Vulnerabilityqueerprocessbrittleness
No, I didn't make that title up. Someone else did. "vulnerabilityqueerprocessbrittleness . in" is currently one 600+ domains that link to a quite prevalent "Fake Anti-virus" malware campaign. Currently, the domains associated to this scam all point to web servers hosted in the 204.152.214.x address range, but of course the threat keeps "moving around" as usual.
The attackers show lots of "creativity" with their domain names
crashessafetypc. in
keepprotectcare. in
microsoftkeeper. in
hazardactivitytasks. in
hazardon-linekeeper. in
highrisksprotection. in
though they don't seem to have attended Marketing 101 yet, because some of the names appear to be less than ideal...:
keepperfomanceworms. in
dangerwreckguarantor. in
highfail-safetykeeper. in
optimizerwreckdeliverer. in
The current set of threats involves frequently changing malware EXEs (or EXEs inside of ZIPs) with low coverage on virustotal. The download URLs usually follow the pattern of http://bad-domain. in/16 character random hex string/setup.exe or /setup.zip
Example: http://fail-safetytestingcontrol. in/fc1a9d5408b7e17d/setup.exe
Stay safe .. and keep your PCs free of the dangerwreckguarantor!
Comments
Lisa G.
Jun 19th 2012
1 decade ago
Joshua
Jun 19th 2012
1 decade ago
http:// detectionshieldverify.in / 16digit hex / 123 / setup.zip
So far we've seen 1 to 3 digits used.
Richard S. Westmoreland
Jun 20th 2012
1 decade ago