crimesciberneticos.com blog.Knowing that we knownothing, were beyond good and evil, after all the only thingabsolute is that everything is relative.A hug, your friendPsychlo.by PsychloFirst ofall, he is NOT my friend. :)This blogis about cybercrime investigations, malware reverse engineering,intrusion analysis and so on. Thus, sometimes I find interestingstuff that allows me to track the Brazilian cyber criminals, and lastyear, I found out very interesting information about them.Somethingwent wrongAbout oneyear ago, a reader sent me a message telling that he tried to accessa website but the index page was presenting confusing information.See below.ImmediatelyI copied the source code and started the analysis. You can see theoriginal code at Pastebin.I tooksome of those strings, put on Google and got about 14,000 results withthe same code. So, about 14K pages were defaced, most from Brazil.Thecriminals used some kind of automated tool to deface and inject codein those pages, but it didn't work well. Consequently, it revealed alot of information about them, how they act, their accounts, logins,passwords, databases, etc.One ofthe most interesting things is this snippet:------------Porrinha------------Counter .HTTP:http://anfeso1201.dominiotempo... Total: 559Date: 28/09/2011Counter .HTTP:http://r7on.com.br/porraloka/clie... Total: 167131/08/2011Counter .HTTP:http://netransportes.com.br/ama... Total: 200007/09/2011TOTAL INFECTS: 00.000 x0,50 = 000,00----------Psychlo----------Agreed Amount: 1000Counter HTTP:http://64.186.158.114/tzu.php Total: 1000I owe him: 250,00Total: 2214,00 I willsend: 3000,00 I owe him: 786,00 - 250 = 536---------Cavalo---------Counter .EXE : 2053TOTAL INFECTS: 5.000 x0,50 = 000,00Counter HTTP:http://200.98.201.13/~rex/tom/rel/inf4/?url=c Total: 3758I owe him: 600,00We cansee some information of the cybercrimes accounting. We have threenicknames, the guy of the message (Psychlo) is one of them.Additionally, we have some counters of infected computers, how muchis paid for each one (50 cents of Brazilian Real) and how much theboss owes for his employees.Here wesee the value of maintain a counter of infections. It is quite commonfind malware that calls home and sends data to inform newinstallations. They earn money with that.We haveother interesting snippets, such this one:miroslav.stampar@gmail.comWordpress guy8276 0241Oi julimarAn emailaddress, probably a programmer, and a cell number.http://beta.statcounter.com/p7142950/entry_page/pageload/?url=http://www.cc.com/d.phpflashgame_co_ccb470killerHere,they are using the statcounter.com to count their infections, butthey left the username and password exposed too. With thesecredentials I logged into the account and gathered more information.Probably the real name and email address of one member (maybe theboss) of the gang.In the original post I did further analysis and tried toput the pieces together. I've found malicious scripts used inDrive-by download attacks; FTP servers where they stored their files;web shells; PHP mailers to send phishing, etc. The postwas well accessed and commented in Brazil, today it has about 70comments. However, it is interesting to note that it attractedattention from the bad guys too. Apparentlyeven the authors of the malicious code read the post and left comments.Take a look at the comments below to better understand the case. There are two guys, c0d3c4sh and Psychlo, talking about their criminal lives and their impressions about the post. On the other hand there are also the regular blog readers confronting their ideas (not shown in these comments).c0d3c4shwrote in 11/09/2011:Ifinally managed to find out who was the UNOCCUPIED that disabled myauto infect! What anger, but no problem, it is already infectingeverything and online again...Anotherthing, I noticed that you didnt understand why the applet writes afile