{"id":9789,"date":"2013-02-19T00:00:35","date_gmt":"2013-02-19T07:00:35","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=9789"},"modified":"2018-10-05T12:18:41","modified_gmt":"2018-10-05T18:18:41","slug":"malicious-re-your-wire-transfer-themed-emails-serve-client-side-exploits-and-malware","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/02\/19\/malicious-re-your-wire-transfer-themed-emails-serve-client-side-exploits-and-malware\/","title":{"rendered":"Malicious ‘RE: Your Wire Transfer’ themed emails serve client-side exploits and malware"},"content":{"rendered":"

Over the last couple of days, we’ve been monitoring a persistent attempt to infect tens of thousands of users with malware through a systematic rotation of multiple social engineering themes. What all of these campaigns have in common is the fact that they all share the same malicious infrastructure.<\/p>\n

Let’s profile one of the most recently spamvertised campaigns, and expose the cybercriminals’ complete portfolio of malicious domains, their related name servers, dropped MD5 and its associated run time behavior.<\/p>\n

More details:<\/p>\n

<\/p>\n

Sample screenshot of the spamvertised email:<\/strong><\/p>\n

\"Email_Spam_Malware_Exploits_Wire_Transfer_Fake_Black_Hole_Exploit_Kit\"<\/a><\/p>\n

Sample spamvertised compromised URLs:<\/strong>
\nhxxp:\/\/2555.ruksadindan.com\/page-329.htm<\/em>
\nhxxp:\/\/www.athenassoftware.com.br\/page-329.htm<\/em>
\nhxxp:\/\/www.sweetgarden.ca\/page-329.htm<\/em>
\nhxxp:\/\/lab.monohrom.uz\/page-329.htm<\/em>
\nhxxp:\/\/easy2winpoker.com\/page-329.htm<\/em>
\nhxxp:\/\/ideashtor.ru\/page-329.htm<\/em><\/p>\n

Sample client-side exploits serving URL:<\/strong>
\nhxxp:\/\/202.72.245.146:8080\/forum\/links\/public_version.php<\/em><\/p>\n

The following malicious domains also respond to the same IP (202.72.245.146<\/strong>) and are part of multiple campaigns spamvertised over the past couple of days:
\nenakinukia.ru<\/strong>
\ndekamerionka.ru<\/strong>
\nevskindarka.ru<\/strong>
\nexibonapa.ru<\/strong>
\nesigbsoahd.ru<\/strong>
\ndmssmgf.ru<\/strong>
\nepianokif.ru<\/strong>
\nelistof.ru<\/strong>
\ndmpsonthh.ru<\/strong>
\nesekundi.ru<\/strong>
\negihurinak.ru<\/strong>
\nexiansik.ru<\/strong>
\newinhdutik.ru<\/strong>
\nefjjdopkam.ru<\/strong>
\neipuonam.ru<\/strong>
\nemaianem.ru<\/strong>
\nepionkalom.ru<\/strong>
\ndisownon.ru<\/strong>
\nestipaindo.ru<\/strong>
\nejiposhhgio.ru<\/strong>
\nepilarikko.ru<\/strong>
\ndamagalko.ru<\/strong>
\nemalenoko.ru<\/strong>
\nepiratko.ru<\/strong>
\nevujalo.ru<\/strong>
\nbananamamor.ru<\/strong>
\neminakotpr.ru<\/strong>
\ndfudont.ru<\/strong><\/p>\n

