Thursday, January 25, 2007 7:58 AM cmosby

F-Secure : News from the Lab - Of Love and Bills

Oh boy here we go again...
Of Love and Bills Posted by Kimmo @ 07:01 GMT

A new round of malicious billing spam e-mails were received yesterday. All attachments have the filename of Rechnung.pdf.exe. Two variants emerged from these spams: W32/Nurech.X and W32/Nurech.Y.

Later in the day, the phrase "Love is all Around" was given a new meaning when another batch of Stormy was received. This new Stormy is still adhered to the theme of Love. Filenames of this new variant could be any of the following:

   Flash Postcard.exe
   Greeting Postcard.exe
   Greeting Card.exe
   Postcard.exe
   flash postcard.exe
   greeting card.exe
   greeting postcard.exe
   postcard.exe

Attachments are now detected as Trojan-Downloader.Win32.Small.ciw.

As seen from the newest samples, social engineering techniques are still employed to entice a portion of the recipients to execute the malicious attachments.

Vigilance and caution are always advised.

F-Secure : News from the Lab - January of 2007.

Filed under: , ,

Comments

No Comments