Thanks to Anand Muralidharan for their assistance with this research.
The world is mourning the loss of another legendary pop singer also known as the queen of pop - Whitney Houston. Spammers are paying homage to the icon with a wicked malware. The malicious email shows a video of the last appearance of the star in a Los Angeles night club and also downloads an executable binary. This file is detected by Symantec Antivirus as WS.Reputation.1.
The email originated from Ireland and targets Portuguese readers. The malicious file is hosted on a hijacked Japanese website. The email subject is randomized by adding random numbers at the end of the subject field.
Here are a few subjects that have been used by this spam:
- Subject: Olha o Video da ultima aparicao publica de Whitney Houston em u ma Boate em Los Angeles. Clique no play para Reproducao (0 .06787)
- Subject: Olha o Video da ultima aparicao publica de Whitney Houston em u ma Boate em Los Angeles. Clique no play para Reproducao (0 .17465)
Translated Subject Line:
Subject: Here is a video of the last public appearance of Whitney Houston in a bar in Los Angeles. Click here to watch (0 .06787)
Whitney Houston's funeral will be held on Saturday in a church in New Jersey and her fans are keen and curious to read any news about the pop star. We expect to see more malicious spam alleging to contain video footage of the funeral.
Symantec recommends our readers to visit reputed news websites to get updates and not to open any email claiming to have video/news of Whitney Houston. Use message security and antivirus solutions from Symantec and frequently update your security software, which protects you from potential online viruses and scams.