Thats what I call redundancy!
Thursday November 16, 2006 at 7:23 am CST
Posted by Pedro Bueno
Sometime ago, I wrote about the PWS-Bankers, and what their authors were doing to make their sample live the longest amount of time possible: by adding additional sites to the trojan so if the first was out, it would get info from the second… Well, today I got another sample of one of those PWS-Banker.dldr, the downloader part that retrieves the actual banker trojan. This one had about 60(!) different websites, of which more than 50 were active as I write this…thats what I call redundancy!
Most of the urls were abusing dynamic DNS services, as you can see here:
hXXt://imagens5.myvnc.com
hXXt://imagens6.myvnc.com
hXXt://imagens7.myvnc.com
hXXt://imagens8.myvnc.com
hXXt://imagens1.myftp.biz
hXXt://imagens2.myftp.biz
hXXt://imagens3.myftp.biz
hXXt://cervatotal.servebeer.com
hXXt://blosblob.serveblog.net
hXXt://imagens6.myftp.biz
hXXt://imagens7.myftp.biz
hXXt://imagens8.myftp.biz
hXXt://imagens9.myftp.biz
hXXt://imagens1.myftp.org
hXXt://imagens2.myftp.org
hXXt://imagens3.myftp.or
hXXt://imagens4.myftp.org
hXXt://imagens5.myftp.org
hXXt://tulipasfotolog.hopto.org
hXXt://imagens7.myftp.org
hXXt://imagens8.myftp.org
hXXt://imagens9.myftp.org
hXXt://imagens1.bounceme.net
hXXt://imagens2.bounceme.net
hXXt://minhavida.servehalflife.com
hXXt://blobufg.zapto.org
hXXt://blobuegarquitetura.serveblog.net
hXXt://somostodosum.serveblog.net
hXXt://herbalifes.servehalflife.com
hXXt://zabumbaflog.zapto.org
hXXt://superflog.serveblog.net
hXXt://visionflog.serveblog.net
hXXt://floglidiane.bounceme.net
hXXt://flogolandia.serveblog.net
hXXt://blobterra.serveblog.net
hXXt://pudimblob.servebeer.com
hXXt://blobestrelinha.serveblog.net
hXXt://flogalera.serveblog.net
hXXt://flogolandias.serveblog.net
hXXt://superblob.serveblog.net
hXXt://blobuol.serveblog.net
hXXt://flogdasloiras.serveblog.net
hXXt://flogescandalos.serveblog.net
hXXt://flogagitabrasil.serveblog.net
hXXt://blobagitacentral.serveblog.net
hXXt://fobiastudiox.servemp3.com
hXXt://superflog.zapto.org
hXXt://flogao.zapto.org
hXXt://flogflog.no-ip.info
hXXt://zuiii.serveblog.net
hXXt://blobpromilitar.serveblog.net
hXXt://flogpromilitar.serveblog.net
hXXt://fotosfraga.serveblog.net
hXXt://fragantes.serveblog.net
hXXt://catarine.serveblog.net
hXXt://liliane.serveblog.net
hXXt://danielamix.serveblog.net
hXXt://mirelle.serveblog.net
hXXt://lidiane.serveblog.net
hXXt://julinha.serveblog.net
November 16th, 2006 at 9:28 am
I just have one question: Why is this variant not (yet) detected by McAfee with DAT 4897? I know that some vendors rely on speed, other in the quality of detections (w/ low fp’s and so on) but I notice that McAfee sometimes takes longer than usual to add some viruses to the library - it’s easy to notice when you receive a EXTRA.DAT that takes forever to be added to normal DAT. Is this a normal behavior? What to expect from McAfee in near future? Intra-daily DATs, more heuristic-based detection? Don’t get me wrong, I’m a McAfee user, but this situation is annoying.