There is a new spam bot out there sending a malware link. see screenshot
screenshot of typical spam email
all emails so far appear to originate from a Ukrainian server noc.maximuma.net 91.196.148.8 which may or may not have been hacked, but web searches suggest that lots of spam & malware is being distributed via that server hosting company
So far I have seen several different sites hosting the malware and the senders & recipient email addresses are all random or spoofed
At present antivirus detection is very sporadic but samples have been sent to all known AV companies so I do expect a better detection rate very shortly
The current payload is always order.zip, which when extracted pretends to be order.doc but has a lot of spaces then .exe so simply clicking on it will infect you
It appears to be a downloader or installer for one of the fake Antivirus programs, that currently plague us.
You can see a quick automatic analysis on the Anubis website From previous experience of this sort of malware and the locations it installs itself to , I would not be at all surprised if the malware shown in the Anubis report also installs the TDL4 bootkit
Update: they have changed the email slightly to something that resembles a previous attack attempt and included a “your credit card will be charged with xxxxx $
That always gets the unwary to follow the link, to check if it is their card that has been falsely charged
Revised updated email, showing alleged credit card charge
Results are coming in from many antivirus companies now, saying that it is a version of the spyeyes crimeware toolkit. Spyeyes is well described in this Symantec blog
