Portuguese spam attempts
 

A new Portuguese spam messages attempts to dupe victims into downloading and installing a fake Symantec product. The spam messages were constructed using two images hosted on the popular imageshack.us site.

As usual for spammed links, despite the text shown in the message, the link actually points to a rogue URL, not a Symantec site. In this case it points to malware hosted on a compromised Czech site.

The file is a Trojan, written in Delphi. The file is a downloader Trojan (proactively detected as Mal/DelpDldr-C), that downloads two additional Trojans from the same compromised site. It also displays a fake error message when run.

This is just another illustration of the importance in effective proactive detection. Even if users fall for the social engineering and click on the link in the spam, proactively detecting the downloader and other Trojans used in the attack can significantly reduce the potential impact of the attack on the victim. In this case, to nil.

Sophos confirmed that the first of the downloaded executables (spool.exe) is proactively detected (as Mal/Behav-103). The second file (ashsert.exe) is an installer, which drops a banking Trojan proactively detected as Mal/DelpBanc-A.

Take care guys