Web Security And Awareness towards Cybercriminals: Category MALICIOUS DOWNLOADS

Posts mit dem Label Category MALICIOUS DOWNLOADS werden angezeigt. Alle Posts anzeigen

4/30/2014

down.360safe.com with Win32/Trojan.Genome:
MALICIOUS DOMAIN FROM CHINA
IP: 180.153.229.17 Shanghai & IP: 220.181.150.209 Beijing

CHINESE (Shanghai & Beijing)
MALWARE DOMAIN: & SUSPICIOUS FILE
DOMAIN + SUBDOMAIN: BLACKLISTED @ MalwareDomainList

http://360safe.com/

https://www.virustotal.com/de/url/b3e16d689af0dd0c1c7f91b3bb7d3b1945f8a38b0f944713c0f87244ee2baee0/analysis/

SUBDOMAIN:

http://down.360safe.com/

https://www.virustotal.com/de/url/a0ded28ef8f22d505636819bb2b8bba88412c8157ca3ac4723a5a34fe994cb73/analysis/1398878350/

SUSPICIOUS FILE LINK:

http://down.360safe.com/setup.exe

https://www.virustotal.com/de/url/659adefa8017920149ed69bc009b0bc8be1ba53a02a589346392cec09cf144f6/analysis/1398878498/

SUSPICIOUS FILE:

https://www.virustotal.com/de/file/1f99e9e6e5bb5444a6010219b44837c89aab951c177da702d771e91dcbfc97d2/analysis/

IP(s):

http://180.153.229.17/

https://www.virustotal.com/de/url/67118050119382d41608cd53e67db70664b09dcd75fe9ad47994be1228b77e9b/analysis/1398878751/

https://www.virustotal.com/de/ip-address/180.153.229.17/information/

http://220.181.150.209/

https://www.virustotal.com/de/url/d4968e75e9802ef631320da4bb1c4c5c5766b28fedb5a90160a18ca79f70b2cf/analysis/1398878962/

https://www.virustotal.com/de/ip-address/220.181.150.209/information/

SEE ALSO:

http://urlquery.net/report.php?id=1398876496772

http://quttera.com/detailed_report/down.360safe.com

4/06/2014

Win.Adware.PCFixSpeed - Category Malicious ADs:
www.pcrx.com HIDDEN IFRAME (W32.HfsIframe)
BAD REPUTATION from Boca Raton, Florida, United States

FOR WEBMASTERS & BLOGGERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain www.pcrx.com in your AdSense Dashboard. The Site is potentially Blacklisted. See the following Report:

MALICIOUS SITE (ALL IN ALL):

DOMAIN:

http://www.pcrx.com/

https://www.virustotal.com/de/url/d134b225cf91b786e6cf9e3864b67f8a573f4de32782a21329e495c0abbcc219/analysis/1396782475/

AD-LINK:

http://www.googleadservices.com/pagead/aclk?sa=L&ai=CMwaGcWBAU_i9AoSM7gb_loCwDsy0sLYGpOjF74kBwI23ARABII7AlCNQz7C-s_z_____AWC7A6ABlLn94wPIAQGoAwHIA8MEqgSiAU_QFxELMNi3LYLgPVXseXnrzD6zDU-J9nXFbw2MryJfQV2MP98Ot-XiBzbVkkAFtRnTRs1qSxOOUOszsmoO2qQisuMwkpn9MK8EGJIdZyph2EyPdzoKqSFWD3C4eMQ95FbGFFCHpl1gz4uPUvbNB8gpYVzPuG6YN7kh-7HHQu-CsISfIufJqY0JTLHVQfcx2gpRXnBisX6spyMI2nBDImh03IgGAYAH1MaCHA&num=1&cid=5GjWo9iwtAvE92tyQ7Z3AUiU&sig=AOD64_357e7amdBz9W7LrWCbdRymWZaNWQ&client=ca-pub-5585202032329389&adurl=https://www.pcrx.com/lp2.aspx?cfg=286&b=GGL_PCRx_ppc34_26PCRx_25_cfg286_*GeoUSCA*_-Content-___virus%20removal&s=awppc34&utm_source=google&utm_medium=cpc&utm_term=virus%20removal&utm_campaign=ppc34-26PCRx&nm=13&mb=2&bg=!A0R-hdQBXOFz0QIAAAA8UgAAABwqAOEZb79pp1D1BE3K7kwI4IOviZ2ubSDhRDJG-7Q4HlS4ZjzcD9QltXbHPpVJdOgrxS3cGZDZauOfZjC6SCCrQ7fVHaKypOSsHZfbX0k7nJ7JNhgSZG7hhEe-BfIiXwT9XJoD4p2_0hnSAD9N6RGfKbD72wSjZTlbAm2ILmg4wXbdZmVOSu6UF4GnFC1vWHqKwNmpMhtAIWpYOO-As5VPOLiflE-B9hlWCIYvvFZZkwncRl4GFWbkdMjFoTD0SdPu5nlIl8KUg51-rSptOBGwp0TELfzhzYbR91ChncIZ-RgADCg

