Inside a (The?) Simda Affiliate : Партнёрка Podmena (formerly Chesto)

I won't study the Styx "Kein" in details (at least for know).
Exploitation graph should be not far from the one in Styxy Cool (+ CVE-2013-2472 (?) click2play bypass + CVE-2013-2465  + CVE-2013-2551 + some soc-eng)

So ?

podmena2014.com

188.138.1.170

8972 | 188.138.0.0/17 | PLUSSERVER | DE | INTERGENIA.DE | INTERGENIA AG

Whois :
-----------
Domain name: podmena2014.com
Registrar: Regtime Ltd.
Creation date: 2013-09-25
Expiration date: 2014-09-25

Registrant:
    Mahmud Perlov
    Email: [email protected]
    Organization: private person
    Address: Voronova 37-48
    City: Hohlovka
    State: Voronezskaja
    ZIP: 589382
    Country: RU
    Phone: +7.4958293920

------------------------------------------
Google translate:
------------------------------------------

------------------------------------------

The PHP Script : http://pastebin.com/5Ha9wYD0

The  "update.php" link is for third party Exploit Kit (which will handle the download).

And the script is for Iframe (go check the link every 5 minutes) and store landing locally.

Text for FAQ :
------------------------------------------

------------------------------------------
Google translate:
------------------------------------------
support
Jabber: [email protected]
ICQ: 983382

manager
Jabber: [email protected]
ICQ: 444846

• The format of return for substitution

For example, you have merged US 1k units. You see in the article $ 2 per day , for a week income boosted to $ 8. Within 2 months turns 60 * 8 = $ 480 , and continues to drip

• Downloads

Accept any country other than the CIS and China
Thus , the maximum yield gives US
Good income from AU CA AG SG MC
Other countries , too, so bring something .

• Exploit Kit

In the promo you will see a link to the actual link ligaments, as well as the script that is easy to pull up- link , is to pull yurl every 5 minutes.
Leyte only Unico , neuniki blocked . All of the countries except CIS and China
Domains change , set a bunch of nice , clean all automatically. Articles on bond will appear in the statistics. The domain is updated , on average, every 1-3 hours, so overtighten link every 5 minutes , the previous domain will be stopped immediately , there is only the current work .
Stastistika by a bunch of updates every 5-10 minutes
Samopisnaya bunch , mostly java
It is best to pour x32 machines (x64 struggling at times). Browser IE x32, any OS , XP is certainly better beats .
Average sample of about 10 % , on a good trafe up to 15-20 %

• Why should we cast it ?

With us, you get the reliability . We pay since 2009 and even though we do not promise space revenues from downloads , and we can not pay for years, while others will close affiliate . For example , some sort of affiliate program pays $ 1,000 a month, affiliate worked for 6 months and brought 6000 . At the same batches have , for example, $ 800 , and we can pay the 2 years and you get 19,200 . Although it seems like that the envelope was smaller?
With us you will surely get your money for a long time and this win .

• Weekends and holidays

On weekends and holiday people click less , respectively, and less income .

• payments

Payments are automatically every 2 weeks in the third and 18th numbers.
If you have a sum of more than $ 200 a day - will make the payment on request within 2 days
The minimum payout is $ 50.

• update statistics

Statistics on money specified to 5 days (depending on the feed providers) . At the same time , most of the money on the balance sheet is already on the next day
Statistics and admin for the settings , overtighten every 30 minutes.
Statistics on the bond every 5-10 minutes.

• eczema file

Soft quiet, the system is holding up well , the user does not interfere.
Contains Rootkit for x64 installs and good to live up to the year
Eczema update every 3 hours - time updates kripter can be arbitrary. We try wherever possible to keep it clean .
Forbidden to scan the file pablikovymi AV checker, type VirusTotal. Use private services , such as http://scan4you.net

• How to get the maximum income

Leyte good quality traffic
Along with us , it is advisable not to pour other affiliate
Pour more US downloads------------------------------------------

Now you know what to expect when you see a >900ko file named pod.exe :)

But to be honest I wonder if I now have not more questions than answers.

The Podmena is tied to the Styx "Kein" "Yahoo Stocks" landing (maybe to the other. Didn't see it myself)
I can't say for sure it's the only Affiliate pushing that stuff.
What are the link between Styx/Styx Kein? We know there are many options in Styx to do exactly what is being done by this Affiliate. The API seems powerful.

We could talk about CVE appearance order in different instances of Styx but i guess you are already bored enough :)

---- 2014-11-07 -----
Yesterday podmena affiliate started to shift to Miuref binaries (at least for some users...but it could be "counter-intel" move )
------------------------

Read More :
Styx Exploit Kit installing Simda - 2013-10-08 - Jose Miguel Esparza - Eternal-Todo

MSRT September 2013 - Win32/Simda - 2013-09-10 - Microsoft

A "Styxy" Cool EK ! - 2013-07-01

Inside Styx Sploitpack 4.0 - Exploit Kit Control Panel 2013-05-19

Crossing the Styx ( Styx Sploit Pack 2.0 ) - Meet CVE-2012-4969 via JS heapspray - 2012-12-22