
I got another email. This one was interesting, the email was the standard "we had a rat on your computer that we used to take dirty pictures of you,  give us money or we will  send it to all your contacts". 

This is the email that I received.

![](2018/10/image-17.png "The scam email")

It's a fairly standard "give us money or we send dirty photos we took to your contacts" kind of scam email, but this one actually does something that I have not seen previously. The scammers establish "credibility" by actually telling you what your password is. The scammers purchased a dumped site database (that assumedly did not hash or salt passwords), correlated the email address in the DB, and sent out an email.

This scam is incredibly effective when you consider that a vast majority of people use the same password for every account. 

This scam also does something unique; they spoofed the sender of this email  to be me. 

    Delivered-To: hello@[redacted]
    Received-SPF: none (zoho.com: 171.99.132.162 is neither permitted nor denied by domain of [redacted]) client-ip=171.99.132.162; envelope-from=hello@[redacted]; helo=171-99-132-162.static.asianet.co.th;
    Authentication-Results: mx.zohomail.com;
        spf=none (zoho.com: 171.99.132.162 is neither permitted nor denied by domain of [redacted])  smtp.mailfrom=hello@[redacted]
    Received: from 171-99-132-162.static.asianet.co.th (171-99-132-162.static.asianet.co.th [171.99.132.162]) by mx.zohomail.com
        with SMTP id [redacted]; Mon, 29 Oct 2018 19:47:47 -0700 (PDT)

This was an interesting way of finding out that my mail server has incorrectly configured SPF records. This establishes ~darknet spooky hacker credibility~ by sending an email as you. 

I am going to take a shot in the dark that they try several different techniques to do this. The first, is just standard SPF record spoofing to send the message. Since the boilerplate message contains `Please don't try to contact me or find me, it is impossible, since I sent you an email from your email account.`, I am going to assume that sending mail as the recipient is part of the scam in general. 

I also have another theory, that when they send the mail, if SPF records prevent spoofing, that they then try to authenticate with the target mail server to craft the email using the harvested credentials. This would also prove to the scammers if the harvested credentials were valid. This is a technique that has been seen in the wild in previous phishing campaigns, talked about [here](https://research.801labs.org/phishing-campaign-research/).

Digging a little deeper and looking at the email headers above, the IP that sent the email is `171.99.132.162`. This IP appears to be a standard telecom IP address, belonging to a Broadband ISP located out of Bangkok, Thailand. 

![](2018/11/image.png)

Riskiq also only has two carrier-assigned DNS records for this IP address

![](2018/11/image-1.jpg)

It appears that this IP is for sure a private (possibly residential IP). Is this IP the actual IP of the scammer? I hope they they wouldn't be so dumb, but who knows. Lets poke at it on [Shodan](https://www.shodan.io). 

![](2018/11/image-2.png)

The only running service on this host is a web server. Ohhh boy, that's great. Since there was no DNS record for a TLD pointing towards this IP, it's safe to assume that it is a residential/business host that opened up a web server for something, or the scammer is running this from their home IP and has a web server running. Lets see whats on it. 

![](2018/11/image-3.jpg)

It appears this IP address is hosting a Hikvision camera control panel. Cameras are the number one compromised host for botnets or malicious activity on the internet. It's easy to assume that the person hosting this publicly accessible camera control panel left it with default passwords, and somebody logged in and compromised one of the cameras, adding it to a botnet. 

Aside from trying to log in (illegal) there's nothing more I can do for this research. :(


Phishing/Scam campaign research (ep. 2)


An email came in that an end user thought was suspicious. The end user passed it up to one of our team members, who then passed it up to me.

![](2018/10/image.jpg "Initial phishing email")

To start off, this email is just dumb. The sender never bothered to copy legitimate Microsoft email formatting, and the wording is just strange. It doesn’t inspire even the most inexperienced users to “***rectify password expiration***”. Just for fun, let’s look at the url.
 
![](2018/10/image-2.jpg "Suspicious url")

`hxxp://piba.org.br` isn’t a known phishing site, it goes to a Portuguese church website. The site doesn’t matter, what does matter is it looks like the script is being ran through a compromised WordPress site, since it’s going through a `/wp-content/` uploads folder. It appears that somebody could upload a script to the WordPress site that acts as a pass-through to further obfuscate and prevent the campaign from being detected.

Once you click the link that passes through WordPress, you end up at a not-so-convincing office 365 login page.

![](2018/10/image-3.jpg "Bad credential harvesting page")

The email address in the link autofills the email box for your account. Let’s point out some interesting things about this scam site though. 

- the copyright on the bottom of the page has the **wrong year**.
- The site doesn't fill the entire page.
- The buttons and links don't work

 Why don’t they work? Because they’re **images**.
 
![](2018/10/image-4.jpg "Everything is a background image, instead of HTML/CSS")

Let’s look at the url and domain. `hxxp://fwclub.co.za/` is a winemaker’s club. It also doesn’t appear to be running any special framework either that would be exploitable.

