Analysis byMary Grace Ermitano-Aquino
Our engineers recently came across samples of a spammed mail purpotedly coming from someone in the National Disability Insurance Scheme department of the Australian government. It sports the subject 'NDISPlan' and notifies the user that they have a secure file waiting to be downloaded and it appears to involve the insurance plan of an individual named 'Shelby'. 

Should users actually click the embedded link, they will be redirected to a landing page that will download an attachment file namely 'Shelby-MyNDISPlan.zip'. Upon extraction, the zip file contains .SCR file that, when executed, runs malicious script that will then download other malicious files like password/information stealers. Infection with such malware can result in financial loss due to online banking accounts being hijacked through information stealing routines.

The spam mail is already blocked and the attachment is detected as TROJ_UPATRE.YYSOO.We again advise users not to click or download any suspicious links or attachments.

 SPAM BLOCKING DATE / TIME: 23 de сентября de 2015 GMT-8
 TMASE
  • TMASE Engine: :
  • Patrón TMASE: :1834