This summary is not available. Please
click here to view the post.
Wednesday, 22 September 2010
Thursday, 16 September 2010
Today some anti-spam friends were chatting about a new rash of "attachment spam" and wondering what attachments "belonged together" and what they did. Sounded like the perfect question for the UAB Spam Data Mine, so I thought I'd take a peek.
The first thing I did was to look for email subjects that had non-graphics-file attachments where we had received at least 250 copies of the email message today.
It wasn't actually that long of a list:
Then I looked to see which of the email attachments were actually the same attachment. That's actually pretty easy for us, since we store the attachments by name, with an MD5 value prepended to the name, such as:
34eaf3d214f1ef58b56d58de5e5e25b6_Invoice Payment Confirmation.html
For the Attachment with an MD5 value of:
136e771425e841bda5fabec0c81df974
We saw all of the following subjects:
'America's Got Talent' Judges Were They Shocked By.html
Application to rent.html
B St. Package 1.html
Church of Body Modification.html
copy of the letter.html
Daniel Covington.html
Hospital violence on the rise, agency warns.html
Invoice-Stockton.html
Jackie Evancho and Sarah Brightman.html
jun wang letter.html
NFL Picks Week 2.html
September 2010.html
So, it would be pretty safe to assume those were all "the same."
That is a block of javascript that starts by doing a document.write with the following block of ASCII letters "unescaped":
%3C%53%43%52%49%50%54%20%4C%41%4E%47%55%41%47%45%3D%22%4A%61%76%61%53%63%72%69%70%74%22%3E%3C%21%2D%2D%0D%0A%68%70%5F%6F%6B%3D%74%72%75%65%3B%66%75%6E%63%74%69%6F%6E%20%68%70%5F%64%30%31%28%73%29%7B%69%66%28%21%68%70%5F%6F%6B%29%72%65%74%75%72%6E%3B%76%61%72%20%6F%3D%22%22%2C%61%72%3D%6E%65%77%20%41%72%72%61%79%28%29%2C%6F%73%3D%22%22%2C%69%63%3D%30%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%7B%63%3D%73%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%3B%69%66%28%63%3C%31%32%38%29%63%3D%63%5E%32%3B%6F%73%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%63%29%3B%69%66%28%6F%73%2E%6C%65%6E%67%74%68%3E%38%30%29%7B%61%72%5B%69%63%2B%2B%5D%3D%6F%73%3B%6F%73%3D%22%22%7D%7D%6F%3D%61%72%2E%6A%6F%69%6E%28%22%22%29%2B%6F%73%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%6F%29%7D%2F%2F%2D%2D%3E%3C%2F%53%43%52%49%50%54%3E
Which is some Javascript code that looks like this:
hp_ok=true;function hp_d01(s){if(!hp_ok)return;var o="",ar=new Array(),os="",ic=0;for(i=0;i gt s.length;i++){c=s.charCodeAt(i);if(c lt 128)c=c^2;os+=String.fromCharCode(c);
and some more stuff I won't list here . . .
All of that mess ends up doing this:
First, you go to this webpage:
dark-pangolin.com/x.html on the IP address 82.165.215.9
That page told my browser:
PLEASE WAITING.... 4 SECONDS
Then did a "Meta Refresh" which sent me to:
http://scaner-enter.cz.cc/scanner15/?afid=24 on 91.197.130.109.
while at the same time loading an IFRAME which took me here:
formyjobduty.com/3/index.php on IP address 91.213.174.221
That site dropped a 15kb file on my machine.
The IP 91.197.130.109 also hosts the sites:
scaner-end.cz.cc
scaner-e.cz.cc
scaner-eee.cz.cc
scaner-demon.cz.cc
scaner-do.cz.cc
scaner-cio.cz.cc
scaner-dro.cz.cc
scaner-ear.cz.cc
hornvimawar.cz.cc
scaner-enter.cz.cc
scaner-dir.cz.cc
scaner-clouds.cz.cc
ilmemenlens.cz.cc
scaner-eclips.cz.cc
scaner-coast.cz.cc
hycormofy.cz.cc
xxxvideo-dpiy.cz.cc
".cz.cc" is a free domain provider that the criminals are abusing like crazy right now.
Other domain names located on 91.213.174.221 include:
mypetitebusiness.org
mylittlejobsite.com
workgroupsite.com
keybussines.com
formyjobduty.com
littlebiz.us
All of those except "keybussines.com" use Yahoo nameservers.
For MD5:
34eaf3d214f1ef58b56d58de5e5e25b6
We saw all of the following subjects:
Corrections.html
Evite invitation.html
invoice.html
Invoice Payment Confirmation.html
proposal.html
Shipping Notification.html
This group's attachment is also a BASE64 encoded html file.
If a user simply clicks the attachment, it SEEMS to take us to a Canadian Pharmacy website of the GlavMed variety:
http://personago.ru/
But unfortunately, a deeper analysis of the code shows it takes the long way around. First the site sends us to:
clicksmile.org/x92s/uc12vx04/xdtldil.php?id=350 on IP address 91.188.59.220 in Latvia
Then it sends us on to "personago.ru" on 113.107.104.23 in China's Guangdong province.
Even though there are many different MD5s of the ".zip" file, quite a few of them are so similar in function, they are clearly "the same" despite different MD5s.
The first of the ".zip" emails has the subject: "Bar/Bri"
The body of the email reads:
Attachment:
Summaries.RBK.zip used the MD5:
4b3e7c54e263363b7dcec53bd9e1c135
25 of 43 detection at VirusTotal - mostly called "FraudLoad" or "ZBot".
When we launched this malware, it connected to several servers in rapid order:
- www.searchannoying.com
- fastlouprim.com
- searchanxious.com
- searchbent.org
- analyticsdead.com
and downloaded a 471kb file from fastlouprim.com. That file was my FakeAV present. It stored in my current user's "Local Settings\Temp" directory as "dfrgsnapnt.exe"
VirusTotal FakeAV Report (20 of 43 detects)
A backup version was also running as "wscvc32.exe" from the same location.
The second ".zip" email had the Subject "details" and contained this email body:
Attachment:
Shadow Ranch Marketing Package.zip used the MD5:
7f51b49e92a1640250746ad3a4f11c36
24 of 43 detects at VirusTotal, mostly "FraudLoad" and ZBot.
The behavior of this malware was identical to the first - using the same domain names, fetching the same FakeAV from the same server, and installing it using the same name.
The third ".zip" email had the Subject: Shipping Notification
The body of the email read:
Attachment:
Shipping Notification.zip used the MD5s:
1ee31a4fae6e9bbceb47f0bf3ea79c6f
218adbd9f6abb8f0b7fd73765e62d005
Summaries.RBK.zip behaved just like the first two entries on this list, in that it began by visiting www.searchannoying.com, fastlouprim.com, searchbent.com, analitycsdead.com, finderwid.org, and downloaded the same Fake AV from the same location.
The first has 24 of 43 detects at VirusTotal, mostly Fraudload, FakeAV, and ZBot.
The second has 26 of 43 detects at VirusTotal, mostly ZBot.
The fourth ".zip" email had the subject: Corrections.zip
The body of the email was very simple, with a Random Name in the body that matched the "From" name:
Corrections.zip used the MD5s:
aa32b48a854b62b5a71c4a4b6f53b3a7
b268064ed27f3d3e07e410f694499b04
The first has 21 of 43 detects at VirusTotal called FraudLoad, Alureon, FakeAV, or ZBot.
