WhatsApp-themed spam campaign delivers malware
Posted on 16.12.2013
A new WhatsApp-themed spam campaign has been spotted targeting users of the popular IM service.

The spam email claims to be a notification about a voice message someone left for the recipient:


"The e-mail looks legit, and even the link is formed to make it look like a voicemail link with the little '/play' ending," points out SANS ISC CTO Johannes Ullrich.

But the thing that fascinated him the most is that the executable offered for download is adjusted to show a phone number that matches the location of the IP address from which the e-mail is downloaded from.

For example, downloading it from a computer located in his home got him VoiceMail_Jacksonville_(904)458abcd.exe, and from a server in Wayne, Pennsylvania resulted in VoiceMail_Wayne_(610)458abcd.exe (the last four digits have been obfuscated).

The file contains a spyware variant that is currently detected by only 8 out of the 49 AV solutions used by VirusTotal.

Another interesting thing is that, once run, the malware triggers Windows' Notepad and the text file contains the following notification: "Unknown ERROR! Please wait and try again later"

This is likely done to make users believe that the file they've tried to open is corrupted and can't be opened, and to prevent them to become suspicious and search for covertly installed malware.









Spotlight

Hackers indicted for stealing Apache helicopter training software

Posted on 1 October 2014.  |  Members of a computer hacking ring have been charged with breaking into computer networks of prominent technology companies and the US Army and stealing more than $100 million in intellectual property and other proprietary data.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Oct 2nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //