June 5 Twitter Bifrost spreader h1.ripway.com and some others

 This is a very prolific twitter malware generator using approximately 70-100 twitter accounts (as of 5pm June 5, 2010 and their number is growing fast) and one domain h1.ripway.com. The malware appears to be Bifrost, many binaries are different MD5, different detection rate, and callback IPs. The subjects and languages of the twitter posts are different too.

  Download 6 samples (some are listed below, all are versions of the same trojan)  as a password protected archive (contact me if you need the password) 



https://twitter.com/#search?q=ripway - twitter search

Other malware spreaders you may find interesting are (I did not check every link for malware presence so please correct me if any of the links/searches are false positives). They look bad to me though.

https://twitter.com/#search?q=shup.com
https://twitter.com/#search?q=localhostr.com 
https://twitter.com/#search?q=freewebtown.com
https://twitter.com/#search?q=su1%20exe
http://twitter.com/#search?q=upload2009
http://twitter.com/#search?q=up-00 
http://twitter.com/#search?q=arabsh 
http://twitter.com/#search?q=Download%20Accelerator%20Plus 
http://twitter.com/#search?q=fileave 
http://twitter.com/#search?q=anilaali.com 

Domain  h1.ripway.com

http://www.robtex.com/ip/64.62.181.46.html
64.62.128.0/18
Hurricane Electric 55 South Market St San Jose, CA AS6939
HURRICANE Electric


Malware (a few samples used )
 video.xnxx.comvideo61715petite_babe_big_faci.exe
http://virscan.org/report/d7615d0c0d4a6cc91245617662095b62.html    

a-squared 5.0.0.11 20100605043517 2010-06-05 Backdoor.Win32.Bifrose!IK 12.027
AVAST! 4.7.4 100605-0 2010-06-05 Win32:VB-OUL [Trj] 0.008
GData 21.297/21.98 20100605 2010-06-05 Win32:VB-OUL [Trj] [Engine:B] 15.672
Ikarus T3.1.01.84 2010.06.05.76004 2010-06-05 Backdoor.Win32.Bifrose 6.630
JiangMin 13.0.900 2010.06.05 2010-06-05 Trojan/Buzus.hlp 2.267
McAfee 5400.1158 6004 2010-06-05 BackDoor-CEP.gen.cb 17.766
Microsoft 1.5802 2010.06.05 2010-06-05 VirTool:Win32/VBInject.gen!CI 6.919
Norman 6.04.12 6.04.00 2010-06-04 W32/VBInject.AS 6.028
Panda 9.05.01 2010.06.05 2010-06-05 Bck/Bifrost.gen      5.889
Quick Heal 10.00 2010.06.05 2010-06-05 Suspicious - DNAScan 1.765


File Name :   video.exe
http://virscan.org/report/02e932f4725a22c9301b3db9e8e102c0.html
File Size :   193125 byte
File Type :   PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 :   2f4f4c151ed20283443e79f5c35f8d45
AntiVir 8.2.2.6 7.10.7.251 2010-06-04 TR/Spy.218394 0.257
McAfee 5400.1158 6004 2010-06-05 BackDoor-CEP.gen.cb 16.025
Panda 9.05.01 2010.06.05 2010-06-05 Bck/Bifrost.gen      1.708
Quick Heal 10.00 2010.06.05 2010-06-05 Suspicious - DNAScan 1.528
VirusBuster 4.5.11.10 10.126.67/2027645 2010-06-06


