'Nacha' Exploit

[kjz1]

Die Kriminellen haben noch eine weitere Sicherheitsschicht eingezogen, und wieder mal ist Hetzner prominent dabei:

header:

01: Received: from 92-252-120-97.dip.osnanet.de
02: (xdsl-92-252-120-97.dip.osnanet.de [92.252.120.97])
03: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Mon, 30 Jan 2012 xx:xx:xx -0500 (EST)
05: Received: from [101.115.231.141] (port=61628 helo=[192.168.5.01])
06: 	by 92.252.120.97 with asmtp
07: 	ID: [ID filtered]
08: 	for xxxxx; Mon, 29 Jan 2012 xx:xx:xx +0100

IP: 101.115.231.141 ---> Vodafone Australia

The ACH transaction (ID: 205238215784), recently initiated from your
bank account (by you or any other person), was canceled by the
Electronic Payments Association. Canceled transaction
Transaction ID: 205238215784
Reason for rejection See details in the report below
Transaction Report report_205238215784.doc (Microsoft Word
Document)
13450 Sunrise Valley Drive, Suite 100Herndon, VA 201712011 NACHA - The
Electronic Payments Association

^whois:http://squigglemate.com/w4A9NR5y/index.html
IP: 202.40.167.24 ---> no-rdns.rackservers.com.au


^whois:http://globcleaning.com/jX9jmRkS/js.js
IP: 124.217.226.160 ---> pigeon1.ip-asia.com

^whois:http://www.somerfordmini.co.uk/vFjzp2tY/js.js
IP: 208.113.251.54 ---> ps68286.dreamhost.com

^whois:http://www.weinbau-hoelzl.at/VQ6kRQGP/js.js
IP: 213.203.202.128 ---> nepuweb16.net-publics.de


^whois:http://stern-schmuck.de/dxtds/gate.php
IP: 80.67.17.178 ---> dgws22s12da.ispgateway.de


Vorsicht, hier lauert der Exploit:

^whois:http://goodest.traeumtgerade.de/a/19396d86a55ac35857cc8bbc6ab159b9
IP: 46.4.179.163 ---> static.46-4-179-163.clients.your-server.de/Hetzner

Die Kontaktadresse zur virenverseuchten IP ist interessant: admin@vps-server.ru

[kjz1]

Diesmal als Intuit getarnt:

header:

01: Received: from 114-47-201-158.dynamic.hinet.net
02: (114-47-201-158.dynamic.hinet.net [114.47.201.158])
03: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Tue,  7 Feb 2012 xx:xx:xx -0500 (EST)
05: Received: from  (192.168.1.23) by quickbooks.com (114.47.201.158) with
06: Microsoft SMTP Server ID: [ID filtered]

Dear Sir/Madam,In order to ensure that exact information is being
sustained on our systems, and to provide you better quality of service;
INTUIT INC. has participated in the Internal Revenue Service [IRS] Name
and TIN Matching Program.We have found out, that your name and/or
Employer Identification Number, that is stated on your account does not
match the information obtained from the Social Security
Administration.In order to review the information on your account,
please enter the secure section.Yours truly,INTUIT INC.Corporate
Headquarters2632 Marine WayMountain View, CA 94043o

Link im HTML-Quellcode:

^whois:http://meluza-ige.1accesshost.com/ee07470.html
IP: 69.27.174.10 ---> 69-27-174-10.acedatacenter.com

als Weiterleitung auf die virenverseuchte(!) Seite:

^whois:http://advisor-jobhiring.com/main.php?page=817d6901506e5d51
IP: 216.224.230.219 ---> Phoenix Internet

Spamhaus meint dazu:

Ref: SBL128301
216.224.230.219/32 is listed on the Spamhaus Block List (SBL)

07-Feb-2012 10:49 GMT | SR03
malware dropper @ 216.224.230.219

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL128301

Analyse:

http://wepawet.iseclab.org/view.php?...605847&type=js

[kjz1]

Die Kriminellen gehen mit Nacha noch mal an den Start:

header:

