We recently saw some articles on the Web saying that Slim Shady aka Eminem died in a car crash. Today, we received a spammed message that still claims the rumor is true. The email pretends to be from CBS News informing the recipient of the news about Eminem’s alleged car crash. It also asks if the user wants to see more information about it. A link is provided in the email to show the user the supposed video. Instead of the video, however, the link redirects to a site that downloads an executable file.

Below are screenshots related to this attack.

The .EXE file, of course, turns out to be malicious. It is another member of the infamous and persistent ZBOT family of infostealers, which is detected as TROJ_ZBOT.HBI. The activities of ZBOT malware and the related ZeuS botnet were discussed in a Trend Micro white paper earlier this year. It’s not the first time that spam has been used to spread ZBOT either, as in March this year, two spam campaigns did so. The first campaign used fake notices from the Internal Revenue Service (IRS) while the second used allegedly posted photos.

Trend Micro product users are already protected from this threat via the Smart Protection Network, which blocks the spammed message, the download URL, and the malicious file.

View full post on TrendLabs | Malware Blog – by Trend Micro

• Spammed IM Link to Fake Facebook Image Leads to Malware
  Advanced threats researcher Jonell Baltazar recently spotted an instant message that contains a link to a malicious page. The use of instant messages to spread malware is no longer new; neither...
• Fake Sun MicroSystems Java leads to malware
  Some domain names look legit but aren’t. Such is the case with javasunupdate.info, which does not belong to Sun MicroSystems or Oracle for that matter. Upon browsing that site, you are prompted ...
• Fake Resume Spam Leads to Malware Infection
  We just noticed a new wave of fake resume spam that redirects users to a malicious site. We see the resume pages were uploaded to innocent sites in top-level domains of various countries, perhaps in a...
• Johnny Depp car crash death video leads to malware
  A fake story about Johnny Depp's death in a car crash has been exploited by hackers, who have used it to spread malware. Learn more at www.sophos.com...
• Malware family “Chepvil” leads rogueware “XP Anti-Virus 2011″.
  One after another malware family trying to panic user to install fake security application. Now the Chepvil malware which comes via email as an attachment. The email as shown below: Email Snip The a...
• Fake Certificate in Malware – with Message
  The malware authors every now and then send us virus researchers some messages. For example in the compiled binary itself, or as debug output. Now we found a Zbot Trojan variant which tries to evade d...
• Malware signed with fake Avira Certificate
  While analyzing new malware samples we stumbled over a sample which contains a digital Avira signature. Something we need to check! Viewing the properties of the digital signature, Microsoft Windows s...
• News of AutoRun’s Death Has Been Greatly Exaggerated
  Last week, I applied Microsoft Updates to one my Windows XP test machines and noted an optional update which restricts "AutoRun entries in the AutoPlay dialog to only CD and DVD drives".You ca...
• Spammer’s blunder leads to widespread split personality malware attack
  We're seeing a widespread malware attack in our spam traps this morning - and what's making it unusual is that it appears not to be able to decide what it is. When you first see the subject line, you ...
• Bredolab Malware spammed via fake Facebook Mails
  The popularity of the social network Facebook is abused again to spread Malware via Email. The spam mails arrive with the subject “Facebook password has been changed. ID” and contain a ZI...