[Dshield] RE: new email threat?

Samantha Fetter sama at snowplow.org
Fri Aug 1 17:54:12 GMT 2003


Trend Micro is now catching it!

On Fri, 1 Aug 2003, Hill, Keith wrote:

> Trend is reporting this as:
> WORM_MIMAIL.A
> and Symantec has also just posted information someone told me.  It looks
> like current definitions are not catching this at all so beware!
>
> >  -----Original Message-----
> > From: 	Hill, Keith
> > Sent:	Friday, August 01, 2003 1:06 PM
> > To:	'list at dshield.org'
> > Subject:	new email threat?
> >
> > I'm being bombarded with emails with the following message:
> >
> > Subject: your account maemddxd
> > Importance: High
> >
> > Hello there,
> >
> > I would like to inform you about important information regarding your
> > email address. This email address will be expiring.
> > Please read attachment for details.
> > ---
> > Best regards, Administrator
> > maemddxd
> >
> > There is an attachment, a zip with an html script embedded in it.  I don't
> > want to send it as it may be malware.  When run it creates a blank web
> > page but the code is 16 KB and contains compiled code and several
> > references that use either "moo ha ha" or "foo.exe" in the script.  Has
> > anyone else seen this?
> >
> > Keith
> >
> > Keith Hill
> > kjhill at cox.net
> > (703) 599-8133
> > ==========
> > This message is for the designated recipients only and may contain
> > sensitive or confidential information. If you have received this message
> > in error, please notify the sender immediately and delete the original and
> > all copies. If you received this message in error or are not a designated
> > recipient, information in this message should not be disclosed and any use
> > of the information is prohibited.
> > ==========
> >
> >
>
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
>




More information about the list mailing list