https://www.virustotal.com/de/url/d01eeb168d9f7603355a6c713dc9f849d0ff9bb33317fe15eb9eba4f712b38b3/analysis/1396780767/

W32.HfsIframe

https://www.virustotal.com/de/file/f185f969ec9e00171ae2c074e778151098b139d6582bfcf38677aedc07c9d844/analysis/1396780976/

---> REDIRECTS TO:

https://www.pcrx.com/lp2.aspx?cfg=286&b=GGL_PCRx_ppc34_26PCRx_25_cfg286_*GeoUSCA*_-Content-___virus%20removal&s=awppc34&utm_source=google&utm_medium=cpc&utm_term=virus%20removal&utm_campaign=ppc34-26PCRx

https://www.virustotal.com/de/url/b9f4bea865ca713b6d2f2502ddf25b7c2b3568c57ad8d74ae87304a79e5deccd/analysis/1396780879/

COMODO WEB INSP.: Malware Downloads

http://app.webinspector.com/public/reports/21119862

POTENTIALLY MALICIOUS PCRx DOWNLOADS:

Win.Adware.PCFixSpeed

https://www.virustotal.com/de/file/6a9485d64a00f9e12772d2c87046aaea52cad77dcb5d780a785b6926803dd9f1/analysis/1396782228/

https://www.virustotal.com/de/file/20d7c743da686f8d380d6aaf53b000ef111ba6f4167ed326a5f5529726e6269d/analysis/

https://www.virustotal.com/de/file/5bcc827dd5eb10282ca30005bcd87e5b7e16f7e1f12b26ddbb6e8d72ed4f09cc/analysis/

WOT: POOR

https://www.mywot.com/en/scorecard/pcrx.com

http://www.urlvoid.com/scan/pcrx.com/

http://scanurl.net/?u=www.pcrx.com%2Flp2.aspx%3Fcfg%3D286%26b%3DGGL_PCRx_ppc34_26PCRx_25_cfg286_*GeoUSCA*_-Content-___virus%2520removal%26s%3Dawppc34%26utm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_term%3Dvirus%2520removal%26utm_campaign%3Dppc34-26PCRx&uesb=Check+This+URL#results

IP:

http://64.135.82.105/

https://www.virustotal.com/de/url/da96984c002d149f8f2254493dee205349d8d1e13239bd6660d8f55634e53a83/analysis/1396783074/

https://www.virustotal.com/de/ip-address/64.135.82.105/information/

4/05/2014

pchelpsoft.com welcomes you with:
MALICIOUS DOWNLOADS (Win32/SpeedingUpMyPC) PLUS
HIDDEN IFRAMES (IP: 107.6.189.44)
as well as a Bad Reputation
USA & FRANCE

FOR WEBMASTERS & BLOGGERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain www.pchelpsoft.com in your AdSense Dashboard. The Site lets your Visitors download and install persistant ADWARE or other Malware like in this case a variant of Win32/SpeedingUpMyPC. See the following Report:

MALICIOUS ADvertiser & HIDDEN IFRAMES

Screenshot with only SOME of the detected Hidden IfRames

DOMAIN:

http://www.pchelpsoft.com/

https://www.virustotal.com/de/url/5c3edae4e373ca3e00b12d47e8cca063d95788ce51bf2231183583fb09c410fe/analysis/1396709017/

