Thank you for your payment nycserv@finance.nyc.gov with zip attachment.

Thank you for your payment nycserv@finance.nyc.gov with zip attachment.

Message Header:

From: {nycserv@finance.nyc.gov}
Subject: Thank you for your payment

Message Body:

This is confirmation that your payment on Wed, 18 Feb 2015 16:31:02 +0000 for 
USD 7900.00 has been
accepted by the NYC Department of Finance. Your Credit Card statement 
will show
an entry from Parking Fines NYCGOV. Please read the attachment and save 
it in case
you have any questions about the items that you have paid.

Name: sol chaimovits

Payment Date: Wed, 18 Feb 2015 16:31:02 +0000

Receipt Number: WWW81733157

Payment Amount: USD 7900.00

Credit Card: Visa

Account ending in: 3501

Your payment was for the following items:

Agency                             Item                              
Amount
------------------------------     --------------------     
---------------
PVO                                1160025162                        
USD 3000.00
PVO                                7247746580                        
USD 4500.00
DOF                                Convenience Fee                    
USD 400.00

Thank you for using New York City's website to process your payment.
Please do not reply to this email.  You may contact us by visiting
http://nycserv.nyc.gov/NYCServWeb/ContactUs.html if you have questions
or need further assistance.

Attachment filename:

attachment.zip

Inside the Zip file is a Windows Executable:

attachment.exe

Md5 Hashes:

5c28d3aeabf4685d3652c8864c02c08d  [1] (Zip) 31aae58c4eb6a0c7fe213322a8acd7fc [2] (Exe)

Malware  information:

VirusTotal Report [1] (hits 6/57 Virus Scanners) (Zip) VirusTotal Report [2] (hits 6/57 Virus Scanners) (Exe) Malwr Report [2] (exe) Hybrid Analysis Report [2] (exe)  Detailed Technical Report

Description:

The malware in the zip is a trojan downloader largely referred to as Upatre.  This download will then probably download it's parter in crime Dyre.Dyre, is Zeus-like banking Trojan, which is trying to capture as much information about your online banking details as possible. It's also being used to then send out the same malware to everyone else by using your own copy of outlook and your bandwith... and basically being a costly pain in the rear.

Cheers,

Steve

Sanesecurity.com