Beware of Malicious “Passing of Your Friend” Funeral Notice Email

A fake funeral notice reporting “The passing of your friend” has been spamming email customers this month, infecting many computer with malware.

The fake notice claims to be from Eubank Funeral Home, with a subject of “Passing of your friend.” The message reads:

For this unprecedented event, we offer our deepest prayers of condolence and invite to you to be present at the celebration of your friends life service on Friday, January 31, 2014 that will take place at Eubank Funeral Home at 11:00 a.m.

Please find invitation and more detailed information about the farewell ceremony here.

Best wishes and prayers,

Funeral home receptionist,
Justin Powers

In the email we received, the link to the “invitation” was a zip file hosted at dev.cardiocorefitness.com. Clicking the link will download this zip file to your computer. Opening the zip file will install malicious software onto your computer. We are still determining the effects of this particular malware, although it has been suggested that it is connected to Asprox botnet.

Note that other “receptionist” names used in these emails have included Anthony Ball, Ethan Valencia, Thomas Spears, and Brandon Kelly.

Eubank Funeral Home

The fake email uses the name and color scheme of a real funeral home located in Canton, Texas. This company has been flooded with inquiries about the fake email above, and have posted a notice on their website about it:

Urgent Warning: An Email Has Been Sent Out Appearing To Come From Eubank Funeral Home. Please Do Not Open The Link As It Is SPAM And May Contain MALWARE. We Apologize For The Inconvenience. PLEASE DO NOT CALL US TO REPORT THIS. Thank You.

If you receive the fake funeral invitation, you are best advised to delete it immediately, and do not click or download the file included with it.

If you already opened the attached zip file, you should run security software designed to remove malware.

Have you seen the fake funeral notice? Let us know if you have spotted any variations, or what happened if you inadvertently opened the zip file.

Variants

In March 2014, we are receiving reports that a variant of the email above claims to be from Douglass Funeral Home. We have also spotted variants claiming to be from Clearwater & Largo Funeral Home as well as Hubbell Funeral Home.