The Legacy Sunbelt Software Blog

Thanks to thenext50k for sending this over.

From: “Paul Anderson”
Date: Thu, 17 Mar 2011 20:33:07 +0100
Subject: Urgent response as regards the Japan Earthquake, Tsunami
Private and Confidential

Firstly, I apologize for sending you this sensitive information via e-mail instead of a Certified mail/Post-mail. This is due to the urgency and importance of the information. This project is based on trust, confidentiality and sincerity of purpose in order to have an acceptable meeting of the minds. I am the account manager of Unity Bank Nigeria, West Africa with branches all over the world and almost in all parts of Asia. My name is Paul Anderson and I work both as an auditor and a consultant with the bank.

11 years ago, an expatriate, a Japanese from Tokyo Japan whom was also a client of the bank I work for successfully invested the sum of $26.2M USD with the bank I work for. On routine audit check I discovered that this investment account have remained dormant for some years. An investigation regarding the status of the account was carried out. However, during the course of the investigation, it was then revealed that the account holder (Expatriate and Investor) died in the Tsunami Earthquake disaster which took place on March 16, 2011 while on vacation. It was also discovered that the late client died intestate (died without a valid will) as he has no relation that knows about this deposit. Until his sudden demise, He was not married and was 44 years old.

NOW THE CRUX OF THIS E-LETTER is that banking regulation/legislation in Nigeria, demand that I notify the fiscal authorities after a statutory time period when dormant accounts of this type are called in by the monetary regulatory bodies. If no beneficiary to the investment account is presented as the late client’s next of kin within the next 14 official working days so that He or She can be paid the outstanding USD 26.2 Million dollars, the funds/payment will be diverted to the government coffers account as unclaimed bill and it may surprise you to know that funds of this nature are usually embezzled and diverted by corrupt government officials into their pockets to be used for their own selfish gains The above set of facts underscores my reason of writing and making this proposal.

Since we have been unsuccessful in locating any of his relatives, I decided to contact you for a deal so that we can work together as a team to remit the money to your account as my client next of kin since I do not want to sit and watch my client’s hard earned entitlement to go astray, it will be easy for us to achieve because you are of the same name like him. Although I know that a transaction of this magnitude might make anyone apprehensive but I would like to assure you that I am proposing this project to you with the best of intentions.
All I require from you is your honest co-operation to enable us seal this deal through. I guarantee that this transaction will be executed under a Legitimate banking arrangement that will protect you from any breach of law. Upon successful conclusion of this project, you will be compensated with 40% of the total fund, while 60% will be for me.

If you are interested to work with me in this deal of mutual benefit, kindly reply strictly to my personal Email: stating your full names, telephone, fax and mobile numbers for effective communication and oral clarification on how to proceed next, postal address, occupation and position held, scanned photocopy of your identification in the form of international passport or driver’s license or other to enable us prepare all necessary bank papers to effect the quick release of the funds into your nominated bank account.

Sincerely yours,

Paul Anderson.
 
I’m struggling to think if there’s any kind of scam left untouched where the Japan quake / Tsunami is concerned.

Christopher Boyd

As you may noticed from the odd blogposts here and there, scammers are firmly on the “exploit the Japanese disaster” bandwagon and anything is a target for them at this point. It’s becoming a little overwhelming to keep up with the posts I’m seeing across the security blogs as more scams come to light (I’ve made six posts myself today alone not including this one), so I thought it might be useful to throw together a short reference post with examples of the dubious techniques being used and how to avoid falling victim. If you think you have family members who may click on things or donate to sites they probably shouldn’t, consider gently pointing them in this direction.

1) Spambots.Keywords on Twitter, trending topics and anything else remotely newsworthy are instant green light signals for Bots to bug you endlessly with links to websites such as this:

Click to Enlarge

While some of it is relatively harmless (such as spamming junk links to eBooks, although it certainly wouldn’t be “harmless” to anybody directly affected by the quake receiving such a crass message) there’s plenty of bad things that come from twitter spam. Fake antivirus spam comes and goes on Twitter, but there are also fake Twitter notifications arriving in mailboxes too (scroll down).

Random links from random people in relation to any disaster should always be treated with caution.

2) Fake videos.
The poster boy of malicious websites everywhere, these are perfect bait for users wanting to get a quick fix. Invariably, they’ll pop a prompt or (worse) an installer the moment the user clicks on the “video” – the payload could be anything from random malware to fake antivirus. If it looks a bit like Youtube and you’re being asked to install things, run away. If it pops a survey, run away. The content was not (and never will be) there.