The second has 26 of 43 detects at VirusTotal called ZBot or Outbreak.
"Corrections" also behaved exactly like those above. Dropping a FakeAV after contacting fastlouprim.com and the others.
The sixth ".zip" email uses the subject: Facebook password has been changed
The body of the email contains:
Attachment:
New_password.zip used the MD5:
843d5efc64e2338206f3736a2a876c45
This one is ESPECIALLY TRICKY, because the filename is hidden from the user! The email contains this code:
Content-Type: application/zip;
name="New_password.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="denno.jpg"
Which makes the attachment, which is actually called "New_password.zip" show up as a ".jpg" file, like this:
22 of 42 detects at VirusTotal mostly called BredoLab or Sasfis.
Launching "New_password" generated lots of quick webtraffic, starting with connections to "moneymader.ru" on IP 109.196.134.44, from which I did this get:
/group/mixer/bb.php?v=200&id=912648491&b=16&sentab&tm=100
I have no idea what that means, but it feels familiar -- for instance, compare with the URL Dancho talked about back in May with some itunes spam.
It also fetched from the unlikely named machine:
0006385484.dc5ccd77.01.94c71046BC3647f49cf44b7e9b4b3544.n.empty.725.empty.5_1._t_i.ffffffff.svchost_exe.165.rc2.a4h9uploading.com
which has the IP address 95.211.131.67
Then we downloaded the file "/milk/dogpod.exe" from 91.204.48.46
I also did a crazy long fetch that began with "/get2.php?c=ALOVLEKD" from the host 061707da092d.bourgum.com
When I did fetches like that, I downloaded "7.tmp" and "8.tmp" which VirusTotal calls bad:
7.tmp VirusTotal report showed it had not been reported before. It called it mostly "Kazy" or "Oficla" and gave a 17 of 43 report.
18 of 43 detection for 8.tmp
It also fetched from "y6pb.huntfeed.com" before loading some BBC News.
The last ".zip" email has the subject line You've got a fax
The body has a nice graphic
and reads "The Fax message is attached to this email!"
The attachment has random numbers in the name, such as "eFAX07391DOC.zip":
eFAX(randomnumbers)DOC.zip used the MD5:
ce8a5f487daaf7a37aa6d2526b2b57d7
19 of 39 detects at VirusTotal mostly called ZBot, Oficla, or Sasfis.
When we launched this file, which was 22kb in size, it connected to "moneymader.ru" just like the "Facebook New Password" one above. I noticed when I launched this time that I sent back a 15 ?minute? delay statement to the server. I'll wait to see what happens.
The first thing I did was to look for email subjects that had non-graphics-file attachments where we had received at least 250 copies of the email message today.
It wasn't actually that long of a list:
| Apartment for rent | Application to rent.html |
| B street financial information - part 1 | B St.Package 1.html |
| Bar/Bri | Summaries.RBK.zip |
| Church of Body Modification | Church of Body Modification.html |
| Cops kill active shooter at Johns Hopkins Hospital | Hospital violence on the rise, agency warns.html |
| Corrections.html | Corrections.html |
| Corrections.zip | Corrections.zip |
| Daniel Covington die | Daniel Covington.html |
| details | Shadow Ranch Marketing Package.zip |
| Employment letter for visa application | jun wang letter.html |
| Evite invitation from (Random Name) | Evite invitation.html |
| Evite invitation from (Random Name) | Evite invitation.zip |
| Facebook password has been changed | New_password.zip |
| find a copy of the letter | copy of the letter.html |
| FW:September financials and newsletter | September 2010.html |
| Invoice for Floor Replacement | Invoice-Stockton.html |
| Invoice Payment Confirmation | Invoice Payment Confirmation.html |
| Jackie Evancho and Sarah Brightman | Jackie Evancho and Sarah Brightman.html |
| League | proposal.html |
| Marketing Package.html | Marketing Package.html |
| NFL Picks Week 2 | NFL Picks Week 2.html |
| Order confirmation for order #(Random number) | invoice.html |
| Shipping Notification | Shipping Notification.html |
| You've got a fax | eFAX(RandomNumber)DOC.zip |
Then I looked to see which of the email attachments were actually the same attachment. That's actually pretty easy for us, since we store the attachments by name, with an MD5 value prepended to the name, such as:
34eaf3d214f1ef58b56d58de5e5e25b6_Invoice Payment Confirmation.html
Group One: MD5 = 136e771425e841bda5fabec0c81df974 - dark-pangolin.com
For the Attachment with an MD5 value of:
136e771425e841bda5fabec0c81df974
We saw all of the following subjects:
'America's Got Talent' Judges Were They Shocked By.html
Application to rent.html
B St. Package 1.html
Church of Body Modification.html
copy of the letter.html
Daniel Covington.html
Hospital violence on the rise, agency warns.html
Invoice-Stockton.html
Jackie Evancho and Sarah Brightman.html
jun wang letter.html
NFL Picks Week 2.html
September 2010.html
So, it would be pretty safe to assume those were all "the same."
That is a block of javascript that starts by doing a document.write with the following block of ASCII letters "unescaped":
%3C%53%43%52%49%50%54%20%4C%41%4E%47%55%41%47%45%3D%22%4A%61%76%61%53%63%72%69%70%74%22%3E%3C%21%2D%2D%0D%0A%68%70%5F%6F%6B%3D%74%72%75%65%3B%66%75%6E%63%74%69%6F%6E%20%68%70%5F%64%30%31%28%73%29%7B%69%66%28%21%68%70%5F%6F%6B%29%72%65%74%75%72%6E%3B%76%61%72%20%6F%3D%22%22%2C%61%72%3D%6E%65%77%20%41%72%72%61%79%28%29%2C%6F%73%3D%22%22%2C%69%63%3D%30%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%7B%63%3D%73%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%3B%69%66%28%63%3C%31%32%38%29%63%3D%63%5E%32%3B%6F%73%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%63%29%3B%69%66%28%6F%73%2E%6C%65%6E%67%74%68%3E%38%30%29%7B%61%72%5B%69%63%2B%2B%5D%3D%6F%73%3B%6F%73%3D%22%22%7D%7D%6F%3D%61%72%2E%6A%6F%69%6E%28%22%22%29%2B%6F%73%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%6F%29%7D%2F%2F%2D%2D%3E%3C%2F%53%43%52%49%50%54%3E
Which is some Javascript code that looks like this:
hp_ok=true;function hp_d01(s){if(!hp_ok)return;var o="",ar=new Array(),os="",ic=0;for(i=0;i gt s.length;i++){c=s.charCodeAt(i);if(c lt 128)c=c^2;os+=String.fromCharCode(c);
and some more stuff I won't list here . . .
All of that mess ends up doing this:
First, you go to this webpage:
dark-pangolin.com/x.html on the IP address 82.165.215.9
That page told my browser:
PLEASE WAITING.... 4 SECONDS
Then did a "Meta Refresh" which sent me to:
http://scaner-enter.cz.cc/scanner15/?afid=24 on 91.197.130.109.
while at the same time loading an IFRAME which took me here:
formyjobduty.com/3/index.php on IP address 91.213.174.221
That site dropped a 15kb file on my machine.
