[AusNOG] Greeting Card spam run potentially targeting Germany, Australia and England

[matthew at auscert.org.au]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings all,

Apologies if you have already heard of or seen this before but we have
seen a few spam runs targeting not only, it seems, Australia but Germany
(de) and England (en):

Wed 09 2006 AUSCERT#2006687ae greeting-e-cards. net/de/

    * http://greeting-e-cards. net/de/ecard_recipient.html
    * and also exists but not seen spammed: /au/ and /en/

Thu 10 2006 AUSCERT#2006fc212 greeting-ecards. net/au/

    * http://greeting-ecards. net/au/ecard_recipient.html
    * and also exists but not seen spammed: /de/ and /en/
    * This seemed to be a fairly large run here in Australia

Fri 11 2006 AUSCERT#2006c34ee greeting-ecards. org/en/

    * http://greeting-ecards. org/en/ecard_recipient.html
    * and also exists but not seen spammed: /de/ and /au/

For all sites:

    * /en/ecard_recipient.html
          o /en/ecard_recipient_err.htm
          o <iframe width=0 height=0 src="flashplayer/install_flash_player.exe"></iframe>
          o /en/flashplayer/install_flash_player.exe
          o MD5 77ff2b14c40d4b230f57e8d905ff487e
    * /au/ecard_recipient.html
          o /au/ecard_recipient_err.htm
          o <iframe width=0 height=0 src="flashplayer/install_flash_player.exe"></iframe>
          o /au/flashplayer/install_flash_player.exe
          o MD5 1e2eef9a4925f735d72840b06dd9ce99
    * /de/ecard_recipient.html
          o /de/ecard_recipient_err.htm
          o <iframe width=0 height=0 src="flashplayer/install_flash_player.exe"></iframe>
          o /de/flashplayer/install_flash_player.exe
          o MD5 4f92076f18afe7f2c793bd6a3883e2ea

Passive dns:

Query: ns1.rimdns. net

greeting-ecards. org     NS    ns1.rimdns. net
greeting-e-cards. net    NS    ns1.rimdns. net
greeting-ecards. net     NS    ns1.rimdns. net
rimdns. net              NS    ns1.rimdns. net
ns1.rimdns. net          A     218.23.229.237
ns1.rimdns. net          A     218.94.136.28
ns1.rimdns. net          A     58.102.73.2

Query: 58.102.73.2

nsd9.serverbackup64. com A    58.102.73.2 
nsd8.sunnuporno. com     A    58.102.73.2
nsd7.paypal-1st. com     A    58.102.73.2
ns1.kesadug. in          A    58.102.73.2
ns1.demon7. info         A    58.102.73.2
ns1.lasord. info         A    58.102.73.2
ns1.utrizen. info   	A    58.102.73.2
nsw1.duoxao. info   	A    58.102.73.2
ns1.irgozy. info         A    58.102.73.2
ns1.rafidns2k. net   	A    58.102.73.2
ns3.rafidns2k. net   	A    58.102.73.2
nsw1.barahlo. net   	A    58.102.73.2
ns1.nakias. net          A    58.102.73.2
ns1.rimdns. net          A    58.102.73.2
ns1.osorgu. biz          A    58.102.73.2

Looks like the rock gang perhaps?

- --SAMPLE EMAILS--
AUSCERT#2006687ae greeting-e-cards.net

Subject: Sie haben eine Grusskarte bekommen.
From: "Info" <no_replyKirchner at greeting-cards.com>
Date: Mon, 07 Aug 2006 22:11:42 +0900
To: auscert at auscert.org.au

Hallo,

Sie haben eine Grusskarte bekommen,klicken Sie auf dem unten stehenenden Link, 
um Ihre Karte abzuholen.  Drucken Sie hier venerable Shintoize Procyon nanostores 
receiver

Note: 
Do not reply to this e-mail, it will be sent to "greeting cards". 

AUSCERT#2006fc212 greeting-ecards.net

Subject: You've got an "e-card" at 'greeting-cards'
From: "Judgment C. Lithographer" <michelle_no_replay at greeting-cards.com>
Date: Wed, 09 Aug 2006 22:36:41 -0700 (Thu 15:36 EST)
To: Auscert <auscert at auscert.org.au>

Dear recipient.
Sender at Michelle sent you an "e-card"
"Here's the Rub" from 'greeting-cards'.
To see your card, click here

This "ecard" will be stored for one week, so
print or save the card as soon as possible.
Hope you enjoy our "e-cards". Spread the love and send one of our "e-cards".

Brought to you by 'greeting cards' - a better way to greet.  

AUSCERT#2006c34ee greeting-ecards.org

Subject: You've got an e-card at "greeting-cards"
From: "Toolkit Q. Effulgent" <no_reply at greeting-cards.com>
Date: Fri, 11 Aug 2006 19:15:56 -0700 (Sat 12:15 EST)
To: Auscert <auscert at auscert.org>

Dear recipient !
Sender at 'Nikol' sent you an "e-card"
"Here's the Rub" from 'greeting-cards'.
Click_here_to_view_the_"e-card".
This "ecard" will be stored for one week, so
print or save the card as soon as possible.
Hope you enjoy our "e-cards"! Spread the love and send one of our "e-cards"!
Brought to you by 'greeting cards' - a better way to greet!
- --SAMPLE EMAILS--

Detects variously as Hanlo or Haxdoor.  Hope this is of some use.  Any
feedback appreciated.

Best regards,

- -- Matthew McGlashan --
Coordination Centre Team Leader             | Hotline: +61 7 3365 4417
Australian Computer Emergency Response Team | Direct:  +61 7 3365 7924
(AusCERT)                                   | Fax:     +61 7 3365 7031
The University of Queensland                | WWW:     www.auscert.org.au
Qld 4072 Australia                          | Email: auscert at auscert.org.au

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (FreeBSD)
Comment: http://www.auscert.org.au/render.html?it=1967
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRNwncSh9+71yA2DNAQIovwP/Z2kMI4x1UKeFGGS8eR54GO1QscJ7dJxJ
HMR3vpcqiJ2gRgQWJ4uCzK7GXZRWH0bqHRifvMkn5vfK8zWFafW9CKkJMxJ09sSy
VPsUZouAKIbrXvAUa11mYta8op+tK3yiinSopdBVW/LDA+9eUFcjmlrsHicVYINK
vPdlEC4mnPA=
=No2q
-----END PGP SIGNATURE-----