A currently spamvertised campaign is enticing end users into downloading a fraudulent online gambling application KingSpinEN.exe. The campaign is part of last month’s Don’t Play Poker on an Infected Table – Part Four series.
Detection rate:
KingSpinEN.exe – W32/Casino.F.gen!Eldorado – Result:16/43 (37.2%)
MD5 : ead8156a838842bc8463995a91eee08b
SHA1 : 239594a514c461c63dc8da69b08b9b63baaf2579
SHA256: 491c291eaed67268d14a36470e5d6f6d4ed829055fe4a2897ac5f050b50a2e36
Upon execution phones back to:
– download.thepalacegroupgaming.com /tracking.aspx?ul=en&casino=spinpalace&banner_tag=a20337&uuid=%7b9F9E0585-9340-45C0-9EC7-46FBE5E7127F%7d&state=100
– spinpalace.mgsmup.com /mupp/spinpalace/spinpalace_install.cab
– spinpalace.mgsmup.com /mupp/spinpalace/spinpalace.cab
– download.thepalacegroupgaming.com /tracking.aspx?ul=en&casino=spinpalace&banner_tag=a20337&uuid=%7b9F9E0585-9340-45C0-9EC7-46FBE5E7127F%7d&state=422
– marketing.valueactive.eu /VIP/animations/en/movies_en.htm
Portfolio of fraudulent online gambling domains part of the campaign. The majority are hosted within AS49130, ARNET-AS SC ArNet Connection SRL:
casino-elit-super.ru – 89.45.14.12
casinogoldsuper.ru – 89.45.14.12
casinokingsuper.ru – 89.45.14.12
casino-king-super.ru – 89.45.14.12
casinolabsuper.ru – 89.45.14.12
casino-lux-super.ru – 89.45.14.12
casinomultisuper.ru – 89.45.14.12
casinonetsuper.ru – 89.45.14.12
casino-net-super.ru – 89.45.14.12
casinonextvip.ru – 89.45.14.12
casino-online-super.ru – 90.182.175.234
casinopartysuper.ru – 90.182.175.234
casino-party-super.ru – 90.182.175.234
casinoplazasuper.ru – 90.182.175.234
1casinostarsuper.ru – 90.182.175.234
casinosuperelit.ru – 89.45.14.12
casino-super-elit.ru – 89.45.14.12
casinosuperking.ru – 89.45.14.12
casino-super-king.ru – 89.45.14.12
casinosupermulti.ru – 89.45.14.12
casinosupernet.ru – 89.45.14.12
casino-super-net.ru – 89.45.14.12
casino-super-online.ru – 90.182.175.234
casinosupervip.ru – 89.45.14.12
casino-super-vip.ru – 89.45.14.12
casinosuperweb.ru – 89.45.14.12
casino-super-web.ru – 89.45.14.12
casinosuperwin.ru – 89.45.14.12
casino-super-win.ru – 89.45.14.12
casinovipsuper.ru – 89.45.14.12
casino-vip-super.ru – 89.45.14.12
casino-win-super.ru – 89.45.14.12
cazino-cash-multi.ru – 89.45.14.12
3cazino-party-royal.ru – 89.45.14.12
cazinopartyweb.ru – 89.45.14.12
cazino-party-web.ru – 89.45.14.12
cazinopartywin.ru – 89.45.14.12
cazino-party-win.ru – 89.45.14.12
cazinoplazawin.ru – 89.45.14.12
cazinoplazaworld.ru – 89.45.14.12
cazino-plaza-world.ru – 89.45.14.12
cazinowinplaza.ru – 89.45.14.12
cazino-win-plaza.ru – 89.45.14.12
cazinoworldplaza.ru – 89.45.14.12
cazino-world-plaza.ru – 89.45.14.12
4elitcasinosuper.ru – 89.45.14.12
elit-casino-super.ru – 89.45.14.12
