Would you apply for this job?

We recently analyzed a sample of Infostealer.Monstres, and our colleague Amado posted an interesting entrywith some details of its actions. As the analysis of this threatcontinued, new details emerged. We've been able to acquire some emailtemplates that the Trojan may use to send targeted spam to individuals,using stolen personal information.

The templates acquired all point to the same position. The job isthat of a 'Transfer Manager' at an investment company. The jobdescription states that the position would entail facilitatingfinancial transactions made by the clients of the investment company.The email looks very realistic and may convince many that it has beensent from Monster.com or Careerbuilder.com.

Here are some of the email templates, using Monster.com as well as Careerbuilder.com as a lure.

The emails sent using the above templates could arrive at users’ mailboxes with the following subject lines:

• %realname%, Monster.com have the new job for you
• Monster.com have the new job for You, %realname%
• %realname%, Monster.com suggests You the new job for you
• Monster.com suggests You the new job for you, %realname%
• %realname%, we have the new job for You
• We have the new job for You, %realname%
• %realname%, we suggest You the new job
• We suggest You the new job, %realname%

The position seems to pay well, doesn't require any prior experience,offers a $500 as sign-on bonus, the ability to work from home, therecruiter advertises a very small amount of work hours, and above all,the job will allow you to develop high self-respect and esteem!

Excellent! Who wouldn't want such a job?

Well, I, for one, wouldn’t. Reading through the rest of theadvertisement you can't help but wonder whether there is somethingdubious going on here.

You're required to have a Bank of America account?

You're required to provide the company with the account details,such as bank address, account holder information and, of course, theaccount number?

The next thing to wonder about is what you'll be required to do onthe job, if your application is approved and all the requestedinformation has been sent to the recruiting company. Well, according tothe posting on the site, you'd be required to use Western Union moneytransferring service to 'facilitate' the financial transaction.

As one would expect, once this MTCN is given to another individual,it can be used to withdraw money from any of the Western Union officesacross the globe. Western Union’s Web site has several advisories forpeople sending transaction details to strangers.

There are several other things about this advertisement which shouldraise flags about its legitimacy, from how money would be transferred,what denominations the transactions have to happen in, to the fact thatthe company’s Web site states that it is located in Russia while thehosting is in Ukraine.

We strongly urge people to refrain from handing out their bank account information to any strangers.

However, the part that is most concerning is this jobadvertisement's connection to Infostealer.Monstres. As pointed out inan earlier entry, the creators of this Trojan have acquired 1.6 millionentries with personal information belonging to several hundred thousandusers. The sheer number of people who could receive such targeted spamis worrisome. We urge readers to limit the information they post on Websites. Also, we’d like to remind everyone to never provide sensitivepersonal details such as bank account information, Social Securitynumbers, etc. to anyone unless their legitimacy has been established.