Greeting e-card from Hallmark leads to download of Net-Worm.Win32.Mytob
April 7, 2010 1 Comment
MX Lab reports that a new campaign regarding greeting e-card that lead to malware is in circulation.
The messages have the subject “You have received a greeding e-card !” and come from the spoofed email address <[email protected]> to make it look genuine and coming from Hallmark itself, which is obviously not the case.
The email looks like this:
The link under “To see it, click here” and “We invite you to make a friend’s day and send one.” will lead you to a server that hosts the 2,9 MB large file ecard.exe which is malware known as Net-Worm.Win32.Mytob (Ikarus) or Win32:Malware-gen (Avast).
Virus Total permlink and MD5: 220934c050bb2335889b56a807026109.
Any chance you could share the binary? We’ve been seeing Hallmark scams since December. It also appeared to be a variant of much older malware - though I’d have to pull my notes. I’d like to compare though to see fi this is new.