Friday, August 15, 2008

New BBC spam mocks Georgia's President, Spreads New Virus

This morning we've received more than 300 copies of a new "BBC" spam campaign which mocks Georgia's President and spreads a new virus.

The mail is delivered with three distinct subjects so far:

A copycat spammer is using headlines:

Weekly BBC NEWS.
Your subscription.

to send spam messages claiming a headline that the President of
Georgia is gay.

The Headlines within the email message choose from:

Mikheil Saakashvili gay scandal! New of this week!
Saakashvili have a funny woman organ (! see it!
Funny Saakashvili gay video...See now!Sensation!
Sensation! president of Georgia... GAY! See now!
Last news! Saakashvili (president of Georgia) the gay!
President of Georgia - intim (GAY) video! see now!

The spams contain a linked image of the President from the BBC:

We've received 300+ copies so far . . .

Malware loads from these locations:

All of those locations actually cause the virus to be delivered from a single location, the IP address:

The name of the malware is "name.avi.exe", and at the moment, only FOUR out of 36 anti-virus products detect it.

Clearly the spam is from someone who doesn't have a solid command on the English language.

So far the emails have been received from more than 40 IP addresses. Spot-checking these IP addresses for previous spam activity finds nothing in the UAB Spam Data Mine, suggesting these machines are not part of a previously used spamming botnet. - Vietnam - India - JetBlue Airways, Salt Lake City, Utah - ADVA Technologies, Sandhurst, GB - Cable Bahamas - Alabanza, Inc - Baltimore, Maryland - NOC4Hosts, Tampa, Florida - US Cellular, Knoxsville, Tennessee - JSC Center Telecom - Russian Federation - Moscow Local Telephone - Russian Federation - Web Media Services - Russian Federation - Colocation facility - Netherlands - Severen Telecom, Russian Federation - Czech Republic - Bucharest, Romania - Turk Telekom, Ankara, Turkey - Poland - St. Petersburg Telephone, Russian Federation - ?? - Verizon - Verizon - Verizon - Taiwan - Italy - Wilamette University, Salem, Oregon - Italy - Germany - Federal Agency of Education, Moscow, Russia - Austin Community College, Austin, TX - Colombia - Mexico - Chile - Colombia - Cumberland Technologies, Mechanicsburg, PA - SEI Data, Dillsboro, Indiana - Korea - Germany - Spain - Spain - Albanza - BTNet - China

No comments:

Post a Comment

Trying a new setting. After turning on comments, I got about 20-30 comments per day that were all link spam. Sorry to require login, but the spam was too much.