We also looked into the compromised domain and found that it doesn't use a Web application firewall, making it easier for malicious actors to infiltrate and use the site for their nefarious deeds.

Another noteworthy behaviour of this particular file, as noted here, is that it connects to an IRC server, possibly to join a botnet. It also reads data from several configuration files and information about the machine its installed in, such as the computer name and its GUID, a unique identifier. Once executed, it phones back to servers located in China, Vietnam, and the United States, most of which already have a history of harboring malicious files. Malwarebytes Anti-Malware detects the malicious SCR file as Trojan.Injector. Once Skype message recipients click the link, they are directed to a compromised domain to download a file pretending to be an image, as you can see below:īelow is the icon of the screensaver (SCR) file, which we have enlarged: Considering the image of the file downloaded from the link, however, I'm personally inclined to believe that the message sender meant the latter. I could be wrong (and please feel free to correct me), but if my very rusty Japanese serves me right, the text is read as ' tsuyo', which could either mean 'strong' or 'too much'. The spam message contains Japanese katakana characters and a bitly link with the following format:īit.ly/ The majority of those affected are in India, Japan, and the Philippines. Today, we've been alerted about an ongoing spam campaign against Skype users.

Skype download links