ZBot trojan attached to contract

mxlab — Sat, 26 Jul 2008 20:31:25 +0000

A new variant of the ZBot trojan is attached to an email with your contract details. Possible subject lines are:

Contract of settlements
Contract of retirements
Permit for retirement
Loan contract

The contents of the message:

Dear customers,

We have prepared a contract and added the paragraphs that you wanted to see in it. Our lawyers made alterations on the last page. If you agree with all the provisions we are ready to make the payment on Friday for the first consignment. We are enclosing the file with the prepared contract. If necessary, we can send it by fax.

Looking forward to your decision.
Israel Bender

Virus Total permalink and MD5 hash: c0a907c8bf64d60bec0cce934ca60a34

“Parcel requires declaration” virus

mxlab — Thu, 24 Jul 2008 21:04:01 +0000

The UPS Trojan has changed its characteristics but the general concept remains the same. An email that is sent from the customs regarding a parcel that is awaiting delivery for you. Attached a .zip file with malware.

The email comes with one of these subject lines:

Your parcel is at the customs office
Parcel requires declaration
Customs, please read
Customs – We have received a percel for you

The contents of the email:

Hello,
We have received a parcel for you, sent from France on July 9. Please fill out the customs declaration attached to this message and send it to us by mail or fax. The address and the fax number are at the bottom of the declaration form.
Kind regards,
Aileen Solis
Your Customs Service

The email has the Bill_Tax.zip file attached with inside the archive Bill_Tax___________________________N89798742344.exe which is the same ZBot trojan. Virus Total report. Only 3 engines detect this one so don’t open the file if you receive the email!

mxlab - all about anti virus and anti spam » parcel virus

ZBot trojan attached to contract

“Parcel requires declaration” virus