Zeus: Same Criminal, New Spam Infrastructure

Last week, one of the most long-lived malware spam delivery systems, which the anti-phishing community knew as "Avalanche" went off-line. After sending spam almost non-stop for many months, no spam at all has been received from the "Avalanche" group, which has been used since June to deliver a variety of Zeus or Zbot infectors, including scams pretending to be MySpace, Facebook, the FDIC, the IRS, NACHA, a Microsoft Outlook Update, and other scams.

Last night a new spam campaign began using a new scam to spread malware. A sample of the email looks like this:

We recorded a payment request from "Amy's Kitchen" to enable the charge of $94.71 on your account.

The payment is pending for the moment.

If you made this transaction or if you just authorize this payment, please ignore or remove this email message. The transaction will be shown on your monthly statement as "Amy's Kitchen".

If you didn't make this payment and would like to decline it, please download and install the transaction inspector module (attached to this letter).

The "Transaction Inspector Module" is in a file called "module.zip", which when opened contains a file called "module.exe". That file is a piece of malware called "Sasfis", which is a dropper. A tiny piece of malware which, when launched, causes additional malware to be downloaded as well.

The Sasfis malware is File size: 18944 bytes
MD5 : eec53e2239800e5d85b6b85d5e2451cb

A VirusTotal Report shows that this version of Sasfis is very widely detected.

UAB Malware Analyst Brian Tanner ran the malware in the lab for me. After launching, the malware connects to a Command & Control server which is on the same computer as the NACHA version of Zeus! Nothing happens for the first 45 minutes, then two additional executables are downloaded, one of which is a copy of Zeus that uses the same config file and same update server as the NACHA version of Zeus.

The UAB Spam Data Mine has received many thousand copies of the new spam campaign, with 536 unique company names used in the subject and body of the email. Each copy of the spam email has a randomly selected company name, and specifies a random dollar amount for the transaction. Here is the complete list of email Subjects:

