Security researchers have identified yet another interesting spam campaignthat exploits the reputation of large foreign financial institutions to distribute malware. The malware, which is a new variant of the Upatre Trojan (TROJ_UPATRE.YYKE), appears as a .MSG attachment embedded within a second .MSG attachment. In this way, cybercriminals try to bypass security defenses.
The second .MSG file in turn contains a ZIP file, which supposedly contains some important update from the bank. When this file is opened on a Windows computer, the Upatre Trojan downloads a variant of the banking malware Ζeus, ΖBot, which aims to steal bank account or card details of users, as well as a variant of NECURS.
NECURS is designed to disable computer security features in order to install backdoors on compromised systems.
