Fake Microsoft "critical update" spam propagating trojan
Updated Tuesday, June 23, 2009 at 1:15 p.m. EST
A new outbreak of spam claims to be a critical update for Microsoft Outlook, but the message really aims to infect users with the information-stealing trojan ZBot, security firm Trend Micro warned Monday.
First detected on Friday, the message reads: “This update is critical and provides you with the latest version of Microsoft Outlook/Outlook Express and offers the highest levels of stability and security.” The email instructs users to visit the “Microsoft Update Center,” but when attempting to follow the link, they download a trojan known as “ZBot” or “Zeus,” Ivan Macalintal, threat researcher at Trend Micro told SCMagazineUS.com Monday.
“ZBot is a notoriously known information stealer,” Macalintal said.
Some of ZBot's other moniker's include “Wsnpoem” and “NTOS” and the first variant was found in September 2007, Patrik Runald, chief security adviser at security vendor F-Secure, told SCMagazineUS.com on Tuesday in an email.
Upon execution, ZBot copies itself onto a users computer and creates two files -- one is an encrypted file that is downloaded from a remote server and contains commands from the botnet master. The commands contain a list of targeted banking institutions, social networks and other sites for the trojan to monitor, including Facebook, MySpace, Flickr, Bank of America and Wachovia, Macalintal said.
If a user visits one of these sites, the trojan will log a users' keystrokes to obtain login credentials, along with credit card or other sensitive information. It saves the information that is gathered in a second file created on the user's computer, and then sends the file back to the attacker's server, Macalintal said.
Macalintal added that there have been many variants of this trojan in the wild and it was previously infecting users by means of drive-by download. A previous variant masqueraded as an email notice from UPS. A different email attack, spoofed to look like it was coming from Delta Airlines to confirm a ticket purchase, had distributed a trojan with properties of ZBot.
“We've seen lots of other themes being used for malicious spam runs such as UPS delivery failure, postal tracking number, Western Union transfer, and Worldpay card transaction confirmation,” Runald said.
Runald added that those behind this threat, believed to be from Russia, have been very active in spamming Zbot during May and June in email attachments -- with a ZIP file that contains an executable -- and also in spam messages containing a URL that the user has to click on.
The most recent attack is still being circulated in the wild, Macalintal said. Considering that there have been many legitimate Microsoft updates in the past, this malware has the potential to infect a large number of users, he added.
In October, security researchers warned of a similar attack, in which a fake phishing email seemingly coming from Microsoft contained a different trojan.