Repeat Old Tricks
There is a lot of buzz in the security community lately about the merger of two widespread password-stealing malware families, Zbot (maker of Zeus) and SpyEye. Some reports says that the Zbot source code was given to the SpyEye crew. Others say that Zeus was sold, and some even say that nothing really happened–this was Read more…
Tags: bueno, Cybercrime, Data Protection, Email & Web Security, malware, pedro bueno, social networking
One common technique used by malware researchers is to analyze a sample using virtual machines. In recent years, malware developers have created “checks” against environments and common malware-analysis tools. If the malware detects a security application, the former will not execute or will execute a deceptive function. I recently came across some common checks for: Read more…
Tags: bueno, malware, Malware research, pedro bueno
Yesterday we discovered a new Zeus campaign. Most of the messages associated with the new spam campaign are linked to the Asprox botnet. This time, the focus is on FedEx. Most of the attachments start with either FedExDoc[randomnumbers].exe or FedExInvoice[randomnumbers].exe. Those attachments are recognized as the Bredolab Trojan, which will download the Zeus component. This Read more…
Tags: bueno, pedro bueno
McAfee Labs detected a new wave of the PWS-Zbot (a.k.a Zeus) spam campaign this week. Some common phrases used in the email subject headers: Subject: Sales Dept Subject: Another candidate brought to you Subject: Summary of payments These emails carried PWS-Zbot Trojan variants that are a part of the 2.x version of the Zeus botnet, Read more…
Tags: bueno, pedro bueno
First of all, this is not a sales pitch. McAfee offers several of its products for a trial period. However, we want you to know that we have just found a brand new variant of the Bredolab Trojan that is spreading by email with the following characteristics: Subject: “McAfee VirusScan Plus” Message body: “Download a Read more…
Tags: bueno, pedro bueno
Yesterday I analyzed a malware sample sent by a customer. At first it looked like a regular bot that was connecting to its control server via an HTTP botnet. The software received commands embedded between the [##] and [/##] tags–pretty much like HTML commands. Some examples: [##]Q8lD[/##] [##]XMg=[/##] [##]FJQCokA=[/##] [##]QMlD[/##] The suspicious file was limited Read more…
Tags: bueno, pedro bueno
In a recent spam–that appeared to be a page from a popular Brazilian newspaper–we read that the Brazilian soccer team coach Dunga had been involved in an assault. He was apparently punched in the face by two angry fans who were unhappy that he had not selected two players–Neymar and Ganso–in his 23-man roster for Read more…
Tags: bueno, pedro bueno
We have written several times about Internet scams. Some of the most famous scams are certainly the “Nigerian” ones, where you were supposedly the one that would receive about 1M USD to facilitate a transaction. It was even covered on Dateline! Other popular scams include work-from-home scams and romance scams. So, I decided to get Read more…
Tags: bueno, pedro bueno
It is the time of year to get together with family and friends, and that often involves flying. So, how about a promotional airline ticket for just $1? That sounds like an irresistable idea! Though it also sounds too good to be true. As you can imagine, there is something wrong here. Instead of flying Read more…
Tags: bueno, pedro bueno
I’m writing this blog to demonstrate how the bad guys are getting better each day–or not, depending of your point of view. Once again our topic is Brazilian malware authors. Yes, the dumb ones I keep running up against. One of the recent versions of the PWS-Banker Trojan being distributed via spam has an interesting Read more…
Tags: bueno, pedro bueno
Posts tagged under pedro bueno