SSH Rootkit Ebury Category MALICIOUS IP: 203.153.108.227 (INDONESIA) Listed at SPAMHAUS (CBL) Linux, FreeBSD or some other form of UNIX

The IP Address 203.153.108.227 is listed in the CBL (Composite Blocking List). It appears to be infected with a spam sending trojan, proxy or some other form of botnet. It was last detected at 2014-05-20 07:00 GMT (+/- 30 minutes), approximately 10 hours ago.

Screenshot of 203.153.108.227

We have detected that this IP is NATting for, or is infected itself, with a Linux (or possibly some other Unix-like system such as FreeBSD) Trojan spam mailer script. This is no joke. This infection is extremely dangerous as it can download anything it wishes, and needs to be removed ASAP.

We do not know how the malware got installed onto the machine, but we know a lot of what it does. The main thing we've seen it doing is sending staggering large volumes of email spam. But it can do a lot more than that, and that is the real danger.

NEW

Of late some of these infections are facilitiated by a SSH Rootkit called "ebury". See this link for more detail.

In most cases, this IP address would be that of a shared hosting environment. If you are a customer of this environment, you will almost certainly not be able to do anything about it, only the administrators of the hosting environment itself can. Please contact your administrators, and refer them to this page. If the administrators are reluctant to do anything please try to convince them, because there is nothing you can do to fix this problem.

For further Info, please read the Screenshots made earlier in the Day (at the End of this Post).

----------------------------------------------------------------------------------------------------------------------------------------------

Analysis:

MALICIOUS IP (PHISH RISK: RouterOS router configuration page):

Heuristic.LooksLike.HTML.Suspicious-URL.E

http://203.153.108.227/

• https://www.virustotal.com/de/url/0a964415fc55b5cdc18c0d36636601c5510eb3646d5ecf9a7513698add2a9817/analysis/1400587343/

Heuristic.LooksLike.HTML.Suspicious-URL.E

• https://www.virustotal.com/de/file/e23ec81b12a8af1412ab02d126086162b758908f1cf3e26a3f9797c3da242a74/analysis/1400587434/

• http://quttera.com/detailed_report/203.153.108.227

• http://zulu.zscaler.com/submission/show/4b322c1b6dd9f1d6b3f50243c20b5c37-1400587353

• http://www.wpbl.info/cgi-bin/detail.cgi?ip=203.153.108.227

SPAMSERVER & DICTIONARY ATTACKER:

• https://www.projecthoneypot.org/ip_203.153.108.227

• http://www.senderbase.org/lookup/?search_string=203.153.108.227

LISTED AT SPAMHAUS (CBL):

• http://www.spamhaus.org/query/bl?ip=203.153.108.227

CBL LISTED:

• http://cbl.abuseat.org/lookup.cgi?ip=203.153.108.227

OTHER MALICIOUS FILE:

http://203.153.108.227/winbox/winbox.exe

• https://www.virustotal.com/de/url/d2563f5885fbe8174154ed20d776233135b80220e97d21b3b42b231c38e69311/analysis/1400602467/

• https://www.virustotal.com/de/file/dcc31d4643e17d31db636c8ccc7e34d004876f18b5d48828ea37e2e8e5e19bcf/analysis/1400068690/

----------------------------------------------------------------------------------------------------------------------------------------------

Introducing COMMENT SPAMMERS (so the NET will not FORGET) Helping those sorrow ones out in Publicity, otherwise no one would notice them....

www.home-staging-montreal.com

IP: 66.43.56.89

(Montréal)

Anonymous wrote on February 8th, 2014:

Pretty great post. I just stumbled upon your blog and wished to mention that I have truly loved surfing around your weblog posts. After all I will be subscribing in your feed and I am hoping you write once more very soon! 
My weblog: www.home-staging-montreal.com...

COMMENT SCREENSHOT

On this Post:

• ILLINOIS Online Child Predators 2011: “funson999” aka Michael Wayne Bailey sentenced to 97 Months in Prison

Screenshot of the Webpage:

One important Question remains: Would you buy something at a place where the Spammer is trying to Advertise through an Article thats subject to Cild Predators & Pedophiles harming Children ??? I BET NOT !!!

----------------------------------------------------------------------------------------------------------------------------------------------

Stop ! This Website Is Not Safe ! Psssst...i am OUTING myself....so, beware... Not only since Yesterday (This Blog) is stamped as a PHISHING Site (by BD (BitDefender)....This POST (Threat)) will be kept updated. Sooner or later. And Fortinet jumped into it (Today. The NET). Riddle: Find out why...it started...! STAY TUNED !

