As I wrote in parts one and two of this series of blogs, Java.Cogyeka uses an autorun.inf file to propagate and download an additional module. I was able to get the downloaded module, based on a Java application, even though it took over a week because of the difficulty in establishing a connection with the […]
Contrary to initial reports, JACKSBOT may not be as low risk as initially thought. We noted some JACKSBOT infection in the wild, indicating that the people behind this multiplatform malware are saving their best tricks for last.We analyzed the JACKSBOT backdoor family (specific detection name JAVA_JACKSBOT.A) that arrives as a Java application. Because it is […]
I’ve stumbled upon hundreds of links targeting Opera Mobile users, to trick them into installing a malware on the device. The links are in the form of: hxxp://geqe.net/opera_mini/1965/opera_mini.auto#phpsessid=85cfe7f19a08b6387d0441a9d949bb95 Each has a different phpsessid value. The domain was registered last month (02/12/2012) and does not seem to host any legitimate content. These pages redirect to another […]
Latest Comments