“Tyranny of the Police” Email Delivers Upatre Trojan

  • 6 December 2014
  • 1 reply
  • 340 views

Userlevel 7
Badge +54
By Ionut Ilascu    6 Dec 2014, 09:04 GMT Dyreza banking malware believed to be downloaded  
  Fake email lures users with bait about police abuse in Ferguson, Missourihttp://i1-news.softpedia-static.com/images/fitted/620x348/Tyranny-Of-the-Police-Email-Delivers-Upatre-Trojan.jpg A malicious email is currently hitting the inboxes claiming to be delivered by the Deans & Lyons law firm and to inform recipients of new abuses committed by the police following the Ferguson incidents.
The message contains a link that appears to lead to a page on CNN, although the domain name should be enough of a clue to stay clear.

According to Belgium-based MX Lab, a company providing solutions against email threats, accessing the URL downloads a ZIP archive containing a file with a double extension (BreakingNews_pdf_exe). It is a variant of the Upatre Trojan that is generally used to get different malware pieces onto the affected computer.

 

Threat has five Dutch PE language resources

 
In order to get the recipient to click on the link, the crooks claim that it is a report made by the law firm about the situation in Ferguson, Missouri. The multiple grammar mistakes in the body of the message should raise suspicions to the recipient. Full Article NOTE It is reported in the article that the domain with the malicious file has been suspended however given the ease of setting up new domains so people should be alert especially if the files names of ybwbh.exe and/or file-7765943_exe are seen  

1 reply

Userlevel 7
Badge +3
Reference to Upatre 3 weeks back also:
 
        http://research.zscaler.com/2014/11/evolution-of-upatre-trojan-downloader.html
 
 Upatre is a Trojan Downloader family that once installed, is responsible for stealing information and downloading additional malware onto the victim machine. It typically arrives via spammed e-mail messages from the Cutwail Botnet, either as an attachment or via a URL pointing to a remote hosting site. 

Reply