{"id":348,"date":"2007-11-16T22:00:13","date_gmt":"2007-11-16T20:00:13","guid":{"rendered":"http:\/\/www.mitternachtshacking.de\/blog\/348-schadcode-per-social-enginering-download"},"modified":"2018-05-22T23:07:37","modified_gmt":"2018-05-22T22:07:37","slug":"schadcode-per-social-enginering-download","status":"publish","type":"post","link":"https:\/\/www.mitternachtshacking.de\/blog\/348-schadcode-per-social-enginering-download","title":{"rendered":"Schadcode per Social Enginering Download"},"content":{"rendered":"

Neulich mal wieder in meiner Inbox:<\/p>\n

<\/p>\n

Interessantes Social Engineering, insbesondere die deutsche Adressen. Wie \u00fcblich, das Exe einmal kurz Virustotal<\/a> \u00fcbergeben:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Antivirus<\/th>\nVersion<\/th>\nLetzte Akt.<\/th>\nErgebnis<\/th>\n<\/tr>\n
AhnLab-V3<\/td>\n2007.11.17.0<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
Authentium<\/td>\n4.93.8<\/td>\n2007.11.16<\/td>\nW32\/Trojan.AMBF<\/td>\n<\/tr>\n
AVG<\/td>\n7.5.0.503<\/td>\n2007.11.16<\/td>\nPSW.Generic4.FVG<\/td>\n<\/tr>\n
CAT-QuickHeal<\/td>\n9.00<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
DrWeb<\/td>\n4.44.0.09170<\/td>\n2007.11.16<\/td>\nTrojan.PWS.Lineage<\/td>\n<\/tr>\n
eTrust-Vet<\/td>\n31.2.5300<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
FileAdvisor<\/td>\n1<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
F-Prot<\/td>\n4.4.2.54<\/td>\n2007.11.16<\/td>\nW32\/Trojan.AMBF<\/td>\n<\/tr>\n
Ikarus<\/td>\nT3.1.1.12<\/td>\n2007.11.16<\/td>\nTrojan-Spy.Win32.Goldun.lw<\/td>\n<\/tr>\n
McAfee<\/td>\n5165<\/td>\n2007.11.16<\/td>\nGeneric PWS.y<\/td>\n<\/tr>\n
NOD32v2<\/td>\n2664<\/td>\n2007.11.16<\/td>\nWin32\/TrojanDropper.ErPack<\/td>\n<\/tr>\n
Panda<\/td>\n9.0.0.4<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
Rising<\/td>\n20.18.40.00<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
Sunbelt<\/td>\n2.2.907.0<\/td>\n2007.11.16<\/td>\nTrojan-Dropper.Delf.HT<\/td>\n<\/tr>\n
TheHacker<\/td>\n6.2.9.132<\/td>\n2007.11.16<\/td>\n–<\/td>\n<\/tr>\n
VirusBuster<\/td>\n4.3.26:9<\/td>\n2007.11.16<\/td>\nTrojanSpy.BZub.AFW<\/td>\n<\/tr>\n<\/table>\n

Interessanterweise wurde der Downloadlink nicht irgendwie maskiert, die Datei liegt wirklich auf diesem Server. Ist das ein Trend?<\/p>\n

Ach ja:<\/p>\n

DNS: www.cristhmasx.com –> 58.65.239.99<\/p>\n

APNIC: 58.65.239.99 –> HostFresh Internet Service Provider, Hong Kong<\/p>\n

und besonders witzig: Auf der Webseite steht „this account temporally suspensed for security reason“ aber der Trojaner-Download funktioniert trotzdem<\/p>\n","protected":false},"excerpt":{"rendered":"

Neulich mal wieder in meiner Inbox: Interessantes Social Engineering, insbesondere die deutsche Adressen. Wie \u00fcblich, das Exe einmal kurz Virustotal \u00fcbergeben: Antivirus Version Letzte Akt. Ergebnis AhnLab-V3 2007.11.17.0 2007.11.16 – Authentium 4.93.8 2007.11.16 W32\/Trojan.AMBF AVG 7.5.0.503 2007.11.16 PSW.Generic4.FVG CAT-QuickHeal 9.00 2007.11.16 – DrWeb 4.44.0.09170 2007.11.16 Trojan.PWS.Lineage eTrust-Vet 31.2.5300 2007.11.16 – FileAdvisor 1 2007.11.16 – F-Prot […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[8,10],"tags":[],"_links":{"self":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/posts\/348"}],"collection":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/comments?post=348"}],"version-history":[{"count":0,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/posts\/348\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/media?parent=348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/categories?post=348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/tags?post=348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}