Here’s yet more spam with a malicious payload:
Date: Fri, 9 Feb 2012 09:46:12 +0300
From: [email protected]
Subject: Re: FW: End of Aug. Statement
Attachments: Invoice_8W20576.htmHi,
as reqeusted I give you inovices issued to you per february (Internet Explorer format).
Regards
TAINA Bland
“Invoice_8W20576.htm” is an HTML attachment containing some obfuscated Javascript that connects to kamarovoskorlovo.ru:8080/images/aublbzdni.php which then attempts to download some malicious components from that domain and also serebrokakzoloto.ru:8080/images/jw.php?i=8 . A Wepawet report can be found here and here.
kamarovoskorlovo.ru and serebrokakzoloto.ru are multihomed on several servers (a raw list can be found at the end of the post). You’ll notice that Slicehost figures prominently.
46.105.97.103 (OVH Systems, France)
46.137.251.11 (Amazon Data Services, Ireland)
50.31.1.105 (Steadfast Networks, US)
50.57.77.119 (Slicehost, US)
50.57.118.247 (Slicehost, US)
50.76.184.100 (Comcast Business Communications, US)
69.60.117.183 (Colopronto, US)
72.22.83.93 (iPower, US)
78.83.233.242 (MVN Systems Ltd, Bulgaria)
87.120.41.155 (Neterra Ltd, Bulgaria)
88.191.97.108 (Free SAS / ProXad, France)
93.189.88.198 (SiliconTower, Spain)
98.158.180.244 (Hosting Services Inc, US)
125.214.74.8 (Web24 Pty Ltd, Australia)
173.201.187.225 (GoDaddy, US)
173.203.51.174 (Slicehost, US)
173.255.229.33 (Linode, US)
174.122.121.154 (ThePlanet, US)
184.106.151.78 (Slicehost, US)
184.106.200.65 (Slicehost, US)
184.106.237.210 (Slicehost, US)
190.106.129.43 (G2KHosting, Argentina)
200.169.13.84 (Century Telecom Ltda, Brazil)
204.12.252.82 (Jaidee Daijai, US)
209.114.47.158 (Slicehost, US)
Blocking access to those IPs will prevent any other malicious sites on the same servers from causing problems. Underneath is a raw list that you can copy and pase.
46.105.97.103
46.137.251.11
50.31.1.105
50.57.77.119
50.57.118.247
50.76.184.100
69.60.117.183
72.22.83.93
78.83.233.242
87.120.41.155
88.191.97.108
93.189.88.198
98.158.180.244
125.214.74.8
173.201.187.225
173.203.51.174
173.255.229.33
174.122.121.154
184.106.151.78
184.106.200.65
184.106.237.210
190.106.129.43
200.169.13.84
204.12.252.82
209.114.47.158
Leave a reply
