Zhelatin gang has updated its tactic again today. We've received its new spams. In the latest spams, a malicious domain "sup<removed>eas.com" was contained. Besides spams, we also found this malicious domain was posted on lots of blogs.
Two files, "StormCodec.exe" and "StormCodec8.exe", will be downloaded. Kaspersky detects them as Email-Worm.Win32.Zhelatin.wt.
Here is the screenshot of this malicious site:
............
Tags - email-worm.zhelatin , stormcodec.exe , stormcodec8.exe , zhelatin.wt
