About Me

Pedro Bueno

Pedro Bueno
Security and Malware Researcher
Pedro Bueno is a Security and Malware Researcher at McAfee Labs for almost 5 years. He also has a volunteer job at the SANS ...

Read More

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

McAfee Labs :

What Next? Spam on RAR-Compacted Text Files – PART 2

Wednesday, August 1, 2007 at 6:20am by Pedro Bueno
Pedro Bueno

There was a time when we used to receive spam through regular email.
Then, the spammers learned about image spam, putting the message on picture files.
Recently we saw that they have moved to PDF spam, and later to encrypted PDF files.
A couple days ago we noticed spam in Excel files, and now we find another round with a different vector: RAR-compacted archives with spam inside text files!
Whatever will we see next?

Part 2:

Our very own Avert Labs Researcher Dirk Kollberg did some real nice research with some Nuwar/Storm/Zelathin malwares. What he found out is that those malwares are in fact the cause of such SPAMs!! On this research, Dirk found out that after the malware starts its P2P stuff, it exchange a bunch of UDP packets, then, some requests, and starts to spam about 500-600 traditional ‘postcard-style’ spam, with the http://xx.xx.xx.xx/?. A few minutes later, it starts to send spam emails with a *.zip as attachment, but tactually contains a RAR archive, with the SPAM text file inside!

Isn’t it great? :)

Yes, we caught them… :)

What we have still to confirm is if these malware are also responsible for the PDF and XLS spams, but we are working on it… :)

Dirk plans to release details of his research in a near future. If you are in Vegas make sure you catch Dirk’s presentation on trojan malware at DefCon!!!

Bookmark and Share

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

 

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (0)