Infection: Western Union Money Transfer

"Western Union man
Bad news in his hand
Knocking at my door
Selling me the score.."
~The Five Americans

A new year, and the scum of the net are back with new ways (and old ways) to get into your PC, give up your personal info, etc.

This one came in several emails to our servers randomly taking shots at generated email addresses trying to get us to click on it and download there Trojan into one of our systems.

====================================================
From: westernunionresponse@mail.westernunion.com
Subject: Your Money Transfer Control Number
To: (you)

Dear customer,

Thank you for using the Western Union Money Transfer®.

Your money transfer has been authorized and is now available for pick up by the receiver.

Transfers to certain destinations may be subject to further delay or
additional restrictions.

TRANSACTION DETAILS:

Your Money Transfer Control Number [MTCN] is: 974757614

Please use this number for any inquiries.

Date of Order: Wed, 6 Jan 2010 11:58:48 -0500
Amount Sent: $4931.50

You can cancel this transfer by using the hyperlink below:

link removed

Thank you for using Western Union!
====================================================

After being warned by Thunderbird, Firefox AND Avast! that this was a scam, we wound up at this bogus page (all the images, text, etc stolen from the official Western Union site):



First red flag, the url, its not just "http://www.westernunion.com" it contains additional text (yht5trte.com.pl), the "yht5trte.com" is the domain name its kept on, while the ".pl" is the Internet country code from Poland.

When you click the "Cancel" button it verifies that your email is "active" (so you will get more of these wonderful scams), and then you are requested to download the "form" program to cancel the transaction.

This wonderful file (form.exe) will infect your PC with a Trojan to allow the hacker into your system.

For your reading pleasure, the Internet Country Codes, this is a major giveaway for most of these scams... bogus website.domain.countrycode:

http://www.learnthenet.com/english/html/85tldn.htm