STOP ! THIS WEBSITE is NOT Safe 

• http://trafficlight.bitdefender.com/info?url=http://stayaway2.blogspot.com

THE BEGINNING: (AS I SAID, SOME (delicate) INFO WILL BE UPDATED). BitDefender is a GERMAN/ROMANIAn "Fusion?"itis.

The more Hacking, the more will publish. The Circle of Life makes not halt in Front of...BD...who is working EAST(Ward)s !!!

The end of defending Bits (or bytes)

Happy Eastern to ALL (and to myself, i almost forgot): But Never Forget: Kaspersky is the RULE !! Is someone heading EAST ? Or WEST ?? Hitchhike.....

And https://www.virustotal.com/de/user/BMonday/

:D

MALICIOUS VISITOR (to this blog): keld-electronics.com (IP: 194.143.194.106) SPAIN

DOMAIN:

http://www.keld-electronics.com/

• https://www.virustotal.com/de/url/d27cb127f2a4373457990c1f6f3d38ff8d02edaa4ce045c050b0da62898b5c93/analysis/1394714792/

• http://www.yandex.com/infected?url=keld-electronics.com&l10n=en

IP:

http://194.143.194.106/

• https://www.virustotal.com/de/url/f14401acac4ed2c05f35eedd7703165aa347c5dca76d10dd064f90132af170b8/analysis/1394716080/

Bad Host Appearances: 99

• https://www.projecthoneypot.org/ip_194.143.194.106

• https://www.virustotal.com/de/ip-address/194.143.194.106/information/

Category MALICIOUS DOMAIN & IP: www.zbestclubreview2014.com (IP: 115.242.210.80) Casino, Gambling (PHISHING, SCAM, SPAM) (Ruby Palace, Mumbai, INDIA)

Auf unseren Webseiten finden Sie die besten Online Casinos mit exklusiven Angeboten, wenn Sie sich über unsere Webseiten registrieren.
Verschiedene Angebote wie Freispiele und Bonusse auf Einzahlungen erwarten Sie.
Besuchen Sie unsere Webseite, finden Sie Ihr neues Online Casino und profitieren Sie von einem exklusiven Angebot, das Ihnen am besten gefällt.
Klicken Sie hier, um unsere Webseite zu besuchen.
http://www.

zbestclubreview2014.com/
Mit freundlichen Grüßen
Bitte klicken Sie hier, wenn Sie von uns keine E-Mails mehr erhalten wollen:
http://unsubscribe.zbestreview2014.com/

• Please notice that most of all those Mails that include "Ruby" (Example), are connected to Gambling Sites who want to "steal" your hard earned money in many different ways. You will ALWAYS lose. Consider going to a "real" Casino, instead of gambling online, although the chance losing more money than gaining it is potentially low as well. "Ruby"-Mails are not only SPAM but as well Scam, Phishing, and downloads of Malware (Riskware). These domains rarely last more than a month and they change the name again. Ignore & delete those Mails and the included links. Otherwise you will be set onto a potential Risk, damaging your PC.

SPAM-Mail Screenshot

• Bitte beachten sie dass sogut wie alle E-Mails die im URL den Namen "Ruby" (Beispiel) enthalten und die im SPAM-Ordner liegen (oder auch nicht), in Verbindung stehen mit (zum Teil illegalem) Glücksspiel (Online-Casinos), die nur darauf bedacht sind ihr hart erworbenes Geld aus der Tasche zu ziehen. Wenn Sie aber unbedingt "zocken" möchten, wäre es ratsamer ein echtes Casino zu besuchen. Obwohl man dort im Normalfall auch, eher ärmer als reicher dieses verlässt. "Ruby-Mails" stehen nicht nur mit SPAM im Zusammenhang, sondern auch mit SCAM, Phishing und schädliche Downloads von schädlicher Software (ganz oft werden diese schädlichen Downloads ohne Wissen des Besuchers) auf den PC heruntergeladen. Am besten ist man meidet diese Sites, ansonsten könnte ihr PC beschädigt werden.

