http://{BLOCKED}4.243.133

July 12, 2012

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

 Analysis by: Giancarlo Ricamora

---

 URL BLOCKING DATE/TIME: 10 Jun 2012 05:20:00 PM GMT-8

 RATING: HIGH

 DOMAIN: 216.144.243.133

 CATEGORY: Disease Vector

 DESCRIPTION: This is the site where users are redirected to if users, with systems infected with TSPY_BANKER.EUIQ, want to visit the banking site with the string Banco Santander Brasil | Pessoa Jur dica | Atendimento empresarial, empresas. TSPY_BANKER.EUIQ poses as a Google Chrome installer to lure users into downloading and running this malware.

Related URLs

• http://{BLOCKED}5.196.130/bfs/update.dat
• http://{BLOCKED}4.243.132
• http://{BLOCKED}4.243.131
• http://{BLOCKED}4.243.130

Related Malware

• TSPY_BANKER.EUIQ