Bitcoin Forum
September 16, 2019, 11:17:00 PM *
News: Latest Bitcoin Core release: 0.18.1 [Torrent]
 
   Home   Help Search Login Register More  
Warning: One or more bitcointalk.org users have reported that they believe that the creator of this topic displays some red flags which make them high-risk. (Login to see the detailed trust ratings.) While the bitcointalk.org administration does not verify such claims, you should proceed with extreme caution.
Pages: [1]
  Print  
Author Topic: Malware and Spam emails : (Suspicious sign in prevented)  (Read 1127 times)
escrow.ms
Legendary
*
Offline Offline

Activity: 1260
Merit: 1004

GPG Key-ID: B82BA7E1 | I don't use skype.


View Profile
March 30, 2014, 10:14:23 PM
 #1

I got a mail same as other members as you can see here it looks like a simple phishing mail with title "Suspicious sign in prevented" but it's more than that.
Email is probably being sent via a php mailer from a hacked server (wohnmobileunited.de)


If you move your mouse on button you will see a shortlink, I copied that link and it redirected me to phishing cum landing page that gives warning about outdated firefox and tries to install a xpi file by running it


XPI file is  hosted on dropbox.

Now I tried to download that addon, renamed .xpi to .zip and exported it's content.


Voila.. There's a exe in it, which is a custom bot cum password stealer that downloads more files on your pc automatically.
But how it's getting executed?  Answer is in javascript file.




It connects to a domain and some servers.
zuzuri.x64.me    79.172.242.88

X64.me is a free dns domain https://www.dnsdynamic.org

Virus scan report. (Most antiviruses are unable to detect as it's Crypted.
https://www.virustotal.com/en/file/02293d8b45e69f4dc0d69eb85553c5b6f97c47789689bc03bc0af729f4b25e0d/analysis/1396215000/

You can see full analysis here.
https://malwr.com/analysis/MjZhN2ExYzQ2MzBmNGI5ZDhiNjExNzM4NTQ1MGM1YjA/

Now when you try to find more info about that zazuri.x64.me domain, you will get scan links of other malwares that includes .scr file and a pdf (pdf exploit)

ttps://malwr.com/analysis/MDIyZGFkNGNmMGM4NGFhZmFjMGM1OTdiMTY3YmJkNGM/
http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~AutoIt-AGU/detailed-analysis.aspx

1568675820
Hero Member
*
Offline Offline

Posts: 1568675820

View Profile Personal Message (Offline)

Ignore
1568675820
Reply with quote  #2

1568675820
Report to moderator
1568675820
Hero Member
*
Offline Offline

Posts: 1568675820

View Profile Personal Message (Offline)

Ignore
1568675820
Reply with quote  #2

1568675820
Report to moderator
1568675820
Hero Member
*
Offline Offline

Posts: 1568675820

View Profile Personal Message (Offline)

Ignore
1568675820
Reply with quote  #2

1568675820
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1568675820
Hero Member
*
Offline Offline

Posts: 1568675820

View Profile Personal Message (Offline)

Ignore
1568675820
Reply with quote  #2

1568675820
Report to moderator
E.exchanger
Hero Member
*****
Offline Offline

Activity: 700
Merit: 500


NEED CRYPTO CODER? COIN DEVELOPER? PM US FOR HELP!


View Profile
March 30, 2014, 10:45:54 PM
 #2

Omg so it was more then phishing. No antivirus can detect it ok I understand it but there has to be some way possible to remove it isn't there any??? Plus how to check if its running in my system or not Huh
escrow.ms
Legendary
*
Offline Offline

Activity: 1260
Merit: 1004

GPG Key-ID: B82BA7E1 | I don't use skype.


View Profile
March 30, 2014, 10:56:20 PM
 #3

Omg so it was more then phishing. No antivirus can detect it ok I understand it but there has to be some way possible to remove it isn't there any??? Plus how to check if its running in my system or not Huh
Install any av that detected it successfully on virustotal and if you have installed that xpi addon your pc is probably infected. You can download malware byets startup lite and look for any random startup entry and check running process (http://www.comodo.com/business-security/network-protection/cleaning_essentials.php)
E.exchanger
Hero Member
*****
Offline Offline

Activity: 700
Merit: 500


NEED CRYPTO CODER? COIN DEVELOPER? PM US FOR HELP!


View Profile
March 30, 2014, 11:03:57 PM
 #4

Omg so it was more then phishing. No antivirus can detect it ok I understand it but there has to be some way possible to remove it isn't there any??? Plus how to check if its running in my system or not Huh
Install any av that detected it successfully on virustotal and if you have installed that xpi addon your pc is probably infected. You can download malware byets startup lite and look for any random startup entry and check running process (there is a process checker on comodo.com)
I didn't install that plug in my computer but will make sure to do a check with the process checker. My running avast  atm and have malwarebytes pro but they both showed my system is clean so maybe I should calm down and stop getting so finicky about it.
jodybay
Sr. Member
****
Offline Offline

Activity: 266
Merit: 250

if you want something do something!!!


View Profile WWW
March 31, 2014, 05:27:01 PM
 #5

same thing happened to me last march 21,2014
google and yahoo pop up the same message at the same time

▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
PRIMEDICE
The Premier Bitcoin Gambling Experience - PRIMEDICE 3 COMING 9TH AUGUST @PrimeDice
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
platorin
Sr. Member
****
Offline Offline

Activity: 392
Merit: 250


View Profile
May 31, 2014, 07:03:11 PM
 #6

Never open messages like that one nor download anything that is asked there.
Xelpherpolis
Sr. Member
****
Offline Offline

Activity: 476
Merit: 250



View Profile
May 31, 2014, 07:38:28 PM
 #7

Ahh very clever little beast that is. Thanks for putting the effort into finding this out and posting it Smiley
acs267
Hero Member
*****
Offline Offline

Activity: 672
Merit: 500



View Profile
May 31, 2014, 09:25:03 PM
 #8

Thanks for posting this. Do you have any idea how that got your E-Mail? Hopefully, I didn't get one.
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!