BREAKING DOMAINs: www.itsdc.org Infected with: Trojan.JS.Blacole.Gen (United States)

This must be a Professional Skill and...

The Following Links and Domains (in blue) are BREAKING BAD TO MALWARE:

DOMAIN:

www.itsdc.org

• https://www.virustotal.com/de/url/d796f7b73d0965aa9de5875b2e257913ea2b0e303e7835432b1fcb0f57894c69/analysis/1389956959/

• https://urlquery.net/report.php?id=8864865

• http://zulu.zscaler.com/submission/show/3938a7a0a7ef602cfae59a8b94e2fada-1389956985

---------------------------------------------

www.itsdc.org/js/jquery.prettyPhoto.js

• https://www.virustotal.com/de/url/d600215636481f986c6e1fc8c8a6019b223364533b8844336ec1a97d8a44fe47/analysis/1389957763/

INFECTED: Trojan.JS.Blacole.Gen

• https://www.virustotal.com/de/file/9b9df85fd11cdb66f7dc3fb2d0f9fa0909992b46beff5e227b9d4b0fcda1a4b7/analysis/1389957587/

---------------------------------------------
 
www.itsdc.org/js/jquery-ui-1.5.2.packed.js

• https://www.virustotal.com/de/url/07481a03983a69c4213b393196a280e7dbf4c0a810c0dfcc2784756204e22a46/analysis/1389958201/

INFECTED: JS/Exploit-Blacole.ml

• https://www.virustotal.com/de/file/5222c0f0f6ab51af52a2733673222a80499033774e194d0f58d827ca90d7afbf/analysis/1389958031/

---------------------------------------------
 
www.itsdc.org/js/jquery.validate.js

• https://www.virustotal.com/de/url/926fd3bbe47f7c17818f7d825c6c40183d34341ed8921f089bd44151f8b8e3a9/analysis/1389958385/

INFECTED: JS/Exploit-Blacole.ml

• https://www.virustotal.com/de/file/f4e388638ccd349bb9a4804dc7522af53d80b052a6018018e885555bae8e952a/analysis/1389958386

---------------------------------------------
 
www.itsdc.org/js/png.js

• https://www.virustotal.com/de/url/e14f6a474b5ee97ae17809b3d568a70fc291de0af1db831617d6208d4cb023ee/analysis/1389958540/

INFECTED: HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/2a404dcb1dae86fd3596f9820fc136554da26e05703fd4059e197822c3490082/analysis/1389958624/

---------------------------------------------

www.itsdc.org/js/jquery.easing.1.1.1.js

• https://www.virustotal.com/de/url/d5a1643eb8bb43181a8fb78b101134402b498c47bdc0eabca41424f343e441a1/analysis/1389958774/

INFECTED: JS:Agent-CPV [Trj]

• https://www.virustotal.com/de/file/ef9101bb998f16c720f4017f2e4058f10518c313cd0904a6b4ac9c661566a6c6/analysis/1389958776/

---------------------------------------------

www.itsdc.org/js/script.js

• https://www.virustotal.com/de/url/7905060a766e0415c594658494650b55853982fbd8ecf6c37aec1c885ca16a9a/analysis/1389958984/

INFECTED: HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/b9f7dbfaac24018e00168704b6dc1bf9fe291aadc0d003229b1d6f7964ec97c2/analysis/1389958986/

---------------------------------------------

www.itsdc.org/js/cufon.js

• https://www.virustotal.com/de/url/ca57d1ed1977c3697dbeb89d8f2a2e6ac26142a02d2024571b5677542c03762a/analysis/1389959036/

INFECTED: HEUR:Trojan.Script.Generic


• https://www.virustotal.com/de/file/e0d7f2bc9e768d7f1ba82b658a195c3c572ec6dac52361c5b416be9da456e05a/analysis/1389959040/

---------------------------------------------
 
www.itsdc.org/js/jquery.cycle.all.min.js

• https://www.virustotal.com/de/url/dbacef70c0d2d51f82e9301b6a3586dd5d77f446ced88cc439228c52893ecceb/analysis/1389959128/

INFECTED: Trojan.JS.Blacole.Gen

• https://www.virustotal.com/de/file/dcd205df4791b88a15430626db103a400c0627960fcdd2ff47a98a2dda2f1da3/analysis/1389959130/

---> DESTINATION
 
www.ferristree.com.au/viberson-back/56RZR8ck.php?id=21743511

• https://www.virustotal.com/de/url/938d25ed6403d2f9cc1ff517aa5bbaddd841f6d292666f525af969903f447820/analysis/1389959565/

INFECTED: HEUR:Trojan.Script.Generic


• https://www.virustotal.com/de/file/3d1ea90bc4b4a4516d37152dc721608bc1256ad48cc4b3a0e3871efd74c99687/analysis/1389959400/

• https://www.virustotal.com/de/file/13cdae6b3d3cfc1281cdb99753dab2fc584bc9120351b9ceb8ce6dc66a63be95/analysis/1389959422/

• http://jsunpack.jeek.org/?report=06721d01e8bf3de21abf75bd5ca8c1e4a89d41f9

---------------------------------------------

... maybe someone wants to notice those 3 (without face(book), wondering why...?) that their Site is infected...


