Anti Virus Softwares

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Tuesday, 1 December 2009

Minipost: CDC Version of Zeus?

Posted on 10:02 by Unknown
Emails like this:



You have received this e-mail because of the launching of State Vaccination H1N1 Program.

You need to create your personal H1N1 (swine flu) Vaccination Profile on the cdc.gov website. The Vaccination is not obligatory, but every person that has reached the age of 18 has to have his personal Vaccination Profile on the cdc.gov site. This profile has to be created both for the vaccinated people and the not-vaccinated ones. This profile is used for the registering system of vaccinated and not-vaccinated people.
Create your Personal H1N1 Vaccination Profile using the link:

create personal profile



using subjects like these:

Create your personal Vaccination Profile
Creation of personal Vaccination Profile
Creation of your personal Vaccination Profile
Governmental registration program on the H1N1 vaccination
Instructions on creation of your personal Vaccination Profile
State Vaccination H1N1 Program
State Vaccination Program
Your personal Vaccination Profile

Pointing to websites like this:

online.cdc.gov.lykasf.be
online.cdc.gov.lykasm.be
online.cdc.gov.lykasv.be
online.cdc.gov.lykasz.be
online.cdc.gov.nyugewc.be
online.cdc.gov.nyugewd.be
online.cdc.gov.nyugewm.be
online.cdc.gov.nyugewn.be
online.cdc.gov.nyugewq.be
online.cdc.gov.nyugewt.be
online.cdc.gov.nyugeww.be
online.cdc.gov.nyugewy.be
online.cdc.gov.nyugewz.be
online.cdc.gov.yhnbad.co.im
online.cdc.gov.yhnbad.com.im
online.cdc.gov.yhnbad.im
online.cdc.gov.yhnbad.net.im
online.cdc.gov.yhnbad.org.im
online.cdc.gov.yhnbak.co.im
online.cdc.gov.yhnbak.com.im
online.cdc.gov.yhnbak.im
online.cdc.gov.yhnbak.net.im
online.cdc.gov.yhnbak.org.im
online.cdc.gov.yhnbam.co.im
online.cdc.gov.yhnbam.com.im
online.cdc.gov.yhnbam.im
online.cdc.gov.yhnbam.net.im
online.cdc.gov.yhnbam.org.im
online.cdc.gov.yttt4l.co.im
online.cdc.gov.yttt4l.com.im
online.cdc.gov.yttt4l.im
online.cdc.gov.yttt4l.net.im
online.cdc.gov.yttt4l.org.im
online.cdc.gov.yttt4r.co.im
online.cdc.gov.yttt4r.com.im
online.cdc.gov.yttt4r.im
online.cdc.gov.yttt4r.net.im
online.cdc.gov.yttt4r.org.im




Dropping malware like this:

vacc_profile.exe
File size: 130048 bytes
MD5 : 5767b2c6d84d87a47d12da03f4f376ad

VirusTotal report showing 6 of 41 detects

(Tip o' the hat to Andrew F, who beat me to the punch with this one...)
Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest
Posted in zbot | No comments
Newer Post Older Post Home

0 comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Popular Posts

  • From Russia, With Love . . . new Postcard spam spies on your PC
    Isn't it nice to have friends who send you postcards? The UAB Spam Data Mine is especially fortunate in that way. Beginning the evenin...
  • Happy New Year! Here's a Virus! (New Year's Postcard malware)
    I've been busy this week looking at the various defacements (see ComputerWorld , and ABC News ) and other cyber attacks (see yesterday...
  • Tempting Photo Attachments Lead to Fake AV
    One of today's largest malicious spam campaigns continued an occasional theme we've been seeing for a few weeks. A subject line, fo...
  • A Prominent American Express Phish
    Every once in a while we see a spam campaign where we dig in to the complexity, expecting to find malware, and find that the criminal has ju...
  • Fake AV Malware Hits the Android
    Mobile Defender - the last line of protection Having studied malware delivered by spam for the past seven years, it is a fairly rare event f...
  • When Parked Domains Still Infect - Internet.bs and ZeroPark
    Last night I was discussing the Kelihos botnet with some friends. There had been several previous attempts to “Kill Kelihos” and I decided ...
  • Cross Brand Intelligence and Phishing
    While there is certainly a reason to shut down any site imitating your company as fast as possible, we have to always consider what the impl...
  • Anonymous, #OpBankster, and the Too Many Nancy's Problem
    The current Anonymous "#OpBanksters" seems to have very little in common with the original operation by the Anonymous Portuguese g...
  • Vista Security Features
    BitLocker Drive Encryption A Real-world Windows Vista BitLocker Tip BitLocker Drive Encryption BitLocker Drive Encryption Frequently Asked Q...
  • 2008: Looking back on a Year of Spam and Malware
    Happy New Year! As we get ready for the New Year, there are quite a few security folks making predictions for 2009. I think my friend Dan...

