There's a cream for that<div class="ExternalClassE768ABF940334D7D9394686C9AB672AF">
<p class="ExternalClass087577BD4AAE48438DD20CA95343151F">The other day, while previewing messages in my inbox, I saw a conspicuous message with the following parameters, typos included:</p>
<div class="ExternalClass087577BD4AAE48438DD20CA95343151F"><br /><strong>To:</strong> (email address)<br /><strong>CC:</strong> (email address),...<br /><strong>Subject:</strong> Your ex sent me this pciture of you.<br /><strong>Body:</strong><br />Hey (email address),<br />Your ex sent me this picture claiming it's you. Is it really so? You probaly should see a doctor:) They can cure it now:).<br /><strong>Attachment:</strong> "<em>Photo.zip</em>"</div>
<p class="ExternalClass087577BD4AAE48438DD20CA95343151F">?</p>
<p class="ExternalClass087577BD4AAE48438DD20CA95343151F">The attached file is a ZIP archive that contains an executable file named "<em>IMG04958.exe</em>" (<em>SHA1: </em><em>51dd01ab8f18bc5e7875526db241d4ea79c136e8</em>), detected as Worm:Win32/Gamarue.E.</p>
<p class="ExternalClass087577BD4AAE48438DD20CA95343151F">Scanning other messages, I noticed three additional spam campaigns using different subject lines and message body text:</p>
<div class="ExternalClass087577BD4AAE48438DD20CA95343151F">
<ul>
<li>"I got you busted bro. You won't deny the obvious now. Check the photo in attachment ."</li>
<li>"I'm sorry man you seem to be in trouble. My girfriend got this picture of you yesterday and sent to your wife. Hope you can handle it"</li>
<li>"I got your picture yesterday, who is that girl next to you? In attachment"</li>
</ul>
</div>
<p>The theme of the spam uses a type of social engineering that leverages the shock of allegation to trick the recipient into opening the attached file. If the recipient opens the attached file in an unprotected environment, this Win32/Gamarue variant will try to download other malware.</p>
<ul>
<li>Downloads "<em>888.exe</em>" from IP 67.210.xxx.xxx:<br />235964da72a80425dfb74efc264fa0ba4d8189c7 – <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Hioles.C">Trojan:Win32/Hioles.C</a></li>
<li>Downloads "<em>sol.exe</em>" from IP 176.31.xxx.xxx:<br />cfb374ae373f49ed7bf8da92fe725b4eaff5e1a5 – <a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/FakeSysdef">Trojan:Win32/FakeSysdef</a></li>
</ul>
<p>Gamarue also communicates with a command and control server on a bot network to perform actions against the infected computer.</p>
<p>It can't be emphasized enough in our recommendation that you apply an "ointment" (i.e. active security scanning) to help prevent "outbreaks".</p>
<p></p>
<p>-- <em>Patrick Nolan, MMPC</em></p>
</div><div style="clear:both;"></div><img src="http://blogs.technet.com/aggbug.aspx?PostID=3486052" width="1" height="1">
Source:
There's a cream for that
