W32/MyTob.GB@mm

Analysis

• undefinedSystemundefined\External.exe

• key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• value: External Dependencies
• data: External.exe

• Email format:


• Subject:

Email Account Suspension

• Body:

Dear [Email Account Domain] Member, We have temporarily suspended your email account [UserEmailAddress]. This might be due to either of the following reasons: 1. A recent change in your personal information (i.e. change of address). 2. Submiting invalid information during the initial sign up process. 3. An innability to accurately verify your selected option of subscription due to an internal error within our processors. See the details to reactivate your [email account domain] account. Sincerely,The [Domain] Support Team +++ Attachment: No Virus (Clean) +++ Antivirus - www.[email account domain]

• Attachment: account-details.zip

Recommended Action

FortiGate Systems

• Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.