Spammed Message Found with Attached Password Protected .ZIP file

TrendLabs engineers received a malicious spam sample with a password protected .ZIP file attachment. In the said mail, the sender claims that the attached file contains photos. The password for the .ZIP file is also indicated in the message. Upon extracting the contents of the .ZIP file, recipients download the malicious file, TSPY_ZBOT.BX, instead of the supposed photos. TSPY_ZBOT.BX is a ZBOT variant that steals sensitive online banking information, such as user names and passwords.

Users must refrain from downloading and executing attachments included in dubious-looking messages.