View Full Version : SPAM frauds, fakes, and other MALWARE deliveries...
AplusWebMaster
2015-07-28, 14:00
FYI...
Fake 'suspicious account activity' SPAM – doc malware
- http://myonlinesecurity.co.uk/important-notice-detecting-suspicious-account-activity-word-doc-malware/
28 July 2015 - "'Important Notice: Detecting suspicious account activity' pretending to come from 'Service Center' with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Subject: Important Notice: Detecting suspicious account activity
Date: Mon, 27 Jul 2015 22:51:16 +0000 (GMT)
From: Service Center <redacted >
Detecting suspicious account activity
<https ://dl.dropboxusercontent .com/s/dr20sz06iuluwtv/Email%20activity.doc?dl=0>
The attachment contain steps to secured your account. If you are viewing
this email on a mobile phone or tablets, please save the document first
and then open it on your PC.
Click Here to download attachment.
<https ://dl.dropboxusercontent .com/s/dr20sz06iuluwtv/Email%20activity.doc?dl=0>
Thanks,
Account Service
If you are unwise enough to follow the links then you will end up with a word doc looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/07/Detecting-suspicious-account-activity_doc.png
DO -NOT- follow their advice/instructions or suggestions to enable content, that will activate the malicious macro inside the document and download and automatically run a file named Account Details.exe which has an icon of an Excel spreadsheet to fool you into thinking it is innocent and infect you.
28 July 2015 : Email activity.doc Current Virus total detections: 21/55*
... Downloads https ://onedrive.live .com/download?resid=9AC15691E4E70C4D!123&authkey=!AL1jJDlqNUg-vAM&ithint=file%2cexe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a5246537429fe24bc1632abb48268543096ae5f8ff0ad451f17cc9199da69161/analysis/1438037595/
** https://www.virustotal.com/en/file/f0a4022497008ac11211a527b6b08eb5712cfe482157d44ba7ac74d505fc5c1c/analysis/1438062482/
___
Fake 'Please Find Attached' SPAM – doc malware
- http://myonlinesecurity.co.uk/please-find-attached-report-form-london-heart-centre-word-doc-malware/
28 July 2015 - "'Please Find Attached – Report form London Heart Centre' pretending to come from lhc.reception@ heart. org.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/07/Please-Find-Attached-Report-form-London-Heart-Centre.png
28 July 2015: calaidzis, hermione.docm - Current Virus total detections: 9/55*
... Downloads what looks like Dridex banking malware from http ://chloedesign .fr/345/wrw.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1d0131590382a18819c4f3b06017696707298275a4a725beaea8b7a25afbef56/analysis/1438067899/
** https://www.virustotal.com/en/file/99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9/analysis/1438068193/
... Behavioural information
TCP connections
93.171.132.5: https://www.virustotal.com/en/ip-address/93.171.132.5/information/
2.18.213.25: https://www.virustotal.com/en/ip-address/2.18.213.25/information/
chloedesign .fr: 85.236.156.24: https://www.virustotal.com/en/ip-address/85.236.156.24/information/
___
Fake 'Air France' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/your-air-france-boarding-documents-on-10jul-word-doc-or-excel-xls-spreadsheet-malware/
28 June 2015 - "'Your Air France boarding documents on 10Jul pretending to come from Air France <cartedembarquement@ airfrance .fr> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/07/Your-Air-France-boarding-documents-on-10Jul.png
28 July 2015: Boarding-documents.docm - Current Virus total detections: 9/55*
... which downloads Dridex banking malware from http ://laperleblanche .fr/345/wrw.exe which is the -same- malware as in today’s earlier malspam run using malicious word docs with macros**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b87c9d1ec244c28fa410ae3c64ab6ca7f191b8a7546ad7ec8e460e857153f167/analysis/1438071620/
** http://myonlinesecurity.co.uk/please-find-attached-report-form-london-heart-centre-word-doc-malware/
laperleblanche .fr: 94.23.1.145: https://www.virustotal.com/en/ip-address/94.23.1.145/information/
- http://blog.dynamoo.com/2015/07/malware-spam-your-air-france-boarding.html
28 June 2015 - "... -same- exact payload as this earlier attack* today..."
* http://blog.dynamoo.com/2015/07/malware-spam-please-find-attached.html
"... phones home to:
93.171.132.5 (PE Kartashev Anton Evgen'evich, Ukraine)
I recommend that you -block- that IP. The malware is the Dridex banking trojan..."
___
Fake 'Invoice notice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-delivery-invoice-notice-receipt-alert-dhl-notice-ups-notification-invoice-information-word-doc-malware/
28 July 2015 - "A series of emails with subjects of: 'Invoice delivery / Invoice notice / Receipt alert / DHL notice / UPS notification / Invoice information' and numerous -other- similar subjects with a malicious word doc attachment is another one from the current bot runs... The email looks like:
You had got the bill !
Delivered at: Tue, 28 Jul 2015 16:15:36 +0500.
Number of sheets: 0.
Mailer ID: 3.
Delivery number: 843.
Kindly be advised that attached is photo-copy of the 1st page alone.
We are going to mail the originals to You at the address indicated already.
-Or-
You have received the bill !
Received at: Tue, 28 Jul 2015 11:43:15 +0000.
Amount of sheets: 9.
Addresser ID: 79187913.
Delivery order: 6199843296.
Kindly be advised that attached is scan-copy of the 1st page alone.
We are going to dispatch the originals to You at the location mentioned earlier.
And multiple similar content. If you are unwise enough to open the attachment then you will end up with a word doc looking like this:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/07/Invoice_number_6199843296.png
DO -NOT- follow their advice/instructions or suggestions to enable content, that will activate the malicious macro inside the document and download and automatically run a file named word.exe which has an icon designed to fool you into thinking it is innocent and infect you. These emails have attachments with names like Invoice_number_6199843296.doc / Order_No._843.doc / Bill_No._95.doc and -multiple- variations of the names and numbers.
28 July 2015 : Invoice_number_6199843296.doc - Current Virus total detections:7/56*
... goes through a convoluted download procedure giving you http ://bvautumncolorrun .com/wp-content/themes/minamaze/lib/extentions/prettyPhoto/images/78672738612836.txt which is a base 64 encoded file that transforms into a password stealer. It also goes to http ://iberianfurniturerental .com/wp-content/plugins/nextgen-gallery/admin/js/Jcrop/css/fafa.txt which automatically downloads http ://umontreal-ca .com/word/word.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/66fef93c2746a3c9ec84cdb76175ef555cfa6495b2c14037f7b18f36e6497575/analysis/1438080189/
** https://www.virustotal.com/en/file/419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea/analysis/1438081346/
bvautumncolorrun .com: 184.168.166.1: https://www.virustotal.com/en/ip-address/184.168.166.1/information/
iberianfurniturerental .com: 173.201.169.1: https://www.virustotal.com/en/ip-address/173.201.169.1/information/
umontreal-ca .com: 89.144.10.200: https://www.virustotal.com/en/ip-address/89.144.10.200/information/
___
Fake 'Voice Message' SPAM – wav malware
- http://myonlinesecurity.co.uk/voice-message-attached-from-08439801260-fake-wav-malware/
28 July 2015 - "'Voice Message Attached from 08439801260' pretending to come from voicemessage@ yourvm .co.uk with a wav (sound file) attachment is another one from the current bot runs... The email looks like:
Time: Jul 28, 2015 3:08:34 PM
Click attachment to listen to Voice Message
28 July 2015: 08439801260_20150725_150834.wav - Current Virus total detections: 2/55*
... Which downloads Dridex banking malware from laurance-primeurs .fr/345/wrw.exe
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/57eea82456dc75a5fc5528d18e235fd3d652703a2bf96585560b025f584bad9b/analysis/1438082138/
laurance-primeurs .fr: 94.23.1.145: https://www.virustotal.com/en/ip-address/94.23.1.145/information/
___
Fake 'Incoming Fax' SPAM - malware
- http://blog.dynamoo.com/2015/07/malware-spam-incoming-fax-internal-only.html
28 July 2015 - "This -fake- fax message leads to malware:
From: Incoming Fax [Incoming.Fax@ victimdomain]
Date: 18 September 2014 at 08:39
Subject: Internal ONLY
**********Important - Internal ONLY**********
File Validity: 28/07/2015
Company : http ://victimdomain
File Format: Microsoft word
Legal Copyright: Microsoft
Original Filename: (#2023171)Renewal Invite Letter sp.doc
********** Confidentiality Notice ********** ...
(#2023171)Renewal Invite Letter sp.exe
Attached is a Word document with a malicious macro. The Hybrid Analysis report shows it downloading components from several locations, but doesn't quite catch the malicious binary being downloaded from:
http ://umontreal-ca .com/word/word.exe ... This has a VirusTotal detection rate of 2/55*.
umontreal-ca .com (89.144.10.200 / ISP4P, Germany) is a -known- bad domain. Other analysis is pending, however the payload is likely to be the Dyre banking trojan.
UPDATE: This Hybrid Analysis report shows traffic to the following IPs:
67.222.202.183 (Huntel.net, US)
195.154.163.4 (Online SAS, France)
192.99.35.126 (OVH, Canada)
95.211.189.208 (Leaseweb, Netherlands)
Recommended blocklist:
89.144.10.200
67.222.202.183
195.154.163.4
192.99.35.126
95.211.189.208 "
* https://www.virustotal.com/en/file/419af0d5a4136749b2be17933355c17ffd568fb07f30a9d19e07144a91b57cea/analysis/1438087963/
___
Fake 'cash prizes for shopping' SPAM – PDF malware
- http://myonlinesecurity.co.uk/get-cash-prizes-for-shopping-fake-pdf-malware/
28 July 2015 - "Another set of emails with subjects including 'Get cash prizes for shopping' and 'Get cash payments for purchasing' with a zip attachment is another one from the current bot runs... The email looks like:
Love purchasing? We have something special for you!
Do you want to get cash compensations on buys you make in your favorite stores? Just get our debit card to make your purchases, and then you will commence enhancing the rewards. Bear in mind only one rule – the more you use it – the more you receive. So kindly check out the applied info to learn how this offer proceeds and how to open your bank account.
It was never so pure, fast and so close to your dreams. Don’t lose your time. Join us, keep to us and shopping will give!
-Or-
Being fond of shopping? We propose something special for you!
Do you want to get cash rewards on purchases you make in your favorite shops? Just use our debit card to make your purchases, and then you will start increasing the remunerations. Bear in mind one rule – the more you use it – the more you get. So please read the enclosed documentations to see how it operates and how to open your account.
It was never so elementary, fast and so close to your dreams. Don’t lose your chance. Join us, stick to us and shopping will pay!
And numerous other similar computer generated text...
28 July 2015: bank_offering_and_card_information.zip: Extracts to: special_offering_and_card_details.scr
Current Virus total detections: 2/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/813aa75ac878b2da882944be368341acdc144bcb365f8820803d1fd9fbdc11dc/analysis/1438090452/
... Behavioural information
TCP connections
216.146.43.70: https://www.virustotal.com/en/ip-address/216.146.43.70/information/
93.185.4.90: https://www.virustotal.com/en/ip-address/93.185.4.90/information/
24.33.131.116: https://www.virustotal.com/en/ip-address/24.33.131.116/information/
95.100.255.176: https://www.virustotal.com/en/ip-address/95.100.255.176/information/
___
Russian Underground - Revamped
- http://blog.trendmicro.com/trendlabs-security-intelligence/the-russian-underground-revamped/
July 28, 2015 - "When big breaches happen and hundreds of millions of credit card numbers and SSNs get stolen, they resurface in other places. The underground now offers a vast landscape of shops, where criminals can buy credit cards and other things at irresistible prices. News and media coverage on significant breaches are increasingly shaping up to becoming an everyday occurrence. 2014 became the “year of the POS breach” for the retailers like Neiman Marcus, Staples, Kmart, and Home Depot. The first part of 2015 has also seen some major breaches within the consumer industry (Chick-fil-A, RyanAir) but also with health insurers (Anthem, Premera). A simple shopping trip to the grocery store (Albertsons or Supervalu) or to Home Depot can prove fatal—paying with debit/credit card has its inherent risks. But what happens with the compromised data and personal information?... right after a significant data breach, the underground experiences an influx of new cards. These stolen credentials surface in places, where they get categorized within databases and sold in a very orderly fashion in underground “marketplaces.” Marketplaces in many ways are what forums used to be: a place of trade, but marketplaces now allow for standardized sales of products and services at a set price that can be bought with a few easy clicks similar to online-shopping. These places often have a professional-looking, user-friendly graphical interface, where the buyer can easily filter the available cards by very specific criteria such as ZIPcode, city, address of the card owner, type of card, etc... several credit cards that can be linked to big, well-known corporations by looking at the (valid) information offered about the card owner, his (corporate) address, zip code, and card number and validity date. What this tells us is that the clever cybercriminal, wanting to operate in a time-efficient manner and maximize his earnings, will make the best use of these new search/filter options offered by marketplaces. He will narrow his search to the big corporations, keep a database with addresses and locations and regularly filter the best marketplaces for the most recent outpour of -fresh- credit card leaks... Many corporations allow their employees to use credit cards for business travels but in the event of a card being stolen, the corporation is affected directly. The benefit these cards render for criminal purposes is obvious: if a corporate card has a transaction limit of, say, US$ 2,000, it can be a gold mine for cybercriminals. Due to hundreds of transactions that are processed, it’s difficult for the corporate card owner to detect and trace back any suspicious movement..."
> https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/russian-underground-automized-infrastructure-services-sophisticated-tools
July 28, 2015
:fear::fear: :mad:
AplusWebMaster
2015-07-29, 14:11
FYI...
Fake 'New mobile banking app' SPAM – PDF malware
- http://myonlinesecurity.co.uk/new-mobile-banking-application-fake-pdf-malware/
29 July 2015 - "Today’s set of Upatre downloaders come with an email subject of 'New mobile banking application / The latest mobile banking application / Renewed mobile banking app' with a zip attachment is another one from the current bot runs... The email looks like:
Dear patron!
