Fake AV

[EP_X0FF]

There is actually more of them.

hxxp://95.163.66.208/files/92
hxxp://95.163.66.208/files/93
hxxp://95.163.66.208/files/96
hxxp://95.163.66.208/files/97
hxxp://95.163.66.208/files/98
hxxp://95.163.66.208/files/99
hxxp://95.163.66.208/files/101
hxxp://95.163.66.208/files/104
hxxp://95.163.66.208/files/105
hxxp://95.163.66.208/files/106
hxxp://95.163.66.208/files/107
hxxp://95.163.66.208/files/108
hxxp://95.163.66.208/files/109
hxxp://95.163.66.208/files/114
hxxp://95.163.66.208/files/115
hxxp://95.163.66.208/files/116
hxxp://95.163.66.208/files/117
hxxp://95.163.66.208/files/118

[HGPower]

Thanks for the additional url's EP_X0FF.

There was one other;
Fake HDD-Data Restore Photo Attached

Code: [Select]

http://95.163.66.208/files/119119.exe VT 5/43
MD5: 58785d416eae6bbeca5a0a214197faec
http://www.virustotal.com/file-scan/report.html?id=624c427b566aa409dd16574550e19af54463b2712e0e7bd239e5eeb397fbe266-1317432710

[HGPower]

Fake AV URL's  
Same payload Security Sphere as the hxxp://95.163.66.208/ url's except file names are
info.exe, about.exe, readme.exe, & contacts.exe
with the exception of the 2 url's ending with 119 which are Fake HDD-Data Restore

Security Sphere
info.exe  5/44
MD5:16a20d53ce8fa7a922af35139bcf2177
http://www.virustotal.com/file-scan/report.html?id=e705203f1a2ccb06668a77bd7922efd1272e06a76cea26c3f5c3dbe504fe73d7-1317536151

Fake HDD-Data Restore
readme.exe 9/44
MD5: 5fa93aed9bb95a1b048a11dae919094d
http://www.virustotal.com/file-scan/report.html?id=5aaa82535df41546c4034afd80cb07307e970665b87031f6a1d9a07f9b9771ce-1317539100

Code: [Select]

http://daxzaz.cx.cc/w.php?e=4&f=28
http://daxzaz.cx.cc/w.php?e=4&f=29
http://daxzaz.cx.cc/w.php?e=4&f=30
http://daxzaz.cx.cc/w.php?e=4&f=31
http://daxzaz.cx.cc/w.php?e=4&f=32
http://daxzaz.cx.cc/w.php?e=4&f=33
http://daxzaz.cx.cc/w.php?e=4&f=34
http://daxzaz.cx.cc/w.php?e=4&f=35
http://daxzaz.cx.cc/w.php?e=4&f=36
http://daxzaz.cx.cc/w.php?e=4&f=37
http://daxzaz.cx.cc/w.php?e=4&f=39
http://daxzaz.cx.cc/w.php?e=4&f=41
http://daxzxz.cx.cc/w.php?e=4&f=42
http://daxzxz.cx.cc/w.php?e=4&f=43
http://daxzxz.cx.cc/w.php?e=4&f=44
http://daxzxz.cx.cc/w.php?e=4&f=45
http://daxzxz.cx.cc/w.php?e=4&f=46
http://daxzxz.cx.cc/w.php?e=4&f=49
http://daxzxz.cx.cc/w.php?e=4&f=50
http://daxzxz.cx.cc/w.php?e=4&f=51
http://daxzxz.cx.cc/w.php?e=4&f=52
http://daxzxz.cx.cc/w.php?e=4&f=53
http://daxzxz.cx.cc/w.php?e=4&f=55
http://daxzxz.cx.cc/w.php?e=4&f=56
http://daxzxz.cx.cc/w.php?e=4&f=57
http://daxzxz.cx.cc/w.php?e=4&f=59
http://daxzxz.cx.cc/w.php?e=4&f=60
http://daxzxz.cx.cc/w.php?e=4&f=61
http://daxzxz.cx.cc/w.php?e=4&f=62
http://daxzxz.cx.cc/w.php?e=4&f=63
http://daxzxz.cx.cc/w.php?e=4&f=65
http://daxzxz.cx.cc/w.php?e=4&f=66
http://daxzxz.cx.cc/w.php?e=4&f=70
http://daxzxz.cx.cc/w.php?e=4&f=71
http://daxzxz.cx.cc/w.php?e=4&f=72
http://daxzxz.cx.cc/w.php?e=4&f=75
http://daxzxz.cx.cc/w.php?e=4&f=78
http://daxzxz.cx.cc/w.php?e=4&f=80
http://daxzxz.cx.cc/w.php?e=4&f=81
http://daxzxz.cx.cc/w.php?e=4&f=82
http://daxzxz.cx.cc/w.php?e=4&f=85
http://daxzxz.cx.cc/w.php?e=4&f=88
http://daxzxz.cx.cc/w.php?e=4&f=92
http://daxzxz.cx.cc/w.php?e=4&f=93
http://daxzxz.cx.cc/w.php?e=4&f=96
http://daxzxz.cx.cc/w.php?e=4&f=97
http://daxzxz.cx.cc/w.php?e=4&f=98
http://daxzxz.cx.cc/w.php?e=4&f=99
http://daxzxz.cx.cc/w.php?e=4&f=101
http://daxzxz.cx.cc/w.php?e=4&f=104
http://daxzxz.cx.cc/w.php?e=4&f=105
http://daxzxz.cx.cc/w.php?e=4&f=106
http://daxzxz.cx.cc/w.php?e=4&f=107
http://daxzxz.cx.cc/w.php?e=4&f=108
http://daxzxz.cx.cc/w.php?e=4&f=109
http://daxzxz.cx.cc/w.php?e=4&f=114
http://daxzxz.cx.cc/w.php?e=4&f=115
http://daxzxz.cx.cc/w.php?e=4&f=116
http://daxzxz.cx.cc/w.php?e=4&f=117
http://daxzxz.cx.cc/w.php?e=4&f=118
http://daxzxz.cx.cc/w.php?e=4&f=119


Code: [Select]