Click to Enlarge

Clickjacking / facebook type scams are also popular where fake videos are concerned. If the content of a Facebook post sounds a bit salacious or beyond the limit of what your workplace AUP would allow, that’s probably because it’s a fakeout designed to get you clicking. The whale scam is a popular one – there are many more out there.

Click to Enlarge

3) Emails and donation websites.

You can safely file unsolicited emails in the junk pile, every single time. It doesn’t matter who they claim to be, ignore it. Websites are a touch more problematic – while there are many legit grass roots efforts popping up on genuine facebook pages, the growing collection of what I like to call “completely random websites” are muddying the waters in spectacular fashion. Remember: anybody can set up a .com, .org, .net – even a .jp. It doesn’t mean the website sporting a Red Cross is any more genuine. There are many 419 mails zinging around related to the disaster, too – examples here and here.

There are a number of genuine donation effort sites listed here, and failing that you can always just go to the Google Crisis Response Page and donate safely. The good news is that many of the more dubious donation sites are having their payment methods switched off.

4) Blackhat SEO poisoning.


Click to Enlarge

Dubious links pointing to fake AV will continue to be an issue for anyone looking at disaster related information, as we can see here, there and everywhere. Of course, there are steps you can take to avoid an unwelcome guest on your desktop. If you get redirected to a fake AV website, more often than not you’re perfectly fine unless you agree to download the installer, double click it, allow it to run and so on. Denying the download will work wonders. If there’s no download but they’ve locked up your browser, CTRL+ALT+DEL or (failing that) ALT+F4 will also be your best friend in these situations.

Additionally, don’t go clicking on random websites with names like “Celebrities with diseases” (see the above screenshot) because you’re pretty much asking for trouble. Stick to legit news websites in the various news portals of search engines such as news.google.com.

Oh, and install AdBlock Plus and / or NoScript too, assuming you use a browser that’s compatible. AdBlock Plus will strip all the adverts from a website, meaning your chances of being hit by a rogue ad banner served on a reputable website are somewhere between zero and zero. NoScript does exactly what it says on the tin, and allows you to control / remove script from websites in a very flexible fashion.

Unfortunately, this is going to keep rolling – in the last hour or so, Dave Marcus of McAfee fame mentioned Fukushima satellite imagery malware doing the rounds. Be careful!

Christopher Boyd

The scammers are in full swing now, aren’t they?

Click to Enlarge

Thanks to Mister U, thenext50k and others for sending over various pieces of spam mail that Twitter users are reporting seeing arrive in their mailboxes.

The example mail above claims to be from “ICRC Basedhelping Foundation” and are unsurprisingly asking for Japan relief donations. They’ve provided bank details so you can send them money from both inside and outside Europe (nice of them), and these unsolicited mails should be dumped into your spam folder as quickly as your fingers will allow.

Christopher Boyd

According to Wikipedia and a bunch of other unverifiable sources I can’t remember the name of, the amount of radiation contamination when Chernobyl exploded was approximately 400 times that of the radiation contamination at Hiroshima.

As you’d imagine, the range and power of any potential meltdown is a bit of a hot topic and search engine poisoners are going to have a field day with users searching for information related to that one.

I asked a random person in my hotel (no really) to go looking for information related to radiation levels after telling them lots of things about contamination level comparisons. Sure enough, they came back with “Chernobyl radiation 400 times Hiroshima” and on the very first page in Google, there’s a website called celebrities-with-diseases(dot)com. The title is pure clickbait: “Americans shouldn’t fear radiation sickness from Fukushima”.

Click to Enlarge

Hitting that link does something you’ve seen a million times or more by now:

Click to Enlarge

Click to Enlarge

Fake warnings, fake scans, a file offered up for download.

As always, remain vigilant and ensure you’re getting your information from trusted sources – you can guarantee “Celebrities with Diseases” won’t be showing up in Google News anytime soon.

Serving up a healthy dose of proof positive that you should, perhaps, obtain your news from somewhere other than random uploads on a video sharing website is a number of uploads that look like this:

Click to Enlarge

These are videos claiming to show various “miracle escapes” from the destruction wrought by the Earthquake and Tsunami. While this is a nice human interest angle (and actual news sites are currently full of “Miracle escape” articles, which is clearly a big hook for readers) the only actual human interest is that of the video uploader wanting to make some money. Both Blogspot sites listed (latestupdatedailynews(dot)blogspot(dot)com and jhonsryo(dot)blogspot(dot)com) take the end-user to wonderfully inappropriate survey questions, complete with smiley face.

Click to Enlarge

The other two sites – lossifnotsee(dot)com and flashvideonews(dot)com – both launch installer prompts for Hotbar, along with a few pieces of pre-ticked software including ShopperReports and Blinkx Beat.

Click to Enlarge

Not quite the “Miracle Stories” I was expecting. As with most Youtube scam clips, you’ll know something is not quite right whenever you see one of those “We can’t play the video here due to copyright reasons, visit our website instead”. Don’t bother.

Christopher Boyd

“Is this legit”?

Good question. Everybody wants to help Japan right now, but as you can imagine scammers are out in force. It’s hard for people to tell what’s real and what’s a fakeout, so we’re going to take a look at the site mentioned above. It’s called helpjapan(dot)jp, and looks like this:

Click to Enlarge

As you can see, it sports a version of the Japanese Red Cross Society logo, but doesn’t carry any of the copyright notices, information or contact details of the real thing. Notice that the real thing has a very specific way of accepting donations, unlike the above site which is asking for Paypal and Alertpay donations (the Japanese Red Cross society also accepts payment via Google Checkout, through this page – and the details listed there don’t appear anywhere on this particular site at payment or elsewhere either).

The Paypal link takes you to a German language donation page:

Click to Enlarge

A site sporting Japanese Red Cross logos yet asking for Paypal donations is very curious, because as this news article from yesterday mentions, the Japanese Red Cross Society DO NOT accept Paypal at this moment in time – yet strangely, we have a site here claiming otherwise.

The Alertpay page gives us this:

Click to Enlarge

At the top, you can see the payment system is being used by someone called “Cassidy Mozes”. The savejapan.jp domain was registered on the 12th of March:

Click to Enlarge

The address listed above isn’t the address of the Japanese Red Cross, and the closest location I can find from the Whois above appears to be a vintage record collector. Additionally, the only reference to the above email address seems to be here, on a pay to click forum.

Is this legit? Well, it doesn’t seem to be registered to the Japanese Red Cross, sports no official information, has a collection of “news articles” that are simply links from a feed, accepts Paypal donations under a Red Cross banner which the legitimate URL doesn’t process yet, seems to indicate that 60,000 people have donated more than three million dollars via the site (which is clearly impossible) and doesn’t have any links in search engines or elsewhere confirming reliability.

We’ve contacted the Japanese Red Cross to see if they know anything about this, and will update when we hear back. In the meantime, just be aware that there are plenty of scams which are strikingly similar to the above example from Symantec (that one sports an American Red Cross badge – it’s almost like there’s a pattern forming), and while I’d hate to steer people away from a genuine donation site, I’d strongly advise to only give money through tried and tested channels.

You’re risking throwing money into the void otherwise, and that certainly isn’t going to help anybody in Japan.

Christopher Boyd

It seems discussing the rather grim situation in Japan has inevitably resulted in tasteless spambots primed to sniff out mentions of said disaster.

Click to Enlarge

The links being spammed lead to a site called radiationhealth(dot)com, which was apparently only registered today and is promoting an eBook. Because as we all know, an eBook is the first thing you’ll reach for during a nuclear emergency.

Click to Enlarge

The eBook costs $19.95, and the payment page mentions leansecret(dot)com as being the individuals you’d be giving your money to. That site has been around since January, but currently has no content other than a landing page and uses the same Whois privacy service as the site promoting “Radiation health” eBooks.

I can’t see this being very popular, unless you count having all of your Twitter spambots blocked and reported for spam as a measure of popularity.

Christopher Boyd

Let’s take a look at the latest in long line of fake stalker apps on Facebook.

This one is called “Profile Update”, and makes a number of claims in relation to tracking vistors while changing your profile background. “Change your background and see your stalkers”, they claim – installing their update will let you see who is stalking you.

Click to Enlarge

Click to Enlarge

If you agree to their terms of service (which are rather long and mention Singapore as being the base of operations for this one) you’ll be prompted to install the rogue application when logging in, giving access to your basic information, granting wall posting rights and letting it “access your data anytime”.

