Sneaky Worldpay CARD transaction Confirmations Spreading the Infectious Mal/WaledPak-A!

Go to your email account and check your inbox. Do you see anything in it with the subject line "Worldpay CARD transaction Confirmation"? If no, you're the lucky one. If the answer is yes, be extremely cautious when dealing with it. Don't believe in everything this email says and more importantly, don't open any attachments that are, most probably, provided in the archived ZIP file. Two months ago I warned you against a new Worldpay spam campaign spreading the Zbot banking Trojan. Today I'm telling you to watch out for a new round of Worldpay spam, infecting your system with Mal/WaledPak-A.

The From address doesn't actually belong to WorldPay, it is probably randomly spoofed. The message itself informs a recipient that his/her transaction has been processed and the invoice is attached below. Here's how the whole message reads:

Table 1.  Text of the spam email

As I've already mentioned, there's a compressed Worldpay_NR9712.zip file attached to the email. It is likely that both the name of the file and its size may vary. According to the cyber criminals this is a .doc file. However, don't believe that and don't open this attachment. It is actually an executable file that will infect your system with malware.

Mal/WaledPak-A is a worm created by cyber criminals for the Windows platform. This malware includes functionality to access the internet and communicate with a remote server via HTTP. It can also send itself out using built-in SMTP client. Below you will find several possible alias names of Mal/WaledPak-A:

Table 2.  Alias names

Once more everybody is warned to look with suspicion at any unsolicited emails with instructions that recipients are urged to follow. The best solution in this situation would be to delete any similar looking emails, without reading them. If you have really ordered something from Amazon and paid via Worldpay and received an email from any of these companies, you should use your common sense and be 100% sure of its legitimacy before clicking on any of the provided links or attached files. Of course, you should also not forget to keep anti-spam filters and anti-virus software up-to-date.