[SpamMail] "Your order has been paid!" 제목으로 전파 되는 메일 주의!!

Your order has been paid! Tracking NR:66557(랜덤 5자리) - 493(랜덤 3자리) 제목으로 스팸메일이 발송되고 있어 주의가 필요하다.

제목 : Your order has been paid! Tracking NR:66557(랜덤 5자리) - 493(랜덤 3자리)

본문 : 

Dear Customers,

Thank you for shopping at Amazon.com!

We have successfully received your payment.

Your order has been shipped to your billing address.

You have ordered ・Sony Bravia S2042 ・

You can find your tracking number in attached to the e-mail document.

Print the postal label to get your package.

We hope you enjoy your order!

Cathleen Zimmerman, Amazon

첨부파일 : AMAZON_LABEL_07_07-2010.zip

해당 메일의 첨부파일 실행 시 Fake AntiVirus 제품과 Spammer 파일을 다운로드 하여 상대방을 마구마구 괴롭힌다.

아직도 분석 중 ㅠ_ㅠ 죈장~ 하는 짓이 너무 많음

- 파일정보

C:\WINDOWS\system32\thxr.wgo

C:\WINDOWS\system32\aspimgr.exe

C:\WINDOWS\ws386.ini

C:\WINDOWS\s32.txt

C:\WINDOWS\ag32.txt

C:\Documents and Settings\UserName\Local Settings\Temp\2.tmp

C:\Documents and Settings\UserName\Local Settings\Temp\6.tmp

C:\Documents and Settings\UserName\Local Settings\Temp\8.tmp

C:\Documents and Settings\UserName\Local Settings\Temp\B.tmp

C:\Documents and Settings\UserName\Local Settings\Temp\C.tmp

C:\Documents and Settings\UserName\Local Settings\Temp\_check32.bat

C:\Documents and Settings\UserName\Application Data\8D8A7C101CAA18BF29C6D4B15CCFC1C3\setup715newver0015.exe

C:\Documents and Settings\UserName\Application Data\8D8A7C101CAA18BF29C6D4B15CCFC1C3\enemies-names.txt

C:\Documents and Settings\UserName\Application Data\8D8A7C101CAA18BF29C6D4B15CCFC1C3\local.ini

- 다운로드 정보

http://russianm****.ru/SecureFixUpdate71510000.exe

http://russianm****.ru/dogma.exe

http://russianm****.ru/v117.exe

http://boot****.in/setup715newver0015.exe

- 레지스트리 정보

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

"Shell" = "Explorer.exe rundll32.exe thxr.wgo nwfdtx"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

"setup715newver0015.exe" = C:\Documents and Settings\UserNAme\Application Data\8D8A7C101CAA18BF29C6D4B15CCFC1C3\setup715newver0015.exe"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspimgr

- 스팸정보(스팸속에 스팸!!)

제목 : 

Subject: Payment received

Subject: Amazon purchase

Subject: Thank you, your Amazon

Subject: Your Sony Bravia is shipped

본문 : 

hi,

as promised your changelog is attached,

Desiree

첨부파일 : Changelog_14.07.2010.zip (뒤에 날짜는 현재 날짜를 표기한다.)