http://vaszxz.cx.cc/w.php?e=4&f=28
http://vaszxz.cx.cc/w.php?e=4&f=29
http://vaszxz.cx.cc/w.php?e=4&f=30
http://vaszxz.cx.cc/w.php?e=4&f=31
http://vaszxz.cx.cc/w.php?e=4&f=32
http://vaszxz.cx.cc/w.php?e=4&f=33
http://vaszxz.cx.cc/w.php?e=4&f=34
http://vaszxz.cx.cc/w.php?e=4&f=35
http://vaszxz.cx.cc/w.php?e=4&f=36
http://vaszxz.cx.cc/w.php?e=4&f=37
http://vaszxz.cx.cc/w.php?e=4&f=39
http://vaszxz.cx.cc/w.php?e=4&f=41
http://vaszxz.cx.cc/w.php?e=4&f=42
http://vaszxz.cx.cc/w.php?e=4&f=43
http://vaszxz.cx.cc/w.php?e=4&f=44
http://vaszxz.cx.cc/w.php?e=4&f=45
http://vaszxz.cx.cc/w.php?e=4&f=46
http://vaszxz.cx.cc/w.php?e=4&f=49
http://vaszxz.cx.cc/w.php?e=4&f=50
http://vaszxz.cx.cc/w.php?e=4&f=51
http://vaszxz.cx.cc/w.php?e=4&f=52
http://vaszxz.cx.cc/w.php?e=4&f=53
http://vaszxz.cx.cc/w.php?e=4&f=55
http://vaszxz.cx.cc/w.php?e=4&f=56
http://vaszxz.cx.cc/w.php?e=4&f=57
http://vaszxz.cx.cc/w.php?e=4&f=59
http://vaszxz.cx.cc/w.php?e=4&f=60
http://vaszxz.cx.cc/w.php?e=4&f=61
http://vaszxz.cx.cc/w.php?e=4&f=62
http://vaszxz.cx.cc/w.php?e=4&f=63
http://vaszxz.cx.cc/w.php?e=4&f=65
http://vaszxz.cx.cc/w.php?e=4&f=66
http://vaszxz.cx.cc/w.php?e=4&f=70
http://vaszxz.cx.cc/w.php?e=4&f=71
http://vaszxz.cx.cc/w.php?e=4&f=72
http://vaszxz.cx.cc/w.php?e=4&f=75
http://vaszxz.cx.cc/w.php?e=4&f=78
http://vaszxz.cx.cc/w.php?e=4&f=80
http://vaszxz.cx.cc/w.php?e=4&f=81
http://vaszxz.cx.cc/w.php?e=4&f=82
http://vaszxz.cx.cc/w.php?e=4&f=85
http://vaszxz.cx.cc/w.php?e=4&f=88
http://vaszxz.cx.cc/w.php?e=4&f=92
http://vaszxz.cx.cc/w.php?e=4&f=93
http://vaszxz.cx.cc/w.php?e=4&f=96
http://vaszxz.cx.cc/w.php?e=4&f=97
http://vaszxz.cx.cc/w.php?e=4&f=98
http://vaszxz.cx.cc/w.php?e=4&f=99
http://vaszxz.cx.cc/w.php?e=4&f=101
http://vaszxz.cx.cc/w.php?e=4&f=104
http://vaszxz.cx.cc/w.php?e=4&f=105
http://vaszxz.cx.cc/w.php?e=4&f=106
http://vaszxz.cx.cc/w.php?e=4&f=107
http://vaszxz.cx.cc/w.php?e=4&f=108
http://vaszxz.cx.cc/w.php?e=4&f=109
http://vaszxz.cx.cc/w.php?e=4&f=114
http://vaszxz.cx.cc/w.php?e=4&f=115
http://vaszxz.cx.cc/w.php?e=4&f=116
http://vaszxz.cx.cc/w.php?e=4&f=117
http://vaszxz.cx.cc/w.php?e=4&f=118
http://vaszxz.cx.cc/w.php?e=4&f=119


[HGPower]

Fake AV URL's

Advanced PC Shield 2012
readme.exe 32/43
MD5: 0d18cb2aa046934f8a3f87230376b033
http://www.virustotal.com/file-scan/report.html?id=a845670a8951f7ffa30e879ce222d89e9641d1a7e6b37a397417f1d9871cc7d9-1318415078
Security Sphere
28.exe 29/43
MD5: 656af96278588387ef03f2cd362c2345
http://www.virustotal.com/file-scan/report.html?id=12f04ace9f97e774c9b12d473c89925fb989fed474d74aa0606c0b010d511ec6-1318414769

Code: [Select]

