Troj/Bredo-ZT

A widespread spam email campaign is responsible for numerous infections with the Troj/Bredo-ZT Trojan. This spam email campaign will usually claim in the subject line that it contains information of a 'Wire Transfer'. It uses spoofed email addresses in order to make the victim believe that this supposed wire transfer is coming from a trusted source, such as LinkedIn or various online services. This message will contain a file attachment that will actually install Troj/Bredo-ZT on the victim's computer system when it is opened. ESG security researchers strongly advise against opening spam attachments and to keep your anti-spam filter fully up-to-date to make sure that these kinds of malicious email messages do not make it into your inbox in the first place.

Troj/Bredo-ZT itself is a downloader Trojan that is designed to infiltrate the victim's computer rapidly after the first contact, install other malware, and then delete itself in order to prevent PC security researchers from analyzing it in order to understand malware attacks better. When the victim opens the file attachment in the malicious email message described above, Troj/Bredo-ZT will be launched automatically. In some cases, an actual document resembling a wire transfer report may be opened in order to distract the victim while Troj/Bredo-ZT does its dirty work in the background. ESG malware researchers have observed the following process in malware very similar to Troj/Bredo-ZT:

1. Troj/Bredo-ZT will establish a backdoor into the victim's computer system. A backdoor is simply an unauthorized hole in the victim's computer's security that can be used to send out and receive data while bypassing the victim's security software. Much like an open physical backdoor can allow a robber to enter and exit a building without being detected, a backdoor in a computer's security allows criminals to gain unauthorized access to the infected computer system.
2. Using the installed backdoor, Troj/Bredo-ZT will connect to a remote server. It will relay basic information on the infected computer system, such as IP address, web browser and operating system version, and then download other malware.
3. Once Troj/Bredo-ZT has downloaded and installed other malware, the Troj/Bredo-ZT will delete all of its files in order to complicate detection and prevention of this malware attack.

SpyHunter Detects & Remove Troj/Bredo-ZT