The IP 91.197.130.109 also hosts the sites:
scaner-end.cz.cc
scaner-e.cz.cc
scaner-eee.cz.cc
scaner-demon.cz.cc
scaner-do.cz.cc
scaner-cio.cz.cc
scaner-dro.cz.cc
scaner-ear.cz.cc
hornvimawar.cz.cc
scaner-enter.cz.cc
scaner-dir.cz.cc
scaner-clouds.cz.cc
ilmemenlens.cz.cc
scaner-eclips.cz.cc
scaner-coast.cz.cc
hycormofy.cz.cc
xxxvideo-dpiy.cz.cc
".cz.cc" is a free domain provider that the criminals are abusing like crazy right now.
Other domain names located on 91.213.174.221 include:
mypetitebusiness.org
mylittlejobsite.com
workgroupsite.com
keybussines.com
formyjobduty.com
littlebiz.us
All of those except "keybussines.com" use Yahoo nameservers.
Group Two: MD5 = 34eaf3d214f1ef58b56d58de5e5e25b6 - personago.ru
For MD5:
34eaf3d214f1ef58b56d58de5e5e25b6
We saw all of the following subjects:
Corrections.html
Evite invitation.html
invoice.html
Invoice Payment Confirmation.html
proposal.html
Shipping Notification.html
This group's attachment is also a BASE64 encoded html file.
If a user simply clicks the attachment, it SEEMS to take us to a Canadian Pharmacy website of the GlavMed variety:
http://personago.ru/
But unfortunately, a deeper analysis of the code shows it takes the long way around. First the site sends us to:
clicksmile.org/x92s/uc12vx04/xdtldil.php?id=350 on IP address 91.188.59.220 in Latvia
Then it sends us on to "personago.ru" on 113.107.104.23 in China's Guangdong province.
The ZIP Files: Group One - fastlouprim.com
Even though there are many different MD5s of the ".zip" file, quite a few of them are so similar in function, they are clearly "the same" despite different MD5s.
The first of the ".zip" emails has the subject: "Bar/Bri"
The body of the email reads:
Hello,
Thank you for ordering from Capcom Entertainment, Inc. on September 15, 2010. The following email is a summary of your order. Please use this as your proof of purchase. If you paid by credit card, please look for attached invoice.
Confidential & Privileged
Unless otherwise indicated or obvious from its nature, the information contained in this communication is attorney-client privileged and confidential information/work product. This communication is intended for the use of the individual or entity named above. If the reader of this communication is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error or are not sure whether it is privileged, please immediately notify us by return e-mail and destroy any copies--electronic, paper or otherwise--which you may have of this communication.
Attachment:
Summaries.RBK.zip used the MD5:
4b3e7c54e263363b7dcec53bd9e1c135
25 of 43 detection at VirusTotal - mostly called "FraudLoad" or "ZBot".
When we launched this malware, it connected to several servers in rapid order:
- www.searchannoying.com
- fastlouprim.com
- searchanxious.com
- searchbent.org
- analyticsdead.com
and downloaded a 471kb file from fastlouprim.com. That file was my FakeAV present. It stored in my current user's "Local Settings\Temp" directory as "dfrgsnapnt.exe"
VirusTotal FakeAV Report (20 of 43 detects)
A backup version was also running as "wscvc32.exe" from the same location.
The second ".zip" email had the Subject "details" and contained this email body:
Hello,
As with all bank owned assets there is a strong desire to sell. The Lender is anticipating a sale before year end and they have encouraged us to bring them qualified offers to purchase.
I will contact you shortly to discuss in detail.
Regards,
RB
Attachment:
Shadow Ranch Marketing Package.zip used the MD5:
7f51b49e92a1640250746ad3a4f11c36
24 of 43 detects at VirusTotal, mostly "FraudLoad" and ZBot.
The behavior of this malware was identical to the first - using the same domain names, fetching the same FakeAV from the same server, and installing it using the same name.
The third ".zip" email had the Subject: Shipping Notification
The body of the email read:
Shipping Notification Thank you for shopping with us. We look forward to serving you again.
The following is your receipt. Please retain a copy for your records.
Qty Item no Description Price S&H Tax Return
Code
1 FC864-2038B Msg Drma7303 White 650.99 6.95 3.37 ____
Merchandise total 650.99
Shipping and handling 6.95
Tax on mdse 6.75% 3.37
Invoice total 706.31
Welcome to the convenience of shopping JCPenney Catalog
Attachment:
Shipping Notification.zip used the MD5s:
1ee31a4fae6e9bbceb47f0bf3ea79c6f
218adbd9f6abb8f0b7fd73765e62d005
Summaries.RBK.zip behaved just like the first two entries on this list, in that it began by visiting www.searchannoying.com, fastlouprim.com, searchbent.com, analitycsdead.com, finderwid.org, and downloaded the same Fake AV from the same location.
The first has 24 of 43 detects at VirusTotal, mostly Fraudload, FakeAV, and ZBot.
The second has 26 of 43 detects at VirusTotal, mostly ZBot.
The fourth ".zip" email had the subject: Corrections.zip
The body of the email was very simple, with a Random Name in the body that matched the "From" name:
============================================================ Corrections.zip
============================================================ Jed Keller
Corrections.zip used the MD5s:
aa32b48a854b62b5a71c4a4b6f53b3a7
b268064ed27f3d3e07e410f694499b04
The first has 21 of 43 detects at VirusTotal called FraudLoad, Alureon, FakeAV, or ZBot.
The second has 26 of 43 detects at VirusTotal called ZBot or Outbreak.
"Corrections" also behaved exactly like those above. Dropping a FakeAV after contacting fastlouprim.com and the others.
The ZIP Files: Group 2 = MoneyMader.ru
The sixth ".zip" email uses the subject: Facebook password has been changed
The body of the email contains:
Dear user of facebook.
Because of the measures taken to provide safety to our clients, your password has been changed.
Important Message!
You can find your new password in attached document.
Thank you.
Facebook Team.
Attachment:
New_password.zip used the MD5:
843d5efc64e2338206f3736a2a876c45
This one is ESPECIALLY TRICKY, because the filename is hidden from the user! The email contains this code:
Content-Type: application/zip;
name="New_password.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="denno.jpg"
Which makes the attachment, which is actually called "New_password.zip" show up as a ".jpg" file, like this:
22 of 42 detects at VirusTotal mostly called BredoLab or Sasfis.
Launching "New_password" generated lots of quick webtraffic, starting with connections to "moneymader.ru" on IP 109.196.134.44, from which I did this get:
/group/mixer/bb.php?v=200&id=912648491&b=16&sentab&tm=100
I have no idea what that means, but it feels familiar -- for instance, compare with the URL Dancho talked about back in May with some itunes spam.
It also fetched from the unlikely named machine:
0006385484.dc5ccd77.01.94c71046BC3647f49cf44b7e9b4b3544.n.empty.725.empty.5_1._t_i.ffffffff.svchost_exe.165.rc2.a4h9uploading.com
which has the IP address 95.211.131.67
Then we downloaded the file "/milk/dogpod.exe" from 91.204.48.46
I also did a crazy long fetch that began with "/get2.php?c=ALOVLEKD" from the host 061707da092d.bourgum.com
When I did fetches like that, I downloaded "7.tmp" and "8.tmp" which VirusTotal calls bad:
7.tmp VirusTotal report showed it had not been reported before. It called it mostly "Kazy" or "Oficla" and gave a 17 of 43 report.
18 of 43 detection for 8.tmp
It also fetched from "y6pb.huntfeed.com" before loading some BBC News.