payment request from "a21"
payment request from "Aaron Rents"
payment request from "Abbott Laboratories"
payment request from "Abercrombie & Fitch"
payment request from "ABM Industries"
payment request from "ABX Air, Inc."
payment request from "ACCO Brands"
payment request from "Ace Hardware"
payment request from "Acme Brick Company"
payment request from "Acme Markets"
payment request from "ACN Inc."
payment request from "Activision Blizzard"
payment request from "Acuity Brands"
payment request from "ADC Telecommunications"
payment request from "Adobe Systems Inc."
payment request from "Advance Auto Parts"
payment request from "Advanced Processing & Imaging"
payment request from "AES"
payment request from "Aetna"
payment request from "Affiliated Computer Services"
payment request from "AFLAC"
payment request from "AGCO"
payment request from "Agilent Technologies"
payment request from "AGL Resources"
payment request from "Air Products & Chemicals"
payment request from "Airgas"
payment request from "AirTran Holdings"
payment request from "AK Steel Holding"
payment request from "Alaska Air Group"
payment request from "Albemarle"
payment request from "Albertsons"
payment request from "Alcoa"
payment request from "Aleris International"
payment request from "Alexander & Baldwin"
payment request from "Allegheny Energy"
payment request from "Allegheny Technologies"
payment request from "Allen Organ"
payment request from "Allergan"
payment request from "Alliant Energy"
payment request from "Alliant Techsystems"
payment request from "Allstate"
payment request from "Amazon.com"
payment request from "AMC Entertainment"
payment request from "AMD"
payment request from "Ameren"
payment request from "America Online"
payment request from "American Airlines"
payment request from "American Apparel"
payment request from "American Axle & Manufacturing"
payment request from "American Broadcasting Company"
payment request from "American Eagle Outfitters"
payment request from "American Electric Power"
payment request from "American Express"
payment request from "American Family Insurance Group"
payment request from "American Financial Group"
payment request from "American Greetings"
payment request from "American Hofmann"
payment request from "American Home Mortgage"
payment request from "American International Group"
payment request from "American Reprographics Company"
payment request from "AmeriCredit"
payment request from "Amerigroup"
payment request from "Ameriprise Financial"
payment request from "AmerisourceBergen"
payment request from "Ametek"
payment request from "Amgen"
payment request from "Amiga"
payment request from "Amkor Technology"
payment request from "Amphenol Corporation"
payment request from "AMR"
payment request from "Amtrak"
payment request from "Amy"s Kitchen"
payment request from "Anadarko Petroleum"
payment request from "Analog Devices"
payment request from "AnaSpec"
payment request from "Anchor Bay Entertainment"
payment request from "AND1"
payment request from "Anixter International"
payment request from "Ann Taylor"
payment request from "Aon"
payment request from "Apache Software Foundation"
payment request from "Apollo Group"
payment request from "Apple Inc."
payment request from "Applebee's"
payment request from "Applied Biosystems"
payment request from "Applied Industrial Technologies"
payment request from "Applied Materials"
payment request from "Aramark"
payment request from "Arbitron"
payment request from "Arch Coal"
payment request from "Archer Daniels Midland"
payment request from "Arctic Cat"
payment request from "Ariba"
payment request from "Armstrong World Industries"
payment request from "Arrow Electronics"
payment request from "Arryx"
payment request from "ArvinMeritor"
payment request from "ASARCO"
payment request from "Asbury Automotive Group"
payment request from "Ashland, Inc."
payment request from "AskMeNow"
payment request from "Aspyr Media Inc."
payment request from "Assurant"
payment request from "AT&T"
payment request from "Atari"
payment request from "Atmos Energy"
payment request from "Autodesk"
payment request from "Autoliv"
payment request from "Automatic Data Processing"
payment request from "AutoNation"
payment request from "Auto-Owners Insurance"
payment request from "Autozone"
payment request from "Avaya"
payment request from "Avery Dennison"
payment request from "Avis Budget Group"
payment request from "Avnet"
payment request from "Avon Products"
payment request from "AVST"
payment request from "Babcock & Wilcox"
payment request from "Baker Hughes"
payment request from "Baldor Electric"
payment request from "Ball"
payment request from "Bank of America Corp."
payment request from "Bank of New York Mellon Corp."
payment request from "Barnes & Noble"
payment request from "Bath & Body Works"
payment request from "Baxter International"
payment request from "BB&T Corp."
payment request from "BE Aerospace"
payment request from "Beaner"s Gourmet Coffee"
payment request from "BearingPoint"
payment request from "Beazer Homes USA"
payment request from "Bechtel Corporation"
payment request from "Beckman Coulter"
payment request from "Becton Dickinson"