File Name :   mahaaa.exe
http://virscan.org/report/b3835cdc5c45685c1c9350fc1318ef11.html   mahaaa.exe 
File Size :   230604 byte
MD5 :   079b2752644e75609ef0ba8329fcabb9
SHA1 :   917139aab4bbc51af958a3e03c00dd19c57b7846
a-squared 5.0.0.11 20100605043517 2010-06-05 Backdoor.Win32.Bifrose!IK 0.888
AntiVir 8.2.2.6 7.10.7.251 2010-06-04 TR/Spy.205381.1 0.264
AVAST! 4.7.4 100605-0 2010-06-05 Win32:Spyware-gen [Spy] 0.014
BitDefender 7.90123.6157321 7.32048 2010-06-06 Gen:Trojan.Heur.om2@rT8DpFoaQ 3.957
GData 21.298/21.99 20100605 2010-06-05 Win32:Spyware-gen [Spy] [Engine:B] 7.262
Ikarus T3.1.01.84 2010.06.05.76004 2010-06-05 Backdoor.Win32.Bifrose 6.541
JiangMin 13.0.900 2010.06.05 2010-06-05 Trojan/Buzus.gvi 1.195
McAfee 5400.1158 6004 2010-06-05 BackDoor-CEP.gen.cb 15.966
Panda 9.05.01 2010.06.05 2010-06-05 Bck/Bifrost.gen      1.721
Quick Heal 10.00 2010.06.05 2010-06-05 Suspicious - DNAScan 1.624


Anubis Report 1  Captain.ex.exe
http://anubis.iseclab.org/?action=result&task_id=182f301d06a8b2c74ed26c9817f6a8c48&format=html
Malware TCP traffic to
 -    82.137.245.67
Syrian Arab Republic (none)  82.137.192.0/18
STE Public Data Network Backbone and LIR AS29386
STE-AS2 Syrian Telecommunications Establishment

 Anubis Report 2 viurgn.com.exe
http://anubis.iseclab.org/?action=result&task_id=1354dfeb3e9278c44a95390c4d036902d&format=html
Malware TCP Traffic to 94.98.220.37:963
http://www.robtex.com/ip/94.98.220.37.html#ip
Hostname:    94.98.220.37.dynamic.saudi.net.sa
ISP:    SaudiNet, Saudi Telecom Company
Organization:    SaudiNet, Saudi Telecom Company
Country:    Saudi Arabia sa flag
State/Region:    Ar Riyad


These are some of the accounts as of June 5 and examples of links/posts

xsyria
hxxp://h1.ripway.com/xboldx/Captain.zip قصائد نزار قباني والشاعر عماد السيد لن تروها الا هنا
hxxp://h1.ripway.com/xboldx/Captain.exe لعبة السكس الشهيرة عالميا اصبحت مجانا جربوها ولن تخسروا بل ستربح اللذة 
hxxp://h1.ripway.com/xboldx/Captain.exe Game Captain now famous celebrity free Ejreboha will Tkhosro Stervhawwa pleasure, but the truth

w3elly
hxxp://h1.ripway.com/hamadh6200/NasSim_x721x .exe Tool speed up the work of Computer

xxhotgirlxx20
hxxp://h1.ripway.com/sexanal/I%20need%20a%20friend.rar

dofus159
hxxp://h1.ripway.com/ftp/video.xnxx.comvideo61715petite_babe_big_faci.exe

xxhotgirlxx20
hxxp://h1.ripway.com/sexanal/I%20need%20a%20friend.rar

ishq7man
hxxp://h1.ripway.com/ishq7man/Chat%20With%20Girls.exe This programm is easy to use you can chat with any one specially (Girls) With Cam

hamodhay
Be free ardoghan Gazah need you'r help .. setub ardoghan tollbar for help us hxxp://h1.ripway.com/hamodhay/ordo.exe
تحريرا لشعوب غزة ونصر رجب اوردوغان لنوحد شعارنا غزة و اردوغان.. حمل برنامج دعم اردوغان .. hxxp://h1.ripway.com/hamodhay/ordo.rar

bda7
hxxp://h1.ripway.com/abda7/ghost_dz.exe Another version of the solution and the problems of windows XP Abe, Vista program ghost_dz

g0od_b0y
(hxxp://h1.ripway.com/fs0l/Difference.bat } The difference between men and women ...... scientifically

fucksoso
hi am sara and i love sex so much is u wanna know more about me come here hxxp://h1.ripway.com/reem0979/reeeeem.rar we will chatting

fsol_sam
{ hxxp://h1.ripway.com/fs0l/sexy.bat } Games +18

nasser1001
Hello guys Allehaa Turkkm with the download Tvdilo hxxp://h1.ripway.com/vxx9/y1g.com

xxhotgirlxx20
hxxp://h1.ripway.com/sexanal/I%20need%20a%20friend.rar hi
hxxp://h1.ripway.com/sexanal/I%20need%20a%20friend.rar 
hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif

mo3az23The Programme for love and romance and decoration hxxp://h1.ripway.com/M0SBAKRMA/sex2010%7D%20more.zip
hxxp://h1.ripway.com/M0SBAKRMA/sex2010%7D%20more.exe Sex with beautiful pictures Funny Celebrities 2010
hxxp://h1.ripway.com/M0SBAKRMA/Sex%20with%20beautiful%20pictures%20Funny%20Celebrities%202010.zip Very sexy

loriee87
photo sexy de lorie hxxp://h1.ripway.com/ssmina19/www.sexylori.com

ntfyhood 
sexy girl prgrams hxxp://h1.ripway.com/drflsafah/slo.scr hxxp://h1.ripway.com/drflsafah/slo.scr

thegreatecizar
TO SUPPORT ISAREL PLEASE LOG IN hxxp://h1.ripway.com/greatecizar/index.htm

xss2010
hxxp://h1.ripway.com/xss2010/sapry3.rar I hope to watch the fun Login

sylvie2008
hxxp://h1.ripway.com/fady72/IDM 5.19.exe internet download manager 5.19 cracked and some photos

brindilat
100% Free Porn Movies and Sex Content hxxp://h1.ripway.com/moikakashi/blog.sexymeta2.scr

z2ad z2ad
..........Sex.......... hxxp://h1.ripway.com/z2ad/Sex.zip Or hxxp://dox.abv.bg/files/fdw?eid=58686383 about 21 hours ago via web

afnangirl
Hi Today I have something new to you sex girl in the car Watch video Download hxxp://h1.ripway.com/alfisal445/sex girl in car 100%.rar about 21 hours ago via web


ramiramiami
Bush Announces GITMO to be Converted into Sex Change Clinic Cites chat online sex hxxp://h1.ripway.com/nany1988/Live-cam.exe
online sex hxxp://h1.ripway.com/nany1988/Live-cam.exe 
Sex Sex Sex Sex Sex Sex hxxp://h1.ripway.com/nany1988/Live-cam.exe
hxxp://h1.ripway.com/nany1988/Live-cam.exe

dalida_sexy
vous voulez amusez ? Me voir ? A ne pas ratter ! regarder ici sexy dalida ! hxxp://h1.ripway.com/bartita/Dalida-dinamite_sexy.pif.exe

ntfyhood
hxxp://h1.ripway.com/drflsafah/sexy.scr good
hxxp://h1.ripway.com/drflsafah/sexy a7.scr sexy girl programs

sex_hot_1
hxxp://h1.ripway.com/ksa4009/YouTube.exe about 22 hours ago via web

ddssww
hxxp://h1.ripway.com/abolalh123456789/Beautiful girl sex _19.exe
Beautiful girl sex _19 hxxp://h1.ripway.com/abolalh123456789/Beautiful girl sex _19.exe

zidanisamir
hxxp://h1.ripway.com/xsamirx/tof.pif 
hxxp://h1.ripway.com/xsamirx/tof.pif photo extra

bode3sl
hxxp://h1.ripway.com/htmailcom/LOOL.html King of Jordan in the disco
hxxp://h1.ripway.com/htmailcom/I‘Msex.html The girl to the murder, sex .. Please look up

imadows
See your home from your computer program is better than Google Earth: hxxp://h1.ripway.com/imad77/Directly-from-the-satellite.exe
انظر منزلك من برنامج الكمبيوتر الخاص بك هو أفضل من جوجل الأرض hxxp://h1.ripway.com/imad77/Directly-from-the-satellite.exe

