Twitter spam campaign leads to Rouge AV "Security Shield"

As Twitter sosial networking site has grown in popularity, it has become target for cybercriminal. Today, lots of people started receiving spam messages that leads to URL ending with "m28sx.html".

The link from spam url points to Rouge AV website,with warning "Caution! Your computer contains a variety of suspicious programs.Your System requires immediate checking! The System will perform a fast and free check your PC for malicious programs." Failing to close browser will be asked to install a file named "pack.exe" which is actually well known "Security Shield" rouge Antivirus solution.

Once installed, it will convince you to purchase to remove malwares with fake Scan Result.

"pack.exe" sample was submitted to Virustotal, without suprise only three security vendors able to detect it.

md5: fb6d34d174df6d29be5886cdd824eaa5

sha1: e6113b7b908c2ca088e44e4dcc4e2aa74d835936

Spam URLs: e83afbf4f33846c0269fd7c2d47b509a38bd79b2d999d7ccc8c0900aa66bc84f

hxxp://marinellilineaoro.it/m28sx.html

hxxp://hdsoft.sk/m28sx.html

hxxp://www.idpbnacional.com/m28sx.html

hxxp://cam-girls-online.com/m28sx.html

hxxp://dezeta.com/m28sx.html

hxxp://www.gemini.ee/m28sx.html

hxxp://cainoventa.it/m28sx.html

hxxp://onlinemacro.com/m28sx.html

hxxp://servizialcittadino.it/m28sx.html

hxxp://aimos.fr/m28sx.html

hxxp://szivacsek.at/m28sx.html

hxxp://www.waseetstore.com/m28sx.html

hxxp://lowcostcoiffure.fr/m28sx.html

hxxp://s15248477.onlinehome-server.info/m28sx.html

hxxp://gdfgdfgdgdfgdfg.in.ua/undo/red.php

hxxp://91.200.240.228/index.php?...

hxxp://91.193.195.17/index.php?....

hxxp://194.28.113.25/buy.php?q=d51e79a6b5bdde257cc4939c7b2a032d

178.162.191.123

gdfgdfgdgdfgdfg.in.ua

mail.detecproforyou.us

mail.gdfgdfgdgdfgdfg.in.ua

mail.parad-kino.ru

mail.sadbzyakuku.biz

mail.xx-gay.com

notarius.me

ns35.hostlife.net

ns37.hostlife.net

parad-kino.ru

sadbzyakuku.biz

sr18.hostlife.net

www.parad-kino.ru

xx-gay.com