{"id":8295,"date":"2012-10-18T12:00:20","date_gmt":"2012-10-18T18:00:20","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=8295"},"modified":"2018-10-05T11:33:08","modified_gmt":"2018-10-05T17:33:08","slug":"intuit-payroll-confirmation-inquiry-themed-emails-lead-to-the-black-hole-exploit-kit","status":"publish","type":"post","link":"https://www.webroot.com/blog/2012\/10\/18\/intuit-payroll-confirmation-inquiry-themed-emails-lead-to-the-black-hole-exploit-kit\/","title":{"rendered":"&#8216;Intuit Payroll Confirmation inquiry&#8217; themed emails lead to the Black Hole exploit kit"},"content":{"rendered":"<p>Over the past 24 hours, cybercriminals launched two consecutive massive email campaigns, impersonating Intui Payroll&#8217;s Direct Deposit Service system, in an attempt to trick end and corporate users into clicking on the malicious links found in the mails.<\/p>\n<p>Upon clicking on any of links found in the emails, users are exposed to the client-side exploits served by the latest version of the Black Hole exploit kit.<\/p>\n<p>More details:<\/p>\n<p><!--more--><\/p>\n<p><strong>Sample screenshot of the first spamvertised campaign:<\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-8297\" title=\"Intuit_Spam_Exploits_Black_Hole_Exploit_Kit\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit.png\" alt=\"\" width=\"361\" height=\"268\" \/><\/a><\/p>\n<p><strong>Upon clicking on the links found in the malicious emails, users are exposed to the following bogus &#8220;Page loading&#8230;&#8221; screen:<\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit_01.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-8298\" title=\"Intuit_Spam_Exploits_Black_Hole_Exploit_Kit_01\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit_01.png\" alt=\"\" width=\"614\" height=\"107\" \/><\/a><\/p>\n<p>Screenshots of the second spamvertised campaign:<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit_02.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-8299\" title=\"Intuit_Spam_Exploits_Black_Hole_Exploit_Kit_02\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit_02.png\" alt=\"\" width=\"363\" height=\"264\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit_03.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-8300\" title=\"Intuit_Spam_Exploits_Black_Hole_Exploit_Kit_03\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/10\/intuit_spam_exploits_black_hole_exploit_kit_03.png\" alt=\"\" width=\"334\" height=\"264\" \/><\/a><\/p>\n<p><strong>Sample spamvertised compromised URLs:<\/strong><br \/>\n<em>hxxp:\/\/www.partypromgowns.com\/wp-content\/plugins\/zaddmuruxhm\/prdiqbss.html<\/em><br \/>\n<em>hxxp:\/\/whitfordmedical.co.nz\/wp-content\/plugins\/zoaddiyefar\/prdiqbss.html<\/em><br \/>\n<em>hxxp:\/\/hanvietroll.com\/components\/com_ag_google_analytics2\/itordernote.html<\/em><br \/>\n<em>hxxp:\/\/aprst.com\/components\/com_ag_google_analytics2\/croconfrm.html<\/em><\/p>\n<p><strong>Sample client-side exploit serving URLs:<\/strong><br \/>\n<em>hxxp:\/\/art-london.net\/detects\/stones-instruction_think.php<\/em><br \/>\n<em>hxxp:\/\/buycelluleans.com\/detects\/groups_him.php<\/em><br \/>\n<em>hxxp:\/\/buycelluleans.com\/detects\/groups_him.php?zgdljis=3833043409&amp;lkaqagg=0636060a350838350b06&amp;pfat=03&amp;ayna=rapcdmse&amp;zvyhcimn=yecbbs<\/em><br \/>\n<em>hxxp:\/\/art-london.net\/detects\/stones-instruction_think.php?lwkmvtb=3533020635&amp;qbstxmw=43&amp;cvsd=0b0a33350a0735020405&amp;stbdtv=0a000300040002<\/em><\/p>\n<p>Both of these malicious domains use to respond to\u00a0<strong>183.81.133.121<\/strong>; <strong>195.198.124.60<\/strong>; <strong>203.91.113.6<\/strong>. More malicious domains part of the campaign&#8217;s infrastructure are known to have responded to the same IPs, for instance,\u00a0<strong>buzziskin.net<\/strong>;\u00a0<strong>addsmozy.net<\/strong>;\u00a0<strong>buycelluleans.com<\/strong>;\u00a0<strong>indice-acores.net<\/strong>. The campaign