full-disclosure - Fake FBI email Worm Variant Xposed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200502261945.j1QJjqrs028790@lists.netsys.com>
From: mail at hackingspirits.com (Debasis Mohanty)
Subject: Fake FBI email Worm Variant Xposed

On 21st Feb, 2005 I came across a worm which claimed to have been sent by
"M.John Stellford" from FBI. The message body text is given below:

Dear Sir/Madam,
we have logged your IP-address on more than 40 illegal Websites.
Important: Please answer our questions!
The list of questions are attached.
Yours faithfully,
M. John Stellford
++-++ Federal Bureau of Investigation -FBI-
++-++ 935 Pennsylvania Avenue, NW, Room 2130 Washington, DC 20535
++-++ (202) 324-3000

Any normal computer user who receives this fake mail will definitely first
get scared by seeing such mail at the first instant. One would probably get
fooled and out of curiosity would go ahead in opening the attachment. That
is it, END OF STORY!!! YOU ARE NOW INFECTED.

I have setup my windows machine for malicious programs collections and
analysis and here I am going to share my experience of reverse engineering
and analysis of this new FBI email worm. 

The detailed article can be downloaded from the following location: 
http://www.hackingspirits.com/eth-hac/papers/whitepapers.asp

Download the article: "Fake FBI email Worm Exposed". 

Regards, 
Debasis Mohanty
www.hackingspirits.com