The attackers show lots of "creativity" with their domain names crashessafetypc. in though they don't seem to have attended Marketing 101 yet, because some of the names appear to be less than ideal...: keepperfomanceworms. in The current set of threats involves frequently changing malware EXEs (or EXEs inside of ZIPs) with low coverage on virustotal. The download URLs usually follow the pattern of http://bad-domain. in/16 character random hex string/setup.exe or /setup.zip Example: http://fail-safetytestingcontrol. in/fc1a9d5408b7e17d/setup.exe Stay safe .. and keep your PCs free of the dangerwreckguarantor! |
Daniel 385 Posts ISC Handler Jun 19th 2012 |
Thread locked Subscribe |
Jun 19th 2012 1 decade ago |
Question: Is the campaign in the form of SPAM? Or a pop-up? Or...? How dos the campaign get the user to click on the URL typically?
|
Anonymous |
Quote |
Jun 19th 2012 1 decade ago |
Time for scorched-earth policy. A few rounds of banks "approving" credit card transactions but not actually sending any money along with blacklisting the class C of anybody hosting these should do it.
|
Anonymous |
Quote |
Jun 19th 2012 1 decade ago |
The URLs also sometimes include another numeric directory in the path, such as:
http:// detectionshieldverify.in / 16digit hex / 123 / setup.zip So far we've seen 1 to 3 digits used. |
Anonymous |
Quote |
Jun 20th 2012 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!