Arbor Networks: Security to the Core

Several pieces of malware I’ve been investigating lately are spambots, tools that turn your computer into a source of spam for the folks running such operations. This one I got this morning first looked like a Nurech spambot, but it turned out to be a simple downloader. Standard-type lure, this one claimed to be from eBay in Germany and encouraged me to look at the attachment (inside the ZIP was a file named Ebay.jpg.exe).

This file, once executed, is only the start. What it grabbed, in turn, was a set of executables that set itself up on a trio of servers: http://81.95.147.138/, http://marketing-know-how.com/, and http://www.eurowing.us/. The first and third of those are no longer reachable by the bot (the full URLs have been taken down), but the second one is up and running. In addition to some binaries and files for communication, it also contains the HTML templates for the spam runs. The current one appears to be for hair loss products, I wonder what will be next.

This doesn’t appear to be widespread at this point, but this is the kind of thing we’re seeing increasingly: spam bots with templates. And as much as you hate spam in your inbox, and the world hates spam at large, remember: you can be part of the problem if you’re not careful. And finally, note that while you help these folks “advertise” dubious products, you don’t see one cent of what they make off of your problem.

This entry was posted on Friday, March 16th, 2007 at 10:23 am and is filed under Arbor Networks, Spam, Trojan Horses. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.