We would like to introduce you new mobile banking app for our bank patrons. Our mobile banking options help you to enter your bank account safely anywhere you want. A quick and easy registration is all you need to start using mobile banking options. With mobile banking, you can realize most of all financial operations. Our application is simple to use and highly safe.
To learn more about application features and work, please view the enclosed info. Download link is also included.
-Or-
Dear client!
We would like to introduce you new mobile banking app for our bank customers. Our mobile banking services help you to access your bank account securely anywhere you want. A quick and easy registration is all you need to start using mobile banking options. With mobile banking, you can realize most of all financial procedures. Our application is toiless to use and extremely safe.
To know more about application details and work, please see the attached information. Download link is also inside.
-Or-
Dear patron!
We are glad to present you new mobile banking app for our bank patrons. Our mobile banking accommodations help you to enter your bank account safely any place you want. A quick and simple registration is all you need to begin using mobile banking options. With mobile banking, you can realize most of all bank operations. Our app is toiless to use and very safe.
To know more about application details and functioning, kindly view the affixed document. Download link is also inside.
And numerous very similar computer generated versions of the above.
29 July 2015: id697062389app_features.doc.zip: Extracts to: app_brochure.exe
Current Virus total detections: 0/55*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ea3beef62c94916aef84962ddca1ef01c12783869875cec0498ef4cc27744baa/analysis/1438168067/
... Behavioural information
TCP connections
216.146.38.70: https://www.virustotal.com/en/ip-address/216.146.38.70/information/
93.185.4.90: https://www.virustotal.com/en/ip-address/93.185.4.90/information/
176.36.251.208: https://www.virustotal.com/en/ip-address/176.36.251.208/information/
95.101.72.123: https://www.virustotal.com/en/ip-address/95.101.72.123/information/
___
Fake 'Get our deposit card' SPAM – PDF malware
- http://myonlinesecurity.co.uk/get-our-deposit-card-and-receive-067-fake-pdf-malware/
29 July 2015 - "The latest upatre downloader to hit the presses is an email with a subject of 'Get our deposit card and receive 067' (varying amounts) pretending to come from jesse_rice with a zip attachment is another one from the current bot runs... The email looks like:
Deposit card containing many profitable features is new extraordinary proposal of ours.
One of the great items that will actually intrigue you is the 98 money back pize. When you outlay 300 USD or more within 3,2,5,4,6 months buying by this card, you will earn a 23 award. There is also 5% cash back award function that give you opportunity to take 5% cash back on up to 1500 USD during each three month quarter. It’s not a disposable prize. You will turn on your feature every 3 month quarter without any extra fees! There are a lot of other bonuses that you will have. You can browse them in the applied to learn more about it and find all details. Feel free to to ask if you have any questions.
We sincerely look forward to your response
29 July 2015: 220317964deposit_card_features_details.zip: Extracts to: card_features_details.exe
Current Virus total detections: 0/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1d362c19a4be98d26405f785d86e196b73d474134fd9f3237f18ae2f48d0ad8e/analysis/1438176115/
... Behavioural information
TCP connections
104.238.141.75: https://www.virustotal.com/en/ip-address/104.238.141.75/information/
93.185.4.90: https://www.virustotal.com/en/ip-address/93.185.4.90/information/
69.144.171.44: https://www.virustotal.com/en/ip-address/69.144.171.44/information/
2.20.143.37: https://www.virustotal.com/en/ip-address/2.20.143.37/information/
___
USA TODAY Fantasy Sports... serves Malware
- https://blog.malwarebytes.org/exploits-2/2015/07/usa-today-fantasy-sports-discussion-forum-serves-malware/
July 28, 2015 - "... We routinely detect infections coming from forums during our daily crawl of potentially malicious URLs. One of the reasons for this comes from the underlying infrastructure that powers those sites. Indeed, server side pieces of software such as Apache or vBulletin are often abused by cyber criminals who can easily exploit security holes especially if these applications are not kept up to date. Case in point, the Fantasy Sports discussion forum part of USA TODAY Sports Digital Properties was recently redirecting members towards scam sites and even an exploit kit that served malware. The forum statistics show a total of 117,470 threads, 3,348,218 posts and 18,447 members.
> https://blog.malwarebytes.org/wp-content/uploads/2015/07/graph.png
... domain is involved in multiple nefarious activities via -malvertising- such as -fake- Flash Player applications, tech support scams or exploit kits. In some cases, all of the above combined...
> https://blog.malwarebytes.org/wp-content/uploads/2015/07/scampage.png
Nuclear exploit kit: Probably the worst case scenario is to be -redirected- to an exploit kit page and have your computer infected.
> https://blog.malwarebytes.org/wp-content/uploads/2015/07/Fiddler21.png
In this particular instance, we were served the Nuclear EK, although given the URL pattern it would have been very easy to call this one Angler EK. This change was noted by security researcher @kafeine* about a week ago...
* https://twitter.com/kafeine/status/623564043345858562
Had the exploit been successful, a piece of malware known as Glupteba (VT link**) would have been dropped and executed. Compromised machines are enrolled into a large botnet that can perform many different malicious tasks... We have notified USA Today about this security incident..."
** https://www.virustotal.com/en/file/7b9f9656e3b43e3d49e67c0a6b6685fe488398bc12d2332f6bc39dcd8c1f89d2/analysis/1437954473/
... Behavioural information
TCP connections
195.22.103.43: https://www.virustotal.com/en/ip-address/195.22.103.43/information/
:fear::fear: :mad:
AplusWebMaster
2015-07-30, 13:29
FYI...
Fake 'settlement failure' SPAM – PDF malware
- http://myonlinesecurity.co.uk/calculated-response-settlement-failure-fake-pdf-malware/
30 July 2015 - "Today’s first set of Upatre downloaders come with email subjects that include 'Calculated response settlement failure / Estimated response settlement failure / Estimated response payment default / Calculated invoice payment default' with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/07/Calculated-response-settlement-failure.png
30 July 2015: official_document_copies_id942603754.pdf.zip: Extracts to: public_order_copies.exe
Current Virus total detections: 0/56*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/94616a968c2f3fb4317f6c711823e55d72b2adb863c8378a3742eac96a48e9ad/analysis/1438249041/
___
Fake 'ADP Payroll' SPAM – PDF malware
- http://myonlinesecurity.co.uk/invoice-random-numbers-adp-payroll-services-fake-pdf-malware/
30 July 2015 - "'Invoice #[random numbers]' pretending to come from ADP – Payroll Services <payroll.invoices@ adp .com> with a zip attachment is another one from the current bot runs... The email looks like:
Attached are the latest statements received from your bank.
Please print this label and fill in the requested information. Once you have filled out
all the information on the form please send it to payroll.invoices@adp.com.
For more details please see the attached file.
Please do not reply to this e-mail, it is an unmonitored mailbox!
Thank you ,
Automatic Data Processing, Inc.
1 ADP Boulevard
Roseland
NJ 07068
© Automatic Data Processing, Inc. (ADP®) . All rights reserved...
30 July 2015: ADP_Invoice _0700613.zip : Extracts to: ADP_Invoice.scr
Current Virus total detections: 2/56*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e11575f7d8abee81f345f6a754d0d42b2bf42f6b05b3a9c64b531830b4268d24/analysis/1438267744/
... Behavioural information
TCP connections
104.238.136.31: https://www.virustotal.com/en/ip-address/104.238.136.31/information/
93.185.4.90: https://www.virustotal.com/en/ip-address/93.185.4.90/information/
178.222.250.35: https://www.virustotal.com/en/ip-address/178.222.250.35/information/
2.18.213.56: https://www.virustotal.com/en/ip-address/2.18.213.56/information/
___
Fake 'check returned' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-cheque-has-been-returned-jobs-asia-fake-pdf-malware/
30 July 2015 - "'Your cheque has been returned' pretending to come from jobs-asia with a zip attachment is another one from the current bot runs... The email looks like:
I enclose a check that has been returned unpaid for occasions shown there.
We have written off you with the sum.
If you have any questions, kindly write to us. We’ll endeavor to help you.
Faithfully,
Lloyd Bailey
Service department
30 July 2015: cheque_and_description_i4Aev0CF.zip: Extracts to: cheque_and_explanation.exe
Current Virus total detections: 0/56*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c6f3221a7ff2c76991f3df67530dd2bbf30599df5dfa6e7ef6565658d3d5562c/analysis/1438267061/
... Behavioural information
TCP connections
104.238.141.75: https://www.virustotal.com/en/ip-address/104.238.141.75/information/
93.185.4.90: https://www.virustotal.com/en/ip-address/93.185.4.90/information/
67.221.195.6: https://www.virustotal.com/en/ip-address/67.221.195.6/information/
2.18.213.24: https://www.virustotal.com/en/ip-address/2.18.213.24/information/
___
Fake 'Income tax settlement failure' SPAM – PDF malware
- http://myonlinesecurity.co.uk/income-tax-settlement-failure-sent-id-fake-pdf-malware/
29 July 2015 - "'Income tax settlement failure sent id: [number]' with a zip attachment is another one from the current bot runs... The email looks like:
In accordance with taxing authority information You have defaulted a term to settle the estimated tax sums.
Kindly see attached the official order from the revenue service.
Furthermore please be noted of the fact that additory penalties would be applied unless the debt amounts are not remitted within four working days.
Regard this reminder as highly important.
Rebecca Crouch Tax Department
29 July 2015: public_order_scan713432229.zip: Extracts to: official_order_copies.exe
Current Virus total detections: 3/56*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5ef779a0b20504629fd9f62f931ee2c526258cfb16a814b7e80c708546a62360/analysis/1438208026/
... Behavioural information
TCP connections
104.238.136.31: https://www.virustotal.com/en/ip-address/104.238.136.31/information/
93.185.4.90: https://www.virustotal.com/en/ip-address/93.185.4.90/information/
87.249.142.189: https://www.virustotal.com/en/ip-address/87.249.142.189/information/
88.221.14.145: https://www.virustotal.com/en/ip-address/88.221.14.145/information/
:fear::fear: :mad:
AplusWebMaster
2015-07-31, 14:10
FYI..
Fake 'Chess Bill' SPAM – doc malware
- http://myonlinesecurity.co.uk/your-latest-chess-bill-is-ready-word-doc-malware/
31 July 2015 - "'Your latest Chess Bill Is Ready' pretending to come from CustomerServices@ chesstelecom .com with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Your bill summary
Account number: 24583
Invoice Number: 2398485
Bill date: July 2015
Amount: £17.50
How can I view my bills?
Your Chess bill is ready and waiting for you online. To check out your detailed bill, previous bills and any charges you’ve incurred since your last bill, just sign into My Account www .chesstelecom .com/myaccount ...
31 July 2015 : 2015-07-Bill.docm - Current Virus total detections: 5/56*
Downloads Dridex banking malware from:
http ://laboaudio .com/4tf33w/w4t453.exe
http ://chateau-des-iles .com/4tf33w/w4t453.exe
http ://immobilier-ctoovu .com/4tf33w/w4t453.exe
http ://delthom .eu.com/4tf33w/w4t453.exe
http ://ctoovu .com/4tf33w/w4t453.exe
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b5ee8925742637a8484f6e1cb08a1c989cb4a8f9e66a8179c929dd789c07c06d/analysis/1438334839/
laboaudio .com: 94.23.55.169: https://www.virustotal.com/en/ip-address/94.23.55.169/information/
chateau-des-iles .com: 94.23.1.145: https://www.virustotal.com/en/ip-address/94.23.1.145/information/
immobilier-ctoovu .com: 94.23.55.169
delthom .eu.com: 94.23.1.145
ctoovu .com: 94.23.55.169
___
Apple Care – phish
- http://myonlinesecurity.co.uk/apple-care-phishing/
31 July 2015 - "'Apple Care' pretending to come from Apple <secure@ appletechnicalteam .com> is one of the latest phish attempts to steal your Apple Account and your Bank, credit card and personal details...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/07/Apple-Care.png
... The actual site this sends you to is http ://applesurveillance .com/account/?email=a@a.a which can very easily be mistaken for a genuine Apple site. To make it even worse, the phishers have gone to the effort of setting up the domain properly and are using an email address to send from “Apple <secure@ appletechnicalteam .com> ” which has the correct domainkeys and SPF records so it doesn’t look like spam and will be allowed past most spam filters. They have also set up the applesurveillance .com site so that it appears to a security researcher or investigator that the account has been suspended by the hosting provider, when it actually is -live- when you put any email address into the url:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/verify_apple_ID.png
When you fill in your user name and password you get a page looking very similar to this one ( split into sections), where the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/verify_apple_ID_2.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/verify_apple_ID_3.png
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
:fear::fear: :mad:
AplusWebMaster
2015-08-01, 20:32
FYI...
Countrywide Money Ltd SPAM
- http://blog.dynamoo.com/2015/08/spam-countrywide-money-ltd.html
1 Aug 2015 - "You know things must be desperate when a business turns to spam. Here's a dubious-looking spam that seems to be presenting itself in a way that looks like a get-rich-quick scheme:
From: Countrywide Money [info@ countrywidemoney .co.uk]
Reply-To: Info@ countrywidemoney .co.uk
Date: 1 August 2015 at 05:11
Subject: Extra Income FOR YOU!...
... to Unsubscribe Click Here!