payment request from "Bed Bath & Beyond"
payment request from "Belden"
payment request from "Belk"
payment request from "Belkin"
payment request from "Bemis"
payment request from "Benchmark Electronics"
payment request from "Berkshire Hathaway"
payment request from "Berry Plastics"
payment request from "Best Buy"
payment request from "Big Lots"
payment request from "Binney & Smith"
payment request from "Biogen Idec"
payment request from "Biomet"
payment request from "Bio-Rad Laboratories"
payment request from "Birdwell"
payment request from "BJ Services"
payment request from "BJ"s Wholesale Club"
payment request from "Black & Decker"
payment request from "BlackRock"
payment request from "Blockbuster Video"
payment request from "BlueLinx Holdings"
payment request from "BMC Software"
payment request from "Bob Evans Farms"
payment request from "Boeing"
payment request from "Boise"
payment request from "Borders Group"
payment request from "BorgWarner"
payment request from "Bosch Brewing Company"
payment request from "Boston Scientific"
payment request from "Boyd Gaming"
payment request from "Bradley Pharmaceuticals"
payment request from "Briggs & Stratton"
payment request from "Brightpoint"
payment request from "Brinker International"
payment request from "Brinks"
payment request from "Bristol-Myers Squibb"
payment request from "Broadcom"
payment request from "Broadridge Financial Solutions"
payment request from "Brookdale Senior Living"
payment request from "Brown-Forman"
payment request from "Brunswick Corporation"
payment request from "Bucyrus International"
payment request from "Burger King Holdings"
payment request from "Burlington Coat Factory"
payment request from "Burlington Northern Santa Fe"
payment request from "C.H. Robinson Worldwide"
payment request from "CA, Inc."
payment request from "Calpine"
payment request from "Capital One"
payment request from "Cartoon Network Studios"
payment request from "Caterpillar Inc."
payment request from "CBS Corporation"
payment request from "Cerner Corporation"
payment request from "Chem-Dry"
payment request from "Chevron"
payment request from "Chicago Bridge & Iron Company"
payment request from "Chrysler"
payment request from "CIGNA"
payment request from "Cisco Systems, Inc."
payment request from "Citigroup"
payment request from "Citrix"
payment request from "CKE Restaurants"
payment request from "Clear Channel Communications"
payment request from "CNA"
payment request from "CNET"
payment request from "Cognizant Technology Solutions"
payment request from "Colgate-Palmolive"
payment request from "Colt Defense"
payment request from "Colt"s Manufacturing Company"
payment request from "Columbia Pictures"
payment request from "Comcast"
payment request from "Comodo"
payment request from "ConocoPhillips"
payment request from "Conseco"
payment request from "Continental Airlines"
payment request from "Control Data Corporation"
payment request from "Convergys Corp."
payment request from "Converse"
payment request from "Corning Incorporated"
payment request from "Costco"
payment request from "Coventry Health Care"
payment request from "Crazy Eddie"
payment request from "Crowley Maritime Corporation"
payment request from "CVS Pharmacy"
payment request from "Danaher"
payment request from "Darden Restaurants"
payment request from "DaVita"
payment request from "Dean Foods"
payment request from "Deere & Company"
payment request from "Del Monte Foods"
payment request from "Dell, Inc."
payment request from "Delphi"
payment request from "Delta Air Lines"
payment request from "Dereon"
payment request from "Devon Energy"
payment request from "Dexrex"
payment request from "DiC Entertainment"
payment request from "Dick"s Sporting Goods"
payment request from "Diebold"
payment request from "Digi-Key"
payment request from "Dillard's"
payment request from "DineEquity"
payment request from "DirecTV Group"
payment request from "Discovery Communications"
payment request from "DISH Network"
payment request from "Doculabs"
payment request from "Dole Foods"
payment request from "Dollar General"
payment request from "Dollar Tree"
payment request from "Dominion Resources"
payment request from "Domtar"
payment request from "Donaldson"
payment request from "Dover"
payment request from "Dow Jones & Company"
payment request from "Dr Pepper Snapple Group"
payment request from "Dresser Inc."
payment request from "DRS Technologies"
payment request from "DST Systems"
payment request from "DTE Energy"
payment request from "Duke Energy"
payment request from "Dun & Bradstreet"
payment request from "DuPont"
payment request from "DynCorp International"
payment request from "Dynegy"
payment request from "Eastman Chemical Company"
payment request from "Eastman Kodak"
payment request from "eBay"
payment request from "Ecolab"
payment request from "El Paso Corp."
payment request from "Electric Boat"
payment request from "Electronic Data Systems"
payment request from "Eli Lilly and Company"
payment request from "EMC Corporation"
payment request from "Emcor Group"
payment request from "Emerson Electric Company"
payment request from "Energy East"
payment request from "Entergy"