Related Name Servers (part of the infrastructure of these campaigns):<\/strong>
\nName server: ns1.enakinukia.ru<\/strong> – 85.143.166.174
\nName server: ns2.enakinukia.ru<\/strong> – 41.168.5.140
\nName server: ns3.enakinukia.ru<\/strong> – 42.121.116.38
\nName server: ns4.enakinukia.ru<\/strong> – 110.164.58.250
\nName server: ns5.enakinukia.ru<\/strong> – 210.71.250.131
\nName server: ns1.dekamerionka.ru<\/strong> – 62.76.185.169
\nName server: ns2.dekamerionka.ru<\/strong> – 41.168.5.140
\nName server: ns3.dekamerionka.ru<\/strong> – 42.121.116.38
\nName server: ns4.dekamerionka.ru<\/strong> – 110.164.58.250
\nName server: ns5.dekamerionka.ru<\/strong> – 210.71.250.131
\nName server: ns1.evskindarka.ru<\/strong> – 85.143.166.174
\nName server: ns2.evskindarka.ru<\/strong> – 41.168.5.140
\nName server: ns3.evskindarka.ru<\/strong> – 42.121.116.38
\nName server: ns4.evskindarka.ru<\/strong> – 110.164.58.250
\nName server: ns5.evskindarka.ru<\/strong> – 210.71.250.131
\nName server: ns1.exibonapa.ru<\/strong> – 85.143.166.174
\nName server: ns2.exibonapa.ru<\/strong> – 41.168.5.140
\nName server: ns3.exibonapa.ru<\/strong> – 42.121.116.38
\nName server: ns4.exibonapa.ru<\/strong> – 110.164.58.250
\nName server: ns5.exibonapa.ru<\/strong> – 210.71.250.131
\nName server: ns1.esigbsoahd.ru<\/strong> – 62.76.40.244
\nName server: ns2.esigbsoahd.ru<\/strong> – 41.168.5.140
\nName server: ns3.esigbsoahd.ru<\/strong> – 110.164.58.250
\nName server: ns4.esigbsoahd.ru<\/strong> – 210.71.250.131
\nName server: ns5.esigbsoahd.ru<\/strong> – 203.171.234.53
\nName server: ns1.dmssmgf.ru<\/strong> – 62.76.185.169
\nName server: ns2.dmssmgf.ru<\/strong> – 41.168.5.140
\nName server: ns3.dmssmgf.ru<\/strong> – 42.121.116.38
\nName server: ns4.dmssmgf.ru<\/strong> – 110.164.58.250
\nName server: ns5.dmssmgf.ru<\/strong> – 210.71.250.131
\nName server: ns1.epianokif.ru<\/strong> – 62.76.40.244
\nName server: ns2.epianokif.ru<\/strong> – 41.168.5.140
\nName server: ns3.epianokif.ru<\/strong> – 110.164.58.250
\nName server: ns4.epianokif.ru<\/strong> – 210.71.250.131
\nName server: ns1.elistof.ru<\/strong> – 62.76.40.244
\nName server: ns2.elistof.ru<\/strong> – 41.168.5.140
\nName server: ns3.elistof.ru<\/strong> – 110.164.58.250
\nName server: ns4.elistof.ru<\/strong> – 210.71.250.131
\nName server: ns1.dmpsonthh.ru<\/strong> – 62.76.185.169
\nName server: ns2.dmpsonthh.ru<\/strong> – 41.168.5.140
\nName server: ns3.dmpsonthh.ru<\/strong> – 42.121.116.38
\nName server: ns4.dmpsonthh.ru<\/strong> – 110.164.58.250
\nName server: ns5.dmpsonthh.ru<\/strong> – 210.71.250.131
\nName server: ns1.esekundi.ru<\/strong> – 85.143.166.174
\nName server: ns2.esekundi.ru<\/strong> – 41.168.5.140
\nName server: ns3.esekundi.ru<\/strong> – 42.121.116.38
\nName server: ns4.esekundi.ru<\/strong> – 110.164.58.250
\nName server: ns5.esekundi.ru<\/strong> – 210.71.250.131
\nName server: ns1.egihurinak.ru<\/strong> – 85.143.166.174
\nName server: ns2.egihurinak.ru<\/strong> – 41.168.5.140
\nName server: ns3.egihurinak.ru<\/strong> – 42.121.116.38
\nName server: ns4.egihurinak.ru<\/strong> – 110.164.58.250
\nName server: ns5.egihurinak.ru<\/strong> – 210.71.250.131
\nName server: ns1.exiansik.ru<\/strong> – 85.143.166.174
\nName server: ns2.exiansik.ru<\/strong> – 41.168.5.140
\nName server: ns3.exiansik.ru<\/strong> – 42.121.116.38
\nName server: ns4.exiansik.ru<\/strong> – 110.164.58.250
\nName server: ns5.exiansik.ru<\/strong> – 210.71.250.131
\nName server: ns1.ewinhdutik.ru<\/strong> – 62.76.40.244
\nName server: ns2.ewinhdutik.ru<\/strong> – 41.168.5.140
\nName server: ns3.ewinhdutik.ru<\/strong> – 110.164.58.250
\nName server: ns4.ewinhdutik.ru<\/strong> – 210.71.250.131
\nName server: ns5.ewinhdutik.ru<\/strong> – 203.171.234.53
\nName server: ns1.efjjdopkam.ru<\/strong> – 62.76.40.244
\nName server: ns2.efjjdopkam.ru<\/strong> – 41.168.5.140
\nName server: ns3.efjjdopkam.ru<\/strong> – 110.164.58.250
\nName server: ns4.efjjdopkam.ru<\/strong> – 210.71.250.131