Click to Enlarge|

You’ll also be prompted to fill in the inevitable survey, which randomly decides to talk about “Profile Peekers 2.0” instead of “Profile Update”. It’s almost like they’re making it up as they go along.

Click to Enlarge

While you’re busy signing your life away to coupons, fruit snack offers and fabric conditioner trials your wall will start to look like this:

Click to Enlarge

Before the police come and take me away for questioning, I should mention that some of the URLs involved are foksrox21(dot)info and wurstbrota(dot)info. Please don’t be fooled by these stalker apps – scams such as these have been around since the days of Myspace, and they didn’t work then either. Wurstbrota is still live, but the foxrox URL currently redirects to a Formspring page. The rogue application seems to be currently unavailable too, so hopefully this is in the process of being shut down.

Christopher Boyd

This time around, the URL is japan-tsunami-whale(dot)info, and it looks like this when spreading on the walls of Facebook users:

Click to Enlarge

Here is the site promoting the (fake) “graphic video”:

Click to Enlarge

As you can see above, the cut and paste template says “FB Video” instead of the now familiar “FouTube” but rest assured it’s a scam all the same. The site was registered yesterday to one “mark van dam” in Switzerland, and will ask you to compare auto insurers or play frogger to see the content.

There are no words…

Christopher Boyd (Thanks to Matthew for sending this over).

Ransomware that demands money so you can access your files is a popular tactic, and here we have another example of this extremely shady practice.

The end-user is presented with a fake warning message from theflowerzf(dot)info, using browser specific messaging that’s recently become popular.

Click to Enlarge

“Install the update for Internet Explorer”, they say. What they don’t tell you is that this IE upgrade will lock you out of your PC with the following horror-story message:

Click to Enlarge

Yes, things are generally looking pretty bad when yellow police tape has been stuck to your monitor. The victim is told they have commited network crime, and that 19 files have been found related to “unlicensed software, movies and music” and “materials with pornographic content (including homosexual content pornography)”, and that this will be serving as material evidence in a court.

They’re given twenty four hours to do something about it, lest their information be sent to a police department and all content on the PC be blocked until arrest.

Charming.

This is how they want the victim to get out of the situation:

Click to Enlarge

The unfortunate individual has to phone one of the numbers listed to obtain an activation key, then punch it into the spaces at the bottom of the screen. As you might imagine, this is going to cost some money (and I’m not sure I’d trust the price listed…or even if they’ll give control of the PC back once the cash has changed hands).

We detect this as Win32.Malware!Drop. Thanks to Patrick for finding this one.

Christopher Boyd

Taken was indeed an excellent film; no doubt Liam Neeson spends most of his time blowing up half of Europe in Unknown, too.

In fact, here he is now looking for all the World like he’s about to lay the smackdown on another collection of hapless European criminals:

Yeah, people are going to die.

Unfortunately, death-dealing might have to be put on hold. Clicking on any of the numerous links promoting showings of Unknown via see-it-free(dot)com on Twitter (or any of the other movies referenced, for that matter) won’t give you cinematic views of Liam Neeson punching the Eiffel Tower while half of Paris burns.

In fact, clicking the “Buy this poster” link won’t even give you a cool poster (it takes you to a Giant Chinchilla plastic exercise ball on Amazon. Who knew).

What you will end up with, is bingo surveys.

AND LOTS OF ‘EM.

“I wonder if a total lack of content will be your reward for filling in yet another useless survey”, I hear you cry.

You could say that:

It seems Liam has already killed everyone in sight and had his movie taken down for good measure. While that’s certainly an admirable trait, it doesn’t help anybody who filled in an offer for free iPads / bingo games / celebrity surveys / horoscopes or anything else that tends to pop up on these information hungry content gateways.

Remember: he might not have money, but what he does have is a particular set of surveys; surveys acquired over a long career. Surveys that make him a nightmare for people like you…

Christopher Boyd

Thanks to Matthew for sending this one over.

