Eminem Killed by Romanian Malware Gang

 

The unsolicited message also contains a link to an alleged “Full story”, but instead, when clicked, takes the user to a malicious file. In order to trick the user into running it, the downloaded file bears a double extension (jpg.exe) and an icon that resembles a thumbnail of Eminem’s picture. If clicked, the executable file installs a backdoor (identified by BitDefender as Trojan.Zapchast.NBF).

Screenshot of the e-mail including the link to malware

After the backdoor has finished installing, Trojan.Zapchast.NBF pops up a message that announces the user that everything was a hoax and that the controversial rapper is safe and sound. However, the bot remains active and ready to receive commands from its creator.

The bot fires up the mIRC client to establish communication with the attacker

In order to be able to receive and send messages, the bot uses the mIRC application, a typical approach for IRC bots. Overall, this malware campaign is strikingly similar to a previous incident that announced the death of Romanian President Traian Basescu, which we detailed on in late June(Romanian content).

The BiTDefender labs have also identified spam messages that point to the same piece of malware, that has been renamed as lottery.exe and displays the message „Unlucky draw”.

In order to stay safe, we recommend that you  do not download or execute any files that come with junk mail, regardless whether they arrive as attachments or are downloaded when you click an included link.

Note : All product and company names mentioned herein are for identification purposes only and are the property of, and may be trademarks of, their respective owners.