Published: December 10 2009, 08:19 PM
by Mary Grace Gabriel

After a few weeks of silence, we have seen Zbot malware revisit its "Facebook Update Tool" and "IRS Tax Refund Request Form" campaigns.

CA ISBU recently received new spammed emails, disguised as legitimate email from VISA (a credit card company), and requesting the recipient to review their "VISA Electronic Report" by clicking on the link provided [Figure 1].

                                                       [Figure 1 – Spam Sample Email]

The email contains the Subject: possible fraudulent transaction occurred with your VISA card

The email contains the Body:
            --------------------------------------------------------------------------------------------------------

            Dear VISA card holder,

            A recent review of your transaction history determined that your card was used at an ATM
            located in {Random Name of a Country}, but for security reasons the requested transaction
            was refused.Please carefully review electronic report for your VISA card at:

           http://transactions.visa.com/cards/alerts/transactions.php?
           ref=77539726816694715907580668966567461158138910157354456&email=xxx@xxxxx.com

           VISA Cards Support

           Id: U7SVR0HMRGVFFOW86ZPGA8B2CIYRIM5XISI49JSXBGFQ01BYMK4IMEF4IF6H3OUWUI5QS
                        
           --------------------------------------------------------------------------------------------------------

Other emails may contain the following Subjects:

• possible fraudulent transaction
• possible fraudulent transaction and/or collusion with your VISA card
• possible fraudulent transaction has been executed
• possible fraudulent transaction has been executed with your VISA card
• possible fraudulent transaction is identified
• possible fraudulent transaction is identified with your VISA card
• possible fraudulent transaction occurred
• possible fraudulent transaction occurred with your VISA card
• possible fraudulent transaction with your VISA card

If you click on the link provided in the email, you will be directed to the site shown below [Figure 2], where you are prompted to download and review your "VISA Electronic Report"; in reality, this so-called "Statement" is actually a malware installer.

                                                        [Figure 2 – Zbot Download Page]

The file "cardstatement.exe" is a password-stealing Trojan that, when executed, usually drops a copy of itself as sdra64.exe to the Windows System folder and then executes it. This Trojan is detected by CA as a Win32/Zbot variant.

Again, we advise users to beware of these kinds of emails and ensure that your CA Security Products are updated with the latest signatures.

Share this post:  Email

Share