MALICIOUS DOMAIN(s): PHISHING, SCAM, SPAM

MAIL SENT THROUGH:

http://de-graaf.nl/

• https://www.virustotal.com/de/url/9a2407169f616b2a2a036d1f5bdfdc1b586c3da935cbeb9586e394db4ebdb792/analysis/1393265245/

HTML (TITLE: test igr)

• https://www.virustotal.com/de/file/897f06db515c21290c30c57dd1af5866fb260e19c213dd86af0c991bf5b2ab5f/analysis/1393265111/

IP:

http://109.109.120.43/

• https://www.virustotal.com/de/url/3ea4a1d473e5c5d071795108a2ac018278483b00a9f78f903666ea1d8966dc72/analysis/1393265363/

• https://www.virustotal.com/de/ip-address/109.109.120.43/information/

HOSTNAME:

http://pernis.cbizz.nl/

• https://www.virustotal.com/de/url/1ffd59fd6c336547198255126d30d61be74c67d3ef51ad3dccac2037c71b43fa/analysis/1393265933/

HTML (PUA - LIKELY HOSTILE)

• https://www.virustotal.com/de/file/b360defdc2da0baa651a970842c02965c9c7abf9aa64fc1313f4a4a1108faf3d/analysis/1393266111/

GETFILE: http://jsunpack.jeek.org/?report=516635988cbc568d4d2d43d0ad9c0e190325b4be

PUA.JS.Obfus-7

• http://virusscan.jotti.org/de/scanresult/9bac55894b100053305d87eaf342fd1d7b967b33

• http://www.UnmaskParasites.com/security-report/?page=pernis.cbizz.nl

DOMAIN:

http://cbizz.nl/

• https://www.virustotal.com/de/url/1ef1ca00c396eeda1ca723d3780b7b912674431c8f5e5aff3d81e5c0b374a59b/analysis/1393266792/

----------------------

SPECIFIC "CASINO" (MALWARE) DOMAIN:

http://www.zbestclubreview2014.com/

• https://www.virustotal.com/de/url/02ee438ea4071e0839c5b4f0839c174ff0413423e74f33227791241134dc444c/analysis/1393265668/

UNSUSCRIBE LINK:

http://unsubscribe.zbestreview2014.com/

• https://www.virustotal.com/de/url/0e33f7e548f5d9685ac666974b4ded4025b0735f14b3e435b0c315555714a755/analysis/1393265770/

ORIGINATING IP ADDRESS:

http://115.242.210.80/

• https://www.virustotal.com/de/url/98b43e7ad335c2310d1cb232e943d9bf9518613df8ba00d9f5dd41062a54e0c3/analysis/

LISTED AT SPAMHAUS (PBL):

• http://www.spamhaus.org/query/bl?ip=115.242.210.80

• http://www.spamhaus.org/pbl/query/PBL386929

EMAIL REPUTATION: POOR

• http://www.senderbase.org/senderbase_queries/detailip?search_string=115.242.210.80

Malicious Downloads of EXPRESS FILES: Domain: pulidecor.com & go-for-files.com Win32/ExpressFiles (U.S.A., U.K., Ukraine, Russia, Netherlands)

ExpressFiles are  programs developed by Express Solutions. The most used version is 1.9.3, with over 98% of all installations currently using this version. Upon installation and setup, it defines an auto-start registry entry which makes this program run on each Windows boot for all user logins. A scheduled task is added to Windows Task Scheduler in order to launch the program at various scheduled times (the schedule varies depending on the version). 

The software is designed to connect to the Internet and adds a Windows Firewall exception in order to do so without being interfered with. The programs's main executable is ExpressFiles.exe and has been seen to consume an average CPU of less than one percent, and utilizes about 20.48 MB of memory. It also adds an icon to the Windows notifications area in order to provide access to the program. A vast majority of those who have this installed end up removing it just after a couple weeks. 

The software installer includes 10 files and is usually about 9.09 MB (9,531,113 bytes). EFUpdater.exe is the automatic update component of the software designed to download and apply new updates should new versions be released. In comparison to the total number of users, most PCs are running the OS Windows 7 (SP1) as well as Windows 8. While about 22% of users of ExpressFiles come from the United States, it is also popular in Italy and Germany.

For more on this Threat, see here

MALWARE SITE: EXPRESS FILES (RBN 434)

DOMAIN:

http://pulidecor.com/

• https://www.virustotal.com/de/url/faf2ea9682c998e9a7d44c054d6f9483e682cd3cbe1bf8ecdbf0f0ad82587cbb/analysis/1393154354/

MALICIOUS LINK:

http://pulidecor.com/KID-ICARUS-DOWNLOAD-CODE.htm

• https://www.virustotal.com/de/url/8e8fb70f7504c3fc967981edcb7bd1ba0d50832cd5366ebda348434398dc12a1/analysis/1393153202/

Express Files

• https://www.virustotal.com/de/file/2edf84f8a5daef6398a5a44a730d6c7917c4f25e41cfaf2ff5ba144031aa006e/analysis/1393153844/

• https://urlquery.net/report.php?id=9609071

------>

DOMAIN/IP:

http://93.174.88.93/

• https://www.virustotal.com/de/url/97e56e02bb235d9b4d8603a2e189479745361911c618102fa066d4d3b26276cd/analysis/1393155556/

• https://www.virustotal.com/de/file/94ee059335e587e501cc4bf90613e0814f00a7b08bc7c648fd865a2af6a22cc2/analysis/1393156281/

 
MALICIOUS LINK:

http://93.174.88.93/go.php?q=KID-ICARUS-DOWNLOAD-CODE

• https://www.virustotal.com/de/url/1fa617458a620b8e6b4c10b903d987b5f1457d22e1addef94abe1da2012f8529/analysis/1393155418/

HTML

• https://www.virustotal.com/de/file/663de60a22fb540bfd8fae57df84a29e6410b90956c7caaddeb60b7e4c438274/analysis/1393156233/

• http://wepawet.iseclab.org/view.php?hash=cbe4a405fb132a836b5dd65a79936c98&t=1393155497&type=js

• https://urlquery.net/report.php?id=9609326

------>

DOMAIN:

http://pushtraffic.net/

• https://www.virustotal.com/de/url/36276552d4b9b922202792af9bb487791f37eacb6b84154cbef2b8ac07d9b0dd/analysis/1393156637/

HTML (Friendly Error Page...Looool)

• https://www.virustotal.com/de/file/761bbfe842ec7b0a1861abddca602c1525cd4555a7a56d91cf582511f26f07b4/analysis/1393156583/

MALICIOUS LINK:

http://pushtraffic.net/TDS/?wmid=99934&uid=969&q=KID-ICARUS-DOWNLOAD-CODE

• https://www.virustotal.com/de/url/043abe5c83ca189dde5ec8d475c706aa7d822fee1c5e57a553e1a9e1044fde89/analysis/1393155686/

HTML

• https://www.virustotal.com/de/file/fe76e106d6e3f1e9ec900de0a09d3e55f25516ea7400ddef4d2bafc4c9f97be8/analysis/1393155858/

• http://wepawet.iseclab.org/view.php?hash=be6ba6e4122acfb113c66af27b22fbd6&t=1393155899&type=js

• https://urlquery.net/report.php?id=9609355

TO GET TO THE FULL REPORT, CLICK THE ICON .txt :

MALICIOUS VISITOR (to this Blog): gayanals.net - TDS SUTRA (United Kingdom, RBN 189) Kryptik.CCEX

MALICIOUS SITE: TDS SUTRA (RBN 189)

http://gayanals.net/ 

• https://www.virustotal.com/de/url/0bca5c9dc2c648f10318a5b74bf12f4498e419ab314a5192dc739e12c5f9e571/analysis/1392976242/

HTML

• https://www.virustotal.com/de/file/9f467f6f8f5ba34d9956ee05de84357c55d4af3bebeba747a53285bc54f35e41/analysis/1392976594/

TDS SUTRA

• https://urlquery.net/report.php?id=9562232

• https://urlquery.net/report.php?id=9562233

FULL REPORT:



 

Trojan Smartasses try to fool with underscore: www.doymus.net infected by Trojan-Downloader.JS.Iframe.cba (Sanayi, TURKEY)

MALWARE: Trojan-Downloader (RBN 368)

http://www.doymus.net/Domains/domainname.jpg_/

• https://www.virustotal.com/de/url/bcf3c8d06a94352143e87576c1e33f2d96704165d5eea0a65e44c9294c042b7f/analysis/1392890782/

Trojan-Downloader.JS.Iframe.cba

• https://www.virustotal.com/de/file/e735971a24c6c3cfc59ccbdd455f353734fe3c11484f3461071628b4e7728b94/analysis/1392891118/

EITHER

http://afonya123.com/r/g.php

• https://www.virustotal.com/de/url/9a529a399ed40360a792e5bb92b09d68fe6c3b54beb7152108ce279910160b69/analysis/1392892392/

