[Xylitol]

http://www.f-secure.com/weblog/archives/00002590.html

Malicious url:

Code: Select all

http://d7586.com/

https://www.virustotal.com/en/ip-addres ... formation/
https://www.virustotal.com/en/file/1449 ... 376502251/
US landing in attach.

Anti right-click:

Code: Select all

document.ondragstart = test;
document.onselectstart = test;
document.oncontextmenu = test;
function test() {
return false;
} 

Anti Ctrl+U/C/A

Code: Select all

function catchControlKeys(event){
var code=event.keyCode ? event.keyCode : event.which ? event.which : null;
if (event.ctrlKey){
// Ctrl+U
if (code == 117) return false;
if (code == 85) return false;
// Ctrl+C
if (code == 99) return false;
if (code == 67) return false;
// Ctrl+A
if (code == 97) return false;
if (code == 65) return false;
}
} 

Check if the MoneyPak code have a lenght of 14:

Code: Select all

if(input[0].value != '' && input[0].value.length != 14 )

'lock tab' code is in iframe:

[Xylitol]

Code: Select all

http://193.169.86.250/
http://europol.europe.eu.france.id936229153-6035413263.c2354.com/?flow_id=5749&599573=30591/case_id=72361

[Flamef]

Hi,just found a new variant of the Greek version,it is not listed here https://www.botnets.fr/index.php/Landings_GR so please submit it there
This is the site :
hXXp://asvert.7mwo.us/games/83pGFdBUXMKn2dOJ4q9XKoCdFC6ttzHuK_/ZTqVLU-EEkX-les/XcByrlH5UANc34wXBDBXVHDM41Zuct4OJz9Qg~~/MjhkYmJmZDJlNTI4YzQ2OTcwYWFlMTVlMjc1
It doesn't block your computer,it just shows the warning,but it doesnt block the screen.
What i mean is :

P.S: Someone move this post wherever it should be.The old man is a greek politician :D .

[Win32:Virut]

Where did you find it? There are few topics about it on fixitpc.pl (in Polish).

[Xylitol]

Browlock.
http://www.malekal.com/2013/10/07/en-br ... -campaign/
Also 193.169.86.250 courtesy of markusg -> https://www.virustotal.com/en/url/9ea53 ... 382965813/

[Win32:Virut]

_hxxp://nijd2.meyair.com/copyright/TufPN8S9mPZBwbs_/5HAQbfPaX-MGX5DVXIAAmVc35XtQjUNZVN5ZCx_/qHynE4bOE98nfT3/hNb-ICQBlIWvyKeg~~/YzI1MDQ3YmFjNjE0MWI4NjlhODE4MGM0Yz
_hxxp://nijd2.meyair.com/cyberpolice/WYpnL2wEW0kyv1uCsKL9pZtMYXsnOO8O0QXv66gMC46RwHVNxfWr8ex61/usr1UhD1J5fyl72IWtxfEhClViJ8A~~/ZWM4YTQ5NGMxYzhlMTFlNDA2OGVlZDVl

[Win32:Virut]

_hxxp://solif2.sofilos.com/copyright/kJqtzBa4RN1J4D2Nb3WyrN9FF67vkAcru8cf2EF0oCdPSVVu9pl6vlCR_/P6KBg/0vY_/AslRG89VtQXpXjgaqYcg%7E%7E/N2FjZjM3ZTIwN2NlNmUzZTFmNTUyODhmNDAyZ

[Xylitol]

Code: Select all

hxxp://z7752.com/checkout.php?step=1
hxxp://europol.europe.eu.france.id911463879-4405515776.a1751.com
hxxp://fbi.gov.id911463879-4405515776.a1751.com
hxxp://polizei.de.id947857189-3979898726.f1207.com
hxxp://politi.no.id764784884-6682874677.b4326.com
hxxp://polizia-penitenziaria.it.id764784884-6682874677.b4326.com
hxxp://afp.gov.au.id764784884-6682874677.b4326.com
hxxp://politi.no.id764784884-6682874677.b4326.com
hxxp://polfed-fedpol.id764784884-6682874677.b4326.com
hxxp://rcmp.gc.ca.id764784884-6682874677.b4326.com
193.169.87.247

[Xylitol]

xmas browlock (fake browlock)

Code: Select all

http://pxlskmpeiovmspcmjd.www5.kwpekd.stdc.org./

[korn36]

Code: Select all

hxxp://police-guardian.net/

Multilanguage. I ran a script which loops over a list of ISO-3116-1 Alpha-2 country codes and checks if the header.jpg file for each country exists on the site.
Results: AU, AT, BE, BO, CA, CY, CZ, EC, FI, FR, DE, GR, HU, IE, IT, LV, MX, NL, NZ, NO, PL, PT, RO, SK, SI, ES, SE, CH, TR, GB.
Some screenshots: