Threat Encyclopedia

W32/MyTob.GB@mm

description-logoAnalysis

  • Drops the following file:
    • undefinedSystemundefined\External.exe
  • Adds the following registry:
    • key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • value: External Dependencies
    • data: External.exe
  • Email Propagation:
    • Email format:

      • Subject:
        • Email Account Suspension
      • Body:
        • Dear [Email Account Domain] Member, 

We have temporarily suspended your email account [UserEmailAddress]. 

This might be due to either of the following reasons: 

1. A recent change in your personal information (i.e. change of address).
2. Submiting invalid information during the initial sign up process.
3. An innability to accurately verify your selected option of subscription due to an internal error within our processors.
See the details to reactivate your [email account domain] account. 

Sincerely,The [Domain] Support Team 

+++ Attachment: No Virus (Clean)
+++  Antivirus - www.[email account domain]
      • Attachment: account-details.zip
  • Attempts to terminate the firewall and other security applications, including antivirus monitors.

    • recommended-action-logoRecommended Action

      FortiGate Systems
    • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

    Telemetry logoTelemetry