- Joined
- April 12, 2009
- Messages
- 23,459
That's nothing new. IIRC some megaupload/rapidshare/whatevercloudstorage download software, jdownload or something like that cracked it years ago.
- Joined
- Apr 12, 2009
- Messages
- 23,459
Dear customer,
This is an automated notification sent from our account security system. You logined your account successfully at 4:27 on twelve 20th form the 125.87.108.* range, but our system shows the 125.10.151.* IP range exists a large number of hackers. As too many customer complaints, the 125.98.104.* IP range has been blacklisted.
We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, visit click:
http://us.battle.net.long.ykienr.in...t.com.cn/account/management/index.xml&app=bam
website fill out some information to facilitate our investigation.
Account security is solely the responsibility of the accountholder. Please be advised that in the event of a compromised account, Blizzard representatives will typically lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play.
If you ignore this mail your account can and will be closed permanently.
Once we verify your account, we will reply to your e-mail informing you that we have dropped the investigation.
Sincerely,
Blizzard account system
Blizzard Entertainment2013
Category: Backdoor
Description: This program provides remote access to the computer it is installed on.
Recommended action: Remove this software immediately.
Items:
containerfile:C:\Documents and Settings\PC1\My Documents\Downloads\perfmod_setup2.1.exe.zip
file:C:\Documents and Settings\PC1\My Documents\Downloads\perfmod_setup2.1.exe.zip->perfmod_setup2.1.exe
Exploit:Java/CVE-2013-0431
Summary
Technical information
Threat behavior
Threat in context
Java is a general-purpose programming language, but cases of this exploit are targeted against the Java plug-in for web browsers. The intent of the Java plug-in is that Java programs (or "applets") can be offered by websites, and run in a "sandbox" where the Java plug-in enforces rules on what the Java applet can do so that it cannot escape restricted environment.
What is an exploit?
Exploits are written to take advantage of weaknesses (or vulnerabilities) in legitimate software. A project called Common Vulnerabilities and Exposures (or CVE) is used by many vendors and organizations and gives each vulnerability a unique number, in this case "CVE-2013-0431". The portion "2013" refers to the year the vulnerability was discovered, and "0431" is a unique identifier. There is more information on the Common Vulnerabilities and Exposures website.
Payload
Downloads and installs files
This exploit downloads and runs files from a remote host. The list of URLs used varies and are only active for a short time. The files that are downloaded can include other malware.
The exploits can run files from a hard-coded URL, or take instructions from the HTML file that loaded them - like loading a URL to run additional malware.
Additional information
Exploit:Java/CVE-2013-0431 uses a vulnerability that was first disclosed when Oracle released a patch in February 2013. The problem lies in the "com.sun.jmx.mbeanserver.Introspector" class which lets an insecure call to invoke a method of "java.lang.reflect.Method" class. An attacker can exploit this issue to bypass sandbox restrictions and run arbitrary code with elevated privileges.
The exploit attacks the security model instead of memory corruption issues. With memory corruption issues, the exploit is dependent on the specific CPU (Central Processing Unit) type and operating systems, and might be affected by mitigation technology like DEP (Data Execution Prevention) or ASLR (Address Space Layout Randomization).
Attacking the security model means that the exploit might be effective on any platform the Java interpreter is on; for example Windows, MacOS or Linux.
Usually the exploits are written using a few Java classes working together. The various class files are bundled into an archive called a JAR, which uses the ZIP file format. Every JAR contains a Manifest.MF file to identify itself to the Java Runtime Environment. Since it is usually found in every JAR, it won't be listed.
