Overblog
Editer l'article Suivre ce blog Administration + Créer mon blog
4 juin 2010 5 04 /06 /juin /2010 20:56

Well this is not the first one, but at least I find it relevant since it is not being detected by (almost) any AV engines - I mean command line versions on VirusTotal.

 

Here is what the MSN message looks like:

 

msg_MSN_040610.jpeg

 

 

I clicked on the link aztec-casino.uk... the browser popped up and offered me to download a file named installcasino.exe.

 

Unfortunately for the bad guys, a BSD derivative kernel is kindda immune to Win 32 PE files... :)

 

According to VirusTotal, only 1 engine out of 41 detects the sample:

http://www.virustotal.com/fr/analisis/09b2b1ea08b19ff9a4e1c3609a39fa8f6ae60b8827260e8dd034630af754343c-1275677556

 

The only detection is an heuristic one. Please keep in mind that VirusTotal uses command line versions of AV engines, and this may reduce heuristic features or particular content dynamic analysis.

 

I'm waiting for an online sandbox analysis results.

 


What about URL filtering? not better either:

- nothing for McAfee TrustedSource:

http://www.trustedsource.org/en/feedback/query?sid=&p=&q=www.aztec-casino.uk.mn

- nothing for IronPort / SurfControl:

http://mtas.surfcontrol.com/MTASResults.asp  (says 'not in our list' at the time of writting).

 


What about domain informations?

- a bit weird according to Netcraft: UK or De?

http://toolbar.netcraft.com/site_report?url=http://www.aztec-casino.uk.mn

- brazilian IP address according to DomainCrawler? no WhoIs information...

http://www.domaincrawler.com/domains/view/www.aztec-casino.uk.mn

 

 

What about DNS?

> server 208.67.222.222
Default server: 208.67.222.222
Address: 208.67.222.222#53

 

> www.aztec-casino.uk.mn
Server:         208.67.222.222
Address:        208.67.222.222#53

Non-authoritative answer:

Name:   www.aztec-casino.uk.mn
Address: 188.40.70.45

OpenDNS and my ISP do agree about the IP resolution, therefore that should be correct.

 

Then I guess RIPE will be a pretty reliable about geo-localization:

http://www.db.ripe.net/whois?form_type=simple&full_query_string=&searchtext=+188.40.70.45&do_search=Search

and (this winner is): Germany.

 

 

 

 

 

Partager cet article

Repost0

commentaires

Dissertation Writing 11/06/2010 06:56


Excellent articles i enjoyed while reading this particular post.