daily something......

[sparsha]

Code: [Select]


http://antivir-scan-pro-best.com/11041/3/
http://files.load-archive-av-pro.com/normal/setup_11041_3_1.exe
http://int.sysproreport1.com/stat.php?func=installrun&id=11041&landing=-1&lang=EN&sub=1&notstat=1
http://dl.super-top-scan-pro.com/get/?pin=11041&lnd=-1&type=main

http://files.get-fails-load-av.com/release/setup.exe
http://dl.scan-anti-spy-4free.com/get/?pin=0&lnd=-1&type=scanner



[SysAdMini]

Code: [Select]

music24shop.net/2/in.phphttp://wepawet.cs.ucsb.edu/view.php?hash=cbf9102477119497295d517be62e4053&t=1240651814&type=js

Code: [Select]

http://music24shop.net/2/pdf.phphttp://www.virustotal.com/analisis/08f4c49651626507490afd80932f4f71 1/38

Code: [Select]

music24shop.net/2/load.php?id=6http://www.virustotal.com/analisis/dd3c7093b2b0827d6ee987b83f015faa 7/40

[CkreM]

Exploit/trojan:

Code: [Select]

wtopcompany.ru/cms/cache/readme.pdfhttp://wepawet.iseclab.org/view.php?hash=3f1acb074a6e8c6b03da890c06e1c4db&t=1240555768&type=js

Fake AV scan:

Code: [Select]

tubeontvgl.com/scan/?id=262whats downloaded from there:

Code: [Select]

uploadmoviez.com/codec.exehttp://www.virustotal.com/analisis/3a09d83950707cd8c0f4c23d913c0129

Same files on the same ip:

Code: [Select]

youngsters.ru/codec.exe
pc-codec-pack.com/codec.exe
suckitnow1.net/codec.exe
velzevuladmin.com/codec.exe

[CkreM]

Rogue:

Code: [Select]

Snobelium.com
Diastolea.com
cussermono.com

[SysAdMini]

Rogue:

Code: [Select]

Snobelium.com
Diastolea.com
cussermono.com

look like templates for future fake avs. there is no additional content than the page itself.

[CkreM]

Rogue:

Code: [Select]

Snobelium.com
Diastolea.com
cussermono.com

look like templates for future fake avs. there is no additional content than the page itself.

yea i noticed that.
will have content in the future probably..


seem like irc bot/backdoor:

Code: [Select]

77.75.105.221/e-card/e-card.gif.exehttp://www.virustotal.com/analisis/335638c7877b9d21eabb7f5e12881fe9

[RS-232]

For the fun of it...

hxxp://youarelucky.biz/SmartDownload.exe
http://www.virustotal.com/analisis/786657fbd9af08fef0cb1745bce68fa5
hxxp://200.122.168.229/dl/goldvipclub/TrackDownload.dll?DID=991392
http://www.virustotal.com/analisis/5d97aab77fba7ca6ab7ecf6728034a15
hxxp://200.122.168.229/dl/goldvipclub/
http://www.virustotal.com/analisis/aef4b913ccfbe8918e83a8ed48870ddd

[XiTri]

This

Code: [Select]

http://neono.biz/myy/index.phpAnd this

Code: [Select]

http://tipojud.com/quq/1/loads.php?id=68

[Malware-Web-Threats]

exploits:

Code: [Select]

hxxp://210.240.61.68/fish/GV14.htmWepawet

trojan:

Code: [Select]

hxxp://www.spps.hlc.edu.tw/fish/1.exeVirusTotal - 17/40 (42.5%)
Anubis

[michajp]

'Greeting cards' (IRC bot/backdoor):

Code: [Select]

hxxp://greetings.3utilities.com/logs/greetings.exe
hxxp://66.83.239.226/E-Greetings.exe


[CkreM]

Fake AV:

Code: [Select]

fullsecurityaction.com
Anytoplikedsite.com
yourpcshield.com
totalvirushield.com
myfirstsecurityscan.com
stopspyware.org
Exploit/trojan

Code: [Select]

78.47.132.221/l3/index.phphttp://wepawet.cs.ucsb.edu/view.php?hash=6f5cdfe1c1aeb5cd68a034c3c2984dc8&t=1240889755&type=js

Seems like koobface

Code: [Select]

70.254.41.230/setup.exehttp://www.virustotal.com/analisis/9dfc0bc4f3e5ea13ae76859d939a8fd8

