Spamvertised American Airlines themed emails lead to Black Hole exploit kit

Spamvertised American Airlines themed emails lead to Black Hole exploit kit

by | Jul 13, 2012 | Industry Intel, Threat Lab

Reading Time: ~ 2 min.

American Airlines customers, watch where you click! Cybercriminals are currently spamvertising millions of emails impersonating the company in an attempt to trick end and corporate users into clicking on the malicious links found in the spamvertised email.

Upon execution, the campaign redirects users to a Black Hole exploit kit landing URL, where client-side exploits are served against outdated third-party software and browser plugins.

More details:

Screenshots of a sample spamvertised email:

Once users click on any of the links in the spamvertised email, they are exposed to the following fake “Page loading…” page:

Spamvertised URLs: hxxp://luxify.net/wp-admin/aair.html redirects to -> hxxp://princess-sales.net/main.php?page=7e45713861176c6b (203.237.211.223) or hxxp://ghanarpower.net/main.php?page=8c6c59becaa0da07 (203.237.211.223)

Upon successful client-side exploitation of CVE-2010-1885, the Black Hole exploit kit drops the following MD5 on infected hosts: MD5: c70d309171d9844f331081b3c3d80ff

Detection rate: Detected by 25 out of 42 antivirus scanners as Trojan.Generic.KDV.664936; Worm:Win32/Cridex.E

Upon execution, the sample phones back to 210.56.23.100:8080/za/v_01_b/in/

Responding to 210.56.23.100, AS7590, COMSATS Commission on Science and Technology for Sustainable Development in the South, are the following command and control servers:

cpojkjfhotzpod.ru
upjachkajasamns.ru
cruoinaikklaoifpa.ru
sumgankorobanns.ru
fedikankamolns.ru
ciontooabgooppoa.ru
caskjfhlkaspsfg.ru
csoaspfdpojuasfn.ru
amanarenapussyns.ru
cparabnormapoopdsf.ru
cjhsdvbfbczuet.ru
caoodntkioaojdf.ru
clkjshdflhhshdf.ru
zolindarkksokns.ru
cnnvcnsaoljfrut.ru
cruikdfoknaofa.ru
cjiahkhklflals.ru
dinamitbtzusons.ru
cjjasjjikooppfkja.ru
ckjsfhlasla.ru
kroshkidlahlebans.ru
ckjhasbybnhdjf.ru
xspisokdomenidgmens.ru
dkijhsdkjfhsdf.ru
dhjikjsdhfkksjud.ru
dsakhfgkallsjfd.ru
dphsgdfisgdfsdf.ru
dkjhfkjsjadsjjfj.ru
debiudlasduisioa.ru
dpasssjiufjkaksss.ru
doorpsjjaklskfjak.ru
dnvfodooshdkfhha.ru
xstriokeneboleeodgons.ru
dpaoisosfdhaopasasd.ru
rushsjhdhfjsldif.su
dkjhasjllasllalaa.ru
puidhfhhaoadans.su
somaniksuper.ru
superproomgh.ru
samsonikonyou.ru
phfhshdjsjdppns.su
dhjhgfkjsldkjdj.ru
poosdfhhsppsdns.su
insomniacporeed.ru

The name servers infrastructure of these domains is parked at the following IPs 94.63.147.96; 171.25.190.249; 188.116.32.177

Webroot SecureAnywhere users are proactively protected from this threat.

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on  Twitter.

Blog Staff

About the Author

Blog Staff

The Webroot blog offers expert insights and analysis into the latest cybersecurity trends. Whether you’re a home or business user, we’re dedicated to giving you the awareness and knowledge needed to stay ahead of today’s cyber threats.

4 Comments

  1. bargain properties costa del sol
    bargain properties costa del sol on May 1, 2016 at 9:33 am

    I really like what you guys are usually up too.
    This type of clever work and exposure! Keep up the great works guys I’ve
    you guys to our blogroll.

  2. Joshua Petraglia
    Joshua Petraglia on August 8, 2016 at 11:32 am

    Thanks for all your feedback! Glad you enjoy the information 🙂

    If you would like to further participate with us, please join our Webroot Community where you can find solutions to all different kinds of problems and maybe even be able to help someone else yourself! We’d love to have you join.

    https://community.webroot.com/

  3. compro galpão.
    compro galpão. on November 15, 2016 at 8:39 pm

    Contamos com uma audiência qualificada e interessada na aquisição de imóveis para
    compra, locação, temporada ou análogo investimento.

Trackbacks/Pingbacks

  1. Spamvertised ‘PayPal has sent you a bank transfer’ themed emails lead to Black Hole exploit kit « Webroot Threat Blog - [...] execution the sample phones back to a well known command and control server - 87.204.199.100/mx5/B/in/ which we’ve already seen in…
  2. Cybercriminals impersonate AT&T’s Billing Service, serve exploits and malware « Webroot Threat Blog - [...] Once executed, the sample phones back to hxxp://87.204.199.100:8080/mx5/B/in/. We’ve already seen the same command and control served used in several malware-serving…
  3. Cybercriminals spamvertise bogus greeting cards, serve exploits and malware « Webroot Threat Blog - [...] The second sample phones back to 87.204.199.100:8080/mx5/B/in/ not surprisingly, we’ve already seen this command and control server used in…
  4. ‘American Express Alert: Your Transaction is Aborted’ themed emails serve client-side exploits and malware « Webroot Threat Blog – Internet Security Threat Updates from Around the World - [...] The last time we came across this IP (210.56.23.100), was in July 2012′s analysis of yet another malicious campaign,…
  5. Bogus IRS ‘Your tax return appeal is declined’ themed emails lead to malware « Webroot Threat Blog – Internet Security Threat Updates from Around the World - [...] Your Transaction is Aborted’ themed emails serve client-side exploits and malware“; “Spamvertised American Airlines themed emails lead to Black…
  6. ‘Your Kindle e-book Amazon receipt’ themed emails lead to Black Hole Exploit Kit « Webroot Threat Blog – Internet Security Threat Updates from Around the World - [...] Spamvertised American Airlines themed emails lead to Black Hole exploit kit [...]
Share This