Michael Jackson Death Prompts Malicious Spam

(PresseBox) (Köln, ) Websense Security Labs(TM) ThreatSeeker(TM) Network has discovered spam emails offering recipients links to unpublished videos and pictures of singer Michael Jackson. According to news reports <http://edition.cnn.com/2009/SHOWBIZ/Music/06/25/michael.jackson/index.html>  Michael Jackson's death was confirmed yesterday.

The spam email appears to offer a link to a YouTube video, but instead sends the recipient to a Trojan Downloader hosted on a compromised Web site. The file offered is called Michael.Jackson.videos.scr (MD5: 664cb28ef710e35dc5b7539eb633abca). This file is located on a legitimate Web site hosted in Australia belonging to a radio broadcasting station. Upon executing the file, a legitimate Web site at http://musica.uol.com.br/ultnot/2009/06/25/michael-jackson.jhtm is opened by the default browser in order to distract the user by presenting a news article for them to read.

In the background, three further information-stealing components are downloaded and installed by the malware. One of the downloaded files is called michael.gif, which has low AV detection rates - see VT results here <http://www.virustotal.com/analisis/67cba7b9d91e1cbcac0f22b5f4bcf12f4b07a1a62d7d3018e28ccd5ee93e0ce4-1246012313> . The malware then installs a malicious BHO that is registered with this file %windir%/Dynamic.dll and this GUID {FCADDC14-BD46-408A-9842-CDBE1C6D37EB}. Another component is bound to startup at %windir%\system32\kproces.exe. Another malicious file installed by the malware is %windir%\system32\fotos.exe.

Websense® Messaging and Websense Web Security customers are protected against this attack.

To view the details of this alert Click here <http://securitylabs.websense.com/content/Alerts/3426.aspx>

Press releases you might also be interested in

Subscribe for news

The subscribtion service of the PresseBox informs you about press information of a certain topic by your choice at a choosen time. Please enter your email address to receive the email with the press releases.

An error occurred!

Thank you! You will receive a confirmation email within a few minutes.


Ich möchte die kostenlose Pressemail abonnieren und habe die Bedingungen hierzu gelesen und akzeptiert.