Usually, such spam emails feature “Airmail Tracking number #8154506″ as subject and include the following message:
“Unfortunately we were not able to deliver postal package you sent on August the 1st in time because the recipient’s address is not correct.
Please print out the invoice copy attached and collect the package at our office
Your support invoice number #3521120850144467
AIRMAIL EXPRESS”
Attached to the email there an archived file (#876712.zip) which should include the above-mentioned invoice. Needless to say, it doesn’t. However, the user is not totally at lost, as he stands every chance to gain a brand new Trojan should he open the file.
According to Sophos, the malware has been identified as Troj/FakeAle-GN.