Michael Jackson Death Prompts Malicious Spam

Posted on Friday, June 26, 2009 @ 09:33:44 PDT in Security: Websense
by Raven

::

From WebSense Security Labs

Michael Jackson Death Prompts Malicious Spam

Date:06.26.2009

Threat Type: Malicious Web Site / Malicious Code

Websense Security Labs(tm) ThreatSeeker(tm) Network has discovered spam emails offering recipients links to unpublished videos and pictures of singer Michael Jackson. According to news reports Michael Jackson's death was confirmed yesterday.

The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default browser in order to distract the user by presenting a news article for them to read.

In the background, three further information-stealing components are downloaded and installed by the malware. One of the downloaded files is called michael.gif, which has low AV detection rates - see VT results here. The malware then installs a malicious BHO that is registered with this file %windir%Dynamic.dll and this GUID {FCADDC14-BD46-408A-9842-CDBE1C6D37EB}. Another component is bound to startup at %windir%system32kproces.exe. Another malicious file installed by the malware is %windir%system32fotos.exe.

Translation of the email is as follows:
::::

Screenshot of the malicious spam:

Screenshot of the malicious file masquerading as a video:

Websense® Messaging and Websense Web Security customers are protected against this attack.

::

 
 
click Related        click Share
 
 
Associated Topics

Security
 
News ©

Site Info v2.2.2 ©

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 369,744,441
  • Today: 51,595
Server InfoServer Info
  • Oct 20, 2018
  • 11:49 am PDT
 
 

Daily Inspiration