Revenge of the Reveton<div class="ExternalClass6E6A11B021864A7DBF8DDC45824FC0DA">
<p>Computer users around the world are increasingly accustomed to managing their bank accounts, paying their bills and performing other activities online. The use of technology to manage finances has long been a target of attackers, and malware authors continue to create scams that try to persuade potential victims to provide access to their valuable personal information, including logon credentials for online accounts. Trojan:Win32/Reveton.A is a recent example of malware that attempts to phish these details from victims using the great motivator - fear.</p>
<p><a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fReveton.A">Trojan:Win32/Reveton.A</a> displays a warning that alleges that the affected computer has accessed "<em>pornographic content, elements of violence and child pornography</em>." The message also suggests that the computer has been "<em>locked</em>" and that the user is "<em>obliged to pay a fine to unlock</em>", as shown below:</p>
<p> <img style="margin: 5px;" alt="Reveton ransom" src="http://www.microsoft.com/security/encyclopedia/en-us/i/499e3590b4bac379.jpg" setwidth="656" setheight="425" /></p>
<p>This phishing and ransom message is also detected by MMPC as Trojan:HTML/Ransom.A. The scam in this attack attempts to phish user accounts for the electronic payment services Ukash and Paysafecard. We wrote about this type of ransom attack in a <a href="http://blogs.technet.com/b/mmpc/archive/2011/12/19/disorderly-conduct-localized-malware-impersonates-the-police.aspx">previous blog post</a>.</p>
<p>Account information provided by the user is stolen and sent to a remote server at “91.195.254.86”. Indications are that this allocated server IP address may be physically located in Russia:</p>
<p><span style="font-family: courier new,courier;">inetnum: 91.195.254.0 - 91.195.255.255</span><br /><span style="font-family: courier new,courier;">netname: GEOSYSTEM-NAVIGATION-NET</span><br /><span style="font-family: courier new,courier;">description: ZAO GeoSystem Navigation</span><br /><span style="font-family: courier new,courier;">country: RU</span></p>
<p>If you've been a victim of this scam, or similar, review <a href="http://www.microsoft.com/security/online-privacy/phishing-scams.aspx#Victim">these steps</a> to take, to minimize your financial loss and/or damage to your identity.</p>
<p>As always, we advise you to be cautious when providing sensitive personal information, such as electronic account details, as it could lead to identity or financial theft.</p>
<p><em>Patrick Estavillo, MMPC</em></p>
</div><div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3493090" width="1" height="1">
Source:
Revenge of the Reveton