Below are some examples of files that exploit the vulnerability described in CVE-2013-0431:
53fe88cfa1405790d97684dc1a5e44c967b455ad
bQLbvMvB.class
HCbdWGC.class
LmrKVvsU.class
MWpWd.hmrf
MzHCrXWlvg.class
pCXrJlkjl.class
YAW.class
zEC.class
cc18b9aceebdaa6b9c420bad230c418075160976
Asd.class
codehex.class
d.class
hw.class
Impossible.class
RunnerGood.class
test.class
test2.class
bef7ebd285841f0f064597e5d7dfb79d248ccde8
cfnD.class
gcSo.class
klowOWkGN.class
lPgOyYffM.class
sHARLdBue.class
VbidYCG.hmrf
YHMrMtQohR.class
yMDIs.class
1a1607652fdd2e3a48ef8392dda559178998a194
BurkinoGoso.class
codehex.class
d.class
hw.class
Impossible.class
RunnerGood.class
54b965557266f2fc29b674750d1f5cd27cdd6cd4
ddp.class
DOkU.class
EeUMUfASp.hmrf
etwGk.class
NQUzDuEIK.class
PYJTIGaCe.class
QkQoLAOA.class
sfslGDub.class
tOKIA.class
1c22ab90fe81db14d69c52596287f6f9e9f055e9
dmq.class
dzsrrk.class
lem.class
mjcluzq.class
oxnadowf.class
pyt.class
rt.class
a0b32e4971d1b9c81dd7667e4db4e1d5cb3c98ad
EGYMsp.class
evJUJyJ.hmrf
FSKdGyKTTW.class
MJKMwLP.class
oegqxHDVz.class
PCMpjy.class
QRdcLx.class
rpjpq.class
WHXNv.class
210fd654b32c33e18665df745e4ac39c9bf4eb01
a.class
alj.class
izemubql.class
me.class
vwxgngt.class
xmd.class
xp.class
874c6b1a64145f8c17f83b67eab71f3e9cc2fb2d
acHthNK.class
bgWMw.class
cRdYJ.class
efbUDeuaSC.class
EqJHhipC.class
irn.class
lXVMM.class
qqpiNAuCR.class
SSuauhLQ.hmrf
dd3f18743914eb75df98a2c3e3b053377888e662
g.class
sox.class
Y.ser
The following articles explain some of the technical details of the weakness this vulnerability exploits:
Oracle Java SE Critical Patch Update Advisory - February 2013
Analysis by Tanmay Ganacharya
Symptoms
Alerts from your security software may be the only symptom.
Prevention
Take these steps to help prevent infection on your PC.
Top
I want to…
Remove malware
Remove difficult malware
Remove FBI/police lock screen
See and search the latest threats
Answer common questions
Fix my software
Download and update
Submit a file
Alert level: Severe
Detected by definition: 1.145.177.0 and higher
First detected on: Feb 21, 2013
This entry was first published on: Feb 21, 2013
This entry was updated on: Dec 11, 2013
This threat is also detected as:
Java/Exploit.Agent.NIF trojan (ESET)
Troj/JavaDl-SA (Sophos)
JV/Blacole-FET!29A92C3EEDD7 (McAfee)
Exploit-FET!CVE2013-0431 (McAfee)
Troj/JavaDl-UG (Sophos)
Trojan.Maljava (Symantec)
JV/Blacole-FET!29A92C3EEDD7 (McAfee)
Exploit-FET!CVE2013-0431 (McAfee)
Exploit.CVE2013-0422.13 (Dr.Web)
Exploit-FET!Exploit-JAR (McAfee)
Mal/JavaJar-B (Sophos)
JV/Blacole-FHA!949BD2B7DE14 (McAfee)
Troj/JavaDl-FC (Sophos)
JAVA_EXPLOYT.BU (Trend Micro)
RDN/Generic Exploit!1mz (McAfee)
Troj/JavaDl-UL (Sophos)
Exploit.Java.458 (Dr.Web)
JV/Blacole-FHA!D0BA98FA1FE3 (McAfee)
Exploit.Java.461 (Dr.Web)
JV/Blacole-FHA!23C205BE86D0 (McAfee)
Java/Exploit.Agent.NLX trojan (ESET)
JAVA_EXPLOIT.WT (Trend Micro)
We don't need a translation, BitCoin is currently in a phase of a dangerous experiment. It may explode right into your face so the best thing you can do is to stay away from it.Routery by "Synology" (what a name) were used as BitCoin Miners, I don't have any English-language article on that, only an forum entry : http://forum.synology.com/enu/viewt...sid=a9b61143dcd1d60c183a03ab4a2072f6&start=15