Tracking Cyber Crime: Severa and Black Software AV Affiliates

I know these FakeAV affiliates since 2 weeks now, but I get inside recently with a magic tricks of Krebs, admins seem asleeps or don't want take the risk to activate new accounts (disclosure :þ)

Login page:

Registration form (account must be activated by admin):

Main menu when inside:

Statistics:

Support:

Payements:

News:

Malware download:

Guide:

Traffic rules:

Account Infos:

The downloaded file have a size of 18,5Kb only:

It's a TR/Downloader, here the download procedure:

File are saved in: C:\WINDOWS\Temp\

It will download two files, and in case of fail, it swich to another domain, all in .cz.cc:

Downloaded files:

FakeAV:

SpamBot (detected as Win32/Kelihos.B by Microsoft):

Spam lead to fake pharma:

For Black Software, it's totally identic:

Registration (account must be activated by admin):

Main page:

News:

 Account infos:

Malware download:

The CMS used seem the same as BestAV and Gargarincash.

 Edit: EP_X0FF from KernelMode forum i've made an interesting post about Severa, you can read it here, or on my blog:

More infos about Peter Severa

Related ~
Decoding Security Shield Fake scanner page (20 June 2k11)
Tracking Cyber Crime: Gagarincash AV Affiliate (19 June 2k11)
Tracking Cyber Crime: Inside the FakeAV Business (14 Jun 2k11)
Security Shield 2011 (11 Jun 2k11)
Essential Cleaner (18 May 2k11)
MS Removal Tool (29 Mar 2k11)
Security Shield (9 Dec 2k10)
System Tool (12 Dec 2k10)
Security Tool (10 Aug 2k10)