2014-01-30 - Affiliate

Icepol ? Urausy via Opener XXX : a subaffiliate of BestSoft/BestAV

Bitdefender recently wrote about the seizure of a server used to distribute "ICEPOL trojan":

Icepol MDN - A Server Snapshot http://t.co/s4Qe4KjR3g
— BitDefenderLabs (@BitDefenderLabs) January 30, 2014

They wrote that it looks like a pyramid scheme as sample were downloaded from another server.

In the Hacker News :

ICEPOL Ransomware Servers seized by Romanian Police that infected 260,000 Computers 2014-01-29

they talk about it as Reveton.

I had no plan to write about them but it looks like it's now time to do it.

From what i saw it was a SubAffiliate of BestSoft ( Urausy and more but NOT REVETON) traffing on porn website and operating via Social Engineering (Fake Codecs) : Opener XXX by Sly VIP

Urausy Design last summer :

Urausy - Summer 2013

Note : Urausy and Sibhost are things from the past now. As Sakura (but totally unrelated), their last days were around middle of December 2013!

If you want to see traces of their activity in open source data take a look at Malekal's list.
Here :

Opener XXX by MalwareDB from Malekal

Or at UrlQuery :

Opener XXX by Urlquery

I didn't kept any fiddler of the infection.
Being able to wget the payload makes me lazy :)

The way distribution worked is explained by Bitdefender Labs.
From a user Point of view Malekal wrote also a nice review here (FR)