“WorldPay CARD transaction Confirmation” : Emails Bombarding Inboxes with Malware?!

Received an email with the subject line "WorldPay CARD transaction Confirmation"? Don't believe in everything it says and more importantly, don't open any attachments that are, most probably, provided in the archived ZIP file. This is a new spam campaign, aiming to spread malware, characteristics of which resemble a well known Zbot banking Trojan.

The From address doesn't actually belong to WorldPay, it is probably randomly spoofed. The message itself informs a recipient that his/her transaction has been processed and the invoice is attached below. Here's how the whole message reads:

Table 1.  Text of the spam email

As I've already mentioned, there's a ZIP file attached to the email. It is designed to look like a .doc file; however it is actually an executable file, that drops a Trojan into the recipient's system.

One of the possible names of the attached file is WorldPay_TRANS_8651.exe with the MD5 d4131d5a287bce49ddb3a4f9db7e7dc1 and the file size of 66560 bytes. Of course, as is the case with the majority of other malware, both the name of the file and its size and MD5 may vary.

The threat provided in these emails has the characteristics of a ZBot banking Trojan which can disable firewalls steal both personal and financial information, download additional malware and give a hacker remote access to the compromised system.

Below you can find information with alias names of the Trojan dropped by the WorldPay_TRANS_8651.exe executable file. 

Table 2.  Alias names of the Trojan

Once more everybody is warned to look with suspicion at any unsolicited emails and links that recipients are prompted to follow. The best solution in this situation would be to delete any similar looking emails, without reading them. In the case of you thinking that the received email is not part of spam campaign, you must be 100% sure of its legitimacy before clicking on any of the provided links or attached files. Of course, you should also not forget to keep anti-spam filters and anti-virus software up-to-dated.