The last ".zip" email has the subject line You've got a fax
The body has a nice graphic
and reads "The Fax message is attached to this email!"The attachment has random numbers in the name, such as "eFAX07391DOC.zip":
eFAX(randomnumbers)DOC.zip used the MD5:
ce8a5f487daaf7a37aa6d2526b2b57d7
19 of 39 detects at VirusTotal mostly called ZBot, Oficla, or Sasfis.
When we launched this file, which was 22kb in size, it connected to "moneymader.ru" just like the "Facebook New Password" one above. I noticed when I launched this time that I sent back a 15 ?minute? delay statement to the server. I'll wait to see what happens.
Tuesday, 14 September 2010
Hype
On September 9th, my blog post on the "Here You Have" worm mentioned that the spread mechanisms of the worm were narrowly focused on a few targets that it hit very hard. Because of this, I've been quite surprised to see claims such as this USA Today article, which claims:
Viral messages carrying an innocuous-looking "Here you have" or "Just for you" subject line at one point Thursday accounted for an astounding 14.2% of spam messages moving across the Internet, says Nilesh Bhandari, Cisco product manager.
and then goes on to do the math for us. The article says there are 300 billion emails per day, so "Here You Have" must have sent 42 billion emails. They then show a chart, for which they provide no source attribution, that demonstrates that there was only one thirty minute period where whoever their source for the chart (presumably Cisco?) claimed the spam had reached 14.2%.
If we assume briefly that there really are 300 billion emails per day, a back of the envelope calculation of this chart would indicate that there were actually closer to 8 billion, rather than 42 billion, emails sent by "Here You Have". (You can clearly see by the USA Today's own chart that in most time periods for the day the percentage was closer to "0%" than to "14%"). 14.2% occurred in only one 30 minute sampling, which, if we assume an equal distribution of the 300 billion across the day, would mean 887 million emails in that thirty minute window.
BUT WAIT! Is it accurate to project the sampling from Cisco's Ironport on "the global spam" picture? Absolutely not! Take for a moment my personal anecdotal evidence. I stand by my earlier statement that the UAB Spam Data Mine on September 9th received 17 copies of the "Here You Have" emails, 13 of which came from senders in a single large financial institution. Our calculation of 0.00002% is perhaps closer to the average "global spam" recipients reality.
In my personal spam collection, including many "live" personal email addresses, I received 10,134 spam email messages on September 9th, of which ZERO were from the "Here You Have" worm. (And yes, I use NO FORM of spam filtering on those email addresses.) I also received zero copies in my university email accounts.
Our reality, and yours, unless your primary email account is in a very large corporation running Outlook, is probably closer to what was described by Microsoft. (Thanks to Robert McMillan of IDG News for pointing this out in his article Here You Have Worm Caused Brief Havoc.)
In this Technet Blog post: "Update on the Here You Have Worm: Visal-B" the Microsoft lab says that in normal spam monitoring, 90% of their reports come from "consumer" email users (protected and reported through Microsoft Security Essentials), while very few reports come from their "corporate" email users (protected and reported through Forefront Client Security).
Microsoft bloggers Jimmy Kuo & Holly Stewart go on to say that while they have sensors deployed worldwide, 98% of their reports for this worm came from US-based reporters. Cisco's 2010 MidYear Security Report (36 page PDF) says that 8.98% of global spam originates in the United States.
When Cisco Ironport reports their numbers, we have to remember that their appliance is overwhelmingly present in corporate email accounts. I know the Ironport guys, believe they have a great product, and believe they reported accurately what they saw on the corporate networks, but also believe that a few media sources have misinterpreted these numbers to turn Here You Have into the Global Armageddon of Spam, which it clearly was not. Except for some US-based corporate mail servers.
But was that the whole point? In order to learn more we need to identify some "patient zero" spam recipients. Who was THE FIRST PERSON at ABC, NASA, Google, JP Morgan Chase, etc, to receive the spam. When we learn more about who is behind the attack, it looks like targeting "big corporations" may have been the whole point of the worm!
Electronic Jihad
The more interesting angle to me is the revelations from Joe Stewart, the International Grandmaster of Malware Analysis at SecureWorks in his blog post Here You Have Worm and e-Jihad Connection. I asked Heather McCalley, the Criminal Intelligence Supervisor in the UAB Computer Forensics Research Laboratory to summarize the details for us:
Joe Stewart had previously identified that the malware contained a string "iraq_resistance" and that a previous version of the same malware use an email address "iraq_resistance@yahoo.com".
A fellow researcher at Internet Identity provided us a link to a YouTube video that claimed to be from the author of the worm. When we first saw the video early yesterday morning it had been viewed 128 times. Heather took a screen shot showing 302 views yesterday morning. This morning there have been 3,803 views of the video.
My nickname is Iraq Resistance. Listen to me about the reasons behind the 9 september virus that affected NASA, Coca-Cola, Google, and most American ?gains?. What I wanted to say is that United States does not have the right to invade our people and steal our oil under the name of nuclear weapons. Have you seen any there? No evidence, even about any project. How easy you kill and destroy. Second, about the Christian Terry Jones what he tried to do on the same day this worm spread is not even fair. I know that not all Christians are similar and some newspapers wrote that I am a terrorist hacker because of the computer virus and Mr. Terry Jones is not and he is not terrorist because he infected all muslims' behavior. I think America, come on! Be fair. Where is your freedom which must end when it reaches another person's freedom. And you say you modern educated people. I don't know there is another one and really I don't like smashing and as you know there were no computers smashed as you know by the analysis report. I could have smashed all those I infected but I wouldn't and don't use the word terrorist please. I hope that all people understand I am not a negative person. Thanks for publishing.
(click for video)So, shall we take Mr. IqZiad at his word? Context is everything, and in this case, we have ample evidence that iraq_resistance, the self-proclaimed "Commander of the Brigades of Tariq bin Ziad", desires to harm America.
Here's a post that he made on the website "vbhacker.net" where he has been active since 2006 using the username "iraq_resistance":
فيروس طارق بن زياد يعصف بأمريكا
السلام عليكم
قام قائد كتائب طارق بن زياد بشن هجوم فيروس على شركات امريكية وذلك يوم الخميس واصاب عدد هائل من الكمبيوترات ما ادى الى ان الشركات توقف خادمات البريد حتى تسيطر على المشكلة.
وقد اوقفت شركة كومكاست بعض خادماتها وشركة قوقل وشركة كوكاكولا ووكالة ناسا وذلك في ضرف ساعتين مساء الخميس الموافق 9-9-2010
هذا تقرير من شركة مايكروسوفت
http://www.msnbc.msn.com/id/39087497/ns/technology_and_science-security/
وهذا تقرير الدايلي ميل البريطانية
http://www.dailymail.co.uk/sciencetech/article-1310890/Here-virus-causes-havoc-spreads-world.html
وقد اقسم قائد كتائب طارق بن زياد على مواصلة الهجوم في وقت لاحق انتقاما لحملتهم على الاسلام
الرجاء نشر هذا الانجاز والدعاء لكتائب طارق بن زياد بالتوفيق والحفظ
The post takes credit for the attack, links to two news stories about the attack, and then closes in the last two lines by saying:
As the Commander of the Brigades of the Tarik bin Ziad, I swear the attacks will continue in retaliation for their attacks against Islam.
Please publish this achievement and pray for the success and protection of al-Tarik bin Ziad.
Well, Mr. IQZiad, I've published your achievement, but I am certainly praying for a different outcome than the one you request.
