Fake Websites Driving Malware Installations

Posted by John B. Frank Thursday, May 14, 2009

Scam / Fraud / Hoax Alerts
Source: F-Secure
Complete item: http://www.f-secure.com/weblog/archives/00001682.html

Description:
One
of our Web Security Analysts came across a website (118,000 ranking in Alexa)
that drives users into installing a fake Adobe Flash Player file. The site
prompts a message requesting the user download "a new version of Adobe Flash
Player" in order to view a video on the site.

Looks pretty authentic,
right? It even offers to download an "install_flash_player.exe" file for you.
The analyst was using a Linux system though, so this seemed slightly
odd. Turns out the site is a (pretty good) fake. Unless a visitor takes a
hard look at the address bar, it's pretty easy to be fooled. The
downloaded installer also looks like the original Adobe Flash Player installer,
though the checksum and digital signatures point out the
difference.

nstall_flash_player.exe version 10.0.22.87
md5:
51F26C0051E97A91145971FE5BC632FF

malware_install_flash_player.exe
md5:
71AD0C4A4168AA98BB20E3561E505CC7

Based on a reverse domain lookup on the
malware link, the fake site is hosted in Bulgaria.

E-Secure-IT
https://www.e-secure-it.com

0 comments

Post a Comment

Learn More About Us

Find out how our patented technology can empower your financial institution.

Our secure two-factor online banking authentication eliminates dangerous passwords and usernames and replicates the same trusted process used to access cash at ATM's. (Insert Bank Issued Card, Enter Bank Issued PIN)

There is an R.O.I. as FI's also earn recurring revenue from each transaction conducted using our PCI 2.0 Certified PIN Entry Device. Our technology also provides a unique real-time P2P "Instant-Transfer" which allows your online banking customer to transfer cash from ANY of their bankcards to ANY other bankcard...with the Swipe of a card.

Help your bank eliminate phishing and your customers avoid identity theft by providing them with the ability to stop typing and start swiping. There is no safer way to conduct financial transactions online than by 3DES DUKPT encrypting the cardholder details, which we do at the mag-head "inside the box/outside the browser."

All Top Banking