W32.HfsIframe

https://www.virustotal.com/de/file/5423ccf2d362c574dd92ee16048771654c0c147615e30969708287e823e86d14/analysis/

AD-LINK:

http://googleads.g.doubleclick.net/aclk?sa=l&ai=C_5YSLfY_U477Oaf97QbKlYCICo_WvewF95Pew5MBwI23ARABII7AlCNQ59rJ-fr_____AWC7A6AByYS85gPIAQGpArbIwK_Uja4-qAMByAPDBKoEhAFP0DaVh04U04otA5RC7LkKN6Bb_76Gi-a6KPMQvyX3m8F19ghuSsCTgBc7cUAPAstOz7czutL_m7MOzFOIkKzeFLZ3UN9ZUEOlz4xXwJPPBb5gK8G6YxHi-4h_mZg4uzJ7soJ9bRaeuP_OZ2MIq7zyOqfZY3eePfaxuKdr22MRIEQwDEuAB5_7wxk&num=1&sig=AOD64_3jGSApnWn_Emx9WI29PpLZtrEk6Q&client=ca-pub-5585202032329389&adurl=http://www.pchelpsoft.com/pc-cleaner/lp1-ms/%3Ftracking%3DPH_EN_PP_GO_CO_ROW_PCC%26keyword%3D%26campaignID%3DADWORDS&nm=39&mb=2&bg=!A0Q9TCHak0v0HwIAAABKUgAAADcqAOG1EZitqUzYO4cdHgIIvh0nlm7oDd0knPeZUrYknpQ3F5-tZmBmXeKSHkPmRrr_CHVhEUhzRoOlThSLBgrs5fJLBrB5bES3Cg3gSdBl8Q6gTAGIzXrrfFYMCH9BIYOWLOuS7dqRqWoHQHEer0wQaFUVg8VOCK9FOIlzVHnwhGYzDu54619Pr81rBHDv7mscitGvxqSMzZirAzqRJipFcOzj4t9u__q1EYkusciy23n30yN3jgPeP_Ps4igDQY2IWVDYlesicGJKIgCoclKMhqQuga9DgkcUZAewYWXsVZknShE

VT ANALYSIS:

https://www.virustotal.com/de/url/aaa0b4defa15863722a5a1f3a972cb1b5ae58782a51ee2ddf099479d13401a25/analysis/

W32.HfsIframe

https://www.virustotal.com/de/file/97297c8b5512bf9630a4785d5efc8b1fa8c0ed256a259f41f2e420dd7ab75f3f/analysis/

URL After Redirect:

http://www.pchelpsoft.com/pc-cleaner/lp1-ms/?tracking=PH_EN_PP_GO_CO_ROW_PCC&keyword=&campaignID=ADWORDS&gclid=COLyicasyb0CFcU-Mgod9WIAFg

https://www.virustotal.com/de/url/b812f343e219878f936a148c61d82ee7b868b62f126c33035034c30558cff252/analysis/

W32.HfsIframe

https://www.virustotal.com/de/file/33e518a1049cacd6ad92fcb4dc8cc4276a7def88a673ec8f8b6730169c874399/analysis/1396709347/

OTHER (MALICIOUS) LINK OF THIS DOMAIN:

http://webtools.pchelpsoft.com/download.cfm?tracking=PH_EN_PP_GO_CO_ROW_PCC&keyword=&campaignID=ADWORDS&gclid=CJi1oOCsyb0CFcx9OgodfGkAVg&go=http://cdn2.pchelpsoft.com/pch_downloads/pc-cleaner-3248.exe

https://www.virustotal.com/de/url/1ac047af6364f4d0b32c39cc39916c2f2c20126ac9084b34a8e37fc243575e3a/analysis/1396710143/

Win32/SpeedingUpMyPC

https://www.virustotal.com/de/file/61825b61802647f122a2faf60ed2b06d4d139939c2305f421557ba7aadeaca8d/analysis/1396709870/

