Domain Name:EVORMCORP .IN None of this fazes the domain name registrar "Directi Web Services" in Mumbai, India, to the least. And Antony has been busy - he bought a dozen or so new domains over the past two days, and managed to bring them live within a matter of minutes after purchase. His new domains currently point to 89.187.53.237, in Moldova. Yup, ol'Antony is quite the international business executive, conducting his trade on three continents with equal ease! The IP used seems to change about once per week, until past Thursday, Antony's virtual HQ was at the neighboring IP, 89.187.53.238. His latest new domains include cyberendbaj .in and provide a generous helping of malware to users unlucky enough to get redirected there via what appears to be poisoned ads on legitimate web pages. Antony's toys currently seem to use URLs with a certain pattern that you can search for in your web logs with a command like egrep -E '\/.{8}\/\?[[:xdigit:]]{60}' Example result from earlier today: Caveat - that regexp might of course also match on perfectly benign web site URLs. The malware uses CVE-2010-0842 (javax.sound.midi) and CVE-2011-3544 (Rhino script engine) and when successful seems to download an executable off a URL that matches egrep -E '\/.{8}\/\?[[:xdigit:]]{60};[0-9];[0-9]'
|
Daniel 375 Posts ISC Handler Jan 14th 2012 |
Thread locked Subscribe |
Jan 14th 2012 9 years ago |
why stop this ?
when we'll have protect ip and sopa to protect us ? |
Anonymous |
Quote |
Jan 15th 2012 9 years ago |
Looks like a Phoenix exploit kit URL. We see a fair few of these, but nowhere near as many as the Blackhole exploit kit. Note the download URLs are one-time only, and the kit usually includes two or three Java exploits and a PDF exploit (probably exploiting CVE-2010-0188).
See http://wepawet.iseclab.org/view.php?hash=502f5b628a4d57603955309d22b42631&t=1326462037&type=js for a recent example My guess is the "rgy9hcgw" part is a user ID for the attacker as the same string will appear in different domains. |
Anonymous |
Quote |
Jan 16th 2012 9 years ago |
Staff in countries outside the US often do not have any idea how our phone numbers or street address system (especially zip code) work and could be helpful in detecting fraud. What looks like obvious fraud to us looks innocuous to them. I'd imagine that we'd have the same problem with their systems.
|
Anonymous |
Quote |
Jan 17th 2012 9 years ago |
Sign Up for Free or Log In to start participating in the conversation!