi.com.mx
update.microsoft.com .iljihli.com.mx
update.microsoft.com .hilli.com.mx
update.microsoft.com .kiffil.com.mx

USAA.com related phishing subdomains:
www.usaa.com.kihhif .com
www.usaa.com.kihhih .com
www.usaa.com.kihhik .com
www.usaa.com.kihhil .com
www.usaa.com.kihhik .net
www.usaa.com.kihhil .net
www.usaa.com.hilli.com .mx
www.usaa.com.frtll.com .mx
www.usaa.com.mrtll.com .mx

DNS Servers of notice:
ns1.vine-prad .com
ns2.vine-prad .com
ns1.blacklard .com
ns1.fax-multi .com
ns2.fax-multi .com
ns1.rondonman .com
ns2.rondonman .com
ns1.host-fren .com
ns2.host-fren .com
ns1.hotboxnet .com
ns2.hotboxnet .com
ns1.free-domainhost .com
ns2.free-domainhost .com
ns1.sunthemoow .com

ns2.sunthemoow .com
ns1.high-daily .com
ns2.high-daily .com
ns1.otorvald .net
ns1.red-bul .net
ns2.red-bul .net
ns1.footdoor .net
ns1.bestdodgeros .net
ns2.bestdodgeros .net
ns1.azdermen .com
ns2.azdermen .com
ns1.departconsult .com
ns2.departconsult .com
ns1.torentwest .com
ns2.torentwest .com
ns1.downlloadfile .net
ns2.downlloadfile .net

Due to this botnet's involvement with several other malware campaigns of notice, as well as its evident connection with the ongoing monitoring of several particular cybecrime groups, analysis and updates will be posted as soon as they emerge.

Crimeware in the Middle - Adrenalin

Crimeware in the Middle - Adrenalin

What is Adrenalin? Adrenalin is an alternative to the Zeus crimeware kit that never actually managed to scale the way Zeus did. Following recently leaked copies of what is originally costing a hefty $3000, crimeware kit Adrenalin, it's time to profile the kit, discuss its key differentiation factors from Zeus, and emphasize on why despite the fact that it leaked, the kit is not going to take any of Zeus-es market share. At least not in its current form.

In the spirit of the emerging copycat web malware exploitation kits, Adrenalin too, isn't coded from scratch, but appears that -- at least according to cybercriminals questioning its authenticity on their way to secure a bargain deal when purchasing it -- Adrenalin is using portions of Corpse's original A-311 release.

Adrenalin's description and features :
"Injections system - inserting html / javascript code in the page / files / javascript or substitution of one code by another injection occurs in the stream mode, ie the modified page is loaded at once!
(not as in the other BHO based trojans with insertions only after the full load the page (causing javascript problems) or limiting the impact (if for instance the user is on a mobile device connection). In our implementation, all works quickly and efficiently!

- The collection of pieces of text from the html pages, as one of the modes of operation injector (balance, etc ..)

- Ftp grabbing - sniffer handles traffic and rip out from access to FTP. All of this is going in an easy to read and process the form

- Collector of certificates. Pulling out of all installed certificates including attempts to commit, and certificates that are marked as uncrackable. Certificates neatly stored for each individual bot.

- Page redirector. allows you to replace a page or separate framing in the network. everything is done completely unnoticed. substitution of the content occurs in the interior windsurfing, and even then the browser and any special lotion can be confident that is what you want.

- Domain redirector. forwards all requests from the original site on the fake. address bar, and all references point to the original course can also be used to block access to certain sites

- Universal form grabbing puller forms, can strip the data from the virtual keyboard these forms can rip off, even with not fully loaded pages. As distinguished from the other crimeware kits working through the tracking of users clicking buttons / links it intercepts the data has already been formed, which can be seen in the log. Data can be collected all the running, and keyword (filter)
to delete the logs; noise over debris to chat and not necessary for the work sites.

All data are transmitted in encrypted form, which is important to bypass the protection, like for instance ZoneAlarm's ID Lock. Undoubted advantage is also that the logs are sent instantly - in parallel with the data sent to the original site. No need to worry that the victim will go into an offline and accumulated locally log form grabbing are not able to send.

- Screenshots at the address
- TAN grabbing. The technology allows to effectively collect workers TANs
- Periodic cleaning of cookies/flashcookie.
- Grabbing around-the-forms words (without adjustment - Adrenalin defines its own algorithm that it must be collected. algorithm Improved!)
- The collection of passwords,  for instance Protected Storage (IE auto complete, protected sites, outlook)
- Classic keylogger
- Cleaning system from BHO trojans, advertising panels and other debris. As is well known - are less vulnerable machines, and want to put on something more. Cleaning system greatly increases the chances of survival
- Anti-Anti Rootkit mechanisms
- Work on the system without the EXE file
- User-friendly format logs! Forget the piles of files stupid!
- Socks4 / 5 + http (s) proxy server enabled on the infected host
- Shell + Backshell enabled on the infected host
- Socks admin
- Management of each bot individually, or simultaneously (Downloading files, updating settings, etc.)
- Requires PHP on the web based command and control host
- Ability to output commands (including downloads), taking into account the country's bot (function as a resident loader statistically for programs) - and other small pleasures"


Without the web injection and the TAN grabbing ability, Adrenalin is your typical malware kit, whose only differentiation factor would have been the customer support in the form of the managed undetected malware binaries that naturally comes with it. However, it's TAN grabbing ability, proprietary collection of data "around the forms", stripping content from virtual keyboards and automatic certificates collection on per host basis, and its ability to clean the system from competing BHO-based trojans, make it special.

How do you actually measure the popularity of crimeware kit? Based on the the market share of the crime kit, or based on another benchmark? It's all a matter a perspective and a quantitative/qualitative approach. For instance, I can easily argue that if the very same community was build around Adrenalin the way it was built around Zeus making the original Zeus release looks like an amateur-ish release, perhaps Adrenalin would have scaled pretty fast. Some of the community improvements include :

- Modified Zeus Crimeware Kit Comes With Built-in MP3 Player
- Modified Zeus Crimeware Kit Gets a Performance Boost
- Zeus Crimeware Kit Gets a Carding Layout

For the time being, the innovation or user-friendly features boosting the popularity of Zeus come from the third-party coders improving the original Zeus release. Moreover, not only are they improving it, they're also looking for vulnerabilities within the different releases, and actually finding some. What does this mean? It means that we have clear evidence of crimeware monoculture, with a single kit maintaining the largest market share.

With the cybercrime ecosystem clearly embracing the outsourcing concept for a while, it shouldn't come as a surprise, that botnets running the Zeus crimeware are offered for rent at such cheap rates that purchasing the kit and putting efforts into aggregating the botnet may seem a pointless endeavor in the eyes of a prospective cybercriminal, even an experienced one interested in milking inexperienced cybercriminals not knowing the real value of what they're doing.

Moreover, speaking of monetization, the attached screenshots represent a very decent example of monetizing the reconaissance process of E-banking authentication that cybercriminals or vendors of crimeware services undertake in order to come up with the modules targeting the financial institutions of a particular country. Is this monetization just "monetization of what used to be a commodity good/service" as usual taking into consideration this overall trend, or perhaps there's another reason for monetizing snapshots of E-banking authentication activities in order to later on achieve efficiency in the process of abusing them? But of course there is, and in that case it's the fact that no matter that a potential cybercriminal has obtained access to a crimeware kit, its database of injects is outdated and therefore a new one has to be either built or purchased.

With Adrenalin now leaked to the general script kiddies and wannabe cybercriminals, it's only a matter of time until a community is build around it, one that would inevitably increase is popularity and prompt others to introduce new features within the kit.

Help! Someone Hijacked my 100k+ Zeus Botnet!

Help! Someone Hijacked my 100k+ Zeus Botnet!

I've been looking for a similar chatter for a while now, given the existence of a remotely exploitable vulnerability in an old Zeus crimeware release allowing a cybercriminal to inject a new user within the admin panel of another cybecriminal.

