Eminem Killed by Romanian Malware Gang

Earlier today, BitDefender has detected a new spam wave claiming to originate from one of the most visited portals in the country and informing the recipient about rap star Eminem being shot dead in Detroit.


The unsolicited message also contains a link to an alleged “Full story”, but instead, when clicked, takes the user to a malicious file. In order to trick the user into running it, the downloaded file bears a double extension (jpg.exe) and an icon that resembles a thumbnail of Eminem’s picture. If clicked, the executable file installs a backdoor (identified by BitDefender as Trojan.Zapchast.NBF).

Screenshot of the e-mail including the link to malware

After the backdoor has finished installing, Trojan.Zapchast.NBF pops up a message that announces the user that everything was a hoax and that the controversial rapper is safe and sound. However, the bot remains active and ready to receive commands from its creator.

The bot fires up the mIRC client to establish communication with the attacker

In order to be able to receive and send messages, the bot uses the mIRC application, a typical approach for IRC bots. Overall, this malware campaign is strikingly similar to a previous incident that announced the death of Romanian President Traian Basescu, which we detailed on in late June(Romanian content).

The BiTDefender labs have also identified spam messages that point to the same piece of malware, that has been renamed as lottery.exe and displays the message „Unlucky draw”.

In order to stay safe, we recommend that you  do not download or execute any files that come with junk mail, regardless whether they arrive as attachments or are downloaded when you click an included link.

Note : All product and company names mentioned herein are for identification purposes only and are the property of, and may be trademarks of, their respective owners.

About the author


Bogdan Botezatu is living his second childhood at Bitdefender as senior e-threat analyst. When he is not documenting sophisticated strains of malware or writing removal tools, he teaches extreme sports such as surfing the web without protection or rodeo with wild Trojan horses. He believes that most things in life can be beat with strong heuristics and that antimalware research is like working for a secret agency: you need to stay focused at all times, but you get all the glory when you catch the bad guys.