2014-04-28 - FAKE FLASH UPDATER HOSTED ON MICROSOFT ONEDRIVE IP ADDRESSES
NOTICE:
- The zip archives on this page have been updated, and they now use the new password scheme. For the new password, see the "about" page of this website.
ASSOCIATED FILES:
MICROSOFT ONEDIRVE IP ADDRESSES HOSTING THE MALWARE:
- 134.170.104[.]216 - xmdrlq.dm2302.livefilestore[.]com
- 134.170.109[.]224 - xmdrlq.dm2304.livefilestore[.]com
- 134.170.109[.]96 - xmdrlq.dm1.livefilestore[.]com
- 134.170.104[.]160 - xmdrlq.dm2301.livefilestore[.]com
NOTES:
- Lately while searching for exploit traffic, I've noticed more of these fake Flash updater pop-ups, so I'm posting more information about them.
- The malware appears to change on a daily basis--maybe more frequently.
- As I've stated before, these fake Flash updates are part of a campaign noted as early as January 2014 in this article.
- If anyone has more information about this particular campaign, please let me know, and I'll include that info with my next post (I'm sure I'll find more of this stuff).
TODAY'S EXAMPLES
comromised website --> fake Flash updater notice --> Microsoft OneDrive hosting the malware
www.rabig[.]com[.]tr --> ab000302.ferozo[.]com --> xmdrlq.dm2302.livefilestore[.]com
- 00:44:08 UTC - 89.19.30[.]135:80 - www.rabig[.]com[.]tr - GET /
- 00:44:09 UTC - 200.58.112[.]67:80 - ab000302.ferozo[.]com - GET /3Q8YBpvd.php?id=3316631
- 00:44:12 UTC - 200.58.112[.]67:80 - ab000302.ferozo[.]com - GET /3Q8YBpvd.php?html=27
- 00:44:14 UTC - 200.58.112[.]67:80 - ab000302.ferozo[.]com - GET /checker.php
- 00:44:21 UTC - 134.170.104[.]216:443 - xmdrlq.dm2302.livefilestore[.]com
- 00:44:21 UTC - 134.170.104[.]216:443 - xmdrlq.dm2302.livefilestore[.]com
- 00:44:29 UTC - 200.58.112[.]67:80 - ab000302.ferozo[.]com - GET /checker.php
HTTPS link from fake Flash updater notice:
- xmdrlq.dm2302.livefilestore[.]com - GET /y2m6sFuBjRyTFpp_um4knm632P5m2rSKVYNr3QJPSU1nybrLIC210kJ3OTfsMU8Z7fz7RPQRecoWAONXJr_bQJxxEgXYHC-KdY8
BBuUWMMijic/FlashUpdater.exe
comromised website --> fake Flash updater notice --> Microsoft OneDrive hosting the malware
www.comersid[.]ro --> ajmfashions[.]ne --> xmdrlq.dm2304.livefilestore[.]com
- 01:19:45 UTC - 92.114.111[.]13:80 - www.comersid[.]ro - GET /
- 01:19:47 UTC - 50.62.216[.]1:80 - ajmfashions[.]net - GET /wp-admin/XpFcGg6B.php?id=14939481
- 01:19:49 UTC - 50.62.216[.]1:80 - ajmfashions[.]net - GET /wp-admin/XpFcGg6B.php?html=27
- 01:20:04 UTC - 50.62.216[.]1:80 - ajmfashions[.]net - GET /wp-admin/checker.php
- 01:20:18 UTC - 134.170.109[.]224:443 - xmdrlq.dm2304.livefilestore[.]com
- 01:20:18 UTC - 134.170.109[.]224:443 - xmdrlq.dm2304.livefilestore[.]com
- 01:20:19 UTC - 50.62.216[.]1:80 - ajmfashions[.]net - GET /wp-admin/checker.php
HTTPS link from fake Flash updater notice:
- xmdrlq.dm2304.livefilestore[.]com - GET /y2mdZiuy9LipkTt3wso9X9969a7Tug98iEG7z_LdLfbnrNYQSk2M6YbzzwUex_RnwO0iqs9-5VYJRnAFmb0X7NDBoe9bvQDA7LTI7q
OtQiKmfA/FlashUpdater.exe
comromised website --> fake Flash updater notice --> Microsoft OneDrive hosting the malware
www.landestrachtenverband[.]at --> www.gala[.]mx --> xmdrlq.dm1.livefilestore[.]com
- 01:57:33 UTC - 83.169.32[.]241:80 - www.landestrachtenverband[.]at - GET /
- 01:57:33 UTC - 83.169.32[.]241:80 - www.landestrachtenverband[.]at - GET /js/prototype.js
- 01:57:33 UTC - 83.169.32[.]241:80 - www.landestrachtenverband[.]at - GET /js/scriptaculous.js?load=effects
- 01:57:33 UTC - 83.169.32[.]241:80 - www.landestrachtenverband[.]at - GET /js/lightbox.js
- 01:57:34 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /wR6xBPtZ.php?id=11227052
- 01:57:35 UTC - 83.169.32[.]241:80 - www.landestrachtenverband[.]at - GET /js/effects.js
- 01:57:35 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /wR6xBPtZ.php?id=11227049
- 01:57:36 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /wR6xBPtZ.php?id=11227053
- 01:57:36 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /wR6xBPtZ.php?id=11227051