elitsupercasino.ru – 89.45.14.12
elit-super-casino.ru – 89.45.14.12
gamelabonline.ru – 78.46.105.205
gameonlinelab.ru – 78.46.105.205
game-party-royal.ru – 78.46.105.205
gamezlabonline.ru – 89.45.14.12
gamezmultilab.ru – 89.45.14.12
gamez-net-online.ru – 89.45.14.12
gamezonlinenet.ru – 89.45.14.12
gamez-party-royal.ru – 89.45.14.12
gamez-party-web.ru – 89.45.14.12
gamezpartywin.ru – 89.45.14.12
gamez-party-win.ru – 89.45.14.12
gamez-plaza-win.ru – 89.45.14.12
gamezplazaworld.ru – 89.45.14.12
gamez-plaza-world.ru – 89.45.14.12
gamez-vegas-web.ru – 89.45.14.12
gamezweblab.ru – 89.45.14.12
gamezwinplaza.ru – 89.45.14.12
gamez-win-plaza.ru – 89.45.14.12
gamezworldplaza.ru – 89.45.14.12
joker-gamez-web.ru – 89.45.14.12
kingcasinosuper.ru – 89.45.14.12
king-casino-super.ru – 89.45.14.12
kinggagnerr.net – 90.182.175.234
kingsupercasino.ru – 89.45.14.12
king-super-casino.ru – 89.45.14.12
lab-cazino-multi.ru – 89.45.14.12
lab-cazino-online.ru – 89.45.14.12
labgamezonline.ru – 89.45.14.12
lab-gamez-web.ru – 89.45.14.12
labonlinecazino.ru – 89.45.14.12
labonlinegame.ru – 78.46.105.205
labvegascazino.ru – 89.45.14.12
luxcasinosuper.ru – 89.45.14.12
luxnextcasino.ru – 89.45.14.12
lux-next-casino.ru – 89.45.14.12
multicasinosuper.ru – 89.45.14.12
multilabgame.ru – 78.46.105.205
multisupercasino.ru – 89.45.14.12
netcasinosuper.ru – 89.45.14.12
net-casino-super.ru – 89.45.14.12
netpartycazino.ru – 89.45.14.12
netsupercasino.ru – 89.45.14.12
net-super-casino.ru – 89.45.14.12
nextcasinovip.ru – 89.45.14.12
next-casino-vip.ru – 89.45.14.12
next-lux-casino.ru – 89.45.14.12
nextvipcasino.ru – 89.45.14.12
onlinecasinosuper.ru – 90.182.175.234
online-casino-super.ru – 90.182.175.234
online-cazino-lab.ru – 89.45.14.12
onlinegameznet.ru – 89.45.14.12
online-gamez-vip.ru – 89.45.14.12
onlinelabcazino.ru – 89.45.14.12
onlinesupercasino.ru – 90.182.175.234
online-super-casino.ru – 90.182.175.234
partycasinosuper.ru – 90.182.175.234
party-casino-web.ru – 78.46.105.205
partycazinonet.ru – 89.45.14.12
party-cazino-royal.ru – 89.45.14.12
partycazinoweb.ru – 89.45.14.12
partycazinowin.ru – 89.45.14.12
partygamezroyal.ru – 89.45.14.12
party-gamez-royal.ru – 89.45.14.12
partygamezwin.ru – 89.45.14.12
party-gamez-win.ru – 89.45.14.12
partynetcazino.ru – 89.45.14.12
party-royal-cazino.ru – 89.45.14.12
party-super-casino.ru – 89.45.14.12
partywebcasino.ru – 78.46.105.205
partywebcazino.ru – 89.45.14.12
partywincazino.ru – 89.45.14.12
party-win-cazino.ru – 89.45.14.12
play-multi-casino.ru – 89.45.14.12
plazacazinowin.ru – 89.45.14.12
plaza-cazino-win.ru – 89.45.14.12
plazacazinoworld.ru – 89.45.14.12
plaza-cazino-world.ru – 89.45.14.12
plaza-gamez-win.ru – 89.45.14.12
plazagamezworld.ru – 89.45.14.12
plaza-gamez-world.ru – 89.45.14.12