Screenshot: https://1.bp.blogspot.com/-kPwPMrWfdWY/VbyME_KHarI/AAAAAAAAG1s/vylJGTUiyQk/s1600/countrywide.jpg
... the Unsubscibe link doesn't work. Tsk tsk. Now, I'm sure this is a legitimate business offer and not some sort of scam. But all those banknotes and the general pitch seems to suit an operation in Lagos rather than one in the UK... A non-trading individual? Let's look at that web site for a moment:
> https://1.bp.blogspot.com/-nlwptGhT5Bc/VbyOIG-tggI/AAAAAAAAG14/OBaj-o-Sk3w/s1600/countrywide2.jpg
Well, it doesn't look like a personal homepage to me... It turns out that the sole director is one "Tony Edwards"... A little bit more digging at DueDil* shows some equally disappointing looking financials... I'm not sure why this person feels that promoting their business through -spam- is appropriate. I certainly won't be signing up to this scheme."
* https://www.duedil.com/company/08095603/countrywide-money-limited
___
Your Files Are Encrypted with a 'Windows 10 Upgrade'
- http://blogs.cisco.com/security/talos/ctb-locker-win10
July 31, 2015 - 'Update 8/1: To see a video of this -threat- in action click here:
> http://cs.co/ctb-locker-video
Adversaries are always trying to take advantage of current events to lure users into executing their malicious payload. These campaigns are usually focussed around social events and are seen on a constant basis. Today, Talos discovered a -spam- campaign that was taking advantage of a different type of current event. Microsoft released Windows 10 earlier this week (July 29) and it will be available as a free upgrade to users who are currently using Windows 7 or Windows 8. This threat actor is impersonating Microsoft in an attempt to exploit their user base for monetary gain. The fact that users have to virtually wait in line to receive this update, makes them even more likely to fall victim to this campaign:
> https://blogs.cisco.com/wp-content/uploads/win10_blacked_out.png
Email Message: The email message above is a sample of the type of messages that users are being presented with. There are a couple of key indicators in the message worth calling out.
First, the from address, the adversaries are spoofing the email to look like it is coming directly from Microsoft (update<at>microsoft.com). This is a simple step that tries to get users to read further:
> https://blogs.cisco.com/wp-content/uploads/win10_header.png
However, a quick look at the email header reveals that the message actually originated from IP address space allocated to Thailand. Second, the attackers are using a similar color scheme to the one used by Microsoft. Third, there are a couple of red flags associated with the text of the email. As you can see below, there are several characters that don’t parse properly. This could be due to the targeted audience, a demographic using a non-standard character set, or the character set the adversaries were using to craft the email:
> https://blogs.cisco.com/wp-content/uploads/Character_errors.png
... Payload: Once a user moves past the email, downloads the zip file, extracts it, and runs the executable, they are greeted with a message similar to the following:
>> https://blogs.cisco.com/wp-content/uploads/CTB-Locker.png
The payload is CTB-Locker, a ransomware variant. Currently, Talos is detecting the ransomware being delivered to users at a high rate. Whether it is via spam messages or exploit kits, adversaries are dropping a huge amount of different variants of ransomware. The functionality is standard however, using asymmetric encryption that allows the adversaries to encrypt the user’s files without having the decryption key reside on the infected system. Also, by utilizing Tor and Bitcoin they are able to remain anonymous and quickly profit from their malware campaigns with minimal risk...
Conclusion: The threat of ransomware will continue to grow until adversaries find a more effective method of monetizing the machines they compromise. As a defense, users are encouraged to backup their data in accordance with best practices. These backups should be stored offline to prevent them from being targeted by attackers. Adversaries are always looking to leverage current events to get users to install their malicious payloads. This is another example, which highlights the fact that technology upgrades can also be used for malicious purposes..."
:fear::fear: :mad:
AplusWebMaster
2015-08-03, 12:53
FYI...
Bogus Win10 'activators'
- http://net-security.org/malware_news.php?id=3082
03.08.2015 - "... bogus Windows 10 "activators".
* http://www.net-security.org/secworld.php?id=17960
> https://blog.malwarebytes.org/online-security/2015/02/windows-10-activation-programs-pups-and-surveys/
___
Fake 'E-bill' SPAM – doc malware
- http://myonlinesecurity.co.uk/e-bill-6200228913-31-07-2015-0018-word-doc-malware/
3 Aug 2015 - "'E-bill : 6200228913 – 31.07.2015 – 0018' pretending to come from noreply.UK.ebiller@ lyrecobusinessmail .com with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear customer,
Please find enclosed your new Lyreco invoicing document nA^ 6200228913 for a total amount of 43.20 GBP, and due on 31.08.2015
We would like to remind you that all of your invoices are archived electronically free of charge and can be reviewed by you at any time.
For any questions or queries regarding your invoices, please contact Customer Service on Tel : 0845 7676999*.
Your Lyreco Customer Service
*** Please do not reply to the sender of this email...
3 August 2015: 0018_6200228913.docm - Current Virus total detections: 5/55*
Downloads Dridex banking malware from http ://immobilier-roissyenbrie .com/w45r3/8l6mk.exe or http ://scootpassion .com/w45r3/8l6mk.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a9f6427bda1f519341d52b3e02372c2bc2d5d1487fd01b7d831306888bdf98c5/analysis/1438596426/
** https://www.virustotal.com/en/file/b3d9e8cd0f2cebf4920a84156104f6c61748ae897d2fc138a971f25733a75ca6/analysis/1438596617/
immobilier-roissyenbrie .com: 94.23.55.169: https://www.virustotal.com/en/ip-address/94.23.55.169/information/
scootpassion .com: 37.0.72.24: https://www.virustotal.com/en/ip-address/37.0.72.24/information/
- http://blog.dynamoo.com/2015/08/malware-spam-e-bill-6200228913-31072015.html
3 Aug 2015
"... Recommended blocklist:
46.36.219.141
94.23.55.169 "
___
DHL DELIVERY - phish ...
- http://myonlinesecurity.co.uk/dhl-delivery-details-_-phishing/
3 Aug 2015 - "'DHL DELIVERY DETAILS' pretending to come from noreply@ dhl .com is one of the latest attempts to steal your email account details...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/DHL_phish_email.png
... click-the-link (DON'T) in the email you will be sent to http ://cherysweete1843 .org/DHL%20_%20Tracking/DHL%20_%20Tracking.htm (or whichever other site the phishers have set up to steal your information). The site looks like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/dhl_phish.png
... entering an email address and password, just gives you a download of the image that was originally in the email. It just looks like the phishers are trying to get email account details and hoping that an unwary user will be unwise enough to give them the password for their email account so it can be used for sending more spam. Of course there will be a few users who genuinely have DHL accounts and the log in details might be enough to compromise the account and use the account to send stolen or illegal items through the DHL network with minimum risk to the criminals. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
cherysweete1843 .org: 178.217.186.27: https://www.virustotal.com/en/ip-address/178.217.186.27/information/
___
First Firmware Worm That Attacks Macs
- http://www.wired.com/2015/08/researchers-create-first-firmware-worm-attacks-macs/
8.03.15 - "... when it comes to firmware, people have assumed that Apple systems are locked down in ways that PCs aren’t. It turns out this isn’t true. Two researchers have found that several known vulnerabilities affecting the firmware of all the top PC makers can also hit the firmware of MACs. What’s more, the researchers have designed a proof-of-concept worm for the first time that would allow a firmware attack to spread automatically from MacBook to MacBook, without the need for them to be networked... The only way to eliminate malware embedded in a computer’s main firmware would be to re-flash the chip that contains the firmware... findings on August 6 at the Black Hat security conference in Las Vegas. A computer’s core firmware — also referred to at times as the BIOS, UEFI or EFI—is the software that boots a computer and launches its operating system. It can be infected with malware because most hardware makers don’t cryptographically sign the firmware embedded in their systems, or their firmware updates, and don’t include any authentication functions that would prevent any but legitimate signed firmware from being installed... it operates at a level below the level where antivirus and other security products operate and therefore does not generally get scanned by these products, leaving malware that infects the firmware unmolested. There’s also no easy way for users to manually examine the firmware themselves to determine if it’s been altered... malware infecting the firmware can maintain a persistent hold on a system throughout attempts to disinfect the computer. If a victim, thinking his or her computer is infected, wipes the computer’s operating system and reinstalls it to eliminate malicious code, the malicious firmware code will remain intact..."
___
Fake Android Virus Alert(s)...
- https://blog.malwarebytes.org/online-security/2015/08/fake-android-virus-alert-blames-chinese-hackers/
Aug 3, 2015 - "... messages of impending doom on a mobile device are always more worrying than on a desktop, because many device owners may not be locking down their phones the way they do their PCs. It’s even worse if on a mobile data package, because nobody wants to end up on premium rate services or websites and contend with spurious charges. Once the popups and redirects take hold, it’s sometimes hard to keep your composure and get a handle on multiple tiny screens doing weird things. In the above case, there’s no infection to worry about so no need to panic. Advert redirects to unwanted locations are always a pain – especially if younger members of your family happen to be on the phone at the time the -redirects- happen – but you’ve generally got to work at it to infect a mobile device with something bad. Keeping the “Allow installs from unknown sources” checkbox -unticked- and the “Very Apps” checkbox -ticked- won’t make your phone bulletproof, but it will go a long way towards keeping you secure."
___
Fake 'pictures' SPAM - JS malware
- http://myonlinesecurity.co.uk/my-relaxation-js-malware/
2 Aug 2015 - "'my relaxation' pretending to come from Facebook <update+pw_k1-d2r1@ facebookmail .com> with a zip attachment is another one from the current bot runs... The email looks like:
Here are some pictures!!
See you later! I love you.
2 August 2015: File_7866.zip: Extracts to: File_7866.js - Current Virus total detections: 10/56*
Downloads Adobe_update-86R8IJHUY0CCI.exe from http ://kheybarco .com and also downloads a genuine PDF file which is a German language hotel invoice from HRS group (this is an updated version of this Malspam run** from last week)...
** http://myonlinesecurity.co.uk/document-hrs-group-js-malware/
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5343e207eaac0600fbfe490b9edd252e6a33b37e5387079b66d71297a5a04de1/analysis/1438493868/
kheybarco .com: 176.9.8.205: https://www.virustotal.com/en/ip-address/176.9.8.205/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-04, 13:37
FYI...
Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-hh-114954-hps-plumbing-word-doc-malware/
4 Aug 2015 - "'INVOICE HH / 114954' pretending to come from haywardsheath@ hpsmerchant .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Please find attached INVOICE HH / 114954
Automated mail message produced by DbMail.
Registered to Heating & Plumbing Supplies, License MBS2009358.
4 August 2015: R-20787.doc - Current Virus total detections: 5/56*
... downloads Dridex banking malware from http ://ilcasalepica .it/45g33/34t2d3.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1a074f920de27b663980a79a245f3379a96262d4f4bfc91e58844fa72565ed29/analysis/1438684390/
** https://www.virustotal.com/en/file/14e9840bdf98de7b9ad8aa0e9fc395ed7aefd31d75e92f7b5ab34a1d195a1328/analysis/1438684442/
... Behavioural information
TCP connections
194.58.111.157: https://www.virustotal.com/en/ip-address/194.58.111.157/information/
8.254.218.142: https://www.virustotal.com/en/ip-address/8.254.218.142/information/
ilcasalepica .it: 195.234.171.179: https://www.virustotal.com/en/ip-address/195.234.171.179/information/
- http://blog.dynamoo.com/2015/08/malware-spam-invoice-hh-114954.html
4 Aug 2015 - "... The payload is the Dridex banking trojan.
Recommended blocklist:
194.58.111.157
62.210.214.106
31.131.251.33 "
___
Malware spam: "Need your attention"
- http://blog.dynamoo.com/2015/08/malware-spam-need-your-attention.html
4 Aug 2015 - "A variety of malicious spam messages are in circulation, each with "Need your attention" in the subject. Each message has a different sender, attachment name and reference number in the subject along with some other variations. Here is an example:
From: Hilda Buckner
Date: 4 August 2015 at 13:29
Subject: Need your attention: OO-6212/863282
Greetings
Hope you are well
Please find attached the statement that matches back to your invoices.
Can you please sign and return.
In that case, the attachment is victimname_JM_1646.doc (other messages have differently-named attachments, but all with the victim's name in them) which in this case contains this malicious macro... What that macro does (other ones may be slightly different) is download a VBS script from pastebin .com/download.php?i=0rYd5TK3... which is then saved as %TEMP%\nnjBHccs.vbs. That VBS then downloads a file from 5.196.241.204 /bt/bt/ched.php which is then saved as %TEMP%\JHVHsd.exe which currently has a detection rate of zero* (MD5 = 00dca835bb93708797a053a3b540db16). The Malwr report indicates that this phones home to 80.247.233.18 (NFrance Conseil, France). The payload is probably the Dridex banking trojan. Note that the malware also sends apparantly non-malicious traffic to itmages .ru , for example:
itmages .ru/image/view/2815551/2b6f1599
itmages .ru/image/view/2815537/2b6f1599
Therefore I would suggest that monitoring for traffic to itmages .ru is a fairly good indicator of compromise."
* https://www.virustotal.com/en/file/aaa9e39e451379135b1515f8a1ed3b2e6045474923b302955e8181b3a6733025/analysis/1438693059/
... Behavioural information
TCP connections
23.14.92.97: https://www.virustotal.com/en/ip-address/23.14.92.97/information/
178.255.83.2: https://www.virustotal.com/en/ip-address/178.255.83.2/information/
80.247.233.18: https://www.virustotal.com/en/ip-address/80.247.233.18/information/
5.196.241.204: https://www.virustotal.com/en/ip-address/5.196.241.204/information/
itmages .ru: 176.9.0.165: https://www.virustotal.com/en/ip-address/176.9.0.165/information/
comment: Derek Knight said...
"It is -ransomware- not Dridex this time and the most evil thing about it, is it uses a legitimate digital signature so it will blow past antiviruses and operating system protections. Correctly digitally signed files are treated as good."
