Trend Micro researchers found spammed messages with a ZIP file attachment that contains a malware. It bears the subject, “Contract of Settlements” and purports to come from LSM Company. It informs users to open and check the attached file that holds a contract, which in actual is an executable file (contract_1.exe) detected by Trend Micro as TROJ_FAKEALE.JH.
When executed in the system, TROJ_FAKEALE.JH connects to http://{BLOCKED}edrdosubor.com/K1er0Lj5n8H0NM4E8h0u, where users get another FAKEAV variant, TROJ_FAKEAV.BQN.
|
|
Accordingly, users cannot scan the attached file because it is password protected. However, a password is included in the email to open the said file. This is probably to trick users into thinking that the said file is legitimate.
As usual, users are advised to refrain from opening any suspicious-looking emails. Trend Micro users are protected from this spam attack via its Trend Micro Smart Protection Network. For Non-Trend Micro product users, they can utilize HouseCall, Trend Micro’s highly popular and capable on-demand scanner for identifying and removing viruses, Trojans, worms, unwanted browser plugins, and other malware.
Post from: TrendLabs | Malware Blog - by Trend Micro
Spoofed Contract Carries Malware
