New Gatina Variant Continues To Target Filipino Users

SophosLabs encountered a new variant of the W32/Gatina family of mass-mailing worms today, detected as W32/Gatina-B.

Like most mass-mailing worms, W32/Gatina-B uses social engineering to try and entice users into reading the message and opening the accompanying file attachment that is a copy of the worm. This particular worm continues to target users in the Philippines as evidenced by some of the following subject lines used by the worm:

“FILIPINO’S SECRETS”
“LYRICS OF BAMBOO AND OTHER BOY BAND”
“Philippines Government Top Secret”
“New Virus Information”
“Ukinnam Virus Information”