Greek security researcher Mr. Andreas Venieris , a reader of SecNews, has identified a new version of the well-known Police virus , which takes over computers of unsuspecting users, even demanding a ransom of €1500 for their "release" !!!
The researcher analyzed the malware, determining its origin, and the results of the study are published EXCLUSIVELY on SecNews.
Origin & attack detection
The new version of the “police virus” was identified on a server abroad by Mr. Venieris. The server is equipped with software that launches attacks to steal money from “unsuspecting users through threats and psychological violence,” as the researcher specifically states.
The attack is "launched" from the following domains and hyperlinks:
- https://id953561182-8812263942.u82f47.com/?flow_id=83338&202447=51533/case_id=4509
- https://id891180584-261909387.y58h56.com/
- https://id106788480-7157832757.p16n42.com/
- https://id546061150-1474475308.y58h56.com/
- https://p16n42.com/processing.php?step=1
- https://p16n42.com/processing.php?step=2
- https://p16n42.com/processing.php?step=3
The above links are sent to unsuspecting victims either via e-mail (phishing attack) or are located within websites with dubious content (pornography, betting websites, etc.).
Country of origin/server details
The new version of the “police virus” is located on the server with IP 146.185.220.194. The electronic trail indicates that this IP belongs to the domain hosted-by.mdsnet.org. The domain is located in Russia, specifically in St. Petersburg, at the Internet service provider Petersburg Internet Network Ltd.The geographical representation is as follows:
The search using reverse IP also yielded the following domains:
- h821g5.com
- n5gg87.com
- s21d68.com
but also 12 additional domains that also distribute malware!
Malware analysis
A quick study of the malicious program by Mr. Venieris identified a particularly interesting feature:
[box_alert]
<form action=”https://p16n42.com/processing.php?step=1″ method=”post” onsubmit=”return check(); window.onbeforeunload = null; window.document.body.onbeforeunload = null;”>
[/box_alert]
At this point, the basic functionality of the new version of the virus is identified.
We see that as soon as the user submits the page, the javascript functioncheck();
This function first checks if the user has filled in the paysafecard values correctly. If this has happened then it redirects the user.
Note the line:
https://p16n42.com/processing.php?step=1
The above line led the researcherto the hypothesis that there may be other… steps! And indeed!!
When step=1 €300 is requested.
Apparently, the malicious program then leads to Step 2 (https://p16n42.com/processing.php?step=2) where €500 is requested and finally there is step 3, where €700 is requested.
A total of €1500 for online fraudsters per unsuspecting user!
The program, as mentioned, has some type of "intelligence" regarding the behavior it displays depending on the victim's country of origin:
- When you call from countries where information about the police authorities exists (e.g. Greece, Italy, etc.), the malware comes into operation and demands from the user a sum of money in 3 stages totaling €1500.
- When you call from countries where there is no information about the police authorities (e.g. Romania), it redirects the user to pornographic websites.
The researcher made this finding using proxies from different countries.
Images of malware