---> REDIRECTION TO: (7 AV-FLAGS)

http://cdn2.pchelpsoft.com/pch_downloads/pc-cleaner-3248.exe

https://www.virustotal.com/de/url/695aac7dd7c803f95c1ff3fb22114a8c07710377c1f761360b4919703dde422d/analysis/

Win32/SpeedingUpMyPC

https://www.virustotal.com/de/file/61825b61802647f122a2faf60ed2b06d4d139939c2305f421557ba7aadeaca8d/analysis/1396709870/

SEE AS WELL:
Scam
Misleading claims or unethical
Poor customer experience

https://www.mywot.com/en/scorecard/pchelpsoft.com

LISTED AT HpHosts:

http://hosts-file.net/?s=pchelpsoft.com

IPs:

http://107.6.189.44/ (Chicago, U.S.A.)

https://www.virustotal.com/de/url/500ee0900e907eb3ec6ddfa941715422ba0d629117bd78a11abfc425e792f55a/analysis/1396710479/

https://www.virustotal.com/de/ip-address/107.6.189.44/information/

http://217.195.25.241/ (Le Pecq, FRANCE)

https://www.virustotal.com/de/url/2fcdb898c3033fa329006d6ad7a857426898b76c36d4031015e80c74b1bcdc0e/analysis/1396710659/

https://www.virustotal.com/de/ip-address/217.195.25.241/information/

http://205.251.253.160/ (Seattle, U.S.A.)

https://www.virustotal.com/de/url/69651f27754573792bde992f0a5bdbb08107d6477da0e85a9f383504ced67cad/analysis/1396710819/

https://www.virustotal.com/de/ip-address/205.251.253.160/information/

BHA: 3

https://www.projecthoneypot.org/ip_205.251.253.160

4/03/2014

MALICIOUS ADs:
download.fromdoctopdf.com
risking with
Adware.MyWebSearch
White Plains, NEW YORK (UNITED STATES)

FOR WEBMASTERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain download.fromdoctopdf.com in your AdSense Dashboard. The Site lets your Visitors download and install persistant ADWARE. See the following Report:

MALICIOUS ADs: Adware.MyWebSearch.15

MALICIOUS CONTENT & DOWNLOADS:

http://www.googleadservices.com/pagead/aclk?sa=L&ai=CZ5u950M9U8H1Goiu7Qbw7YDgCMWmg7oEza6d5Fmwtc3fUBABII7AlCNQq8iQnAZguwOgAbuLoeMDyAECqAMByAPBBKoEkwFP0INx3GRxGmf75YJHVfg23Y1q0faoAWwxpSI0eW2lAjrO4iGtdTPCH5e2qE0-OJYs2Nzy3PwLsVBURyZQBdBqSuU3c8rON3dh9vA-8VLjBuUDUefI0r3rD9eSIrC-NykRnoCC_TyV-EAoBCDuoqT7Gs-hxBakOM0ZIuWaQx0i1lofQlAkWFG6zz51lD0laNJkf-uIBgGgBgKAB6303hw&num=1&cid=5Gi0szH0G6npQc1zBwu_So85&sig=AOD64_1k0A5LtYUiNxfDGsHRhrPeLa_gQA&client=ca-pub-5585202032329389&adurl=http://download.fromdoctopdf.com/index.jhtml%3Fpartner%3DY6xdm010&nm=1&mb=2&bg=!A0S2nPCfVMrd2QIAAAA3UgAAABgqAOEAYGl_c7TMnCDOZeuOQ1tdwMlTc5AjqsfXe6qIrAw64KouboiusTyHanPQBv1xwPq5aJtvphicS2RfNGWeczY_j68aSMS7YgI5crzlya6a1oHsBSRE3bjLecUvRnaNGRi2UveY9oI91rKvISEK3gSPdHKAZ9We2D12U3d-N6nskV2jobsjRJYY1P0-R2Utrg-kJcArZtz9bURG1mslSipysYp8n3u3rGyh40WBX4gqJJkgGqYahbw9-wnY3eF4A2ooAG4_smQYaM9C0Iu5FwVm1Us5ddKk2NOcgoOoqeDV7KE

ANALYSIS VT:

https://www.virustotal.com/de/url/09f26ddc5338a53ab3d8161f9694c23b876736809c779d59ccd0265bfac9d423/analysis/1396524292/

