BBC Georgia's President Trojan
August 15, 2008
Aug 15, 2008
Starting August 15, 2008, a new wave of malicious e-mails is being spammed with following subjects:
- BBC NEWS.
- Weekly BBC NEWS.
- Your subscription.
The headlines in the email claim that Georgian president Mikheil Saakashvili is gay. Messages contain a linked image of the President from the BBC website:
Emails include links that are pointing to the following domains:
- aguadodecea.com
- elitezeitung.de
- farmaciacardelus.com
- freeweb.8k.ro
- petstogoodhomes.com
- thecar.fr
- transporter.tv
- vishalkullarwar.com
- www.oris-uk.com
- xrevolution.de
- and others
All these locations redirect to a single IP (79.135.167.49).
The name of the malware is "name.avi.exe".
SonicWALL detects this new wave with following signature:
GAV: FakeAlert.gen (Trojan)