DHL tracking email contains Bredolab trojan
October 27, 2009 4 Comments
MX Lab is intercepting a large amount of emails regarding a DHL tracking error with an attached Bredolab trojan. The emails are from Manager Lucinda Poe <[email protected]>, where the name of the person is choosen randomly, and the subject is “DHL Services. You should get the parcel NR.23962″, where the nr is also randomly choosen.
The body of the email:
Dear customer!
The courier company was not able to deliver your parcel by your address.
Cause: Error in shipping address.You may pickup the parcel at our post office personaly!
Please attention!
The shipping label is attached to this e-mail.
Print this label to get this package at our post office.Please do not reply to this e-mail, it is an unmonitored mailbox.
Thank you,
DHL Express Services.
The attachment is named DHL_print_label_2cd1e.zip that contains DHL_print_label_2cd1e.exe. The combination letters and numbers is random.
The trojan listens to the name Trojan.Downloader.Bredolab.AZ (BitDefender), is detected by 20 of the 41 AV engines at Virus Total. Virus Total permlink and MD5: 76cb6667fef3d40e34f08e6af123930e.
Pingback: Bredolab surges to new heights thanks to Cutwail botnet « mxlab - all about anti virus and anti spam
Just for comment I am receiving an acceptable spanish translation of this message to a .es e-mail address from @dhl.es
-
Estimado Cliente.
El mensajero de nuestra Compañía no pudo entregarle el envío en su domicilio.
Causa: Error en la indicación del domicilio de entrega.
Puede recibir su envío personalmente en la oficina de correos cercana a su domicilio.
¡Atención!
A esta carta se le adjunta una etiqueta postal. Usted debe imprimir la etiqueta para poder recibir el envío en la oficina de correos.
Gracias.
DHL servicios.
-EOM
G’day guys,
I also got this message twice one day, since there it’s in my spam list but thanks for information, keep me informed please, thanks in advance. Cheers,
Sue
Thanks for the blog. I got similar email with attachment “DHL_Tracking_NR.324-492383.zip” and email content:
Dear ladies and gentlemen,
We were not able to deliver postal package you sent on the 2nd May in time
because the recipient’s address is not correct.
Please print out the invoice copy attached and collect the package at our office.
Your personal manager: Kennith Rankin,
Customer Service: 1-800-CALL-DHL
Fax: 888-993-6314
DHL International, Ltd. All Rights Reserved.