URL AFTER REDIRECT:

http://download.fromdoctopdf.com/index.jhtml?partner=Y6xdm010&gclid=CPOus7OaxL0CFaw-Mgod8FAA7A

https://www.virustotal.com/de/url/f47d656744a326f0c31554124e28cfed59e6417e1f2f19a907478fb0aa437522/analysis/

IP:

http://74.113.233.180/

https://www.virustotal.com/de/url/54b4d071b1897bce1af782c969f0510bd2744190d95d92e4bae7d9758a033bb3/analysis/1396460279/

https://www.virustotal.com/de/ip-address/74.113.233.180/information/

Fwd/Rev DNS Match: NO

http://www.senderbase.org/lookup/?search_string=74.113.233.180

SCREENSHOT AT URLQuery: https://urlquery.net/screenshot.php?id=1396456860485

CLICK TO DOWNLOAD & INSTALL:

Adware.MyWebSearch.15

https://www.virustotal.com/de/file/3861f4259af68b4ba6ea7cdff84d9ce2deddcf4f5056685d00997d12fdcd4593/analysis/1396524664/

4/02/2014

MALICIOUS ADs:
www.mapsgalaxy.com
risking with
Adware.MyWebSearch
White Plains, NEW YORK (UNITED STATES)

FOR WEBMASTERS

If you own a Website or a Blog and are affiliated with Google AdSense, in order to your own Reputation, should block the Domain www.mapsgalaxy.com in your AdSense Dashboard. The Site lets your Visitors download and install persistant ADWARE. See the following Report:

MALICIOUS GOOGLE AD: Adware.MyWebSearch.47

MALICIOUS CONTENT & DOWNLOADS:

http://googleads.g.doubleclick.net/aclk?sa=l&ai=CnEVeQDc8U-upIeel7QahnoDQCund95AHodCfgp4BtNjNkjsQASCOwJQjUOX47tf9_____wFguwOgAY-N4MsDyAECqAMByAPBBKoEiwFP0MESvZ_isD1TrzMOPDJ1o7Ufq5dre3IjKnqqYo-zjs39xY_t30Lip57ow-ldZoz2GU26VWAho6A9Zfx_82_n7YwdODV1nM_hOiWndJ9Ur_0KCBr2cVNXHqUbYh6rHuuZw6vVy-t87Bu9AdYWDGHkkkxPd-td_QvjgH9bq3ZYt0sk6iXBAIerka9uoAYCgAfZ8p80&num=1&sig=AOD64_0IYB2aEpKbXMiR0DfT4GK6wEbtjg&client=ca-pub-5585202032329389&adurl=http://www.mapsgalaxy.com/index.jhtml%3Fspu%3Dtrue%26partner%3DUXxdm063&nm=1&mb=2&bg=!A0Qka6E9cikknAIAAAAoUgAAABAqAOF3LAxbRwhN4BN-FCwOxvTpAJVAY9WiyoU86eSLNpX7oIu11_DHmjdhLtRJxnOsZ2ZRyxI1gmGBT5wpOWh-io87KnZHpVUxySq_sLVnszay-jesA7PsUY1GadC8jU80U8gmgzyt23KO5wCm_3kKPipcR-wmYUFGqhG3IF3DU6V5F_dft6JJcBuz8QGIoYwpzwmmdFstwcCSDxhbRT_gPOHJnI0rgkFGl8V_gcGC8067tK2mZXJ6J3RpV9c3FljPkMmJqBIAk27NWoNXPFLAtzCXuxRLD6Wx9O3OyjxViucvt-M

ANALYSIS VT:

https://www.virustotal.com/de/url/a92a922529b7b83d95cac0b4cc8d93e8e2370088c4084e86866279241bd5bcad/analysis/

URL AFTER REDIRECT:

http://www.mapsgalaxy.com/index.jhtml?spu=true&partner=UXxdm063&gclid=CI32lZabwr0CFYhaMgodVmQAAQ

https://www.virustotal.com/de/url/21b8b9a8349d7ddde85e4ca86b43d2e76552e689dcc3e80a9a38d4e49517a1bb/analysis/

