Threat Level: green Handler on Duty: Russ McRee

SANS ISC: Malware distributed through German-language spam mail SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Malware distributed through German-language spam mail

Eric wrote in with a new malicious message that is making the rounds in Europe. It's written in German, and contains a link to a Geocities account with an invisible iframe link. The content of one of the e-mails is below:

"Die Berliner U-Bahn Mitarbeiter fanden die Reste eines unbekannten Flugkoerpers.
Interessant findet man auch die Ermittlung von moeglichen Gruenden des
Unwohlseins einiger U-Bahn Angestellten. Nach etlichen Inspektionen wurde ein
Fremdkoerper gefunden. Wie Wissenschaftler behaupten, koennte der Koerper so
gross wie ein Bus sein. Es wurde auch vermutet, er haette seltsame Strahlen
aussenden koennen und das wegen rund um dem Rumpf gebildeter "Totzone".
Naeheres dazu unter http://geocities.com/[filtered]"

Very interesting story about an unidentified flying object and body found in the Berlin underground. The geocities URL mentioned is different in every single mail, and points to an index.html which contains a hidden iframe pointing to a server in Hong Kong, 58.65.239.106. While this host has likely been victimized, you may wish to temporarily block it on your web proxy.

That server is hosting a file update.exe which has spotty AV coverage at this time:

AntiVir 7.3.1.52 04.16.2007 HEUR/Malware
F-Secure 6.70.13030.0 04.16.2007 W32/Malware
Ikarus T3.1.1.5 04.16.2007 Trojan-Spy.Win32.Goldun.lw
Norman 5.80.02 04.14.2007 W32/Malware
Sophos 4.16.0 04.12.2007 Mal/Binder-C
VBA32 3.11.3 04.14.2007 MalwareScope.Trojan-Spy.BZub.1
Webwasher-Gateway 6.0.1 04.16.2007 Heuristic.Malware

--
Maarten Van Horenbeeck

Maarten

158 Posts
Apr 16th 2007

Sign Up for Free or Log In to start participating in the conversation!