WP Tb USA AUS NZL An TGP T0 0329 AUSCAN Overall classification REL TO USA AUS CAN GBR NZL BRICKTOP 2009 Tascom RusComNet Kaspersky Rosoboron nstitute oflnformation mt Moscow TelecommunicaTion Analytical Technology Corpora rion Comstar Komet Rail lNi'It Kacnepcxoro GEiilr Jo Sample Email Received by an AV Vendor PWZA201 2051 021 8350000 1 97506 Good day A phishing scam file is attached for your analysis Zip file password virus The file tricks the user into giving her his bank account credentials This can be verified by clicking on the Sign In button FYI Regards Francois Picard NewRoma net Attachment BMOFinancialGroup zip Work Flow Analytic value brings in 10 potentially malicious files per day for malware triage i3 Over 500 potentially malicious files collected since 2009 50 CAMBERDADA signatures deployed to for alerting 1 9 domains mitigated DNS Interdiction as9 domains under DNS Interdiction aasCloudshield intercepts the DNS request as Returns the address of a listening post asMunged version of the request is sent out aasDNS response is sent to a log Current status 33% CRN 3 550 Overhead SCS FORNSAT L-C-2010-147 Multi-Country Computer Network Ops 33% Dozens of CADENCE selectors daily queries models What else can we do can repu rpose the malware 33% Check Kaspersky AV to see if they continue to let any of these virus files through thei Anti- Virus product 33%Monitor the folks who provide the malware to see if they re into more nefarious activity 33% Establish automated reporting More Targets fsb-antivirus Bit-Defender France Romania eAladdin Norman Israel secure DrWeb AVG F-prot Norwa Czech Iceland Y F nland Hau k7computing Ikarus Korea A b't India Austria ma Antw Avira Poland Chinese Germany Spy-Emergency N0d32' Novirusthanks Slovakia Slovakia Ahnlab Italy 5 Korea Emsisoft Eset Avast Checkpoint Austria Slovakia Czech Israel -- co Vizcma TOP SECRETHCOMINTHREL TO USA AUS CAN GER NZL 4121 V252 S De ved From 1-52 Dated 20070108 Declass'rfy On 20370301 TOP SECRETHCOMINTHREL TO USA AUS CAN GBR NZL