RapidShare used to spread rogueware
Besides the usual spam this morning, in the likes of "very good news . now you can buy new iphone 4 from this site! ",
I had also received an email from someone I know. It was sent to all of his contacts, including me. The message only contained the following URL:
Link to Rapidshare to download a file called "surprise.exe" I have obfuscated the URL for your safety.
It comes to no surprise that actually this file is rogueware with the name Security Shield. Below you can find an example screenshot of this rogue:
Security Shield rogueware
surprise.exe
Result: 11/42 (26.2%)
MD5: a6af97e7a5fd59c82b4c08a568eae882VirusTotal
Anubis Report
ThreatExpert Report
When executing the downloaded file ( surprise.exe ):
Conclusion
Besides coming from a trusted person, this rogueware program is also using Rapidshare as a mirror for spreading. Also, the file has the name "surprise.exe" which may convince you even further that your friend has just sent you a message with a nice surprise e-card or similar. After all, you know the person who sent it, why would it hurt ?
The above pictures proove why. I doubt youd want some rogueware sitting on your computer. The trick is you should never trust an email which has:
- only a URL included in the message
- crappy spelling and grammar if there is content in the message
- been sent out to everyone in the senders address book
- been sent from an unknown sender
- promises you can buy something for a very cheap price
- No subject or strange subjects ( eg.: "0 enjoy yourself" )
If you have downloaded a program and you are unsure about its intentions, you can always upload it to VirusTotal or other online virusscanners (VirScan, Jotti). Keep in mind that if a file is not detected by any engine, it is not necessarily clean!
Peace out.
download file now