![\"\"](\"http:\/\/webrootblog.files.wordpress.com\/2012\/09\/ups_spam_email_exploits_malware_black_hole_exploit_kit.png\" "\\"UPS_Spam_Email_Exploits_Malware_Black_Hole_Exploit_Kit\\"")
<\/a><\/p>\nSample malicious iFrame URLs found in multiple malicious .html files:<\/strong>\u00a0hxxp:\/\/denegnashete.ru:8080\/forum\/links\/column.php<\/em>; hxxp:\/\/soisokdomen.ru:8080\/forum\/links\/column.php<\/em>; hxxp:\/\/diareuomop.ru:8080\/forum\/links\/column.php<\/em>; hxxp:\/\/omahabeachs.ru:8080\/forum\/links\/column.php<\/em> ;hxxp:\/\/penelopochka.ru:8080\/forum\/showthread.php?page<\/em>; hxxp:\/\/furnitura-forums.ru:8080\/forum\/showthread.php?page<\/em>; hxxp:\/\/onerussiaboard.ru:8080\/forum\/showthread.php?page<\/em>; hxxp:\/\/online-gaminatore.ru:8080\/forum\/showthread.php<\/em>; hxxp:\/\/bmwforummsk.ru:8080\/forum\/showthread.php?page<\/em><\/p>\n Sample detection rate for a malicious .html file found in the spamvertised emails<\/strong>:\u00a0UPS_N21489880.htm – MD5: 38a2a54d6e7391d7cd00b50ed76b9cfb<\/strong><\/a> – detected by 26 out of 43 antivirus scanners as Trojan.Iframe.BCK; Trojan-Downloader.JS.Iframe.dbh<\/p>\n Client-side exploits serving URL:<\/strong>\u00a0hxxp:\/\/denegnashete.ru:8080\/forum\/data\/java.jar<\/em> – MD5:\u00a086946ec2d2031f2b456e804cac4ade6d<\/strong><\/a> – detected by 25 out of 43 antivirus scanners as\u00a0Java\/Cve-2012-1723;\u00a0Exploit:Java\/CVE-2012-4681.H<\/p>\n denegnashete.ru<\/strong> is currently responding to the following IPs – 84.22.100.108; 190.10.14.196; 203.80.16.81; 61.17.76.12; 213.135.42.98<\/p>\n Related malicious domains part of the campaign’s infrastructure:<\/strong> Name servers part of the campaign’s infrastructure:<\/strong> This isn’t the first time that cybercriminals have impersonated UPS. Go through related analysis of previous campaigns impersonating the company:<\/p>\n Webroot SecureAnywhere<\/strong><\/a>\u00a0users are proactively protected from this threat.<\/p>\n You can find more about Dancho Danchev at his\u00a0LinkedIn Profile<\/strong><\/a>. You can also\u00a0follow him on \u00a0Twitter<\/strong><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Over the past 24 hours, cybercriminals spamvertised millions of email addresses, impersonating UPS, in an attempt to trick end users into viewing the malicious .html attachment. Upon viewing, the file loads a tiny iFrame attempting to serve client-side exploit served by the latest version of the Black Hole Exploit kit, which ultimately drops malware on […]<\/p>\n","protected":false},"author":65,"featured_media":17048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[12307,12263,12303,11341,6187,6177,9563,10103,12297,11229,11227,4911,10109,11343,6189,12301,12299,12305,10297,10625],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8257"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=8257"}],"version-history":[{"count":3,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8257\/revisions"}],"predecessor-version":[{"id":25449,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8257\/revisions\/25449"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17048"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=8257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=8257"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=8257"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=8257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/p>\n<\/a><\/p>\n
\nrumyniaonline.ru<\/strong> – 84.22.100.108
\ndenegnashete.ru<\/strong> – 84.22.100.108
\ndimabilanch.ru<\/strong> – 84.22.100.108
\nioponeslal.ru<\/strong> – 84.22.100.108
\nmoskowpulkavo.ru<\/strong> – 84.22.100.108
\nomahabeachs.ru<\/strong> – 84.22.100.108
\nuzoshkins.ru<\/strong> – 84.22.100.108
\nsectantes-x.ru<\/strong> – 84.22.100.108<\/p>\n
\nns1.denegnashete.ru<\/strong> – 62.76.190.50
\nns2.denegnashete.ru<\/strong> – 87.120.41.155
\nns3.denegnashete.ru<\/strong> – 132.248.49.112
\nns4.denegnashete.ru<\/strong> – 91.194.122.8
\nns5.denegnashete.ru<\/strong> – 62.76.188.246
\nns6.denegnashete.ru<\/strong> – 178.63.51.54<\/p>\n\n