Further Koobface Analysis
How much information is available on those responsible for the koobface attack? One of the main attack servers – kukuruku-290709.com – is registered to
Polev Andrei. This article looks for information on Andrei Polev using his name and e-mail address
firstname.lastname@example.org. Note the false address in Paris (Kuku Avenue).
Registrant: Polev Andrei (email@example.com) kuku av. 54 -10 Paris,139123 FR Tel. +001.41512345678
An Andrei Polev was also associated with other malware serving domains, such as freehostinternet.com and hostindianet.com.
Registrant: Andrei Polev firstname.lastname@example.org +7.4963612199 Krasnaya str. d.117 kv.119 Solnechnogorsk,Moskovskaya,RUSSIAN FEDERATION 199538
This address, pictured above, appears valid though on closer inspection 199xxx postcodes are for St. Petersburg, not Moscow.
WHOIS results for
rabota2.info reveal the same address (this time with an invalid postcode) and a third e-mail address of
Registrant ID:DI_8622071 Registrant Name:Polev Andrei Registrant Street1:Krasnaia str., 117-119 Registrant City:Solnechnogorsk Registrant Postal Code:23563 Registrant Country:RU Registrant Phone:+7.45743255233 Registrant Email:email@example.com
A further e-mail address is exposed courtesy of cheapestpharmacy.at.
personname: Andrei Polev street address: Krasnaya str. d.117 kv.119 postal code: 199538 city: Solnechnogorsk country: Russland phone: +74963612199 e-mail: firstname.lastname@example.org
An old Koobface C&C server at
zaebalinax.com reveals yet another e-mail address and variation on the name. The postcode is, again, not for Moscow, but for Lipetsk.
Registrant: Mir trud mai Aleksandr Polev (email@example.com) ul. Mira 32 - 90 Moscow,398540 RU Tel. +7.4954115553
upr0306.com, hosted on the same server as
zaebalinax.com is registered to an Andrej Polev.
Registrant: Andrej Polev Email: firstname.lastname@example.org Address: Furshtatskaya ul. 25 - 65 City: Moskva State: Moskva ZIP: 187523 Country: RU Phone: +7.4953440978
bigvillyxxx e-mail address leads to
myfastfind.com, registered to Ivan Petrov with the samee-mail address.
Registrant: Ivan Petrov (email@example.com) Guglovskaya 21-90 Moscow Moskovskaya oblast,167450 RU Tel. +07.4951986709
A cached copy of irchackers.ru shows a user named
#icqhackers but back in 2003. The user is located in russia, but the DNS no longer resolves to an IP.
While there are plenty of other references to a
krotreal user (on flickr etc), none of them appear to have links to hacking or malware.
A series of postal addresses have been discovered, though all have inconsistencies indicating that they are invented or otherwise not genuine. A possible handle has been identified and a series of five e-mail addresses have been discovered.
firstname.lastname@example.org email@example.com firstname.lastname@example.org email@example.com firstname.lastname@example.org