http://182.18.185.81/files/28
http://182.18.185.81/files/29
http://182.18.185.81/files/30
http://182.18.185.81/files/31
http://182.18.185.81/files/32
http://182.18.185.81/files/33
http://182.18.185.81/files/34
http://182.18.185.81/files/35
http://182.18.185.81/files/36
http://182.18.185.81/files/37
http://182.18.185.81/files/38
http://182.18.185.81/files/39
http://182.18.185.81/files/41
http://182.18.185.81/files/42
http://182.18.185.81/files/43
http://182.18.185.81/files/44
http://182.18.185.81/files/45
http://182.18.185.81/files/46
http://182.18.185.81/files/47
http://182.18.185.81/files/49
http://182.18.185.81/files/50
http://182.18.185.81/files/51
http://182.18.185.81/files/52
http://182.18.185.81/files/53
http://182.18.185.81/files/55
http://182.18.185.81/files/56
http://182.18.185.81/files/57
http://182.18.185.81/files/59
http://182.18.185.81/files/60
http://182.18.185.81/files/61
http://182.18.185.81/files/62
http://182.18.185.81/files/63
http://182.18.185.81/files/65
http://182.18.185.81/files/66
http://182.18.185.81/files/67
http://182.18.185.81/files/70
http://182.18.185.81/files/71
http://182.18.185.81/files/72
http://182.18.185.81/files/74
http://182.18.185.81/files/75
http://182.18.185.81/files/80
http://182.18.185.81/files/81
http://182.18.185.81/files/82
http://182.18.185.81/files/85
http://182.18.185.81/files/86
http://182.18.185.81/files/88
http://182.18.185.81/files/92
http://182.18.185.81/files/93
http://182.18.185.81/files/96
http://182.18.185.81/files/97
http://182.18.185.81/files/98
http://182.18.185.81/files/99
http://182.18.185.81/files/101
http://182.18.185.81/files/104
http://182.18.185.81/files/105
http://182.18.185.81/files/106
http://182.18.185.81/files/107
http://182.18.185.81/files/108
http://182.18.185.81/files/109
http://182.18.185.81/files/114
http://182.18.185.81/files/115
http://182.18.185.81/files/116
http://182.18.185.81/files/117
http://182.18.185.81/files/118

Code: [Select]

http://182.18.185.81/w.php?e=4&f=28
http://182.18.185.81/w.php?e=4&f=29
http://182.18.185.81/w.php?e=4&f=30
http://182.18.185.81/w.php?e=4&f=31
http://182.18.185.81/w.php?e=4&f=32
http://182.18.185.81/w.php?e=4&f=33
http://182.18.185.81/w.php?e=4&f=34
http://182.18.185.81/w.php?e=4&f=35
http://182.18.185.81/w.php?e=4&f=36
http://182.18.185.81/w.php?e=4&f=37
http://182.18.185.81/w.php?e=4&f=39
http://182.18.185.81/w.php?e=4&f=41
http://182.18.185.81/w.php?e=4&f=42
http://182.18.185.81/w.php?e=4&f=43
http://182.18.185.81/w.php?e=4&f=44
http://182.18.185.81/w.php?e=4&f=45
http://182.18.185.81/w.php?e=4&f=46
http://182.18.185.81/w.php?e=4&f=49
http://182.18.185.81/w.php?e=4&f=50
http://182.18.185.81/w.php?e=4&f=51
http://182.18.185.81/w.php?e=4&f=52
http://182.18.185.81/w.php?e=4&f=53
http://182.18.185.81/w.php?e=4&f=55
http://182.18.185.81/w.php?e=4&f=56
http://182.18.185.81/w.php?e=4&f=57
http://182.18.185.81/w.php?e=4&f=59
http://182.18.185.81/w.php?e=4&f=60
http://182.18.185.81/w.php?e=4&f=61
http://182.18.185.81/w.php?e=4&f=62
http://182.18.185.81/w.php?e=4&f=63
http://182.18.185.81/w.php?e=4&f=65
http://182.18.185.81/w.php?e=4&f=66
http://182.18.185.81/w.php?e=4&f=70
http://182.18.185.81/w.php?e=4&f=71
http://182.18.185.81/w.php?e=4&f=72
http://182.18.185.81/w.php?e=4&f=75
http://182.18.185.81/w.php?e=4&f=78
http://182.18.185.81/w.php?e=4&f=80
http://182.18.185.81/w.php?e=4&f=81
http://182.18.185.81/w.php?e=4&f=82
http://182.18.185.81/w.php?e=4&f=85
http://182.18.185.81/w.php?e=4&f=88
http://182.18.185.81/w.php?e=4&f=92
http://182.18.185.81/w.php?e=4&f=93
http://182.18.185.81/w.php?e=4&f=96
http://182.18.185.81/w.php?e=4&f=97
http://182.18.185.81/w.php?e=4&f=98
http://182.18.185.81/w.php?e=4&f=99
http://182.18.185.81/w.php?e=4&f=101
http://182.18.185.81/w.php?e=4&f=104
http://182.18.185.81/w.php?e=4&f=105
http://182.18.185.81/w.php?e=4&f=106
http://182.18.185.81/w.php?e=4&f=107
http://182.18.185.81/w.php?e=4&f=108
http://182.18.185.81/w.php?e=4&f=109
http://182.18.185.81/w.php?e=4&f=114
http://182.18.185.81/w.php?e=4&f=115
http://182.18.185.81/w.php?e=4&f=116
http://182.18.185.81/w.php?e=4&f=117
http://182.18.185.81/w.php?e=4&f=118