The user iraq_resistance has been a member of vbhack.net since 2006. When we looked into the board this morning there were 619 active registered users logged in to the site, as well as 17,032 "guests" reading public messages on the board. The board, which is hosted on LiquidWeb in Chicago, is one of the 22,000 most popular on the Internet according to NetCraft, and has many non-offensive topics, including large popular forums about the World Cup and Islam.
Despite his long membership, Iraq_resistance has only created three discussion threads. The most popular, which was read 4,765 times and has 163 replies, was this message from May of 2008, entitled: مطلوب شباب للمشاركة في حملة الجهاد الالكتروني
which translates as: "Wanted: Young people to participate in Electronic Jihad".
السلام عليكم اخواني
تم تأسيس مجموعة بإسم كتائب طارق بن زياد وهدف هذه المجموعة اختراق اجهزة امريكية تابعة للجيش الامريكي
وقد تطلب زيادة العدد حتى نكون اكثر فعالية .. لذلك نطرح شروط الانتساب الى هذه المجموعة الجهادية الالكترونية:
1 - أن يكون هدف المشترك الجهاد الالكتروني وأن يقسم أنه لن يستخدم ما يتعلمه مع المجموعة ضد هدف آخر.
2 - الإخلاص في العمل واحترام أعضاء المجموعة وبعد توسعها يكون للاقدمية والاكثر فعالية مرتبة القيادة على مجموعات تابعة للمجموعة الرئيسية .
3 - يكون اللقاء والمحادثة على الياهو مسنجر والامسن .
4 - اي مشاكل مع الاعضاء او القيادات باب الشكوى مفتوح للقائد العام للكتائب .
5 - مستوى المجاهد غير مهم لانه سيتعلم مع المجموعة كما ان الطريقة ليست صعبة وهي مؤثرة فعلا.
6 - اتباع نصائح القائد العام والاخلاص الكامل بالعمل لوجه الله .
7 - تناسي الاحقاد بين اعضاء المجموعة وروح المنافسة تكون ضد العدو وليس ضد الاخوة .
8 - القسم في عدم استخدام ما يتعلمه في هدف اخر خارج المجموعة سيكون على المايك ويسمعه القائد العام .
نسأل الله ان يوفقنا ويسدد خطانا واياكم .. ونتمنى من الاخوة الاستجابة للانضمام لهذه الفرصة المباركة
كما نشكر ادارة المنتدى لاتاحة الفرصة لاعلان الحملة وطلب والانتساب وسيتم موافاتكم اولا باول بالنتائج باذن الله.
للانضمام الرجاء اضافة معرف ياهو
tarek_bin_ziad_army
بانتظار المجاهدين لقبول اضافتكم
اخوكم القائد العام لكتائب طارق بن زياد
Which, according to Google translate, reads:
Peace be upon you my brothers
Group was established in the name of al-Tariq bin Ziyad and goal of this group infiltrate a U.S. subsidiary of the U.S. Army
The increasing number of requests so we'll be more effective .. Therefore, we present the conditions for affiliation to these jihadist group E:
1 - to be the common goal of electronic jihad and to apportion that it will use what it learns with the group against the other goal.
2 - dedication to work and respect for members of the group and after the expansion is the most seniority and rank the effectiveness of the leadership groups of the main group.
3 - be meeting and chatting on Yahoo Messenger, Alamson.
4 - any problems with members or leaders open the door of the complaint to the General Commander of the Brigade.
5 - the level of fighting is not important because he will learn with the group and that the way in which it is not really impressive.
6 - follow the advice of the Commander in Chief and dedication to working for God's sake.
7 - forget the grudges between the members of the group and the spirit of competition which is against the enemy and not against the brothers.
8 - Section in the non-use of learning the target outside the group will be on the mic and hear the commander in chief.
We ask God to help us and guide our steps and you .. And good response from the brothers to join this blessed opportunity
We also thank the management of the Forum for the opportunity to announce the campaign and asked the association and will provide you with first hand the results, God willing.
Please add to join the Yahoo ID
tarek_bin_ziad_army
Waiting for the Mujahideen to accept Adavckm
Brother Commander General of the Brigades, Tariq ibn Ziyad
Tariq ibn Ziyad was the name of the Muslim servant who was appointed a General and given troops to conquer the Iberian peninsula in the year 711. You can read more about him in his Wikipedia article, or for a more Islam-friendly version of events, see HaqIslam. Tariq is the invader who famously burned his ships after landing, convinced of his victory by a vision of the Prophet promising him success and that he would personally kill King Roderick.
The same "call for recruits" was posted in many other places, including:
http://www.amman-dj.com/vb/a-t68089/ (by user "iraq_resistance", active since December 2006, hosted on SoftLayer in the USA.)
http://www.m0dy.net/vb/t104142.html (by user "iraq_resistance", active since November 2005, hosted on SoftLayer in the USA.)
http://vbnaajm.naajm.com/showthread.php?t=44269 (by user "iraq_resistance", active since July 2004, hosted on BlueHost in the USA.)
http://www.arabteam2000-forum.com/index.php?showuser=74343 (user "iraq_resistance", active since March 2006, hosted on XLHost in the USA.)
In addition there are malware author recruiting ads, such as this one:
http://lovesingle.jeeran.com/no2.html
The call is for assistance from those who can create computer viruses to strike the enemy. Malware coders who want to help in the cause were instructed (in Arabic):
To subscribe send a message to
tarek_bin_ziad_army@yahoo.com
And please send a message to email the following to configure a lethal army of God Almighty in the future
thabet3000@gmail.com
Impact?
So despite the "I'm not a terrorist", YouTube video, we have a mass-mailing worm that disproportionately impacted US-based businesses, successfully planting backdoor code on many of the infected machines, planted by a person who has been calling himself "Iraq_resistance" since 2006, and who has been recruiting for "electronic Jihad" participants since 2008. This person boasted about his attacks, and has promised there will be others, and as far back as March 6, 2009, was specifically inviting malware authors to help him create "a lethal army of God".
Was there a lot of Hype in the coverage of this malware? Yes. But perhaps the hype is deserving a deeper response than a shrug.
Update
Our friend Bob McMillan has shared an interesting Series of Emails with the worm author.
Thursday, 9 September 2010
This evening while I was driving to an open house at my daughter's school (very cool! proud of you, Kyriae!) a journalist called to ask me about "the major new email worm that everyone is talking about".
Insert sound of crickets.
I asked him for more details and he said all he knew so far was that it used the subject line "Here you have", which made me laugh -- that was the main subject line of the Anna Kournikova virus way back in 2001!
In my lab at the University of Alabama at Birmingham we have a project called the UAB Spam Data Mine, so I'm usually a pretty good person to ask if something involves the words "major" and "email", but not this time. As the evening progressed I got more and more queries and emails about it, so I decided to look into it.
In the entire Spam Data Mine, we had 17 copies of the email, or roughly one out of every 100,000 email messages for the day. Certainly not "major", but then when we looked at the actual emails, we noticed that thirteen of the seventeen came from the same Very Large Financial Institution.
