Trojan-Downloader-Tacticlol « Webroot Threat Blog

Shipping Confirmations Back on the Radar

March 21, 2011 – 2:11 am

By Andrew Brandt After a prolonged absence, waves of Trojans distributed as Zipped email attachments have been showing up in our spam traps for a few weeks. The spam messages employ the same hackneyed shipping confirmation pretext as many previous iterations of this scam. This technique’s emergence as a common malware distribution method correlates with [...]

By mguthrie09 | Posted in Backdoors, Botnet activity, Downloaders, Keyloggers, Rogue Security Products, social engineering, spam, Stupid malware tricks, Threat Research | Tags: 548.exe, 62.122.73.203, AdobeUtil .exe, cnnus.ru, DHL, DHL Tracking.exe, DHL_tracking, DHL_tracking.zip, FedEx, HKCU\Software\MSOLoad, HKLM\software\classes\idid, krnl_servers_list, kusika911.ru, mialepromo.ru, MSHTA, Opera Internet Browser, Our_Agent, Post Express, Post_Express_Label, Post_Express_Label.zip, tracking.zip, Trojan-Downloader-Karagany, Trojan-Downloader-Tacticlol, Trojan-Relayer-Highport, UPS, User-Agent: Our_Agent, USPS | Comments (3)

10 Threats from 2010 We’d Prefer Remain History

January 1, 2011 – 3:32 pm

By Andrew Brandt With 2010 finally behind us, and an unknown number of cyberattacks likely to come in the new year, I thought I’d run down a brief list of the malicious campaigns criminals pulled off last year that I’d really dread to see anyone repeat. Now that they’re in the past, they should stay [...]

By mguthrie09 | Posted in Backdoors, Blackhat SEO, Botnet activity, Destructive behavior, Enterprises, Firefox, Gaming threats, Internet Explorer, Keyloggers, Online shopping threats, Passwords, phishing, Phishing Trojans, Rogue Security Products, social engineering, social networks, spam, Stupid malware tricks, Threat Research, Trojans, Website owners | Tags: .cc, .in, Adobe updater, Aurora, BHSEO, black hat SEO, ccTLD, China, Cocos (Keeling) Islands, Exploit-PDF, Fake PDF, Firefox, Firefox update, Flash update, India, Koobface, Oficla, Operation Aurora, rogue antivirus, Rogue Security Products, Sasfis, SEO, Stuxnet, Tacticlol, Trojan-Downloader-Tacticlol, Windows Update | Comments (1)

Hey Malware Guy: Just What the Heck Am I Supposed to Do With This?

October 19, 2010 – 11:43 am

By Andrew Brandt The Tacticlol downloader, responsible for a lot of infections over the past year, propagates in two ways: via drive-by downloads, and as a .zip archive attached to messages. Maybe the spam filtering companies finally caught on to the trick, or maybe the Tacticlol distributors are just trying to mix it up, but [...]

By mguthrie09 | Posted in Botnet activity, Downloaders, social engineering, spam, Stupid malware tricks, Threat Research | Tags: глупо номер один, holbrook.jpg, Label_UPS_Nr###.exe, Label_UPS_Nr343.exe, Tacticlol, Trojan-Downloader-Tacticlol, UPS | Leave a Comment

Spammed Trojan Won’t Run Under Windows XP

June 14, 2010 – 2:07 pm

By Andrew Brandt While it is far from the first Trojan ever to simply fail to execute under Windows XP, it definitely caught our eye that a variant of Trojan-Downloader-Tacticlol distributed last week in a spam campaign only fully executed under Windows Vista or newer operating systems. It may have been just a fluke, but [...]

By mguthrie09 | Posted in social engineering, spam, Stupid malware tricks, Threat Research | Tags: Hide File Extensions for Known File Types, HKLM\software\classes\idid, Pushu, Statement_of_Fees_2009-2010.DOC.exe, Statement_of_Fees_2009-2010.zip, Sysinternals Antivirus, Tacticlol, TDSS, Trojan-Agent-TDSS, Trojan-Backdoor-TDSS, Trojan-Downloader-Tacticlol, Trojan-Pushu, TRxGM, Zbot | Comments (3)

Fake Amazon.com Order Emails Bring a Trojany “Friend”

May 17, 2010 – 4:37 pm

By Andrew Brandt An ongoing campaign where malware distributors use email spam to deliver dangerous programs to unwitting victims has begun to change its tune, switching the scam to incorporate different brands. In the latest scam, the message appears to be an order confirmation from Amazon.com for the purchase of an expensive consumer electronics item, [...]

By mguthrie09 | Posted in Destructive behavior, Downloaders, social engineering, spam, Stupid malware tricks, Threat Research | Tags: Amazon.com, itunes, Oficla, Pushdo, Pushu, Sasfis, shipping confirmation, Sony Bravia S8056, Tacticlol, Trojan-Backdoor-Zbot, Trojan-Downloader-Tacticlol, Trojan-Pushu, Zbot | Comments (7)

Getting a “Conract” Doesn’t Make You a Rock Star

April 30, 2010 – 2:01 pm

By Andrew Brandt If you’re a rock-and-roll star, anticipating the imminent arrival of a new recording contract from your lawyer, you can stop reading this post. If you’re not, I’m sorry to be the one to tell you, it was not your hours of practice playing Rock Band, or singing in the shower, that attracted [...]

By mguthrie09 | Posted in Destructive behavior, social engineering, Stupid malware tricks, Threat Research | Tags: Fregee, Losabel, Oficla, Our lawyers made alterations on the last page, Pushdo, Pushu, Sasfis, Tacticlol, Trojan-Downloader-Tacticlol, Trojan-Pushu, We are enclosing the file with the prepared contract, we are ready to make the payment on Friday for the first consignment | Comments (4)

Follow

Follow “Webroot Threat Blog”

Powered by WordPress.com