Cybercriminals impersonate UPS, serve malware

Cybercriminals impersonate UPS, serve malware

by | Aug 31, 2012 | Industry Intel, Threat Lab

Reading Time: ~ < 1 min.

Cybercriminals are currently mass mailing millions of emails impersonating the United Parcel Service (UPS) in an attempt to trick users into downloading and executing the malicious file hosted on a compromised web site.

More details:

Sample screenshot of the spamvertised email:

Spamvertised URL: hxxp://buzzstar.co.uk/JUVNEFNQVI.htm

Actual download location of the malicious archive: hxxp://buzzstar.co.uk/Label_Copy_UPS.zip

The malware has a MD5: b702590c01f76f02e2d8d98833d1c95f – detected by 36 out of 42 antivirus scanners as Trojan-Downloader.Win32.Kuluoz.z; TrojanDownloader:Win32/Kuluoz.B

Webroot SecureAnywhere users are proactively protected from this threat.

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on  Twitter.

Blog Staff

About the Author

Blog Staff

The Webroot blog offers expert insights and analysis into the latest cybersecurity trends. Whether you’re a home or business user, we’re dedicated to giving you the awareness and knowledge needed to stay ahead of today’s cyber threats.

3 Comments

  1. Dick H
    Dick H on September 1, 2012 at 2:24 pm

    Thanks for posting the actual malware location. Sure Webroot employees wont click on it in their email?

    • ddanchev
      ddanchev on September 1, 2012 at 2:38 pm

      You’re welcome.

      I sincerely hope they won’t.

      Dancho

  2. Tom P
    Tom P on September 3, 2012 at 8:13 am

    My wife received this hoax email and forwarded it to me to check on it (since we’ve mailed through UPS recently). Luckily, my browser would not let me select the ‘Print Label’ button..warned me that it would attempt to download a suspect or malicious file. Not sure if Webroot was behind the warning..but I was saved.

Trackbacks/Pingbacks

  1. Cybercriminals impersonate UPS, serve client-side exploits and malware « Webroot Threat Blog – Internet Security Threat Updates from Around the World - [...] Cybercriminals impersonate UPS, serve malware [...]
  2. ‘Your UPS Invoice is Ready’ themed emails serve malware « Webroot Threat Blog – Internet Security Threat Updates from Around the World - [...] Cybercriminals impersonate UPS, serve malware [...]
  3. USPS ‘Postal Notification’ themed emails lead to malware « Webroot Threat Blog – Internet Security Threat Updates from Around the World - [...] this campaign? It’s the same cybercriminal/group of cybercriminals that launched the “Cybercriminals impersonate UPS, serve malware” campaign in August,…
Share This