Finding the Spam Before Its Spammed . . .

This morning I met with Brian Tanner, one of the UAB Malware Analysts, to determine what malware he should unpack for us this morning. I told him that I was interested in doing a quick check on the "Facebook" malware that we saw over the weekend. The only problem is that Ryan and the guys at Facebook had already had all those domains shut down. No problem. We'll just find the domains they are ABOUT to spam instead.

The UAB Spam Data Mine had received more than 500 emails yesterday in what we are calling the "Facebook Stripper" spam campaign.



The subject lines are each unique, having a suffix of "(Last rated by Random Name)", where Random Name has a first and last name randomly chosen. There are 32 base subjects though:

FaceBook message: Dancing Girl Drunk In The Pub- facebook Video
FaceBook message: Amateur Video - Perfect Girls striptease
FaceBook message: Art Of Exotic Dancing Striptease Series - video...
FaceBook message: Beautiful Girl Dancing Extrahard Striptease!
FaceBook message: Beautiful Girl Dancing Striptease! Cute!
FaceBook message: Beautiful girl hot dancing alone - video
FaceBook message: Beautiful Girls Dancing in the Club
FaceBook message: Dancing Girl loves herself - Amazing Clips
FaceBook message: Dancing girl oriental dance ...
FaceBook message: Dancing girls ... Funny and Hot Videos
FaceBook message: Erotic Dance Striptease
FaceBook message: Exotic Dance Video From facebook member.
FaceBook message: Extreme striptease dance video
FaceBook message: Facebook girl Striptease Beautiful dance
FaceBook message: facebook members Dancing In Striptease
FaceBook message: Girls Dancing on facebook Video
FaceBook message: Hot Girl Dancing At Striptease Dance Party
FaceBook message: Magnificent Exotic Dancing - video ...
FaceBook message: Magnificent girl dancing video clip
FaceBook message: Magnificent Girls dancing in front of camera
FaceBook message: Magnificent Girls dancing on stage
FaceBook message: Magnificent Girls extremely dancing
FaceBook message: Magnificent Striptease Dance
FaceBook message: Numerous of Magnificent Girls Dancing video
FaceBook message: Perfect Girl Dancing Video
FaceBook message: Perfect Girls Dancing - Video
FaceBook message: Smokin' and dancing girl
FaceBook message: These two girls are so... watch the video
FaceBook message: Two Magnificent Girls Dancing, More Info ...
FaceBook message: Two Magnificent Girls Dancing...
FaceBook message: Very Beautiful facebook girl Dance Video!
FaceBook message: Watch the Oooh! Super Beautiful Girl Dancing


Yesterday the domains used in the spam were:

53445player.com
5436player.com
7636player.com
4346player.com
867player.com

While these domains were hosted on a large number of botnet hosted machines, their nameserver actually had a static location. They all used the nameserver "ns1.pvthstonline.com" (8.12.160.183) and "ns2.pvthstonline.com" (205.1.190.113).

Using a Passive DNS Replication service (*wave* to Florian), we checked to see what other nameservers were hosted on 205.1.190.113.

ns2.insdcertificate.com and ns2.shortcuttingv.com were both hosted on that IP.

We knew that the domains served by insdcertificate.com were old - we saw those mostly on the 13th -- 342certificate.com, 234certificate.com, 656certificate.com, 767certificate.com and 867certificate.com -- so we decided to look for domains that were served by ns2.shortcuttingv.com.

Sure enough, we found five domains - all registered THIS MORNING (its only 10:40 AM here):

423adobe.com
545adobe.com
675adobe.com
685adobe.com
987adobe.com

We confirmed that 423adobe.com is being fast flux hosted -- its currently using the IP addresses:

71.195.128.169 (ComCast in Brandon, MA)
75.138.113.226 (Charter Cable in Ashville, NC)
96.32.130.151 (Charter Cable in Alpharetta, GA)
98.209.65.175 (ComCast in East Lansing, MI)
208.120.237.132 (Mindspring in Brooklyn, NY)

Looking at some history on these IPs, we can confirm that they have previously hosted Bank of America "video demo malware", on domains such as 867certificate.com and aheadfixpatch.com, as well as previous days of the Facebook stripper malware, on domains such as 5436player.com, and facebooketus.com.

When we put the "path" of "/home.htm" on one of the domains that we are predicting for today's host, we get the Facebook look-alike page, along with a popup telling us we have to download a new video player (which is actually the virus), now using the name "Flash_Adobe11.exe"



Uploading the malware to VirusTotal, we see that it is only detected by 4 of the 39 anti-virus products with which it is scanned. If you are relying on AVG, McAfee, Microsoft, Symantec, Trend, or pretty much anyone else to protect you from this virus, so far, they don't know about it. (Our report to VirusTotal causes a copy to be sent to them for analysis though - which is one of the reasons we love VirusTotal!)

Click for VirusTotal report

File size: 36352 bytes
MD5...: d17008513f2c93933b92a392260c5cda

Brian finished unpacking the malware and confirms that this copy still sends its stolen credentials to Hong Kong's HostFresh network to the IP address 58.65.232.17.

Afternoon Update

We've now seen more than 300 copies of the "predicted" facebook spam, and the criminals have now shifted again to another group of domain names:

2433module.com
3445module.com
3499module.com
5464module.com
9873module.com

We've seen less than 4 copies of each of these latest, which have a new malware piece as well, which you can find a VirusTotal report for here:

http://www.virustotal.com/analisis/aadd5db3b69580412041681ea3bb65e7