4 Aug 2015
___
Fake 'AMEX Alert' SPAM - Phish... malware
- http://myonlinesecurity.co.uk/american-express-account-alert-important-cardmembership-notification-phishing-and-possible-malware/
4 Aug 2015 - "'Account Alert: IMPORTANT CardMembership Notification' pretending to come from American Express <AmericanExpress@ aecom .com> with an html webpage attachment... seems to be a malware downloader...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Amex-Account-Alert-IMPORTANT-CardMembership-Notification.png
The attached webpage looks like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Amex-Account-Alert-IMPORTANT-CardMembership-Notification_1.png
4 August 2015: AYNEUS018829.html - Current Virus total detections: 4/55*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1fcadd5d9ed561fb5f9535f065976e08d0d9ae7e254aef9ab08438e901d7e345/analysis/1438622967/
___
Malvertising Campaign Takes on Yahoo!
- https://blog.malwarebytes.org/malvertising-2/2015/08/large-malvertising-campaign-takes-on-yahoo/
Aug 3, 2015 - "June and July have set new records for malvertising attacks. We have just uncovered a large scale attack abusing Yahoo!’s own ad network. As soon as we detected the malicious activity, we notified Yahoo! and we are pleased to report that they took immediate action to stop the issue. The campaign is no longer active at the time of publishing this blog.
This latest campaign started on July 28th, as seen from our own telemetry. According to data from SimilarWeb, Yahoo!’s website has an estimated 6.9 Billion visits per month making this one of the largest malvertising attacks we have seen recently... As with the previous reported cases this one also leverages Microsoft Azure websites... We did not collect the payload in this particular campaign although we know that Angler has been dropping a mix of ad fraud (Bedep) and ransomware (CryptoWall)... Malvertising is a silent killer because malicious ads do not require any type of user interaction in order to execute their payload. The mere fact of browsing to a website that has adverts (and most sites, if not all, do) is enough to start the infection chain. The complexity of the online advertising economy makes it easy for malicious actors to abuse the system and get away with it. It is one of the reasons why we need to work very closely with different industry partners to detect suspicious patterns and react very quickly to halt rogue campaigns."
> http://bits.blogs.nytimes.com/2015/08/03/hackers-exploit-flash-vulnerability-in-yahoo-ads/
- http://net-security.org/malware_news.php?id=3083
04.08.2015 - "... In the first half of this year the number of malvertisements has jumped 260 percent compared to the same period in 2014. The sheer number of unique malvertisements has climbed 60 percent year over year... fake Flash updates have replaced fake antivirus and fake Java updates as the most commonly method used to lure victims into installing various forms of malware including ransomware, spyware and adware..."
:fear::fear: :mad:
AplusWebMaster
2015-08-05, 14:24
FYI...
Fake 'Ofcom Spectrum' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/important-document-from-ofcom-spectrum-licensing-word-doc-malware/
5 Aug 2015 - "'IMPORTANT – Document From Ofcom Spectrum Licensing' pretending to come from Spectrum.licensing@ ofcom. org.uk with a malicious word doc/xls attachment is another one from the current bot runs... The email looks like:
Dear Sir/Madam,
Please find attached an electronic version of important documents relating to your Wireless Telegraphy licence or application.
Please read the document carefully and keep it for future reference.
If any details within this letter are incorrect, please notify Ofcom Spectrum Licensing as soon as possible. It is the Licensee’s responsibility to ensure all information we hold is correct and current.
If you have any enquiries relating to this document, please email
spectrum.licensing@ ofcom .org.uk
Yours faithfully,
Ofcom Spectrum Licensing ...
5 August 2015: logmein_pro_receipt.xls - Current Virus total detections: 6/55*
Downloads Dridex banking malware from http ://naturallyconvenient .co.za/75yh4/8g4gffr.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3f23b47564cfada12ca18f18f51215bf0e6747419249db1c3d71887e55a16b8a/analysis/1438771928/
** https://www.virustotal.com/en/file/6b668ffa97a00d9e4d6ed0be6ae5dfbd191bb4201bb49e34d23c44a430c16ee6/analysis/1438771421/
... Behavioural information
TCP connections
194.58.111.157: https://www.virustotal.com/en/ip-address/194.58.111.157/information/
2.18.213.40: https://www.virustotal.com/en/ip-address/2.18.213.40/information/
naturallyconvenient .co.za: 197.221.14.220: https://www.virustotal.com/en/ip-address/197.221.14.220/information/
- http://blog.dynamoo.com/2015/08/malware-spam-important-document-from.html
5 Aug 2015
"... downloads a malware executable from:
naturallyconvenient .co.za/75yh4/8g4gffr.exe
... phoning home to:
194.58.111.157 (Reg.RU, Russia)
That IP has been used for badness a few times recently and I definitely recommend that you block traffic to it..."
___
Fake 'Booking Confirmation' SPAM – doc malware
- http://myonlinesecurity.co.uk/booking-confirmation-accumentia-16915-david-nyaruwa-word-doc-or-excel-xls-spreadsheet-malware/
5 Aug 2015 - "'Booking Confirmation – Accumentia (16/9/15)' pretending to come from <david.nyaruwa @soci .org> with a malicious word doc is another one from the current bot runs... The email looks like:
Please find attached a proforma invoice for Accumentia’s booking of the council room on 16/09/15. The deposit to confirm the booking is 25% (ie £205.50) with the balance due by the date of the meeting.
Regards,
David Nyaruwa
Project Accountant ...
5 August 2015: Accumentia Booking (16-9-15).doc - Current Virus total detections: 7/55*
Downloads -same- Dridex banking malware as today’s other 2 malspam runs [1] [2]
1] http://myonlinesecurity.co.uk/statement-unpaid-swandean-foods-word-doc-malware/
...
2] http://myonlinesecurity.co.uk/important-document-from-ofcom-spectrum-licensing-word-doc-malware/
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/236c724d2aa44d57361ca825878aaac44b2855a2a0b8c79fdf6594fe7531c32b/analysis/1438773636/
- http://blog.dynamoo.com/2015/08/malware-spam-booking-confirmation.html
5 Aug 2015 - "... Accumentia Booking (16-9-15).doc which comes in at least two different versions [VirusTotal results 6/56* and 7/56**]... download -malware- from the following locations:
hunde-detektive .de/75yh4/8g4gffr.exe
naturallyconvenient .co.za/75yh4/8g4gffr.exe
This file has a detection rate of 4/55*** and the Malwr report shows that it phones home to the familiar IP of:
194.58.111.157 (Reg.RU, Russia)
I strongly recommend that you block traffic to that IP. The payload is the Dridex banking trojan..."
* https://www.virustotal.com/en/file/3e9ae31f74f9b78619be6fa25279c86d13ac960257e9578d40018e6e81f005eb/analysis/
** https://www.virustotal.com/en/file/08f309a099ca24a110088d9d6f386dec982c343c71989a2e77dd8ac0bb95bff2/analysis/
*** https://www.virustotal.com/en/file/1bac0544e05b7914ee296ce1cee356d532487038e2b3508934c09b454a9b5633/analysis/1438773952/
... Behavioural information
TCP connections
194.58.111.157: https://www.virustotal.com/en/ip-address/194.58.111.157/information/
2.18.213.40: https://www.virustotal.com/en/ip-address/2.18.213.40/information/
hunde-detektive .de: 81.169.145.89: https://www.virustotal.com/en/ip-address/81.169.145.89/information/
___
Fake 'passport' SPAM – JS malware cryptowall/fareit
- http://myonlinesecurity.co.uk/my-passport-reginald-vazquez-js-malware/
5 Aug 2015 - "'My passport – Reginald Vazquez' pretending to come from Reginald Vazquez <Reginald.Vazquez@ iconbrandingsolutions .com> with a zip attachment is another one from the current bot runs... The email looks like:
Please find attached copy of the passport for my wife and daughter as requested. please note we need to complete on the purchase in 4 weeks from the agreed date.
Kind regards,
Reginald Vazquez
5 August 2015: Reginald Vazquez.zip - Extracts to: Reginald Vazquez.js
Current Virus total detections: 0/55*. Downloads 2 files from 31072015a .com 1 is -cryptowall-, the second is -fareit- VirusTotal [1] [2]. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://www.virustotal.com/en/file/314050de5b8ff9c3ca9b9b692ed3f11410ada9dbcc079e72b70a84f5e2396795/analysis/1438775249/
... Behavioural information
TCP connections
188.165.164.184: https://www.virustotal.com/en/ip-address/188.165.164.184/information/
5.196.199.72: https://www.virustotal.com/en/ip-address/5.196.199.72/information/
45.56.87.253: https://www.virustotal.com/en/ip-address/45.56.87.253/information/
103.28.39.102: https://www.virustotal.com/en/ip-address/103.28.39.102/information/
81.218.71.215: https://www.virustotal.com/en/ip-address/81.218.71.215/information/
212.90.148.43: https://www.virustotal.com/en/ip-address/212.90.148.43/information/
184.168.47.225: https://www.virustotal.com/en/ip-address/184.168.47.225/information/
198.211.120.49: https://www.virustotal.com/en/ip-address/198.211.120.49/information/
98.130.136.200: https://www.virustotal.com/en/ip-address/98.130.136.200/information/
2] https://www.virustotal.com/en/file/90063ec35942f7aba8eafc978f31f296ac3ca8642061a2745bdf5aecc14f7fad/analysis/1438775261/
... Behavioural information
TCP connections
192.186.240.131: https://www.virustotal.com/en/ip-address/192.186.240.131/information/
82.208.47.134: https://www.virustotal.com/en/ip-address/82.208.47.134/information/
160.153.34.130: https://www.virustotal.com/en/ip-address/160.153.34.130/information/
50.62.121.1: https://www.virustotal.com/en/ip-address/50.62.121.1/information/
192.254.185.141: https://www.virustotal.com/en/ip-address/192.254.185.141/information/
50.63.93.1: https://www.virustotal.com/en/ip-address/50.63.93.1/information/
31072015a .com:
> http://centralops.net/co/DomainDossier.aspx
Registrant Country: RU
Admin Country: RU
Tech State/Province: RU ...
route: 178.151.105.0/24
descr: Kiev, Troyeshchyna
origin: AS13188
AS13188: https://www.google.com/safebrowsing/diagnostic?site=AS:13188
...
89.185.15.235: https://www.virustotal.com/en/ip-address/89.185.15.235/information/
94.45.73.242: https://www.virustotal.com/en/ip-address/94.45.73.242/information/
46.119.54.121: https://www.virustotal.com/en/ip-address/46.119.54.121/information/
31.43.132.156: https://www.virustotal.com/en/ip-address/31.43.132.156/information/
217.73.85.49: https://www.virustotal.com/en/ip-address/217.73.85.49/information/
62.244.60.154: https://www.virustotal.com/en/ip-address/62.244.60.154/information/
194.242.102.188: https://www.virustotal.com/en/ip-address/194.242.102.188/information/
176.111.43.241: https://www.virustotal.com/en/ip-address/176.111.43.241/information/
95.47.4.154: https://www.virustotal.com/en/ip-address/95.47.4.154/information/
194.44.37.3: https://www.virustotal.com/en/ip-address/194.44.37.3/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-06, 15:00
FYI...
Fake 'Voice message' SPAM – malware
- http://myonlinesecurity.co.uk/re-voice-message-from-07773403290-voiplicity-co-uk-fake-wav-malware/
6 Aug 2015 - "'RE: Voice message from 07773403290 pretending to come from tel: 07773403290 <non-mail-user@ voiplicity .co.uk> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Voice-message-from-07773403290.png
6 August 2015: message_01983527496.wav.zip: Extracts to: message_01983527496.exe
Current Virus total detections: 0/58* . Downloads other files from mastiksoul .org or wedspa .su which appear to be Dridex/Cridex banking malware and posts stolen information to wedspa .su (VirusTotal**). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper wav ( sound) file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/25a283556840d41562f44b97ec08e80cf722644b521e8dc7940e29eb79a85c33/analysis/1438846882/
** https://www.virustotal.com/en/file/f91405a19f09a3994a8c3c6f84fb4f82cf5bcf50f0aab600b56e14c002e15eb1/analysis/1438847706/
... Behavioural information
TCP connections
212.47.196.149: https://www.virustotal.com/en/ip-address/212.47.196.149/information/
8.254.218.94: https://www.virustotal.com/en/ip-address/8.254.218.94/information/
mastiksoul .org: 74.220.207.107: https://www.virustotal.com/en/ip-address/74.220.207.107/information/
wedspa .su:
94.229.22.39: https://www.virustotal.com/en/ip-address/94.229.22.39/information/
94.242.58.226: https://www.virustotal.com/en/ip-address/94.242.58.226/information/
185.26.113.229: https://www.virustotal.com/en/ip-address/185.26.113.229/information/
- http://blog.dynamoo.com/2015/08/malware-spam-voice-message-from.html
6 Aug 2015 - "... Recommended blocklist:
185.26.113.229
212.47.196.149 "
___
Chinese Actors Copy/Paste HackingTeam 0-Days in Site Hack
- https://blog.malwarebytes.org/exploits-2/2015/08/chinese-actors-copy-and-paste-hackingteam-zero-days-in-site-hack/
Aug 6, 2015 - "... The HackingTeam archive provided very easy to reuse zero-days that even contained instructions. Exploit kit authors still repackaged the exploits to their liking from the original copies, simply reusing the same vulnerability. Not all threat actors did that though. We found a particular attack on a Chinese website where the perpetrators literally copied and pasted the exploit code from HackingTeam, and simply replaced the default ‘calc.exe’ payload with theirs:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/copypaste.png
... The only thing that really differs is the payload... malicious binaries.
Files used:
mogujie.exe: https://www.virustotal.com/en/file/95d2b94f17ba09cfa8cc94690ad9b4a57ce1f853db63598166f0b718a8f4af1a/analysis/1438875540/
desktop.exe: https://www.virustotal.com/en/file/6bc32b3212a32ee93964666cbd3ac50fa52f15f831a18b4610aa8d46a3e0385d/analysis/1438875538/
SWF(1): https://www.virustotal.com/en/file/1a275895d3407a20c06d58188d26836149348538c1295c043701a69aa80ea588/analysis/1438459365/
SWF(2): https://www.virustotal.com/en/file/67ac1342db4f3e0dfb5fb1d73220482f9989ddafe2c2991a1c79bc2563dca76a/analysis/1438534343/ ..."