That did pique my interest! ABC seems to be the only news station covering the story, which is because the worm behind this malware managed to get lose in some ABC properties. Here's a sample news story, from ABC 13 in Houston:
(story from ABC's KTRK in Houston)
ABC National news had a similarly glamorous lead in, mentioning that as of 4 PM on Thursday "Here you have" was the second hottest news trend on Google. "Organizations including NASA, Comcast, AIG, Disney, Proctor & Gamble, Florida Department of Transportation and Wells Fargo are just a few of the organizations apparently affected by the worm, which appears to have sent out hundreds of thousands, if not millions of e-mails"
If we scroll back in the Twitter space about twelve hours (1:00 PM on Thursday) we can confirm that at least for some folks, the email did feel pretty overwhelming. See posts such as:
tony1971 who else is getting tons of e-mails with the subject, #hereyouhave?
jmyoung82 328 emails and counting from #hereyouhave email worm
wiltap I turned off my desktop email--machine was non-responsive. RT @perfectcr Yup, its global! #hereyouhave
padevries Seems like #hereyouhave #virus is under control at my company. After 724 emails in 10 min it has stopped.
The malware preferred to spread via the Outlook mail program, and spammed itself primarily by sending to every member of the local Outlook address book. In companies where a domain administrator logged in to an infected machine the effect was that every machine reachable from that machine that used the same administrator password became infected, and then each of those users sent an email to every other user in the company directory. I can see where that would pile up quickly.
Apparently very few companies have the addresses in the UAB Spam Data Mine in their address books, which would explain me receiving so little spam. (A fortuitous typographical error seems to be how I got most of our copies.)
BarracudaLabs claims in their useful and informative blog entry, “Here You Have” Spam Teaches an Old Worm a New Trick that they saw the spam first at 9:44 AM Pacific time and quickly saw 200,000 copies, but that its likely that infected organizations had many more. The spam dried up once the website hosting the malware shut down the offending account.
Although the malware is being recognized for its spam, the reason it is being labeled as a worm has to do with its spread within corporate networks. The malware, which was previously seen on August 20th, has been given the name W32.Imsolk.A by Symantec and others at that time. They call the new version "W32.Imsolk.B". TrendMicro calls the new version "Worm_Meylme.B".
Here's a VirusTotal report showing detections and who is calling it what. Currently 23 of 42 anti-virus products are reporting a detection. (Up from 17 of 42 when I checked about 4 hours ago).
Its interesting to follow Symantec's ticket on the malware through the day . . . Symantec Tech Support ticket - which concluded:
""Enterprise customers are protected by a Rapid Release signature set dated Sep 9th 2010 rev 023, or later. The next regular definition set to be published at 16:00 PST Sep 9th 2010 will contain the detection."
McAfee's AvertLabs also had a Special Report on Here you Have, including links to their advice on identifying and removing the malware, with a special Knowledge Base link that provided information on an emergency signature file and a special version of their stand-alone "stinger" product.
Microsoft has a quite good Threat Encyclopedia entry for the previous version, which they called "Visal.A", and has updated it with a great entry on Visal.B. Some of the cooler features of this malware described by Microsoft include:
- the malware copies itself as " CV 2010.exe" to drives C: through H:.
- The worm adds an autostart key by making the following registry modification:
which is how it guarantees that it will re-invoke after boot -- note that by linking to "Winlogon", even a 'safe mode' boot will be "infected".
- the worm will attempt to mount network shares for all computers on the local network and copy itself as a fake graphic file - "N73.Image12.03.2009.JPG.scr" and placing itself in a "New Folder", as well as folders named "Music" and "Print" on every drive it can mount. It will add an entry into an autorun.inf file on each of those drives to ensure that mounting the drive will invoke their fake JPG file.
- The malware also attaches itself via the registry to 391 various .exe file names, primarily the names of security tools and programs, so that if any of them are executed, the malware stored in "%windir%\csrss.exe" will be re-invoked.
Although the malware theoretically can send three different emails from templates in the malware, all of the samples we received today were of the first variety:
The first actual copy of the email we saw was actually from an employee of a local utility company. In all the copies I saw, the actual link was downloading the content from:
members.multimania.co.uk/yahoophoto/PDF_Document21_025542010_pdf.scr
Although SCR files are traditionally thought of as "screen saver" files, if the file is an executable, '.scr' files can be directly executed in Windows, as indeed this one is. Because file extensions are suppressed by default in Windows, and because the executable uses an icon that makes it appear to be a PDF file, this one fooled quite a number of people.
Multimania quickly shutdown the account "yahoophoto" once it was understood what was
happening. After that the attack more or less ran itself out. While it continued to spread via network shares inside of large corporate networks, the email based component was a dud after that point.
Insert sound of crickets.
I asked him for more details and he said all he knew so far was that it used the subject line "Here you have", which made me laugh -- that was the main subject line of the Anna Kournikova virus way back in 2001!
In my lab at the University of Alabama at Birmingham we have a project called the UAB Spam Data Mine, so I'm usually a pretty good person to ask if something involves the words "major" and "email", but not this time. As the evening progressed I got more and more queries and emails about it, so I decided to look into it.
In the entire Spam Data Mine, we had 17 copies of the email, or roughly one out of every 100,000 email messages for the day. Certainly not "major", but then when we looked at the actual emails, we noticed that thirteen of the seventeen came from the same Very Large Financial Institution.
That did pique my interest! ABC seems to be the only news station covering the story, which is because the worm behind this malware managed to get lose in some ABC properties. Here's a sample news story, from ABC 13 in Houston:
A massive and dangerous email virus has spread like wildfire, flooding inboxes and disrupting operations across the globe. The email is landing in the inboxes of companies around the world.
The email has the subject line 'Here you have.' In the body of the email, it reads, "Hello: This is The Document I told you about, you can find it here," and contains a reference to a document and a link to what appears to be a PDF. IT departments are advising users not to open the email or click on the link, but to delete the message.
If you click on the link, the virus replicates and sends itself out using your name and contact list.
The attack appears to be global, so far affecting companies such as Disney, P&G, Dow, Coca-Cola and others. The Florida Department of Transportation's email system has been shut down, and other Florida government agencies have been affected, but so far no Texas government agencies are reporting any impact. The virus may have originated in Russia.
(story from ABC's KTRK in Houston)
ABC National news had a similarly glamorous lead in, mentioning that as of 4 PM on Thursday "Here you have" was the second hottest news trend on Google. "Organizations including NASA, Comcast, AIG, Disney, Proctor & Gamble, Florida Department of Transportation and Wells Fargo are just a few of the organizations apparently affected by the worm, which appears to have sent out hundreds of thousands, if not millions of e-mails"
If we scroll back in the Twitter space about twelve hours (1:00 PM on Thursday) we can confirm that at least for some folks, the email did feel pretty overwhelming. See posts such as:
tony1971 who else is getting tons of e-mails with the subject, #hereyouhave?
jmyoung82 328 emails and counting from #hereyouhave email worm
wiltap I turned off my desktop email--machine was non-responsive. RT @perfectcr Yup, its global! #hereyouhave
padevries Seems like #hereyouhave #virus is under control at my company. After 724 emails in 10 min it has stopped.
The malware preferred to spread via the Outlook mail program, and spammed itself primarily by sending to every member of the local Outlook address book. In companies where a domain administrator logged in to an infected machine the effect was that every machine reachable from that machine that used the same administrator password became infected, and then each of those users sent an email to every other user in the company directory. I can see where that would pile up quickly.
Apparently very few companies have the addresses in the UAB Spam Data Mine in their address books, which would explain me receiving so little spam. (A fortuitous typographical error seems to be how I got most of our copies.)
BarracudaLabs claims in their useful and informative blog entry, “Here You Have” Spam Teaches an Old Worm a New Trick that they saw the spam first at 9:44 AM Pacific time and quickly saw 200,000 copies, but that its likely that infected organizations had many more. The spam dried up once the website hosting the malware shut down the offending account.
