AutoScout24 subject to phishing

March 19, 2009 1 Comment


Most of the time, when a phishing email is sent it has it’s goal set to obtain personal and financial information regarding your bank, PayPal or eBay. But sometimes phishers choose other targets as well. In this case it is AutoScout24.

At MX Lab we intercepted a few phishing emails today from “Autoscout24 <[email protected]>”, which is obviously spoofed, with the subject “Autoscout24-Verkaeufer Informationen Haben Erfordert” and with the following content in the email body:

Aufmerksamkeit!

Liebes Mitglied Autoscout24,

Wir haben kurzlich bemerkt, dass eine oder mehr Versuche in zu Ihrem autoscout24 Konto von einem auslandischen IP Adresse loggen..

Wenn Sie kurzlich auf Ihr Konto zugegriffen haben, wahrend Reisen, durfte der ungewohnliche Klotz in Versuchen von Ihnen eingeleitet worden sein. Jedoch, wenn Sie den Klotz in nicht eingeleitet haben, bitte Besuch autoscout24 sobald moglich, Ihre Identitat zu beglaubigen:

hxxp://autoscot24-ch.info/home/index/login.asp/verify.html

Beglaubigt, dass Ihre Identitat ein Sicherheitsma©¬ ist, das sichern wird, dass Sie die einzige Person mit Zugriff auf das Konto sind.

Dank fur Ihre Geduld, als wir zusammenarbeiten, Ihr Konto zu schutzen.

Fur mehr Informationen sieht bitte den Verbindungsblasebalg:

http://about.autoscout24.com/de-de/au-company/au-company-agb/au-company-agb-as24.aspx

Mit freundlichen Gru©¬en,
AutoScout24 Team,
AutoScout24 GmbH
Rosenheimer Str. 143 b
81671 Munchen

The message indicates that there is an issue with your account because AutoScout24 noticed login attempts from a foreign IP address. You have to login and verify your account to get your account unlocked again according to these instructions.

We did a test to see if the browsers phishing engines did detect the phishing site. Here are the results:

Safari 3 (MacOS X): yes
Firefox 3 (MacOS X): no

Firefox 3 (Windows): no
Internet Explorer 7 (Windows): no

Filed under Phishing Tagged with ,

Rogue anti virus program: Antivirus for Windows – New 2009 Version

March 11, 2009 2 Comments


MX Lab intercepted a message that caught our attention. Some time ago, a rogue anti virus/anti spyware program known as Antivirus 2009, XP Antivirus Protection, MSAntivirus 2008 and Vista Antivirus 2008 was promoted on the internet and in various spam emails.

It seems that this now is distributed under a new name “Antivirus for Windows – New 2009 Version”.

The email was sent from PC Protection <[email protected]> and contains the subject “Update your Antivirus for Windows.

The email looks like a mailing and contains an Unsubscribe, Forward and Update Profile links. However, when looking at all the links in the message, some links are invalid like the Report Abuse link that contains an URL to http://ss25..sourcecompmail.com/ - note the double point after ss25. The domains http://ss25.sourcecompmail.com/ or http://sourcecompmail.com/ are giving us an HTTP 404 error and contains no web site. It is very common to work from under a subdomain and pages under that domain without any root HTML pages.

The domain itself appears to be registered at Tucows with the following details:

[whois.tucows.com]
Registrant:
 Quattro Web Solutions
 13 Hares avenue
 Woodstock
 Cape Town,  7925
 ZA
 Domain name: SOURCECOMPMAIL.COM
 Administrative Contact:
    Honig, Paul  [email protected]
    15 Wandel street
    Gardens
    Cape Town
    Cape Town,  7925
    ZA
    +27.4480099    Fax: +27.214619277
 Technical Contact:
    Desk, Help  [email protected]
    322 South Marietta Street
    ww
    w
    Gastonia, WI 28052
    US
    +1.7048527000    Fax: +1.7048849011
 Registrar of Record: TUCOWS, INC.
 Record last updated on 28-Oct-2008.
 Record expires on 28-Oct-2009.
 Record created on 28-Oct-2008.
 Registrar Domain Name Help Center:
http://domainhelp.tucows.com
 Domain servers in listed order:
    NS3.NITRIC.CO.ZA
    NS2.NITRIC.CO.ZA   
 Domain status: clientTransferProhibited
                clientUpdateProhibited

When following the download links, a landing page is shown:

When filling in your email address and the activation code you are presented with a payment screen.

Recommendation: do not proceed with the payment process and do not download the program.

Filed under Email security, Viruses Tagged with , , ,

New UPS trojan detected: TrojanSpy.ZBot.DGI

March 2, 2009 2 Comments


Posting updated on 10 March 2009. Read the new information at the end of this posting.

MX Lab intercepted a few messages, with the zero hour anti virus system, that claim that the delivery of the postal package that is handled by UPS has failed due to an incorrect address. At the time of writing, 03.02.2009 22:55:45 (CET), only 7 of the 38 anti virus engines detect this new variant.

The trojan is named TrojanSpy.ZBot.DGI (VirusBuster), Trojan-Dropper.Delf (Ikarus) or VirTool:Win32/DelfInject.gen!J (Microsoft).

The from address is spoofed and contains “United Postal Service <[email protected]>”.

The message contains the following body content:

Hello!

Sorry, we were not able to deliver postal package you sent on February the 23th in time because the recipient’s address is not correct.

Please print out the invoice copy attached and collect the package at our office.

Your UPS Support Team

The trojan hides itself inside the file Invoice_8612112.exe once you have extracted the ZIP archive Invoice_8612112.zip. Names and numbers may vary.

It has the same characteristics as in one of our previous blog posts with the difference that the connection to the remote host 91.211.65.33 now tries to get /ejik/admin.bin and /ejik/hot.php.

Virus Total permlink and MD5: a3d1a160e6ce8ca4c2b4421731e549c2.

Update 10 March 2009: A new variant is being distributed. The attached file is named UPS_ID.zip and contains the trojan UPS_ID.exe.

Virus Total permlink and MD5: b5e44647bc1f08c4d7f32fc933db1ac6.

Filed under Viruses Tagged with , , , ,

Newer posts →

Follow

Get every new post delivered to your Inbox.

Join 348 other followers