Contributor: Joseph Graziano
A new clever way of social engineering spam is going around today that is attempts to trick users into running malware on their computers. The methods malware authors are using include pretending to be from various antivirus (AV) companies with an important system update required to be installed by the end user, along with attaching a fake hotfix patch file for your antivirus software. The email plays on end user concern over the lack of detection, especially in the face of the latest threats showcased in the media recently, such as the Cryptolocker Trojan. This type of social engineering entices users to open and install the hotfix without using much discretion as to what they may be actually installing.
Symantec has observed a number of different email subject lines that include many well-known antivirus companies:
- AntiVir Desktop: Important System Update – requires immediate action
- Avast Antivirus: Important System Update – requires immediate action
- AVG Anti-Virus Free Edition: Important System Update – requires immediate action
- Avira Desktop: Important System Update – requires immediate action
- Baidu Antivirus: Important System Update – requires immediate action
- Cloud Antivirus Firewall: Important System Update – requires immediate action
- ESET NOD32 Antivirus: Important System Update – requires immediate action
- Kaspersky Anti-Virus: Important System Update – requires immediate action
- McAfee Personal Firewall: Important System Update – requires immediate action
- Norton AntiVirus: Important System Update – requires immediate action
- Norton Internet Security: Important System Update – requires immediate action
- Norton 360: Important System Update – requires immediate action
- Symantec Endpoint Protection: Important System Update – requires immediate action
- Trend Micro Titanium Internet Security: Important System Update – requires immediate action
Although the subject line changes, the attached zip file containing the malicious executable stays the same.
Once the malware is executed, a connection is made to [http://]networksecurityx.hopto.org to download another file. The malware is using a process called ozybe.exe to perform tasks.
Symantec has the following protections in place for this threat:
- Symantec.cloud Skeptic scanner
- Symantec antivirus
- Trojan.Gen
- Trojan.Zbot
Symantec advises following best practices to avoid becoming a victim of social engineering spam attacks:
- Do not click on suspicious links in email messages.
- Do not open any attachments from recipients you do not know.
- Do not provide any personal information when replying an email.
- Use comprehensive security software, such as Norton Internet Security or Norton 360, which protects you from phishing and social networking scams.
- Exercise caution when clicking on enticing links sent through email or posted on social networks.