JS:ScriptIP-inf [Trj]

• https://www.virustotal.com/de/file/5a9b0eab6c9ea56986c8530f9cec3286ca339738b370f3e99285178470c0cac6/analysis/1392891103/

• https://www.virustotal.com/de/file/9d8ab0819fbc70b5b813b5494ea7b2d265ba9d17539be6d0f5e9687843bd04ea/analysis/1392892609/

• https://www.virustotal.com/de/file/ed6cf4753e2ead2289eb857df21df42d6ef61e120013552d36e04a036e46a98c/analysis/1392892669/

OR

http://sandiiegoexpo.ru/expocity.html

• https://www.virustotal.com/de/url/e10e79b4164439018d53e5e5c2292249139f22847952d6a698f579c2ce1dcc18/analysis/1392892505/

------------

• http://jsunpack.jeek.org/?report=8e80d2752b1684ccb8932f9fcacd6aba48781b73
• http://jsunpack.jeek.org/?report=54d2ad555e3ffbfe355275443ee1dcd9ecc779b9

HEUR:Trojan.Script.Generic sitting on www.arcoserv.com.br from BRAZIL and emedemargara.com from CANADA

MALICIOUS SITES: HEUR:Trojan.Script.Generic

http://www.arcoserv.com.br/

• https://www.virustotal.com/de/url/969971f91ee04be15dadc65ef5be7840ada025564a9814675abe4893693c5c6b/analysis/1392809735/

INFECTION:

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/cc90607dd56550c117c0222b8e6750a3b259c11fa8b712ab7f83245013a71ba7/analysis/1392810262/

FULL REPORT:

Full Report

NEWLY DETECTED: ichoicecomputers.com & mwola.com MULTIPLE EXPLOIT KITS (HEUR:Trojan.Script.Generic) Singapore

NEWLY DETECTED MALICIOUS SINGAPUR SITE: MULTIPLE EXPLOIT KITS

DOMAIN:

http://ichoicecomputers.com/

• https://www.virustotal.com/de/url/f70c7291a017d9058b850ef001c861da6f09713dcaae03a346821e12e13cb4f0/analysis/1392799010/

INFECTION:

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/0cf10f4c2dd4723268d178c1c1530160f17902e1ef36ad4204cba7cefc933617/analysis/1392799595/

• https://urlquery.net/report.php?id=9527754

FULL REPORT:

IMPACT EXPLOIT KIT: @ www.hbacklink.com & www.adkreator.com (PAID LINKS) (SINGAPORE & United States - IP 182.50.135.128 - Zeus Tracker)

MALWARE SITE: IMPACT EXPLOIT KIT PATTERN

http://www.hbacklink.com/

• https://www.virustotal.com/de/url/eb5a2bc6a6a9015b8eb73f6abe0f1ef873be71e14cc1b4310c6a99ecbdc23476/analysis/1392748362/

HTML

• https://www.virustotal.com/de/file/b0e4064b12bcd8d9d0ba1f6cb259341f8fa9e885c851296cc4a0342b83d682a6/analysis/1392752133/

IMPACT EXPLOIT KIT PATTERN

• https://urlquery.net/report.php?id=9513916

FULL REPORT:

HEUR:Trojan.Script.Generic ---> artofzengraphics.com IP 216.177.139.128 (Laguna Niguel, California, United States)

MALICIOUS SITE & IP: HEUR:Trojan.Script.Generic

http://artofzengraphics.com/

• https://www.virustotal.com/de/url/81193b530827110d85212ac17af2962377242f30ea759b2b673ecb33a91bc00c/analysis/

INFECTION:

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/28c5a744588396a98aefcd426d21687d6523192503858b9d56bcfa90699938ee/analysis/1392491478/

• http://wepawet.iseclab.org/view.php?hash=bc670ebbbcb5ac14506a784751b405fa&t=1392491777&type=js

FULL REPORT:

SINCE 2009: www.cafi.it Infected with Malware: Malicious Iframe Injection At the Moment: HEUR:Trojan.Script.Iframer (ITALY & UKRAINE)

MALICIOUS DOMAIN ALREADY SINCE 2009: HEUR:Trojan.Script.Iframer (RBN 422) (UKRAINE)

http://www.cafi.it/

• https://www.virustotal.com/de/url/7bd6d2f5f61ade1dcfe6c3357fd48b812d1f40ef8d54b3feae0a71cb831dd2b1/analysis/1392383368/

