Members
  • Total Members: 12811
  • Latest: nodrog
Stats
  • Total Posts: 28507
  • Total Topics: 8238
  • Online Today: 852
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: New Exploit As Flash Player Upgrade (flashinstaller.exe, Zbot-MGA, Zbot.gen!R)  (Read 4580 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


Phishing campaign has hit more than 3.5 million mailboxes, researchers say.

Researchers have detected a new phishing attack that promises to enhance the security of the user's emailbox -- and then downloads a malicious Trojan instead.

The email requests that recipients click on a link in the body of the email to update the "security mode" of their emailboxes, according to researchers at Red Condor, an email security tool vendor.

Users who click on the link are taken to a Website that advises them to update to the latest version of the Macromedia Flash Player by downloading "flashinstaller.exe." This executable is actually a banking Trojan that is known to disable firewalls, steal sensitive financial data, and provide hackers with remote access capabilities, Red Condor says.

The malware is more commonly known as Win32:Zbot-MGA (Avast), W32/Bifrost.C.gen!Eldorado (F-Prot), PWS-Zbot.gen.v (McAfee), or PWS:Win32/Zbot.gen!R (Microsoft), the researchers note.

The spam campaign was detected late on Nov. 20; within the first six hours, Red Condor says it blocked more than 500,000 email messages. So far, the company says it has stopped more than 3.5 million messages belonging to this campaign.

"Protecting inboxes is seen as business-critical, so it is no surprise that spammers and cybercriminals are playing off of email users' growing security concerns with security-focused junk mail," says Tom Steding, president and CEO of Red Condor. Hours after the spam campaign began, only about half of the antivirus products had begun to recognize and block it, Steding says.

"Spam that suggests users update their Flash Player is a common type of scam during the holidays, but it is often associated with viewing a fake e-card or a viral video," Steding observes. "We encourage email users, particularly those returning to full inboxes after the Thanksgiving holiday, to immediately delete these messages and notify their IT administrators."

(darkReading)

Samker's Computer Forum - SCforum.info





F3RL

  • SCF Advanced Member
  • ***
  • Posts: 171
  • KARMA: 18
  • Gender: Male
Re: New Exploit As Flash Player Upgrade (install_flash_player_ax.exe)
« Reply #1 on: 27. November 2009., 09:34:51 »
Just to let you know, the actual or real flash installer's name is 'install_flash_player_ax.exe' (as of 27/11/09)
Triple-click on cancel button if you see any other file name than 'install_flash_player_ax.exe'
well? understand ma bad English.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Re: New Exploit As Flash Player Upgrade (install_flash_player_ax.exe)
« Reply #2 on: 27. November 2009., 09:42:07 »
Just to let you know, the actual or real flash installer's name is 'install_flash_player_ax.exe' (as of 27/11/09)
Triple-click on cancel button if you see any other file name than 'install_flash_player_ax.exe'


Thanks for info. Eric...  :up:

jasonx

  • SCF Newbie
  • *
  • Posts: 2
  • KARMA: 1
    • Laser Pointers
Thank you for sharing. Now I know that now..

Raviraj

  • SCF Newbie
  • *
  • Posts: 1
  • KARMA: 0
Yes even i have got the same mail regarding the Flash Player update . When i installed the flash player exe file instead of installing the flash player the exe file installs a malicious file Trojan. Its really a bad news. Thanks for updating about this issue.

Colorado Mortgage

fotis100

  • SCF Member
  • **
  • Posts: 29
  • KARMA: 1
  • Gender: Male
thanks for info

tuyugi007

  • SCF Member
  • **
  • Posts: 26
  • KARMA: 1
Thanks for the update

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising