It have been found a new malware injection kit named "Anonymous exploits kit"
It is located in the domain zaebal11.uni.me hosted on an IP of Panama.
The infection vector that drops the trojan is:
It downloads the malicious binary:
Binary size cita.exe: 271622
This malware infects the user with the Citadel Trojan which tries to connect against the fraudulent domain netreverseram.ru that is currently idle.
Access to the statistical panel of "Anonymous exploits kit" is via URL address:
Showing the following screen:
Once inside the panel it can see the tracking information of infected users, the victim's home country, operating system version, browser version etc.
At the time of analysis this kit was in a very initial state without any infected user yet. There are only traces of the authors of KIT from IP of Netherlands.
The file structure of the KIT is:
As remarkable new code of all files that make up the kit have been encrypted in Base64
This KIT takes advantage of vulnerabilities discovered for Java and PDF to infect the user with configured exploits in the kit:
Exploits are also encrypted so they couldn’t be reused by other criminal groups, and certainly when criminals finish adapting the kit will have the latest vulnerabilities zero-day discovered for Java
In fact in the same fraudulent domain is hosted the famous Control panel Multilocker Trojan or Trojan Police that uses Java exploits to spread
As showed in the following screens:
And the list of cheated users who have already made payments to unlock their computers