Truth in e-mail virus filenames / 2014-11-13

2014-11-13 Truth in e-mail virus filenames
Truth in e-mail virus attempts seen (note the filename) :
Subject: MDaemon Notification -- Attachment Removed

-----------------------------------------
order01.zip (order01\bot_crypted10394.scr)
Oh, and another one came through with attachment:
Archive:  order01.zip
  Length     Date   Time    Name
 --------    ----   ----    ----
   385024  11-12-14 17:00   order01/bot_crypted10394.scr
 --------                   -------
   385024                   1 file
$ md5sum order01.zip ; sha256sum order01.zip 
ad9cb44bb7d64a8c5b619a4d37e7eb97  order01.zip
ecd0ead687314c195a8072fe46fd513b46d61688c19398ec3edbfd6f92b4aca4  order01.zip
$ md5sum order01/bot_crypted10394.scr ; sha256sum order01/bot_crypted10394.scr 
509670b354f356dcd38f3d47408d9910  order01/bot_crypted10394.scr
93098ab5d8827339b17e4510676c40c79f6eb09c7cbb5cf0931100fce647a64f  order01/bot_crypted10394.scr
Lots of German text in the .scr file:
Mitgemeint7
Logistiktruppe
Landschaftsstreifen
Blumenart7
Friedensnobelpreis
Priesterausbildung
Luftmotor
Form
C:\prestigetr
chtigem\Durchmischend6\Rauchgasexplosion\VB98\VB6.OLB
Exzessiverem7
Raumverschwendungen7
Artikelstammwartung1
And I pasted the complete strings -a bot_crypted10394.scr into pastebin.

Tags: , ,

IPv6 check

Running test...
, reachable as koos+website@idefix.net. PGP encrypted e-mail preferred. PGP key 5BA9 368B E6F3 34E4 local copy PGP key 5BA9 368B E6F3 34E4 via keyservers

RSS
Meningen zijn die van mezelf, wat ik schrijf is beschermd door auteursrecht. Sommige publicaties bevatten een expliciete vermelding dat ze ongevraagd gedeeld mogen worden.
My opinions are my own, what I write is protected by copyrights. Some publications contain an explicit license statement which allows sharing without asking permission.
Other webprojects: Camp Wireless, wireless Internet access at campsites, The Virtual Bookcase, book reviews
This page generated by $Id: newsitem.cgi,v 1.55 2021/11/09 13:09:49 koos Exp $ in 0.005798 seconds.