![](2018/10/image-5.jpg "No interesting services detected")

There are quite a few open ports as well on this server, four of them are CPanel. It’s possible that the person running this phishing campaign got access to the site’s CPanel and piggybacked off their normal traffic.

Back to the original url, `hxxp://fwclub.co.za/includes/Office1/Login.php`. If we try one directory up, `/Office1/`, it redirects back to this script. So, lets go up another directory to `/includes/`.

![](2018/10/image-6.jpg "All the scripts!")

Hmm, looks like directory listing is turned on, and… there’s a recent backup of their phishing campaign. Let’s look at this backup.

![](2018/10/image-7.jpg)

Yup, that’s the source code to the credential dumping code. A day later, the domain is shut down in one form or another :(
 
![](2018/10/image-8.jpg)

Sophos also flagged the site, finally.

![](2018/10/image-9.jpg)

Well, we’ve still got their source code, so let’s take a look. 

`blocker.php` is a very interesting file.

![](2018/10/image-10.jpg)

The code uses a function I’ve never actually seen in PHP before, `gethostbyaddr()`, which attempts to lookup the incoming IP address to a hostname and possibly an identifier, like as Google or AWS, as well as the host names for a few other malware and phishing scanners.

It also has a list of banned IP addresses, ranges from Google, Cogent, Digital Ocean, ISC, EQNET, INSC, Amazon, Softlayer, EIG, NTT America, MX Logic, British Telecom, Nianet, Elisa, GigeNET, University Of Minnesota(?), NetVision, NET1 Plus, Unified Webhosting, MULTACOM, China Unicom, Dassault Systèmes, Hurricane Electric, CoreSpace, SITA, Orange S.A, Cyber Wurx, CYBERCON, Zayo Bandwidth, Savvis, QTS, Kasetsart University in Thailand(?), Chungnam National University in South Korea(?), RCC, USAA, Comverse, Omnico Hosting, AT&T, Marlink, Airstream, The Department of Defense Network Information Center, and DataPipe. Whew, that was a long list. 

The major group of IP ranges are hosting providers that have a large amount of traffic for VPN/Proxy services. It would make sense that the Phisher’s target audience falls outside of hosting companies, it falls to individual users and companies. The second interesting group of IPs are for a few Universities, none in the list make any sense though. Only one of them has a recognized Cybersecurity course. It appears that MXLogic is also on the list, probably to avoid enterprise email filtering detection for companies that use it. I also found it a little interesting that they blocked the DoD as well.

The last bit of code simply checks if the useragent falls under msnbot, google bot, yahoo bot, etc. They also have a robots.txt that does the same thing.

Once it has checked the incoming request, the index.php file sets the header (URL) to something along the lines of  `login.php?websrc=<random numbers>&dispatched=<random numbers>&id=<random numbers>&email=<compromised email>`. It’s interesting that the phishing author attempted to make the URL look more legitimate and lengthy, as many official emails are.
 
![](2018/10/image-11.jpg)

Once it goes to the Login.php page, it loads the two images and two text boxes that are supposed to look like, and auto fills the email address, to make it look more “authentic”.

On the form submit, it hits `logon.php` (not login). Here’s where something interesting happens. The first thing the script does, is gets the visitors country from geoplugin.net. The second thing it does, is craft a basic email and loads in the submitted username, password, ip, browser, date, and geoip lookup. It then sets the TO: field of this email to ipconfigura@gmail.com, the subject to `“Office365 | <country> | <username>”`  and lastly sets the FROM: field to `“John De Fisher <new@cpanel.com>”`.

![](2018/10/image-12.jpg)

After it crafts this email, it then runs a function called `check()` from inside a PHPMailer directory from the script `smtp.php`, and passes the submitted username and password. Let’s look at this script then.

![](2018/10/image-13.jpg)

This `check()` function is incredibly clever. It connects to the office365 SMTP server, authenticates with the server using the submitted credentials, sets the FROM field to the email `hbergamini@truehomesusa.com`. This is interesting, `truehomesusa.com` doesn’t seem to be flagged and is a legitimate website, they even run on office 365. I take an educated guess and figure that this domain has not fully set up the correct MX records to protect their domain from email spoofing, allowing this test email to not be noticed by most people and not appear in anybody’s inbox. Clever. It then checks to see if the email sent. If it could send, it means that the submitted credentials successfully authenticated with Microsoft and are correct. 

This is something I don’t see that often. It’s commonplace for campaigns to accept and send off any credentials it gets, but this one is checking the validity of the credentials. It also allows the phishing author to provide a “Password not recognized” message, to skeptical users who input a wrong password the first time to see if it works or not.
 
![](2018/10/image-14.jpg)

Aaand that's the analysis of this phishing campaign.


801 Labs Research Portal

phishing

Phishing/Scam campaign research (ep. 2)

Phishing/Scam campaign research