[Dshield] RE: new email threat?
sama at snowplow.org
Fri Aug 1 17:54:12 GMT 2003
Trend Micro is now catching it!
On Fri, 1 Aug 2003, Hill, Keith wrote:
> Trend is reporting this as:
> and Symantec has also just posted information someone told me. It looks
> like current definitions are not catching this at all so beware!
> > -----Original Message-----
> > From: Hill, Keith
> > Sent: Friday, August 01, 2003 1:06 PM
> > To: 'list at dshield.org'
> > Subject: new email threat?
> > I'm being bombarded with emails with the following message:
> > Subject: your account maemddxd
> > Importance: High
> > Hello there,
> > I would like to inform you about important information regarding your
> > email address. This email address will be expiring.
> > Please read attachment for details.
> > ---
> > Best regards, Administrator
> > maemddxd
> > There is an attachment, a zip with an html script embedded in it. I don't
> > want to send it as it may be malware. When run it creates a blank web
> > page but the code is 16 KB and contains compiled code and several
> > references that use either "moo ha ha" or "foo.exe" in the script. Has
> > anyone else seen this?
> > Keith
> > Keith Hill
> > kjhill at cox.net
> > (703) 599-8133
> > ==========
> > This message is for the designated recipients only and may contain
> > sensitive or confidential information. If you have received this message
> > in error, please notify the sender immediately and delete the original and
> > all copies. If you received this message in error or are not a designated
> > recipient, information in this message should not be disclosed and any use
> > of the information is prohibited.
> > ==========
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
More information about the list