- 01:57:37 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /wR6xBPtZ.php?html=27
- 01:57:38 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /checker.php
- 01:57:41 UTC - 134.170.109[.]96:443 - xmdrlq.dm1.livefilestore[.]com
- 01:57:41 UTC - 134.170.109[.]96:443 - xmdrlq.dm1.livefilestore[.]com
- 01:57:53 UTC - 171.25.168[.]120:80 - www.gala[.]mx - GET /checker.php
HTTPS link from fake Flash updater notice:
- xmdrlq.dm1.livefilestore[.]com - GET /y2mZ5R3NCpDyBRgrCmaP9R3xACI6G9fhx8Fu4_JSlQkTvEgh2XVsJe3zA2nK6uSvmV8IjZRhCQM9EYw4XlNKpS3sC2r5SLsXEp6cUl6x
ltf6ZQ/FlashUpdater.exe
comromised website --> fake Flash updater notice --> Microsoft OneDrive hosting the malware
www.vendre-voiture-export[.]be --> www.spid[.]it --> xmdrlq.dm2301.livefilestore[.]com
- 02:15:49 UTC - 109.237.140[.]12:80 - www.vendre-voiture-export[.]be - GET /
- 02:15:52 UTC - 109.237.140[.]12:80 - www.vendre-voiture-export[.]be - GET /vendor/[various names].js
- 02:15:53 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065716
- 02:15:53 UTC - 109.237.140[.]12:80 - www.vendre-voiture-export[.]be - GET /vendor/[various names].js
- 02:15:54 UTC - 109.237.140[.]12:80 - www.vendre-voiture-export[.]be - GET /js/[various names].js
- 02:15:54 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065710
- 02:15:54 UTC - 109.237.140[.]12:80 - www.vendre-voiture-export[.]be - GET /js/[various names].js
- 02:15:55 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065709
- 02:15:55 UTC - 109.237.140[.]12:80 - www.vendre-voiture-export[.]be - GET /js/[various names].js
- 02:15:55 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065708
- 02:15:56 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065718
- 02:15:57 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065734
- 02:15:57 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065730
- 02:15:58 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065732
- 02:15:58 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065726
- 02:15:59 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065719
- 02:16:00 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065715
- 02:16:01 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065704
- 02:16:02 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065707
- 02:16:02 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065694
- 02:16:03 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065696
- 02:16:04 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065693
- 02:16:04 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065698
- 02:16:05 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065700
- 02:16:05 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065701
- 02:16:06 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065702
- 02:16:07 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065699
- 02:16:07 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065697
- 02:16:08 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?id=15065703
- 02:16:10 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/Brfc9DkH.php?html=27
- 02:16:19 UTC - 134.170.104[.]160:443 - xmdrlq.dm2301.livefilestore[.]com
- 02:16:19 UTC - 134.170.104[.]160:443 - xmdrlq.dm2301.livefilestore[.]com
- 02:16:11 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/checker.php
- 02:16:26 UTC - 195.149.221[.]120:80 - www.spid[.]it - GET /images/checker.php
HTTPS link from fake Flash updater notice:
- xmdrlq.dm2301.livefilestore[.]com - GET /y2mltWLVrNb53-3iLFl38VhDmx4wauHN4ChHWzSmk3-63RsXLihJQGVM4LiEa-jFyYv4j9hJc86hiTvLjFyNV0QHDUx19MC9g7S23fQ
D6QEKHU/FlashUpdater.exe
PRELIMINARY MALWARE ANALYSIS
File name: FlashUpdater.exe
File size: 162,816 bytes
MD5 hash: 8cf348c51fa48116df89009b1886f9eb
Detection ratio: 3 / 51
First submission: 2014-04-28 00:52:27 UTC
VirusTotal link: https://www.virustotal.com/en/file/d3adf9d07df2813839698c8a777394fe5262c9c575a2a7e82d2f15c132e221e4/analysis/
Click here to return to the main page.