More Fedex Spam Malware

It has been a relatively quiet weekend here at SophosLabs. However, we are continuing to see Fedex spam with a subject like “Fedex Tracking N*5421062126” and the following message body:

Error! No JavaScript in your browser!

The message contains a zip attachment called or, containing an executable file with the same name. We detect the attached files as Troj/Agent-HPK or Troj/Agent-HPL.


It is likely that this campaign will change once again and there are many other campaigns so please be vigilant about attachments in email.