01: Received: from nacha.org (unknown [112.186.230.230])
02: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	Tue,  7 Feb 2012 xx:xx:xx -0500 (EST)  
04: Received: from [60.16.97.55] (helo=ixadooqzlxuw.cgernzxsixojw.ua)
05: 	by  with esmtpa (Exim 4.69)
06: 	(envelope-from )
07: 	ID: [ID filtered]
08: 	for xxxxx; Tue, 6 Feb 2012 xx:xx:xx +0900

IP: 60.16.97.55 ---> China Unicom Liaoning

Das Helo deutet aber näher in Richtung Osten....

The information stated below involves the ACH payment that was Initially
effectuated by you or on your behalf on 02-06-2012.Transaction
ID:90083323476428
Status of the transaction:cancelled
Supplementary information: Please view the detailed report
Faithfully,Violette Coirs.2012 NACHA - The Electronic Payments
AssociationThis email is sent by an automated system. Please do not respond.

Im HTML-Teil dann:

^whois:http://xepirymuco-ely.100freemb.com/ansryee70.html
IP: 69.27.174.10 ---> 69-27-174-10.acedatacenter.com

leitet weiter auf:

^whois:http://hire-centers.net/main.php?page=df56f45d65eea286 Vorsicht, Exploit!
IP: 173.212.222.36 ---> 173-212-222-36.static.hostnoc.net

Auch bei Spamhaus schon erfasst:

Ref: SBL128300
173.212.222.36/32 is listed on the Spamhaus Block List (SBL)

07-Feb-2012 10:48 GMT | SR03
malware dropper @ 173.212.222.36

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL128300

[cmds]

hier auch

header:

01: Received: from host84-38-93-115.tvkdiana.pl (84.38.93.115)
02:   by vs2068031.vserver.de with SMTP; 7 Feb 2012 xx:xx:xx +0000
03: Received: from apache by nacha.org with local (Exim 4.67)
04: 	(envelope-from <transactions [at] nacha.org>)
05: 	ID: [ID filtered]
06: 	for <XXXXX>; Tue, 6 Feb 2012 xx:xx:xx +0100
07: To: <XXXXXXXX>
08: Subject: nacha5_sbj}
09: X-PHP-Script: nacha.org/sendmail.php for 84.38.93.115

^whois:http://zeshald.cwahi.net/xubafohi.html

[kjz1]

Die Russenmafia scheint das Server-Cracken bereits automatisiert zu haben, allerdings sind alle Weiterleitungen bereits tot...

header:

01: Received: from rtr-kr.gigainternet.pl (unknown [91.219.115.1])
02: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	Wed,  8 Feb 2012 xx:xx:xx -0500 (EST)

Attn: Financial ManagerHerewith we would like to notify you about the
recent changes in the FDIC insurance coverage for transaction
accounts.During the period from December 31, 2010 to December 31, 2012
all assets in a "noninterest-bearing transaction account" are provided
with an unlimited coverage by the Federal Deposit Insurance Corporation.
Please note, that this is a temporary arrangement in addition to the
FDIC's basic rules.The term "noninterest-bearing transaction account"
means a usual checking account or demand deposit account on which no
interest is paid. For more information about this temporary FDIC
arrangement, please enter link.Sincerely,Rupert Childs.Federal Deposit
Insurance Corporation

^whois:http://zsk.nerdvana.net.au/hDXsWPAX/index.html
IP: 113.212.99.50 ---> Network Presence

header:

01: Received: from rtr-kr.gigainternet.pl (unknown [91.219.115.1])
02: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	Wed,  8 Feb 2012 xx:xx:xx -0500 (EST)

Attn: Owner/ ManagerBy this message we would like to pay your attention
to the recent alterations in the FDIC coverage rules.During the period
from 12-31-2010 to 12-31-2012 all assets in a "noninterest-bearing
transaction account" are provided with a full insurance coverage by the
Federal Deposit Insurance Corporation. Please note, that this
arrangement is temporary and in addition to the FDIC's common deposit
insurance rules.The term "noninterest-bearing transaction account" means
a conventional checking account or demand deposit account on which the
insured depository institution pays no interest. To learn the details of
this temporary FDIC unlimited coverage, please enter link.Yours
truly,Olen Knapp.Federal Deposit Insurance Corporation

