[email protected] zar3.rtf Trojan.Downloader.Upatre

Trojan.Downloader.Upatre Email Campaign
Reported by neonprimetime security
http://neonprimetime.blogspot.com

*****
Match:  Trojan.Downloader.Upatre
*****
From: [email protected]
Subject: All American C&E/ Nardin
Attachment(s):	<Random Characters>.zip
Body:
   Your completed calcs are attached.
   The first attachment is your Manual J&S Load calcs.
   The second is your Form 405-10 Energy code compliance calc.
   If you have any questions, feel free to call.

  Thank you so much for your business!


  Ed Wolfe- Office Manager
  Energycalcs.net, Inc
  Phone: (386) 775-0908
  Fax: (888) 262-5406
*****

Urls:
  hxxp://checkip.dyndns.org
  hxxp://199.16.199.3/zar3.rtf
  hxxp://eltubazopanama.com/zar3.rtf
  hxxp://encontrohuambo.com/css/zar3.rtf
*****
Files:
  <Random Characters>.zip
  /src/<7 digit #>/xtract/iDocs.exe
  /zar3.rtf
  /css/zar3.rtf