New Fake IRS Email Notice Leads to ZBOT

TrendLabs senior advance threat researcher Ivan Macalintal found spammed messages claiming to come from the Internal Revenue Service (IRS). The email message warns recipients of either under-reporting, or not reporting, their incomes in line with the tax season (April). It asks users to click the embedded link to correct the supposed errors.

Once clicked, the URL leads users to download a ZBOT variant detected as TROJ_KRAP.SMDA. Like previously detected  ZBOT variants featured in the following entries, this malware also steals information from users’ systems then sends the stolen data to a remote user:

Bogus IRS W-2 Form Leads to Malware
Social Engineering Watch: Another IRS Scam
Tax Season Is Phishing Season

TROJ_KRAP.SMDA also terminates security-related processes and disables Windows Firewall. For more information on the ZBOT malware and the infamous ZeuS botnet, please refer to Trend Micro’s recently published research paper, “Zeus: A Persistent Criminal Enterprise.”
Trend Micro™ Smart Protection Network™ protects product users from this threat by preventing the spammed messages from even reaching users’ inboxes via the email reputation service. It also blocks access to the malicious sites via the Web reputation service and stops the download and execution of the malicious files via the file reputation service.
Post from: TrendLabs | Malware Blog - by Trend MicroNew Fake IRS (continue reading...)