{"id":8980,"date":"2012-12-05T00:00:25","date_gmt":"2012-12-05T07:00:25","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=8980"},"modified":"2018-10-05T11:57:59","modified_gmt":"2018-10-05T17:57:59","slug":"bogus-facebook-account-cancellation-request-themed-emails-serve-client-side-exploits-and-malware","status":"publish","type":"post","link":"https://www.webroot.com/blog/2012\/12\/05\/bogus-facebook-account-cancellation-request-themed-emails-serve-client-side-exploits-and-malware\/","title":{"rendered":"Bogus ‘Facebook Account Cancellation Request’ themed emails serve client-side exploits and malware"},"content":{"rendered":"

Facebook<\/strong><\/a> users, watch what you click on!<\/p>\n

Cybercriminals are currently mass mailing bogus “Facebook Account Cancellation Requests<\/em>“, in an attempt to trick Facebook’s users into clicking on the malicious link found in the email. Upon clicking on the link, users are exposed to client-side exploits which ultimately drop malware on the affected host.<\/p>\n

More details:<\/p>\n

<\/p>\n

Sample screenshot of the spamvertised email:<\/strong><\/p>\n

\"Fake_Facebook_Account_Cancellation_Email_Spam_Exploits_Malware\"<\/a><\/p>\n

Sample client-side exploitation chain:<\/strong>\u00a0hxxp:\/\/adlinkservhost.strangled.net<\/em> -> hxxp:\/\/lakkumigdc.com\/media\/clients\/index.php?showtopic=397065<\/em> -> hxxp:\/\/lakkumigdc.com\/media\/clients\/rhin.jar<\/em> -> hxxp:\/\/lakkumigdc.com\/media\/clients\/Goo.jar<\/em> -> hxxp:\/\/lakkumigdc.com\/media\/clients\/lib.php<\/em> -> hxxp:\/\/lakkumigdc.com\/media\/clients\/load.php?showforum=lib<\/em><\/p>\n

Sample client-side exploits served:<\/strong>\u00a0CVE-2010-0188<\/em><\/a>;\u00a0CVE-2011-3544<\/em><\/a>;\u00a0CVE-2010-0840<\/em><\/a><\/p>\n

Malicious domain name reconnaissance:<\/strong>
\nlakkumigdc.com<\/strong> – 68.168.100.135 – Email: dolphinkarthi@gmail.com
\nName Server: NS1.MACROVIEWTECH.COM<\/strong> – 68.168.100.136
\nName Server: NS2.MACROVIEWTECH.COM<\/strong> – 68.168.100.137<\/p>\n

Domains responding to the same IP, including domains also registered with the same GMail account:
\ndrganesanneurospine.com<\/strong>
\ndryathishoncologist.com<\/strong>
\nhematologistcoimbatore.com<\/strong>
\nlakkumigdc.com<\/strong>
\nciska.org<\/strong>
\ntexsonpumps.com<\/strong>
\nicreu2012.com<\/strong>
\nlakkumigdc.com<\/strong>
\npaypal.com.tradelinee.com<\/strong>
\npianoforall.theseopark.com<\/strong>
\nupdate-paypall.32165453423154623166352.indianmjp.com<\/strong>
\npaypal.com.usa.ssion.secure.acess.update.reg.ideators.co<\/strong>
\npaypal.com.us.cgi-bin.session.secure.update-info.ideators.co<\/strong>
\npaypal.com.vtigp.org<\/strong>
\nzakcreations.com<\/strong>
\ntechhoot.com<\/strong>
\nideators.co<\/strong><\/p>\n

Upon successsful client-side exploitation, the campaign drops MD5: 8b3979c1a9c85a7fd5f8ff3caf83fc56<\/strong><\/a> – detected by 3 out of 46 antivirus scanners as PWS-Zbot.gen.aru<\/p>\n

Upon execution, the sample creates the following file on the affected hosts:<\/strong>
\n%AppData%Ixriyvemarosa.exe – MD5: A33684FD2D1FA669FF6573921F608FBB<\/em><\/p>\n

It also creates the following directories:<\/strong>
\n%AppData%Ixriyv<\/em>
\n%AppData%Uxwonyl<\/em><\/p>\n

As well as the following Mutex:<\/strong>
\nLocal{7A4AAF46-5391-8FF9-A32F-78A34C8B50D7}<\/em><\/p>\n

It then phones back to shallowave.jumpingcrab.com<\/strong> (93.174.95.78) on port 8012.\u00a0Another similar subdomain on this host (takemeout.jumpingcrab.com<\/strong>), was also seen in a crowdsourced DDoS campaign<\/strong><\/a> in 2009.<\/p>\n

Historically,\u00a0more malware is known to have been hosted at another subdomain (hxxp:\/\/dady.jumpingcrab.com:881\/js\/js\/<\/strong>) in 2011. List of associated MD5s:
\nMD5: e58fe6d04e8d9fce1020f532d3f0bd49<\/strong><\/a> – detected by 40 out of 44 antivirus scanners as Backdoor.Win32.Delf.yqo
\nMD5: 60fde61eea4da0601a294d8cac18fb85<\/strong><\/a> – detected by 37 out of 42 antivirus scanners as Backdoor:Win32\/Hupigon.EA
\nMD5: ac95c84a99edd65b00fbc845f8e167f0<\/strong><\/a> – detected by 38 out of 42 antivirus scanners as TrojanDropper:Win32\/Delfsnif.A
\nMD5: 7487bbfadde66edddf131b879382a9ef<\/strong><\/a> – detected by 38 out of 43 antivirus scanners as Trojan-PSW.Win32.Bjlog.vge
\nMD5: 6cf58ce47e4a9163ecf2e5e0498d3fa8<\/strong><\/a> – detected by 38 out of 43 antivirus scanners as Worm.Win32.AutoRun.davw
\nMD5: a694f0c6a0b64cc3601d946f63330a23<\/strong><\/a> – detected by 34 out of 44 antivirus scanners as Trojan.RAR.Qhost.c<\/p>\n

Webroot SecureAnywhere<\/strong><\/a>\u00a0users are proactively protected from these threats.<\/p>\n

You can find more about Dancho Danchev at his\u00a0LinkedIn Profile<\/strong><\/a>. You can also\u00a0follow him on \u00a0Twitter<\/strong><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Facebook users, watch what you click on! Cybercriminals are currently mass mailing bogus “Facebook Account Cancellation Requests“, in an attempt to trick Facebook’s users into clicking on the malicious link found in the email. Upon clicking on the link, users are exposed to client-side exploits which ultimately drop malware on the affected host. More details:<\/p>\n","protected":false},"author":65,"featured_media":17048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[12709,12703,10907,10897,12307,12263,6183,5811,12711,3871,11081,9563,4033,5257,12705,7643,12707,5717,12443,11837],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8980"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=8980"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8980\/revisions"}],"predecessor-version":[{"id":25555,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/8980\/revisions\/25555"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17048"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=8980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=8980"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=8980"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=8980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}