Mail Delivery Subsystem - message.exe

これも繰り返し使われるネタの一つ。

今回は、外からexeをダウンロードさせようとするタイプ。

ひとつめ

もうひとつ

http://www.virustotal.com/analisis/6ea8d183fbb7be68a8ca4665e6b5e66790d49e8d3633b6378163c01b379b2290-1279264192

 Domain Name               : youngrembrandts.co.kr
 Registrant                : Young Rembrandts Korea
 Registrant Address        : 402, 910-2 Daechidong Gangnamgu Seou South-Korea   
 Registrant Zip Code       : 135270
 Administrative Contact(AC): Young Rembrandts Korea
 AC E-Mail                 : andy@youngrembrandts.co.kr
 AC Phone Number           : 02-544-7468
 Registered Date           : 2006. 12. 13.
 Last updated Date         : 2008. 12. 01.
 Expiration Date           : 2014. 12. 13.
 Publishes                 : Y
 Authorized Agency         : Gabia, Inc.(http://www.gabia.co.kr)

 youngrembrandts.co.kr has address 121.254.168.90
 
 inetnum:      121.254.128.0 - 121.254.255.255
 netname:      KIDC
 descr:        Korea Internet Data Center Inc.
 country:      KR

   Domain Name: KRZKRZ.COM
   Registrar: TUCOWS INC.
   Whois Server: whois.tucows.com
   Referral URL: http://domainhelp.opensrs.net
   Name Server: NS1.FATCOW.COM
   Name Server: NS2.FATCOW.COM
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Updated Date: 08-apr-2010
   Creation Date: 08-apr-2010
   Expiration Date: 08-apr-2011

 KRZKRZ.COM has address 65.254.248.137
 
 OrgName:    The Endurance International Group, Inc. 
 OrgID:      EIG-12
 Address:    70 Blanchard Road
 City:       Burlington
 StateProv:  MA
 PostalCode: 01803
 Country:    US 
 
 NetRange:   65.254.224.0 - 65.254.255.255 
 CIDR:       65.254.224.0/19 
 NetName:    BIZLAND-FC03
 NetHandle:  NET-65-254-224-0-1
 Parent:     NET-65-0-0-0-0
 NetType:    Direct Allocation
 NameServer: NS1.BIZLAND.COM
 NameServer: NS2.BIZLAND.COM
 Comment:    
 RegDate:    2004-01-06
 Updated:    2005-03-31

[カテゴリ:spam観察日記]

by jyake