used to rely on the following name servers:\u00a0<strong>ns1.zikula-support.com<\/strong>;\u00a0<strong>ns2.zikula-support.com<\/strong><\/p>\n<p><strong>Sample client-side exploits served:<\/strong>\u00a0<a href=\"http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2010-0188\"><em>CVE-2010-0188<\/em><\/a><\/p>\n<p>Upon successful client-side exploitation, the campaign drops <a href=\"https:\/\/www.virustotal.com\/file\/64e1ae655aafcf83717cb6b678fa2c36d7cfea2f5bc46dcf56d03f280f024bb3\/analysis\/\"><strong>MD5: 5723f92abf257101be20100e5de1cf6f<\/strong><\/a> and <a href=\"https:\/\/www.virustotal.com\/file\/ee305b8e80ca0e06147909080435a9eec04532d3054e76102dd6750ef132d907\/analysis\/\"><strong>MD5: 06c6544f554ea892e86b6c2cb6a1700c<\/strong><\/a> on the affected hosts.<\/p>\n<p><strong>Related analysis of malicious campaigns impersonating Intuit:<\/strong><\/p>\n<ul>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/09\/05\/intuit-themed-quickbooks-update-urgent-emails-lead-to-black-hole-exploit-kit\/\">Intuit themed \u2018QuickBooks Update: Urgent\u2019 emails lead to Black Hole exploit kit<\/a><\/li>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/08\/29\/cybercriminals-impersonate-intuit-market-mass-mail-millions-of-exploits-and-malware-serving-emails\/\">Cybercriminals impersonate Intuit Market, mass mail millions of exploits and malware serving emails<\/a><\/li>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/07\/20\/spamvertised-intuit-themed-emails-lead-to-black-hole-exploit-kit\/\">Spamvertised Intuit themed emails lead to Black Hole exploit kit<\/a><\/li>\n<\/ul>\n<p>Detection rate, <a href=\"https:\/\/www.virustotal.com\/file\/64e1ae655aafcf83717cb6b678fa2c36d7cfea2f5bc46dcf56d03f280f024bb3\/analysis\/\"><strong>MD5: 5723f92abf257101be20100e5de1cf6f<\/strong><\/a> &#8211; detected by 17 out of 43 antivirus scanners as Gen:Variant.Kazy.96378; Worm.Win32.Cridex.js, <a href=\"https:\/\/www.virustotal.com\/file\/ee305b8e80ca0e06147909080435a9eec04532d3054e76102dd6750ef132d907\/analysis\/\"><strong>MD5: 06c6544f554ea892e86b6c2cb6a1700c<\/strong><\/a> &#8211; detected by 26 out of 43 antivirus scanners as Trojan.Win32.Buzus.mecu; Worm:Win32\/Cridex.B<\/p>\n<p><a href=\"https:\/\/www.webroot.com\/us\/en\/home\/products\/complete\"><strong>Webroot SecureAnywhere<\/strong><\/a>\u00a0users are proactively protected from these threats.<\/p>\n<p><em>You can find more about Dancho Danchev at his\u00a0<a href=\"http:\/\/linkedin.com\/in\/danchodanchev\"><strong>LinkedIn Profile<\/strong><\/a>. You can also\u00a0<a href=\"http:\/\/www.twitter.com\/danchodanchev\"><strong>follow him on \u00a0Twitter<\/strong><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Over the past 24 hours, cybercriminals launched two consecutive massive email campaigns, impersonating Intui Payroll&#8217;s Direct Deposit Service system, in an attempt to trick end and corporate users into clicking on the malicious links found in the mails. Upon clicking on any of links found in the emails, users are exposed to the client-side exploits [&hellip;]<\/p>\n","protected":false},"author":65,"featured_media":17048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[12263,11341,6187,6177,12265,9563,6185,11739,11733,11729,12267,4911,10981,11343,6189,11737,11735,11731,11573,11747],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8295"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=8295"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8295\/revisions"}],"predecessor-version":[{"id":25463,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8295\/revisions\/25463"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17048"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=8295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=8295"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=8295"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=8295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}