New trojan being distributed via WMF spam
Posted by Mikko @ 12:44 GMT
Wednesday, January 4, 2006
There's a new trojan spam run underway, exploiting again the WMF vulnerability.
The exploit code is taken directly from the last Metasploit distribution. So the Metasploit exploit is assisting botnet herders and spyware distributors to take over the computers of users who still have no Microsoft patch to close the hole.
In this particular case the spammed message was a fake warning...When curious readers follow the link to a web server under comcast.net, they are hit with a WMF file that immediatly downloads a botnet client via tftp and runs it. In case the WMF exploit wouldn't work, the front page of the site also contains an exploit against older versions of Firefox, using the "InstallVersion.compareTo()" flaw. The downloaded client will connect to a botnet hosted via several IRC servers.