In the past we’ve seen many variants of the UPS email containing an attached trojan in a zip file known now as Win32/Kollah.RT, 32/Zbot.GXN!tr.spy or TrojanSpy:Win32/Zbot.gen!C according to the virus engine. Since yesterday we’ve seen a new variant and it…
Messages with the subject Re: F.C. Doc. contain an attached file Doc_N012.zip that contain according to F-Secure the Trojan-Downloader.Win32.Small.aglf or known as Mal/EncPk-CO by Sophos. The contents of the email: Hello, onkar-amodik. We send the updated report. Ssory for a…
UPDATE, Nov 27th: One of the new CnC servers, ‘sdx3Fs5B.info’ was resolving to 72.233.114.74 at LayeredTech. FireEye sent an abuse notification to LayeredTech when the CnC servers went online and they have pulled out the server. —————-…
After the take down of the internet connections for the US ISP McColo on November, 11th 2008, spam levels dropped worldwide between 50% and 75% according to some sources. 5 botnets Rustock, Srizbi, Pushdo/Cutwail, Ozdok/Mega-D…
McColo, the ISP that has been taken down because of their malicious activities, was back online during a brief period thanks to the Swedish ISP TeliaSonara AB that has a router in San Jose. The peering…
SMTP connections that involves spam have dropped 50% at MX Lab since yesterday. At first, we thought we faced a technical problem and all systems where checked to be sure but there where less SMTP…
Emails with the following subjects contain the Trojan.Downloader-58166, W32.SillyDC or Worm.Win32.AutoRun.rwo, depending on the anti virus engine, in the file active_key.zip. It is being detected by 12 of the 36 anti virus engines at Virus Total. The Activation Keys…
It not happens very often but this spam is written in Dutch and doesn’t contains spelling or grammar mistakes. An example: Iemand heeft de dobbelstenen gegooid en heeft voor jou een verbazingwekkende bonusaanbieding. Kom…
Phishers try to get confidential information and most these guys are out for your login and password of your banc accounts or credit card details. However, the latest phishing attemps are more targeted towards domain…
