Zeus Botnet Attacks via FedEx Scam
- Tuesday, August 31, 2010, 17:18
- Threat Research
Yesterday we discovered a new Zeus campaign.
Most of the messages associated with the new spam campaign are linked to the Asprox botnet. This time, the focus is on FedEx. Most of the attachments start with either FedExDoc.exe or FedExInvoice.exe. Those attachments are recognized as the Bredolab Trojan, which will download the Zeus component.
This Zeus variant has a control host on hxxp://x5vsm5.ru, but also downloads from hxxp://trachsel.biz.
The targets of these samples are a large number of banks outside the United States. We still see common U.S. targets…
Citibank
Comerica
USBank
WellsFargo
and also some banks from Europe, the Middle East, Asia, and South America…
Neue Bank (Liechtenstein)
Arab Bank
MyBank (Taiwan)
BHI Bank (United Kingdom)
NPBS (United Kingdom)
Banco de Sabadell (Spain)
as well as several other banks.
Watch out for Zeus’ going global.