Contributor: Joseph Graziano
A new clever way of social engineering spam is going around today that attempts to trick users into running malware on their computers. The methods malware authors are using include emails pretending to be from various antivirus software companies with an important system update required to be installed by the end user, along with attaching a fake hotfix patch file for their antivirus software. The email plays on end user concern over the lack of detection, especially in the face of the latest threats showcased in the media recently, such as the Cryptolocker Trojan. This type of social engineering entices users to open and install the hotfix without using much discretion as to what they may be actually installing.
Symantec has observed a number of different email subject lines that include many well-known antivirus software companies:
Although the subject line changes, the attached zip file containing the malicious executable stays the same.
Once the malware is executed, a connection is made to networksecurityx.hopto.org to download another file. The malware is using a process called ozybe.exe to perform tasks.
Protection & best practices
The Skeptic scanner of Symantec Email Security.cloud can block this and similar emails before it can even reach the end user. In addition, Symantec also detect the files associated with this attack using the following signature names:
Symantec advises following best practices to avoid becoming a victim of social engineering spam attacks: