www.bewet.fora.pl

0411awosfd

o subid = “landing”
The following internet connections wil lbe established on port 80:
v class="googleright">
Sax2 is intrusion detection systems (IDS),[link widoczny dla zalogowanych],intrusion prevention systems(IPS) which excels at real-time packet capture, 24/7 network monitor, advanced protocol analysiEmails regarding an attached resume contains a trojan
Bookmark and Share
1. Overview
A new trojan distribution campaign by email regarding a resume were intercepted by Ax3soft, the following subjects are possible:
1. Resume attached.
2. please find enclosed.
3. Please find attached.
4. Attached please find.
5. Here’s the file you wanted.
6. I have attached the resume.
7. The new resume is attached
8. The resume document is attached
9. Please find my CV and cover letter attached.
10. You will find the resume attached to this email.
11. Please find attached my CV for your attention.
12. I’ve attched..I’m encoding..the latest figures for you.
13. Replace the old resume with the new one which is attached.
The email is send from the spoofed address and has the following body:

* />

Please take a look at the attached resume.
Attached please find.
o affid = “396″

Please find my attached CV for your attention
* [link widoczny dla zalogowanych]
* Create files as followings:
%Temp%dfrgsnapnt.exe
%Temp%eapp32hst.dll
%Temp%topwesitjh
%Temp%wscsvc32.exe

Please review the attached resume.
* The following processed will be created or are affected:
dfrgsnapnt.exe
wscsvc32.exe
Several registry modifications will be done and the following URLs are used:

/>
mediafullups.com

You will find the resume attached to this e-mail.
The attachedZIP file has the name 50443cv.zip and contains the 16 kB large file />
The trojan is known as (Antivir), (F-Secure), FakeAlert-DefCnt.d (McAfee),[link widoczny dla zalogowanych],[link widoczny dla zalogowanych],[link widoczny dla zalogowanych], a variant of Win32/Kryptik.AJD (NOD32).
Create files as followings:
%CommonFavorites%_favdata.dat
%Temp%TMP35073.tmp
%Temp%TMP35042.tmp
%Temp%TMP34714.tmp
Resume attached

Replace the old resume with the new one which is attached
Two files will be downloaded from /a/ad that contains a malicious payload and here are the details.
The first file is known as Mal/EncPk-LZ (Sophos):
Created the registry key as following :

* />

* [HKEY_CURRENT_USERPrintersConnections]