It appears that this guy has had his 100k+ Zeus botnet hijacked several months ago, and now that he's managed to at least partly recover the number of infected hosts in two separate botnets, is requesting advice on how to properly secure his administration panel.

Here's an exact translation of his concerns :
"Dear colleagues, I'd like to hear all sorts of ideas regarding to security of Zeus. I've been using Zeus for over an year now, and while I managed to create a botnet of 100k infected hosts someone hijacked it from me by adding a new user and changing my default layout to orange just to tip once he did it. Once I fixed my directory permissions. I now have two botnets, the first one is 30k and the second (thanks to a partnership with a friend) is now 3k located at different hosting providers. 

Sadly, yesterday I once again found out that my admin panel seems to have been compromised since all the files were changed to different name, and access to the admin panel blocked by IP. Yes, that seems to be the IP the hijacker is using. The attacker has been snooping Apache logs in order to find IPs that have been used for logging purposes and blocked them all. Therefore I think the new user has been added by exploiting a flaw in Zeus. In my opinion a request  was made to the database, either through an sql injection in s.php a file or a request from within a user with higher privileges.

Since I've aplied patches to known bugs, this could also be a compromise of my hosting provider. So here are some clever tips which I offer based on my experience with securing Zeus. 

- Change the default set of commands, make them unique to your needs only. 
- If it is possible to prohibit the reading and dump tables with logs all IP, to allow only certain (so that the crackers were not able to make a dump and did not read the logs in the database). 
- If it is possible to prohibit editing of tables with all the commands of Zeus IP, to allow only certain (that could not be "hijacked", insert the command bots)"

Surreal? Not at all, given the existing monoculture on the crimeware market. Morever, yet another vulnerability was found in the Firepack web malware exploitation kit earlier this month (Firepack remote command execution exploit that leverages admin/ref.php). This exploit could have made a bigger impact in early 2008, the peak of the Firepack kit, which was also localized to Chinese several months later:

The FirePack Web Malware Exploitation Kit
The FirePack Exploitation Kit - Part Two
The FirePack Exploitation Kit Localized to Chinese

Ironically, cybercriminals too, seem to be using outdated versions of their crimeware.

Related posts:
Crimeware in the Middle - Adrenalin
76Service - Cybercrime as a Service Going Mainstream
Zeus Crimeware as a Service Going Mainstream
Modified Zeus Crimeware Kit Gets a Performance Boost
Modified Zeus Crimeware Kit Comes With Built-in MP3 Player
Zeus Crimeware Kit Gets a Carding Layout
The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw
Crimeware in the Middle - Zeus

Inside a Zeus Crimeware Developer's To-Do List

Inside a Zeus Crimeware Developer's To-Do List

Every then and now I get asked a similar question in regard to crimeware kits - which is the latest version of a particular crimeware/web malware exploitation kit?

The short answer is - I don't know. And I don't know not because I'm a victim of an outdated situational awareness, but due to the fact that nowadays third-party developers are so actively tweaking it that coming up with a version number would be inaccurate from my perspective. Therefore, whenever I provide such a version number, I try to emphasize and provide practical examples of how the current decentralization of coding from the core authors to third-party developers and, of course, scammers brand jacking the Zeus brand, is making the answer a little bit more complex than it may seem at the first place.

For instance, cybercriminals themselves have been capitalizing on this situation during the last two quarters, by speculating with the version numbers and offering backdoored copies of non-existent Zeus releases, in a attempt to hijack their Zeus botnets at a later stage -- a practice that phishers have been taking advantage of for a while. Anyway, once I'm able to sort of cluster a particular third-party developer's persistence in tweaking the Zeus crimeware kit, an interesting picture emerges. For instance, a team member from a third-party developer of backend systems for botnets that came up with the built-in MP3 player in a Zeus release, is also directly involved in developing the backend system and GUI for the Chimera botnet which the British Broadcasting Corporation purchased last month.

