Zeus/Zbot: Usage frauduleux de votre carte bancaire VISA ?
Dear VISA card holder,
A recent review of your transaction history determined that your card was used at an ATM located in Anguilla, but for security reasons the requested transaction was refused.
Please carefully review electronic report for your VISA card at...
Exemple de sujets utilisés dans les spams :
- possible fraudulent transaction
- possible fraudulent transaction occurred
- possible fraudulent transaction is identified
- possible fraudulent transaction and/or collusion
- possible fraudulent transaction has been executed
- possible fraudulent transaction with your VISA card
- possible fraudulent transaction occurred with your VISA card
- possible fraudulent transaction is identified with your VISA card
- possible fraudulent transaction and/or collusion with your VISA card
- possible fraudulent transaction has been executed with your VISA card...
L'icône du site (shortcut icon) est directement utilisé à partir du véritable site: visaeurope.com
(Cliquez sur l'image pour agrandir)
Au moment de l'écriture de ce billet, le programme téléchargé correspond à celui-ci:
Une fois exécuté, il va télécharger ces fichiers:
Ci-dessous, les informations relatives au nom de domaine.
domain: STOMAID.RU
type: CORPORATE
nserver: ns1.stomaid.ru. 193.104.41.130
nserver: ns2.stomaid.ru. 91.200.164.34
state: REGISTERED, DELEGATED, UNVERIFIED
person: Private person
phone: +380 50 5963256
e-mail: kievsk@yandex.ru
registrar: REGRU-REG-RIPN
created: 2009.12.08
paid-till: 2010.12.08
source: TCI
- AS47560 VESTEH-NET-as ; ORG-VL42-RIPE
Vesteh LLC
Maksim Ananyev
5a Polytehnichna str,
Kiev, Ukraine
+380 44 2464408
- AS49934 VVPN-AS ; ORG-PESV2-RIPE
PE Evgen Sergeevich Voronov
22 Plyazhna str.,
Sebastopol, Ukraine
+380 67 2307487
A l'aide de ZeusTracker, il est possible de lister les autres Zbots ayant été découverts sur ces AS:
- 47560
- 49934
Toujours dans le code de la page intitulée "VISA Card Transactions":
Ici, "file.exe" correspond au fichier distant "http://bersdf.com/grsfx/load.php"
domain: BERSDF.COM
reg_created: 2009-12-02 07:57:17
created: 2009-12-02 08:56:32
changed: 2009-12-03 19:22:58
expires: 2010-12-02 07:57:17
ns1.everydns.net 208.76.62.100
ns2.everydns.net 78.129.207.168
ns3.everydns.net 208.76.63.100
person: Al Aponas
address: 1095 Hwy A1A
zipcode: 32937
city: Satellite Beach
state: Florida
country: United States of America
phone: +1.5087262585
- AS47560 VESTEH-NET-as ; ORG-VL42-RIPE
Vesteh LLC
Maksim Ananyev
5a Polytehnichna str,
Kiev, Ukraine
+380 44 2464408
Liens connexes:
- Fake Visa Electronic Report Serves Up Zbot Data Stealer ( Christopher Boyd (SpywareGuide), December 10, 2009 )
- Visa Targeted (Again) by Zbot Phishers ( Andrew Brandt (Webroot), December 11, 2009 )
- Ongoing VISA scam drop Zeus Zbot ( Gary Warner (CyberCrime & Doing Time), December 12, 2009 )
- Some updates ... Visa/Zeus and Google Jobs ( Gary Warner (CyberCrime & Doing Time), December 21, 2009 )
