It’s not Kaspersky…

There’s a nasty site out there, that has nothing to do with Kaspersky and yet uses the brand name to lure users.

x.kaspersky-com.info

The page greets you with no less than 3 iframes:

If you check the first iframe, you notice that it uses “jpg” to hide malicious exploit code. A technique well used to bypass security scanners.

That’s how one of the jpg looks like:

Upon successful exploit, a file is downloaded from x.kaspersky-com.info/mm.exe

Looks like another Agent Trojan.

Jerome Segura

Malware ID: 44e0c70cefe5e6db6e7115a061e86dc9.zip