FBI vs. Facebook - Makes Any Sense?
July 28th, 2008
Of course not. It’s another new Storm campaign on the loose, with a minor change in the social-engineering trick. Mail with subjects like “FBI wants instant access to Facebook” is hitting users’ inboxes at the moment. If a user follows the trick, he will be presented with the following web site:
As usual the fake web site is hosted on an infected Storm web proxy. The text states that “Your download will start shortly. If you are unable to read the article, save it in and run on your computer”. If you follow the lure and click the link you’ll end up with an executable named “fbi_facebook.exe”. This is the malware - don’t run it. Again the malware authors don’t just rely on pure social-engineering, the web site also fires a set of browser exploits leveraging known vulnerabilities. A closer look at the source code reveals that there is an invisible IFRAME pointing to ‘ind.php’.
The Secure Anti-Malware Engine detects the threat as ‘Worm.Zhelatin.zk’, the exploit script is detected as ‘Script.Zhelatin.zb’, the payload as ‘Worm.Zhelatin.ZL’. And finally the whole fake web site with the invisible IFRAME is blocked as ‘Script.Zhelatin.ZL’ as well.
Author: Anti-Malware Team
Back to McAfee Research Blog overview