210.56.51.74: https://www.virustotal.com/en/ip-address/210.56.51.74/information/
___
Malware-injecting 'man-in-the-cloud' attacks
- http://www.theinquirer.net/inquirer/news/2421076/dropbox-and-onedrive-at-risk-from-malware-injecting-man-in-the-cloud-attacks
Aug 06 2015 - "... Imperva has revealed a new type of attack called 'man-in-the-cloud' (MITC) that allows hackers to access cloud storage services without the need for a password. The research was unveiled at the Black Hat security conference in Las Vegas, and shows how the attack enables hackers to hijack users of cloud-based storage services, such as Box, Dropbox, Google Drive and Microsoft OneDrive, without their knowledge. Imperva said that the hacker gains authentication to the cloud service by stealing a token that is generated the first time a cloud syncing service is used on a PC, without compromising the user's cloud account username or password. From here, an attacker can access and steal a user's files, and even add malware or ransomware to the victim's cloud folder. Imperva said in some cases "recovery of the account from this type of compromise is not always feasible"..."
- http://www.darkreading.com/cloud/man-in-the-cloud-owns-your-dropbox-google-drive----sans-malware-/d/d-id/1321501
8/5/2015
___
Threat Group-3390 Targets Organizations for Cyberespionage
- http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/
5 Aug 2015 - "... TG-3390 is known for compromising organizations via SWCs and moving quickly to install backdoors on Exchange servers. Despite the group's proficiency, there are still many opportunities to detect and disrupt its operation by studying its modus operandi. The threat actors work to overcome existing security controls, or those put in place during an engagement, to complete their mission of exfiltrating intellectual property. Due to TG-3390's determination, organizations should formulate a solid -eviction- plan before engaging with the threat actors to prevent them from reentering the network..."
(More detail at the URL above.)
* http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/#r01
:fear::fear: :mad:
AplusWebMaster
2015-08-07, 15:41
FYI...
Fake ad 'Sleek Granite Computer' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/08/malware-spam-sleek-granite-computer.html
7 Aug 2015 - "What the heck is a Sleek Granite Computer? As clickbait it is kind of weird.. but perhaps interesting enough to get people to click on the malicious attachment it comes with:
From: mafecoandohob [mafecoandohob@ bawhhorur .com]
To: Karley Pollich
Date: 7 August 2015 at 13:17
Subject: Sleek Granite Computer
Good day!
If you remember earlier this week we discussed with You our new project which we intend to start next month.
For Your kind review we enclose here the business plan and all the related documents.
Please send us an e-mail in case You have any comments or proposed changes.
According to our calculations the project will start bringing profit in 6 months.
Thanks in advance.
Karley Pollich
Dynamic Response Strategist
Pagac and Sons
Toys, Games & Jewelery
422-091-2468
The only sample of this I had was -malformed- and the attachment wasn't attached properly. However, if properly formatted it would have been named saepe 422-091-2468.zip and it contains a malicious executable named nulla.exe. This has a VirusTotal detection rate of 4/55* with Sophos identifying it as a variant of Upatre. The Hybrid Analysis report shows a typical Upatre/Dyre traffic pattern to:
195.154.241.208 :12800/0608us12/6FsvE66Gy1/0/61-SP1/0/FDMBEFJBMKBEMM
195.154.241.208 :12800/0608us12/6FsvE66Gy1/41/2/18/FDMBEFJBMKBEMM
This IP address belongs to Online SAS in France who seem to have hosted quite a bit of this stuff recently, the hostname identifies it as belonging to poneytelecom .eu. Traffic is also spotted to:
37.57.144.177 (Triolan / Content Delivery Network, Ukraine)
95.143.141.50 (LTnet, Czech Republic)
There is also non-malicious traffic to icanhazip.com to identify the IP address of the infected machine. This is worth monitoring though as it is a potential indicator of compromise. The payload is almost definitely the Dyre banking trojan.
Recommended blocklist:
195.154.241.208
37.57.144.177
95.143.141.50 "
* https://www.virustotal.com/en/file/b17e5cc7b27fecb92f601b358963e22df77b4beb517936aaa9e95b4e61269d7d/analysis/1438950940/
___
Fake 'Tax Refund' SPAM – PDF malware
- http://myonlinesecurity.co.uk/tax-refund-new-message-alert-fake-pdf-malware/
7 Aug 2015 - "Amongst all of today’s usual bunch of spoofed HMRC tax refund phishing attempts, we are seeing an email tonight saying 'Tax Refund New Message Alert!' pretending to come from HM Revenue & Customs <security.custcon@ hmrc .gsi .gov .uk> with a zip attachment is another one from the current bot runs... The email looks like:
Dear Customer,
After the last anual calculations of your fiscal activity we have discovered
that you are eligible to receive a tax refund of GBP 1048.55.
Kindly complete the tax refund request and allow 1-15 working days to process it.
Please download the document attached to this email and confirm your tax refund.
A refund can be delayed for a variety of reasons.
For example: Submitting invalid records or applying after the deadline.
Yours sincerely, Edward Troup
Tax Assurance Commissioner.
Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
7 August 2015: TaxRefund0036192.zip - Extracts to: TaxRefund0036192.pdf.exe
Current Virus total detections: 4/56* which looks to be this rather nasty ransom ware Trojan**. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/186a9b8c038b8fafc5fe4a7cd1f09d54a9c0cc4e8849f37d414fdc134baa9be0/analysis/1438968024/
** https://usa.kaspersky.com/internet-security-center/threats/onion-ransomware-virus-threat#.VcURnHnbK70
"... via the Andromeda botnet"
___
Updates in... Ransomware
- http://blog.trendmicro.com/trendlabs-security-intelligence/price-hikes-and-deadlines-updates-in-the-world-of-ransomware/
Aug 7, 2015 - "... ransomware variants have evolved to do more than just encrypt valuable system files. CryptoFortress targeted files in shared network drives while TeslaCrypt targeted gamers and mod users. Now we are seeing another feature rapidly gaining ground in the world of ransomware: the ability to increase the ransom price on a deadline... A recent attack on an Australian company revealed a new TorrentLocker variant that can double the price of decryption after a deadline of five days. The cyber attack started with a business email. We noted a TorrentLocker spam run targeting Australia that probably delivered the infected email. TorrentLocker is a persistent threat in the region... After clicking on one of these infected emails, a manager’s system ended up with the crypto-ransomware TROJ_CRYPLOCK.XW. Nothing happened at first. The manager deleted the email and thought nothing of it until hours later. By then, it was too late. The malware had already encrypted 226 thousand files before it popped the warning and all IT admins can do is stare at a screen asking them for AU $640 in five days, after which the price will double to AU $1280:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/08/Cyptoransomware_updates_01.png
... Continuing upgrades in crypto-ransomware show that users need to be vigilant with attack vectors that may be used to get the malware in their machines. While installing security software to protect all endpoints is paramount to security, it is equally important to use a multi-layered approach.
- Always have a -backup- strategy, most efficiently by following the 3-2-1 rule*...
- Trust products proven to detect ransomware before it reaches your system—either as a bad URL, a malicious email, or via unpatched exploits.
- Noting the way that the Australian company was hacked, it pays to also educate employees about safe email and Web browsing procedures..."
* http://blog.trendmicro.com/trendlabs-security-intelligence/world-backup-day-the-3-2-1-rule/
"... backup best practices is the three-two-one rule. It can be summarized as: if you’re backing something up, you should have:
At least three copies,
In two different formats,
with one of those copies off-site..."
___
RIG Exploit Kit 3.0 - 1 Million Strong and Growing
- https://atlas.arbor.net/briefs/index#1344414045
Elevated Severity
Aug 6, 2015 - "The RIG exploit kit, used to deliver various forms of -malware- onto compromised systems, has seen a recent surge in victims. The surge, impacting more than 1.25 million systems globally, is spreading via a large -malvertising- campaign at an average rate of 27,000 new victims a day*..."
* https://www.trustwave.com/Resources/Trustwave-Blog/How-an-Upgraded-Version-of-the-RIG-Exploit-Kit-is-Infecting-27k-Computers-Per-Day/
___
Google, Samsung to issue monthly Android security fixes
- http://www.reuters.com/article/2015/08/07/us-android-security-idUSKCN0QC00320150807
Aug 6, 2015 8:03pm EDT - "... As with Apple's iPhones, the biggest security risk comes with apps that are not downloaded from the official online stores of the two companies... a key avenue was to convince targets to download legitimate-seeming Android and iPhone apps from imposter websites."
:fear::fear: :mad:
AplusWebMaster
2015-08-10, 14:38
FYI...
Fake 'Your order' SPAM – doc malware
- http://myonlinesecurity.co.uk/your-order-10232-from-create-blinds-online-paid-word-doc-malware/
10 Aug 2015 - "'Your order 10232 from Create Blinds Online: Paid' pretending to come from orders@ createblindsonline .co.uk with a malicious word doc attachment is another one from the current bot runs... This email has what appears to be a genuine word doc or Excel XLS spreadsheet attached which is malformed and contains a macro script virus... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
... The email looks like:
We would like to thank you for your recent order. Order Status updated on: 10/08/2015 Your Customer ID: 1761 Your Order ID: 10232
Invoice Number: 10232
Delivery Note: We received your order and payment on Aug/102015 Your order details are attached:
Kind regards
Create Blinds Online Team ...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Your-order-10232-from-Create-Blinds-Online.png
10 August 2015: invoice-10232.doc Current Virus total detections: 5/55* Downloads Dridex banking malware from http ://mbmomti .com.br/435rg4/3245rd2.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0d917831636f69503b6f0a96e27958c1727303042c7832e36c8516292e5f1165/analysis/1439189964/
** https://www.virustotal.com/en/file/64be05ce8131bbae5be0d68f45c0416aba5e06f6301962f6f03484b26ddccdd8/analysis/1439190149/
... Behavioural information
TCP connections
78.47.119.85: https://www.virustotal.com/en/ip-address/78.47.119.85/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
mbmomti .com.br: 187.17.111.99: https://www.virustotal.com/en/ip-address/187.17.111.99/information/
- http://blog.dynamoo.com/2015/08/malware-spam-your-order-10232-from.html
10 Aug 2015 - "... attempts to download a -malicious- binary from one of the following locations:
mbmomti .com.br/435rg4/3245rd2.exe
j-choi .asia/435rg4/3245rd2.exe
... generates traffic to 78.47.119.85 (Hetzner, Germany). The payload is almost definitely the Dridex banking trojan."
j-choi .asia: 153.122.0.184: https://www.virustotal.com/en/ip-address/153.122.0.184/information/
___
Fake 'MI Package' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/premium-charging-mi-package-for-merchant-17143013-word-doc-or-excel-xls-spreadsheet-malware/
10 Aug 2015 - "'Premium Charging MI Package for Merchant 17143013' pretending to come from GEMS@ Worldpay .com with a malicious word doc attachment is another one from the current bot runs... This email has what appears to be a genuine word doc or Excel XLS spreadsheet attached which is malformed and contains a macro script virus... DO NOT follow the advice they give to enable macros or enable editing to see the content:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
... The email looks like:
*** Please do not reply to this Message *** Attached is the Management Information to support your Monthly Invoice. Should you have any queries, please refer to your usual helpdesk number.
10 August 2015: 17143013 01.docm - Current Virus total detections: 5/56*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6011af6c2682d6acc32673b68be89a42c274ea5988117cdc3a05616bc5cb6f8d/analysis/1439196186/
- http://blog.dynamoo.com/2015/08/malware-spam-premium-charging-mi.html
10 Aug 2015 - "... one sample with named 17143013 01.docm ... detection rate of 5/55* and it contains this malicious macro... which then downloads a component from:
gardinfo .net/435rg4/3245rd2.exe
This is exactly the -same- payload as seen in this spam run** also from this morning."
* https://www.virustotal.com/en/file/0cdec864ba6daa55b3f37e6cc5dbab00752efbccbe15459999af85493f31b349/analysis/1439198630/
** http://blog.dynamoo.com/2015/08/malware-spam-your-order-10232-from.html
gardinfo .net: 62.210.16.61: https://www.virustotal.com/en/ip-address/62.210.16.61/information/
___
Fake 'Resume' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/08/malware-spam-gabriel-daniel-resume.html
10 Aug 2015 "This fake résumé comes with a malicious attachment:
From: alvertakarpinskykcc@ yahoo .com
Date: 10 August 2015 at 19:40
Subject: Resume
Signed by: yahoo .com
Hi my name is Gabriel Daniel doc is my resume
I would appreciate your immediate attention to this matter
Kind regards
Gabriel Daniel
Interestingly, the email does really appear to come via Yahoo!'s mail servers. Attached is a document Gabriel_Daniel_resume.doc which contains this malicious macro... which has a VirusTotal detection rate of 2/56*. As far as I can tell, it appears to download a disguised JPG file from 46.30.43.179/1.jpg (Eurobyte LLC, Russia) which appears to be an encrypted executable. I wasn't able to decode all of the macro, however this Hybrid Analysis report shows clearly what is going on:
> https://1.bp.blogspot.com/-pVLYG1iCchQ/VcjC9aEOGPI/AAAAAAAAG4I/WNCsjruC-UA/s1600/cryptowall.png
So, it is pretty clear that the payload here is -Cryptowall- (which encrypts all the victim's files). The same Hybrid Analysis report shows that it POSTS information to:
conopizzauruguay .com/wp-content/wp-content/themes/twentythirteen/cccc.php?v=c91jzn46yr
conopizzauruguay .com/wp-content/wp-content/themes/twentythirteen/cccc.php?b=86v97tziud5m
conopizzauruguay .com/wp-content/wp-content/themes/twentythirteen/cccc.php?o=ups5xom3u2sb01
It also directs the visitor to various personalised ransom pages hosted on 80.78.251.170 (Agava, Russia).