plazawincazino.ru – 89.45.14.12
plaza-win-cazino.ru – 89.45.14.12
plazaworldcazino.ru – 89.45.14.12
plaza-world-cazino.ru – 89.45.14.12
royal-party-cazino.ru – 89.45.14.12
star-casino-super.ru – 90.182.175.234
star-super-casino.ru – 90.182.175.234
super-casino-elit.ru – 89.45.14.12
supercasinoking.ru – 89.45.14.12
super-casino-king.ru – 89.45.14.12
supercasinolab.ru – 89.45.14.12
super-casino-land.ru – 90.182.175.234
supercasinomulti.ru – 89.45.14.12
supercasinonet.ru – 89.45.14.12
super-casino-net.ru – 89.45.14.12
supercasinoonline.ru – 90.182.175.234
super-casino-online.ru – 90.182.175.234
super-casino-star.ru – 90.182.175.234
supercasinovip.ru – 89.45.14.12
super-casino-vip.ru – 89.45.14.12
super-casino-web.ru – 89.45.14.12
super-casino-west.ru – 90.182.175.234
supercasinowin.ru – 89.45.14.12
super-casino-win.ru – 89.45.14.12
super-elit-casino.ru – 89.45.14.12
superkingcasino.ru – 89.45.14.12
super-king-casino.ru – 89.45.14.12
super-land-casino.ru – 90.182.175.234
super-multi-casino.ru – 89.45.14.12
supernetcasino.ru – 89.45.14.12
super-net-casino.ru – 89.45.14.12
superonlinecasino.ru – 90.182.175.234
super-online-casino.ru – 90.182.175.234
superpartycasino.ru – 90.182.175.234
super-party-casino.ru – 89.45.14.12
superstarcasino.ru – 90.182.175.234
super-star-casino.ru – 90.182.175.234
super-vip-casino.ru – 89.45.14.12
super-web-casino.ru – 89.45.14.12
super-west-casino.ru – 90.182.175.234
superwincasino.ru – 89.45.14.12
vegas-game-web.ru – 78.46.105.205
vegas-gamez-multi.ru – 89.45.14.12
vegasgamezweb.ru – 89.45.14.12
vipcasinosuper.ru – 89.45.14.12
vip-casino-super.ru – 89.45.14.12
vipnextcasino.ru – 89.45.14.12
vipsupercasino.ru – 89.45.14.12
vip-super-casino.ru – 89.45.14.12
web-casino-super.ru – 89.45.14.12
web-cazino-royal.ru – 89.45.14.12
webgamezroyal.ru – 89.45.14.12
webpartycazino.ru – 89.45.14.12
web-super-casino.ru – 89.45.14.12
west-super-casino.ru – 90.182.175.234
wincasinosuper.ru – 89.45.14.12
win-casino-super.ru – 89.45.14.12
win-cazino-plaza.ru – 89.45.14.12
win-gamez-plaza.ru – 89.45.14.12
winpartycazino.ru – 89.45.14.12
win-party-cazino.ru – 89.45.14.12
winplazacazino.ru – 89.45.14.12
win-plaza-cazino.ru – 89.45.14.12
winsupercasino.ru – 89.45.14.12
win-super-casino.ru – 89.45.14.12
worldcazinoplaza.ru – 89.45.14.12
world-cazino-plaza.ru – 89.45.14.12
worldgamezplaza.ru – 89.45.14.12
world-gamez-plaza.ru – 89.45.14.12
world-plaza-cazino.ru – 89.45.14.12
Monitoring of the campaign is ongoing.
Related posts:
Don’t Play Poker on an Infected Table – Part Four
Don’t Play Poker on an Infected Table – Part Three
Don’t Play Poker on an Infected Table – Part Two
Don’t Play Poker on an Infected Table
This post has been reproduced from Dancho Danchev’s blog. Follow him on Twitter.
Leave a reply
