Quote from: Injust on October 03, 2015, 11:18:25 PM

Quote from: Mickeyb on October 03, 2015, 11:06:13 PM

Quote from: Injust on October 03, 2015, 10:45:33 PM

The file that is available for download has some interesting metadata.

File description: Jolanta6
Product name: Phocaceous8
Language: Bulgarian (Bulgaria)
Original filename: Qaplus.exe

EDIT: More metadata

TRANSLATION   0x0402 0x04b0
INTERNALNAME   Qaplus
FILEVERSION   1.00
COMPANYNAME   Astonsoft Ltd.
COMMENTS   Oxyuriasis
PRODUCTNAME   Phocaceous8
PRODUCTVERSION   1.00
FILEDESCRIPTION   Jolanta6
ORIGINALFILENAME   Qaplus.exe

So how did you get to the file? Have you entered the site? Or you used some other way to scan the file?

Downloaded the file and ran it sandboxed. It's a nasty piece of work.
Runs a process disguised as scvhost.exe.
Also copies itself to several places in your user profile.
It corrupts the Computer Management shortcut in the Start Menu too.
Nasty piece of shit.

Yes, I can only imagine! Thanks for checking. I urge everybody to stay away from this e-mail and that they report these motherf***ers if they get an email. I just did!