Recommended blocklist:
46.30.43.179
80.78.251.170
conopizzauruguay .com "
*https://www.virustotal.com/en/file/48f68ceeb094bd8c72c0a65ec5efd09a8da33934d854296b73c2dce99aff50d8/analysis/1439219044/
conopizzauruguay .com: 208.113.240.70: https://www.virustotal.com/en/ip-address/208.113.240.70/information/
___
.COM.COM Used For Malicious Typo Squatting
- https://isc.sans.edu/diary.html?storyid=20019
2015-08-10 - "... domains ending in ".com.com" are being -redirected- to what looks like malicious content. Back in 2013, A blog by Whitehat Security pointed out that the famous "com.com" domain name was sold by CNET to known typo squatter dsparking .com [1]. Apparently, dsparking .com paid $1.5 million for this particular domain. Currently, the whois information uses privacy protect, and DNS for the domain is hosted by Amazon's cloud. All .com.com hostnames appear to resolve to 54.201.82.69, also hosted by Amazon (amazon .com .com is also directed to the same IP, but right now results in more of a "Parked" page, not the -fake- anti-malware as other domains). The content you receive varies. For example, on my first hit from my Mac to facebook .com .com , I received the following page:
> https://isc.sans.edu/diaryimages/images/Screen%20Shot%202015-08-10%20at%202_34_58%20PM.png
And of course the -fake- scan it runs claims that I have a virus :) . As a "solution", I was offered the well known scam-app "Mackeeper". Probably best to -block- DNS lookups for any .com.com domains. The IP address is likely going to change soon, but I don't think there is any valid content at any ".com.com" host name. The Whitehat article does speak to the danger of e-mail going to these systems... Amazon EC2 abuse was notified."
1] https://blog.whitehatsec.com/why-com-com-should-scare-you/
54.201.82.69: https://www.virustotal.com/en/ip-address/54.201.82.69/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-11, 15:09
FYI...
Fake 'Website Invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/here-is-your-bt-website-invoice-pdf-malware/
11 Aug 2015 - "'Here is your BT Website Invoice. pretending to come from btd.billing.noreply@ bt .com with a PDF attachment is another one from the current bot runs... The email comes in corrupt... There is an HTML attachment which contains what the actual email should read:
***Please do not reply to this automated e-mail as responses are not read***
Hello
Here is your latest billing information from BT Directories – please check the details carefully.
If you need to contact us then you’ll find the numbers in the attachment.
Kind Regards
BT Directories Billing & Credit Management ...
And there is a PDF attachment which contains the malware:
11 August 2015 : DirectDebit Invoice_5262307_011220140151449702826.pdf
Current Virus total detections: 4/56* which is a PDF containing a word doc with embedded macros in the same way as described in today’s earlier malspam run**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/08af5513378e9186ba26b4ba1aa8b2e3951d61328f8d7a8c98a43f087cb7a97a/analysis/1439286155/
** http://myonlinesecurity.co.uk/interparcel-documents-pdf-malware/
11 Aug 2015 - "'Interparcel Documents' pretending to come from Interparcel <bounce@ interparcel .com> with a PDF attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Interparcel-Documents.png
11 August 2015: Shipping Labels (938854744923).pdf - Current Virus total detections: 4/57*
... downloads Dridex from http ://sonicadmedia .com/334f3d/096uh5b.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9fde36d6b82a8c2f81448cf053ca74637bef98a6e0b8a8bdfbf11908840917e4/analysis/1439281100/
** https://www.virustotal.com/en/file/b134e2be463dcdbb48cb8081e2fac1ff2c1c32796abafbc03d6f38105f7d5db1/analysis/1439284911/
sonicadmedia .com: 192.185.5.3: https://www.virustotal.com/en/ip-address/192.185.5.3/information/
___
Fake 'Congratulations on your purchase Windows' SPAM – fake PDF malware
- http://myonlinesecurity.co.uk/congratulations-on-your-purchase-windows-fake-pdf-malware/
11 Aug 2015 - "'Congratulations on your purchase Windows' with a zip attachment is another one from the current bot runs... The email looks like:
The invoice for the license windows 10.
Invoice id: 5661255582
License number: 211883074666
License serial number: XXXXXX-XXXXXX-XXXXXX-QF7303-DG7S86
Details of the attachment.
THANKS A LOT FOR BEING WITH US.
Todays Date: Invoice Windows10 1648726511-en.zip:
Extracts to: Invoice Windows10 7848342350-en.exe
Current Virus total detections: 6/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ac95e5be477cbddf2478632d28ada80bd4d235bef526de210c964084460fcabf/analysis/1439303996/
___
Asprox botnet... disappears
- http://www.infoworld.com/article/2969322/malware/asprox-botnet-a-longrunning-nuisance-disappears.html
Aug 11, 2015 - "The Asprox botnet, whose malware-spamming activities have been followed for years by security researchers, appears to be gone... the botnet seemed to be shut down, wrote Ryan Olson, intelligence director for Palo Alto Networks, in a blog post:
> http://researchcenter.paloaltonetworks.com/2015/08/whats-next-in-malware-after-kuluoz/
Olson wrote that Palo Alto thought the botnet's operators may have changed their tactics, and Palo Alto missed the shift. But they verified that Asprox's command-and-control structure shut down - at least for now... Earlier this year, Brad Duncan, a security researcher at Rackspace, also noticed a change:
> https://isc.sans.edu/forums/diary/What+Happened+to+You+Asprox+Botnet/19435/
... Spam that appeared stylistically close to that sent by Asprox had -different- malware. Asprox has taken a hit before. In November 2008, it was one of several botnets affected by the shutdown of McColo, a notorious California-based ISP that was providing network connectivity for cybercriminals. The shutdown of McColo dramatically cut the amount of spam, but Asprox as well as other botnets came back. The most frequent malware now seen by Palo Alto is Upatre. That malware downloads other harmful programs to a computer, and Palo Alto has seen it involved in installing a banking trojan called Dyre and the Cryptowall ransomware..."
>> http://researchcenter.paloaltonetworks.com/wp-content/uploads/2015/08/kuluoz-2.png
:fear::fear: :mad:
AplusWebMaster
2015-08-12, 15:11
FYI...
Fake 'Invoices payable' SPAM – JAVA malware
- http://myonlinesecurity.co.uk/re-re-invoices-payable-java-malware/
12 Aug 2015 - "'RE: Re: Invoices payable' with a jar attachment pretending to come from info@ fulplanet .com is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Invoices-payable.png
12 August 2015: Invoice.jar - Current Virus total detections: 4/57*
Luckily, Outlook (as you can see from the screenshot above) and many other email clients automatically -block- java jar files from being accessed or opened in the email client. Webmail clients are more at risk as most allow any attachment. Java is a crossbrowser and cross OS program and that is why it is so dangerous. Malicious Java files can infect and compromise ANY computer whether it is windows or Apple or Android or Linux. You will not be infected and cannot be harmed if you do -not- have Java installed on the computer.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like an unknown instead of the java executable file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/f2188d223305092fe0a9c8be89c69e149c33c3ea4b1c0843fda00771ac72272d/analysis/1439362101/
___
Fake 'list attached' SPAM – PDF drops word doc – malware
- http://myonlinesecurity.co.uk/list-attached-as-requested-danielle-cc-signs-ltd-pdf-drops-word-doc-malware/
12 Aug 2015 - "'list attached as requested' pretending to come from Danielle | CC Signs Ltd. <orders@ ccsigns .co.uk> with a malicious PDF attachment that drops a word doc is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
The email has a -blank- body with just this image inside it and looks like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/CC-Signs-Ltd.jpg
12 August 2015: smo.pdf - Current Virus total detections: 5/56*
... which drops/creates 4.docm (VirusTotal**) which contains a macro that connects to http ://konspektau.republika .pl/07jhnb4/0kn7b6gf.exe and downloads Dridex banking malware (VirusTotal***). Other download locations include http ://madrigalchor-schloss-benrath .de/07jhnb4/0kn7b6gf.exe ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a4a7b540630853ca92c87ddbde759e85dbfe762ff13ab917b6db3433dea28d7a/analysis/1439370949/
** https://www.virustotal.com/en/file/e8889312bec248f762c14c519ecdbbe1ae01b6c011cd29ae6b1ca4544417dbb2/analysis/1439371138/
*** https://www.virustotal.com/en/file/6dbe2d872dd324d5204e0dcc596bfd20f62d3d95e7533383fd42e4cc6a1cdf70/analysis/1439372114/
... Behavioural information
TCP connections
74.119.194.18: https://www.virustotal.com/en/ip-address/74.119.194.18/information/
95.101.128.113: https://www.virustotal.com/en/ip-address/95.101.128.113/information/
konspektau.republika .pl: 213.180.150.17: https://www.virustotal.com/en/ip-address/213.180.150.17/information/
madrigalchor-schloss-benrath .de: 81.169.145.158: https://www.virustotal.com/en/ip-address/81.169.145.158/information/
___
Fake 'Invoice for 415 Litmus' SPAM – doc malware
- http://myonlinesecurity.co.uk/invoice-for-415-litmus-word-doc/
12 Aug 2015 - "'Invoice for 415 Litmus' pretending to come from angela_lrc088128@ btinternet .com (the lrc088128 is random and I am seeing -hundreds- of lrc******@ btinternet .com being -spoofed- as the from addresses) with a malicious word doc attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Invoice-for-415-Litmus.png
12 August 2015: 415 Litmus Cleaning invoice.docm - Current Virus total detections: 6/56*
The -malicious- macro inside this version of the word doc connects to and downloads Dridex banking malware from http ://madrigalchor-schloss-benrath .de/07jhnb4/0kn7b6gf.exe (Virus Total**) Which is the -same- malware as described in today’s other Malspam run[1] containing malicious PDF dropping word docs... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8cc4da70ab176d2f942325ac74615d80b5968d817e3e52377ad2c9feb1ee1484/analysis/1439371782/
** https://www.virustotal.com/en/file/6dbe2d872dd324d5204e0dcc596bfd20f62d3d95e7533383fd42e4cc6a1cdf70/analysis/1439372114/
... Behavioural information
TCP connections
74.119.194.18: https://www.virustotal.com/en/ip-address/74.119.194.18/information/
95.101.128.113: https://www.virustotal.com/en/ip-address/95.101.128.113/information/
madrigalchor-schloss-benrath .de: 81.169.145.158: https://www.virustotal.com/en/ip-address/81.169.145.158/information/
1] http://myonlinesecurity.co.uk/list-attached-as-requested-danielle-cc-signs-ltd-pdf-drops-word-doc-malware/
___
Fake 'transferred into Your account HSBC' SPAM – PDF malware
- http://myonlinesecurity.co.uk/this-is-to-confirm-that-amounts-were-transferred-into-your-account-hsbc-fake-pdf-malware/
12 Aug 2015 - "A series of emails on the theme of 'This is to confirm that amounts were transferred into Your account' with subjects like 'Payment affirmation' or 'Conducted transaction information' with an email -link- to entice you into downloading a zip attachment is another one from the current bot runs... Some of the subjects include:
Conducted transaction information
Deposited funds receipt
Fund transfer receipt
Deposited funds acknowledgment
Transaction statement
Transfer verification
Deposited funds affirmation
Deposited funds statement
Balance change receipt
The senders pretend to be bank employees from HSBC and include such titles as:
Forward Applications Strategist
Principal Assurance Developer
Corporate Web Architect™
Principal Factors Director
And hundreds of other similar style of seemingly important sounding titles. The sender matches the job title in the body of the email although the names are totally random...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Payment-affirmation.png
12 August 2015: invoice.pdf.zip: Extracts to: invoice.pdf.exe*
Current Virus total detections: 3/56*. These -Upatre- downloaders normally download either Dridex or Dyreza banking malware. So far the automatic tools haven’t managed to get any actual download. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/21d56cfe59c7ae00096ccee20bf480350ca88bac5f2c4b267442b07f876bc64c/analysis/1439376577/
___
Fake 'Important documents BoA' SPAM – PDF malware
- http://myonlinesecurity.co.uk/fw-important-documents-bankofamerica-com-fake-pdf-malware/
12 Aug 2015 - "'FW: Important documents' pretending to come from Guadalupe Aldridge <Guadalupe.Aldridge@ bankofamerica .com> or Mariano Cotton <Mariano.Cotton@ bankofamerica .com> (and probably loads of other random names @ bankofamerica .com) with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/B-of-A-Important-documents.png
12 August 2015: AccountDocuments.zip: Extracts to: AccountDocuments.scr
Current Virus total detections: 0/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6ac32eeb2a0be4b0f8aac5c306f3c99eeabfa71afc1777adcc75ea9fe5489f0a/analysis/1439398277/
___
Win10 Store, Mail client down for some
- http://www.zdnet.com/article/microsofts-windows-10-store-mail-client-down-for-some/
Updated Aug 10, 11 - "... having problems accessing the Windows 10 Store and a number of Store apps, including Microsoft's new Mail client, for more than a day:
> http://zdnet2.cbsistatic.com/hub/i/r/2015/08/09/6500f82d-e2ca-4bcc-85f7-bdd8738e5bb1/resize/770x578/f03d307cee48206e18f434fbefba03f4/win10storedown.jpg "
:fear::fear: :mad:
AplusWebMaster
2015-08-13, 14:56
FYI...
Fake 'Invoice Bristan' SPAM – PDF malware
- http://myonlinesecurity.co.uk/invoice-i623792760-bristan-fake-pdf-invoice-malware/
13 Aug 2015 - "'Invoice I623792760' (Random characters and numbers) pretending to come from Bristan Documents <Prism@ bristan .com> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Invoice-I623792760.png
13 August 2015: INVOICE_I623792760.zip: Extracts to: INVOICE_I9288320.exe
Current Virus total detections: 1/57*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3eb08a1fc4c27ecc5bb1e512327fc645076b00c3a62555871d8b8ed395517c79/analysis/1439455676/
___
Fake 'Incident' RBS SPAM – doc malware
- http://myonlinesecurity.co.uk/re-incident-im07298646-word-doc-malware/
13 Aug 2015 - "'RE: Incident IM07298646' (random numbers) pretending to come from RBS <secure.message@ rbs .co.uk> with a malicious word doc attachment is another one from the current bot runs... This particular version pretends to be signed with an RSA secure key and you need to enable editing and macros to see the content... DO NOT follow the advice they give to enable macros or enable editing to see the content:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/RSA-key-protected-view.png
13 August 2015: AccountDocuments.doc - Current Virus total detections: 5/56*
This goes through a convoluted download procedure linking to: http ://hutsul .biz/administrator/components/com_joomlaupdate/rara.txt which is just a simple instruction to download what looks like -Upatre- downloader which will eventually download Dridex banking malware from http ://klosetaffair .com/scripts/jquery-1.8.3.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/c683e3a12ab2e80aa4247a1c8ed6b9c565e0241212bc9730596e69ee54807b57/analysis/1439461278/
** https://www.virustotal.com/en/file/a887578ad7657b18d3b889a53ed123c30ba3d9b8c5d6795723555ee7333ce7ca/analysis/1439461900/
hutsul .biz: 144.76.80.78: https://www.virustotal.com/en/ip-address/144.76.80.78/information/
klosetaffair .com: 192.185.48.205: https://www.virustotal.com/en/ip-address/192.185.48.205/information/
- http://threattrack.tumblr.com/post/126606969628/rbc-secure-webmail-spam
Aug 13, 2015 - Subjects Seen:
RBC Secure Webmail/Courriel secure
Typical e-mail details:
Hello
You have received a secure e-mail, which may contain personal/confidential information.
To read and/or reply to the secure e-mail, please follow the simple steps below:
· Double click on the attached Click2View.zip
IMPORTANT:
1.) You must be connected to the Internet to view the secure e-mail.
2.) Please ONLY reply from the above link. DO NOT reply by clicking the “reply” option as this will not be secured.
Malicious File Name and MD5:
Click2View.scr (51cabd5eb93920043db1b18cf163b108)
Tagged: RBC, Upatre
___
Fake 'Notice of payment' SPAM – PDF malware
- http://myonlinesecurity.co.uk/notice-of-payment-national-bank-of-canada-fake-pdf-malware/
13 Aug 2015 - "'Notice of payment' pretending to come from sac.sbi@ sibn .bnc.ca with a zip attachment is another one from the current bot runs... The email looks like:
You can view and print the notice of payment using the Netscape or Microsoft
Explorer browsers, versions 6.2 and 5.5. You can export and store the
notice of payment data in your spreadsheet by choosing the attached file in
pdf format “.pdf”.
If you have received this document by mistake, please advise us immediately
and return it to us at the following E-mail address: “sac.sbi@ sibn .bnc .ca“.
Thank you.
National Bank of Canada
600 de La Gauchetire West, 13th Floor
Montreal, Quebec H3B 4L2 ...
13 August 2015: PaymentNotice.zip: Extracts to: PaymentNotice.scr
Current Virus total detections: 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a978053fe90cc25dacc95b3f8e71884c88c3757027b98be120f1df46bf80f202/analysis/1439483960/
___
SSL Malvertising Campaign Continues
- https://blog.malwarebytes.org/malvertising-2/2015/08/ssl-malvertising-campaign-continues/
Aug 13, 2015 - "The actors behind the recent Yahoo! malvertising attack are still very much active and able to infect people who browse popular websites. We have been tracking this campaign and noticed that is has recently moved to a new ad network used by many top publishers:
- drudgereport .com 61.8M visits per month
- wunderground .com 49.9M visits per month
- findagrave .com 6M visits per month
- webmaila.juno .com 3.6M visits per month
- my.netzero .net 3.2M visits per month
- sltrib .com 1.8M visits per month
The malvertising is loaded via AdSpirit .de and includes a -redirection- to an Azure website. Note how both URLs are using HTTPS encryption, making it harder to detect the malicious traffic at the network layer:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/malvertising.png
Redirection chain
Publisher’s website
https ://pub.adspirit .de/adframe.php?pid=[redacted]
https ://pr2-35s.azurewebsites .net/?=pr2-35s-981ef52345
abcmenorca .net/?xvQtdNvLGcvSehsbLCdz
Angler Exploit Kit...
We informed the ad network and although they did not immediately get back to us, the rogue advert was taken down."
Update 08/14: The campaign has -moved- to another advertiser (AOL) and new Azure domain:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/ebayadvertisement.png
abcmenorca .net: 88.198.188.158:
- https://www.virustotal.com/en/ip-address/88.198.188.158/information/
Country: DE
Autonomous System: 24940 (Hetzner Online AG)
Diagnostic page for AS24940 (HETZNER-AS)
- https://www.google.com/safebrowsing/diagnostic?site=AS:24940
"... over the past 90 days, 2335 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2015-08-13, and the last time suspicious content was found was on 2015-08-13... this network has hosted sites that have distributed malicious software in the past 90 days. We found 224 site(s)... that infected 837 other site(s)..."
:fear: :mad:
AplusWebMaster
2015-08-14, 16:57
FYI...
Fake 'Invoice' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/invoice-bristol-rope-twine-co-word-doc-or-excel-xls-spreadsheet-malware/
14 Aug 2015 - "'Invoice Bristol Rope & Twine Co' pretending to come from Roger Luke <rogerluke@ bristolrope .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be -blank- or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
The email looks like:
Thank you for your order. Your Invoice – 14/0238 – from Bristol Rope &
Twine Co is attached.
14 August 2015: 140238.XLS - Current Virus total detections: 6/57*
... Downloads Dridex banking malware from http ://buero-kontierservice .de/7656/4563.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f299af94bcb39bbcad5668ac9e7d0591ec7c6d90be2332f8fcbcbb8588be41d7/analysis/1439545269/
** https://www.virustotal.com/en/file/57bde530100143b81c804d5cd9082aab2f42c7f1f8e11f5c5c37d41a433cf20b/analysis/1439545437/
... Behavioural information
TCP connections
62.152.36.25: https://www.virustotal.com/en/ip-address/62.152.36.25/information/
2.18.213.90: https://www.virustotal.com/en/ip-address/2.18.213.90/information/
buero-kontierservice .de: 81.169.145.157: https://www.virustotal.com/en/ip-address/81.169.145.157/information/
___
Fake 'Account management' SPAM – PDF malware
- http://myonlinesecurity.co.uk/account-management-was-limited-jpmorgan-chase-bank-fake-pdf-malware/
14 Aug 2015 - "'Account management was limited' pretending to be a message from JPMorgan Chase Bank with a zip attachment is another one from the current bot runs... Other subjects in this malware run include:
Personal account access has been minimized
Bank account control has been minimized
Personal account management had been restricted
Bank account access was blocked ...
The email looks like:
Dear Bank member,
Please consider this e-mail alert highly urgent. Kindly note that our
security department has detected the attempt to withdraw money from Your
account without confirmation.
As a security measure the bank had to restrict access to the account
until we get relevant request from the signatory. Please see attached
the document to be filled in order to get full access to the account.
Peter Malcolm,
Security Department Specialist
JPMorgan Chase Bank PLC
14 August 2015: Formsheet_to_be_filled in_.zip: Extracts to: Formsheet_to_be_executed_.exe
Current Virus total detections: 2/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6b18f506d572f8f422a5568a84797ce355aedb897353310eb30d959986565e31/analysis/1439572799/
:fear::fear: :mad:
AplusWebMaster
2015-08-17, 22:30
FYI...
Multi-language Tech Support Scams
- https://blog.malwarebytes.org/fraud-scam/2015/08/the-multi-language-tech-support-scam-is-here/
Aug 17, 2015 - "The Microsoft tech support scam has been going on for -years- starting with cold calls originating from India. Over time fake websites and pop ups warning of infections for Windows, Mac, Android and even iOS users were created. The vast majority of victims are from the U.S., Canada, the U.K., Australia, South Africa and New Zealand; in essence countries where English is the primary language spoken. This is about to change though, as tech support scammers are tapping into brand new markets in Europe but also Japan... The latest iteration we uncovered is targeting -multiple- new countries and considerable efforts were spent to make the templates look professional and authentic.
New targets:
France (population 66 M)
Spain (population 46 M)
Germany (population: 81 M)
Japan (population: 126 M)
... fraudulent pages typically show up via -malvertising- campaigns or as part of a bundle within Potentially Unwanted Programs... Translation to English:
' Warning! A virus has been detected on your computer. Please call the number provided immediately to remove adware, spyware and viruses from your computer. Seeing this message means that all your personal information, pictures, passwords and credit card details are at risk and vulnerable to attacks. Do not use the Internet, do not connect to any website or make any purchase until you call the phone number provided.'
Actual native speakers: We called one of the numbers for the French campaign and talked with an agent that spoke fluent French. He turned out to be working from Québec, Canada...
Avoiding the scam: The best protection against these scams is awareness. Please pass the word around to family and friends, especially older ones or those not computer savvy. We also have a resource page* with plenty of information that is well worth a read. What we can say looking back at all these years since the tech support scams started is that crooks have been able to adapt the con, often times getting inspired by actual malware authors and their practices (i.e. Browlock, fake BSOD, etc…). This latest twist is without a doubt going to have a serious impact on countries that have never really experienced tech support scams before. Not only are people not prepared for it, but also the fraudster will appear genuine by speaking the local tongue..."
* https://blog.malwarebytes.org/tech-support-scams/
:fear::fear:
AplusWebMaster
2015-08-19, 13:41
FYI...
Fake 'SHIPMENT NOTICE' SPAM – PDF malware
- http://myonlinesecurity.co.uk/shipment-notice-safilo-com-fake-pdf-malware/
19 Aug 2015 - "'SHIPMENT NOTICE' pretending to come from serviceuk@ safilo .com with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/safilo-SHIPMENT-NOTICE.png
19 August 2015: ship20150817.zip: Extracts to: ship20150817.exe
Current Virus total detections: 2/54* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/b936cf05514ede49c63a732717ac901d22d3038e46a5820d7955f55c1ef7d6d0/analysis/1439977857/
- http://blog.dynamoo.com/2015/08/malware-spam-shipment-notice.html
19 Aug 2015 - "... the malware attempts to phone home to:
megapolisss006 .su/go/gate.php
.SU (Soviet Union) domains are bad news in general, if you can I would recommend blocking traffic to -all- of them. This domain is hosted on the following IPs:
195.2.88.196 (Zenon N.S.P., Russia)
94.229.22.39 (Bashrtcomm LIR, Russia)
94.229.22.42 (Bashrtcomm LIR, Russia)
You might want to consider blocking:
195.2.88.0/24
94.229.16.0/21
This though is the recommended minimum blocklist:
195.2.88.196
94.229.22.39
94.229.22.42 ..."
___
Fake 'lawsuit' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/wtf-is-thislawsuit-word-doc-or-excel-xls-spreadsheet-malware/
19 Aug 2015 - "'wtf is this?lawsuit?' coming from random names and random email addresses with a malicious word doc attachment is another one from the current bot runs... This email has what appears to be a genuine word doc or Excel XLS spreadsheet attached which is malformed and contains a macro script virus... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be -blank- or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
The email looks like:
why have you sued me? wtf is this?
i am attaching the subpoena
19 August 2015: subpoena.doc - Current Virus total detections: 5/54*
Connects to http ://bigdiscountsonline .info/css/_notes/rara.txt which is a simple text instruction to download Dridex banking malware from http ://allthatandmore .info/css/_notes/pa.exe (VirusTotal**). It also connects to http ://bigdiscountsonline .info/css/_notes/8179826378126.txt which is a VBS downloader (VirusTotal***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/61f94cafd9a0186dcc2f50bd907f712ddda5a284fe8900543014177c9bf484b9/analysis/1439998392/
** https://www.virustotal.com/en/file/a0d84fe3721c23db1de2c9b8952ccbb3d66b0eed1c27659cd60bee73ba36d6f9/analysis/1439996382/
... Behavioural information
TCP connections
148.251.34.82: https://www.virustotal.com/en/ip-address/148.251.34.82/information/
62.149.142.168: https://www.virustotal.com/en/ip-address/62.149.142.168/information/
*** https://www.virustotal.com/en/file/6097eee70a23b8912d36a70f42b0972bd34e4bda2debd6c9e47758b1fff5e43e/analysis/1439995932/
bigdiscountsonline .info: 97.74.4.87: https://www.virustotal.com/en/ip-address/97.74.4.87/information/
allthatandmore .info: 97.74.4.87
___
Out of band I/E patch - all versions...
- http://myonlinesecurity.co.uk/out-of-band-emergency-patch-for-all-versions-of-internet-explorer-on-windows-18-august-2015/
18 Aug 2015
>> https://forums.spybot.info/showthread.php?862-Microsoft-Alerts&p=465708#post465708
:fear::fear: :mad:
AplusWebMaster
2015-08-20, 12:52
FYI...
Fake 'Shared from Docs app' SPAM – xls Malware
- http://myonlinesecurity.co.uk/shared-from-docs-app-excel-xls-spreadsheet-malware/
20 Aug 2015 - "'Shared from Docs app' coming from Admin at random email addresses with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be -blank- or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
The Excel spreadsheet in this one looks like this... DO NOT follow their suggestion and enable editing or macros:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/LIST_141114_jpg-2.xls.png
The email is very plain and terse and simply says :
Sent from Mail for Windows 10
20 August 2015: LIST_141114_jpg (2).xls - Current Virus total detections: 4/56*
So far automatic analysis hasn’t retrieved any payload so we are waiting for a manual analysis to be performed. These normally download Dridex banking malware...
