Monday, May 26, 2014

hsbconlineuk.com Citadel/Zeus Service

Citadel and Zeus control panels were posted on Cybercrime-Tracker. 
I'm on holiday today (thanks troops), and this server is hosted in America (not on my watch), so I'll take a look at it. 

I observed this C&C on May 26th. According to log files, it had been operating since at least March 30th 2014 

hsbconlineuk.com. 14400 IN A 198.176.28.49

NetRange:       198.176.28.0 - 198.176.31.255
CIDR:           198.176.28.0/22
OriginAS:       AS46785
NetName:        QUASAR-DATA-CENTER
NetHandle:      NET-198-176-28-0-1
Parent:         NET-198-0-0-0-0
NetType:        Direct Allocation

The panels were mixed variety of Citadel and ZeuS, in the 'images' directory:

Looks like Nigerian names


After I contacted the NOC and abuse emails, I hacked the server and was going through the control panels taking screenshots, gathering evidence.


hxxp://hsbconlineuk.com/images/ada/cp.php
94 bots



Seemed like a pretty boring setup, but it started acting odd.



Then I got a funny message:




Awesome. 



Details

ala/cp.php
93 bots

BuckC
57 bots

Ebuka
0 bots

ija
33 bots




Other:
.contactemail 
cushlilly@gmail.com
.lastlog
37.221.161.234
inetnum: 37.221.161.232 - 37.221.161.239
netname: FVDE
descr: Tor Exit Node Hosting
country: RO

That contact email is a known 419 scammer.

Zenith Bank (fake bank)
http://db.aa419.org/fakebanksview.php?key=82051

http://bgp.he.net/dns/merchantspeedaircourier.com#_whois

http://www.whoismind.com/whois/franchiseclearing-exchange.com.html


1 comment:

  1. Also uses cuchlilly@yahoo.com - check the control panel on some of the other sites on the same IP.

    Google FoxxyDon Nigeria, and we find this:

    http://www.singlesaroundme.com/ShowUser_uid_foxxydon.aspx
    http://www.nigerianbestforum.com/socialnetwork/profile.php?user=foxxydon

    Name:
    cush
    Birthday:
    28 April 1980
    (33 years old)
    Gender:
    Male
    Marital Status:
    s
    Contact Information
    Street Address:
    235 ogui road
    City:
    enugu
    State or Province:
    nigeria
    Country:
    nigeria
    Phone Number:
    2347030806898
    cushlilly@yahoo.com

    http://badoo.com/en-ng/0366307070/

    http://en.netlog.com/foxxydon
    Name
    foxxy don
    Date of birth
    04/04/1980
    (6 more days)
    Location
    coly city (Enugu)
    Nigeria
    Native language
    English
    Company
    foxxydon webdeisgning and IT company LTD
    Profession
    MG (Other)

    He lives in Nigeria, Enugu.

    http://ng.linkedin.com/pub/cush-lilly/2a/543/b33

    http://www.vconnect.com/foxxydon-group-limited-awka_south-anambra_b108379
    Contact person : Victor Ekene Okoye
    Phone : 08139111452
    Address : 9 ,Aroma Street, Awka South, Anambra, Nigeria
    Email : cushlilly@yahoo.com
    Website : http://www.foxxydonwebgroupltd.com
    Category : Website Designing

    http://www.mydailyflog.com/foxxydon/profile

    ReplyDelete