CyberCrime & Doing Time: MasterCard spam leads to Fake AV

The FBI is doing a great job gaining international cooperation in going after cyber criminals. Just last month yet another malware group was arrested, as the public learned about in the June 22, 2011 FBI press release, Department of Justice disrupts international cybercrime rings distributing scareware. In that case, criminals were arrested as part of a scareware ring that had infected more than 1 million computers and caused more than $72 million in losses!

Unfortunately, the end of fake Anti-virus scareware has not yet arrived. Here's an example from today's spam from the UAB Spam Data Mine.

Please see end for an update

We're seeing a significant "spam attached malware" campaign in the past 24 hours with six different attachment MD5s.

uab_spam=> select count(*), sender_domain, md5_hex, size from spam natural join spam_attach where sender_domain = 'mastercard.com' and receiving_date >= '2011-07-22' group by sender_domain, md5_hex, size;

count | received | md5_hex | size
-------+-------------------------+---------------------------------+-------
318 | 7/22 03:15 - 7/22 10:15 | 241cc18918540d6c49dd8b45df31985d | 67584
20 | 7/22 10:45 - 7/22 11:00 | 5f8a95d194f7dcadabf442ed5705c4e0 | 79872
565 | 7/22 11:30 - 7/22 17:30 | 0256a71baefd0f625910bbc44147e432 | 68096
1133 | 7/22 17:45 - 7/23 04:00 | f4aea68ea94d7780a5b1abd709f7730f | 69632
67 | 7/22 12:00 - 7/23 08:15 | 277eb4dacd401a3c520dc5bb9ede70f0 | 77237
439 | 7/23 04:00 - 7/23 08:15 | fe88c3a276d11aa208dac7ae68f55cd3 | 67584
(6 rows)

Most popular email subjects:

count | subject
-------+-----------------------------------------------
24 | WARNING: Your credit card is locked!
26 | WARNING: Your credit card is blocked!
26 | ATTENTION: Your credit card has been blocked!
1116 | Your credit card is blocked
29 | ATTENTION: Your credit card is blocked!
1184 | Your credit card has been blocked
24 | CAUTION: Your credit card is locked!
29 | ATTENTION: Your credit card is locked!
31 | WARNING: Your credit card has been blocked!
19 | CAUTION: Your credit card has been blocked!
34 | CAUTION: Your credit card is blocked!
(11 rows)

The body of the email looks like the attached file:

------------------
Dear User,
Your credit card is locked!
From your credit card has been removed $ 3951,74
Possibly illegal operation!
More details in the attached file.
Instantly contact your bank .
Best regards, MASTERCARD Services.
-------------------

The username portion of the email sender is random, using a classic mis-spelling that has been consistent for this sender (which is the same guy who has been doing the "government imitating" zeus). "cunsumer"

Usernames are a single word, followed by a ".", "_", or "-", followed by a two or three digit number.

The most popular words (by far) are "manager" (770 time), and "support" (757 times), but we've also seen admin, adminnistration, alerts, cunsumer, delivery, e-file, finance, frboard-webannouncements, govdelivery, information, inspector, news, news-alerts, no-reply, protection, public, report, service, stats, subscriber, subscriptions, usttb, and webannouncements.

The attached file is actually named as a ".com" file, using a random-seeming filename in the format "id" followed by a 5-7 digit number (such as id918538.com).

Of the 2,649 IP addresses that have sent us the spam so far, they have come from 1,443 distinct sending IP addresses. Some of our most popular senders have been:

count | sender_ip
-------+--------------------
10 | 113.172.171.155/32
10 | 190.99.213.191/32
9 | 75.145.37.117/32
9 | 187.126.15.108/32
9 | 110.164.112.159/32
8 | 188.81.213.237/32
8 | 201.240.80.96/32
8 | 79.82.153.66/32
8 | 110.138.30.34/32
7 | 180.253.110.135/32
7 | 151.64.138.215/32
7 | 79.178.152.194/32
6 | 95.37.41.218/32
6 | 201.240.215.105/32
6 | 94.20.98.220/32
6 | 122.167.44.208/32
6 | 71.197.255.106/32
6 | 113.190.138.153/32
6 | 90.177.147.202/32
6 | 178.150.237.124/32
6 | 65.10.178.64/32
6 | 178.204.204.172/32
6 | 24.90.102.247/32
6 | 93.75.103.25/32
6 | 190.235.93.183/32
6 | 82.51.62.237/32
6 | 77.236.26.169/32
6 | 110.164.106.145/32
6 | 178.222.27.142/32
6 | 113.53.181.86/32
6 | 123.17.157.159/32
6 | 151.25.53.47/32
5 | 201.68.209.20/32
5 | 180.180.150.248/32
5 | 120.62.24.122/32
5 | 59.182.51.42/32
5 | 182.53.176.152/32
5 | 194.28.88.58/32
5 | 85.186.178.173/32
5 | 41.140.170.143/32
5 | 71.200.55.41/32
5 | 200.91.255.142/32
5 | 190.43.147.223/32
5 | 125.24.202.30/32
5 | 41.140.43.44/32
5 | 59.184.128.238/32
5 | 95.58.34.230/32
5 | 117.201.20.59/32
5 | 186.6.177.39/32

I chose the most recent MD5 and did a scan at VirusTotal, finding that only 3 of 43 Antivirus products were able to detect this as a virus, according to this VirusTotal report.

