Sly Spam Run Targets Hotmail Users

Hotmail users need to be wary about a malicious spam run that specifically targets users of the said webmail.

Senior Security Analyst Rik Ferguson reports that spam messages arrive with text indicating that it has file attachments that are image files with the JPEG format. In truth however, the file names of attachments are actually links that connect to shortened URLs, which in turn connect to malicious URLs.

Connecting to the malicious URLs, which are now blocked, leads to the download of the malicious file fotos.com which is now detected as MAL_BANKER. The said file, in turn, downloads a wide variety of information-stealing malware. The malicious URLs and files are all blocked through the Trend Micro Smart Protection Network.

Quite noteworthy is the fact that the links were crafted to, at first glance, look very similar to how file attachments are displayed in most emails. An envelope-shaped icon is even seen at the side of each of the links, which is typical for file attachments.

However, there are also noticeable differences between such spam email and a legitimate email message, which users must watch out for should they receive a suspicious email message.

Here are a few of the noticeable differences between the spam email and a legitimate one:

• The attachment details are indicated not in the message area, but above it, along with the other fields.
• The number of attached files are supposed to be stated right under the email address in the To: field.
• The size of the attached file is displayed beside the file name.
• The attached images are always displayed at the bottom of the message.

Hotmail users are advised not to click on any of the links contained in messages that do not display the abovementioned details.

We Recieved some spam emails as we see in this pic below :

When we click on the links its open a short-url site that redirect to another site that have the trojan files :

when you click on the links inside the spam email

We download the files and uploaded it to virus total :

Files downloaded from spam email

the result of scanning spam email files at virustotal.com :