Become a Spam Bot — For Free!

Several pieces of malware I’ve been investigating lately are spambots, tools that turn your computer into a source of spam for the folks running such operations. This one I got this morning first looked like a Nurech spambot, but it turned out to be a simple downloader. Standard-type lure, this one claimed to be from eBay in Germany and encouraged me to look at the attachment (inside the ZIP was a file named Ebay.jpg.exe).

ebay_mail

This file, once executed, is only the start. What it grabbed, in turn, was a set of executables that set itself up on a trio of servers: http://81.95.147.138/, http://marketing-know-how.com/, and http://www.eurowing.us/. The first and third of those are no longer reachable by the bot (the full URLs have been taken down), but the second one is up and running. In addition to some binaries and files for communication, it also contains the HTML templates for the spam runs. The current one appears to be for hair loss products, I wonder what will be next.

hairloss_spam

This doesn’t appear to be widespread at this point, but this is the kind of thing we’re seeing increasingly: spam bots with templates. And as much as you hate spam in your inbox, and the world hates spam at large, remember: you can be part of the problem if you’re not careful. And finally, note that while you help these folks “advertise” dubious products, you don’t see one cent of what they make off of your problem.

3 Responses to “Become a Spam Bot — For Free!”

March 16, 2007 at 2:41 pm, Me said:

Hi,

this is not a spam bot and this is not a spam template. This page have been there since some time already. Maybe a copy from a legitimate web site to look more unsuspicious. But the domain marketing-know-how.com has been the seeding point for many malicious files used by some invoice trojan downloaders mass spammed in Germany the last months.

But I agree, that spam bots which uses spam template are on the rise.

June 14, 2007 at 10:17 pm, gary rager said:

cool stuff

February 04, 2008 at 5:37 am, bob said:

rofl nice one please send me free spam i love it. And if you can send me some porn…

thanks,
bob

Comments are closed.