801

Another one here, Trojan:JS/BlacoleRef.W missed: htxp://zulu.zscaler.com/submission/show/f58b27f17b497ce2c367cb12a7694ff5-1338582640
see VT results → htxps://www.virustotal.com/file/38addb00e677ec62da4d04da6344107aeaa00ba204ab3f02d9806d3e0284e85d/analysis/
see: htxp://urlquery.net/report.php?id=62312 mdl_Leads to exploit kit detected 2012-06-01 13:22:00 live malware,
which avast should normally detect as HTML:RedirME-inf [Trj]
Detected BlackHole exploit kit HTTP GET request

  • Detected malicious injected iframe → iframe src='htxp://mazdaforumi.ru:8080/forum/showthread.php?page=5fa58bce769e5c2c
    (the one we reported in the previous posting)
    We see this is an ongoing problem through a malware campaign (5 hrs ago, 6 hrs ago) when we search for: htxp://www.google.nl/search?sugexp=chrome,mod=9&ix=h9&sourceid=chrome&ie=UTF-8&q=iframe+src%3D’http%3A%2F%2Fmazdaforumi.ru%3A8080%2Fforum%2Fshowthread.php%3Fpage%3D5fa58bce769e5c2c

reported to virus AT avast dot com,

polonus

802

Another Trojan:JS/BlacoleRef.W, not detected, htxps://www.virustotal.com/file/07ca7776a566cc872c2fd0602da135072e780a10b062175e00c2710f3f63a365/analysis/
from: htxp://zulu.zscaler.com/submission/show/af5d670395a65113f12e98337f95bb64-1338587387
see: htxp://urlquery.net/queued.php?id=62630

  • Detected BlackHole exploit kit HTTP GET request
  • Detected malicious injected iframe

reported to virus AT avast dot com

803

Hi Polonus,

Not a new exploit method given in your post regarding “wire-transfer.htm”.

I’ve seen the exact algorithm somewhere else.

804

Hi !Donovan,

Well then they are running a new campaign with this again. So old wine in new sacks, so to say. Thanks for your evaluation.
I just report what I see happening while scanning and when I cannot get a avast detection, I immediately report back to the avast base,
well analysts. I think you are developing a very good “feel” for the various varieties of malcoded scripts out there,
as it is inspiring for both of us,

polonus

805

Hi malware reporters ;D

Trojan-FakeAV.Win32.Agent.rkx
https://www.virustotal.com/file/e1aaa0a98fc43f47d0d5777429631eaa4f8449bdbdbc268fb03d48fc910df8a3/analysis/

trojan winlock
https://www.virustotal.com/file/36ad11081c1b29b3540b918337478740921ddec0a90c45aabc0cc367f34e6763/analysis/

reported to avast! :wink:

EDIT: detections added

806

From the latest VT Comments:
Weelsolf BotNet (9-40)
https://www.virustotal.com/file/f25296744471f5f29718832998c20ac15bb968f426ae2259b5bdcb57a249d47f/analysis/

Rouge AV Live Security Platinum (8-42)
https://www.virustotal.com/file/cca6e3ecef865d2a5623c2e3b04a27d96c10abc90c5e67a3b5477d7ba215c438/analysis/

807

Hi Friends,

found by makcunknown

trojan ransom.
https://www.virustotal.com/file/d5faa80f5c8c083d37bc276f5dfe1598599fa07f67e8c9d55bbf8c41caa5bb62/analysis/

reported to avast!

EDIT: detection added

808

undetected malware

https://www.virustotal.com/file/b11c2b9b1dff86529ae399eb2bb2181e8edf720c722029a9000f6a7adad7248d/analysis/1338741938/

809

reported to virus AT avast dot com: https://www.virustotal.com/file/524b01eeee5d8c40918f552a1eb3543c37a3a773af9505070ecab24ccc7b31a7/analysis/

polonus

810

No AV Detect…yet.
https://www.virustotal.com/file/2a8d08b52bad72da37b15e56a0f8bfb41bee1188c15808e7e5a0a2b0a5ccec35/analysis/
See comment from mwsniffer

811

See: htxp://vscan.urlvoid.com/analysis/e88bca0faa4901001e23d338727d9327/aW5kZXg=/
See: htxp://sitecheck.sucuri.net/results/www.wandelhalle-hamburg.de

reported to virus AT avast dot com,

polonus

812

Trojan.Mayachok.17105 detects only by Dr.web
https://www.virustotal.com/file/1091ad4f18ada3c85bd69ac724e32f31585fc1a15a432a21e92d03087066777b/analysis/1338983553/

813

Hacktool or backdoor not detected by avast: htxp://zulu.zscaler.com/submission/show/61e0aaa070b0a7ac40098af1a3a433f0-1338986102
and VT results: htxps://www.virustotal.com/file/80725340b7830288dfe4969eb070a542516a040efc2c1e6473b6051d086f46ab/analysis/
reported to virus AT avast dot com,

polonus

814

https://www.virustotal.com/file/b918547ded8f978ba5bfc2f1dd48cd2bf620635d18c869b1a3c513dd8efa2edf/analysis/1338986572/

815

TR/Flame.A.7

https://www.virustotal.com/file/0a96ba671bebc78e705ae2d2360bf49a3f34f46a7522555eec47b31d90069c71/analysis/

reported to avast! 8)

Edit: detection added

816

Mal/FBJack-A
detection missed…contains obfuscated Iframe…new Facebook HTML malware/spam…redirects to faked Jason Bieber video

https://www.virustotal.com/file/57726a46a0debac32dec0a06d1fa9df2b79566f2f8a2ef8754a66775e86f939c/analysis/1339141426/

reported to avast!

817

Malware sent yesterday to avast but still no detection ?

https://www.virustotal.com/file/06f2dde9b6e726480e52f02fc3af75278fedc1270764b10dbbfb349a9876b23b/analysis/1339248959/

818

Hi MDRockstar,

This because the suspicious file ltastd.exe is flagged as riskware. It might be opened by avast to be run first in sandbox for evaluation,

polonus

819

Not many of the larger AVs are detecting it either. Many that are are using heuristics and are calling it PUP or riskware.

820

Hi DavidR,

Thank you for confirming the PUP status. The poster probably sent it because of this report: http://systemexplorer.net/db/ltastd.exe.html

polonus