Let's discuss the way the version number system in the Zeus crimeware, before we take a peek at a recent CHANGELOG, and a future TO-DO list from one of the third-party developers. Zeus version a.b.c.d means that change in A stands for a complete change in the bot, B stands for major changes that make previous bot versions incompatible, C stands for modifications and performance boosting, and D is a prophylactic change in order to avoid antivirus solutions from detecting it.

The Q&A applied in Zeus can be easily seen by taking a peek at some of the changes that took place in December, 2008 :

"Change 10.12.2008
- Documentation will no longer be available in a CHM format, instead in a plain-text format
- The bot is a now able to receive commands not only by using the send command function, but also during requests for files and logs changes
- Local data requests to the server and the configuration file can be encrypted with RC4 key depending on your choice
- In order to decrease the load on the server, a fully updated bot-to-server and server-to-bot communication protocol is introduced

Change 20.12.2008
- Small error fixed when sending reports
- The size of the report cannot exceed 550 characters
- Error fixed in the bot due to low timeout for sending POST requests resulting in dropping requests for log files bigger than 1 MB

Change 2.03.2009
- Changed the default cryptor routines
- Updated process of building the bot
- Optimized compressed of the binary
- Rewritten the process of assembling the configuration file
- Changed the MyMSQL tables
- Fixed fonts in the panel due to bogus displaying of characters
- Updated Geolocation database"

The following "To-Do" list, pretty similar to another one which I discussed last year (A Botnet Master's To-Do List). What's to come in the Zeus crimeware kit, at least courtesy of a sampled third-party developer? The following features have been in the works for several months now:

"- Compatibility with Windows Vista and Windows 7
- Improved WinAPI hooking
- Random generation of configuration files to avoid generic detection"
- Console-based builder
- Version supporing x86 processors
- Full IPv6 support
- Detailed statistics on antivirus software and firewalls installed on the infected machines"

The Zeus crimeware is not going away from the radar anytime soon, and the main reason for that is not the fact that its exclusive features outperform the ones in the Limbo crimeware and the Adrenalin crimeware, but due to the fact that Zeus has a much bigger fan base, and well established third-party community around it.

Image courtesy of Abuse.ch's Zeus Tracker -- the one that got DDoS-ed in February due to its apparent usefulness.

Related posts:
Crimeware in the Middle - Limbo
Crimeware in the Middle - Adrenalin
Crimeware in the Middle - Zeus
76Service - Cybercrime as a Service Going Mainstream
Zeus Crimeware as a Service Going Mainstream
Modified Zeus Crimeware Kit Gets a Performance Boost
Modified Zeus Crimeware Kit Comes With Built-in MP3 Player
Zeus Crimeware Kit Gets a Carding Layout
The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw

View CC license • Digg This! • Stumble It! • Add to del.icio.us

Posted by Dancho Danchev at Wednesday, April 08, 2009  

Blackhat SEO Campaign Hijacks U.S Federal Form Keywords, Serves Scareware

Blackhat SEO Campaign Hijacks U.S Federal Form Keywords, Serves Scareware

During the past 24 hours, a blackhat SEO campaign has been hijacking U.S Federal Forms related keywords in an attempt to serve scareware.

What's particularly interesting about the campaign is that the Ukrainian fan club behind it -- you didn't even think for a second that there's no connection with their previous campaigns, did you? -- are using basic segmentation principles since the tax form keywords poisoning is attempting to hijack U.S traffic. Evasive practices are also in place through the usual http referrer check, which would only serve the scareware if the visitor is coming from Google.com, if not a 404 error message will appear.

