W32/Stration.E0A0@mm

Analysis

• SQHOST.EXE
• E1.DLL

• key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• value: sqhost
• data: undefinedWindowsundefined\sqhost.exe s

• key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
• value: AppInit_DLLs
• data: e1.dll

• Email format:


• Subject:

postcard

• Body:

Hi, you.ve just received a postcard. For: [users email address] From: --- Text: Happy New Year! Postcard: Click on attachment to view a postcard. ---- Pre-holidays Postcards.

• Attachments:

  postcard.zip

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.