Since this morning, we’ve been receiving picture files of two
lovely girls, Natasha and Cristina …
Or so it seems.
Natasha and Cristina (aka TROJ_DLOADER.AWT and TROJ_SMALL.ABO)
are actually Trojan programs that attempt to download and execute a
file from a particular website (which is a known virus accomplice
site). These two babes-er, Trojans, trick users into opening them
through the use of double extension filenames and the use of
picture file icons. As of now, the samples that we have received
follow this particular naming convention:
DCXXX_{Girl’s Name}.JPG.EXE
{Girl’s Name}_DCXXX.JPG.EXE
Detection patterns are currently in the works for these
malware.