INFECTION: 

HEUR:Trojan.Script.Iframer

• https://www.virustotal.com/de/file/3510b819f8d1d209bb267f3a721f9cb040fc2c609412e7ace7f2dcd75528e67d/analysis/1392384000/

Mal/Iframe-F

• https://www.virustotal.com/de/file/6eb573fba0944e608d57dc882860149f14bdb2368a295ac19e93f7e6a0072386/analysis/1392383703/

Malicious iframe injection
Javascript associated with malicious code

• https://urlquery.net/report.php?id=9433018

--->

http://91.207.61.32/.r/.fi/index.php

• https://www.virustotal.com/de/url/9d80e5be6628f7734d3fd816c391733b5c4e491c2f96818e22738b8a9c2ed5c7/analysis/1392384629/

• https://urlquery.net/report.php?id=9433214

NEWLY DETECTED: www.albertomanganaro.it Infected with HEUR:Trojan.Script.Generic (ITALY)

NEWLY DETECTED MALWARE SITE FROM ITALY: HEUR:Trojan.Script.Generic

Malicious iframe injection

• https://urlquery.net/report.php?id=9432480

http://www.albertomanganaro.it/

• https://www.virustotal.com/de/url/48d1ce8ef5d827edda2d76a7f190c37d64812b63c905739df28a28101a4732fd/analysis/1392334229/

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/d246753919f66e3b34e54e24c34b4ec331e07afa0a695b4763c7637470a7dea6/analysis/1392335647/

The complete report can be found here:

NEW MALWARE CODE: Trojan-Downloader.JS.Iframe.dfm INFECTED DOMAIN castelgiorgio.com (ITALY - AUSTRALIA - UNITED STATES)

NEWLY DETECTED: ricaworld.altervista.org HEUR:Trojan.Script.Generic (GERMANY)

NEWLY DETECTED MALWARE: HIDDEN IFRAME (HEUR:Trojan.Script.Generic)

ricaworld.altervista.org

• https://www.virustotal.com/de/url/75c19d584b99aa082712e4ff096bc54f5edc683048b8729344b9f854b2608fe7/analysis/1392036074/

INFECTION:

Trojan.JS.QXJ

• https://www.virustotal.com/de/file/e42c571c0963b0d0d7a7344f9582c6252bcf12614a6c8e368559502d643d48c0/analysis/1392036385/

--->

ricaworld.altervista.org/Scripts/AC_RunActiveContent.js

• https://www.virustotal.com/de/url/fb38eb2a93366fdd5276b20f708db788dfcad2f2e6662ff916779246be29b3bf/analysis/1392036955/

INFECTION:

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/b5b1d54315c2a2e9d9486452b6e0b27be42cbe78a31f28d3f49051c30663897a/analysis/1392036765/

• https://www.virustotal.com/de/file/481cdfa5cb56926629612634970abf7679b43261dc92ad5040eba08a513f82fd/analysis/1392036780/

 

--->

chcipenize.wz.cz/mailcheck.php

• https://www.virustotal.com/de/url/de21862addb9217bd2c8085868153c321b2fa58ef42248920d2ad2c819cb269e/analysis/1392037277/

• https://www.virustotal.com/de/file/a406668064e43de3c55fb9293777d8f9651ace466dc1f51bf53fcf9a0402a7d2/analysis/1375077498/

• https://www.virustotal.com/de/file/ac21eb5fb9ff8ad43bf2826385b0019225ed43bbc3098e6ce65542ce8f9b6e12/analysis/1392037253/

--->

www.iws-leipzig.de/contacts.php

• https://www.virustotal.com/de/url/d0b7f370689cad91470fe8264879beeca58ae2600215d5b899d084bde6a25559/analysis/1392037470/

NEW: yansalamandra.ru HEUR:Trojan.Script.Generic Russian Federation

NEWLY DETECTED: MALICIOUS IFRAME (RBN 365)

yansalamandra.ru

• https://www.virustotal.com/de/url/67921025f91c62ba5e76eda2f819051ee0ad0d25d2aa551bdb8b7f215979ce12/analysis/1391972916/

INFECTION: 

HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/4d878e5f2db1d468d80a1d15ab6a5bef205b4834e85e5226f8ba9cae406e4b64/analysis/1391974022/

• https://urlquery.net/report.php?id=9327064

• http://jsunpack.jeek.org/?report=5c2537adab93e2e9a6fa9108f149dc6d9138b788

--->

advomn.pp.ua

• https://www.virustotal.com/de/url/93856bf13af0b2df401a4080f6b72274156db06cc73e05499e0d3cffe0cf7e86/analysis/1391975226/

• https://urlquery.net/report.php?id=9327399

advomn.pp.ua/38c190227eaddbe1e920ad1a993701980a6d4d8e516d3011c2fc023a042b7d4b171a7f801a278e4630354f01a9232a6a3a2ec980002e92716c9ce0dc480c29447345c6dee2d30344b6b

• https://www.virustotal.com/de/url/df4bd15c09f7e998375234b0ec08a26dce90f07c9cd2da9dde32f54ca1336bb2/analysis/1391975200/

--->

changeip.changeip.name/rsize.js

• https://www.virustotal.com/de/url/41c106f4f24956e8e6d031bc20861b77b7b9674f8ad231ef4e51fff8892e90a3/analysis/1391974447/

• https://urlquery.net/report.php?id=9327265

• https://urlquery.net/report.php?id=9327273

------------------------------------------

OTHER MALICIOUS LINK:

yansalamandra.ru/administrator/help/en-GB/chinchin.js

• https://www.virustotal.com/de/url/286c044eac09bac2fe39efa3e21ab1e60bbee92349e1499c02e7efe4e02d7eec/analysis/1391975320/

INFECTION:

Troj/JSRedir-MN

• https://www.virustotal.com/de/file/c3755028d1adf4d41fd5d0ffd1bdabffc9a093be438025b491fca6901c74cc06/analysis/1391975322/

• http://jsunpack.jeek.org/?report=009476f8e2cc5e8c96b8a51b339bcd41b26c9851

Category MALICIOUS IP: 217.74.66.183 (komsta.biz) Infected with a spam or malware forwarding link - Botnet (POLAND) Also: mecsohesti.strefa.pl & berlokava.strefa.pl

The IP address 217.74.66.183 (listed in the CBL (Composite Blocking List)) corresponds to a web site that is infected with a spam or malware forwarding link. The website's host name is "komsta.biz", and this link is an example of the redirect: "http://komsta.biz/xmlrpc/r1.php". In other words the website "komsta.biz" has been hacked. Usually, the redirect takes the user's browser to a spam or malware site. It's usually fake russian pills or pornography.

Most probably, the infection is a Cpanel, Plesk, Joomla or Wordpress CMS install, that has become infected either through a vulnerability (meaning the CMS software is out of date and needs patching), or the owner of "komsta.biz" has had their account information (userids/passwords) compromised. Then malicious software/files are being uploaded by ftp or ssl.

In many cases, particularly with older compromises, the criminals that hacked this site will have uploaded a wide variety of spamming and other compromise tools. Therefore, the account corresponding to "komsta.biz" needs to be examined very carefully for signs of tampering. Further, the criminals will even modify existing web pages (particularly http://komsta.biz itself) to have hidden references to pill/drug/porn sites.

It is believed that the malicious redirects are done by altering web server access control mechanisms (example, ".htaccess" files on Apache web servers), and causing the redirect to occur on all "404 url not found" errors.


REFERENCES:

217.74.66.183

• https://www.virustotal.com/de/url/0a6cbec1348cf0d336786144d8ac8b3392a06044ea45210c1ff7164b935138d3/analysis/1391867416/

LISTED AT SPAMHAUS (CBL):

• http://www.spamhaus.org/query/bl?ip=217.74.66.183

LISTED AT CBL:

• http://cbl.abuseat.org/lookup.cgi?ip=217.74.66.183 

----------------------------------------------------------

komsta.biz

• https://www.virustotal.com/de/url/d075ee0a046bf5b9061d6516f74a2a8a896f6d645b500b82b8e5621cdd347af3/analysis/1391868630/

komsta.biz/xmlrpc/r1.php

• https://www.virustotal.com/de/url/13fe2e198d34cfb1180de459f3cdc711cd35315653a442f5ea4cfae49d771803/analysis/ 

---------------------------------------------------------

Other Malicious Domains connected to this IP:

mecsohesti.strefa.pl

• https://www.virustotal.com/de/url/7b8461c8134626cc15ae094d9ae3c6fa82c82a417cc6936693dbaac78829481e/analysis/1391866196/

mecsohesti.strefa.pl/908juare3rm.js

• https://www.virustotal.com/de/url/e953124d50e1310dd2812e263931848b00d462470c676a634e4cb399cfa6b92a/analysis/1391866188/

• https://www.virustotal.com/de/file/b16b4bdb5699e781801c38303ff0843681d622683b1edfaefe7d9255da7cdc36/analysis/1391865764/

• http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=mecsohesti.strefa.pl

---------------------------------------------------------

berlokava.strefa.pl

• https://www.virustotal.com/de/url/3ade4568cc4b8450928f22fdc2ef3961f253073f5854b1cecc26274ddce8afc6/analysis/1391865399/

INFECTED WITH: HTML:Script-inf

• https://www.virustotal.com/de/file/1b9c71d4ede9b1b74f6a228fd391b1532e2dbe90c78ef3bbb77effbebac9693c/analysis/1391865730/

• http://wepawet.iseclab.org/view.php?hash=f54d99392772ab74cc133e0920e5a658&t=1391865424&type=js

• http://zulu.zscaler.com/submission/show/4f05692eb30713ac8402cef9ce93cb06-1391865434

arifizgidizayn.com (MALICIOUS DOMAIN) Infected with: HEUR:Trojan.Script.Generic (EXPLOIT KIT, TURKEY)

MALICIOUS DOMAIN: EXPLOIT (KIT)

arifizgidizayn.com

• https://www.virustotal.com/de/url/6d6c58ba2c1ccebe07cdae728992b6ecb9ada7c603b89df47fc4fda6dd80a703/analysis/1391683685/

SPECIFIC LINK:

arifizgidizayn.com/swfnoborder.js

• https://www.virustotal.com/de/url/0505699678769fee5f460fc5d4d1eb04c24ad093d348504cfd2dd82860e595a4/analysis/1391683043/

https://www.virustotal.com/de/file/24a0434d89dfd70c0b84e3caa8adb9231512568bf2caf24d2bb9a6d7404952bb/analysis/1391683046/

Malware Network Compromised Redirect

• https://urlquery.net/report.php?id=9252311

• http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=arifizgidizayn.com

---> PATH


DOMAIN:

habibtour.com.au

• https://www.virustotal.com/de/url/1ab36c262cf6533186fbe3a53be55e00d781a106bbffce7bea5fdbff8feab24a/analysis/1391683497/

SPECIFIC REDIRECTION LINK(s) (SUSPENDED):

habibtour.com.au/language/t.php

• https://www.virustotal.com/de/url/7506f10411b494a3fdd3e39a6485ff45534f0ea20342a400ffdf22ae4c6238e8/analysis/1391683482/

• https://www.virustotal.com/de/file/07f99e34de6b4f4707f502d1cfcf2957b330c5ff713cf377d1eb82b85f975539/analysis/1391414551/

habibtour.com.au/cgi-sys/suspendedpage.cgi

• https://www.virustotal.com/de/url/be266fdc5e1bb28d85a41c7de7af5c0fce9c078aa3bcab1d83530e56c0fe52ca/analysis/1391683618/

MALWARE: zorder.co.nz INFECTED WITH: HEUR:Trojan.Script.Generic (TrojWare.JS.TrojanDownloader.Iframe.MAD) United States

MALICIOUS DOMAIN: TROJAN SCRIPT

SCREENSHOT OF SCRIPT

DOMAIN:

zorder.co.nz

• https://www.virustotal.com/de/url/51c428d8f76369716dfd470c39b02befd1f4b3a2cc1cbbc5d4047e15a814769d/analysis/

MALICIOUS URL (SCRIPT):

zorder.co.nz/js/jquery.anchorScroll.js

• https://www.virustotal.com/de/url/bde3af1fc4072773b904173f89dba6ccfc3760390fc0482cec0b782bd3570a68/analysis/

INFECTED WITH: HEUR:Trojan.Script.Generic

• https://www.virustotal.com/de/file/f5881bd0bf3a8af23cc88f2d00096ee5c1e67f56be5b0adc9679a3570058623f/analysis/1391277589/

ADDITIONAL INFO:

• http://app.webinspector.com/public/reports/19840092

• http://jsunpack.jeek.org/?report=57f974f0b6eb671bf48be8d546e55b46ceba45b3

• http://zulu.zscaler.com/submission/show/790880c97012d751aae8bdd695b40ae7-1391277900