IP:

http://74.113.233.180/

https://www.virustotal.com/de/url/54b4d071b1897bce1af782c969f0510bd2744190d95d92e4bae7d9758a033bb3/analysis/1396460279/

https://www.virustotal.com/de/ip-address/74.113.233.180/information/

Fwd/Rev DNS Match: NO

http://www.senderbase.org/lookup/?search_string=74.113.233.180

SCREENSHOT AT URLQuery: https://urlquery.net/screenshot.php?id=1396456860485

Own Screenshot

CLICK TO DOWNLOAD & INSTALL:

Adware.MyWebSearch.47

https://www.virustotal.com/de/file/68ae70b9cd962e0b44215c1e3b9909aec214ce508ce812876d0e2f0b798ad23a/analysis/1396457127/

OTHER MALICIOUS LINKS CONNECTED:

http://ak.imgfarm.com/images/download/spokesperson/spokesperson.js

https://www.virustotal.com/de/url/b08c15078bb414e7a8a5b00bfdd6cf39932a31b55d078bde87713ad4baa38ef9/analysis/

https://www.virustotal.com/de/file/dccc8d765c3a166c8fa79a0ad9358f1b6571cf0e411245a03950f1d9fc2e9d04/analysis/1396456474/

http://ak.imgfarm.com/images/anx/anemone-1.2.7.js

https://www.virustotal.com/de/url/02be3e7f50f96b17100f9298b452272ec2eda7aa02cf2f47acd56d168c83c2ae/analysis/

https://www.virustotal.com/de/file/b61f1dc82835d8bc3b6332443358eb5b9c41a5f4b0672497cdf06ac0a8bbfdfa/analysis/1394482504/

SEE ALSO:
http://wepawet.iseclab.org/view.php?hash=75d2310bc0fb8f44448a4ca37b09586c&t=1396455295&type=js

2/25/2014

Solimba Installer
Category MALICIOUS DOWNLOADS: dl.downloadohdooshieyei.com
(IP: 165.254.155.129) Englewood, Colorado, United States

MALWARE SITE: MALICIOUS DOWNLOADS (Solimba Installer)

DOMAIN:

http://dl.downloadohdooshieyei.com/

https://www.virustotal.com/de/url/ef7757bab9e69849807f527d515ab673778d76a3e3cb8f1d2da775a2d5dfb199/analysis/

MALICIOUS DOWNLOAD LINK:

http://dl.downloadohdooshieyei.com/n/11812101/N0636.exe

https://www.virustotal.com/de/url/7be861a3b2d6b26d20a103730f77fdbdc3248682700ebd2405ef0002db822494/analysis/1393347015/

FUNNY 2 DIFFERENT FILES:

FILE DOWNLOADED BY VT:

N0636.exe Solimba Installer

https://www.virustotal.com/de/file/6b76dc210986bb989da482ef6a8bd19cf8438c832e4c8b8984f15c8567c342e5/analysis/1393347021/

FILE FROM JSUNPACK:

http://jsunpack.jeek.org/?report=c631008f24cb11be18ffb6c52628296e2f878c79

https://www.virustotal.com/de/file/814f68ccb748f3bbe2cf34078ca219b6ce59f0c079d3e21b0320c8153fa15300/analysis/1393347080/

2/24/2014

GREATSOFTWARE.COM:
www.greatsoftware.com & dl.downloadohdooshieyei.com
(MALICIOUS DOWNLOADS from NORWAY & FRANCE)

MALWARE SITE (DIRECTLY & INDIRECTLY): MALICIOUS DOWNLOADS

DOMAIN:

http://www.greatsoftware.com/

https://www.virustotal.com/de/url/944ea52f2622d40e250fca3d82c5b01920482196479a88a5fc7aa55567828d0c/analysis/1393276144/

MALICIOUS LINK:

http://www.greatsoftware.com/image-merger-exe/

https://www.virustotal.com/de/url/ae080a4ba9dff79029475591902616ccde3860d512fc444d14f7d2fd0f313254/analysis/1393276105/

(DONT) CLICK THE DOWNLOAD BUTTON AND YOU WILL GET THE FILE (MALWARE)