Upon clicking on the link, the user is redirected through a centralized location responsible for managing the traffic from the thousands of subdomains/keywords used - honda-recycle .cn/go.php?id=2017&key=cbafb5cb2&p=1 - 83.133.123.113 Email: accabj@cn.accaglobal.com. Parked on the same IP are also related malware/scareware domains:

winsoftwareupdatev2 .com - Email: webmaster@kaity.or.kr
much-in-love .com - Email: krebikim@kanmail.net
i-dont-care-much .com - Email: krebikim@kanmail.net
malwareurlblock .com - Email: Qinrui971@hotmail.com
bennysaintscathedral .com - Email: gayaomila@yahoo.com
browsersecurityinfo .com - Email: visor@elcomtech.com
windowssecurityinfo .com - Email: arziw12@freebbmail.com
ringtone-radio .com - Email: bobbyer@iofc.org
events-team-manager .com - Email: krebikim@kanmail.net
1worldupdatesserver .com - Email: tapias.andres@hdtvspain.org
discovernewchina .cn - Email: leijun.ma@unifem.org
rollerskatesadvise .cn - Email: info@chinaeuropaforum.net
allfootballmanager .cn - Email: info@chinaeuropaforum.net
hardwarefactories .cn - Email: leijun.ma@unifem.org
besthockeyteams .cn - Email: info@chinaeuropaforum.net
gowildtours .cn - Email: leijun.ma@unifem.org

The malicious domains used -- with two exceptions -- are all parked at AltusHost Inc./ALTUSHOST-NET. Here's the complete list:
tebdigasbi .com - 91.214.44.205 - Email: martin94304@yahoo.com
kraijfaw .com - 91.214.44.240 - Email: argantael31869@msn.com
reychohica .com - 91.214.44.209 - Email: martin94304@yahoo.com
fequervo .com - 91.214.44.239 - Email: orla53111@hotmail.com
ukaszohat .com - 91.214.44.205 - Email: argantael31869@msn.com
buwrynko .com -  91.214.44.204 - Email: keallach84256@yahoo.com
fetholye .com - 91.214.44.208 - Email: martin94304@yahoo.com
pasbirrada .com - 91.214.44.204 - Email: martin94304@yahoo.com
dynodns.net - legitimate
thebbs.org - legitimate

The people behind the campaign have also taken contingency planning in mind since the scareware domain portfolio is parked on five different IPs - no-spyware-thanks .com - 94.102.48.29; 94.102.51.26; 188.40.61.236; 83.133.126.155; 91.212.107.5 Email: Paul.Saydak@lovellis.com. The complete list:

fast-scan-your-pcv3 .com - Email: info@valeros.com
basicsystemscannerv3 .com - Email: changhong@corpdefence.cn
antivirus-quickscanv5 .com - Email: diana1982@yahoo.com
basicsystemscannerv6 .com - Email: changhong@corpdefence.cn
basicsystemscannerv8 .com - Email: changhong@corpdefence.cn
privatevirusscannerv8 .com - Email: info@rasystems.com
spywarefastscannerv9 .com - Email: info@rasystems.com
online-pro-antivirus-scan .com - Email: findz@freebbmail.com
onlineproscan .com - Email: addworld@freebbmail.com
onlineproantivirusscan .com - Email: addworld@freebbmail.com
online-pro-scanner .com - Email: addworld@freebbmail.com
basicsystemscanner .com - Email: changhong@corpdefence.cn
onlineproantivirusscanner .com - Email: findz@freebbmail.com
iwantsweepviruses .com - Email: leesten@fedexnow.com

Two sampled scareware samples during the past 24 hours phone back to goldmine-sachs .com (Goldman Sachs typosquatting) - 83.133.122.211; 89.47.237.52 - Email: rodriguez.dallas@romehotels.com and to june-crossover .com - 83.133.123.109 - Email: doru@sattenis.com. In regard to 89.47.237.52, the "fan club" used it to host scareware in their June's campaigns.

AltusHost Inc./ALTUSHOST-NET is expected to take action shortly.

Koobface Botnet's Scareware Business Model

Koobface Botnet's Scareware Business Model

UPDATE1: TrendMicro just confirmed the ongoing double-layer monetization of Koobface. Meanwhile, the gang is rotating the scareware domains with new ones pushed by popup.php, followd by two recently updated Koobface components.