C0ooo0L
Princess erotic scandal .. With the private secretary + 29 -- hxxp://h1.ripway.com/redtube69/squirting-princess.com

coldzero00
hxxp://h1.ripway.com/kamallag/Porno%20xXx.exe

Angelina19901
A screen saver for the World Cup New hxxp://h1.ripway.com/fahdnet/new.scr

mo3azaqabaa
To download the strongest films hxxp://h1.ripway.com/Programm/To download the strongest films.rar

mrbrolo
hxxp://h1.ripway.com/gropyuy/sexy-in-the-bidroom.scr very nice

Mexi2girl
paltalk profile hxxp://h1.ripway.com/tht/PaltalkScee.exe

adon456
My film's hxxp://h1.ripway.com/3don/sxs%20fire.rar
A program to bring millions of money and girls hxxp://h1.ripway.com/3don/privt.rar 

ha888zm
hxxp://h1.ripway.com/6arab8/OxXo.exe sex +18

seven2smok
Mec israilien tell a Ghaza our israillien tell for all sorry hxxp://h1.ripway.com/seven2smok/mec Israil.rar

ya7ubbi
hxxp://h1.ripway.com/5gg/Bigass.exe
hxxp://h1.ripway.com/5gg/I love sex.exe
hxxp://h1.ripway.com/ksa4009/YouTube.exe 9:39 PM Jun 3rd via web

deana1989
hoot pic 4 me ;) wats ur comment :P hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
new sexy flash pic for me !!! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
nye sexet flash pic for mig! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif 8:20 PM
bagong sexy flash pic para sa akin! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
Flash für mich! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
ný kynþokkafullur glampi mynd fyrir mig! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
nuevo flash foto sexy para mí! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
flash sexy pic nova para mim! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
nuovo flash sexy foto per me! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
פלאש סקסי חדש pic בשבילי! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif
new sexy flash pic for meee !!! hxxp://h1.ripway.com/ababneh11/flash%20pic%20for%20mee%20!!.pif

seexy_girl666
hxxp://h1.ripway.com/stay4351/seeex-movi.rar

alzahrani111
hxxp://h1.ripway.com/fff123/fuck ass girl.exe Free Sex and free porn, sexy girls

sakoma22
hxxp://h1.ripway.com/esmara/photo-sexy.jpg.scr best pic of six look it

Angelina19901
Screen saver is very new and beautiful hxxp://h1.ripway.com/fahdnet/new.scrsasasa123sa
sasasa123sa hi i am hot girl hxxp://h1.ripway.com/rachid75/sexy%20girl%2001.rar hxxp://h1.ripway.com/rachid75/sexy%20girl%2001.JPG.exe

x0xjohnx0x
hxxp://h1.ripway.com/mrtros/sapry.exe 5:24 PM

natrooo
crack tested and tried it because all the content you are using Almendiat All windows 7 hxxp://h1.ripway.com/natroo0/crack windows 7.rar

ryanhail
hxxp://h1.ripway.com/ryanhail/game2010.exe game sex girl

oklaiti
hxxp://h1.ripway.com/fff123/biforst.exe sexy girl hot
hxxp://h1.ripway.com/fff123/biforst.exe
hxxp://h1.ripway.com/fff123/fuck ass girl.exe
hxxp://h1.ripway.com/fff123/fuck ass girl.exe hot nude girl fuck her from back

memohotgirl
Hay brought to you today a program to download the latest sex movies for downloading hxxp://h1.ripway.com/haifa333/sexsy%20hotgirl.rar

C0ooo0L
The rape of a minor girl .. +30 .. hxxp://h1.ripway.com/redtube69/viurgn.com
Big Ass .. Very hot +25 . hxxp://h1.ripway.com/redtube69/very-sexy.com

homodeee
hxxp://h1.ripway.com/homode/5.exe

hoood22
hxxp://h1.ripway.com/mahaaa/mahaaa.exe

amir_222
Perfect program :D:D !! hxxp://h1.ripway.com/bebo2c2/Vidz.exe

liberty207
hxxp://h1.ripway.com/tarek207/My_Piic!!!!!.exe Girls Sakhanat.............
hxxp://h1.ripway.com/tarek207/My_Piic!!! Téléchargez le logiciel de chat chaud... Download the chat program hot...

