Home / malware

PDF

Trojan:HTML/BlacoleRef.A

First posted on 21 February 2013.
Source: Microsoft

Aliases :

Trojan:HTML/BlacoleRef.A is also known as Trojan.HTML.Redirector.AN (Kaspersky), HTML/FriendLoad.A (Avira), JS/Exploit-Blacole.ju (McAfee), Troj/Redir-O (Sophos), Trojan.HTML.Blacole (Ikarus), Trojan.HTML.Redirector.CH (BitDefender).

Explanation :

Trojan:HTML/BlacoleRef.A is a malicious webpage used by the Trojan:JS/BlacoleRef family to infect your computer with other malware.

If you visit such a page, you may be redirected to other pages where - if you have vulnerable (or non-updated) software on your computer - you may be infected with more malware, such as trojans and viruses.

The page may look like the following:



In the wild, we have observed Trojan:HTML/BlacoleRef.A redirecting your browser to the following URLs:

• 7careerblog.com
• abcnews22.ru
• allfoxnews.ru
• allnewsjob.ru
• androidtabletdrugstore.com
• androidtabletgenerics.com
• assayspills.com
• assaysrx.com
• biologicalprescription.com
• BlogNewsGuide.ru
• blogsandsites.ru
• breakoutnews.ru
• brocolos-fun.com
• canadapharmacypipeline.com
• carepharmhealth.com
• cbns24.com
• channelnws.com
• cnm-story.com
• counterpunchlisprescription.com
• dailynews.com.2012.fashion.italy.moda.trends.12newsfx.com
• dailynews.com.2012.fashion.italy.moda.trends.luxurynws.com
• dailynews.com.2012.fashion.Raspberry.UltraDrops.fxnws12.com
• eilt.ru
• ejournal91.com
• e-nbcnews.com
• estory24.com
• fixednws.com
• flagshiphealthcare.com
• foonws.com
• foxbiznet.ru
• foxnetinfo.ru
• foxnetonline.ru
• foxnews.com.happyhcgultracustomers.new.12newsclock.com
• foxnews.com.happyhcgultracustomers.new.bcn-story.com
• foxnews.com.happyhcgultracustomers.new.cbsn24.com
• foxnews.com.happyhcgultracustomers.new.cnb29.com
• foxnews.com.happyhcgultracustomers.new.enwb21.com
• foxnews.com.happyhcgultracustomers.new.f4xw.com
• foxnews.com.happyhcgultracustomers.new.fxnwsonline.com
• foxnews.com.happyhcgultracustomers.new.iarticle24.com
• foxnews.com.happyhcgultracustomers.new.msnbc-story.com
• foxnews.com.happynews.americastopdiet.ultradrops.fxnwst.com
• foxnews512.ru
• foxpronet.ru
• foxtopnews.ru
• fx-2013nws.com
• fxdrop.com
• fxhtm.com
• fxnwsw.com
• fxxslines.com
• goodnewsportal.ru
• greatfxs.com
• greyfxs.com
• hadnws5.com
• hcg-news-html.com
• hcgultra-online.com
• healthcaremedshealth.com
• health-news24.com
• herbalpillmale.com
• inprivatehealth.com
• istory24.com
• journali2.com
• journals26.com
• kindlevitra.com
• lastweekinfo.ru
• lifeweeknewsblogs.com
• mediaportall.com
• medicalpharmarijuana.com
• medicarepillsrepublicans.com
• medscialpolymer.com
• msb-article.com
• msbcn-story.com
• msnb21.com
• msnbc-html.com
• nationalnewssite.com
• nbcnewsat9.com
• nbcnewslinks.ru
• nbcn-story.com
• nbcsw24.com
• nbcws24.com
• nbsn24.com
• nbsw24.com/
• new-article24.com
• newnextonline10market.com
• news24cnbc.com
• news861.com
• news981.com
• newsallday.ru
• news-article24.com
• newsbizday.ru
• newsfixs.com
• newsfxhtml.com
• newsgo5marketgenonline.eu
• newsgo9marketgenonline.eu
• news-home-business.ru
• newsnetworkcorp.ru
• newsnews7.ru
• NewsRadioNet.ru
• news-story24.com
• newstimez.com
• new-story24.com
• nextmarketnews.com
• nightnws.com
• njournal24.com
• nmbs24.com
• nonstopnews5market.com
• nwsclocks.com
• okfunclubbrocolos.com
• online11work.com
• online12work.com
• online-article24.com
• onlinemarket11work.com
• onlinenewmarket.com
• online-story24.com
• ontimenws.com
• patientslnessmedical.com
• prescriptionmedicaredrug.com
• prescriptionpharmacygenerics.com
• prime-fxx.com
• rxlevitrleiby.com
• rxobesity.com
• saleretailers.com
• saletabinprivate.com
• story24i.com
• tablethealthphysicians.net
• ticnewss.com
• time-fxs.com
• timerfox.com
• timesfix.com
• WeekNewsSite.ru
• welnessherbalair.com
• whitesnews.com
• yearnws.com

Analysis by Hyun Choi

Last update 21 February 2013

 

TOP