payment request from "Enterprise GP Holdings"
payment request from "Equifax"
payment request from "Erie Insurance Group"
payment request from "Exelon Corporation"
payment request from "Expeditors International"
payment request from "Express Scripts Incorporated"
payment request from "ExxonMobil"
payment request from "Federal Home Loan Mortgage Corporation"
payment request from "Federal National Mortgage Association"
payment request from "FedEx"
payment request from "Fidelity Investments"
payment request from "FileMaker Inc., formerly Claris Corp."
payment request from "Ford Motor Company"
payment request from "Forum Communications"
payment request from "Fox Film Corporation"
payment request from "FreeWave Technologies, Inc."
payment request from "Frontier Airlines"
payment request from "Gartner"
payment request from "Gateway Computers"
payment request from "Gatorade"
payment request from "General Dynamics"
payment request from "General Electric"
payment request from "General Mills"
payment request from "General Motors"
payment request from "Gentiva Health Services"
payment request from "Georgia Pacific"
payment request from "Giant Food"
payment request from "Global Insight"
payment request from "Go Daddy"
payment request from "Goldman Sachs"
payment request from "Goodyear Tire and Rubber Company"
payment request from "Google"
payment request from "H&R Block"
payment request from "H. J. Heinz Company"
payment request from "Haley Builders"
payment request from "Halliburton"
payment request from "Hallmark Cards"
payment request from "Hardee's"
payment request from "Harley-Davidson"
payment request from "Hasbro"
payment request from "Hastings Entertainment"
payment request from "Hawaiian Airlines"
payment request from "HCD Surveys"
payment request from "H-E-B"
payment request from "Hewlett-Packard"
payment request from "Hilton Hotels Corporation"
payment request from "Hi-Point Firearms"
payment request from "Home City Ice Co."
payment request from "Home Depot"
payment request from "Honeywell"
payment request from "Hot Topic"
payment request from "Hyland Software"
payment request from "i-flex Solutions"
payment request from "Infor"
payment request from "Informix"
payment request from "Intel"
payment request from "International Business Machines"
payment request from "International Game Technology"
payment request from "International Paper"
payment request from "Interplay Entertainment"
payment request from "Interstate Batteries"
payment request from "Intuit"
payment request from "ION Media Networks"
payment request from "iRobot"
payment request from "J. C. Penny"
payment request from "J. P. Morgan Chase and Co."
payment request from "JetBlue Airways"
payment request from "JN-International Medical Corporation"
payment request from "Johnson & Johnson"
payment request from "Johnson Controls"
payment request from "Jones Soda Co."
payment request from "Journal Communications"
payment request from "KBR"
payment request from "Kellogg Company"
payment request from "Kerr-McGee"
payment request from "Kimberly-Clark"
payment request from "Kmart Corporation"
payment request from "Kohler"
payment request from "KPMG"
payment request from "KPMG Fiduciaire"
payment request from "Kraft Foods"
payment request from "Kroger"
payment request from "Kurzweil Educational Systems"
payment request from "L.L.Bean"
payment request from "Landscape Binders"
payment request from "Laserfiche"
payment request from "LeapFrog Enterprises"
payment request from "Limited Brands"
payment request from "Liz Claiborne"
payment request from "Local Matters"
payment request from "Lockheed Martin"
payment request from "Louisiana Pacific"
payment request from "Lowe's"
payment request from "Lucas Oil"
payment request from "Lucasfilm"
payment request from "Lumencraft"
payment request from "Marathon Oil"
payment request from "Mars Incorporated"
payment request from "Marsh & McLennan"
payment request from "Marshall Pottery Inc."
payment request from "Martha Stewart Living Omnimedia"
payment request from "Martin Marietta Materials"
payment request from "MasterCard"
payment request from "Mattel"
payment request from "McDonald"s Corporation"
payment request from "MCI"
payment request from "Medimix International"
payment request from "Meijer"
payment request from "Merck and Company"
payment request from "Microsoft"
payment request from "Midway Games"
payment request from "Midwest Communications"
payment request from "Miller Brewing"
payment request from "Minnesota IMPLAN Group"
payment request from "Miro Technologies"
payment request from "Monsanto Company"
payment request from "Morgan Stanley"
payment request from "Motorola"
payment request from "Musco Lighting"
payment request from "Mutual of Omaha"
payment request from "Nabisco"
payment request from "Nationwide Insurance"
payment request from "NBC Universal"
payment request from "NCR Corporation"
payment request from "NetApp"
payment request from "NetZero"
payment request from "New Balance"
payment request from "New Era Tickets"
payment request from "News Corporation"
payment request from "Nike"
payment request from "Northrop Grumman"
payment request from "Northwest Airlines"
payment request from "Novell"