Categories

  • Blogs
  • Calendar
  • china
  • Communities
  • computer security careers
  • conficker
  • cyberwar
  • digital certificates
  • Drivers
  • email
  • Excel 2007
  • facebook
  • fake av
  • Features
  • Firewall
  • Gadgets
  • gumblar
  • Hardware
  • Hotmail
  • IE7
  • Internet Explorer 7
  • koobface
  • law enforcement
  • malware
  • Microsoft
  • Outlook
  • pharmaceuticals
  • phishing
  • PowerPoint 2007
  • public policy
  • Ready Boost
  • ReadyBoost
  • Security
  • Sidebar
  • Software
  • spam
  • Tutorials
  • twitter
  • twitter malware
  • USB
  • Virtual PC
  • Vista
  • waledac
  • Wallpaper
  • Websites
  • Windows
  • Windows Live
  • Windows Vista
  • Word 2007
  • zbot

Blog Archive

  • ►  2013 (17)
    • ►  November (1)
    • ►  October (1)
    • ►  September (1)
    • ►  August (3)
    • ►  July (1)
    • ►  June (1)
    • ►  May (5)
    • ►  April (3)
    • ►  March (1)
  • ►  2012 (18)
    • ►  August (1)
    • ►  June (1)
    • ►  May (7)
    • ►  April (2)
    • ►  March (7)
  • ►  2011 (28)
    • ►  November (3)
    • ►  October (1)
    • ►  August (4)
    • ►  July (6)
    • ►  June (1)
    • ►  May (2)
    • ►  April (2)
    • ►  March (6)
    • ►  February (1)
    • ►  January (2)
  • ►  2010 (80)
    • ►  December (6)
    • ►  November (10)
    • ►  October (6)
    • ►  September (12)
    • ►  August (5)
    • ►  July (4)
    • ►  June (11)
    • ►  April (7)
    • ►  March (8)
    • ►  February (4)
    • ►  January (7)
  • ▼  2009 (93)
    • ▼  December (12)
      • New Year's Waledac Card
      • 2009 Year in Review
      • A donde se va Avalanche? BBVA! y United Bankers ...
      • Some updates . . . Visa/Zeus and Google Jobs
      • Who is the "Iranian Cyber Army"? Twitter DNS Redi...
      • China changes registration rules - will spam chang...
      • Ongoing VISA scam drop Zeus Zbot
      • Minipost: Google v. Pacific WebWorks
      • Yet Another Facebook spam - New Zeus / Zbot threat
      • Webmasters Targeted by CPANEL phish
      • Minipost: CDC Version of Zeus?
      • Google Jobs Scam: Read the Fine Print
    • ►  November (11)
    • ►  October (16)
    • ►  September (7)
    • ►  July (5)
    • ►  June (10)
    • ►  May (2)
    • ►  April (7)
    • ►  March (7)
    • ►  February (6)
    • ►  January (10)
  • ►  2008 (109)
    • ►  December (7)
    • ►  November (17)
    • ►  October (12)
    • ►  September (10)
    • ►  August (23)
    • ►  July (14)
    • ►  June (3)
    • ►  May (8)
    • ►  April (6)
    • ►  March (2)
    • ►  February (3)
    • ►  January (4)
  • ►  2007 (37)
    • ►  December (3)
    • ►  November (9)
    • ►  October (3)
    • ►  September (2)
    • ►  August (5)
    • ►  July (5)
    • ►  April (2)
    • ►  March (2)
    • ►  February (2)
    • ►  January (4)
  • ►  2006 (5)
    • ►  December (2)
    • ►  October (3)
Powered by Blogger.

About Me

Unknown
View my complete profile