cNotes 検索 一覧 カテゴリ

US Airways 2

Published: 2012/04/08

観測日: 2012/4/6

通数: 600通/day

手法: 文中のリンクをクリックさせることで、マルウェアダウンロードサイトへ誘導

目的: マルウェア感染

特徴:

4/7の「US Airways」のバリエーション。

改竄ページに設置されるhtmlファイルのファイル名が統一的ではなく、7文字のランダムな文字列を利用するようになってます。


メール本文は前と同じ。

文中で指定されているリンク=改竄サイトに設置されるファイルのファイル名が統一的なものではなく、7文字のランダムな文字列に変更。

domainpath
http://mandalayfreerider.com/TreadImage/phmexhm.html
http://smansixbo.sch.id/media/uvdpTTe.html
http://landscapedesign.org.ua/wp-content/themes/slidette/PeEjVPe.html
http://arjomax.eu/MmTixUF.html
http://clor.fr/language/ru-RU/jfJPAcX.html
http://morostech.com/images/OzlrphU.html
http://newfoundland-and-labrador.net/wp-content/plugins/akismet/OfbDFnV.html
http://conchoursclassics.com/auto/AgdaCKK.html
http://creativecrimes.nl/mGfFEgX.html
http://lehrmanntraining.de/oeffentlich/pix/pdf/iSZpaLk.html
http://sklep.okay-sklepy.pl/images/NHmeZhz.html
http://audiomediatv.com/inversiones/templates/rhuk_milkyway/fHeCENG.html
http://csportal-bg.info/forum/xgPDYlA.html
http://hoveniersbedrijfrjansma.nl/wp-content/themes/ecobiz/cache/OnUhaeZ.html
http://neboshop.ru/yml/xvXidZp.html
http://crthailand.com/upload/company/aOAbpzE.html
http://emailstudio.fr/kDLuvJL.html
http://indianpalacefreising.de/templates/ja_purity/zGbEBuh.html
http://nelsonpublicidade.com.br/templates/system/nIZDs1z.html
http://pearl-pk.com/pearl/images/txsoFaI.html
http://primfix-elite-arbitrage.com/simogeo-Filemanager/userfiles/MDiYJSM.html
http://quranschoolinc.com/gPvYBBD.html
http://amdac.co.uk/templates/ja_purity/DSVCCSG.html
http://asteraplys.ru/includes/yMdOuOB.html
http://galaxy-warez.com/prezz-galaxy/VSybFnE.html
http://paforu.com/codelibrary/inc/SMmestJ.html
http://208.53.168.5/~mythucom/EcLrZeX.html
http://abelabosede.com/administrator/templates/khepri/ghNULXS.html
http://adamlgoldstein.com//wp-content/themes/twentyeleven/XBGReAJ.html
http://alain-mace.com/administrator/GZxBPVD.html
http://allgk.com/XiHsdGo.html
http://cyborgchat.altervista.org/cyborg/dokbsum.html
http://dailej.net/scorp/mcazyAu.html
http://dialcmoviles.com/scorp/mlxAox1.html
http://fashionbuddies.com/wp-content/plugins/stats/zFDvnKI.html
http://my-movie-database.de/templates/galeries/fTtihEj.html
http://rapnowogard.pl/shit/IDLFusL.html
http://sepedahan.com/file/igYiaOe.html
http://veliunlu.com/wp-content/plugins/akismet/iUJdOxt.html
http://68.169.46.7/~tailieu2/forum/images/vXIeBfM.html
http://avtodor-ural.ru/media/JN1pnMR.html
http://band2.com/images/nJaVrNB.html
http://bandengmontok.com/wp-content/themes/TheCorporation/UGREuRU.html
http://copperfieldhotel.co.uk/pages/gRZlmnN.html
http://great-breads.com/njtPzUk.html
http://hifi-leipzig.eu/images/banner/H1ZlbJE.html
http://megagalactic.org.ua/wp-content/themes/organic-theme/ppUuSoH.html
http://mib.edu.my/tmp/BbzL1fc.html
http://mypassion4cars.com/wp-content/plugins/akismet/gfauIEg.html
http://p30download.gozarweb.com/Forum/xtDjbRn.html
http://qpay.com.vn/wp-includes/js/jquery/ylZX1bK.html
http://templatesville.com/wp-content/themes/twentyten/gZBiHSs.html
http://agadoodles.com/VNFYSkJ.html
http://bbook.biz/scorp/RedzAPh.html
http://breeze.pcollab.com/dreamworks2/uploads/oaV1HSh.html