payment request from "Novellus Systems"
payment request from "Office Depot"
payment request from "Office Max"
payment request from "Oracle Corporation"
payment request from "PACCAR"
payment request from "Pacific Gas & Electric Company"
payment request from "PalmOne, Inc."
payment request from "PalmSource, Inc."
payment request from "Paramount Pictures"
payment request from "PayPal"
payment request from "PepsiCo"
payment request from "Pfizer"
payment request from "Pinnacle Systems"
payment request from "Pizza Hut"
payment request from "Polaroid Corporation"
payment request from "Precision Castparts Corporation"
payment request from "Price Waterhouse Coopers"
payment request from "Principal Financial Group"
payment request from "Procter & Gamble"
payment request from "Publix"
payment request from "Qualcomm"
payment request from "Quantrix"
payment request from "Quest Software"
payment request from "Quincy Newspapers"
payment request from "Qwest"
payment request from "R. H. Donnelley"
payment request from "R. R. Donnelley & Sons"
payment request from "RadioShack"
payment request from "Raytheon"
payment request from "RCA"
payment request from "Red Hat"
payment request from "Red River Broadcasting"
payment request from "Regis Corporation"
payment request from "Respironics"
payment request from "Rockwell Automation"
payment request from "Rockwell Collins"
payment request from "Russell Investment Group"
payment request from "Russell Stovers"
payment request from "Safeco Corporation"
payment request from "Safeway Inc."
payment request from "Salem Communications"
payment request from "SBC Communications"
payment request from "Science Applications International Corporation"
payment request from "Sears"
payment request from "Sequoia Voting Systems"
payment request from "Service Corporation International"
payment request from "Silicon Graphics"
payment request from "Six Flags"
payment request from "Skype"
payment request from "SkyWest Airlines"
payment request from "Snap-on Tools"
payment request from "Softscape"
payment request from "Sony Pictures Entertainment"
payment request from "Southern California Edison"
payment request from "Southwest Airlines"
payment request from "Spanx"
payment request from "Sprint Nextel Corporation"
payment request from "Staples, Inc."
payment request from "Starbucks"
payment request from "Starz"
payment request from "State Street Corporation"
payment request from "Steinway & Sons"
payment request from "Sterling Commerce"
payment request from "Sterling Ledet & Associates, Inc."
payment request from "Stewart-Warner"
payment request from "STOUT UNIVERSITY FOUNDATION"
payment request from "STX"
payment request from "Subway"
payment request from "Sun Microsystems"
payment request from "Sunny Delight Beverages"
payment request from "Sunoco"
payment request from "Syntel"
payment request from "Target Corporation"
payment request from "Tesla Motors"
payment request from "Texas Instruments"
payment request from "Textron Inc."
payment request from "The Coca-Cola Company"
payment request from "The Dow Chemical Company"
payment request from "The Liberty Corporation"
payment request from "The Ohio State University Medical Center"
payment request from "The Vanguard Group"
payment request from "The Walt Disney Company"
payment request from "The Weinstein Company"
payment request from "TheStreet.com"
payment request from "Time Warner Cable"
payment request from "Towers Perrin"
payment request from "Trinity Industries Inc."
payment request from "U.S. Robotics"
payment request from "Ubu Productions"
payment request from "Union Oil Company of California"
payment request from "Union Pacific Railroad"
payment request from "Unisys"
payment request from "United Airlines"
payment request from "United Parcel Service"
payment request from "United Services Automobile Association"
payment request from "United Technologies"
payment request from "Universal Studios"
payment request from "US Airways"
payment request from "US Cellular"
payment request from "UTStarcom"
payment request from "Valero Energy Corporation"
payment request from "Vectren"
payment request from "Verizon"
payment request from "Verizon Wireless"
payment request from "Viacom"
payment request from "Visa Inc."
payment request from "VIZ Media"
payment request from "Vizio"
payment request from "VMware"
payment request from "Vocera Communications"
payment request from "W.R. Berkley"
payment request from "Walgreens"
payment request from "Walmart"
payment request from "Washington Mutual"
payment request from "Welch's"
payment request from "Wells Fargo Bank, N.A."
payment request from "Wendy"s/Arby"s Group"
payment request from "West Liberty Foods"
payment request from "Westat"
payment request from "Whole Foods Market"
payment request from "Wizards of the Coast"
payment request from "World Financial Group"
payment request from "World Wrestling Entertainment"
payment request from "Xerox"
payment request from "Xilinx"
payment request from "XPLANE"
payment request from "Yahoo!"
payment request from "YRC Worldwide Inc."
payment request from "Yum! Brands, Inc."
payment request from "Zapata"
payment request from "Zappos.com"