FakeAVLock - FedEx Shipping Issues - Revisited

This is continuation of the FedEx Malware Overnight Posting. I had considered putting this in the same post but there has been some changes in what was being seen. Will update with more as I find it.

** 1/14/2012 Updated with more Initial Landing Points, and new Subject Characteristics. **
The current infection process is the same:

• Receive a Phishing Email about a Package
• Download Zip file with Receipt.exe in it
• Open Malicious EXE and Svchost.exe is injected and calls home
• Calls home for the 2nd Stage, Multiple IPs until one successfully connects
• Finishes infection 
• Machine is unusable. 

Characteristics of the email:

• Different Sender
• Different Subject
• Starts with:
• Tracking IR
• Tracking Number
• Number
• 1 Letter in ()
• 2-3 letters following
• No space between last character and numbers.
• Subject: FW: Tracking ID (t)hia53 120 120 5339 5339
• URL for receipt is somewhat unique. 
• http://druckerpatronen-1x1.de/AEPDVJYDTS.php?receipt=798_15525##### where # random numbers
• Order Number in Body is different. 

External Link Data: 

Anubis  PostalReceipt.exe

Malwar

Virustotal

UrlQuery  for the call home site of 184.106.214.159

Malicious IPs:

62.146.51.19
202.169.224.202
88.191.123.128
184.106.214.159
50.57.135.154
66.232.145.174
74.208.111.15
178.77.103.54
66.84.10.68
46.4.178.174
173.255.203.178
85.214.22.38
82.113.204.228
81.93.248.152
88.40.201.187
94.101.86.146
118.97.15.13

You may also see request for the following files: 

lite.dll.crp

sb215.dll.crp

Initial Landing Links for the ZIP file:
The .php?reciept=79 has been seen among all links received.


http://1stline.org/PKMCQPMRIP.php?receipt=796_908103503
http://alfashop.com.br/BBYDVVPDOF.php?receipt=797_1555910781
http://newsletter.canaanland.com.my/KCQIHUFFRB.php?receipt=797_1531499115
http://1stline.org/PKMCQPMRIP.php?receipt=796_908361164
http://theblackproject.net/HRCRUPDQBJ.php?receipt=755_48016707
http://www.fellfab.com/UOBSRUTTHH.php?receipt=796_795924187
http://havadurumu.skiciyiz.biz/ROYQXQPAQX.php?receipt=797_1308676636
http://www.adrenalinamergulho.com.br/UAIBSOOUFA.php?receipt=798_1808639291
http://femmeoui.com.br/TVKYAIAOYT.php?receipt=794_481843431
http://bananajack.com.br/YDMQAOXAAZ.php?receipt=798_1730800210
http://druckerpatronen-1x1.de/AEPDVJYDTS.php?receipt=798_1552553621
http://newsletter.canaanland.com.my/KCQIHUFFRB.php?receipt=796_736326616