12345

12/21/2011

[Warning] Additional malicious file disguised as the pic of Kim Jong Il (Update #1)

1. Introduction

INCA Internet's Emergency Response Team has detected malicious file disguised the pic of Kim Jong Il.
Its icon and extension is well manipulated as a normal image file, and it shows Kim Jong Il related images on executing.
Therefore, general users can hardly notice about its being infected.
With the death of Kim Jong Il, a bunch of malicious files are up in these days.


 
December 20, 2011, INCA Internet's Emergency Response Team detected various malicious files related his death.

If a user clicks that file and executes malicious attachment, that user can be infected by malicious file.

[Warning] Kim Jong Il Malicious scam is spreading
http://en-erteam.nprotect.com/2011/12/warning-kim-jong-il-malicious-scam-is.html

[Caution]Malicious file is spreading via a Korean entertainer's porn video file.
http://en-erteam.nprotect.com/2011/12/cautionmalicious-file-is-spreading-via.html

With it, various phishing can be generated; therefore, users need to be careful on execute unofficial and suspicious news, image file, video clip and shorten URL.

Especially, various attachments including(PDF, DOC, HWP, PPT, ZIP, EXE, and SCR) can be malicious.

2. Spreading path and symptoms of infection

INCA Internet's Emergency Response Team has found another malicious file disguised the pic of Kim Jong Il.
This malicious file is disguised as a picture of Kim Jong Il unlike previous malicious file used PDF, DOC vulnerability.

Its icon adopted basic JPG and you can show its real extension when "Hide protected operating system files (Recommend)" is unchecked. Actually SCR file is for screen saver, and it disguised its extension to SCR.

Besides, its file name can rise up Kim Jong-il.

Users can be infected on executing.

First, it creates Update.exe in Application Data folder with hidden property, then it creates Kim Jong-il.jpg in the same path of executed malicious Kim Jong-il.jpg.scr.


Then it creates MSN Talk Start.lnk on startup, finally it removes Kim Jong-il.jpg.scr and it pretend that it isn't malicious.


This malicious tries to access certain host, and it installs malicious files such as Kserver.exe, kserver.dll on Recycle Bin folder.

Those two files are remote command Backdoor Server files, and attacker can get the permission of all administrators on victim's PC and can monitor.



* Update 2011. 12. 21


We found the malicious file "The Death of North Korea's Kim Jong Il.pdf" and added pattern on our nProtect Anti-Virus.



3. How to prevent

To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.
5. Execute downloaded file after scan with anti-virus SW.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.

45 comments:

  1. Replies
    1. شادترین و بهترین موزیک ها در سایت ما
      دانلود آهنگ جدید

      Delete
  2. Having trouble with a philosophy paper writing? Check out this guide, guys, should be helpful.

    ReplyDelete
  3. The article you have shared here very awesome
    Swords And Souls

    ReplyDelete
  4. This is a great article, with lots of information in it, These types of articles interest users in your site.
    After buying a Hp printer if you are stuck in some steps then contact hp setup to get the quick and easy solution.

    ReplyDelete

  5. HappyMod is a new generation App Store for Modified Apps and Games.Download HappyMod APK to get access to thousands of cracked and premium apps for Android.

    https://www.happymod.vip/

    HappyMod

    ReplyDelete
  6. This is a great piece of news,i really find this interesting if you wan to secure your data the install webroot antivirus to make your data highly secured.

    ReplyDelete
  7. Kaspersky Lab groups the whole scope of malignant programming or possibly undesirable articles that are distinguished by Kaspersky's antivirus motor – ordering the malware things as indicated by their action https://www.assignmentdone.co.uk/ on clients' PCs. The grouping framework utilized by Kaspersky is likewise utilized by various different antivirus merchants as the reason for their characterizations.

    ReplyDelete
  8. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you!

    ReplyDelete
  9. If you need any kind of assignment help, Then you can go AllAssignmentHelp.com. Here you will get high-quality assignment help. We have a team of assignment experts who will help you by delivering the contents as you desired.

    ReplyDelete
  10. Thanks for your valuable post. Please post some more related topics. We are on your page only to read your blog because, as you know, there are no other for being here. Like you, we also here for some information of HP printer Offline, so if any of you need any type of help related HP printer then contact our Printer Offline Windows 10 or visit the website.
    Printer Is Offline

    HP Printer Offline

    Printer Offline Window 10

    ReplyDelete
  11. I read this article. I think You put a lot of effort to create this article. I appreciate your work. Wondering where to go in 2019? Things to do has ranked as the best include a remote, idyllic island, the design capital ...

    ReplyDelete
  12. Printing test pages for checking printer quality are becomes necessary when your printer stops printing properly. From the given link you can test print easily.

    ReplyDelete
  13. It's nice to see your writing, which is exactly what I need, it's very detailed

    ReplyDelete
  14. If you need help with writing essay, you can contact a reliable writing service. Take a look at topwritingservice.com feedback which other students left after cooperation with such service.

    ReplyDelete
  15. Your review is very great and useful for me…thank you
    app mobile

    ReplyDelete
  16. Your blog is great. I read a lot of interesting things from it. Thank you very much for sharing. Hope you will update more news in the future. TO Fix Change Password Quickbooks Online please contact our technical expert for help related to QuickBooks.

    ReplyDelete
  17. The ultimate goal of entrepreneurship coursework writing services is to provide Entrepreneurship Writing Services and entrepreneurship essay writing services since entrepreneurship assignments writing service seekers lack time to complete their entrepreneurship term paper writing services.

