Mr Clean's dirt

[Mr Clean]

Code: [Select]

http://download.av-best.info/install.php?campaign=mmb_3593020743&country=en&counter=0&campaign=mmb_3593020743&landid=4
Referer: http://scanner.av-best.info/scan.php?campaign=mmb_3593020743&landid=4


Downloads a file called AntiVirusInstaller.exe

http://www.virustotal.com/analisis/7a63e24b4f5b13ea8f13c4ddeeb467f2
http://www.threatexpert.com/report.aspx?md5=8d7463acc24e8bcb5c569d0ad2a23dba

[Mr Clean]

Code: [Select]

http://dwnld.promotion-offer.com/secure/d3176d39144e0a6fc93c2a7d3f0b4471/49d0bb49/srm/srm_free_setup.exe

http://www.virustotal.com/analisis/7a0fe250cb4f063ccb32089f240842f6

[Mr Clean]

It all starts here:

Code: [Select]

GET: http://pnfzetnax.nethttp://pnfzetnax.net/est/ HTTP/1.1"

Referrer: http://media2.mediafileshost.com/images/5516_562850_7444899_250_300.swf?clickTAG=http%3A//12.47.196.61/ct.jsp%3Fp%3D112801%26appid%3D32255%2"


SRC: GET /est/ HTTP/1.1
SRC: Accept: */*
SRC: Accept-Language: en-us
SRC: UA-CPU: x86
SRC: Accept-Encoding: gzip, deflate
SRC: User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648)
SRC: Host: pnfzetnax.net
SRC: Connection: Keep-Alive
SRC:
SRC:
DST: HTTP/1.1 302 Found
DST: Server: nginx/0.6.32
DST: Date: Mon, 30 Mar 2009 19:13:38 GMT
DST: Content-Type: text/html
DST: Transfer-Encoding: chunked
DST: Connection: close
DST: Set-Cookie: SL_25_0000=_1_; domain=webstatsmaster.com; path=/; expires=Tue, 31-Mar-2009 19:13:18 GMT
DST: Location: http://67.215.246.138/aff56.php

to download this nice pdf:

Code: [Select]

http://67.215.246.138/a9/pdf.php?u=i_7_0

http://www.virustotal.com/analisis/9e90711ccbb0a0d013a02094d5773fca
http://wepawet.iseclab.org/view.php?hash=7bff4ce3676fc2e12093b0791c1d0c9e&t=1238220458&type=js

immediately followed by this goodie:

Code: [Select]

http://67.215.246.138/a9/aff_9.exe?u=i_7_0&spl=p1

http://www.virustotal.com/analisis/030c906429c51e38b75bda1f15eee8f8
http://www.threatexpert.com/report.aspx?md5=264c543ac609726837815a398f1ea8df

[Mr Clean]

Code: [Select]

http://www.pornoget.info/sexnew22ii/browser-video-object2.exe

http://www.virustotal.com/analisis/ce4512e7c219df07a0bb85f42547ec67
http://www.threatexpert.com/report.aspx?md5=16b7227d021f7f7073b50ae8769ea7f1
http://anubis.iseclab.org/?action=result&task_id=17734c4d20134fd0405ac17ef81bbfdee&format=html

[MysteryFCM]

Nice one, cheers

[Mr Clean]

Nice one, cheers

thanks. 

I like what you guys/gals have going here.   

More dirt, without a doubt, is on it's way.   

[Mr Clean]

This domain isn't unknown but here's more evidence of it's bad behaviour

Code: [Select]

http://i1match361.biz/file/2440/f8ae8aedaf494548b681dedb37dd3d5f/0.exe.bak

http://www.virustotal.com/analisis/ddbc6d82836afea549062340220fed9c

[Mr Clean]

Code: [Select]

http://loyaldown99.com/codec/259.exe

http://www.virustotal.com/analisis/81af29e6474cebea18f2d20bb94ba75d

[Mr Clean]

Code: [Select]

http://ultracleaner.biz/download.php?affid=02935

downloads install.exe

http://www.virustotal.com/analisis/de2069149077bdac0ddb6ebb497d4e64
http://www.threatexpert.com/report.aspx?md5=319d046a673a0f50652b9e2884233dd6

BTW, there is an important lesson here, NEVER EVER trust DNS PTR records.  PTR record says it's google.com

Code: [Select]

$ dig ultracleaner.biz +short
84.16.227.222
$ dig -x 84.16.227.222 +short
84-16-227-222.google.com.

[SysAdMini]

Code: [Select]

http://ultracleaner.biz/download.php?affid=02935


http://www.malwaredomainlist.com/mdl.php?search=84.16.227.222&colsearch=All&quantity=50

[Mr Clean]

Code: [Select]

http://kol-development.com/viewtubesoftware.40019.exe

http://www.virustotal.com/analisis/b43af6ab6de8c91f32f3b8c16a90aedf
http://anubis.iseclab.org/?action=result&task_id=1125842cb5bf63b246558583f1fddf282
http://www.threatexpert.com/report.aspx?md5=8ab1ad490a65ea907848b8f5b2aa6682

[Mr Clean]

Code: [Select]

http://ultracleaner.biz/download.php?affid=02935


http://www.malwaredomainlist.com/mdl.php?search=84.16.227.222&colsearch=All&quantity=50

very nice!    

[Mr Clean]

Code: [Select]

http://files.ms-load-av.com/exe/setup_200002.exe

http://www.virustotal.com/analisis/31bb622ca5445fec193f60b305e58c5a
http://anubis.iseclab.org/?action=result&task_id=10b1ad77a3cbfc184b9054b5775669955

[SysAdMini]

Code: [Select]

http://kol-development.com/viewtubesoftware.40019.exe


Code: [Select]

frg-softwares.com/viewtubesoftware.40019.exe

[Mr Clean]

Code: [Select]

http://kol-development.com/viewtubesoftware.40019.exe


Code: [Select]

frg-softwares.com/viewtubesoftware.40019.exe