 
DOMAIN ferristree.com INFECTED:
 
www.ferristree.com.au

• https://www.virustotal.com/de/url/cae9435a93d607c734227e6f4687b7c5315a60f1aa849af781088df3a9c6f811/analysis/1389960189/

INFECTED: HEUR:Trojan.Script.Generic


• https://www.virustotal.com/de/file/c893a3d264485f69596365a9d0006dd7cf2ea2c524851355bcda9d0139a70b62/analysis/1389960100/

• https://urlquery.net/report.php?id=8865038

• http://jsunpack.jeek.org/?report=e4c2e9fda049f5ba96f585233250acd794a4f985

---------------------------------------------

www.ferristree.com.au/js/jquery.js

• https://www.virustotal.com/de/url/a94b49a8d55485b3d4eb23bec856b1aa4cc9ade8ae39db98b898426ff789902e/analysis/1389960262/

INFECTED: HEUR:Trojan.Script.Generic


• https://www.virustotal.com/de/file/e2f1d06f4551c9f4b403f64dcaef284e7999ee0f4555f469d6902f3517a58217/analysis/1389960320/

---------------------------------------------

www.ferristree.com.au/js/img_on.js

• https://www.virustotal.com/de/url/7ae0c27906e5e5f2124b167685d8a85b30f1444b2c9f3401dd626e1d3fa01962/analysis/1389960627/

INFECTED: Trojan:HTML/Redirector.DW

• https://www.virustotal.com/de/file/022ce5fdf7ba14c6d1e2efe480d0586e016f134c2a5f91a505adaa1c4f13a65c/analysis/

---> DESTINATION
 
ida.es/etiquetas/ZwWhK2AF.php?id=21060826

• https://www.virustotal.com/de/url/fe914a0b3d52d37a29ec926981f359dba668ab824e8211042ba8c070c8bd98c4/analysis/1389971027/

INFECTED: HEUR:Trojan.Script.Generic


• https://www.virustotal.com/de/file/409b4c585342aa93a289b4f2d10c01da8889511b7bc0239c78ce8eae0a959571/analysis/1389970629/

---------------------------------------------

...Integration of developed Applications. WOW ! Sounds great...


DOMAIN ida.es INFECTED: EXPLOIT REDKIT
 
ida.es

• https://www.virustotal.com/de/url/127f82997623325f90a92a86fb4dbb4fc4a4b7e0fee2f6e1fb7ef705f29ada67/analysis/1389960923/

INFECTED: HEUR:Trojan.Script.Generic


• https://www.virustotal.com/de/file/e0b6f3ee2acc8918c950bcd88d36e94d21148aaa843cd312487b8fe37a0c4f4c/analysis/1389971978/

• https://urlquery.net/report.php?id=8865115

---> PATTERN


...and Chilling. Isn`t it ? The better it is...

dekostube.net/images/3MWDJlIz.php?id=21457000

• https://www.virustotal.com/de/url/e43b4a9d200694a7db7e9670447bd9bbdae3ba0d943d56beef5ee9493601876f/analysis/1389972387/

• https://www.virustotal.com/de/file/effa29283c16682404074ae8e600fbfe512ddce86dd99f49ec7d73715e8833f3/analysis/

--->





...the worser it gets !



safelist-retire.com/mhsn.html?h=757898

• https://www.virustotal.com/de/url/8401ec62af7ea2eaff810973cbb53843cfe2ca37214b3d847132501863a28a7a/analysis/
• https://www.virustotal.com/de/file/92133aa8467bcddd785c66777a97785635fe0217f896297e2e09816a147c56ec/analysis/

EXPLOIT RedKit

• https://urlquery.net/report.php?id=8866156

SUSPICIOUS PDF File

ida.es/DocumentosPdf/EtiquetasElectronicas.pdf

• https://www.virustotal.com/de/url/79840998e517a3cd16f9a1dd6c1d8cb9bedf5fea3ce726665d0e4bdb738c8a30/analysis/1389973163/
• https://www.virustotal.com/de/file/dc3a5b8fffcb624a5ac8446ff4f9aec8cdeb9e6e88bb0f7436529631d6cea9b1/analysis/1389973169/

---------------------------------------------

DOMAIN dekostube.net INFECTED:

dekostube.net

• https://www.virustotal.com/de/url/2aaefbf20ee0bdfcff1891fdf2de19f229e3fc6936680160d027443ff9c2e475/analysis/1389961175/

EXPLOIT LANDING PAGE

• https://urlquery.net/report.php?id=8865136

--->


safelist-retire.com/mhsn.html?h=757898

• https://www.virustotal.com/de/url/8401ec62af7ea2eaff810973cbb53843cfe2ca37214b3d847132501863a28a7a/analysis/

OTHER MALICIOUS DOMAINS INVOLVED:


adscendmedia.com

• https://www.virustotal.com/de/url/32b0db6874108d5093e977abac99128c8002145d81f5dc757257fba66db05bff/analysis/1389970800/

www.logixcoder.com

• https://www.virustotal.com/de/url/eb156f3b4bcb961194bf65bcc11038a3fa3e2da7729776ee6e0577346b7e3dfb/analysis/1389971337/

g.owest.net

• https://www.virustotal.com/de/url/cf77607d3b3d7b8a326d67085950159bf642743dab6bc483bbfa598a4c5c1185/analysis/1389961517/

An asset is a resource controlled by the entity as a result of past events and from which future economic benefits are expected to flow to the entity.

My reply to "them":  IDIOTS !