Vulnerabilityqueerprocessbrittleness

Published: 2012-06-19
Last Updated: 2012-06-19 10:26:16 UTC
by Daniel Wesemann (Version: 1)
3 comment(s)


No, I didn't make that title up. Someone else did. "vulnerabilityqueerprocessbrittleness . in" is currently one 600+ domains that link to a quite prevalent "Fake Anti-virus" malware campaign. Currently, the domains associated to this scam all point to web servers hosted in the 204.152.214.x address range, but of course the threat keeps "moving around" as usual.

The attackers show lots of "creativity" with their domain names

crashessafetypc. in
keepprotectcare. in
microsoftkeeper. in
hazardactivitytasks. in
hazardon-linekeeper. in
highrisksprotection. in

though they don't seem to have attended Marketing 101 yet, because some of the names appear to be less than ideal...:

keepperfomanceworms. in
dangerwreckguarantor. in
highfail-safetykeeper. in
optimizerwreckdeliverer. in

The current set of threats involves frequently changing malware EXEs (or EXEs inside of ZIPs) with low coverage on virustotal. The download URLs usually follow the pattern of http://bad-domain. in/16 character random hex string/setup.exe or /setup.zip

Example: http://fail-safetytestingcontrol. in/fc1a9d5408b7e17d/setup.exe

Stay safe .. and keep your PCs free of the dangerwreckguarantor!

3 comment(s)
ISC StormCast for Tuesday, June 19th 2012 http://isc.sans.edu/podcastdetail.html?id=2611

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]
What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/

Diary Archives