Warning! Fake United Parcel Service “Failed Delivery” Notifications Spreading Troj/Agent-KBE

Cyber criminals are successfully bombarding our inboxes with various fake delivery notifications and infecting systems with malware or stealing personal as well as financial information. Last week I informed you about fake Western Union messages, promising refunds of money. This time everybody should watch out for fake messages purportedly coming from 'United Parcel Service of America' and infecting computers with Troj/Agent-KBE.

How does the whole campaign work and what should you pay attention to? Fake 'United Parcel Service of America' delivery notifications are being spammed around the world informing potential victims that their postal packages could not be delivered.

Here is a sample of the fake message belonging to this campaign:

Table 1.  Fake email message

As is the case with a majority of other fake delivery notifications, the number in the subject line is random and may vary with each message.

The message itself does not infect your computer. It comes with an attachment called UPSNR_976120012.zip. The title and number of the attachment may of course vary and change with each fake message. The size of the file is 38167 files and the MD5 reads as f8342178f82f9f637846d2c47bb3b2ff. However, everybody should remember that as soon as they download this file into their computers, their system will be infected with a malicious Trojan horse called Troj/Agent-KBE.

The following table gives you other possible names of the Trojan spread via these fake messages:

Table 2.  Alias names of Troj/Agent-KBE

Therefore, be careful and do not download any similar files that actually aim to infect your computer. Delete these emails claiming to be from United Parcel Service prior to opening them. Use your common sense - if you didn't even try send a package how can a failed delivery notification come into your inbox... If you have any doubts, contact United Parcel Service directly. And, of course, don't forget to use appropriate anti-virus software and updated anti-spam filters.