Regions Financial - Online Banking Fraud Alert: Zeus Malware

[jcgriff2]

​

I received 3 emails this morning - http://www.regions.com/about_regions/zeus_malware.rf

... and I don't even have an account with them.

The zip attachment that came with each email stated that a browser with Java was needed!

 

[Corrine]

Am I understanding correctly that you don't have an account with them and attempted to open the zip attachment? :shame2:

 

[niemiro]

Reminds me of a text only email stuffed full of spelling and grammatical I got from fedex_tracking@{disposable_address}.com asking me to track my parcel.

Attached was .zip file containing tracking.exe. I didn't open it

Has got to be one of the worst pieces of spam I have ever received.

 

[AceInfinity]

"The zip attachment that came with each email stated that a browser with Java was needed! " - Should be enough to warn lol

Zeus is one monstrous trojan though. The structure of that malicious code is incredibly scary...

 

[Cayden]

"The zip attachment that came with each email stated that a browser with Java was needed! " - Should be enough to warn lol

Zeus is one monstrous trojan though. The structure of that malicious code is incredibly scary...

What do you mean? I'm no coder so I don't see how simple code can 'look scary'.

 

[Corrine]

You see, Cayden, Ace is a coder so he'd understand what the code is doing.

 

[AceInfinity]

"The zip attachment that came with each email stated that a browser with Java was needed! " - Should be enough to warn lol

Zeus is one monstrous trojan though. The structure of that malicious code is incredibly scary...

What do you mean? I'm no coder so I don't see how simple code can 'look scary'.

Zeus is by no means "simple", it almost has enough code to look like it was an encyclopedia. :lol:

 

[jcgriff2]

Am I understanding correctly that you don't have an account with them and attempted to open the zip attachment? :shame2:

Yes, I opened the zip attachment after I grabbed it from the WLM EML folder. I didn't do anything within the email itself.

There was an HTM file inside. That is what they wanted Java for.

I looked at the HTM source for a bit, then got rid of it all.

I didn't save the HTM code for proper analysis. Next time. :)