Email-Worm.Win32.Sober.aa
Spams from AntiFraud
We have received numurous spams about Internet Explorer 7.0 Beta. These spams are masquerated from Microsoft, and a file "update.exe" will be downloaded. It's a trojan downloader. Please be careful.
The spam is as the following:
If clicks this picture, "update.exe" will be downloaded. As now, we have received lots of different urls. They are include:
The size is 4,608 bytes, MD5 hash is dd2afa3c001def1d3c68ea39f280c05a. Kaspersky detects it as Trojan-Downloader.Win32.Agent.bjo.
Last modified by smallmo onMay 5, 2007 22:39
The spam is as the following:
Quotation
From: admin@microsoft.com
Subject: Internet Explorer 7.0 Beta
Body: (a picture of Internet Explorer 7.0 Beta)
Subject: Internet Explorer 7.0 Beta
Body: (a picture of Internet Explorer 7.0 Beta)
Quotation
From: Admin@windows.com
Subject: "Internet Explorer 7.0 Beta" download.
Body: (a picture of Internet Explorer 7.0 Beta)
Subject: "Internet Explorer 7.0 Beta" download.
Body: (a picture of Internet Explorer 7.0 Beta)
If clicks this picture, "update.exe" will be downloaded. As now, we have received lots of different urls. They are include:
http://addys.co.uk/<removed>/update.exe
http://dynaplastt.com/<removed>/update.exe
http://dzwebsolutions.net/<removed>/update.exe
http://gloriousfailure.com/<removed>/update.exe
http://gmasinc.com/<removed>/update.exe
http://gmba.com/<removed>/update.exe
http://goalmastery.net/<removed>/update.exe
http://gojenola.com/<removed>/update.exe
http://goldenmexico.com/<removed>/update.exe
http://mitien.clan.su/<removed>/update.exe
http://dynaplastt.com/<removed>/update.exe
http://dzwebsolutions.net/<removed>/update.exe
http://gloriousfailure.com/<removed>/update.exe
http://gmasinc.com/<removed>/update.exe
http://gmba.com/<removed>/update.exe
http://goalmastery.net/<removed>/update.exe
http://gojenola.com/<removed>/update.exe
http://goldenmexico.com/<removed>/update.exe
http://mitien.clan.su/<removed>/update.exe
The size is 4,608 bytes, MD5 hash is dd2afa3c001def1d3c68ea39f280c05a. Kaspersky detects it as Trojan-Downloader.Win32.Agent.bjo.
Last modified by smallmo onMay 5, 2007 22:39
