Avoid installation of the Adwind through U.S. Department of Treasury email

What is "U.S. Department of Treasury Email Virus"?

Cyber criminals often attempt to trick users into infecting their computers with malware through spam campaigns. They achieve this by sending emails disguised as "important" or "official", and containing a malicious attachment. Their main goal is to trick recipients into opening the malicious file, which then installs malware.

This particular spam campaign is used to distribute a rogue program called Adwind.

This email is disguised as a message from the US Department of Treasury regarding a certain sum of money that was supposedly transferred to the recipient's bank account. It claims that there is no indication that the money was transferred, and encourages the recipient to check some details, which are supposedly provided within the attached file.

In fact, the file ("CONTRACT PAYMENT.zip") attached to this email is used to distribute malware. This archive file contains a .jar file, which, if executed, installs Adwind (also known as AlienSpy, Frutas, JSocket, Sockrat, Unrecom, or jRAT), an information stealer.

This malware is capable of accessing (stealing) saved passwords and logging keystrokes, and also gaining access to the microphone and webcam. Typically, cyber criminals use Adwind and similar programs to steal login credentials, credit card details and other sensitive information.

The details are then misused to steal accounts, identities, make fraudulent purchases and transactions and to generate revenue in other ways.

Users who are tricked into installing Adwind might thus become victims of identity theft, lose access to personal accounts, suffer monetary loss, experience serious problems relating to online privacy, browsing safety, and other issues. Therefore, you are strongly advised to avoid these emails and leave attached files and website links unopened.

Threat Summary:

Name	U.S. Department of Treasury spam
Threat Type	Trojan, password-stealing virus, banking malware, spyware.
Hoax	This email is disguised as a message from the US Department of Treasury.
Attachment(s)	CONTRACT PAYMENT.zip
Detection Names (malicious .jar file)	ESET-NOD32 (A Variant Of Java/TrojanDownloader.Agent.NRG), Ikarus (Win32.Outbreak), Kaspersky (UDS:DangerousObject.Multi.Generic), ZoneAlarm by Check Point (UDS:DangerousObject.Multi.Generic), Full List Of Detections (VirusTotal).
Symptoms	Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Payload	Adwind
Distribution methods	Infected email attachments, malicious online advertisements, social engineering, software 'cracks'.
Damage	Stolen passwords and banking information, identity theft, the victim's computer added to a botnet.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Other examples of spam campaigns that are used to distribute various malware include "Chorus Union Email Virus", "U.S. Small Business Administration" and "Secret Love". Cyber criminals who send these emails seek to trick recipients into installing ransomware, Remote Administration Trojans (RATs) or Trojans.

The main purpose of these programs is to extract data, which can then be misused to generate revenue.

How did "U.S. Department of Treasury Email Virus" infect my computer?

In this case, computers are infected when users extract a malicious .jar file from the "CONTRACT PAYMENT.zip" archive file (its name might vary) and execute it. It is a common practice to spread malware in this way. Some more examples of files that cyber criminals attach to their emails include Microsoft Office documents, PDF documents, executable files (.exe), JavaScript files.

Note that malicious MS Office documents that are opened with newer MS Office versions (later than MS Office 2010) cannot infect computers/install malware without receiving explicit permission to enable editing/content (macros commands). If a malicious document is opened with a version older than MS 2010, however, it infects the system automatically.

How to avoid installation of malware

You are strongly advised not to open attachments or website links within irrelevant emails that were received from unknown/suspicious addresses. Note that these emails are disguised as important and official. Software and files should be downloaded from official websites and through direct links.

Peer-to-Peer networks, unofficial pages, third party downloaders, installers, free file hosting pages and other similar channels are often used to distribute unwanted, malicious software. Installed programs and operating systems must be updated and activated with tools or implemented functions that are provided by official developers.

No third party activation/update tools are trustworthy. Furthermore, it is illegal to activate licensed software with unofficial ('cracking') tools. Keep computers safe by regularly scanning them with reputable anti-spyware or antivirus software, and keep the software up to date.

If you have already opened "U.S. Department of Treasury Email Virus" attachment, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Text presented in the "U.S. Department of Treasury Email Virus" email message:

Subject: U.S. Dept. OF TREASURY/PAYMENT

 

Sir,

 

CONTRACT PAYMENT REF. ATTACHEDM

 

We wish to bring to your knowledge that in the course of our file
verification exercise as directed by the Secretary of Treasury,
we come across a payment file in your name. This file has all the
payment approval documents, especially from the United Nations
Payment Agency as well as other relevant agencies including US
agencies.

 

However, there is no indication that the said approved fund was
finally paid to you as the beneficiary, or did you at any point
changed ownership or receiving bank account of the approved fund?
If not claimed  till May 30th, the , U.S. DEPT. OF TREASURY
anticipated that the funds be distributed as Emergency Relief
Fund to support  the uncertainty caused by the crisis of COVID-19
globaly. It is anticipated that your funds will be distributed in
early June.

 

Then there will be no indication that you receive this payment in
the near future if you fail to respond to this mail and update
this office urgently because others with similar situation are
been processed for transfer of their funds.

 

Faithfully

 

Mr. Wilson Chalker
U.S. DEPT. OF TREASURY

Malicious attachment distributed via "U.S. Department of Treasury Email Virus" spam campaign detection names in Virustotal:

Example of a Department Of Treasury-themed spam email used for phishing purposes:

Text presented within:

Subject: GOODDAY,,

Attention: Sir/Madam,

After our board meeting with United Nation/United State
Government/European Parliament they instructed us to release your
Compensation Fun through or ATM Master Card or Bank to Bank Wire
Transfer immediately you provide your full information listed below.

