ZBot trojan attached to contract

July 26, 2008 by mxlab 1 Comment

A new variant of the ZBot trojan is attached to an email with your contract details. Possible subject lines are:

Contract of settlements
Contract of retirements
Permit for retirement
Loan contract

The contents of the message:

Dear customers,

We have prepared a contract and added the paragraphs that you wanted to see in it. Our lawyers made alterations on the last page. If you agree with all the provisions we are ready to make the payment on Friday for the first consignment. We are enclosing the file with the prepared contract. If necessary, we can send it by fax. 

Looking forward to your decision.
Israel Bender

Virus Total permalink and MD5 hash: c0a907c8bf64d60bec0cce934ca60a34

Filed under Viruses Tagged with , , , , , , , , ,

“Parcel requires declaration” virus

July 24, 2008 by mxlab 5 Comments

The UPS Trojan has changed its characteristics but the general concept remains the same. An email that is sent from the customs regarding a parcel that is awaiting delivery for you. Attached a .zip file with malware.

The email comes with one of these subject lines:

Your parcel is at the customs office
Parcel requires declaration
Customs, please read
Customs – We have received a percel for you

The contents of the email:

Hello,
We have received a parcel for you, sent from France on July 9. Please fill out the customs declaration attached to this message and send it to us by mail or fax. The address and the fax number are at the bottom of the declaration form.
Kind regards,
Aileen Solis
Your Customs Service

The email has the Bill_Tax.zip file attached with inside the archive Bill_Tax___________________________N89798742344.exe which is the same ZBot trojan. Virus Total report. Only 3 engines detect this one so don’t open the file if you receive the email!

Filed under Viruses Tagged with , , , , ,