You'll see more of it, friend. yes there are all WordPress, that's why I wrote & exposed it openly in MMD blog.
PS, back to the first case, here's the hint to find the IP who hacked it, please grep the access log the below GET/POST command
Code: Select all/wp-includes/js/tinymce/themes/advanced/skins/default/img/load.php
↑The site you mentioned had the vulnerability to upload file by using it.
Regarding to the phishing email, based on your hotmail email header. Hotmail auth has no mistake in detecting this email as suspicious, PoC:
Code: Select allAuthentication-Results: hotmail.com; spf=none (sender IP is 209.236.116.226) smtp.mailfrom=inmobil2@flash.servidorlinux6.com; dkim=none header.d=flash.servidorlinux6.com; x-hmca=none
X-SID-PRA: supports@flash.servidorlinux6.com
X-AUTH-Result: NONE
X-SID-Result: NONE
Yet I don't undersatand why the email went to the mailbox? Only the user's setting allows that to happen.
Code: Select allReceived: from flash.servidorlinux6.com ([209.236.116.226]) by SNT0-MC1-F32.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900); Sat, 5 Jan 2013 00:45:10 -0800
Btw, see the mailer type is a common script used by spambot:
Realizing the spam group is behind this, I checked down to the relay server too.
I investigated further to find that flash.servidorlinux6.com is an innocent MTA, but it has open relay flaw on Port 587, that the phisher knew about it and use it to relay this spam, below is the PoC: (just sent email to servidorlinux6.com about this)
Code: Select all @unixfreaxjp ~]$ telnet flash.servidorlinux6.com 587
Trying 209.236.116.226...
Connected to flash.servidorlinux6.com.
Escape character is '^]'.
220-flash.servidorlinux6.com ESMTP Exim 4.80 #2 Sat, 05 Jan 2013 21:26:49 -0200
220-We do not authorize the use of this system to transport unsolicited,
220 and/or bulk e-mail.
helo servidorlinux6.com
250 flash.servidorlinux6.com Hello p6e5369.sitmnt01.ap.so-net.ne.jp [218.110.83.105]
mail from: support@servidorlinux6.com
250 OK
rcpt to: unixfreaxjp@checkingyourmta.com
250 OK
Regarding to the PHP rotator:
As you can see they use copy() & mkdir() in PHP each time
someone click on the rotator to make different dirs and evade antivirus
↑That's right (since you brought this up)
and imagine if this techies is used by Exploit Kit infector, and they know its advantages & made it as malware infector based on it.
What we found+post was an evidence of that act, "they" know this things for sure... Bad things happens..