http://caycanhvietnam.net/diendan/lMuLtxp.html
http://crossbonesguild.com//images/stories/KkTh1Lc.html
http://djurs.kernelglobal.dk/wordpress/cvmTuJn.html
http://dkmarket.co.kr/images/RZNmRfa.html
http://dricaza.com/pILLdPc.html
http://energycommercialization.com/AxJavgh.html
http://fixacar.org.ua/wp-includes/images/smilies/lvzVsFJ.html
http://gabriels-pizzeria-wiesbaden.de/images/UhroAcg.html
http://gx-hosting.com/arena/IlZiVBS.html
http://langpra.com/vtBaHhY.html
http://lekiuh.10h.us/RxfTStM.html
http://lightship-pos.com/yKafOLv.html
http://mirabab.fr/eiYLxDS.html
http://rt.kh.ua/wp-includes/images/smilies/MBADoyo.html
http://whiteandcare.com/upimg/JHYiNai.html
http://a1bizlinks.com/foCOSmu.html
http://blackr00t.netne.net/bNoOoPs.html
http://bulletup.com/wp-content/themes/twentyten/hKExVDV.html
http://camassatouch.com/scorp/1ZMRvTJ.html
http://citycontractcleaners.co.uk/templates/beez/GBMBIeP.html
http://ez123webhost.com/members/templates/XxOOyoh.html
http://pescapesca.cl/BuHKIsC.html
http://pierre-lafoucriere.com/wp-admin/ytjVBay.html
http://sjinfra.co.kr/board/data/eng_board_store/hAgumCg.html
http://smkn1jamblang.sch.id/modul/BUIPCHs.html
http://solidusscale.com/upimg/yjP1IhM.html
http://soyminero.com.ar/wp-content/backups/jzzprSz.html
http://verify-paypal.net/IuLJXEu.html
http://acnstudios.com/bizdirect/files/upload/BzrMbdg.html
http://baby2day.co.za/images/HmFgJng.html
http://bedeckedandbeadazzled.com/images/shop/storefronts/1/categories/nublor/uCDvHCx.html
http://beogame-online.net/lapac/plugins/buttons/A1xhZvu.html
http://bodyandsenses.dk/joomla/templates/atomic/UugvzzI.html
http://candlecottage.com/IxhMGfz.html
http://childrenlearningtools.com/wp-content/themes/twentyten/HHMFnMk.html
http://clubhippiquedegrasse.com/bwgest/planning1/uOFEInH.html
http://compagnie-bagamoyo.org/images/background/ae1bTAc.html
http://copcochemtech.co.th/images/FRVPouf.html
http://del-irk.ru/templates/delirk/ueeJIDf.html
http://delta-holod.ru/assets/site/jZGpGKT.html
http://doktorlarkulubu.biz/forum/tp-images/File/eVsDGtI.html
http://eda2a.com/FtsfvSS.html
http://europe-banks.com/eporue/upload/sYbppvZ.html
http://evraire.ca/nDsMYDH.html
http://guiasolidaria.com/templates/beez/xjaxrFH.html
http://love-youpeng.net/bbshop451/images/kdmzmGo.html
http://mebolaget.se/wordpress/ssntgEi.html
http://mining.org.ua/wp-includes/images/smilies/rEubdsT.html
http://mnhcamp.com/wp-includes/images/ZtuHGsR.html
http://old.bip.miastko.pl/download/zalaczniki/ZG1FFvg.html
http://parsianinc.com/KAZRF1l.html
http://perfectbody.in/vjgUtXU.html
http://qrz.ge/qrz.ge/includes/vrKRBRL.html
http://saigonlink.vn/wp-content/plugins/akismet/MHchvHL.html
http://soft-guide.dk/joomla15/templates/ja_purity/XpbrRiD.html
http://tamarackarmory.com/wp-content/themes/irrigation/VDUSrJp.html
http://vgelendjike.ru/yNSUiOd.html
http://y-cult.net/rikHifG.html

これらのサイトの存在する国はこんな感じでアメリカが多いです。

UnitedStates45
Germany15
Denmark5
France5
RussianFederation5
Thailand5
Ukraine5
Korea3
Poland3
Vietnam3
Canada2
Indonesia2
Malaysia2
Netherlands2
Georgia1
Singapore1
Turkey1
UnitedKingdom1
8

次のジャンプ先が早期にNXDOMAIN化され対策済みです。


[カテゴリ:spam観察日記]

by jyake