After a long hiatus, spammers are once again using an old trick, where they attach a .zip file to trick the user into executing the compressed malware. The chart below shows the number of spam messages with .zip attachments over the last 90 days in Symantec’s Global Intelligence Network (GIN).
Figure 1. Spam messages with .zip attachments over the last 90 days
On January 7, 99.81 percent of the .zip attachment spam that came into Symantec’s GIN had the file name “BankDocs-” followed by 10 hexadecimal characters.
Figure 2. Email with “BankDocs-” .zip attachment
On January 8, 99.34 percent of the .zip attachment spam seen in Symantec’s GIN had a file name “Invoice-E_” followed by 10 hexadecimal characters.
Figure 3. Email with “Invoice-E_” .zip attachment
On January 9, 98.94 percent of the .zip attachment spam seen in Symantec’s GIN had a file name “Early2013TaxReturnReport_” followed by 10 hexadecimal characters.
Figure 4. Email with “Early2013TaxReturnReport_” .zip attachment
On January 10, 98.84 percent of the .zip attachment spam seen in Symantec’s GIN had a file name “[BRAND NAME REDACTED]_December_2013_” followed by 10 hexadecimal characters.
Figure 5. Email with “[BRAND NAME REDACTED]_December_2013_” .zip attachment
While these examples have different file names and MD5s, they all carry the same malware, identified by Symantec as Trojan.Zbot. This Trojan has primarily been designed to steal confidential information from the compromised computer.
It appears that the large attack has subsided for now, as the spam volume returned to normal levels after January 10, but it is just a matter of time before spammers organize another large campaign. Users should keep their antivirus software up-to-date and should not open attachments from unknown sources.