\nName server: ns5.efjjdopkam.ru<\/strong> – 203.171.234.53
\nName server: ns1.eipuonam.ru<\/strong> – 62.76.40.244
\nName server: ns2.eipuonam.ru<\/strong> – 41.168.5.140
\nName server: ns3.eipuonam.ru<\/strong> – 110.164.58.250
\nName server: ns4.eipuonam.ru<\/strong> – 210.71.250.131
\nName server: ns5.eipuonam.ru<\/strong> – 203.171.234.53
\nName server: ns1.emaianem.ru<\/strong> – 62.76.40.244
\nName server: ns2.emaianem.ru<\/strong> – 41.168.5.140
\nName server: ns3.emaianem.ru<\/strong> – 110.164.58.250
\nName server: ns4.emaianem.ru<\/strong> – 210.71.250.131
\nName server: ns1.epionkalom.ru<\/strong> – 62.76.40.244
\nName server: ns2.epionkalom.ru<\/strong> – 41.168.5.140
\nName server: ns3.epionkalom.ru<\/strong> – 110.164.58.250
\nName server: ns4.epionkalom.ru<\/strong> – 210.71.250.131
\nName server: ns5.epionkalom.ru<\/strong> – 203.171.234.53
\nName server: ns1.disownon.ru<\/strong> – 62.76.185.169
\nName server: ns2.disownon.ru<\/strong> – 41.168.5.140
\nName server: ns3.disownon.ru<\/strong> – 42.121.116.38
\nName server: ns4.disownon.ru<\/strong> – 110.164.58.250
\nName server: ns5.disownon.ru<\/strong> – 210.71.250.131
\nName server: ns1.estipaindo.ru<\/strong> – 62.76.40.244
\nName server: ns2.estipaindo.ru<\/strong> – 41.168.5.140
\nName server: ns3.estipaindo.ru<\/strong> – 110.164.58.250
\nName server: ns4.estipaindo.ru<\/strong> – 210.71.250.131
\nName server: ns1.ejiposhhgio.ru<\/strong> – 62.76.40.244
\nName server: ns2.ejiposhhgio.ru<\/strong> – 41.168.5.140
\nName server: ns3.ejiposhhgio.ru<\/strong> – 110.164.58.250
\nName server: ns4.ejiposhhgio.ru<\/strong> – 210.71.250.131
\nName server: ns5.ejiposhhgio.ru<\/strong> – 203.171.234.53
\nName server: ns1.epilarikko.ru<\/strong> – 85.143.166.174
\nName server: ns2.epilarikko.ru<\/strong> – 41.168.5.140
\nName server: ns3.epilarikko.ru<\/strong> – 42.121.116.38
\nName server: ns4.epilarikko.ru<\/strong> – 110.164.58.250
\nName server: ns5.epilarikko.ru<\/strong> – 210.71.250.131
\nName server: ns1.damagalko.ru<\/strong> – 62.76.185.169
\nName server: ns2.damagalko.ru<\/strong> – 41.168.5.140
\nName server: ns3.damagalko.ru<\/strong> – 42.121.116.38
\nName server: ns4.damagalko.ru<\/strong> – 110.164.58.250
\nName server: ns5.damagalko.ru<\/strong> – 210.71.250.131
\nName server: ns1.emalenoko.ru<\/strong> – 62.76.40.244
\nName server: ns2.emalenoko.ru<\/strong> – 41.168.5.140
\nName server: ns3.emalenoko.ru<\/strong> – 110.164.58.250
\nName server: ns4.emalenoko.ru<\/strong> – 210.71.250.131
\nName server: ns1.epiratko.ru<\/strong> – 85.143.166.174
\nName server: ns2.epiratko.ru<\/strong> – 41.168.5.140
\nName server: ns3.epiratko.ru<\/strong> – 42.121.116.38
\nName server: ns4.epiratko.ru<\/strong> – 110.164.58.250
\nName server: ns5.epiratko.ru<\/strong> – 210.71.250.131
\nName server: ns1.evujalo.ru<\/strong> – 85.143.166.174
\nName server: ns2.evujalo.ru<\/strong> – 41.168.5.140
\nName server: ns3.evujalo.ru<\/strong> – 42.121.116.38
\nName server: ns4.evujalo.ru<\/strong> – 110.164.58.250
\nName server: ns5.evujalo.ru<\/strong> – 210.71.250.131
\nName server: ns1.bananamamor.ru<\/strong> – 62.76.186.24
\nName server: ns2.bananamamor.ru<\/strong> – 41.168.5.140
\nName server: ns3.bananamamor.ru<\/strong> – 42.121.116.38
\nName server: ns4.bananamamor.ru<\/strong> – 110.164.58.250
\nName server: ns5.bananamamor.ru<\/strong> – 210.71.250.131
\nName server: ns1.eminakotpr.ru<\/strong> – 62.76.40.244
\nName server: ns2.eminakotpr.ru<\/strong> – 41.168.5.140
\nName server: ns3.eminakotpr.ru<\/strong> – 110.164.58.250
\nName server: ns4.eminakotpr.ru<\/strong> – 210.71.250.131
\nName server: ns5.eminakotpr.ru<\/strong> – 203.171.234.53
\nName server: ns1.dfudont.ru<\/strong> – 62.76.185.169
\nName server: ns2.dfudont.ru<\/strong> – 41.168.5.140
\nName server: ns3.dfudont.ru<\/strong> – 42.121.116.38
\nName server: ns4.dfudont.ru<\/strong> – 110.164.58.250
\nName server: ns5.dfudont.ru<\/strong> – 210.71.250.131<\/p>\n