Although the malware is being recognized for its spam, the reason it is being labeled as a worm has to do with its spread within corporate networks. The malware, which was previously seen on August 20th, has been given the name W32.Imsolk.A by Symantec and others at that time. They call the new version "W32.Imsolk.B". TrendMicro calls the new version "Worm_Meylme.B".
Here's a VirusTotal report showing detections and who is calling it what. Currently 23 of 42 anti-virus products are reporting a detection. (Up from 17 of 42 when I checked about 4 hours ago).
Its interesting to follow Symantec's ticket on the malware through the day . . . Symantec Tech Support ticket - which concluded:
""Enterprise customers are protected by a Rapid Release signature set dated Sep 9th 2010 rev 023, or later. The next regular definition set to be published at 16:00 PST Sep 9th 2010 will contain the detection."
McAfee's AvertLabs also had a Special Report on Here you Have, including links to their advice on identifying and removing the malware, with a special Knowledge Base link that provided information on an emergency signature file and a special version of their stand-alone "stinger" product.
Microsoft has a quite good Threat Encyclopedia entry for the previous version, which they called "Visal.A", and has updated it with a great entry on Visal.B. Some of the cooler features of this malware described by Microsoft include:
- the malware copies itself as "
- The worm adds an autostart key by making the following registry modification:
In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Adds value: "Sets Shell"
With data: “%windir%\csrss.exe”
which is how it guarantees that it will re-invoke after boot -- note that by linking to "Winlogon", even a 'safe mode' boot will be "infected".
- the worm will attempt to mount network shares for all computers on the local network and copy itself as a fake graphic file - "N73.Image12.03.2009.JPG.scr" and placing itself in a "New Folder", as well as folders named "Music" and "Print" on every drive it can mount. It will add an entry into an autorun.inf file on each of those drives to ensure that mounting the drive will invoke their fake JPG file.
- The malware also attaches itself via the registry to 391 various .exe file names, primarily the names of security tools and programs, so that if any of them are executed, the malware stored in "%windir%\csrss.exe" will be re-invoked.
Although the malware theoretically can send three different emails from templates in the malware, all of the samples we received today were of the first variety:
Subject: Here you have
Hello:
This is The Document I told you about,you can find it Here.
http://www.sharedocuments.com/library/PDF_Document21.025542010.pdf
Please check it and reply as soon as possible.
Cheers,
The first actual copy of the email we saw was actually from an employee of a local utility company. In all the copies I saw, the actual link was downloading the content from:
members.multimania.co.uk/yahoophoto/PDF_Document21_025542010_pdf.scr
Although SCR files are traditionally thought of as "screen saver" files, if the file is an executable, '.scr' files can be directly executed in Windows, as indeed this one is. Because file extensions are suppressed by default in Windows, and because the executable uses an icon that makes it appear to be a PDF file, this one fooled quite a number of people.
Multimania quickly shutdown the account "yahoophoto" once it was understood what was
happening. After that the attack more or less ran itself out. While it continued to spread via network shares inside of large corporate networks, the email based component was a dud after that point.
This summary is not available. Please
click here to view the post.
Thursday, 2 September 2010
Today I asked our UAB Cyber Intelligence team to give me some background on the Discover Channel eco-terrorist, James J. Lee. Heather McCalley, who supervises the team, provides the following "guest" blog entry. We'll be seeing more guest bloggers from my research team at UAB's Computer Forensics Research Lab in the future . . .
Discovery Channel shooter James Jay Lee not only ran the website www.savetheplanetprotest.com, he was also a frequent poster in the saveThePlanetProtest topic on a message board at Yuku.com: savetheplanetprotest.yuku.com
There he chatted as “misterfifteen” with other misguided people in January 2008 about the weeklong protest he was planning--although it sounds like it was more of a vigil--for Discovery Channel headquarters beginning the following February 15th. On this forum he wrote threateningly about his anger toward the educational TV channel: “They have to get on board with saving the planet and I'd better start seeing some REAL improvement in the news that things are changing.” (or, WHAT will happen, you ask?) He also wrote, “Discovery is the enemy.” But his protest fizzled out when nobody showed up, and he decided to quit paying people to hang around, like the homeless man below:
In order to create a "protest crowd", Lee began throwing thousands of dollars of cash into the air, as documented in this YouTube video Mad Money Dash in Silver Springs.
The police arrested him, and Lee notes in the forum that he was held for two weeks, including four days in the loony bin. I like the way one forum poster commented on Lee’s alias name on Yuku: “an obvious reference to the Fifteen Minutes of Fame he hopes to garnish from this fruitless exertion of time and energy.”
Shortly after his release he launched his new effort, an essay contest with a $200,000 first prize:
Well, Lee never quite went so far in his posts as to make outright threats of physical harm. But what if he had? Who monitors such incendiary internet sites? Don’t count on Yuku to take this down anytime soon; they describe themselves as “a social universe of communities united by people and their passions.”And, I suppose the 11-step rant on his website will stay up until he misses a few payments to IN2NET NETWORK, INC. Pete4Peace details his concerns, however, in a post about several encounters with Lee. He was concerned because Lee “talked about using violence” :
http://beltwaybeast.blogspot.com/
That blog post from today contains email exchanges from the past between the blogger and "misterfifteen@hotmail.com".
Inquiring 21st Century minds have already identified Lee’s old videos, photos, and MySpace page(already down)…heck, he even has a fan page now on Facebook! Although he had clearly been thinking about the Discovery Channel for a long time, he actually updated his manifesto on his website yesterday morning before heading over to the headquarters building. The time stamp for the HTML page is Wednesday, September 01, 2010 8:46:30 AM. Chilling. (His manifesto is at savetheplanetprotest.com, at least for now...(archived here just in case...)
Discovery Channel shooter James Jay Lee not only ran the website www.savetheplanetprotest.com, he was also a frequent poster in the saveThePlanetProtest topic on a message board at Yuku.com: savetheplanetprotest.yuku.com
There he chatted as “misterfifteen” with other misguided people in January 2008 about the weeklong protest he was planning--although it sounds like it was more of a vigil--for Discovery Channel headquarters beginning the following February 15th. On this forum he wrote threateningly about his anger toward the educational TV channel: “They have to get on board with saving the planet and I'd better start seeing some REAL improvement in the news that things are changing.” (or, WHAT will happen, you ask?) He also wrote, “Discovery is the enemy.” But his protest fizzled out when nobody showed up, and he decided to quit paying people to hang around, like the homeless man below:
In order to create a "protest crowd", Lee began throwing thousands of dollars of cash into the air, as documented in this YouTube video Mad Money Dash in Silver Springs.
The police arrested him, and Lee notes in the forum that he was held for two weeks, including four days in the loony bin. I like the way one forum poster commented on Lee’s alias name on Yuku: “an obvious reference to the Fifteen Minutes of Fame he hopes to garnish from this fruitless exertion of time and energy.”
Shortly after his release he launched his new effort, an essay contest with a $200,000 first prize:
Well, Lee never quite went so far in his posts as to make outright threats of physical harm. But what if he had? Who monitors such incendiary internet sites? Don’t count on Yuku to take this down anytime soon; they describe themselves as “a social universe of communities united by people and their passions.”And, I suppose the 11-step rant on his website will stay up until he misses a few payments to IN2NET NETWORK, INC. Pete4Peace details his concerns, however, in a post about several encounters with Lee. He was concerned because Lee “talked about using violence” :
http://beltwaybeast.blogspot.com/
That blog post from today contains email exchanges from the past between the blogger and "misterfifteen@hotmail.com".
