Home→Blog→What we detect→Zhelatin
|
01 Apr Don't be an April Fool! Dmitry Bestuzhev Join our blog You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings. |
It's been clear for a long time that virus writers will take whatever opportunity they can to spread their malicious code. One popular approach is exploiting public holidays and other well-known days on the calendar – the St. Valentine's Day spam this year is a case in point.
The approach is particularly effective if the holiday is an international one – the result is an increased pool of potential victims.
Last night, on the eve of April Fool's Day, we started seeing a wave of new modifications of the notorious Zhelatin worm. At the time our mail pots started picking up on these messages, no antivirus company was detecting the latest version of the worm.
This latest attack took the usual approach:
1: Prepare the bot machines
2: Mass mail spam containing a link to a site
3: Malicious code is automatically downloaded to the victim machine when the site is viewed
Analysis
Alerts