The new scareware domains kjremover .info; lrxsoft .info - 212.117.160.21 - Email: niclas@i.ua actually download it from the well known q2bf0fzvjb5ca .cn portfolio, which phones back to the same domains listed previously, with only a slight change in the filename - urodinam .net/8732489273.php. The generic detection rate for the updated components (61.235.117.83 /bin/get.exe; 61.235.117.83 /bin/v2webserver.exe) with get.exe phoning back to a domain parked at the takedown-proof, China-based 61.235.117.83, in particular gdehochesh .com/adm/index.php.
 
Just like Conficker, the Koobface botnet is no stranger to the scareware business model and the potential for monetization of the hundreds of thousands of infected hosts.

However, changes made in the campaign structure of the Koobface botnet during the last couple of days, indicate that the Koobface gang has embedded a pop-up at each and every host that's automatically rotation different scareware brands. They're now officially monetizing the botnet using a scareware business model.

Let's analyze the latest changes introduced by the Koobface gang over the last couple of days and emphasize on the monetization tactics introduced by the gang.

Next to insulting, showing gratitude, the Koobface gang also has a (black) sense of humor - within one of the directories at the takedown-proof command and control used by the gang in China (61.235.117.83; at 61.235.117.83/bin in particular) they've left the following message "2008 ali baba and 40, LLC". Ali Baba and the Forty Thieves is a 1944 film based on the original Ali Baba character.


Compared to previous campaigns relying on centralized command and control and redirection points -- making them easy to shut down -- the ongoing Facebook campaigns are dynamically redirecting to IPs within the Koobface network, which combined with their use of compromised legitimate sites is supposed to make the take down of their campaigns a bit more time consuming.

That's, of course, not the case since undermining their monetization approaches undermines the monetary value of their campaigns, which is what they're after this time. The Koobface gang has now embedded a single line within each and every infected host used in the campaign, in order to not only attempt to infect new visitors with the Koobface malware itself, but to also trick them into installing the scareware which is rotated as usual.

dangerWindAdr = 61.235.117.83/ popup.php loads on each and every Facebook spoof page part of the botnet and is then redirecting the most popular scareware template, the My computer Online Scan.

The first scareware domain used in the last 48 ryacleaner .info/hitin.php?affid=02979 (212.117.160.21l parked there as also eljupdate .info Email: niclas@i.ua and dercleaner .info Email: niclas@i.ua) was serving setup.exe which is downloading the actual scareware executable from mt3pvkfmpi7de .cn/get.php?id=02979 (220.196.59.23).

What's so special about this domain? It was last profiled in the A Diverse Portfolio of Fake Security Software - Part Twenty Three with the entire portfolio of .cn domains parked at the same IP registered under the same email - robertsimonkroon@gmail.com.

The second scareware domain pushed by the Koobface during the last 24 hours, gotrioscan .com/?uid=13301 - 91.212.107.103 - momorule@gmail.com redirects to plazec .info/22/?uid=13301 - 91.212.107.103 - Email: bebrashe@gmail.com where the scareware is served. Parked at the same IP is the rest of thescareware domains portfolio pushed by Koobface:

in5id .com
in5ch .com
goscanback .com
goscanlook .com
gofatescan .com
goeachscan .com
gobackscan .com
goironscan .com
gotrioscan .com
ia-pro .com
iantivirus-pro .com
iantiviruspro .com
windoptimizer .com
woptimizer .com
in5cs .com
wopayment .com
in5st .com
zussia .info
plazec .info
gaudad .info
voided .info
gelded .info
tithed .info
botled .info
tented .info
fatted .info
unowed .info
wzand .info
searce .info
prarie .info
meyrie .info

pittie .info
penvie .info
figgle .info
sawme .info
droope .info
haere .info
scarre .info
undeaf .info
adjudg .info
wiving .info
slatch .info

bedash .info
dolchi .info
sighal .info
devicel .info
knivel .info
freckl .info
scrowl .info
usicam .info
spelem .info
vagrom .info
numben .info
speen .info
krapen .info
atwain .info
declin .info
inclin .info
unclin .info
towton .info
grumio .info
stampo .info
extrip .info

polear .info
benber .info
kedder .info
erpeer .info
argier .info
fulier .info
lavyer .info
inquir .info
orodes .info
faites .info
beeves .info
quoifs .info
filths .info
broths .info
nevils .info
swoons .info
sallat .info
apalet .info

reglet .info
camlet .info
plamet .info
hownet .info
fosset .info
cuplift .info
raught .info
holdit .info
unroot .info
unwept .info
anmast .info
ticedu .info
outliv .info
onclew .info
froday .info
mayray .info
tenshy .info
steepy .info
miloty .info
debuty .info
fifthz .info
potinz .info
caretz .info
narowz .info

