Fake FBI email Worm Variant Xposed

["Debasis Mohanty" <mail () hackingspirits com>]

On 21st Feb, 2005 I came across a worm which claimed to have been sent by
"M.John Stellford" from FBI. The message body text is given below:

Dear Sir/Madam,
we have logged your IP-address on more than 40 illegal Websites.
Important: Please answer our questions!
The list of questions are attached.
Yours faithfully,
M. John Stellford
++-++ Federal Bureau of Investigation -FBI-
++-++ 935 Pennsylvania Avenue, NW, Room 2130 Washington, DC 20535
++-++ (202) 324-3000


Any normal computer user who receives this fake mail will definitely first
get scared by seeing such mail at the first instant. One would probably get
fooled and out of curiosity would go ahead in opening the attachment. That
is it, END OF STORY!!! YOU ARE NOW INFECTED.

I have setup my windows machine for malicious programs collections and
analysis and here I am going to share my experience of reverse engineering
and analysis of this new FBI email worm. 

The detailed article can be downloaded from the following location: 
http://www.hackingspirits.com/eth-hac/papers/whitepapers.asp

Download the article: "Fake FBI email Worm Exposed". 


Regards, 
Debasis Mohanty
www.hackingspirits.com 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html