Rougeware “Data Recovery” through Fake USPS email

A few days backs I posted a blog regarding fake USPS (United States Postal Service) emails. Today I have once again come across a similar sort of fake email which pretends to be from USPS with the subject: “Your postal label is available.”

The mail states that USPS failed to deliver the product to the mentioned address so you have to personally visit the nearest USPS office to collect the parcel. The required information regarding the parcel is attached with the mail. Allegedly, there were many other examples of such fictitious emails from USPS. Some users may mistakenly view this email as genuine. Indeed, it does look quite authentic.

The attachment contains an executable file which belongs to the TrojanDownloader.Kuluoz family and has a PDF file icon. When anyone mistakenly executes this file, it downloads other malware which may be keyloggers, backdoors or some other Trojans. In my case, it downloaded and installed a rogueware named Data Recovery.

Quick Heal successfully detects and deletes the attached file and the installed rogueware.

Ranjeet Menon