XyliBox: FakeInst

Showing posts with label FakeInst. Show all posts

Sunday, 20 November 2011

Wizard Mobile Affiliate (JAVA/SMSSend - Android/FakeInst)

Same principle as ZipWap
User download a JAR/APK file, and need to send SMS's for install the app.

Advert:

Main:

News:

Settings:

Payments:

Statistics:

Midlets:

Midlet URL's:

http://jimm-download.com/files/Jimm_NEW_3546.jar

http://jimm-download.com/files/Jimm_NEW_3546.apk

http://xvideo-collection.com/files/Best_Porn_3546.jar

http://xvideo-collection.com/files/Best_Porn_3546.apk

http://vk-client.ru/files/VK_Client_2011_3546.jar

http://vk-client.ru/files/VK_Client_2011_3546.apk

http://x-porn-tube.net/files/X-Porn_Tube_3546.jar

http://x-porn-tube.net/files/X-Porn_Tube_3546.apk

http://official-opera-mini.ru/files/Opera_Mini_6_3546.jar

http://official-opera-mini.ru/files/Opera_Mini_6_3546.apk

http://new-mobile-skype.ru/files/Mobile_Skype_3546.jar

http://new-mobile-skype.ru/files/Mobile_Skype_3546.apk

http://mobile-mamba.ru/files/Mobile_Mamba_3546.jar

http://mobile-mamba.ru/files/Mobile_Mamba_3546.apk

http://mobile-mail-agent.ru/files/Mail_Agent_3546.jar

http://mobile-mail-agent.ru/files/Mail_Agent_3546.apk

Landing URL's:

http://jimm-download.com/?sid=3546

http://xvideo-collection.com/?sid=3546

http://vk-client.ru/?sid=3546

http://mob2011.ru/?sid=3546

http://x-porn-tube.net/?sid=3546

http://official-opera-mini.ru/?sid=3546

http://new-mobile-skype.ru/?sid=3546

http://mobile-mamba.ru/?sid=3546

http://mobile-mail-agent.ru/?sid=3546

Screenshots of sites:

Create APK:

Modules:

Sub-account:

Referrals:

Frequently Asked Questions:

Tickets:

According to VirusTotal, 15 AV detect these JAR files as Java/SMSSend:
http://www.virustotal.com/file-scan/report.html?id=79cf653779d84f085025c859c6df3958b9edffb7581b124ea6679935c5645a71-1321784975

And only 10 AV detect these APK files as Android/FakeInst:
http://www.virustotal.com/file-scan/report.html?id=e732600b11cb617d0e3f29cccb4e1626de3c6d4897c1e968b82b6d9379bca152-1321785109

Saturday, 16 April 2011

HoaxSMS Fake installers (Flash player / WinRAR )

Hoax SMS again, this time for Adobe Flash player and Winrar
----
Flash Player:
Flash_player come from: 109.120.157.81
Some files are sent in \%temp%\
No EULA shown.
MD5: e54c20c71f1cb78f25246c970f70c528

Network activities:

http://77.221.149.219/program/open_archive

http://77.221.149.219/program/get_prefix

http://77.221.149.219/program/check_key 

The IP 77.221.149.219 is "zip-archive.com" a "Pay Per Install" service.

----
WinRAR:
This one made me laught, a winrar installation who use a WinZip icon.
When opened, files are sent to C:\Documents and Settings\%userprofile%\%appdata%\winzipsoft
WinRAR come from: download-server-43.net
No EULA shown.
MD5: 134fcb1ecac0db185e2d3259a26a3e50

Chars are badly displayed because i've not enabled cyrilic support.

Net work activity:

http://wlnrar-auth5.net/pass_request_mt/?guid=7fc6bebcd8796ef5e5c72e43045f3654&parid=0&xnum=&xid=&nomer=undefined&param=&fn=dxl3.exe&xtime=29844&lp=9f54cb3ef8cce8e472ddf6de2736dfbb

----

Hoax SMS in the past:
findvirus.ru: HoaxSMS Fake installers - BitDefender/Avast/Avira/Dr.Web/Mcafee/Norton Fake products

HoaxSMS Fake installer (Avast) - Avast-antivirus-francais.exe

HoaxSMS Fake installers (Opera / WinRAR 2011)

HoaxSMS Avast.exe

HoaxSMS (uTorrent / Flash Player) FLASH10.exe

HoaxSMS Fake installers (WinRARc / WinRAR 2010)

Tuesday, 5 April 2011

findvirus.ru: HoaxSMS Fake installers - BitDefender/Avast/Avira/Dr.Web/Mcafee/Norton Fake products

Another website who try to extort money using fake installers.