^whois:http://lesalon-emmen.nl/ASopEPQ8/index.html
IP: 46.235.43.52 ---> srv043052.webreus.nl

header:

01: Received: from dial-b1-224-130.telepac.pt (dial-b1-224-130.telepac.pt
02: [194.65.224.130])
03: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed,  8 Feb 2012 xx:xx:xx -0500 (EST)

The ACH transfer (ID: 29959055094229), recently sent from your
checking account (by you or any other person), was canceled by the
other financial institution. Rejected transfer
Transaction ID: 29959055094229
Rejection Reason See details in the report below
Transaction Report report_29959055094229.doc (Microsoft Word
Document)
13450 Sunrise Valley Drive, Suite 100Herndon, VA 201712011 NACHA - The
Electronic Payments Association

^whois:http://ftp.glamourshop.eu/chRgwi0p/index.html
IP: 212.57.32.36 ---> mort.webglobe.sk

[kjz1]

Heute als Nacha am Start:

header:

01: Received: from 187.115.184.246.static.host.gvt.net.br (unknown
02: [187.115.184.246])
03: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
04: 	Fri, 10 Feb 2012 xx:xx:xx -0500 (EST)

The information stated below is related to the ACH transaction that was
originally effectuated by you or on your behalf on 02-02-2012.

Transaction ID:
5169900853803
Transaction status: rejected
Supplementary information: Please open the detailed report
^whois:http://kosa.ayz.pl/2.html

Sincerely,
Violette Coirs.

2012 NACHA - The Electronic Payments Association

Please do not reply to this email, this mailbox is not monitored.

IP: 85.10.207.71 ---> s36.linuxpl.com/Hetzner

Hetzner wieder mal....

als Weiterleitung auf die Schadseite:

^whois:synergyledlighting.net/main.php?page=4e4959105994cf84 Vorsicht, Malware!!!

IP: 173.236.78.113 ---> drover.net.au

Bei Spamhaus auch schon gelistet:

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL128633

[cmds]

weiter gehts mit dem Nacha Zeug

header:

01: From - Tue Feb 14 xx:xx:xx 2012
02: X-Account-Key: account5
03: X-UIDL: [UID filtered]
04: X-Mozilla-Status: 0001
05: X-Mozilla-Status2: 00000000
06: X-Mozilla-Keys:                                                                        
07: 	        
08: Received: (qmail 18203 invoked from network); 14 Feb 2012 xx:xx:xx +0000
09: Received-SPF: neutral (______.netfabrik.de: 2.174.167.199 is neither permitted nor
10: 	denied by domain of nacha.org) client-ip=2.174.167.199; envelope-from=transfers [at] nacha.org;
11: 	helo=nacha.org;
12: Received: from unknown (HELO nacha.org) (2.174.167.199)
13:   by vs2068031.vserver.de with SMTP; 14 Feb 2012 xx:xx:xx +0000
14: Received: from apache by udvedewhojugwygfufwqxauewioc.huksy.ru with local (Exim 4.67)
15: 	(envelope-from <transfers [at] nacha.org>)
16: 	ID: [ID filtered]
17: 	for <poor [at] spamvictim.tld>; Tue, 13 Feb 2012 xx:xx:xx +0100
18: To: <poor [at] spamvictim.tld>
19: Subject: Rejected ACH payment 
20: X-PHP-Script: udvedewhojugwygfufwqxauewioc.wonderware.com/sendmail.php for 2.174.167.199
21: From: "The Electronic Payments Association" <admin [at] nacha.org>
22: X-Sender: "The Electronic Payments Association" <admin [at] nacha.org>
23: X-Mailer: PHP
24: X-Priority: 1
25: MIME-Version: 1.0
26: Content-Type: multipart/alternative;
27: 	boundary="------------02040800404060801060709"
28: Message-ID: [ID filtered]
29: Date: Tue, 13 Feb 2012 xx:xx:xx +0100

institution.