Inquiring 21st Century minds have already identified Lee’s old videos, photos, and MySpace page(already down)…heck, he even has a fan page now on Facebook! Although he had clearly been thinking about the Discovery Channel for a long time, he actually updated his manifesto on his website yesterday morning before heading over to the headquarters building. The time stamp for the HTML page is Wednesday, September 01, 2010 8:46:30 AM. Chilling. (His manifesto is at savetheplanetprotest.com, at least for now...(archived here just in case...)
In a bold new spam campaign, the criminals behind the Zeus Botnet have been distributing a spam email with a link to an executable file.
We first noticed this campaign in the UAB Spam Data Mine with a spam email message with the subject "you vacancy".
The body of that email read:
The exact same email has also been seen in the UAB Spam Data Mine with several other subjects today:
The final link there that LOOKS like its going to download a Microsoft Word document, actually retrieves a file with the name:
mycv.doc.exe
The properties on that document claim to be:
BitDefender Management Console
SOFTWIN S.R.L.
The current detection rate on the malware at VirusTotal is 16/43, meaning that only 16 of 43 anti-virus products identify this as malware, although only one is calling it "zbot". Here's the VirusTotal Report for md5 = 10fd124206b15f878240f22a30eaf9fe
Our copy of the malware came from a computer with the IP address 58.222.143.148, which has been in bad company for some time. The IP is located on China Beijing Chinanet Jiangsu Province Network. Another example of Russian-speaking crooks hosting their malicious servers in China.
According to those great guys at ZeusTracker, that IP has been used for some really bad stuff.
caseoffinance.cc
dowsonstoke.cc
leadingcase.cc (Confirmed Zeus)
goldfieldforu.cc (Confirmed Zeus 8/24)
youmoneyway.cc (Confirmed Zeus 8/24)
a8228djjnedu7e8hd83ndd43d3d3.com
mikkymouse.com
first-wave-aug.com
iwfybfywi.com (Confirmed Zeus 8/19)
whiteagngo.com (Confirmed Zeus 9/2)
ekuns.com
fasterbuyers.com
hotsku.com (COnfirmed Zeus 9/1)
askuv.com (Confirmed Zeus 9/2)
good-resume.info
roundhome.net (Confirmed Zeus 8/24)
caramelloinze.net (Confirmed Zeus 9/2)
plitkinski.net
olandik.net (Confirmed Zeus 8/20)
instamfan.net (Confirmed Zeus 7/28)
tjkleen.net (Confirmed Zeus 8/9)
incornew.net (Confirmed Zeus 7/30)
autasienga.ru
jocudaidie.ru (Confirmed Zeus 7/15)
dahzunaeye.ru (Confirmed Zeus 6/23)
vohphozeeg.ru
eexiziedai.ru
railuhocal.ru (Confirmed Zeus 6/11)
blackfuril.ru
purplepron.ru (Confirmed Zeus 8/15)
cahgofoneu.ru (Confirmed Zeus 8/31)
iveeteepew.ru (Confirmed Zeus 6/23)
hazelpay.ru (Confirmed Zeus = 5/27)
We've got quite a few more details that we've already shared with law enforcement, but we wanted the public to be advised as well.
If you are a spam researcher and can tell me what botnet this is, please shoot me a note at 'gar at cis dot uab dot edu'. Here are some of the top sending IPs for this group:
72.16.178.42
81.180.66.34
187.36.133.238
186.82.57.113
186.112.107.35
77.127.135.151
195.135.239.5
76.97.210.124
195.228.164.14
24.36.173.168
93.32.50.228
211.17.116.17
24.80.8.180
190.48.237.121
212.29.192.202
We first noticed this campaign in the UAB Spam Data Mine with a spam email message with the subject "you vacancy".
The body of that email read:
Thank you for the chat yesterday, it really helped me get a clearer idea
of recruitment as well as exploring any potential opportunity.
I have just spotted a mistake on the CV I sent in which my email was incorrect.
Apologies for any inconvenience caused if you have already sent me any information on anything we discussed.
My CV is an updated!
CV with the correct email on this link: http://good-resume.info/mycv.docx
The exact same email has also been seen in the UAB Spam Data Mine with several other subjects today:
| 908 | you vacancy |
| 869 | Re: CV |
| 864 | for CV |
| 370 | Welcoming speech |
| 115 | Greetings |
| 112 | Hello |
| 111 | Compliments |
| 110 | Salutation |
| 108 | Speech of welcome |
| 100 | Civilities |
| 99 | Hello message |
The final link there that LOOKS like its going to download a Microsoft Word document, actually retrieves a file with the name:
mycv.doc.exe
The properties on that document claim to be:
BitDefender Management Console
SOFTWIN S.R.L.
The current detection rate on the malware at VirusTotal is 16/43, meaning that only 16 of 43 anti-virus products identify this as malware, although only one is calling it "zbot". Here's the VirusTotal Report for md5 = 10fd124206b15f878240f22a30eaf9fe
Our copy of the malware came from a computer with the IP address 58.222.143.148, which has been in bad company for some time. The IP is located on China Beijing Chinanet Jiangsu Province Network. Another example of Russian-speaking crooks hosting their malicious servers in China.
According to those great guys at ZeusTracker, that IP has been used for some really bad stuff.
caseoffinance.cc
dowsonstoke.cc
leadingcase.cc (Confirmed Zeus)
goldfieldforu.cc (Confirmed Zeus 8/24)
youmoneyway.cc (Confirmed Zeus 8/24)
a8228djjnedu7e8hd83ndd43d3d3.com
mikkymouse.com
first-wave-aug.com
iwfybfywi.com (Confirmed Zeus 8/19)
whiteagngo.com (Confirmed Zeus 9/2)
ekuns.com
fasterbuyers.com
hotsku.com (COnfirmed Zeus 9/1)
askuv.com (Confirmed Zeus 9/2)
good-resume.info
roundhome.net (Confirmed Zeus 8/24)
caramelloinze.net (Confirmed Zeus 9/2)
plitkinski.net
olandik.net (Confirmed Zeus 8/20)
instamfan.net (Confirmed Zeus 7/28)
tjkleen.net (Confirmed Zeus 8/9)
incornew.net (Confirmed Zeus 7/30)
autasienga.ru
jocudaidie.ru (Confirmed Zeus 7/15)
dahzunaeye.ru (Confirmed Zeus 6/23)
vohphozeeg.ru
eexiziedai.ru
railuhocal.ru (Confirmed Zeus 6/11)
blackfuril.ru
purplepron.ru (Confirmed Zeus 8/15)
cahgofoneu.ru (Confirmed Zeus 8/31)
iveeteepew.ru (Confirmed Zeus 6/23)
hazelpay.ru (Confirmed Zeus = 5/27)
We've got quite a few more details that we've already shared with law enforcement, but we wanted the public to be advised as well.
If you are a spam researcher and can tell me what botnet this is, please shoot me a note at 'gar at cis dot uab dot edu'. Here are some of the top sending IPs for this group:
72.16.178.42
81.180.66.34
187.36.133.238
186.82.57.113
186.112.107.35
77.127.135.151
195.135.239.5
76.97.210.124
195.228.164.14
24.36.173.168
93.32.50.228
211.17.116.17
24.80.8.180
190.48.237.121
212.29.192.202
Subscribe to:
Posts (Atom)
