“Facebook Support. Your password has been changed!” contains trojan


MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “Facebook Support. Your password has been changed! ID09687″. Note that the number may change with each email.

The email is send from the spoofed addresses:

account@facebook.com
manager@facebook.com

The message has the following body:

Dear user of FaceBook.

Your password is not safe!
To secure your account the password has been changed automatically.

Attached document contains a new password to your account and detailed information about new security measures.

Thank you for your attention,
Your Facebook

The attached ZIP file has the name New_Password_IN04393.zip, note that the number at the end will change, and contains the 33 kB large file New_Password.exe.

The trojan is known as Gen:Heur.VIZ.2 (BitDefender), Mal/FakeAV-JX (Sophos), Trojan.Generic.Bredolab-2 (ClamAV).

The following files will be created:

%System%\document.doc

Several Windows registry changes will be exectued and the trojan can establish connection with the IP 193.106.34.20 on port 80.

Data can be obtained from following URLs:

  • hxxp://profmiale.ru/TGQW4nHJOS/document.doc
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=8
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=9
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=uploader
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=grabbers
  • hxxp://profmiale.ru/TGQW4nHJOS/grabbers.php
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=0
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=1
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=2
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=3
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=4
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=5
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=6
  • hxxp://profmiale.ru/TGQW4nHJOS/load.php?file=7

At the time of writing, only 6 of the 42 AV engines did detect the trojan at Virus Total.

Virus Total permalink and MD5: ecc2d442886b7296b5bd7eaeaae0bcea.

2 Responses to “Facebook Support. Your password has been changed!” contains trojan

  1. Pingback: ZDNet – Spamvertised ‘Facebook. Your password has been changed!’ emails lead to malware | CYBERSEECURE

  2. ram sai says:

    hi my facebook and email has been hacked since 2days please help me even they changed my security question on my facebook tell me what i need to do please please please help me

Follow

Get every new post delivered to your Inbox.

Join 425 other followers

%d bloggers like this: