It’s not just banks that hackers deploy phishing attacks against; it has been seen that hackers also deploy attacks against other payment processing services such as MoneyGram, Equifax, Western Union, etc as a way of gaining profit through harvesting personal details.
There is another round of spam messages claiming to be a ticket receipt for Southwest Airlines. The message attempts to entice the user into opening an attachment containing the electronic ticket which is actually malware classified as W32/Autorun.AEL.worm. The ploy here is the note that the ticket reservation system has changed and that an account has been created.
Recently we have noticed several email messages claiming to come from Lloyds TSB a London, UK based financial entity informing customers that they are required to login and accept an updated terms and conditions, otherwise their account will be suspended. The messages appear to be coming from firstname.lastname@example.org; however, when further analysis is done on the message header it is actually coming from several domains ending with .es.
When the user clicks the link below thinking they will be going to the terms and conditions, they are actually sent to a fake Lloyds banking site that guides the user through the login process (in an effort to steal credentials).
This morning the Celebrity spam campaign continued with a few new fake video codec sites delivering a downloader Trojan designed to install a fake security product known as AntiVirus XP 2008. It’s apparent now that a number of these spam campaigns are only interested solely in distributing this one particular fake security product. The file downloaded is called video99.exe or video66.exe and varies depending on the email message and the site used (HTML page names often correspond to the binary used index99.html, index66.html, etc).
Some of the subject lines of this particular spam campaign is:
“John McCain to Paris Hilton: Cosmo, baywatch!”
“Britney Spears Shaves Head at Request of Zombie Overlord”
A couple of minutes ago another round of spam messages appeared claiming to provide information concerning a statement of fees recently posted (inferring to banking account fees). The message contained an attachment with a fake Microsoft Word Document which actually is an executable (Fees-2008_2009.doc.exe) that installs a Trojan Downloader.
Further analysis indicates that the Trojan when installed connects to a php page hosted on a Russian domain to obtain several possible sites as a means of downloading the installer for AntiVirus XP 2008. The actual URLs are contained within this script and the file which is downloaded is lspr.exe (MD5 ffccd0518b04354532c733674c0faa00) and is identified as Adware/AVXP2008.
Spammers continue their efforts today with another round of celebrity oriented spam designed to entice users into watching a non-existent video. The fake video site exhibits the same behavior found in the CNN and MSNBC spam attacks covered earlier this month (i.e. a popup message indicates that the ActiveX movie control is out of date and the user is required to install an update to properly view the video).
The executable the user is forced into downloading and installing is known as install.exe or classified as a malicious Trojan – Trj/Exchanger (this particular threat will install AntiVirus XP 2008). It is apparent that the spammers are very interested in getting a large number of users to install and use false security products such as AV XP 2008 and it’s variants in an effort to generate revenue.
We have been tracking a number of spam messages over the last couple of days pertaining to celebrities involved in a number of odd and unexplained activities. The binary file being delivered in this latest spam run involving Paris Hilton is stream.exe which is meant to lure a user into executing the file hidden behind the link, thus, the user thinking he/she will be viewing a video is actually getting a Trojan. Stream.exe is identified as a varient of Trj/Exchanger:
|File size: 78848 bytes|