FROM:
http://dl.downloadohdooshieyei.com/n/12372005/Image%20Merger%20.EXE.exe

https://www.virustotal.com/de/url/e5a90ede66101c9b432ea464827a5d8c0f47bb8461520eacbea096b4ba9e823a/analysis/1393273342/

(PUA) Win32/FirseriaInstaller.F

https://www.virustotal.com/de/file/a43fc03c2fc7519029692d6666c54ea5d8ef478748ec893153ee479607324277/analysis/1393273348/

MALICIOUS DOMAIN:

http://dl.downloadohdooshieyei.com/

https://www.virustotal.com/de/url/ef7757bab9e69849807f527d515ab673778d76a3e3cb8f1d2da775a2d5dfb199/analysis/1393274740/

2/01/2014

NEW MALWARE CODE:
Trojan.NSIS.StartPage.ed (CHINA)
MALICIOUS DOWNLOADS Domain:
keaitz.com

MALICIOUS SITE: (Nullsoft Scriptable Install System FROM: CHINA)

DOMAIN:

keaitz.com

https://www.virustotal.com/de/url/9b81a505362c1aab403292563a9360f72e8e076fd83794ef36faeb29181ebdf2/analysis/1391274035/

1390472709.keaitz.com

https://www.virustotal.com/de/url/d3940fe84e654ea2d17c7d219ae53ca86be9b66d1474683ae0596ed5c8d57f8c/analysis/1391272982/

https://www.virustotal.com/de/file/a77b681a6138fdcc50c8be703ee1637fc60f1f90a47f6ba09b1539371ac6f60e/analysis/1391272594/

SPECIFIC LINK:

1390472709.keaitz.com/chat/raffle/raffl.exe

https://www.virustotal.com/de/url/510a6e03aa6c4b786a33d25f7d48d2b0c76d16726e2efa83b531137b09fb5651/analysis/1391272314/

INFECTED WITH: Trojan.NSIS.StartPage.ed

https://www.virustotal.com/de/file/cb99213503ed1f23bdcca1ef9b95ac1b423036dba3e5f8bbd68743b7dcdb98fe/analysis/

SEE ALSO:

http://app.webinspector.com/public/reports/19839594

http://zulu.zscaler.com/submission/show/b57c16e6dd5a128c923b1b0555949636-1391272426

http://anubis.iseclab.org/?action=result&task_id=1f72b554221efb114f53fcb4a82d166f0&format=html

http://www.urlvoid.com/scan/1390472709.keaitz.com/

SCREENSHOT OF DOMAIN (403)

FOR MORE INFO ON THIS THREAT, SEE:

http://www.avgthreatlabs.com/virus-and-malware-information/info/downloader-nsis/

1/19/2014

Malicious U.K. Site: secure.rocketdlgo.com
POTENTIALLY MALICIOUS DOWNLOADS (PUA)

MALICIOUS DOMAIN: MALICIOUS DOWNLOADS (PUAs)

secure.rocketdlgo.com (LONDON)

https://www.virustotal.com/de/url/36ed680720c344c20d4265de97ffc49efd5c3932f21ef54938b5e260b55f66f1/analysis/1390121354/

MALWARE (PUA) LINK (out of many):

secure.rocketdlgo.com/nsi/nsis-html/Microtraffic_5485.exe

https://www.virustotal.com/de/url/fdb52ef1459d2cd2c98423e3f6cb0915b4ce2b0621a190257901013bdeefa7f2/analysis/1390121715/

INFECTED: Win32/InstallMonetizer.AG

https://www.virustotal.com/de/file/ca51c74ae63a852388ffa13f842a6c4e7b3d32be8afedb49705aaf837a2ea54a/analysis/1390121994/

http://www.urlvoid.com/scan/secure.rocketdlgo.com/

http://zulu.zscaler.com/submission/show/dfc38710b3e03079599ec5cb922e7113-1390121373

For additional Info see:

http://malwaretips.com/blogs/pup-optional-installmonetizer-a-removal/

Translate

4/30/2014

4/06/2014

4/05/2014

4/03/2014

4/02/2014

2/25/2014

2/24/2014

2/01/2014

1/19/2014