Since this was an email attachment, web reputation didn't really help here. This would be a case where your spam blocking would be your best defense!

When the file is launched, it attempts to make connections to a long list of domains that are probably made by a "DGA" or "Domain Generation Algorithm". It's likely that at different times or days this list would be different. My domains included:

syqivolurypugi.com
qotasifelaw.com
tibumuqel.com
suzehebaq.com
sivycaqilugoq.com
levulehup.com
ledimajezociw.com
rabuqibareme.com
fopuvuwupode.com
cinuherijugeg.com

and more.

bakagunaxepo.com responded as 193.164.132.20 <= Gigahosting, Germany
bipuwyqojivu.com responded as 85.17.239.165 <= Leaseweb, Netherlands
civivicuqekexo.com responded as 93.104.208.84 <= Gigahosting
levulehup.com responded as 204.45.120.27 <= FDC Servers, Chicago
levysavasezo.com responded as 85.17.239.215 <= Leaseweb, Netherlands
pafozykavygaj.com responded as 85.17.239.216 <= Leaseweb, Netherlands
pejozehywe.com responded as 50.2.7.242 <= Eonix/GotHost
suzehebaq.com responded as 206.217.134.44 <= Colocrossing
syqivolurypugi.com responded as 206.217.134.43 <= Colocrossing
waciroqohuli.com responded as 64.56.65.213 <= VRTServers.net
zarapetahuryp.com responded as 50.2.7.241 <= Eonix/GotHost

as a few examples . . .

The purpose of the malware? Seems to be just another Fake Anti-virus product. Here's the scan that kicked off:

After the scan, I was of course constantly reminded of the grave danger I was in:

First it did a get for "1038000112" from "bogekizase.com" on 66.197.213.6.

All it got back from there was "OK."

Most of the interaction was from tibumuqel.com on 79.143.178.101.

tibumuqel.com was registered on July 15, 2011 using the contact info:

Ana Ivancic freon@cutemail.org
+385.20324535
Od Domina 5
Dubrovnik,Southern Dalmatia,HR 20000

Searching on her details will show that "Ana" has registered plenty of other malware domains as well, usually with different email addresses.

From the tibumuqel.com domain, we did a get for "10380001124255461742" which was redirected to "buy.html"

That's also the box that my payment information was posted back to, although unfortunately, my credit card was declined. 8-(

That was my "purchase the fake AV product" screen, giving me my pricing options, and letting me know that this fake AV product was an SC Magazine 2011 award finalist!

What are our lessons learned?

Anti-virus can't protect you by itself, as evidenced by the 3 of 43 AV products that new about this malware this morning. You need a robust security strategy that includes:

a. Being Smart about what you click on. (Start with CLICK ON NOTHING)
b. a web-reputation component (stopping traffic to bad websites)
c. a strong spam filter

Update

Love Card Version

The "Love card" version of the spam reads like this:

-------

GOOD AFTERNOON! Do you like games ?

Service www. lovecard. ge Present New Game For Amateurs Strawberries
This game is still freeware. You can find it in Attached. Please test it and send us Your comments and suggestions !
With Best Wishes !.. www. love-card. org

-------

or

-------

Attention! Do you like games ?

Service www. mylovecards. com Present New Game For Amateurs Strawberries
This game is still freeware. You can find it in Attached. Please test it and send us Your comments and suggestions !
With Best Wishes !.. www. love-card. org

-----

The "love card" version ends with "white on white" text in tiny letters that reads:

Are you tired of routine romance and love making? Are you looking for a little more fun and excitement? Games are light-hearted and lots of fun. They take the pressure off and allow you and your partner to really let loose. Whether you're trying to get to know each other better, spark the romance, or improve your sex life, a game is a fun way to do it! www. love-card. org is the recognised industry leader in adult games for lovers who want to explore a deeper level of intimacy, sexuality and romance. We have been offering couples in loving relationships pleasurable and educational entertainment to enhance their relationship since 1987. Developed with the assistance of professionals, our games and products are tasteful, sensitive and respectful.

FedEx Version

The "FedEx" version looks like this:

GOOD DAY!
DEAR CONSUMER , Delivery Confirmation: FAILED
PLEASE PRINT OUT THE INVOICE COPY ATTACHED AND COLLECT THE PACKAGE AT OUR DEPARTMENT
Pack it. Ship ip. No calculating , Your FedEx TEAM

or

Hello!
DEAR USER , DELIVERY CONFIRMATION: FAILED
PLEASE PRINT OUT THE INVOICE COPY ATTACHED AND COLLECT THE PACKAGE AT OUR DEPARTMENT
With respect , FedEx .com Customer Services

or

Good day!
DEAR USER , We were not able to delivery the post package
Please print out the invoice copy attached and collect the package at our department
Best Regards , Fedex Customer Services

CyberCrime & Doing Time

Saturday, July 23, 2011

MasterCard spam leads to Fake AV

Please see end for an update

Update

Love Card Version

FedEx Version

No comments:

Post a Comment

GarWarner

Blog Archive

Pageviews last month

Pageviews all time

Labels

CyberCrime & Doing Time

Saturday, July 23, 2011

MasterCard spam leads to Fake AV

Please see end for an update

Update

Love Card Version

FedEx Version

No comments:

Post a Comment

GarWarner

Subscribe To

Blog Archive

Pageviews last month

Pageviews all time

Labels