FakeRean trojan is using the same subject of the latest ZBot variant

MX Lab just intercepted an email with the subject A new settings file for the jp@******.com has just been released, similar to the latest ZBot variant, but with a major difference in distribution. This time the email conatins the ZIP archive install.zip with the executable install.exe. Body of the email: Dear user of the ****.com mailing service! We [...]


MX Lab just intercepted an email with the subject “A new settings file for the jp@******.com has just been released”, similar to the latest ZBot variant, but with a major difference in distribution. This time the email conatins the ZIP archive install.zip with the executable install.exe.

Body of the email:

Dear user of the ****.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox jp@****.com settings were changed. In order to apply the new set of settings open zip attached file.

Best regards, ****.com Technical Support.

Further investigation shows us that this virus is listening to the name W32/FakeRean.A.gen!Eldorado (F-Prot), TrojanDownloader:Win32/FakeRean (Microsoft),  W32/PackSpam.A!worm (Fortinet) or W32/FakeAV.AE!genr (Norman).

Virus Total permlink and MD5: 7d96ce7f588613f0343049918de70665. Only 15 of the 41 AV engines detected the trojan correctly. For more information regarding this tojan you could check out the Microsoft Malware Protection Center.


Read Full Article
GSO
Written on Wednesday, 14 October 2009 04:56 by GSO

Viewed 116 times so far.
Like this? Tweet it to your followers!
Published in Subscribe to the RSS feed of Network Security & Hacking News  Network Security & Hacking News / Subscribe to the RSS feed of Latest Security News  Latest Security News
Like this? Let your friends know now!

Rate this article

Latest articles from GSO

Latest 'tweets' from GovernmentSecurity

  • News Update: Cyber war is coming, the impact could be huge: CBS News reports that cyber.. http://bit.ly/1tx1kr | #Security Link Monday, 09 November 2009 07:35
  • News Update: Tenable Network #Security Podcast - Episode 11: Welcome to the Tenable Netw.. http://bit.ly/2Iqd6G | Security Link Monday, 09 November 2009 07:35
  • News Update: Consent will be required for cookies in Europe: EDITORIAL: A law that dema.. http://bit.ly/3JYgip | #Security Link Monday, 09 November 2009 07:35
  • News Update: CBS 60 Minutes tackles cyber-terrorism: Could hackers get into the compute.. http://bit.ly/2d5Y21 | #Security Link Monday, 09 November 2009 07:35
  • Blog Update: We have launched the new GovernmentSecurity.org: We decided to launch th.. http://bit.ly/2G1SSF | #Security Link Saturday, 07 November 2009 17:38
blog comments powered by Disqus
back to top

Site Search

Disqus Tools