Cutwail « Webroot Threat Blog

New Bank Phisher Brings Added Functionality, Problems

February 23, 2011 – 4:23 pm

By Andrew Brandt I didn’t want to let too much time pass before I wrote about a new Zbot-like bank phishing Trojan variant that came across my desk last week. The keylogger started arriving the first week of February as an attachment to a spam email designed to look like it came from United Parcel [...]

By mguthrie09 | Posted in Botnet activity, Downloaders, Keyloggers, phishing, Phishing Trojans, social engineering, spam, Stupid malware tricks, Threat Research | Tags: Bank of America, Capital One, Chase, cheburash.com, Cutwail, eveningquest.com, HKEY_CURRENT_USER\Software\Microsoft setiasworld, nightphantom.com, Rapport, romanspamer.com, The Adventures of Cheburashka and Crocodile Gena, Trojan-Backdoor-Downfall, Trojan-Backdoor-Poebot, Trojan-Pushu, Trusteer, TRxGM, United Parcel Service notification, USPS_Document.zip | Comments (2)

Trojan Masquerades as iTunes Gift or Résumé

May 12, 2010 – 10:06 am

By Andrew Brandt If you received one or more email messages over the past week that claim to contain an attached gift certificate for the Apple iTunes store or an unsolicited résumé, you probably received the latest scam involving the Tacticlol downloader. The iTunes-themed spam messages use the forged return address of gifts.certificate@itunes.com and read, [...]

By mguthrie09 | Posted in Stupid malware tricks, Threat Research, Phishing Trojans, social engineering, spam | Tags: Cutwail, Pushdo, Trojan-Pushu, Tacticlol, Oficla, Sasfis, You have received an iTunes Gift Certificate in the amount of $50.00. You can find your certificate code in the attachment below, Please review my CV, Thank you!, iTunes Gift Certificate, UPS_invoice_####.exe, DHL_label_nr###.exe, Resume_document_###.exe, iTunes_certificate_###.exe, c99 madShell v. 3.0 Blog edition, c99madShell, gifts.certificate@itunes.com | Comments (2)

Pushu Variant Spams Hotmail, Cracks Audio Captchas

March 22, 2010 – 5:01 am

By Andrew Brandt A new version of Trojan-Pushu is doing some interesting stuff to bypass captchas used by Microsoft’s Hotmail/Live.com/MSN webmail services in order to spam people with links to malicious Yahoo Groups pages. The three-year-old spy (known by a variety of other aliases, including Cutwail, Pushdo, Diehard, and Rabbit) has always been, primarily, a [...]

By mguthrie09 | Posted in spam, Stupid malware tricks, Threat Research | Tags: audio captcha, Become more emancipated man, captcha, Cutwail, Diehard, God wants you to look this hot photos right now!, Hacked Blackbook, Hotmail, Keep posting such photos on facebook, Live.com, Look at these delineations!, MSN, Pushdo, Pushu, Rabbit, spam, spambot, Trojan-Pushu, You are looking so manhood on your delineations. | Comments (8)

Follow

Follow “Webroot Threat Blog”

Powered by WordPress.com