Oficla trojan found in emails with subject “Please look my CV. Thank you.”

MX Lab started to intercept emails with the subject “Please look my CV. Thank you.” with the trojan Gen:Variant.Bredo.4 (Bitdefender, F-Secure), TrojanDropper:Win32/Oficla.G (Microsoft), Trojan.Sasfis (Symantec) or Mal/FakeAV-BW (Sophos).

This distribution is sent from the spoofed email address.

The body of the email:

Hello!

I have figured out that you have an available job.
I am quiet intrested in it. So I send you my resume,

Looking forward to your reply.

Thank you.

The email contains the file ZIP archive My_Resume_221.zip containing the 64 kB large executable My_Resume_221.exe.

The following files are created:

%Temp%\1.tmp
%System%\pgsb.lto

The registry key “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\idid” is created.
The registry key “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]” will be modified.

The trojan can retrieve data from:

* hxxp://davidopolko.ru/

At the time of writing, 16 of the 41 AV engines did detect the trojan. Virus Total permlink and MD5: c571e7e7f09bb845a2f38a4b8ffb02c9

MX Lab customers are protected against this email based threat.