Malicious Web Attack Using Executable With facebook.com in Name

As we were working through URLs identified as suspicious due to our GTI technology, one of the URLs that presented itself was an average “.com” site that loaded a php. As we processed this – it was interesting to see that this php actually reached out to download a file that ended with the string facebook.com.exe — as this “.com” site was very social-network friendly – it would be easy to see how an average user, without web protection in place, would not even realize what was going on.

And what was this *facebook.com.exe?  This was  detected it immediately by the McAfee Web Gateway Engine as: McAfee-GW-Edition 6.8.5 2010.03.10 Trojan.Injector.Awi.88

By the time I am writing this – it is already being seen with further visibility across our Artemis detection and we are making sure that all of our products protect against this threat.

This server where this was hosted has already been taken off-line – however, this threat, maneuver, and piece of malware will continue to be seen again, and again, and again. In fact, we already have other webservers that are hosting that same attack – along the same lines – and will be continuing to monitor and follow this particular attack.