Bogus DHL emails / Angry Birds Star Wars Android apk...
FYI...
Bogus DHL emails serve malware
- http://blog.webroot.com/2012/11/28/b...serve-malware/
Nov 28, 2012 - "From UPS, USPS to DHL, bogus and malicious parcel tracking confirmations are a common social engineering technique often used by cybercriminals to trick users into clicking on malicious links or executing malicious attachments found in the spamvertised emails. Continuing what appears to be a working social engineering tactic, cybercriminals are currently mass mailing bogus DHL ‘Express Delivery Notifications’ in an attempt to trick users into executing the malicious attachment. Once executed, it opens a backdoor on the affected host allowing the cybercriminals behind the campaign complete access to the infected PC...
Sample screenshot of the spamvertised email:
> https://webrootblog.files.wordpress....am_malware.png
Sample detection rate for the malicious attachment: MD5: b0d4dad91f8e56caa184c8ba8850a6bd * ... Trojan-Downloader.Win32.Andromeda.daq.
What’s particularly interesting about this MD5 is that there are files named T-Mobile-Bill.pdf.exe that have also been submitted to VirusTotal, indicating that there’s a -another- T-Mobile themed campaign, that’s currently circulating in the wild. PEiD Signature of the file: BobSoft Mini Delphi -> BoB / BobSoft. It also creates %AllUsersProfile%\svchost.exe on the system, plus a Registry Value – “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] SunJavaUpdateSched = “%AllUsersProfile%\svchost.exe” so that svchost.exe runs every time Windows starts."
* https://www.virustotal.com/file/148a...is/1353774086/
File name: DHL-EXPRESS-DELIVERY-NOTIFICATION.exe
Detection ratio: 34/42
Analysis date: 2012-11-24
___
Fake Angry Birds Star Wars Android SMS Sender
- http://www.gfi.com/blog/the-fail-is-...id-sms-sender/
Nov 28, 2012 - "Back in April, fake copies of Angry Birds Space were in circulation – with the recent release of Angry Birds Star Wars, scammers have caused a great disturbance in the Force, as if millions of phones cried out in terror and were suddenly silenced... Fake apps are once again the order of the day – here’s one our Labs have found and taken a look at, offered up for download from a dedicated website over at
angrybirdsstarwars-android(dot)ru [ 5.9.112.10 - AS24940**]
> http://www.gfi.com/blog/wp-content/u...rsfakeapp1.png
As with so many similar fakeouts, Android owners must download the app from the website then install it on their phone (downloading with anything other than your mobile device – say, a web browser – offers up a .jar file instead)... This one acts like a typical Boxer Android file, sending premium SMS messages before downloading a valid version of the software. All in all, a rather costly mistake given you could pay the one time fee for the legitimate Google Play download and Angry Bird yourself into a (non-scammed) frenzy instead. VirusTotal results can be found here*, and we detect this as Trojan.AndroidOS.Generic.A with VIPRE Mobile.
End-users should always be cautious of websites offering up Android files that aren’t the Google Play store, especially when based around a hot new property or must-have game..."
* https://www.virustotal.com/file/d1eb...is/1354052956/
File name: Angry_Birds_Star_Wars_install.apk
Detection ratio: 7/43
Analysis date: 2012-11-27
** https://www.google.com/safebrowsing/...?site=AS:24940
"... over the past 90 days, 5998 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-11-28, and the last time suspicious content was found was on 2012-11-28... Over the past 90 days, we found 817 site(s)... that appeared to function as intermediaries for the infection of 4963 other site(s)... We found 1714 site(s)... that infected 9332 other site(s)..."
> http://sitevet.com/db/asn/AS24940
Blacklisted URLs: 3081
___
Changelog SPAM / ganadeion .ru
- http://blog.dynamoo.com/2012/11/chan...nadeionru.html
28 Nov 2012 - "This fake changelog spam leads to malware at ganadeion .ru:
Date: Wed, 28 Nov 2012 05:21:35 -0500
From: LinkedIn Password [password @ linkedin .com]
Subject: Re: Changelog as promised (upd.)
Hello,
as prmised updated changelog - View
C. BERGMAN
The malicious payload is at [donotclick]ganadeion .ru:8080/forum/links/column.php hosted on some familiar looking IP addresses that you should block if you can:
202.180.221.186 (GNet, Mongolia)
203.80.16.81 (MYREN, Malaysia)
208.87.243.131 (Psychz Networks, US)"
___
Fake UPS email serves Fake AV
- http://www.gfi.com/blog/festive-ups-...es-up-fake-av/
Nov 28, 2012 - "... seasonal looking fake UPS delivery notification, claiming in broken English that “Your package delivered to the nearest Postal Office. When receiving, please show a mailing receipt. Address of the nearest office you can find on our website”.
> http://www.gfi.com/blog/wp-content/u...xNI1r6pupn.png
Depending on the spam campaign you happen to stumble upon, you’ll most likely be redirected through a collection of websites before arriving at your final destination which in this case happens to be Fake AV – specifically, System Progressive Protection.
> http://www.gfi.com/blog/wp-content/u...upsfakeav2.png
Fake UPS spam is a perennial favourite of Malware pushers... We detect the above as Lookslike.Win32.Winwebsec.p (v)... treat delivery notification emails with the utmost caution. If in doubt, simply visit the website of your chosen parcel delivery service and have fun typing in tracking codes instead. It’s a lot safer."
