EXPLOIT DotKaChef: gmc.yoyogames.com infected (IP: 78.129.174.221) United Kingdom

MALICIOUS URL (DOMAIN): EXPLOIT DotKaChef

DOMAIN:

http://gmc.yoyogames.com/

• https://www.virustotal.com/de/url/12e5110e14db3ce65d9aaf36b49b9384c72b562ce1064580ecb8e049d51768e5/analysis/1393259505/

HTML

• https://www.virustotal.com/de/file/1a95707e9ea74da8b9199ac18b76548e4890d278a541e51384cb1d24b2008e9f/analysis/1393259871/

SPECIFIC LINK:

http://gmc.yoyogames.com/index.php?showtopic=479246

• https://www.virustotal.com/de/url/93917974f72f15f40bb77746b50bbd3993b4ea2ed5987ed985044afc42293dfc/analysis/1393259414/

HTML

• https://www.virustotal.com/de/file/d8178b94ffba61ff7365005c105aadd795c7f2872c94fb4a0db0461ec4ddf7fd/analysis/

--->

DOMAIN:

http://alnera.eu/

• https://www.virustotal.com/de/url/d56d95917506e3446ed65d011174cf24dee73b9812fac409112c5c7b785bb2d4/analysis/1393260526/

EXPLOIT LANDING PAGE

http://alnera.eu/B1D7AA56.js?cp=gmc.yoyogames.com

• https://www.virustotal.com/de/url/af2c5eddfbfc5a4873cd9e8f463992b4537e5b16410d01070cad5c665b51c8d3/analysis/1393249461/

AND OTHERS....RANDOMLY (POSSIBLY)

• https://urlquery.net/report.php?id=9628606

• https://urlquery.net/report.php?id=9628608

• https://urlquery.net/report.php?id=9628612

• https://urlquery.net/report.php?id=9630211

• https://urlquery.net/report.php?id=9630215

Possible Redkit 1-4 char JNLP request

• https://urlquery.net/report.php?id=7843788

DotkaChef EK initial landing from Oct 02 2013 mass-site compromise EK campaign

• https://urlquery.net/report.php?id=6995999

FOR MORE ON THIS TREAT, SEE:
http://community.websense.com/blogs/securitylabs/archive/2014/02/03/dotkachef-exploit-kit-comeback.aspx

Weitere Informationen dieses Exploits finden Sie unter dem folgenden Link:
http://www.datev.de/portal/ShowPage.do?pid=dpi&nid=159813