Spammer's blunder leads to widespread split personality malware attack

Filed Under: Malware, Spam

UPS FDICWe're seeing a widespread malware attack in our spam traps this morning - and what's making it unusual is that it appears not to be able to decide what it is.

When you first see the subject line, you imagine it's going to be another "undelivered parcel" attack:

United Parcel Service notification #49674

(the tracking number changes in each email)

And the fact that it uses an @ups.com email address doesn't do anything to make you think it won't be another addition to the long line of malware attacks that are spammed out pretending to come from the likes of UPS, FedEx or DHL.

Things get a little weird, however, when you look at the email's content.

FDIC / UPS malicious email

The message, embedded as an image inside the email, claims to come from the Federal Deposit Insurance Corporation (FDIC).

It claims that there are "important changes in current regulations of endowment insurance procedure" that you should look through, and is signed - with "best regards" from the "Federal Deposit Insurance Corporation Investors Relations Department".

What a strange email!

On one hand it claims to be from UPS about a delivery, and with a split personality it then claims to be a message from FDIC! The attached file appears to keep up the pretence of being FDIC-related - it's called FDIC_Document.zip.

Beware opening the ZIP file, however. It contains a malicious file called FDIC_Document.exe. Sophos has added detection of the malware as Troj/Bredo-FA.

UPS FDIC malicious emails

This malicious spam campaign is widespread right now, hitting inboxes around the world. Hopefully the cybercriminal's botched job will stop some people opening the attachment as its subject line and 'from' address is clearly so out of kilter with its email body.

But no doubt there are some folks who will be so puzzled by this email's split personality that they'll investigate the attached file, and end up with an infected Windows computer.

15 February 2010 Update: It looks like the bad guys have now realised their mistake, as we're seeing malicious messages using a "correct" FDIC-related subject line and the embedded image claiming to come from FDIC:

Subject: Important information for depositors of Federal Deposit Insurance Corporation #76367

(the number is still randomly chosen)

Take care folks!

, , ,

You might like

One Response to Spammer's blunder leads to widespread split personality malware attack

  1. llc ยท 1348 days ago

    Stranger yet, the UPS parcel # is a real one. Several months old, but not a fake. Wonder how they got a large number of them?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.