Western Union money transfer email contains new variant of Bredolab
November 6, 2009 6 Comments
MX Lab intercepts a new trojan W32/Bredolab!Generic variant attached in emails from Western Union with the instructions on how to receive the money transfer.
Possible subjects:
Western Union transfer is available for withdrawl.
Western Union. You should receive money transfer! Order 7909.
Senders:
Content of the email:
Hello.
The amount of money transfer: 5887 USD.
Money is available to withdrawl.You may find the Money Control Number and receiver’s details in document attached to this email.
Western Union.
Customer Service Center.
We did noticed that with this campaign, since November 5th 2009, the attached ZIP archive is only 4 kB big and when extracted the executable is 0 kB big! It seems there is some issue with the email distribution but we expect that this can change quickly.
Virus Total link and MD5: e6069e83c06da868637489466daed9d3.
Pingback: Bredolab surges to new heights thanks to Cutwail botnet « mxlab - all about anti virus and anti spam
The following is received:
Date: Fri, 6 Nov 2009 14:23:52 +0000 Download Western Union. You should receive money transfer! Order 583..msg
From: “Manager Maria Berry” [email protected] Block email [email protected] Block SMTP relay host86-129-161-227.range86-129.btcentralplus.com
To:
Subject: Western Union. You should receive money transfer! Order 583.
Dear customer.
The amount of money transfer: 2193 USD.
Money is available to withdrawl.
You may find the Money Transfer Control Number and receiver’s details in document attached to this email.
Western Union.
Customer Service.
I received something very similar. The zip file contained an exe that I did not open. I removed the “To:” line but the rest of the e-mail is below.
—-
Western Union. You should receive money transfer! Order 471.
Saturday, November 7, 2009 2:30 AM
From:
“Manager Shawn Calhoun”
Message contains attachments
1 File (156b)
* WU_Details_b81e3.zip
Hello.
The amount of money transfer: 2531 USD.
Money is available to withdrawl.
You may find the Control number and receiver’s details in document attached to this email.
Western Union.
Finance Department.
was also from
[email protected]
Dear customer.
The amount of money transfer: 7771 USD.
Money is available to withdrawl.
You may find the Money Transfer Control Number (MTCN) and receiver’s details in document attached to this email.
Western Union.
Customer Service Center.
Requiero la orden de 10 numeros
where is document attached to this email.
Western Union.