Threat Spotlight

For the week of 20 Oct 2011
Threat 1

Pharma spam spoofs Facebook notifications

About:

We've been monitoring a pharmacy spam campaign for some time that shows no decline in message volume. This campaign attempts to forge the message header and body content to look like a real message from Facebook.

Often the HTML structure and message headers are identical to messages sent by Facebook. The messages include a From header that makes it seem like Facebook is the sender, although not all forge Facebook's domain, facebookmail.com. Examples include:  

Facebook [update+some_id]@facebookmail.com
Facebook [notification+some_id]@notifierfacebook.com
Facebook [notification+some_id]@textfacebook.com
Facebook [notification+some_id]@facebookmail.com
Facebook [notification+some_id]@clockfacebook.com
Facebook [notification+some_id]@notifierfacebook.com
Facebook [notification+some_id]@balloonerfacebook.com
Facebook [notification+some_id]@balloonsfacebook.com
Facebook [notification+some_id]@facebookjailed.com

Samples of the phony message subject lines include many that are found in legitimate Facebook emails.

Subject: Getting back onto Facebook
Subject: You have 4 lost messages on Facebook...
Subject: You have 3 lost messages on Facebook...
Subject: You have 1 lost message on Facebook...
Subject: You have 2 lost messages on Facebook...
Subject: [random first name][random last name] sent you a message on Facebook...
Subject: Hi, you have notifications pending
Subject: Facebook has sent you a notification...
Subject: Facebook Administration has sent you a message
Subject: Oops.. You have notifications pending
Subject: You have 3 lost messages on Facebook...
Subject: You have notifications pending
Subject: New notification from Facebook

True Facebook messages are sent by IPs under the control of Facebook. And all legitimate Facebook emails contain links to domains under Facebook's control, such as facebook.com. But the spam messages are sent via many different spambots and compromised hosts throughout the world.

The spam emails direct users to domains under the control of the spammers, which are typically compromised legitimate domains. Currently the website is a basic page asking the reader to "Buy Viagra Online." This page links to one of many "Pharmacy Express" templates.

This campaign exploits users who allow Facebook to send them too many notifications, which could prevent these messages from being scanned and identified as spam. The spammers are counting on the fact that users are more likely to click on a link in the message if they believe it comes from a legitimate source like Facebook.

Threat 2

Phony company email is a sneaky Trojan

Threat Name:

Troj/Inject-QL

Users at Risk:

Windows users

Also Known As:

Avira TR/Dldr.Injecter.gxz
AVP Trojan-Downloader.Win32.Injecter.gxz
K7 Trojan-Downloader ( 002f252b1 )
Trend Micro TROJ_BENNET.A

Removal Instructions:

Please follow the instructions for removing Trojans

About:

Troj/Inject-QL is a Trojan for the Windows platform.

Recently we've seen this Trojan attached to spam claiming to come from someone inside the recipient's company and warning them of a virus. The message directs recipients to download an antivirus software, which is actually malware.

When run, the Trojan may create the following files:

<Systemroot>\query.txt
<Program Files>\NetMeeting\netsa.dll
<Windows>\java\java.dll

At the time of analysis, the above three files were not available.

Threat 3

Infamous MyDoom worm spams itself out

Threat Name:

W32/MyDoom-O

Users at Risk:

Windows users

Also Known As:

Kaspersky Lab Email-Worm.Win32.Mydoom.m
McAfee W32/Mydoom.o@MM
Microsoft Worm:Win32/Mydoom.O@mm
Symantec W32.Mydoom.M@mm
Trend Micro WORM_MYDOOM.M

Removal Instructions:

Please follow the instructions for removing worms

About:

W32/MyDoom-O is a mass-mailing worm first discovered in 2004. It continues to spread by sending itself as an attachment to harvested email addresses. It relies entirely on social engineering to encourage users to open and execute its attachment. The malware currently contains no exploit code.

W32/MyDoom-O has an inbuilt SMTP engine that it uses to spam addresses harvested from the host machine. It spoofs email From addresses according to its current template (obtained by either a command and control server or its peers).

W32/MyDoom-O creates a file named services.exe in the Windows or Temp folder and runs the file. Services.exe is a backdoor component.

W32/MyDoom-O searches the hard disk for email addresses. In addition it may use an Internet search engine to find more email addresses. The worm will send a query to the search engine using domain names from email addresses found on the hard disk. It examines the query results, searching for more addresses.

Click here for a detailed analysis of MyDoom from our SophosLabs experts.

© 1997 - 2013 Sophos Ltd. All rights reserved. Legal Privacy Cookie Information