http://test.{BLOCKED}rara.com/6gsgXBfC.exe

 Analysis by: Jerowin Santillan

 URL BLOCKING DATE/TIME: 12 Jun 2013 11:45:00 PM GMT-8
 RATING: HIGH
 DOMAIN: impferrara.com
 CATEGORY: Disease Vector
 DESCRIPTION:

TSPY_ZBOT.ADD may be downloaded from this remote site. This ZBOT variant was used in a spam run which takes advantage of the UK Tax Return deadline. The said spam message pretends to come from HM Revenue and Customs in the UK and informs users of a certain VAT return receipt.