Code: [Select]

http://182.18.185.81/w.php?f=106&e=28
http://182.18.185.81/w.php?f=106&e=29
http://182.18.185.81/w.php?f=106&e=30
http://182.18.185.81/w.php?f=106&e=31
http://182.18.185.81/w.php?f=106&e=32
http://182.18.185.81/w.php?f=106&e=33
http://182.18.185.81/w.php?f=106&e=34
http://182.18.185.81/w.php?f=106&e=35
http://182.18.185.81/w.php?f=106&e=36
http://182.18.185.81/w.php?f=106&e=37
http://182.18.185.81/w.php?f=106&e=39
http://182.18.185.81/w.php?f=106&e=41
http://182.18.185.81/w.php?f=106&e=42
http://182.18.185.81/w.php?f=106&e=43
http://182.18.185.81/w.php?f=106&e=44
http://182.18.185.81/w.php?f=106&e=45
http://182.18.185.81/w.php?f=106&e=46
http://182.18.185.81/w.php?f=106&e=49
http://182.18.185.81/w.php?f=106&e=50
http://182.18.185.81/w.php?f=106&e=51
http://182.18.185.81/w.php?f=106&e=52
http://182.18.185.81/w.php?f=106&e=53
http://182.18.185.81/w.php?f=106&e=55
http://182.18.185.81/w.php?f=106&e=56
http://182.18.185.81/w.php?f=106&e=57
http://182.18.185.81/w.php?f=106&e=59
http://182.18.185.81/w.php?f=106&e=60
http://182.18.185.81/w.php?f=106&e=61
http://182.18.185.81/w.php?f=106&e=62
http://182.18.185.81/w.php?f=106&e=63
http://182.18.185.81/w.php?f=106&e=65
http://182.18.185.81/w.php?f=106&e=66
http://182.18.185.81/w.php?f=106&e=70
http://182.18.185.81/w.php?f=106&e=71
http://182.18.185.81/w.php?f=106&e=72
http://182.18.185.81/w.php?f=106&e=75
http://182.18.185.81/w.php?f=106&e=78
http://182.18.185.81/w.php?f=106&e=80
http://182.18.185.81/w.php?f=106&e=81
http://182.18.185.81/w.php?f=106&e=82
http://182.18.185.81/w.php?f=106&e=85
http://182.18.185.81/w.php?f=106&e=88
http://182.18.185.81/w.php?f=106&e=92
http://182.18.185.81/w.php?f=106&e=93
http://182.18.185.81/w.php?f=106&e=96
http://182.18.185.81/w.php?f=106&e=97
http://182.18.185.81/w.php?f=106&e=98
http://182.18.185.81/w.php?f=106&e=99
http://182.18.185.81/w.php?f=106&e=101
http://182.18.185.81/w.php?f=106&e=104
http://182.18.185.81/w.php?f=106&e=105
http://182.18.185.81/w.php?f=106&e=106
http://182.18.185.81/w.php?f=106&e=107
http://182.18.185.81/w.php?f=106&e=108
http://182.18.185.81/w.php?f=106&e=109
http://182.18.185.81/w.php?f=106&e=114
http://182.18.185.81/w.php?f=106&e=115
http://182.18.185.81/w.php?f=106&e=116
http://182.18.185.81/w.php?f=106&e=117
http://182.18.185.81/w.php?f=106&e=118
http://182.18.185.81/w.php?f=106&e=119