There’s a nasty round of Facebook app pages dabbling in Javascript shenanigans to spam Acai Berry diet pages on your profile walls. Simply visiting these pages while logged in is enough to post some spam, most of the pages involved promising (surprise, surprise) a video to watch:

Click to Enlarge

If you try to navigate away from the above app page, a message will pop up claiming you’re about to “corrupt the Flash install”. Total nonsense, but it’s just enough to result in something like the below being posted to your profile:

Click to Enlarge

“I am living proof that this works”, claims the “facebook sponsored weight loss product”. No sign of anyone yelling “Beefcake, Beefcake” but let’s dispense with the South Park references and see where the spam link leads to:

Click to Enlarge

Oh look, a fake news site touting logos from various news sources. Needless to say, you don’t want to be handing over any money for the above. Though the code in the below screenshot may look like a load of tech related jibber-jabber, you can still see many pieces of text used for the various spam messages:

Spam messages will also be sent out in both wall postings and facebook chat that look like this:

“Hey, What the hell are you doing in this video? Is this dancing or what?? Bahahah”

You can see that in the above screenshot, too (look near the bottom of the code). If you don’t want to strain your eyes, here it is in action:

There appears to be one main domain for this, franebook(dot)com (although it’s currently serving up 404 errors) and many of the related application pages also appear to have been taken down by facebook. apps(dot)facebook(dot)com/bergamoleyra/ and apps(dot)facebook(dot)com/hellenismkpmga/ are both giving “page not found” messages, although there seems to be a number of app pages still live and redirecting to the Acai berry spam sites.

As always, be careful what you’re clicking on in facebook – random messages promising junk will usually give you just that (and perhaps a little more besides).

Christopher Boyd

A friend sent me this link, which is an interesting spin on the old “HMRC tax refund” scam – a fake HMRC claiming your bank wants to issue a refund instead.

Click to Enlarge

As you can see below, they have a large selection of banks to choose from (in keeping with more common phish attacks):

Click to Enlarge

Everybody from NatWest and HSBC to Santander and Halifax are in there. Most of the bank specific pages all ask for the same kind of personal information, but if one of the banks asks for something unique to them (such as a banking PIN or other security feature) the phishers have taken care to include those too. If your bank isn’t included, no problem: they have a generic “catch-all” page for you to sign up to years of identity theft and a couple of days worth of “Who bought all this stuff on iTunes”?

Here’s a sample of the information asked for on the Barclays page:

Click to Enlarge

Deep breath: name, address, phone number, email (and email password!), national insurance number, information related to your parents, how long you’ve lived at your address, employment status / income, your full card details (of course) and everything related to your online banking account.

I think “Ouch” is the word we’re looking for.

HMRC do not issue tax refunds by email, they most certainly do not have websites where banks want to issue you with refunds, and they also know how to spell “being” (take another look at that second screenshot).

Avoid like the plague.

Christopher Boyd

Changing some code in Firefox to make it store passwords without notification isn’t a particularly new trick; indeed, code to do just that has been around since at least 2009. What’s interesting is the appearance of malicious files automating the process – back in October, Webroot uncovered a file that used this technique to collect logins, while using added functionality to send the stolen details back to base.

Here’s a timely reminder to always be wary of public terminals, because we have another executable that forces Firefox to store logins locally while removing any notifications to the end-user:

Hitting the “Enable” button alters “nsLoginManagerPrompter.js”, replacing some bits of code and adding others like the Trojan-PWS-Nslog file from October did. At this point, the unwary user will log in without any “Do you want Firefox to remember this password” prompt and go about their merry business. The moment they leave, all the attacker has to do is access the same PC, go into Tools / Options / Saved Passwords and retrieve whatever has been stored there from the list of sites, usernames and passwords.

Unlike Trojan-PWS-Nslog, the executable we tested doesn’t appear to send the logins elsewhere – it’s a local threat only, which is better than nothing I suppose. If a public terminal seems a little insecure or you didn’t see a “save this password” prompt from Firefox, it might be a good idea to check if your logins have been stored. In all likelihood, they probably just have the “save passwords” feature disabled but better safe than sorry.

Detection rates on Virustotal at the moment are quite low – 8/43 – and we detect this as Backdoor.Win32.FFGrab.A.

Thanks to Adam Thomas and Francesco for additional research.

Christopher Boyd

A question from a security mailing list: “Is this some sort of phish”?

———- Forwarded message ———-
From: Adobe Incorporated
Date: 1 March 2011 01:33
Subject: Adobe Acrobat Reader latest version released ! Upgrade Available Now
To: —-

Copyright © 2011 Adobe Systems Incorporated. All rights reserved.

While this isn’t a phish in the sense that they aren’t asking for login details, they are trying to get some money by making it look like you need to pay to download Adobe Acrobat Reader (you don’t). This kind of thing has been around for a while, and is also popular where Skype is concerned too.

Steer clear.

Christopher Boyd

It always pays to be on your guard, as a phish attempt may crop up in the most unlikely of places.

