The Latest in IT Security

We haven’t seen this “pizza spam” (or spam pizza?) for a while. Rest assured, it leads to malware on uiwewsecondary.ru:

Date:      Mon, 16 Apr 2012 08:40:47 -0500
From:      [email protected]
Subject:      Order confirmation

You’ve just ordered pizza from our site

Pizza Triple Meat Italiano with extras:
– Ham
– Ham
– Bacon Pieces
– Pineapple
– Onions
– Easy On Cheese
– No Sauce
Pizza Chicken Supreme with extras:
– Ham
– Jalapenos
– Black Olives
– Extra Cheese
– Extra Sauce
Pizza Hawaiian Luau with extras:
– Pepperoni
– Italian Sausage
– Beef
– Pineapple
– Easy On Cheese
– No Sauce
Pizza Chicken Supreme with extras:
– Italian Sausage
– Bacon Pieces
– Italian Sausage
– Jalapenos
– Diced Tomatoes
– Green Peppers
– Easy On Cheese
– Extra Sauce
Drinks
– Fanta x 4
– Limonade x 6
– Schweppes x 6
– Sprite x 2
Total Charge:    89.70$

If you haven’t made the order and it’s a fraud case, please follow the link and cancel the order.
CANCEL ORDER NOW!

If you don’t do that shortly, the order will be confirmed and delivered to you.

With Best Regards
Pizza by AMERIGO

The malicious payload is at uiwewsecondary.ru:8080/internet/fpkrerflfvd.php (report here) hosted on some familiar IP addresses (a subset of the ones found here):

41.168.5.140 (Neotel, South Africa)
62.85.27.129 (Microlink, Latvia)
83.170.91.152 (UK2.NET, UK)
85.214.204.32 (Strato AG, Germany)
88.190.22.72 (Free SAS / ProXad, France)
89.31.145.154 (Nexen, France)
112.78.124.115 (Sakura Internet, Japan)
210.56.23.100 (Commission For Science And Technology, Pakistan)
211.44.250.173 (SK Broadband, Korea)
219.94.194.138 (Sakura Internet, Japan)

Plain list for copy-and-pasting:
41.168.5.140
62.85.27.129
83.170.91.152
85.214.204.32
88.190.22.72
89.31.145.154
112.78.124.115
210.56.23.100
211.44.250.173
219.94.194.138