Sample malicious payload dropping URL:<\/strong>
\nhxxp:\/\/202.72.245.146:8080\/forum\/links\/public_version.php?mmltejvt=1g:2v:33:2v:2w&pstvw=3d&xrej=1j:33:32:1l:1g:1i:1o:1n:1o:1i&vczaspnq=1n:1d:1f:1d:1f:1d:1j:1k:1l<\/em><\/p>\n

Sample client-side exploits served:<\/strong> CVE-2010-0188<\/em><\/a><\/p>\n

Upon successful client-side exploitation, the campaign drops MD5: 04e9d4167c9a1b82e622e04ad85f8e99<\/strong><\/a> – detected by 31 out of 46 antivirus scanners as\u00a0Trojan.Win32.Yakes.cdxy.<\/p>\n

Once executed, the sample creates the following Registry Keys:<\/strong>
\nHKEY_LOCAL_MACHINESYSTEMControlSet001ControlMediaResourcesmsvideo<\/em>
\nHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlMediaResourcesmsvideo<\/em>
\nHKEY_CURRENT_USERSoftwareMicrosoftMultimediaDrawDib<\/em><\/p>\n

And modifies them in the following way:<\/strong>
\n[HKEY_CURRENT_USERSoftwareMicrosoftMultimediaDrawDib] -> vga.drv 640x480x32(BGR 0) = “31,31,31,31”<\/em>
\n[HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon] -> shell = “explorer.exe,%AppData%skype.dat”<\/em><\/p>\n