What do these two scareware executables have in common? Its the phone back locations that the Koobface gang is using, reveling its participation in a scareware affiliate network called Crusade Affiliates.

The first phone back location urodinam.net /dfgsdfsdf .php - 122.224.9.67 adds a .bat file which would attempt to obtain mshta.exe from urodinam.net/33t .php?stime=1253063118 on hourly basis. The second phone back location is the Crusade Affiliates network that shares revenue with the Koobface gang whenever a scareware pushed by the gang is purchased - crusade-affiliates .com/install.php?id=02979 - 85.17.139.149.

The third phone back location is a direct download attempt of FraudTool.Win32.SecretService; RogueAntiSpyware.PrivacyCenter.AJ from 0ni9o1s3feu60 .cn/u4.exe - 220.196.59.23. It's pretty evident that the Koobface botnet is now relying on multiple layers of monetization approaches.

The Koobface gang has been pretty during the last couple of days. The following list of Koobface malware spreading domains are in circulation across social networking sites since the last 48 hours, consisting of a combination of purely malicious and compromised legitimate sites:
3sss .com/youtube.com 
4bond .it/youtube.com 
ac2j .com/freeem0vies
aced1979 .freehostia.com/y0urfi1m
alexandrialocksmith .net/uncens0redvide0 
alpha.kei .pl/amalzlngfi1ms
alruwaithy .com/extrlmeperf0rmans
astoundeddesign .com/privaledem0nstrati0n
awwfuck .me/fuunnyacti0n
baddog.me .uk/uncens0redc1ip
bbckzoo .com/extrlmedwd 
bbckzoo .com/mmyperf0rmans 
be. la/freeefi1ms
bencaputoprinting .com/c00lfi1m 
bicentenario.sc49 .info/mmyfi1m
bighornrivercabins .com/c00lvlds
biskopsto .fo/fantasticm0vie
bloch-data .dk/c00lvlds
bokongerslev .dk/amalzlngm0vie 
bokongerslev .dk/extrlmeacti0n 
book-dalmose .dk/extrlmeperf0rmans
campionariadigalatina .it/youtube.com 
carlamo .com/extrlmec1ip
centerforyourhealth .com/extrlmem0vies 
centralbaptist.org .au/fantasticvide0

certtiletechs .com/fuunnym0vies
cisaimpianti .net/youtube.com 
claykelley .net/extrlmevlds 
claykelley .net/mmyvide0 
clubatleticigualada .com/y0urc1ip
connoro .com/bestsh0w
consignbuydesign .com/fuunnyttube
dkflyt .dk/mmytw
downingfarms .com/bestacti0n
eminfinity.com .au/amalzlngc1ips 
eminfinity.com .au/uncens0redsh0w 
endurancesportscar .com/extrlmem0vies 
epicent .dk/pub1icfi1m 
evaracollin .be/mmyfi1ms
exceleronmedical .com/amalzlngc1ips 
exceleronmedical .com/c00lperf0rmans 
exceleronmedical .com/privalettube/?youtube.com
finolog .com/privalem0vie
fitslim .com/fantasticdem0nstrati0n
gacogop .org/fuunnyc1ips
gamlabodens .se/privaletw 
garagedoorsnow .com/meggadem0nstrati0n
garlicworld .com/mmym0vie 
garlicworld .com/uncens0redperf0rmans

