Website blacklisted, with hidden iFrame and defaced! - VBS:Agent-KZ [Trj]

polonus · 2015-04-23T13:13:16.000Z

Avast detects VBS:Agent-KZ [Trj]
See: http://killmalware.com/cloud9-consulting.com/#
and https://www.virustotal.com/en/url/c643f741808b04910e1fa8d2e9370816bf7963f63a4d2865c8175f6c9eab5aa4/analysis/1429794052/
Quttera finds:
index.html
Severity: Malicious
Reason: Detected known malicious content.
Details: Threat detected according to previously retrieved information
File size[byte]: 3793
File type: ASCII
Page/File MD5: 7A3FBA795798F75DB4A39A87961E71B2
Scan duration[sec]: 0.001000

Blacklisted: https://yandex.com/infected?l10n=en&url=cloud9-consulting.com&redircnt=1429794373.1
and here: http://www.google.com/safebrowsing/diagnostic?site=cloud9-consulting.com
And alerts: http://urlquery.net/report.php?id=1429794194049

ISSUE DETECTED DEFINITION INFECTED URL
Defacement MW:DEFACED:01 htxp://cloud9-consulting.com
Defacement MW:DEFACED:01 htxp://cloud9-consulting.com/404javascript.js
Website Malware MW:BLK:2 htxp://cloud9-consulting.com
Web site defaced. Details: http://sucuri.net/malware/entry/MW:DEFACED:01

Hacked By Anti Security

Link to: https://www.virustotal.com/en/domain/ant.trenz.pl/information/ (has Win32:Vitro!)
IP badness history: https://www.virustotal.com/en/ip-address/192.185.144.185/information/

polonus

Pondus · 2015-04-23T14:33:57.000Z

cloud9-consulting.com.htm
https://www.virustotal.com/en/file/cb0b617e7d54fab5922601cefdb8a96b3bfa0dad0022e478960733b5b962cd34/analysis/1429799504/

Link to: https://www.virustotal.com/en/domain/[b]ant.trenz.pl[/b]/information/ (has Win32:Vitro!)

ant.trenz.pl.htm https://www.virustotal.com/en/file/42032247f50b2b76d6b48e6fd68a0f10df1fbffe85ebb084e823970da030d989/analysis/1429800139/

Announcements