September 9, 2008
Recently we have noticed several email messages claiming to come from Lloyds TSB a London, UK based financial entity informing customers that they are required to login and accept an updated terms and conditions, otherwise their account will be suspended. The messages appear to be coming from noreply@illoydstsb.com; however, when further analysis is done on the message header it is actually coming from several domains ending with .es.
When the user clicks the link below thinking they will be going to the terms and conditions, they are actually sent to a fake Lloyds banking site that guides the user through the login process (in an effort to steal credentials).
Leave a Comment » | 
Malware analysis | Tagged: antimalware, code, lloyds tsb, malcode, security, spam, Virus | 
Permalink
Posted by Ryan Sherstobitoff
September 8, 2008
As we have been monitoring the threat landscape during the last couple of weeks we have noticed an increase in fake anti-malware applications being used to defraud users. While these applications themselves do not provide any level of security for the user in terms of detecting and removing malware; the application itself is designed to trick the user into thinking that they are infected via the use of pop-ups and enticing them to purchase a full version as a means of cleaning the system.
The objective is always financial motivation and this is one way they are making money by sending out Spam with Trojan downloaders hidden behind the links designed to install fake security software, in a majority of the cases Anti-virus XP 2008.
Leave a Comment » | 
Malware analysis | Tagged: anti-malware, anti-virus XP 2008, malcode, malspam, Malware, spam, trojan, worm | 
Permalink
Posted by Ryan Sherstobitoff
August 28, 2008
This morning the Celebrity spam campaign continued with a few new fake video codec sites delivering a downloader Trojan designed to install a fake security product known as AntiVirus XP 2008. It’s apparent now that a number of these spam campaigns are only interested solely in distributing this one particular fake security product. The file downloaded is called video99.exe or video66.exe and varies depending on the email message and the site used (HTML page names often correspond to the binary used index99.html, index66.html, etc).
Some of the subject lines of this particular spam campaign is:
“John McCain to Paris Hilton: Cosmo, baywatch!”
“Britney Spears Shaves Head at Request of Zombie Overlord”
Leave a Comment » | 
AV XP 2008, Malware analysis | Tagged: hacking tool, john mccain, malcode, malspam, Malware, paris hilton, security, spam, trojan, Virus, worm | 
Permalink
Posted by Ryan Sherstobitoff
August 28, 2008
This morning the AV XP 2008 spammers were at it again with another round of spam messages claiming to offer an update to Microsoft Windows Vista (we have seen similar attacks before offering false updates). However, when the user clicks the link he/she is directed to a malicious .swf that will download the file install.exe which essentially is a downloader Trojan designed to install AV XP 2008.
Leave a Comment » | AV XP 2008, Malware analysis | Tagged: anti-malware, anti-virus XP 2008, malcode, malicous code, Malware, spam, trojan, Virus, worm | Permalink
Posted by Ryan Sherstobitoff
August 28, 2008
A couple of minutes ago another round of spam messages appeared claiming to provide information concerning a statement of fees recently posted (inferring to banking account fees). The message contained an attachment with a fake Microsoft Word Document which actually is an executable (Fees-2008_2009.doc.exe) that installs a Trojan Downloader.
Further analysis indicates that the Trojan when installed connects to a php page hosted on a Russian domain to obtain several possible sites as a means of downloading the installer for AntiVirus XP 2008. The actual URLs are contained within this script and the file which is downloaded is lspr.exe (MD5 ffccd0518b04354532c733674c0faa00) and is identified as Adware/AVXP2008.
10 Comments | Malware analysis | Tagged: analysis, anti-virus XP 2008, hacking tool, malcode, malspam, Malware, security, spam, trojan, worm | Permalink
Posted by Ryan Sherstobitoff
