“You have received an eCard” (Virus) - SPAM

We have been receiving lots of spam in June with the age-old, eCard social engineering hook. The messages show up with these subject headers:

“You have received an eCard”
“You have received a greeting ecard”
“You Have Received a Greeting Card”

The bodies are all very simple, one piggybacking on the trusted name ‘123greetings.com’ while the others being more simple instructing the recipient to open the eCard to view. All traced malware variants are related to the ZBot family, or W32/Branvine.A!tr.dldr. The latter downloads Privacy Center (detected by Fortinet as W32/PCenter.A!tr), yet another fake security software (scareware) suite. We first discussed Scareware at the height of its entry surge in September 2008. Ten months later, the spam campaigns still roll in. The campaign used two different attack methods with similar templates, one being the traditional attachment and the other malicious links: more >>