Wrap-Up on July’s Fake Invoices
July 25th, 2008
Since the beginning of July there are steady waves of mass-mailings hitting the users’ inboxes with fake invoices. Fake UPS messages claim that a package couldn’t be delivered and was returned, the user should print out the attached invoice - which in fact is the malware of course.
Yesterday two different spoofs were on the loose, containing both the very same malware. One in german language claiming to be an invoice from PayPal Europe and the other pretending to be from the US Custom Services. And just today the next spam run brings in an invoice for a flight ticket. Victims are told they’ve bought an airplaine ticket and your credit card was charged. The details and the flight ticket are attached - again this is malware.
Users who fall prey to these common social-engineering tricks and install one of these nasties on his computer, actually install a ZBot spyware (aka ‘Wsnpoem’, aka ‘ntos.exe’ - a description is available in our Malware Library). ZBot, depending on the actual variant, downloads an encrypted configuration file with further instructions from a russian location and POSTs collected data back.
The Secure Anti-Malware Engine protects in two ways: the malware itself is blocked as Trojan.Spy.ZBot right away. Mobile computers that may have been infected while on the road, outside of the corporate protection and now joining back into the network, can be identified as infected with the “Potentially Unwanted Program” (PUP) heuristics. These heuristics can distinguish normal user browsing behavior from infected machines phoning home, and can block such compromised computers from all internet access until they’re cleaned again.
Gallery of Latest Fake Invoices
Author: Anti-Malware Team
Back to McAfee Research Blog overview
