Facebook Parola Sıfırlama. Dikkat Malware

Son günlerde Facebook tarafından gönderilmiş gibi görünen e-mail (fake password reset e-mail) ortalarda dolaşıyor. E-mail' de Facebook parolanızın değiştiği ve ekteki dosyanın çalıştırılarak yeni parolanızın oluşturulacağı yazıyor. Dosya virustotal'de analiz edildiğinde bir çok popüler antivirüs programı tarafından yakalanamadığı görülüyor. Facebook, kullanıcılarına parola sıfırlamak için herhngi bir iletiye eklenmiş bir dosya göndermiyor.

Kaynak:http://isc.sans.org/diary.html?storyid=7729

I received an email today purporting to be from Facebook, which of course had an attachment. The file was Facebook_Password_833fd.zip, which unzipped to be Facebook_Password_833fd.exe. The zip file is in fact a zip file, and the exe is in fact MS-DOS executable PE for MS Windows (GUI) Intel 80386 32-bit (according to the file command). The subject line is "Facebook Password Reset Confirmation. Customer Support. " The body of the email is pretty straight forward:

"Hey email,

Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.

Thanks,
Your Facebook."

Which is an attempt to get you to first open the attachment, unzip the file, and then run the executable content. The executable has the following attributes:

File size: 27648 bytes
MD5 : 11dee2f7ecc31a9a6f5fcab4e9654073
SHA1 : 30cfe72393ca5c58e7bba452c401932c6dcc9a9f

First set of Virustotal results were 20/41 today at 01:30:12 (UTC) https://www.virustotal.com/analisis/af6abaa7d0a29cdd4cf2680771d6d87e22d190a6a293572910ab89bd0653b322-1260408612 when I ran it again at 17:49:06 (UTC) they were up to 26/41 detection. It is a dropper which subsequently downloads and executes other badness.

Facebook does not send out passwords in attached files. If you have forgotten your password on Facebook reset it here: http://www.facebook.com/reset.php if you cannot login to your account (someone else has taken it over) go to this page: http://www.facebook.com/help.php?topic=login, which also has this advisory on it:
"Fake password reset emails

Some users have received fake password reset emails with attachments that contain viruses. Do not click on these emails or download the attachment. Also, please note that Facebook will never send you a new password as an attachment. To learn more visit our Security page: facebook.com/security"