7 replies to this topic

[nosirrah]

I have not reverse DNSed these yet so more are likely .

http://antiworm2008.com

http://goldenantispy.com

http://menacerescue.com

http://antispywaresuite.com

http://trojansfilter.com

[JeanInMontana]

2008 nice to see they are looking ahead.

[nosirrah]

So are we , to spreading the word against them .

Antispywaresuite.com
Antiworm2008.com
Defensaantimalware.com
Filtrodetrojan.com
Goldenantispy.com
Keinegefahr.com
Menacerescue.com
Menacesecure.com
Orantiespion.com
Rescatedeamenazas.com
Trojanerfilter.com
Trojansfilter.com
Trojansfiltre.com
Antiespiadorado.com
Antiespionspack.com
Antigusanos2008.com
Antispionage.com
Antispionagepro.com
Antiver2008.com
Antiwurm2008.com


I am going to see if all of these are live .

[nosirrah]

Same family as here : http://www.malwarebytes.org/forums/index.php?showtopic=1391

On a hunch I tried adding the same suffix to trigger a download , it works .

/data/?450801071357510a5501&mpt=1181125634&gai=swg_av&gli=3948&gff=pp_1084837492&ax=4&wqbp=7484-46197-7784-0

[nosirrah]

http://content.onerateld.com/antiworm2008.com/AntiWorm2008/install_en.exe

http://content.onerateld.com/goldenantispy.com/GoldenAntiSpy/install_en.exe

http://content.onerateld.com/menacerescue.com/MenaceRescue/install_en.exe

http://content.onerateld.com/antispywaresuite.com/AntiSpywareSuite/install_en.exe

http://content.onerateld.com/trojansfilter.com/TrojansFilter/install_en.exe

[nosirrah]

Faking the install with those links does not work , you need to use the suffix I posted above to get different infections .

[nosirrah]

I think these work by automatically rebranding a core installer based on temp info . I was able to get all variants installed by grabbing the 14 meg unbranded installer (AVSystemcare) installer and then interrupting the install process of each variation and then dropping the 14 meg file into the temp folder . I had to clear my temp folders each time to get this to work .

[SwampDiner]

Wow that took a lot of effort, every one of these clones will be added 138.