[CERT-daily] Tageszusammenfassung - Dienstag 11-12-2012

[Daily end-of-shift report]

=======================
= End-of-Shift report =
=======================
Timeframe:   Montag 10-12-2012 18:00 − Dienstag 11-12-2012 18:00
Handler:     Matthias Fraidl
Co-Handler:  Christian Wojner




*** Beware of Bitcoin miner posing as Trend Micro AV ***
---------------------------------------------
"Malware almost always comes in disguise, but some malware peddlers try to do a better job than others. Trend Micro researchers have recently uncovered a piece of malware that tried to pass itself off as "Trend Micro AntiVirus Plus AntiSpyware" (click on the screenshot to enlarge it):Unfortunately for whose who get fooled, the software in question is a Trojan that creates the process svchost. exe and downloads additional malicious components such as a Bitcoin miner application
---------------------------------------------
http://www.net-security.org/malware_news.php?id=2349




*** Multipurpose Necurs Trojan infects over 83,000 computers ***
---------------------------------------------
"The polivalent Necurs malware family has been wreaking havoc in November by infecting over 83,000 unique computers - and that are only the ones detected by Microsofts solutions! The Necurs Trojan is capable of:Modifying the computers registry in order to make itself start after every reboot. Dropping additional components that prevents a large number of security applications from functioning correctly, including the ones manufactured by Avira, Kaspersky Lab, Symantec and
---------------------------------------------
http://www.net-security.org/malware_news.php?id=2350




*** 200,000 new malicious programs detected every day ***
---------------------------------------------
"Kaspersky Lab released its annual Kaspersky Security Bulletin, which provides the overall malware and cyber-threat statistics for 2012. The report revealed significant growth of Mac-specific malware and an explosive growth in the number of threats targeting the Android platform. Overall, Kaspersky Lab detected and blocked more than 1...."
---------------------------------------------
http://www.net-security.org/malware_news.php?id=2352




*** Necurs Rootkit Infections Way Up ***
---------------------------------------------
"Infections from a nasty bit of malware, generally delivered by the Black Hole Exploit Kit, surged in November, hitting more than 83,000 machines. Microsofts Malware Protection Center rates the Necurs rootkit threat as severe. Dubbed a rootkit by Kaspersky Lab, Necurs has many dimensions to it...."
---------------------------------------------
http://threatpost.com/en_us/blogs/necurs-rootkit-infections-way-120712?




*** Joomla (and WordPress) Bulk Exploit Going on, (Mon, Dec 10th) ***
---------------------------------------------
Weve gotten some reports and discussion around many Joomla (and some WordPress) sites exploited and hosting IFRAMES pointing to bad places. Well get to the downloaded in a second, but the interesting thing to note is that it doesnt seem to be a scanner exploiting one vulnerability but some tool thats basically firing a bunch of Joomla and Wordpress exploits at a given server and hoping something hits. Wed like PCAPs or weblogs if youre seeing something similar in your environment.
---------------------------------------------
http://isc.sans.edu/diary.html?storyid=14677&rss




*** Russian ransomware strikes Queensland doctor ***
---------------------------------------------
Seven years of patients files encrypted by crooks. A medical practice in the Australian state of Queensland, the Miami Family Medical Centre, has been hit by ransomware said to originate in Russia.
---------------------------------------------
http://go.theregister.com/feed/www.theregister.co.uk/2012/12/11/queensland_ransomware_attack/




*** Unzuverlässige Trojaner-Warnungen durch Android 4.2 ***
---------------------------------------------
Nur 15 Prozent der in einer Analyse eingesetzten Schadsoftware hat der mit Googles Betriebssystem Jelly Bean (Android 4.2) kommende App Verification Service entdeckt.
---------------------------------------------
http://www.heise.de/security/meldung/Unzuverlaessige-Trojaner-Warnungen-durch-Android-4-2-1765770.html/from/atom10