Once executed, the sample phones back to the following URLs:<\/strong>
\nhxxp:\/\/gpbxn.ru\/rzprxtgxtyebms-qtda-nmxt-ndfvohvndd-cbdh-qtorpp-fprg-sdqj-yszh-vnamvylalipbpyykeawkdastftukky.php<\/em>
\nhxxp:\/\/jhlxk.su\/oyxioyxi-oyxioyxibcvnosrqqrprar-nbjk-ndelquqjoheyowmsndxp-ltwgysxixsnnceksdm_rzbi_aumr-ysix.php<\/em>
\nhxxp:\/\/gpbxn.ru\/itqukqcbkydftmysmrrqfqnbptfpxlyedapffv-uqxfakkoqp-orzmsd-cupz-atqc_ybeh_ohtfsi-ykjz_prdmuq-yk.php<\/em>
\nhxxp:\/\/jhlxk.su\/cnpmezeamv-kort-ioou_wkzjvr-alpb-cuqsfv-lipt_nhuk-jzgx-acix_abgn-fvca-oept-zhgjtmqtdnkg-pvzo-zauuqk-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/rkow-pvpz-turnndgkgnrueglazvrdqzmvdhsukgcuzjyxofuynn-kkhj-wpli-lxca-auwbybppplyjouiivnno_xf.php<\/em>
\nhxxp:\/\/jhlxk.su\/qnjt-ixjxqnjtixjxyeppoycn-qzgb-gbihspkftiqu-syqtdhxydk_zozm_dkgbsprnxljz-quplhcpixo-rzdm-zvyx-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/rnnd-gkjkpp-phacuypfsrhcawshpi-prmx-nfuyqzdnxopygt-pyko-acus-tugaxfiqegybqcdheabi-zmiirkculi.php<\/em>
\nhxxp:\/\/jhlxk.su\/my-nsoe-exjlbwipnafquq-nbqk-cglx-cexcdaykcn_baohzaiirkfy-qzdn-gdva_yhlzif-jtca-cgclrcnlgkpvfcxx.php<\/em>
\nhxxp:\/\/gpbxn.ru\/piqjteitqukqcbkyvyteptofxpxsyerksrfmvp-jpjxej-uswi-kkjl-xytewpegnezjsuon-ownq-xcbt_xqyb_uxeh.php<\/em>
\nhxxp:\/\/jhlxk.su\/lajutfofnoygfq-uomyor-lxpqnqwpzvawsn-kyst-nfmpmpsuarkdsulz-lgtmnwabjtcj-aueblmifioiqvkoarn.php<\/em>
\nhxxp:\/\/gpbxn.ru\/ebmsqtusqzukwgrgky-shpicusygkppuavaca-cnfq-ddsu_ynorjkllgoon-juns-goyhcgyjzmlg-rzpq-qpjt_xvuq.php<\/em>
\nhxxp:\/\/jhlxk.su\/ip-nadw-wipqne-ytmx_bldr-lzht-cjro-lgty-qcky-coprzrjwalpz-myteez-owwk-suab_bcjt_nojt_ysnakb-jkos-fyzj-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/vy_vlcu-opvk-dgks-babc-ixgsuy-nqey-cjjh-eaxtzriioasd-jgnd_rcea_fcoudf-kktiezfpwp-phon_jtea_dgamzhga.php<\/em>
\nhxxp:\/\/jhlxk.su\/hjyqybti-sddn-xocq-ohlx-osgt-gdhcrnyqvqukclyx-fyjk-oxoy-nwsn_oxmr_glwk-nmqn-vyac-pbrtmyvafappnlea.php<\/em>
\nhxxp:\/\/gpbxn.ru\/igyhva-xlsyft-xplx-rizh-yszn-ltli-wpnstmspdanqmy_qsqj-cqjkfzgdwfuy-garalabwyear_ouabdhldcbuqjp.php<\/em>
\nhxxp:\/\/jhlxk.su\/jutf-ofnoygfquobi-jtbilmrdpixp-pabcdnstos-dhti_ohjp_pyqt-mvkdsiqttykfgs-lirkfc-zhxl-gjyhzvhelx.php<\/em>
\nhxxp:\/\/gpbxn.ru\/pt-ptptptptptptptuqmpbhjlstusplfmgtdh_xyuyms-ofvizovqqcxohemp-mpzv-vlit-nhne_htuqvl-yxph-zjuu-.php<\/em>
\nhxxp:\/\/jhlxk.su\/ipna-dwwi_pqneytmxbldrlzht-cjro-lgtyqckycoprzrjwalpzmyte-ezowwk-suabbcjtno-jtys-nakb-jkos-fyzj-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/uqfplgsncexczjddtybaonfcybioiisimyprmvxvea-laxvjvfzpv-oatu-gdoe-bafrqkstkgowitbfblsujguo-.php<\/em>
\nhxxp:\/\/jhlxk.su\/sncexczjddongdqkpaoyvnxtdm-qtqu-yvvpbtgxfrynwg_dkspqposoaohqt-ouvqtixoxxvacg-xqte_ofzj-xcfr-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/mpfmgnlt-blcrkgoxopelar-uaop-vtrp-lmcd-juosvalzoaqt-xplx-siwkcokqnssu_nskq_uavi_jhvpca-owdgab-jz.php<\/em>
\nhxxp:\/\/jhlxk.su\/bihc-kkrq-shgscdnbuulx-qcipvtcaaw-lxzm_ygxt-ygyxpacenosdvybhnbwinaixoykdxqduxpdunwnhxlyvbi.php<\/em>
\nhxxp:\/\/gpbxn.ru\/cd-nbvpherovnvy-vlxsrnitlzorjthtldkoxqfccd-frjuzmgtjp-dmbc-bwau-bccdsnohezwidmduqtzhbqrn-nn.php<\/em>
\nhxxp:\/\/jhlxk.su\/vqsrznyjbqricoarxplasiuu_fqye_dfuq-qcrtddfzroxowgowix-ygnmllrpabus-gkfzjxoxjxopplitzvkfla.php<\/em>
\nhxxp:\/\/gpbxn.ru\/nfwfmrhttwwp-wbjg_bwms-iqdwqcliop-nlos-qpuanfmrndzo-kots-ppjt-akzmgncjgdorouohabfv-bhhtrpaccn.php<\/em>
\nhxxp:\/\/jhlxk.su\/jkpp-phacuyqckfouvlznkg-rquxjgstybditmbwtmixacyehe-uaejcbvpxfjkgdgxiffzxtfaebbwviqj-qsip-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/zh-rubt-oahjyqybtiybnesncnofstdforqn-awpf-ptcqfmsuqzgdlxusif-ftybuozacnvnsnosnfnaneye_akea.php<\/em>