    ReplyDelete
  18. Sometimes users face some common issues like installation errors, Printing errors, PDF related errors, and connectivity issues while accessing Quickbooks. To overcome all issues with a single application known as Quickbooks Tool Hub. Rather than download individual tools, you can use this tool to save your time.
    Quickbooks tool hub download

    ReplyDelete
  19. Wales publishers are offering optimized, Best Publication Services in UK to boost the researcher and research communities, by providing accelerated and efficient services to fasten the publishing process and to give more opportunities for research on different disciplines.Wales publication research conferences give the researchers an international platform to discuss their scientific research Open Access Publishing UK work and their edges.We are different from other conferences because the community's member organizes our conferences.

    ReplyDelete
  20. sauna room

    WAJA sauna is specialist manufacturer of top quality sauna products. Products include sauna rooms, steam rooms, barrel saunas, wooden hot tubs, and all kinds of sauna accessories.

    ReplyDelete
  21. Thanks for sharing this information. Keep up the good work. Check out the way to fix Dell Error Code 2000-0125. Lean how you can fix it at your own or feel free to call our experts on our toll-free numbers or visit our website to know more!

    ReplyDelete
  22. In case you have any kind of difficulties repaying the online no credit check loans on the agreed date you should inform your direct lender and ask about the possibility to fix a new repayment plan extending the guaranteed payday loans no matter what bad credit.

    ReplyDelete
  23. Akshi Engineers Pvt. Ltd. Company manufacture Hot Rolling Mill Manufacturer in India for flat products like mill stand, gear boxes, shears and pinch roll etc. The Hot Rolling Mills are normally of 2Hi or 5Hi configuration depending on the type of product being rolled. The 2Hi Hot Rolling Mills are used for materials like Aluminum, Copper, Brass and other softer metals whereas the 5Hi Hot Rolling Mills are used for harder metals like Stainless Steel, Alloy Steel etc. Get Best deal by calling us or you can also visit our website for more information.

    ReplyDelete
  24. This article is increasing the interest to learn more about this topic. Continue the sharing your new updates, regularly for my future.


    คาสิโนออนไลน์
    ufabet
    ufa
    เว็บบอล
    relx

    ReplyDelete
  25. Nice to be visiting your blog again, it has been months for me. Well this article that i've been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share.


    เว็บแทงบอล
    ufabet
    ufa
    พวงหรีด
    โควิด
    บาคาร่า

    ReplyDelete
  26. I came across a great site to find ukrainian bride.Gender roles in Ukraine are still different from Western Europe and even more so from Russia. For example, the ideas of feminism did not take root in Ukraine. At the same time, the role of women in the management of the male world is so great that it is simply impossible to describe. A woman in Ukraine has always had a will to make independent decisions, and unlike in Russia, she has never been a thing, which is why it is best to look for a Ukrainian bride.

    ReplyDelete
  27. CBD flowers are often lighter than outdoorCBD Flower
    This is mainly due to the fact that hemp growers can optimize and control indoor parameters such as temperature and humidity.

    ReplyDelete

  28. The market feasibility of population statistics and psychological statistics is studied. Usually, there is a huge demand for uesed cars for sale. Several surveys over the years have shown that people who can afford new cars are much less than those who like to buy second-hand cars.

    ReplyDelete
  29. Get ready for the biggest poker action in April with 888poker, in collaboration with โป๊กเกอร์ออนไลน์ WPTDeepStacks There will be three tournament festivals held on top of the platform 888poker, 888poker Iberia (Spain and Portugal) and 888poker Italy

    ReplyDelete
  30. Our UFA800 has various game rooms for you to choose from ดูบอลออนไลน์ .For those of you who like to play casino games in the name of UFAGAME, it is a collection of many games such as baccarat games, bounce games

    ReplyDelete
  31. เราคือผู้นำด้านเกมพนันออนไลน์ Major168 เราคือผู้ให้บริการ คาสิโนออนไลน์ ที่ได้รับรองว่าดีที่สุดในประเทศไทย มีค่ายเกมส์ให้เล่นมากมาย Sagaming, Sexy bacarat, Dreamgame, Ebet, Wm casino, Vivo gaming ไม่ผ่านเอเย่นต์ ระบบปลอดภัยมีทีมงานดูแลตลอด 24ชม.

    SAGAME88 แหล่งรวมเกมส์พนันออนไลน์ คาสิโนสด บาคาร่า กำถั่ว คาสิโนออนไลน์ ไฮโล รูเล็ต รับเครดิตฟรีเล่นได้ทุกเกมส์ โบนัสสมาชิกใหม่เพียบ พร้อมระบบฝากถอนออโต้ 10วิ เรามีทุกค่ายเกมส์ให้คุณเลือกเดิมพัน SA Game Sexy bacarat Dreamgame WM Casino VIVO Gaming Ebet เล่นได้ทุกเกมส์

    Our website ufabet provides betting services in the system of Auto Deposit-Withdrawal. Our members are not only in Thailand. Online football betting UEFA Bet market And this makes a guarantee that Ufabet168 is another reliable football betting website

    ufa through the website UFABET1688 a web gambling online , one that integrated all the bets from online casinos , online casino , online , and also have a game a lot more to be chosen to play such games.

    ReplyDelete
  32. پکیج های روف تاپ عموما روی سقف ساختمان به سادگی و بدون برهم زدن نمای ساختمان نصب می شود. این دستگاه ها معمولا برای فضا ها و ظرفیت های بالا مورد استفاده قرار می گیرند. از این دستگاه ها معمولا برای کارخانه ها ،سوله ها ،ورزشگا ها، مساجد ،فروشگا ها و سینماها استفاده می شود. این محصول را میتوانید از شرکت تهویه نوین ایرانیان تهیه نمایید.

    ReplyDelete