Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: Vulnerabilityqueerprocessbrittleness - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Vulnerabilityqueerprocessbrittleness


No, I didn't make that title up. Someone else did. "vulnerabilityqueerprocessbrittleness . in" is currently one 600+ domains that link to a quite prevalent "Fake Anti-virus" malware campaign. Currently, the domains associated to this scam all point to web servers hosted in the 204.152.214.x address range, but of course the threat keeps "moving around" as usual.

The attackers show lots of "creativity" with their domain names

crashessafetypc. in
keepprotectcare. in
microsoftkeeper. in
hazardactivitytasks. in
hazardon-linekeeper. in
highrisksprotection. in

though they don't seem to have attended Marketing 101 yet, because some of the names appear to be less than ideal...:

keepperfomanceworms. in
dangerwreckguarantor. in
highfail-safetykeeper. in
optimizerwreckdeliverer. in

The current set of threats involves frequently changing malware EXEs (or EXEs inside of ZIPs) with low coverage on virustotal. The download URLs usually follow the pattern of http://bad-domain. in/16 character random hex string/setup.exe or /setup.zip

Example: http://fail-safetytestingcontrol. in/fc1a9d5408b7e17d/setup.exe

Stay safe .. and keep your PCs free of the dangerwreckguarantor!

Daniel

367 Posts
ISC Handler
Question: Is the campaign in the form of SPAM? Or a pop-up? Or...? How dos the campaign get the user to click on the URL typically?
Anonymous
Time for scorched-earth policy. A few rounds of banks "approving" credit card transactions but not actually sending any money along with blacklisting the class C of anybody hosting these should do it.
Anonymous
The URLs also sometimes include another numeric directory in the path, such as:

http:// detectionshieldverify.in / 16digit hex / 123 / setup.zip

So far we've seen 1 to 3 digits used.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!