//===============================
#MalwareMustDie! GMO analysis
$ whoami ; date
unixfreaxjp
Sat Apr 5 21:15:01 JST 2014
//===============================
Four full set of spam campaign gameover analyzed:
Pic: https://twitter.com/MalwareMustDie/status/452398976986128384
2 fails (binary crashed and 404)
// 021 "HMRC..."
Relayed: (HELO ip-78-94-74-96.unitymediagroup.de) (78.94.74.96)
======> fail binary.....
// 022 xerox local scan
Relayed: (HELO 79.109.232.90.dyn.user.ono.com) (79.109.232.90)
=======> Zeus cant be downloaded (404)
And 4 succeed, can be used as evidence to takedown, please.
// 020 - "Homicide..spam" ,
Relayed: (HELO ?14.47.238.211?) (14.47.238.211)
Relayed: (HELO ?197.155.140.130?) (197.155.140.130)
Relayed: (HELO 190-82-83-98.static.tie.cl) (190.82.83.98)
and...
// 023 "Outlook instruction spam..."
Relayed: (HELO 50-223-114-200.fibertel.com.ar) (200.114.223.50)
Relayed: (HELO pt.lu) (83.99.38.205)
Relayed: (HELO h69-129-183-234.applwi.dedicated.static.tds.net) (69.129.183.234)
GMO (same ones, first VT is original downloaded decrypted bins)
https://www.virustotal.com/en/file/527acb5d7b43c1915784da2a82e9808e1401008781e65f5f68d719b4d011ba3e/analysis/
https://www.virustotal.com/en/file/ff002a7bccbdad339966124cb1c960903a493714c4558513b410542497694a28/analysis/1396698692/
UPATRE DOWNLOADS SOURCE:
chiropractorincenterville.com/wp-content/uploads/2014/04/0404USm.tax
IP: 192.254.187.227|46606 | 192.254.128.0/18 | UNIFIEDLAYER-AS-1 | US | WEBSITEWELCOME.COM | WEBSITEWELCOME.COM
$
DGA:
ojamxrwylyxwshgixjzormqo.com
dikzhhiealaypkbvwlemha.info
huuofukzdeguflbhmafyivkj.biz
vheaiheudairozltvxwhscx.com
hdrgcshsjbnbobylampt.ru
mnvrwhzhskyxceucztswavohcegu.org
alvohyhgypfyrsgewgifcrgifjz.net
aulbbiwslxpvvphxnjij.biz
dadgimjlbordcjnzhjzgavwfav.info
ztpuodmgehgqrwxobiptjnp.net
mvgfjvwhjfljdmjkvtpbmtg.org
aulbbiwslxpvvphxnjij.biz
ALIVE IP (Noted: By domains, non responsing to HTTP POST)
23.92.19.67 POST /write HTTP/1.1
50.116.4.71 POST /write HTTP/1.1
192.81.130.196 POST /write HTTP/1.1
LOG WITH GEOIP:
Sat Apr 5 20:26:03 JST 2014|23.92.19.67|li644-67.members.linode.com.|8001 | 23.92.16.0/21 | NET-ACCESS-CORP | US | LINODE.COM | LINODE
Sat Apr 5 20:26:46 JST 2014|50.116.4.71|li430-71.members.linode.com.|6939 | 50.116.0.0/20 | HURRICANE | US | LINODE.COM | LINODE
Sat Apr 5 20:27:52 JST 2014|192.81.130.196|li592-196.members.linode.com.|6939 | 192.81.128.0/22 | HURRICANE | US | LINODE.COM | LINODE
---
#MalwareMustDie!!
Comments