Breaking News

Historical OSINT - Google Sponsored Scareware Spotted in the Wild

Cybercriminals continue actively spreading malicious software while looking for alternative ways to acquire and monetize legitimate traffic successfully earning fraudulent revenue in the process of spreading malicious software.

We've recently came across to a Google Sponsored scareware campaign successfully enticing users into installing fake security software on their hosts further earning fraudulent revenue in the process of monetizing access to malware-infected hosts largely relying on the utilization of an affiliate-network based type of revenue sharing scheme.

In this post we'll profile the campaign, provide actionable intelligence, on the infrastructure, behind it and discuss in-depth, the tactics techniques and procedures of the cybercriminals behind it.

hxxp://www.google.com/aclk?sa=l&ai=Czd4NEnlLS-pWlrS1A-jBmIwO9pfjnQHOjKCvEI2B8woQAigIUPjA4pz8_____wFgyZajiqSkxBGgAabhse4DyAEBqgQhT9
CjnzChYHf5zQB4c8FB-fW9WUzgcUTQ4c7ciD4Gyxs0&num=5&sig=AGiWqty0Uq3Kr6U1Sb10olrq6C22JfNR_w&q=http://www.adwarepronow.com

hxxp://www.google.com/aclk?sa=L&ai=COLk5EnlLS-pWlrS1A-jBmIwO0YGZmwGz9aqwDbiw8bcBEAUoCFCnyNGE______8BYMmWo4qkpMQRyAEBqgQZT9
CTvAGhbX_5PQN_7QaAIk7HT3dQfrqLJQ&num=8amp;sig=AGiWqtyHmo4mgVkszSWtDUcT4dMRUAQnXg&q=http://www.antimalware-2010.com

Known malicious domains known to have participated in the campaign:
hxxp://www.adwarepronow.com/?gclid=CJ6d8LSGnZ8CFRMqagodmR_KaA - 209.216.193.112

Known malicious domains known to have participated in the campaign:
hxxp://www.antimalware-2010.com/ - 209.216.193.119

Sample detection rate for a sample malware:
MD5: 8328da91c8eba6668b3e72d547157ac7

Sample detection rate for a sample malware:
MD5: b74412ea403241c9c60482fd13540505

Once, executed, a, sample, malware, phones, back, to, the, following, malicious, C&C, server, IPs:
hxxp://72.167.164.199/definitions/configuration.txt
hxxp://72.167.164.199/latestversion/AntiMalwarePro_appversion.txt

We'll continue monitoring the campaign and post updates as soon as new developments take place.
Share:

Featured Security Image

Featured Security Image
The Heart of KOOBFACE. C&C and Social Network Propagation

Featured Cyber Intelligence Service

Featured Cyber Intelligence Service
DDanchev is for Hire!

Featured Cyber Intelligence Project

Featured Cyber Intelligence Project
Project Proposal - Cybercrime Research - Seeking Investment

Featured Threat Intelligence Project

Featured Threat Intelligence Project
Dancho Danchev's Mind Streams of Information Security Knowledge - The World's Most Comprehensive Threats Database

Featured Threat Intelligence Consultancy

Featured Threat Intelligence Consultancy
Threat Intelligence - An Adaptive Approach to Information Security - Free Consultation Available

Featured Hacking Project

Featured Hacking Project
Book Proposal - Seeking Sponsorship - Publisher Contact

Popular Posts

Featured Privacy Service

Featured Privacy Service
Pi-hole Privacy Blocking

Featured Video

Recent Posts

Featured Service

Featured Service
SurfWatch Threat Analyst

Featured Video

Featured Privacy Tool

Featured Privacy Tool
DNSCrypt

Featured Product

Featured Product
Sentinel Visualizer

Unordered List

  • Lorem ipsum dolor sit amet, consectetuer adipiscing elit.
  • Aliquam tincidunt mauris eu risus.
  • Vestibulum auctor dapibus neque.

Featured Privacy Tool

Featured Privacy Tool
OnionShare