coolgirl20129
hxxp://h1.ripway.com/sexo-girl/video.exe this my first program

sexygirl1m
hxxp://h1.ripway.com/stay4351/SEX-FILM.avi.rar MY FAVORITE SEEX

asoao
hxxp://h1.ripway.com/matrex03/sexy%20girls%20ass.exe The sexy ass girls:):):)

glbiass
hxxp://h1.ripway.com/glbisex/live.html Provoked by the site and sex

salahtito
hxxp://h1.ripway.com/dzteam1/Rip.exe for all الى الكل يا عرب لا تحملون ارجوكم الى الاجانب فيق وخصتاً الياهود الحمير :)
hxxp://h1.ripway.com/dzteam1/salah.exe Prefer this to your sweetheart or wife or a friend ... For all beautiful .. What do you

rinda10
hi am rinda 22 i love chatting with cute people see the link if u wanna learn more about rinda hxxp://h1.ripway.com/reem0979/me.rar bye

sasakota
hxxp://h1.ripway.com/sasanolove/The-cameras- worlds.rar

ksh_mat
Sexist portrayal of Ben Clinton and Monica To see the picture on this link hxxp://h1.ripway.com/vlan/Picture sex.exe

soritasexy
hxxp://h1.ripway.com/coora/chat room 2010.rar

sasasa123sa
hi i am hot girls i love you hxxp://h1.ripway.com/rachid75/sexy%20girl%2001.rar hxxp://h1.ripway.com/rachid75/sexy%20girl%2001.JPG.exe

lauraramirami
hxxp://h1.ripway.com/nany1988/Setup.exe Live Live Live Live

Katriennasaxy
hxxp://h1.ripway.com/Tamnitk0010/Beautiful%20exclusive%20sex%20first%20time%20sex%20shows.avi.exe

handr1
hxxp://h1.ripway.com/handr/sexhot.exe thes is sex hot free
hxxp://h1.ripway.com/handr/sex hot.exe

nabil987
pour activer touts vos logiciels experimentaux ,telecharger ce important logiciel :hxxp://h1.ripway.com/nabil87/microsoft/anti%20trial.EXE
ce logiciel il s'apelle "ANTI TRIAL" son role est activer es logiciels experimentaux hxxp://bit.ly/bL1Q2I 4:48 PM Jun 2nd via web

sarhlove
hxxp://h1.ripway.com/xxxhack/dr saud.scr Jessica kind of unique new, if you like please email me ???

sko0or
hxxp://h1.ripway.com/RoOTTeEM/Captain.exe im girl
hxxp://h1.ripway.com/RoOTTeEM/Captain.exe I love

novr5
hxxp://h1.ripway.com/reeem/MoN,GirL,KsA.pif Looking for a relationship befriended those who wish to see my profile I am 19 years

ssaarraahh1010
The noisy retinue everything new to the definitions of the device hxxp://h1.ripway.com/ssaalloomm/Stup.exe
Messenger password stealing program hxxp://h1.ripway.com/ssaalloomm/qqq.html

rab7_1
hxxp://h1.ripway.com/reem0979/su1.exe if you you wanna more about me :) click the linke (( i love you my country ))

shrarh911
hxxp://h1.ripway.com/shrarh/sexy_phlsten
Sex in Palestine hxxp://h1.ripway.com/shrarh/sexy_phlsten.exe

DRHEX2010
hxxp://h1.ripway.com/houbry/Captain.exe

abdulelah696
hxxp://h1.ripway.com/khaled9998/love.exe :)

JacobTheHacker
Add my new profile hxxp://h1.ripway.com/Hak0ha/Jacobtheman.html hxxp://h1.ripway.com/Hak0ha/Jacobtheman.html
Add new Profile!!! hxxp://lnk.ms/9QZJM im going to delete this one hxxp://h1.ripway.com/Hak0ha/Jacobtheman.html

rahmanfitraa
Buka ini dong pleasee: hxxp://h1.ripway.com/rahmanfitra/index.html

Tour MileyCyrusTour
Check out our page to promote Miley's upcoming new album Can't Be Tamed @ hxxp://h1.ripway.com/mileycyrustour The record is out June 22nd!

medinaras
Najis. Bilang makasih lo RT @rahmanfitraa: Hoi buka ini dong pleasee: hxxp://h1.ripway.com/rahmanfitra/index.html
Hoi buka ini dong pleasee: hxxp://h1.ripway.com/rahmanfitra/index.html
Check out our page to promote Miley's upcoming new album Can't Be Tamed @ hxxp://h1.ripway.com/mileycyrustour