http://{BLOCKED}.130.35:8080/forum/viewtopic.php

September 02, 2013

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

 Analysis by: Clarisa Joyce Velasco

---

 URL BLOCKING DATE/TIME: 01 Sep 2013 08:20:00 PM GMT-8

 RATING: HIGH

 DOMAIN: 198.57.130.35

 CATEGORY: Disease Vector

 DESCRIPTION:

TSPY_FAREIT.AFM attempts to steal stored account information and other sensitive information and send the gathered information via HTTP POST to this URL. This FARFEIT variant is the final payload of a Blackhole Exploit Kit related spam run.

Related URLs

• http://webmail.{BLOCKED}antravel.com:8080/forum/viewtopic.php
• http://sch.{BLOCKED}c.cy/DH8xSJxy.exe
• http://{BLOCKED}panagiotidou.gr/qntUYid.exe
• http://horizon.{BLOCKED}ertech.org/1k7Yvm.exe
• http://{BLOCKED}ndart.com/f2kr.exe

Related Malware

• TSPY_FAREIT.AFM