Threat Spotlight

For the week of 07 Mar 2011
Threat 1

Malware exploits Java vulnerability

Threat Name:

Mal/JavaKP-N

Users at Risk:

Windows users

Also Known As:

  • AVP: Exploit.Java.CVE-2010-0840.b
  • Kaspersky: Exploit.Java.CVE-2010-0840.b
  • Microsoft: TrojanDownloader:Java/OpenConnection.G
  • Trend Micro: JAVA_DLDR.WQ

Removal Instructions:

Please use the instructions for removing generically detected files to delete the file from your computer.

About:

Mal/JavaKP-N is a Java malware that exploits vulnerability CVE-2010-0840 in the Java Runtime to get access to the victim system. CVE-2010-0840 is a Java vulnerability publicly disclosed in April 2010. It was patched by Oracle in March 2010.

This threat spreads through web pages that contain a malicious Java Applet. The malware usually downloads and executes additional malicious software on the victim system.

Threat 2

Spam dating email sent from an old friend

About:

The messages start with what sounds like an old friend finding the recipient’s contact information after a long disconnect. The "old friend" then mentions their new email address, which is of course different from the source email address, and then asks the recipient to contact them when they have time.

Sample message:

I just found your profile on the net and couldn't belive it's you :) I haven't see you for ages! How are you doing? Here's my new email:
<redacted>@hotmail.com please drop me a line when you have a time
cheers

This campaign is being launched by bots all over the world and uses various source email addresses to prevent IP or email filtering. For the most part, the spammers managed to keep the names consistent in the email headers:

lara <lara62@<redacted>.net>

Not always though:

stevie <kristy19@<redacted>.net>
While the campaign uses different subject lines, there aren't many variations:

liked your profile
wanna chat?
hello
RE:
hi there

Since this is the first email in what is undoubtedly a scam, the spammer tries to establish trust first before moving on to asking the recipient for money to send them naughty pictures/help them escape from some foreign country/send them pills. As always, never send money to people you met through email only.

As of the time of this writing, this spam campaign is still going strong. While we applaud the spammers' attempt to reconnect old friends, we suggest you use other methods.

Threat 3

Typo-ridden DHL spam harbors Trojan

Threat Name:

Troj/Agent-QQG

Users at Risk:

Windows users

Also Known As:

  • Avira: TR/Spy.ZBot.PB
  • F-Secure: Backdoor.Win32.Bifrose.fxe
  • Kaspersky: Backdoor.Win32.Bifrose.fxe
  • Microsoft: VirTool:Win32/VBInject
  • Symantec: Trojan.Dropper

Removal Instructions:

Please follow the instructions for removing Trojans.

About:

This Trojan is normally found as a spam attachment with attachment name "DHL_document.zip." The spam email has the subject "DHL notification."

The message body reads as follows:

Dear customer.
The parcel was send your home address.
And it will arrice within 7 bussness day.

More information and the tracking number
are attached in document below.

Thank you.
2011 DHL International GmbH. All rights reserverd.