Rejected transaction
Transaction ID: XXXXXXX0747099
Reason for rejection See details in the report below
Transaction Report report_XXXXXXXXXX.doc
<^whois:http://ardeaonlus.it/img/info.html> (Microsoft Word Document) Vorsicht, dürfte Bösartiges vorhanden sein

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

XXX Zahlenfolge als evtl. ID Merkmal entschärft

[kjz1]

Glücklicherweise hat man dort wohl schnell reagiert und den Webserver vom Netz genommen.

[cmds]

Glücklicherweise hat man dort wohl schnell reagiert und den Webserver vom Netz genommen.

wahrscheinlich (hoffentlich) liegt das an meinem Verpetzen bei "Spamcop"

Re: 2.174.167.199 (Administrator of network where email originates)
To: abuse@t-mobile.de (Notes)

Re: http://ardeaonlus.it/img/info.html (Administrator of network hosting website referenced in spam)
To: postmaster@servizi-internet.it (Notes)
To: administrator@servizi-internet.it (Notes)
To: abuse@retelit.it (Notes)
To: abuse@servizi-internet.eu (Notes)
To: info@servizi-internet.eu (Notes)

[kjz1]

Die Viren-Gang macht weiter (auf dem Schwarzmarkt gibt es ja auch 'Boni' pro neu infiziertem Rechner...):

header:

01: Received: from ip-21-208-46-46.dialup.ice.net
02: (ip-21-208-46-46.dialup.ice.net [46.46.208.21])
03: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
04: 	for xxxxx; Wed, 15 Feb 2012 xx:xx:xx -0500 (EST)
05: Received: from  (192.168.1.151) by fdic.gov (46.46.208.21) with
06: Microsoft SMTP Server ID: [ID filtered]

Your Corporated and Business Banking account
Federal Deposit
Insurance Corporation
Dear Sir/Madam,
Your ability to fulfill ACH and Wire transfers has been temporarily
placed on
hold for security reasons, because of the expiration of your security
version.
Please download and install the most recent installations, by opening
this link.

^whois:http://ayaknight.com/_thumbs/12lop.html

As soon as you have installed it, your payment abilities will be
entirely restored.
Faithfully yours, Online Security Department, Federal Deposit Insurance
Corporation.

header:

01: Received: from nat-kro53-135.aster.pl (unknown [77.236.25.135])
02: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 Feb 2012 xx:xx:xx -0500 (EST)
04: Received: from  (192.168.1.79) by bbb.org (77.236.25.135) with Microsoft
05: SMTP Server ID: [ID filtered]

Attention: Owner/Manager

Here with the Better Business Bureau would like to notify you that we
have been
filed a complaint (ID 68192477) from one of your customers with respect
to their
dealership with you.

Please open the COMPLAINT REPORT ^whois:http://mediteo.ch/infoc.html below
to obtain
more information on this case and inform us about your point of view as
soon as
possible.

We hope to hear from you very soon.

Faithfully,

Theresa Morris

header:

01: Received: from mail.distrium.com.br (unknown [200.195.173.210])
02: 	by spammotel.com (Postfix) with ESMTP ID: [ID filtered]
03: 	for xxxxx; Thu, 16 Feb 2012 xx:xx:xx -0500 (EST)
04: Received: from  (192.168.1.119) by bbb.org (200.195.173.210) with
05: Microsoft SMTP Server ID: [ID filtered]

Attn: Owner/Manager

Here with the Better Business Bureau notifies you that we have received a
complaint (ID 97410769) from your customer with respect to their
dealership with
you.

Please open the COMPLAINT REPORT
^whois:http://supercleanjewelry.com/livezilla/about.html below to find more
information on this case and inform us about your position as soon as
possible.

We are looking forward to your prompt reply.

Kind regards,

Gerard Johnson