|
|
|
Multi-language support Not your everyday spam |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : Sometime during the beginning of the year, we have encountered a surge in Fareit spams. Fareit is a downloader used to deliver Zeus and Cryptowall. Lately, we have been noticing yet another downloader being spammed. It seems that the spammer for this downloader has spent more effort to trick the user into believing that it s a legitimate email. A recent spam was a fake KLM e-ticket which was tailored to pretend to come from the Sales Service Center of Air France KLM. klm_eticket_ready 39k image However, this spammer did not only tend to English language speakers. Recently, we also saw quite a number of its spam sent in Polish. This email, for example, supposedly comes from dotpay.pl, a service for online transaction payment that is based in Poland. dotpay_blurred_ready 34k image While this one uses an ISP that s popular in Poland. nowy_kontrakt_listopad_ready 23k image And just when we thought the spammer s language skills ends there, it gave us a sample of its Finnish-themed spam. lomake_ready 24k image The grammar seems to be quite convincing enough considering that even the subject and attachments are using the correct Finnish terms. Not only that, the email address used, suomi24.fi , is one of Finland s most popular websites. Obviously, spammers are also doing their research in customizing their messages to produce more effective scams. Not only do they use the language of the target country or people, but they have also achieved to make use of popular email or service providers. The payload of these spams is a Trojan Downloader known as Wauchos. Here are its recent filenames attachments_ready 3k image For the two sample attachments, it confirms internet connection by trying to connect to http www.google.com webhp. It makes the following network connections http 188. 225.32.207 ssdc32716372 login.php http 188. 225.32.208 ssdc32716372 file.php http 188. 225.32.209 ssdc32716372 file.php http 188. 225.32.209 ssdc32716372 file.php http 188. 225.32.209 ssdc32716372 file.php http 92. 53.97.194 ssdc32716372 file.php http 46. 28.55.113 ssdc32716372 file.php And it downloads these additional trojans from the following http auto .it jeve.exe http dd .ru old.exe The Wauchos variants we ve seen in these emails downloaded either Zbot or Cridex, which are both information stealers. We detect these families as Trojan-Downloader W32 Wauchos, Trojan-Spy W32 Zbot, and Trojan W32 Cridex. On 31 10 14 At 04 01 PM
Les derniers articles du site "F Secure Antivirus Research Weblog" :
- OnionDuke APT Attacks Via the Tor Network
- What grade does your favorite app get
- Remember, Remember the Fifth of November
- Vote For Freedome Beta
- Multi-language support Not your everyday spam
- It's Not a Game - It's a Violation of Human Dignity
- 101 Bad Android Apps
- A Tale of Two Powerpoint Vulnerabilities
- Wanted Testers For The Greatest Android App Ever
- RATs threatening democracy activists in Hong Kong
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
