Top websites deliver CryptoWall ransomware via malvertising

[Petrovic]

Content source

http://www.scmagazine.com/popular-websites-infecting-users-with-crytowall/article/374137

CryptoWall ransomware with a valid digital signature is being delivered as part of a widespread malvertising campaign, according to Barracuda Labs.

Drive-by downloads were detected as coming from hindustantimes[.]com, bollywoodhungama[.]com, one[.]co[.],il, codingforums[.]com, and mawdoo[.]com, according to a Sunday post, which explains that the ransomware in each instance was delivered via the Zedo ad network.

A specific subchain “is common to every site's sequence of events,” and in that subchain, “ss1[.]zedo[.]com served obfuscated JavaScript that began a series of redirects to malicious content,” according to the post. “The last site, xenon[.]asapparts[.]com, redirected to one of several different exploit kit-backed sites.”

The initial VirusTotal results showed zero detections; however, the program has since been deemed malicious by additional tools, the post indicates.

 

[Oxygen]

Before you know it every top website will be spreading it.

 

[Kent]

Why do people are reluctant to use adblocker and Malwarebytes Anti-Exploit to avoid it ,even Ghostery blocks Javascripts from the adverts

 

[Malware1]

Here's a new VT scan: https://www.virustotal.com/en/file/...535f7d4c3776a3a9d1fa3510/analysis/1412022040/

Sample: http://malwaretips.com/threads/cryptowall.34337/