One encouraging detail is that when Longmore tested the malware against VirusTotal in his first blog post (Wednesday), only one out of 48 anti-virus engines detected it as malware (Kaspersky). "Well it appears that in order to celebrate their return, they've acknowledged my acknowledgement in the form of a malware landing page of ." He adds, "The domain dynamooblog ru was registered yesterday to the infamous Russian 'Private Person' and is hosted on a lot of IPs that have been serving up Zbot for some time."ĭespite the difference in the emails, the intent is the same – to install a Zeus derivative via dynamooblog ru. Your old password has expired and you'll need to create a new one to log in." "We have a warning in our system," it claims, "that you recently tried to login to Dropbox with a password that you haven't changed long time already. Two days later, on Friday last week, he found new Dropbox scam emails similar but not identical to the one found by AppRiver. Last week Conrad Longmore at Dynamoo wrote "fake Pinterest spam leads to a malicious download on alenikaofsa ru:8080 ieupdate exe" (notice the same malicious file), and asked, is this "the return of the RU:8080 gang?" This would appear to be a joke, because is a genuine security blog that has been writing about the suspected attackers known as RU:8080. The file is a Trojan that is part of the Zeus family."ĪppRiver notes that all of the links in the email messages came from 54 unique domains, but the malware itself is downloaded from the newly registered. However, warns AppRiver in a blog posting, "Clicking anything in the linked notification page downloads a file ieupdate.exe. "We detected your browser is NOT up-to-date" it says, inviting the user to select which browser out of Chrome, Internet Explorer or Firefox should be updated.
But of course, clicking the reset button does not instigate a password reset, but instead leads the user to an internet page that claims the user's browser is out of date. The email includes a sad-faced-computer-thinking-about-Dropbox cartoon graphic, and a 'Reset Password' button.
0 kommentar(er)