Sure enough, we have an example of a scammer going phishing on Play(dot)com, the second biggest online retailer in the UK market. Play allows individuals to buy / sell their wares, much like the Amazon marketplace. Here’s an example of what I’d see while shopping for Batman DVDs (because really, what else am I going to be wasting my money on?):

Sellers are awarded ratings depending on how awesome they are at selling things – or not. Thanks to MrTom for sending this one over, because what seemed like a bargain videogame purchase resulted in the following email from a seller:

Yes, it’s the old “Problem with payment” trick so beloved of scammers on sites such as eBay (with random “verified by..” graphics to sweeten the deal) . What makes this attempt particularly silly is the following ramble regarding security:

“fill in the following secure form by clicking reply you should then be able to fill in the form. This is just for verfication and a security check  please note we do not see any of your personal details as its encrypted through our server and part of data protection”

There is, of course, no “secure form” – all the victim is doing is sending a regular email to a @live.co.uk account. It’s worth bearing in mind that a copy of said email could well be stored on the servers it passes through, which isn’t really the best thing in the World when you just sent your card details to the Wallet Inspector.

The scammers here are rather lazy, too – hyperlinking their images from other sources and causing a little brand damage in the process. You should NEVER send a seller your card details in this manner, especially if they’re claiming there are problems and asking for card details via email. Play(dot)com is setup so that you’d never have to do this – any other reputable merchant would be doing the same thing.

Unfortunately these kind of scams cause a chilling effect for new sellers and makes it more difficult to get started selling Batman DVDs – and while you’ll get your money back from the initial transaction made through the Play(dot)com system, you may find it’s a little more tricky to get results after firing the “Take my money, and take it now” emergency flare in the general direction of an Email scammer.

Christopher Boyd

I’m almost certain this compromise of a .gov.uk domain (specifically, a page added to chickerell-tc(dot)gov(dot)uk) is supposed to be humorous, but you never know:

If the intention is to freak the site owners out with an introduction to those guys that pull the strings, using Tupac related references on a local council .Gov site in the Dorset area of the UK may not have the desired effect.

I’m informed the site owners have been notified, and we’ve dropped them a line as well – the compromise is still live at time of writing, but there doesn’t appear to be any Malware involved.

We’re through the looking glass with this one…

Christopher Boyd

Not so long ago, we heard news of a “Playstation 3 rootkit” which turned out to be rumours based on misinterpretation of comments made in IRC.

Today, we wake up to the alleged relevation that your “credit card info is not secure” on the Playstation 3 network. This all stems from a five page research document entitled “Call of Privacy: Modern Spyware by Playstation network”.

Click to Enlarge

As a result of the above document mentioning unencrypted credit card data, reports quickly spread that your payment information was being sent unencrypted across the network, which seemed strange (what happened to SSL?) – and sure enough, it seems initial reports were inaccurate. The (theoretical) danger to your payment details is an issue when using custom firmware – otherwise, you should be fine. Even then, the attacker would apparently have to use custom firmware, certificates, proxies and third party DNS.

The research document above did mention that custom firmware was the reason payment information was being sent unsecured, but that seems to have got lost in the background noise – even though the sole reference to credit cards takes up one single page out of the five. The rest of the document mainly talks about banhammers, the fact that SONY may know what kind of television you have connected to the PS3 and provides links to the (completely unrelated) rootkit story from 2005.

Ars Technica has an updated article which sheds some light on the confusion. For now, if you’re running non custom firmware on your PS3 you shouldn’t panic too much about this one.

Christopher Boyd

As you can see, the budding phish hunter needs to be careful – while using genuine login credentials and having all your information stolen to verify a phish is a new one on me, many phish directories can host malware, drivebys, extremely dubious pornography and more besides.

Here’s a file being hosted on Dropbox(dot)com that popped up on the Phishtank list today and (instead of being a phish, as you might expect) is a live infection called “Cheque487002.com”

A file ending in .com is highly unlikely to be your friend. In this case, we have an 18/42 detection rate for a data theft Trojan we detect as BehavesLike.Win32.Malware.rwx (mx-v).

As a sidenote, I’ve noticed a lot of scammers taking advantage of Dropbox(dot)com lately – everything from fake IRS tax returns and Paypal to Runescape logins and, er, Barbara Streisand albums.

Suddenly that malware looks a lot more appealing…

Christopher Boyd