1) Your Full Name???
2) Your Mobile Number and Fax??
3) Your Home address???
4) Your age and Occupation

I wait for your urgent respond for the claims of your fund.
All legal documents will be release to you before your US$20.5M will
be transfer into your bank account.

Thanks for your maximum co-operation.

Richard Douglas
Department Of Treasury Direct-Account
United Nations Fund's Remittance
Please Reply Here:douglas111richard@hotmail.com

Another example of an email from "U.S. Department Of Treasury" spam campaign:

Text presented within:

Subject: Get back to me

Dear beneficiary,
 
This is Jacob Leibenluft (Chief, Office of Recovery Programs and Counselor of the Treasury) at the U.S. Department of the Treasury. The Office of Recovery programs (ORP) was established barely two years ago to lead the implementation of economic relief and recovery programs. The link below will help shed more light;
 
-
 
The U.S. Treasury Department through the Office of Recovery Programs have facilitated the deployment of capital to ensure all outstanding relief, inheritance and compensation funds are paid to deserving beneficiaries, small businesses and scam victims from previous years. This is to make sure all outstanding funds are paid to respective beneficiaries this fiscal year 2023.
 
As a result of this development, you have been selected alongside a few other beneficiaries to receive a payment of $1,250,000 (One Million Two Hundred and Fifty Thousand Dollars) only. You are required to furnish me with your personal details as requested below to facilitate the processing of your payment;
 
(1) Full Names:
(2) Residential Address:
(3) Date of Birth:
(4) Phone/Cell Number:
(5) Occupation:
 
We demand your utmost cooperation to enable us expedite this payment. It is guaranteed that this process would be executed under a legitimate arrangement that would legally protect you from any breach of Law.
 
Get back to me as soon as you can.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is U.S. Department of Treasury spam?
• Types of malicious emails.
• How to spot a malicious email?
• What to do if you fell for an email scam?

Types of malicious emails:

Phishing Emails

Most commonly, cybercriminals use deceptive emails to trick Internet users into giving away their sensitive private information, for example, login information for various online services, email accounts, or online banking information.

Such attacks are called phishing. In a phishing attack, cybercriminals usually send an email message with some popular service logo (for example, Microsoft, DHL, Amazon, Netflix), create urgency (wrong shipping address, expired password, etc.), and place a link which they hope their potential victims will click on.

After clicking the link presented in such email message, victims are redirected to a fake website that looks identical or extremely similar to the original one. Victims are then asked to enter their password, credit card details, or some other information that gets stolen by cybercriminals.

Emails with Malicious Attachments

Another popular attack vector is email spam with malicious attachments that infect users' computers with malware. Malicious attachments usually carry trojans that are capable of stealing passwords, banking information, and other sensitive information.

In such attacks, cybercriminals' main goal is to trick their potential victims into opening an infected email attachment. To achieve this goal, email messages usually talk about recently received invoices, faxes, or voice messages.

If a potential victim falls for the lure and opens the attachment, their computers get infected, and cybercriminals can collect a lot of sensitive information.

While it's a more complicated method to steal personal information (spam filters and antivirus programs usually detect such attempts), if successful, cybercriminals can get a much wider array of data and can collect information for a long period of time.

Sextortion Emails

This is a type of phishing. In this case, users receive an email claiming that a cybercriminal could access the webcam of the potential victim and has a video recording of one's masturbation.

To get rid of the video, victims are asked to pay a ransom (usually using Bitcoin or another cryptocurrency). Nevertheless, all of these claims are false - users who receive such emails should ignore and delete them.

How to spot a malicious email?

While cyber criminals try to make their lure emails look trustworthy, here are some things that you should look for when trying to spot a phishing email:

• Check the sender's ("from") email address: Hover your mouse over the "from" address and check if it's legitimate. For example, if you received an email from Microsoft, be sure to check if the email address is @microsoft.com and not something suspicious like @m1crosoft.com, @microsfot.com, @account-security-noreply.com, etc.
• Check for generic greetings: If the greeting in the email is "Dear user", "Dear @youremail.com", "Dear valued customer", this should raise suspiciousness. Most commonly, companies call you by your name. Lack of this information could signal a phishing attempt.
• Check the links in the email: Hover your mouse over the link presented in the email, if the link that appears seems suspicious, don't click it. For example, if you received an email from Microsoft and the link in the email shows that it will go to firebasestorage.googleapis.com/v0... you shouldn't trust it. It's best not to click any links in the emails but to visit the company website that sent you the email in the first place.
• Don't blindly trust email attachments: Most commonly, legitimate companies will ask you to log in to their website and to view any documents there; if you received an email with an attachment, it's a good idea to scan it with an antivirus application. Infected email attachments are a common attack vector used by cybercriminals.

To minimise the risk of opening phishing and malicious emails we recommend using Combo Cleaner Antivirus for Windows. 

Example of a spam email:

What to do if you fell for an email scam?

• If you clicked on a link in a phishing email and entered your password - be sure to change your password as soon as possible. Usually, cybercriminals collect stolen credentials and then sell them to other groups that use them for malicious purposes. If you change your password in a timely manner, there's a chance that criminals won't have enough time to do any damage.
• If you entered your credit card information - contact your bank as soon as possible and explain the situation. There's a good chance that you will need to cancel your compromised credit card and get a new one.
• If you see any signs of identity theft - you should immediately contact the Federal Trade Commission. This institution will collect information about your situation and create a personal recovery plan.
• If you opened a malicious attachment - your computer is probably infected, you should scan it with a reputable antivirus application. For this purpose, we recommend using Combo Cleaner Antivirus for Windows.
• Help other Internet users - report phishing emails to Anti-Phishing Working Group, FBI’s Internet Crime Complaint Center, National Fraud Information Center and U.S. Department of Justice.

▼ Show Discussion