WhatsApp-themed spam campaign delivers malware

A new WhatsApp-themed spam campaign has been spotted targeting users of the popular IM service.

The spam email claims to be a notification about a voice message someone left for the recipient:

“The e-mail looks legit, and even the link is formed to make it look like a voicemail link with the little ‘/play’ ending,” points out SANS ISC CTO Johannes Ullrich.

But the thing that fascinated him the most is that the executable offered for download is adjusted to show a phone number that matches the location of the IP address from which the e-mail is downloaded from.

For example, downloading it from a computer located in his home got him VoiceMail_Jacksonville_(904)458abcd.exe, and from a server in Wayne, Pennsylvania resulted in VoiceMail_Wayne_(610)458abcd.exe (the last four digits have been obfuscated).

The file contains a spyware variant that is currently detected by only 8 out of the 49 AV solutions used by VirusTotal.

Another interesting thing is that, once run, the malware triggers Windows’ Notepad and the text file contains the following notification: “Unknown ERROR! Please wait and try again later”

This is likely done to make users believe that the file they’ve tried to open is corrupted and can’t be opened, and to prevent them to become suspicious and search for covertly installed malware.