gcillustration .com/extrlmevide0 
germanamericantax .com/pub1icm0vie 
happyholidaychristmastrees .com/uncens0redperf0rmans
horaexata.com .br/c00lc1ip
huffmanfarms .com/fantasticfi1ms
imagequest360 .com/fantasticm0vies 
inartdesigns .com/extrlmevide0
interception .dk/mmyttube
kalender.sttmedia .se/amalzlngdem0nstrati0n 
kartingclubsourdsnamur .be/besttw
kiding.users.digital-crocus .com/mmym0vies
kloerfem .dk/amalzlngsh0w
kracl .com/freeesh0w
kreativdizajn .com/amalzlngvlds
ktvsongs .com/pub1icacti0n 
lonestargcs .com/mmydwd
losangelesfurniture .com/fantasticdem0nstrati0n
lr-online .dk/c00lfi1ms 
lr-online .dk/y0ursh0w 
marketmarkj .com/privalem0vies
martinhorngren .com/privalettube 
meetingpacket .com/youtube.com 
microscoop .net/fantasticttube
momentsbypat .com/pub1icm0vie
mtn-ejendomme .dk/mmyacti0n
nadiottawa .org/pub1icc1ips
naestved-sportscollege .dk/amalzlngacti0n
nicalandnow .com/uncens0redvlds
odyssey-consultants .com/amalzlngvide0 
odyssey-consultants .com/mmym0vie 
onlyfun .se/extrlmec1ip
pridesoccer .com/privalec1ips
quicksilver-direct .com/amalzlngfi1m 
reddoorchina .com/mmyvlds 
relivery .com/extrlmesh0w
ristorocasanova .it/youtube.com 
sanfranciscocookie .com/fantasticfi1ms
sarkos .ch/fuunnyperf0rmans
saudiclubs .org/fantasticvlds
sauipeswimwear .com/c00lm0vie
schoolofhiphop .no/freeefi1ms
senegalinfoservices .com/bestacti0n

squashigualada .com/extrlmevlds
starcraftdream .com/fuunnyvlds
stm.frihost .org/freeefi1m
stringer .no/uncens0redacti0n
sttmedia .se/fantastictw 
taia.com .br/uncens0reddwd
thefurniturewarehouse .net/mmym0vies
theidusshop .com/pub1ictw
thepinflow .com/meggash0w
thorsen-meyer .dk/bestc1ips
tivity .dk/amalzlngm0vie 
tivity .dk/fantasticfi1ms 
tizianamaniezzo .com/fantasticc1ips 
tohva .org/bestacti0n
troop270 .nwsc.org/fuunnydwd
txmurphys .com/c00lfi1m 
tybjerglillebakkervand .dk/privalem0vie
vagnpfisk .dk/privalem0vie
vivaipirovano .com/youtube.com 
xanchise .com/c00lc1ip
yurafting .com/amalzlngvlds

Sampled Koobface binary now phones back to bianca.trinityonline .biz/.sys/?action=ldgen&v=14 and bianca.trinityonline .biz/.sys/?action=ldgen&a=590837698&v=14&l=1000&c_fb=0&c_ms=0&c_hi=0&c_tw=0&c_be=0&c_tg=0&c_nl=0. 69.163.147.203 - Email: email@darrenjames.net, with the latest Koobfae update modules detected as follows - 61.235.117.83 /bin/v2prx.exe; 61.235.117.83 /bin/pp.12.exe

The "Koobface botnet and the 40 cybercriminals" (2008 ali baba and 40 , LLC) have not just started monetizing the infected hosts, they're using multiple layers of monetization to do so.

The Ultimate Guide to Scareware Protection

The Ultimate Guide to Scareware Protection

Throughout the last two years, scareware (fake security software), quickly emerged as the single most profitable monetization strategy for cybercriminals to take advantage of. Due to the aggressive advertising practices applied by the cybercrime gangs, thousands of users fall victim to the scam on a daily basis, with the gangs themselves earning hundreds of thousands of dollars in the process.

This end user-friendly guide aims to educate the Internet user on what scareware is, the risks posed by installing it, how it looks like, its delivery channels, and most importantly, how to recognize, avoid and report it to the security community taking into consideration the fact that 99% of the current releases rely on social engineering tactics.