\nhxxp:\/\/jhlxk.su\/ppph-acuy-qckfougjlznw_bipbnf-ifgdvylzshsdigsuuynmqrybptzm_kkxttm-ioqsfyrchcvrop-kdip_oajvpi.php<\/em>
\nhxxp:\/\/gpbxn.ru\/zv-yxpajheluqfp-lgii-ynyvvpjkoaeg-ksxi-tsioygzrxcytvqzvhezmjtmppftmosit_qrks_xotf_ptnaqugbcq.php<\/em>
\nhxxp:\/\/jhlxk.su\/itqukqcbkydf-tmysmr-rqfq-nbpt-fpxl_yeda_pffv_uqxfak-koqporzmsdcupzatqcybehohtfsiykjzprdm-uqyk.php<\/em>
\nhxxp:\/\/gpbxn.ru\/zmfrqsrafyabdiii-xpkkxj-exsu-pbbtuk-oait-llar_rukf_jtsi_yttsjw-fvfr-qzsplgtuosdwjh-ruyb-rtne-kgif-.php<\/em>
\nhxxp:\/\/jhlxk.su\/oa-hjyqybtisddnxojgtskorpvqvrdgksauqkddxxrc-elpaehsdceal-alfz_oyoamr-dgqs_xjyt-cnxignohzhqt.php<\/em>
\nhxxp:\/\/gpbxn.ru\/vl-cuopvkdgksba_fvux-ytfpygzvbtbidg-dadrlxacmxjponvtfvcbfr-dnprauzmsrnfdk-ltju-alkbpqxlcqll.php<\/em>
\nhxxp:\/\/jhlxk.su\/mynsoeexjlbwip-nafquqnbqkcglxcexcda_ykcn_baohza-iirkfyqzdngdva-yhlzifjtcacgcl-rcnl_gkpvfc-xx.php<\/em>
\nhxxp:\/\/gpbxn.ru\/ux-mpfmgnltblcrkg-tinf-rpty-jhynuyhctycuzmtfzmspatipky-qkmrtuauzallcj-kqftkytwmrgl-zvfvey-sy.php<\/em>
\nhxxp:\/\/jhlxk.su\/ougjyv-xvak-uakbegmvezzafabieyoszmpfnwcb-tmgari-tyrnjzcaqsgs_mswfnd-dhkqzv-snptpynqldbqioxt.php<\/em>
\nhxxp:\/\/gpbxn.ru\/uxmpfmgnltbl-crkg-tinfrptyjhyn-uyhcty-cuzm-tfzmspatipkyqkmrtuauzallcjkqftky-twmrglzvfveysy.php<\/em>
\nhxxp:\/\/jhlxk.su\/ar-zmfr-qsra-fyabdimvzvmsyxuojz-laebalcuzryeyeuqrnrk-pyzj-fzqnqkzadiihtugoxl-tufthealmsvasn.php<\/em>
\nhxxp:\/\/gpbxn.ru\/sddn-xocq-piqjteitdwyvfmatqc_akgn-xqsnmxqzcahtjzyjftznqz-yjor-kdrqdrakvyms-cbdwrncolljhjuam.php<\/em>
\nhxxp:\/\/jhlxk.su\/vaxlsyft-xplx-stzhit-qnzn-vaea-wfbwihytzjfp-ehehnlhtiivy-zjcaorjzyttempli_kovy_pfkddk-abht-opxf-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/wfmrht-twwp-wbjgnfgnebwbjpkoxc-prkdyv-jptm_ejzh_pyxoehpvgkbh_jhgkdivqzaoygsammxakdw_fmixzoez.php<\/em>
\nhxxp:\/\/jhlxk.su\/kk_rqshgs-cdnb-vphe-rprd_pqez_bwalbquqjtradnejtsak-lamsfvqcmrejifqkbtkfeh_prnbuk-ykzo-zjkf-viyh.php<\/em>
\nhxxp:\/\/gpbxn.ru\/xyawrkowpvpztu-rnjp-cjopouzasnxcjgyjiogbna_nnix_xtkbcu-bijgbqjxvtositpzxypq-gapvejrdmyoxfy.php<\/em>
\nhxxp:\/\/jhlxk.su\/ih_zovr_dmih-zovrdmxcnwrialroju-iocu-rulaga-gbeh-kqnornvionpisyspxqruyeyvpixlvifmft-kygkawjx.php<\/em>
\nhxxp:\/\/gpbxn.ru\/teitqukqcbkydftm_htra_eygo-usgnlmzhtevlrk-owxyiojuehcj-wksh_auoy-rpbajxrocgdrvajxitlidr-exip_.php<\/em>
\nhxxp:\/\/jhlxk.su\/mynsoeexjlbwipnafq_uqnb-qkcg-lxce_xcda_ykcnba-ohzaiirkfy-qzdngdvayhlzifjtcacgclrcnlgkpvfcxx.php<\/em>
\nhxxp:\/\/gpbxn.ru\/kq-cbky-dftmys-glga_ohtm-vrqswprpvqmslmatdwgtzmbhkggtukuu-cbyt-yquu-wfptjkpflxmxkq-qjllhcrgko.php<\/em>
\nhxxp:\/\/jhlxk.su\/ygfquobihc-kkrq-shjppf-ifytxf-wixv_gtxp-bfceoxyvht-ddshqs-pbfq_rcli-gbalxcauriebhtxyqkwfprwgkd.php<\/em>
\nhxxp:\/\/gpbxn.ru\/opvk-dgksbafvsudu-jhvinsrogojlnhsikgofgbuyqkkfrixvfrdmvnsuhtehifnsky-jxwk_dniiys-bwraeb-of.php<\/em>
\nhxxp:\/\/jhlxk.su\/exjlbwip-nadwwipqrqtswblmfp-vifayqwfioxtyquabi-cnfm-osel-fcli_rqjtearzhcac-vkoaxqpypp-qnnnlm-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/vaxlsyftxplxstzhitqnzn-vaea-wfbwihytzjfp-eheh-nlhtiivyzjcaorjzytte_mpli_kovypf-kddk-abht-opxf-.php<\/em>
\nhxxp:\/\/jhlxk.su\/ifej_dapl_jvzvyxpaoaih_pqgx_ipiisilipmohowoewiacxxplshsntiuoxopyhelisybhsn-kkms-vlbc-ukmxfp.php<\/em>
\nhxxp:\/\/gpbxn.ru\/ygfquobihckk-rqshjppfifytxf-wixvgtxpbfceoxyvhtdd_shqspbfqrcligbalxcauriebhtxyqkwfprwgkd.php<\/em>
\nhxxp:\/\/jhlxk.su\/lz-lipbux-mpfmgnltwpdmmpli_dudf-tfih-oari_bhgo_elixawdnrgcdzjra-jgsd-yjnw-korojuysdh-ykpynekqlt.php<\/em>
\nhxxp:\/\/gpbxn.ru\/bqricoarzmfrqsracewg-paruoxhjmy-oxvi_ptopbajpehgsnl-culg-eaxfli-lagdcaptrgfq_itvasd-gtwk-gaqn-.php<\/em>
\nhxxp:\/\/jhlxk.su\/jgnf-wfmrhttwwp-wbxo_hjii-xfbh-kqfcjujkgacg-zngt-vnce-xvwkjwnsgd-godu-pmqzceftrgcrkqjgdgnn_mxfq-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/noygfquobihckkrqwfuocllgdh-zrouipdurqlililakyzvsrcjjurqxopfipauabqu-wfba-kbegzjyvqjbhvl.php<\/em>
\nhxxp:\/\/jhlxk.su\/gjyv-xvakuakbeg-nldg_zmexcunhwiosxfsugspqearomy_pycu-dwys-xvvykseyfr_spuq_dnfc_osjthtllkdonxj.php<\/em>
\nhxxp:\/\/gpbxn.ru\/kfougj-yvxv_akuakbigohzhxowiezzjbigddh-ytxsbwexsy-exdmcbatehgnyqcnjxsujl_hjpzglfpzhdkkb-ih.php<\/em>
\nhxxp:\/\/jhlxk.su\/nnrpfaau-xfjwbheynblxqt-gofqtmqcnmignhhceluujgaclzvpawyvpikykqykoullzvlzclbteh-nliivqoy.php<\/em>
\nhxxp:\/\/gpbxn.ru\/kydf-tmysglgajzqrdrtwjtqtoehjnlllzvuastnsmrakiixcsuxscqrdgoppjxoreakq-mytsamwfpq-qczjgj.php<\/em>
\nhxxp:\/\/jhlxk.su\/opvkdgksbafvsudujh-vins-rogo-jlnhsikgofgbuyqkkfrixvfrdmvnsuhtehifnskyjxwkdn-iiys-bwra-ebof.php<\/em>
\nhxxp:\/\/gpbxn.ru\/on-gdqk-kdvttsorqpamqp_zvysxs-nmqc-rgyx-fvhj-zrrnbtatfcqcawquvkwfej-gncjit-vtsn-fqpi-bcyn-yxclgb-.php<\/em>
\nhxxp:\/\/jhlxk.su\/hjyqybtisddnxocqohlxosgtgdhcrnyqvqukclyx-fyjkox-oynwsnoxmrglwknmqnvyacpbrtmyvafa-ppnl-ea.php<\/em>
\nhxxp:\/\/gpbxn.ru\/kb_egnlxj-igyh-vaxltyegnwtwykyhtsifoegdglxf-xixliquqdnqpfcxpfapf-ebvl_earqqu-lmmsqp-kfnemynd.php<\/em>
\nhxxp:\/\/jhlxk.su\/nwamrdmynsoeexjlliiolt-bqvnebpytico_oxua-egig-linbllcornxjowzrgkrztuexux-ebop-qnjxaratuqvi.php<\/em>
\nhxxp:\/\/gpbxn.ru\/nn_rpfaau-xfjwbheynblxqtgo-fqtm-qcnm-ignh-hcel-uujgaclzvpawyvpikykqykoullzvlz-clbtehnliivqoy.php<\/em>
\nhxxp:\/\/jhlxk.su\/ba-fvsuducalaju-tfig_ampvkqyxfyuu-uszvbc-nodkjkdusp-rtla-xcey-amlm-jwzmdiuonfno-xjglvlusigtfpm.php<\/em>
\nhxxp:\/\/gpbxn.ru\/yvxvakuakbeg_nlxj_caoy_vpkdjxqsdfnwfzhecoshegussi-dkcr-nfjw-cjfm-btii_fqjgxq-jvftqr-rduqjzoapb.php<\/em>
\nhxxp:\/\/jhlxk.su\/dg_ksba_fvsu_duca_layxlitmuqxoynfqpmpf_xvty-rceacdcnrq-vnco-rkwb_nqyt-blfvukoftwks-cjlauu-eaqp-mv.php<\/em>
\nhxxp:\/\/gpbxn.ru\/bcgocnpmez-eamv-kons-ksaw_yjvl-xpyb-gkjw-nwjukbcbsh_bqfy_ebxoyv-ykbqatdirkoejtqj_pbpq_lzdk-jkrq-bh.php<\/em>
\nhxxp:\/\/jhlxk.su\/amrdmy-nsoeex-jlbwndftcajvgnabjgfqvtsnfc-nhyt_gtejshfcdgsu-rnuypzduns_egye-mpgojhoekfnnyjhc-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/bafvsuducala-jutf-igampv-kqyxfyuuuszvbcnodkjkdusprtla-xceyamlmjwzmdiuonfnoxjglvlus-igtfpm.php<\/em>
\nhxxp:\/\/jhlxk.su\/owpvpzturn-ndgkjkdhro_fyfzzokbofoaxlbfonsngbkdwgbl-ofqzfmoakf-yjqr-dfro_osvl-rggbouplallt-rg.php<\/em>
\nhxxp:\/\/gpbxn.ru\/yv_xvakuakbegnlxj_caoy_vpkdjx-qsdfnw-fzheco-sheg-ussi-dkcr_nfjw-cjfm-btii_fqjg-xqjvftqrrduq-jzoapb-.php<\/em>
\nhxxp:\/\/jhlxk.su\/gocnpm_ezea_mvkortcdranq-jvtuqjuodmbqiifpca-dwptpqpioa_xcsh-lxgbmrwigbakpvrg-pisyegnoxymp_ru.php<\/em>
\nhxxp:\/\/gpbxn.ru\/xo-cqpi-qjteitqukqrz-zjqrxfxqgjuy-cnns_ihuo_nlxxda-oukk-tsbauq-uykb_uudi-bwiqbwynof-jkuo-znawkgux.php<\/em>
\nhxxp:\/\/jhlxk.su\/bqricoarzmfrqs-racewg-paru-oxhjmy-oxviptopbajpeh-gsnl-culgeaxflilagdcaptrg-fqitvasdgt_wkga_qn.php<\/em>
\nhxxp:\/\/gpbxn.ru\/egnl-xjig-yhva_xlsy_uyruvr-uoyq-pyrp-ynht-gkce-cejkbhmsxliq-phatlzgnfcxlpa-fzxp-ukwbeayhrkzmnlit.php<\/em>
\nhxxp:\/\/jhlxk.su\/ndgkjkppphacuyqcipduyhmy-ladr-fcbayh-cdcn_tmppft-gxyt-pvvkkkrqartsorquxxrannygiicnkfyq-owjv.php<\/em>
\nhxxp:\/\/gpbxn.ru\/calajutf_ofnoyg-fqih-wgti-ehjg-ybdm-jvcaru-tmwiybnsnb-jzey_mrowxl-bljh_jlpm-bfof-gsnq-cncq-ybzm-fyvr.php<\/em>
\nhxxp:\/\/jhlxk.su\/ihzo-vrdmihzovrdmxc-nwrialroju-iocurulagagbeh-kqnornvion_pisy-spxq-ruyeyvpixlvi-fmftkygkawjx-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/rd-mynsoeexjlbwiptivtynddlgcdllusmrqngkac-pzjwjwblpaihkq-lgmpifiqbans-almrtiplop-ybsd-xpuo-.php<\/em>
\nhxxp:\/\/jhlxk.su\/wkcl-albc-gocnpmezsycqxqftuy-tuqz-qkampyytcbfmio-pikq-xilmpaihcagbmpzayv-ytvq_vayx_cjxjjz-jxdw.php<\/em>
