Resurgence of Virut?
Full article142 words · extracted from blog.talosintelligence.com · click to collapse
Wednesday, May 16, 2012 13:43
It seems like the infamous virus Virut is making a comeback. Over the past 10 days, one of our most popular ClamAV signatures has been HTML.Iframe-63:
Virut is a file infector that has been around for over 5 years. It typically connects to its C&C servers at brenz.pl or trenz.pl. It also adds an iFrame script to HTML files on your machine that looks like this:
This iFrame will redirect anyone who opens that HTML page in a web browsers to brenz.pl/rc .
Do not navigate to that website. Historically, it has been used to distribute malware. As of 5/16/2012, Google Safe Browsing warns that brenz.pl has been used in the past 90 days to infect several domains.
On the Snort side, SID 22940 will keep your web servers from serving infected HTML pages to your users.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/resurgence-of-virut/