Saddam spam hides Trojan malware

The promise of execution footage hides a nasty Trojan payload

Security firms are warning that Trojan malware installers are being placed inside emails claiming to offer videos of the hanging of former Iraqi leader Saddam Hussein.
Symantec and F-Secure have issued warnings to users that emails are being sent out which advertise video footage of the execution. The user is then prompted to install a .exe or .scr file which contains the malware. 

An email obtained by Symantec contained a photo of the execution and advertised the complete video.

When users clicked on the link, they were sent to a site hosting a file called 'video_sadan.exe' which in turn attempted to download a piece of malware called 'infostealer.bancos'.

F-Secure reported a similar series of attacks, which used email attachments instead of links.

When the attachments were launched, a Portuguese-language YouTube page displaying search results for 'execution' was displayed while the attachments attempted to download and install malware on the users' systems.

F-Secure added that two of the attachments appeared as .exe files, while the third was listed as a .scr screen-saver file.

Symantec advised users not to open any attachments about the Saddam Hussein execution.

"Beware, you morbid types," the company warned. "In this case, [the Trojan] is trying to appeal to the dark side of the individuals who are on the receiving end of the email."