Yesterday we saw a message that promised to show you a video about the disaster after the earthquake and the tsunami. It included a link, that was an executable file:
http://<>/consulado/japones/urgente/desespero-da-equipe-de-resgate-ao-encontrar-milhares-de-corpos-816283hDGJDj36378.youtube.com-AVI.exe
This is just a downloader, that downloads and installs more malware in your computer. It also downloads a HOSTS file and overwrites in your computer to redirect the browser in case you visit any of the following web sites:
www.banespa.com.br
banespa.com.br
www.santander.com.br
santander.com.br
caixa.com.br
www.cef.gov.br
cef.gov.br
www.cef.com.br
www.caixa.gov.br
caixa.gov.br
www.caixa.com.br
live.com
www.live.com
www.msn.com
cef.com.br
internetbanking.caixa.gov.br
internetbanking.caixa.com.br
internetbanking.cef.gov.br
internetbanking.cef.com.br
www.e-gold.com.br
e-gold.com.br
www.e-gold.com
e-gold.com
www.bradescoprime.com.br
www.cetelem.com.br
cetelem.com.br
www.cartaoaura.com.br
msn.com
www.msn.com.br
login.live.com
cartaoaura.com.br
bradescoprime.com.br
www.itaupersonnalite.com.br
itaupersonnalite.com.br
americanexpress.com.br
www.sicredi.com.br
sicredi.com.br
portal.sicredi.com.br
www.realsecureweb.com.br
realsecureweb.com.br
www.hotmail.com
hotmail.com
www.americanexpress.com.br
www.americanexpress.com
www.real.com.br
www.bancoreal.com.br
real.com.br
bancoreal.com.br
www.hotmail.com.br
hotmail.com.br
itau.com.br
www.itau.com
itau.com
imagem.caixa.gov.br
imagem.caixa.com.br
imagem.cef.gov.br
imagem.cef.com.br
www.bradesco.com.br
bradesco.com.br
www.bradesco.com
bradesco.com
www.itau.com.br
www.realsecureweb.com.br
Taking a look at the URLs where the HOSTS file is located, we have found another directory in the same server that contains some highly suspicious folders:
This is what we see if we visit some of these folders:
These are phishing sites to steal your credentials. Don’t worry about this one, as since yesterday we are blocking the URLs and the malware was proactively detected with TruPrevent.
If you really want to help our Japanese friends, please click here and donate now.
[...] (source: Panda) [...]
[...] Guys ! For continuation of thread I suggest to read this article: http://pandalabs.pandasecurity.com/c…se-earthquake/ Yesterday we saw a message that promised to show you a video about the disaster after the [...]
[...] I princip jämt när det är något som engagerar alla och det skrivs mycket i media om så gör hackers vad de kan för att sprida skadlig kod på sajter som sätts upp för att locka trafik från de sökorden. Vår huvudkontor i Spanien har gjort en bloggpost till dettta (på engelska): http://pandalabs.pandasecurity.com/cybercriminals-taking-advantage-of-the-japanese-earthquake/ [...]
[...] http://pandalabs.pandasecurity.com/cybercriminals-taking-advantage-of-the-japanese-earthquake/ Weitere verwandte Artikel… [...]
[...] http://pandalabs.pandasecurity.com/cybercriminals-taking-advantage-of-the-japanese-earthquake/ Share and Enjoy: [...]