tiistai 24. joulukuuta 2013

Uusi "Adobe" sähköpostiansa

E-mailina saapui "Adoben" -nimissä sähköpostiansa. ÄLKÄÄ MISSÄÄN TAPAUKSESSA AVATKO ZIP tiedostoa, siinä on troijjalainen virus.
Kirjeessä lukee:
----------------
Hello.
Thank you for buying Adobe Captivate 6 software.
Your Adobe License key is in attached document below.
Adobe Systems Incorporated.
Liite: LicenseKey_JMK-7297_Adobe.zip (tämä on se pommi)
----------------
Lähettäjään viittaava "engenharia-software" -sivusto löytyy mutta ei ole domain eikä välitä lisenssiavaimia.
http://www.alexa.com/siteinfo/engenharia-software.com
SITÄPAITSI: en ole ostanut ohjelmaa tai tilannut tätä lisenssiavainta koskaan.
---------------
Verkosta löytyy vastaavasta tapauksesta tietoa:
http://blog.mxlab.eu/2011/11/02/email-with-adobe-license-key-attached-contains-a-trojan/
Email with Adobe license key attached contains a trojan
MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “Your InDesign CS4 License key”.
The email is send from the spoofed address “Adobe ” and has the following body:
Hello,
Your Adobe CS4 License key is in attached document below. We encourage you to explore its new and enhanced capabilities with these helpful tips, tutorials, and eSeminars.
Thank you for buying Adobe InDesign CS4 software.
Adobe Systems Incorporated
The attached ZIP file has the name License_key_N7853.zip and contains the 47 kB large file License_key.exe.
Please note that the from email address, the subject, content and name of the attached file can change accordingly.
The trojan is known as Troj/Bredo-LK (Sophos), W32/Yakes.F.gen!Eldorado (F-Prot), Downloader.Chepvil (Symantec).
At the time of writing, only 7 of the 43 AV engines did detect the trojan at Virus Total.