We’ve seen the spamming of TROJ_SMALL.EDWand TROJ_STRAT.CJ, now here comes another spammed trojan with an attachment name of “Rechnung.zip”. This incident is similar to an earlier blog post, Bogus 1&1 Bill from Germany.
The executable file in the zip archive has the following properties:
- MD5: 0B9BC464379180B6A813B85D94D21E9D
- File Size: 16,896 bytes
Here are some sample email details:
![](http://extracare.trendmicro-europe.com/tm/core/global/images/diary/184260348236f9554fe9375772ff966e_rechnung.jpg)
![](http://extracare.trendmicro-europe.com/tm/core/global/images/diary/184260348236f9554fe9375772ff966e_rechnung2.jpg)
Trend Micro will soon detect this malware as TROJ_YABE.AV.