lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed Jun 28 17:07:38 2006
From: ademar.gonzalez at gmail.com (Ademar Gonzalez)
Subject: Orkut exploit

Don't know if you guys have seen this. Just got it in my gmail
account, it tries to execute the file scrapbook.exe from :

http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe

Karpesky says is Trojan-Spy.Win32.Banker.anv

attached is the original emai.

ciao ciao

ademar
-------------- next part --------------
                                                                                                                                                                                                                                                               
X-Gmail-Received: c80ebeab16f2929bed85c587f2faf8e4b61a638e
Delivered-To: ademar.gonzalez@...il.com
Received: by 10.48.218.3 with SMTP id q3cs438948nfg;
        Wed, 28 Jun 2006 07:42:07 -0700 (PDT)
Received: by 10.54.122.2 with SMTP id u2mr905635wrc;
        Wed, 28 Jun 2006 07:42:07 -0700 (PDT)
Return-Path: <nobody@...n.gov.co>
Received: from michelangel.idsn.gov.co ([200.21.86.226])
        by mx.gmail.com with ESMTP id 29si3223488wrl.2006.06.28.07.42.04;
        Wed, 28 Jun 2006 07:42:07 -0700 (PDT)
Received-SPF: neutral (gmail.com: 200.21.86.226 is neither permitted nor denied by best guess record for domain of nobody@...n.gov.co)
Received: by michelangel.idsn.gov.co (Postfix, from userid 99)
	id EBAC317DC4; Wed, 28 Jun 2006 09:31:23 -0500 (COT)
To: ademar.gonzalez@...il.com
Subject: Karina Lima deixou um recado para voce!
X-Message-Status: s1:0
X-SID-PRA: Karina Lima <no-reply@...ut.com>
X-SID-Result: TempError
Errors-To: no-reply@...ut.com
From: Karina Lima <no-reply@...ut.com>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-encoding: 8bit
Reply-To: Karina Lima <no-reply@...ut.com>
Message-ID: <813b8c66f3c6555d06885de863df4b00@>
Conversion-With-Loss: Yes
Sensitivity: 3
Expiry-Date: Never
X-Priority: 3
X-MSmail-Priority: High
X-Originating-Email: [Karina Lima]
X-Originating-IP: [200.201.120.121]
X-iGspam-global: Unsure, spamicity=0.748491 - pe=7.48e-01 - pf=0.748491 - pg=0.748491
X-oemPro-CSID: MjgxXzI3NA==
X-oemPro-MsgId: YWRlbWFyLmdvbnphbGV6QGdtYWlsLmNvbQ0=
Date: Wed, 28 Jun 2006 09:31:23 -0500 (COT)

<table cellSpacing="8" cellPadding="0" width="100%" align="center" border="0" nowrap>

  <tbody>

    <tr>

      <td>

        <div>

          <div style="BACKGROUND-COLOR: #d4dded">

            <p> </p>

            <p> </p>

            <table id="AutoNumber1" style="BORDER-COLLAPSE: collapse" borderColor="#0000ff" cellSpacing="0" cellPadding="0" width="92%" bgColor="#ffffff" border="0">

              <tbody>

                <tr>

                  <td width="64%">

                    <p align="left"><span id="ws"> </span></p>

                    <p align="left">Ol?,<br>

                    <br>

                    Karina Lima deixou um recado para voc?.<br>

                    <br>

                    Para ver o perfil de Karina, clique em:<br>

                    <a href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe">http://www.orkut.com/Profile.aspx?uid=15566759696860888154</a><br>

                    <br>

                    Para ler o novo recado, visite o orkut.<br>

                    <br>

                    <a href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe">http://www.orkut.com/Scrapbook.aspx</a><br>

                    <br>

                    <br>

                    * * *<br>

                    <br>

                    Para controlar os emails de notifica??o, acesse suas

                    Configura??es de conta:<br>

                    <br>

                    <a href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe">http://www.orkut.com/Settings.aspx</a><br>

                    <br>

                    Se voc? n?o for usu?rio do orkut e quiser impedir que usu?rios

                    do orkut lhe enviem<br>

                    e-mails, visite:<br>

                    <br>

                    <a href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe">http://www.orkut.com/Block.aspx</a><br>

                    <span id="ws"><br>

                     </span></p>

                  </td>

                  <td width="36%"><span id="ws1"><a href="javascript:ol('http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe');"><img alt="Orkut" src="https://www.orkut.com/img/i_o.gif" border="0" width="58" height="20"></a></span><br>

                    <span id="ws0"><a href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe"><img title="quem voc? conhece?" alt="quem voc? conhece?" src="https://www.orkut.com/img/pt-BR/wdyk.jpg" border="0" width="240" height="136"></a></span></td>

                </tr>

              </tbody>

            </table>

            <p><br>

             </p>

            <table cellSpacing="0" cellPadding="0" width="100%">

              <tbody>

                <tr>

                  <td class="I" style="BACKGROUND-REPEAT: repeat-x" vAlign="top" background="https://www.orkut.com/img/tr1.gif" rowSpan="2">servi?o

                    filiado ao Google</td>

                </tr>

              </tbody>

            </table>

          </div>

        </div>

      </td>

    </tr>

  </tbody>

</table>

Powered by blists - more mailing lists