Spamming Malware

You may have recently received an email with a subject header that resembled:

You've received an ecard from a class-mate!

In the body of the message will be at least one and possibly two links which will lead you to a webpage that will try to load malware on your computer.

Some things to keep in mind when considering whether an email of this type is legitimate or not:

• The email of a legitimate egreeting should be from the egreeting site, not a yahoo (or other free) address
• The links should go to the e-card site (and particularly, should resolve to an actual domain name, not a series of numbers like--xx.xxx.xxx.xxx)
• The e-card should be from someone (not 'a friend' or 'a classmate' or 'a family member')

• If you have doubts about an email of this type, don't click on any of the links. You can always forward the message to eit@iastate.edu and ask us whether it's legitimate or not.

You can find more information about this particular bit of spam/malware at:

http://isc.sans.org/diary.html?storyid=3063&rss

Posted by dcoates at July 03, 2007 11:18 AM