printer friendly version

Romanian scam claims Eminem dead to spread malware

BitDefender has detected a new spam wave claiming to originate from one of the most visited portals in the country and informing the recipient about rap star Eminem being shot dead in Detroit.

The unsolicited message also contains a link to an alleged ‘Full story’, but instead, when clicked, takes the user to a malicious file. In order to trick the user into running it, the downloaded file bears a double extension (jpg.exe) and an icon that resembles a thumbnail of Eminem’s picture. If clicked, the executable file installs a backdoor (identified by BitDefender as Trojan.Zapchast.NBF).

Screenshot of the e-mail including the link to malware

After the backdoor has finished installing, Trojan.Zapchast.NBF pops up a message that announces the user that everything was a hoax and that the controversial rapper is safe and sound. However, the bot remains active and ready to receive commands from its creator.

The bot fires up the mIRC client to establish communication with the attacker

In order to be able to receive and send messages, the bot uses the mIRC application, a typical approach for IRC bots. Overall, this malware campaign is strikingly similar to a previous incident that announced the death of Romanian President Traian Basescu. BitDefender labs has also identified spam messages that point to the same piece of malware, that has been renamed as lottery.exe and displays the message ‘Unlucky draw’.

In order to stay safe, we recommend that you do not download or execute any files that come with junk mail, regardless whether they arrive as attachments or are downloaded when you click an included link.

Share this article:

Further reading: