Analyse vonDhan Praga

TrendLabs engineers received a malicious spam sample with a password protected .ZIP file attachment. In the said mail, the sender claims that the attached file contains photos. The password for the .ZIP file is also indicated in the message. Upon extracting the contents of the .ZIP file, recipients download the malicious file, TSPY_ZBOT.BX, instead of the supposed photos. TSPY_ZBOT.BX is a ZBOT variant that steals sensitive online banking information, such as user names and passwords.

Users must refrain from downloading and executing attachments included in dubious-looking messages.
 Spam gesperrt am/um:: 08 April 2011 GMT-8
 TMASE
  • TMASE Engine::6.5
  • Patrón TMASE: 8062