ClassMates.com spam keeps sucking passwords

Yesterday we received more than 800 copies of spam email messages using a ClassMates.com subject to trick people into infecting themselves with a password stealing program.



There were two separate groups of websites. The first group of five domains all used the nameserver ns1.boxingmital.com. The domain names were:

brloadvideo.com (34 emails)
coreadminclass.com (42 emails)
meetingclassmatesserver.com (37 emails)
servesonline.com (44 emails)
updateunionplayer.com (54 emails)

This one had 29 different subject lines:

Classmates personal message: - Help me decide please....
Classmates personal message: "Help me to decide which way to choose?"
Classmates personal message: Can you help me to choose my final woman?
Classmates personal message: Girls Help me to Decide? I want as many answers as Possible please ...
Classmates personal message: Help me decide please - Wife Guys!
Classmates personal message: HELP ME TO CHOOSE A GOOD WOMAN PLEASE!
Classmates personal message: Help me to choose....Wife Guys!
Classmates personal message: Help me to decide a good and with best woman
Classmates personal message: Help me to decide my wife! - family
Classmates personal message: Help me to decide on a woman and wife?
Classmates personal message: Help me to decide on a woman.
Classmates personal message: Help me to decide on my family.
Classmates personal message: Help me to decide please!
Classmates personal message: Help me to decide what kind of woman better!
Classmates personal message: Help me to decide whether or not to tell my friend that ...
Classmates personal message: Help me to decide which woman better
Classmates personal message: Help me to decide which woman to choose?
Classmates personal message: Help me to decide. Making decisions about my family can be confusing.
Classmates personal message: Hi all, i need your opinion and help for choosing woman
Classmates personal message: Hi Guys Please help me to choose between the two womans.
Classmates personal message: Please help me to decide which way to choose
Classmates personal message: Please, help me to choose right woman!
Classmates personal message: plz help me to choose what to do, Wife is a beast!
Classmates personal message: Re:can you help me to choose a wife
Classmates personal message: Who can help me to decide where is right way.
Classmates personal message: Wife Guys! Help Me To Decide WIfe!!!
Classmates personal message: Wife Guys! information to help me choose the right way
Classmates personal message: Wife Guys! Need to decide Quickly what to do, PLEASE HELP ME.
Classmates personal message: Wife is a beast! can any one help me to choose


The bodies of the emails in this group looked like this:

Special video report March 10, 2009
Message from your group member:

"Should I leave my Crazy Fat Wife for a younger woman? Please look video and Help me to decide, please ........I need your help, if possible - Write your opinion on the page wall"


Proceed to open full message text:

http://classmates.messagecenter.filetime.videomessageid-toa3dk6b1.coreadminclass.com/msg4829.htm?/boundary/LOGIN=bf96xidehi5oqtc


Sincerely, Velma Lacy.
2009 Classmates Message Center.

The second group of emails also came from five different domains, which all used the nameserver "ns1.clickforghost.com". The domains in this group were:

clieckfordownload.com (120 emails)
installserverversion10.com (125 emails)
unionmeetflash.com (131 emails)
updtadeyouwinplayer.com (121 emails)
videoplayer11version.com (128 emails)

And the subject lines from this group were:

2009 Classmates - 2009 Meeting
2009 Classmates - Annual Meeting
2009 Classmates - Getting Video
2009 Classmates - Ill have more to say about the specifics of the meeting soon
2009 Classmates - Meetings
2009 Classmates - Save video fragments from movies with the simplicity of pressing ...
2009 Classmates Annual Meeting
2009 Classmates Annual Meeting -- Coming Soon! - Modern ...
2009 Classmates Annual Meeting & Exposition
2009 Classmates ANNUAL MEETING March 11, 2009
2009 Classmates Annual Meeting.
2009 Classmates FREE VIDEO CONFERENCING,
2009 Classmates Meeting Registration, Registration information, coming soon. ...
2009 Classmates Online Meeting - Fast. Easy. Secure
2009 Classmates start searching for friends, classmates, family
2009 Classmates TOLL FREE AUDIO, ONLINE ...
2009 Classmates Video Conferencing and Online Meeting Services
2009 Classmates Videos
2009 Classmates WEB CONFERENCING,
Annual 2009 Classmates Meeting has become the premier meeting
Annual Meeting - 2009 Classmates
Classmates 2009 Annual Meeting March
Classmates annual meeting as soon as possible - invitation
Get to Know Your Classmates - What Works
Greetings fellow members of the 2009 Classmates
Helping Classmates Understand invitations 2009 Classmates
Invite Your Friends and Get invited! 2009 Classmates
Meet your classmates -- join our social network
News - 2009 Classmates Annual Meeting.
One of your classmates have 4 kids...
One of your classmates have airplan...
One of your classmates have limo...
One of your classmates invitation...
One of your classmates lost...
One of your classmates new photos...
One of your classmates sent invitation to you...
One of your classmates wedding...
Save The Date! 2009 Classmates Annual Meeting soon.
Video Clips- 2009 Classmates!
What are your ol' classmates up to? > General Family & Friends ...
What is an Annual Return? 2009 Classmates

Special video report March 10, 2009
One of your classmates has sent you a video invitation:

"Read the story and see photos of my wedding and our tour,Please discover our video invitation to your family. I hope to get back from you soon..."


Proceed to view full message:

http://classmates.messagecenter.asp.videomessageid-x0ajpo2vz1.updtadeyouwinplayer.com/msg4829.htm?/InterstitialControl/LOGIN=t8k6pqzb5azfjpw


Sincerely, Marion Lyon.
2009 Classmates Message Center.

In both examples, the name after the "Sincerely" was randomly selected from a huge list of possible first and last names.

Once infected, the malware steals passwords from FTP sessions, POP3 and IMAP email sessions, ICQ sessions, and any webpages that seem to be prompting for a login. The stolen data used to be sent to UKR Telecom in these cases, but we've had another update. The data is now sent to HostFresh in Hong Kong at the IP address 58.65.232.17

inetnum: 58.65.232.0 - 58.65.239.255
netname: HOSTFRESH
descr: HostFresh
descr: Internet Service Provider
country: HK
admin-c: PL466-AP
tech-c: PL466-AP
remarks: Please send Spam & Abuse report to
remarks: abuse@hostfresh.com

person: Piu Lo
nic-hdl: PL466-AP
e-mail: ipadmin@hostfresh.com
address: No. 500, Post Office, Tuen Mun, N.T., Hong Kong
phone: +852-35979788
fax-no: +852-24522539
country: HK
changed: 20071025


A virusTotal report on the malware, which was named "AdobeMedia10.exe" can be found at the following URL (9 of 39 anti-virus products now know this is a virus. Yesterday it was 6 of 39.)

http://www.virustotal.com/analisis/eec39a519bd12b2c654bc541fd3a2907



For malware analyst fans, I was out of the office so I used "Eureka" to unpack the malware. You can find strings from the unpacked executable here:

http://eureka.cyber-ta.org/OUTPUT/c26213f4a96b0c5b9b2f4c98813ca264/