[RS-232]

hxxp://verringo.cn/bmngr2/controller.php?action=bot&entity_list=

From the same ip:

hxxp://www.downloads-123.com/dyyhhj1g/3j2khf32/aap.exe
http://www.virustotal.com/analisis/85d89df7d1f11b6178ba112551a4c248
hxxp://downloads-123.com/guard.exe
http://www.virustotal.com/analisis/1e3f57b7808d6e154dcea62a6e53d2f0
Result: 1/40 (2.5%)

hxxp://91.207.61.12/stata/controller.php?action=bot&entity_list=

From the same ip:

hxxp://tomohappy.com/forum/data.php?id=500
hxxp://tomohappy.com/forum/data.php?id=5xx   // where xx is whatever numeric value...
http://www.virustotal.com/analisis/97eb93b986035c20b613677ba6235136
Result: 13/40 (32.50%)

hxxp://goooodbill.cn/unig/load.php
http://www.virustotal.com/analisis/5b838bbb5899ae16758851bf33d7521c
Result: 15/40 (37.5%)

hxxp://myspyfiles.cn/qazwsx/index.php

Injection - redirects to the already listed rutraff.cn:
http://www.google.com/search?hl=en&q=myspyfiles.cn&btnG=Google+Search

hxxp://xcount.cc/ads/in.cgi?13
hxxp://weh8dnb.com/cp/index.php
hxxp://weh8dnb.com/cp/load.php
http://www.virustotal.com/analisis/143e40ce67aa7846b7a06ac080c6bb34
Result: 4/40 (10%)

[SysAdMini]

Code: [Select]

sorwwwros.cn/life/t.php

Code: [Select]

sorwwwros.cn/life/fdoc.pdfhttp://www.virustotal.com/analisis/7e2777e6031abc9c55597bd880ad2f25 6/40
MD5...: 9de067ace8636a8a788a3925533e9660
http://wepawet.cs.ucsb.edu/view.php?hash=9de067ace8636a8a788a3925533e9660&type=js

Code: [Select]

sorwwwros.cn/life/fdem.swfhttp://www.virustotal.com/analisis/75ff201372b07627b2e00defa0739510 0/40
MD5...: c7c0f03b8a7fec6b163c501bcb4d8500

payload

Code: [Select]

sorwwwros.cn/life/l.php?b=4&s=PDFhttp://www.virustotal.com/analisis/0b67d1b488abcb478155d20ec2708633 17/40
MD5...: 84909a9d6cdc7c50cfd9da181232df7a

[RS-232]

The...usual suspects:

hxxp://rxtraffclicks.com/download/1/1000/5
http://www.virustotal.com/analisis/4e670f047ca735c1e65f8e8aa458ca1f
Result: 15/40 (37.5%)

hxxp://pornosbest.com/movies/movie1.wmv.exe
http://www.virustotal.com/analisis/64bb880feb8b31a351c2809dc8549dde
Result: 12/40 (30%)

====================
These ones are currently being injected in unsuspected sites...for now,they all leed to (already listed) litevehiclemall.cn...

hxxp://betbigwager.cn/in.cgi?income61
hxxp://hotslotpot.cn/in.cgi?income65
hxxp://litecartop.cn/in.cgi?income70
hxxp://lotultimatebet.cn/in.cgi?income60

http://www.robtex.com/ip/213.163.91.93.html
http://www.bfk.de/bfk_dnslogger.html?query=213.163.91.93#result
And...
http://www.robtex.com/ip/213.182.197.23.html
http://www.bfk.de/bfk_dnslogger.html?query=213.182.197.23#result

Another one which is being injected...

hxxp://nyoflak.com/?click=3C5DCB

According to Wepawet,it also leads to "openstats.info":
http://wepawet.cs.ucsb.edu/view.php?hash=b8ace1842982cb47ee7a390120812436&t=1240920333&type=js
But someone didn't wanted to blacklist openstats.info few days earlier that i had mentioned it...    

Yet one more:

hxxp://nipkelo.net/?click=5A158BD

The story in short - with even more domains to be blocked etc etc...
http://blog.unmaskparasites.com/2009/04/15/malicious-income-iframes-from-cn-domains/

hxxp://simple-faq.cc/stat.js
hxxp://a-stone.biz/xZfmG3YK1/
hxxp://a-stone.biz/xZfmG3YK1/flash.php?id=1647&spl=14
hxxp://a-stone.biz/xZfmG3YK1/load.php?id=1647
http://www.virustotal.com/analisis/b9495d617e3535b2420d19e25ce1b57f
Result: 16/40 (40%)

Now,what i've found rather interesting...is what happens when quering a-stone.biz directly,via Wepawet...and without with simple-faq.cc referrer:
http://wepawet.cs.ucsb.edu/view.php?hash=5a514c44b04f33c1834083a2a05e1432&t=1240934612&type=js

Code: [Select]

Redirects
From
http://a-stone.biz/xZfmG3YK1/
To
http://grabberz.comIt's a small world out there...   

[RS-232]

Another lameness which is being injected to sites out there...

hxxp://77.92.158.122/webmail/inc/web/index.php

hxxp://77.92.158.122/webmail/inc/web/include/two.pdf
http://www.virustotal.com/analisis/29e7ee82e1302ef9559db58b41527755
Result: 14/40 (35%)

hxxp://77.92.158.122/webmail/inc/ -> Open dir...