Another Fake IRS Notification

Recently we received the following email:

This is a fake “IRS Notification”. As can be seen from the mail, it asks the user to fill up the following form:

We have been seeing many such fake notification mails containing an attachment like “IRS document.zip”. After analysis we found that it is connecting to random IPs.

Later on, it downloads and installs other malware as well. Quick Heal detects “IRS document.zip” as TrojanDownloader.Deliver.lj.

We recommend that users do not respond to such emails.

Vishal Dodke