http://storage5.{BLOCKED}c.itmages.ru/i/12/0601/h_1338571059_9957469_b48b167953....

August 10, 2012

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

 Analysis by: Paul Jayson Tiu

---

 URL BLOCKING DATE/TIME: 11 Jun 2012 07:25:00 PM GMT-8

 RATING: HIGH

 DOMAIN: storage5.static.itmages.ru/

 CATEGORY: Disease Vector

 DESCRIPTION:

TROJ_AGENT.BCPC connects to this site to download and execute a malicious file detected as ADW_EOREZO. TROJ_AGENT.BCPC is one of the “Printer Virus” that prints several lines of characters when executed.

Related URLs

• http://dles.{BLOCKED}o.com/clib/suf.exe?{random string}
• http://prof.{BLOCKED}o.com/cgi-bin/create_profile.cgi
• http://log.{BLOCKED}o.com/cgi-bin/trace.cgi
• http://ads.{BLOCKED}o.com/cgi-bin/advert/getads?did=43

Related Malware

• ADW_EOREZO
• TROJ_AGENT.BCPC

Related Web Attack

• Understanding the Printer Virus