12345

12/21/2011

[Warning] Additional malicious file disguised as the pic of Kim Jong Il (Update #1)

1. Introduction

INCA Internet's Emergency Response Team has detected malicious file disguised the pic of Kim Jong Il.
Its icon and extension is well manipulated as a normal image file, and it shows Kim Jong Il related images on executing.
Therefore, general users can hardly notice about its being infected.
With the death of Kim Jong Il, a bunch of malicious files are up in these days.


 
December 20, 2011, INCA Internet's Emergency Response Team detected various malicious files related his death.

If a user clicks that file and executes malicious attachment, that user can be infected by malicious file.

[Warning] Kim Jong Il Malicious scam is spreading
http://en-erteam.nprotect.com/2011/12/warning-kim-jong-il-malicious-scam-is.html

[Caution]Malicious file is spreading via a Korean entertainer's porn video file.
http://en-erteam.nprotect.com/2011/12/cautionmalicious-file-is-spreading-via.html

With it, various phishing can be generated; therefore, users need to be careful on execute unofficial and suspicious news, image file, video clip and shorten URL.

Especially, various attachments including(PDF, DOC, HWP, PPT, ZIP, EXE, and SCR) can be malicious.

2. Spreading path and symptoms of infection

INCA Internet's Emergency Response Team has found another malicious file disguised the pic of Kim Jong Il.
This malicious file is disguised as a picture of Kim Jong Il unlike previous malicious file used PDF, DOC vulnerability.

Its icon adopted basic JPG and you can show its real extension when "Hide protected operating system files (Recommend)" is unchecked. Actually SCR file is for screen saver, and it disguised its extension to SCR.

Besides, its file name can rise up Kim Jong-il.

Users can be infected on executing.

First, it creates Update.exe in Application Data folder with hidden property, then it creates Kim Jong-il.jpg in the same path of executed malicious Kim Jong-il.jpg.scr.


Then it creates MSN Talk Start.lnk on startup, finally it removes Kim Jong-il.jpg.scr and it pretend that it isn't malicious.


This malicious tries to access certain host, and it installs malicious files such as Kserver.exe, kserver.dll on Recycle Bin folder.

Those two files are remote command Backdoor Server files, and attacker can get the permission of all administrators on victim's PC and can monitor.



* Update 2011. 12. 21


We found the malicious file "The Death of North Korea's Kim Jong Il.pdf" and added pattern on our nProtect Anti-Virus.



3. How to prevent

To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.
5. Execute downloaded file after scan with anti-virus SW.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.

15 comments:

  1. Having trouble with a philosophy paper writing? Check out this guide, guys, should be helpful.

    ReplyDelete
  2. The article you have shared here very awesome
    Swords And Souls

    ReplyDelete
  3. This is a great article, with lots of information in it, These types of articles interest users in your site.
    After buying a Hp printer if you are stuck in some steps then contact hp setup to get the quick and easy solution.

    ReplyDelete

  4. HappyMod is a new generation App Store for Modified Apps and Games.Download HappyMod APK to get access to thousands of cracked and premium apps for Android.

    https://www.happymod.vip/

    HappyMod

    ReplyDelete
  5. This is a great piece of news,i really find this interesting if you wan to secure your data the install webroot antivirus to make your data highly secured.

    ReplyDelete
  6. Kaspersky Lab groups the whole scope of malignant programming or possibly undesirable articles that are distinguished by Kaspersky's antivirus motor – ordering the malware things as indicated by their action https://www.assignmentdone.co.uk/ on clients' PCs. The grouping framework utilized by Kaspersky is likewise utilized by various different antivirus merchants as the reason for their characterizations.

    ReplyDelete
  7. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you!

    ReplyDelete
  8. If you need any kind of assignment help, Then you can go AllAssignmentHelp.com. Here you will get high-quality assignment help. We have a team of assignment experts who will help you by delivering the contents as you desired.

    ReplyDelete