Nice collection right?:
A-squared HiJackFree ~ A-squared HiJackFree Antivirus Free 4.5
AVG Anti-Virus ~ AVG Anti-Virus Free
ArcaMicroScan ~ ArcaVir Internet Security 2009
Avast! Antivirus ~ Avast! Free Antivirus
Avira Antivirus ~ Avira AntiVir Personal
BitDefender Antivirus ~ BitDefender Antivirus
Comodo Firewall Pro 4 ~ Comodo Firewall Pro 4.0.141842.828
Dr.Web Antivirus ~ Dr.Web Антивирус
ESET NOD32 Antivirus ~ ESET NOD32 Антивирус
GeSWall 2.9.0 ~ GeSWall Firewall 2.9.0
Loaris Trojan Remover ~ Loaris Trojan Remover
McAfee Rootkit Detective ~ McAfee Rootkit Detective 1.1
McAfee VirusScan ~ Антивирус McAfee
Norton AntiBot ~ Norton AntiBot AntiSpyware
Norton Antivirus ~ Norton AntiVirus 2011
Online Armor Free ~ Online Armor Free v4.0.0.44
Outpost Antivirus ~ Outpost Security Suite PRO 2009
Outpost Firewall Pro ~ Outpost Firewall Pro 2009 6.7.3
PC Tools Firewall Plus ~ PC Tools Firewall Plus 6.0.0.88
PC Tools Internet Security ~ PC Tools Internet Security
Panda Antivirus ~ Panda Antivirus Pro 2011
RusRoute Firewall ~ RusRoute Firewall 1.7.1
SUPERAntispyware ~ SUPERAntiSpyware Free 4.35.1002
Spybot Search & Destroy ~ SpyBot - Search & Destroy
Spyware Doctor ~ Spyware Doctor 7.0.0.543
Spyware Terminator ~ Spyware Terminator 2.7.0.260
Sunbelt Kerio Personal Firewall ~ Sunbelt Personal Firewall 4.6.1861
Trend Micro Internet Security ~ Trend Micro Internet Security 2010
WinPatrol ~ WinPatrol 17.1.20010.1
ZoneAlarm Extreme Security ~ ZoneAlarm Extreme Security 2010
ZoneAlarm Firewall Free ~ ZoneAlarm Free Firewall 9.1.007.002
Антивирус Касперского ~ Антивирус Касперского 2011 (It's Kaspersky)

Code to send: 76633399892169157
Code to send: 76633399594169160
Code to send: 76633399899169103
Code to send: 76633399890169135
Code to send: 76633399534169088
Code to send: 76633399723169208
Code to send: 76633399039169173
Code to send: 76633399092169126

Some of these files are goods, that not the case for all.
BitDefender_Antivirus_Pro_2011.exe for example

1) Language selection (And you have not really the choice)

2) Destination folder for the installation:

3) Simulate an activity:

4) Ask for money by SMS:

5) Setup complete:

The man who created this use zipmonster.ru, a know website for this type of things.
The customer support of zipmonster.ru is: zip-help.com

Another one: BitDefender_Downadup_Removal_Tool.exe

Avast: Avast!_Virus_Cleaner.exe:

Avira: Avira_AntiVir_Removal_Tool.exe:

Dr.Web: Dr.Web_Trojan.Encoder.19_Decrypt.exe:

Mcafee: McafeeRootkitDetective.exe:

McAfee: McAfee_VirusScan_Plus_2009.exe:

Norton: NortonOnlineBackup.exe:

Last thing: Have you noticed these fake installers have not displayed an EULA ? (End User License Agreement)

If you want download an Antivirus, make sure you are on the official website.