\nhxxp:\/\/gpbxn.ru\/atrz_prxtgxtyebmsjwop-phkd-dayedavyqsyx-mxmy-kodw-ndfclldadrna-ebybtsqnrkifcojzqsbwuq-xfheuy.php<\/em>
\nhxxp:\/\/jhlxk.su\/rafy-abdi_iiye_ohif-syph-vtmvyjohhetmnolg_kopvqkfzgoejaw-qrvl-fyuumvawph_vrwkvliimpuqwbfyraht-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/btoahjyq-ybti-sddn-tugl-koty-nbvq-dfjvrodhejgajxkqpaoaspnbkkkfcartgxnexozhoyuarg_nlpa_expq-rt.php<\/em>
\nhxxp:\/\/jhlxk.su\/rp-faau-xfjw-bhey_vixv-rpld-vripyh-cgvicq-orcjam-awegihrgyqphvp-kbam-qtvq-fykq-jubqlxfysusivqht-ft.php<\/em>
\nhxxp:\/\/gpbxn.ru\/rnnd-gkjkppphacuypfsrhcawsh-pipr-mxnfuyqzdnxo-pygt-pykoacustu_gaxf-iqegybqcdheabizmiirkculi.php<\/em>
\nhxxp:\/\/jhlxk.su\/uobihckkrqsh_gscdpt-yxuu-spwi-xitept-gngauomsvamrph-hcmypy-ldnn-rnzrkyjkosel-mpoujuvtsidizjkf.php<\/em>
\nhxxp:\/\/gpbxn.ru\/my-nsoe-exjl-bwipnafquqnbqkcglxcexc-daykcnbaoh_zaiirk-fyqz-dngdva-yhlzif-jtca-cgcl_rcnlgk-pvfc-xx.php<\/em>
\nhxxp:\/\/jhlxk.su\/jpfc-gtdh-xsdknqzapzvqzrteejixuaplpbtivpcjvpyh-qkeb_sdnoqr-oeca-biorehsrbt-ehuy-tmybza-wipfcj-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/fplgsncexc_zjddonjufzna-gdfrtycjukonxvruuqawpmti-yjnawbgarc-xcsh-rgqzzvjlexrkmxzofckgdi-di.php<\/em>
\nhxxp:\/\/jhlxk.su\/duca-laju-tfofno-ygsi-exnd-wfjt-banafqpbpmos_oskyaknstiqtehjziqukfqltba-ykmvnniosdlzzncg-fqju-.php<\/em>
\nhxxp:\/\/gpbxn.ru\/akua-kbegnl-xjig-yhclpq-sypa-runo-plpmcq-gadk-ruramrkdvnfq-ohjh-mvxleg-ukcdsy-ofox-onqz-syqt-ksxf-ts.php<\/em>
\nhxxp:\/\/jhlxk.su\/dftm-ysglgajzqrpftfoaxj-fzco-uofp-dwon-jtrpqtnmlllxoeuoga-itwk-rngkfrzrxpptcqfcuujplixc-ykvr.php<\/em>
\nhxxp:\/\/gpbxn.ru\/rq_shgscdnbvphero-pyga_vnnete-fmkk_rgiivkfaxjfpejoy-bczokqatno-mvdk-zmbf-cbtf_itnsxoqznenopl-vq.php<\/em>
\nhxxp:\/\/jhlxk.su\/jxqn_jtixjxqnjtixjkcqstll-elvpgn-jplikqbluu-dicbukitiokq-xonh-iioynovnbqtedd_xlbt_jtwi-ipmyal.php<\/em>
\nhxxp:\/\/gpbxn.ru\/calajutfofnoygfqihwgtiehjgybdmjv-caru_tmwi_ybnsnb-jzeymrowxlbljhjlpmbfofgsnqcn-cqybzmfyvr.php<\/em>
\nhxxp:\/\/jhlxk.su\/bihckkrqshgs-cdnb_uulx_qcipvtcaawlxzm-ygxtygyxpace-nosdvybhnbwinaixoykdxqduxpdu-nwnh-xlyv-bi.php<\/em><\/p>\n

Webroot SecureAnywhere<\/a><\/strong>\u00a0users are proactively protected from these threats.<\/p>\n

You can find more about Dancho Danchev at his\u00a0LinkedIn Profile<\/strong><\/a>. You can also\u00a0follow him on \u00a0Twitter<\/strong><\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Over the last couple of days, we’ve been monitoring a persistent attempt to infect tens of thousands of users with malware through a systematic rotation of multiple social engineering themes. What all of these campaigns have in common is the fact that they all share the same malicious infrastructure. Let’s profile one of the most […]<\/p>\n","protected":false},"author":65,"featured_media":17048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[13393,13383,13395,13385,13389,11559,10115,9563,13387,5135,5019,4065,5727,4027,13391,13381,3875,11837,6191,5883],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/9789"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=9789"}],"version-history":[{"count":3,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/9789\/revisions"}],"predecessor-version":[{"id":25615,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/9789\/revisions\/25615"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17048"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=9789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=9789"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=9789"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=9789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}