Update: we now have managed to get an automatic analysis[2] which gave us: ceece.exe that looks like Dridex but no download location for it (VirusTotal)[3]... We always have problems with automatic analysis when the Doc or LS file is in Russian language and character set... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5e77f6a84ef5179824f2a110a73c10927d32cb8efe306f6d333295a5cbac9467/analysis/1440065594/
2] https://malwr.com/analysis/YzdlYjBjMDFmMTM1NGMwZGE4MjE2ZThlNGU0MTcwMzQ/
3] https://www.virustotal.com/en/file/cfc7d0bab0e11ce1bcdbbf05dc2817933109a5f7523748370a2c000ce4897d4a/analysis/1440066467/
... Behavioural information
TCP connections
62.152.36.25: https://www.virustotal.com/en/ip-address/62.152.36.25/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'new ID and password' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-new-id-and-password-fake-pdf-malware/
20 Aug 2015 - "'Your new ID and password' coming from random names and email addresses with a zip attachment is another one from the current bot runs... The email looks like:
Your ID name and password has been changed according to your request dated August 19, 2015. Check attachment to view the renewed information.
20 August 2015: doc_ad78120.zip : Extracts to: doc_in30541.exe
Current Virus total detections 3/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6f90a6b02b5de4bee197449581a10c8b897aa784e63579ae40e2d0597692a427/analysis/1440069970/
___
Fake 'order not avaliable' SPAM – doc malware
- http://myonlinesecurity.co.uk/we-are-sorry-but-the-product-youve-ordered-is-not-avaliable-now-fake-word-doc-malware/
20 Aug 2015 - "An email saying 'We are sorry but the product you’ve ordered is not avaliable now' with a subject of Order #y0CD3mxQizcBk88ovaw [random characters] coming from random names and email addresses with a zip attachment is another one from the current bot runs... The email looks like:
Good afternoon,
We are sorry but the product you’ve ordered is not avaliable now.
Please fill up the attached form of refund and choose a gift as a token
of our apology for the inconvenience.
Order #fNcszeK2PW9J1rjN
Date sent: Thu, 20 Aug 2015 11:42:51 +0100
Mariam Olson Sr...
-Or-
Good afternoon,
We are sorry but the product you’ve ordered is not avaliable now.
Please fill up the attached form of refund and choose a gift as a token
of our apology for the inconvenience.
Order #4y3Rs24VDxJ8BBW8
Date sent: Thu, 20 Aug 2015 11:45:02 +0100
Carolyn Raynor...
20 August 2015: Order Beier-Swaniawski_fNcszeK2PW9J1rjN.zip: Extracts to: order id283694136_Angus Ferry.exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper word document instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6e57b64a48eda1b367d41502dd4251521cb30799f3b371f236c806d97328f4bf/analysis/1440070000/
___
Fake 'Transport for London' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/08/malware-spam-email-from-transport-for.html
20 Aug 2015 - "This -fake- TfL spam comes with a malicious attachment:
From "Transport for London" [noresponse@ cclondon .com]
Date Thu, 20 Aug 2015 17:04:26 +0530
Subject Email from Transport for London
Dear Customer
Please open the attached file(7887775.zip) to view correspondence from Transport
for London.
If the attachment is in PDF format you may need Adobe Acrobat Reader to read or download
this attachment. If you require Adobe Acrobat Reader this is available at no cost...
Thank you for contacting Transport for London.
Business Operations
Customer Service Representative...
The attachment name seems to vary, in the samples I have seen there is 7887775.zip, 0174458.zip and rather oddly [?var=partorderb].zip. From these I have recovered two malicious samples with a VirusTotal detection rate of 6/56* and 1/57**... Hybrid Analysis reports... show the malware connecting to various malicious and non-malicious IPs, but in particular we see a traffic pattern like this:
93.185.4.90 :12326/2008uk77/jI7tL6q34q/0/61-SP1/0/FDMBEFJBMKBEMM
93.185.4.90 :12326/2008uk77/jI7tL6q34q/41/5/42/FDMBEFJBMKBEMM
These GET requests are a characteristic of Upatre/Dyre. 93.185.4.90 is allocated to C2NET, Czech Republic and I strongly recommend that you -block- it."
* https://www.virustotal.com/en/file/6bd9680283424eb294a6a2b788bac911a15b47eb7f1a251cc6ad501df7e1acff/analysis/1440071767/
** https://www.virustotal.com/en/file/e40a32e6781af530eb6a544b185156d1a25384a78b7771bca52f05744af811f1/analysis/1440071784/
___
Fake 'ACH failed' SPAM – doc malware
- http://myonlinesecurity.co.uk/ach-failed-due-to-technical-error-the-electronic-payments-association-word-doc-malware/
20 Aug 2015 - "'ACH failed due to technical error' pretending to come from The Electronic Payments Association with a malicious word doc attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
This malicious word doc has what pretends to be a RSA encrypted security key and it wants you to enable editing to see the content. This is almost identical to this slightly older version with a different date. Once again DO NOT not enable editing or macros:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/RSA-key-protected-view.png
The email looks like:
ACH PAYMENT REJECTED
The ACH Payment (ID: 49583071624518), recently initiated from your savings account (by you or any other person), was REJECTED by other financial institution.
Rejection Reason: See details in the attached report.
Payment Report: report_49583071624518.doc (Microsoft Word)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2014 NACHA – The Electronic Payments Association
20 August 2015 : report_49583071624518.doc - Current Virus total detections 16/57*
... connects to http ://luckytravelshop .info/wp-content/uploads/2015/05/sasa.txt which tells it to download a Dridex banking malware from http: //tadarokab .com/temp/recent.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/617e96e03ed78aae59ea049c5f856aead2f6cf3ba958aa38629503c6f51fca48/analysis/1440087068/
** https://www.virustotal.com/en/file/2bc39fee6e884348c3490214160e0882cfd0bc416f9b8c4165d93a3307e0ff02/analysis/1440081269/
luckytravelshop .info: 23.229.232.199: https://www.virustotal.com/en/ip-address/23.229.232.199/information/
tadarokab .com: 38.110.76.140: https://www.virustotal.com/en/ip-address/38.110.76.140/information/
___
Fake 'ACH Payment' SPAM – PDF malware
- http://myonlinesecurity.co.uk/ach-payment-notification-logicease-solutions-inc-fake-pdf-malware/
20 Aug 2015 - "'ACH Payment Notification' pretending to come from ap_vendor_pay2@ bankofamerica .com with a zip attachment is another one from the current bot runs...
The email looks like:
LOGICEASE SOLUTIONS INC Vendor:10288253 Pay Dt: 20150820 Pay Ref Num: 2000542353
Your invoice has been processed for payment by Bank of America Corporate Accounts Payable. The following items are included in this payment:
The net amount deposited to account number ending XXXX8014 designated by you is $1843.73
IMPORTANT: AVAILABILITY OF FUNDS FOR WITHDRAWAL IS SUBJECT TO POSTING BY RECEIVING BANK (USUALLY WITHIN THREE BUSINESS DAYS)
Please do not respond to this e-mail. Should you have questions, please contact the Purchasing, Payment & Reimbursement helpline at 888.550.6174...
20 August 2015: Pay_Advice.zip: Extracts to: Pay_Advice.exe
Current Virus total detections 5/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6272900d5bec803b6150d753c0b53b2aa090f0e415d780e7f5cc9be6b964dc3d/analysis/1440085153/
:fear::fear: :mad:
AplusWebMaster
2015-08-21, 14:19
FYI...
Fake 'bank birthday bonus' SPAM - PDF malware
- http://myonlinesecurity.co.uk/our-bank-have-a-birthday-today-so-we-would-like-to-give-you-some-bonuses-as-youre-the-most-valuable-client-of-ours-fake-pdf-malware/
21 Aug 2015 - "A series of emails saying 'Our bank have a birthday today so we would like to give you some bonuses as you’re the most valuable client of ours' with a subject of 'You are our most valued customer. Your ID 23428458 [random numbers]' coming from random names and email addresses with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/You-are-our-most-valued-customer-Your-ID-23428458.png
All these emails have random senders & companies, random phone numbers but the alleged sender matches the name in the body of the email and the name of the attachment.
21 August 2015: Bank-Reagan Bashirian DDS_(278) 789-4975_client-268119023428458.zip:
Extracts to: Bank Client992322638_West Jermainemouth.exe - Current Virus total detections: 2/57*.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3f81ba9dd277971969eab270e00dfcd590a42b41d20ab8123a2369590ab58f06/analysis/1440154416/
___
Fake 'translator job' SCAMs
- http://myonlinesecurity.co.uk/real-translator-jobs-scam/
21 Aug 2015 - "We all see thousands of adverts and get loads of emails offering us jobs. This one caught my eye earlier:
'Earn Up To $315 A Day Translating Words'. Sent by Real Translator Jobs <realtranslatorjobs@ freonjob .org>
The email reads like a godsend for somebody who speaks an extra language and needs a few $$ or ££ but has all the hallmarks of a scam/multi level marketing/pyramid scheme.
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/translator-job-scam.png
... If you follow the links to the website you see http ://www.realtranslatorjobs .com/ and a referrer link at the end of the url. I have blanked out the referrer link so he/she doesn’t get any income from the scam by following links from here:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/translator-jobs-website.png
... The first thing that jumps out at you is:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/home-sidebar-checklist2.jpg
... The only people who get rich and make a lot of money are the originators for this scam and the “affiliates” who promote it and get a commission on every sign up or click through to the website... it will cost you $68 to sign up but there is a special offer for today only for $34 dollars (save 50%!)... don’t fall for it and don’t waste your money. You won’t earn a thing..."
___
Fake 'invoice 2018' SPAM – PDF malware
- http://myonlinesecurity.co.uk/invoice-2018-garry-white-whitechappell-co-uk-fake-pdf-malware/
21 Aug 2015 - "'invoice 2018' pretending to come from Garry White <garry@ whitechappell .co.uk> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/invoice-2018.png
21 August 2015 : CRFC, Invoice 2018.pdf.zip: Extracts to: CRFC, Invoice 2018.pdf.exe
Current Virus total detections: 3/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/229e15d3a63ad632045395f7fee9c0193ccfdeba25c0d5205f382cb2ab57aa83/analysis/1440155507/
___
What is event.swupdateservice .net?
- http://blog.dynamoo.com/2015/08/what-hell-is-eventswupdateservicenet.html
21 Aug 2015 - "... I saw some mysterious outbound traffic to event.swupdateservice .net/event (138.91.189.124 / Microsoft, US). Googling around for the domain came up with some references to malware, but nothing very conclusive. The WHOIS details for the domain are -anonymised- (never a good sign), and the IP address is also used by event.ezwebservices .net which uses similarly -hidden- details. Team Cymru have an analysis* of what is being phoned home to this mystery server, and I found an existing Malwr analysis** referencing the alternate domain. I eventually found the mystery executable in C:\Users\[username]\AppData\Local\SoftUpdate\SoftUpdate.exe on the afflicted machine... The binary itself does not identify its creator. I found various references (such as in this report***) linking this software and the domains to Emaze .com (a "free" presentation tool)... Neither domain identifies itself through the WHOIS details, nor can I find any contact details on either site... I don't like sharing data with commercial operations who are not prepared to fully reveal their identity, and I personally recommend -blocking- traffic to:
visualbee .com: 168.62.20.37: https://www.virustotal.com/en/ip-address/168.62.20.37/information/
emaze .com: 54.83.51.169: https://www.virustotal.com/en/ip-address/54.83.51.169/information/
swupdateservice .net
ezwebservices .net "
* https://totalhash.cymru.com/analysis/?a10211e1a1549147630704aa6cfd89b27bc51970
** https://malwr.com/analysis/MWUzZmM5M2UyN2Q5NGU0M2E4M2U3NTE3MWUzNWNhZjE/
*** https://www.hybrid-analysis.com/sample/f479a3779efb6591c96355a55e910f6a20586f3101cd923128c764810604092f?environmentId=1
138.91.189.124: https://www.virustotal.com/en/ip-address/138.91.189.124/information/
___
Fake Malwarebytes?...
- https://blog.malwarebytes.org/online-security/2015/08/exploring-an-mbam-for-windows-10-website/
Aug 21, 2015 - "Here at Malwarebytes, we offer support for a wide variety of Windows Operating Systems – from XP right up to Windows 10. The latter OS is the starting point for this blog post, with a website located at: malwarebytes-windows10(dot)com which seemed to offer up a “Windows 10 ready” version of Malwarebytes Anti-Malware:
Screenshot: https://blog.malwarebytes.org/wp-content/uploads/2015/08/mbam101.jpg
This installer is -not- ours, so it’s clear that this is a download manager of some sort, and – one would hope – gave the downloader a copy of MBAM at the end of the process. However, the download kept breaking, so we couldn’t get any further than the initial installer splash...
Since we started looking into this, the site has also now apparently rolled down the shutters:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/mbam104.jpg
However, the EULA / Privacy Policy on the installer took us to a site located at
qpdownload(dot)com which also offered up a variety of programs including Adblock Plus and yet another MBAM:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/mbam105.jpg
... Users of Malwarebytes Anti-Malware will find we detect the “Download Manager” as PUP.Optional.InstallCore.A. Download sites can be cool, but it seems counter-intuitive to offer products designed to reduce advertisements / advertising software on your desktop alongside... adverts..."
malwarebytes-windows10(dot)com: 107.180.24.239: https://www.virustotal.com/en/ip-address/107.180.24.239/information/
qpdownload(dot)com: 96.43.136.163: https://www.virustotal.com/en/ip-address/96.43.136.163/information/
___
Malvertising on Telstra Media Homepage ...
- https://blog.malwarebytes.org/news/2015/08/telstra-medias-homepage-pushes-malvertising/
Aug 21, 2015 - "The media home page of Australia’s -largest- telecommunications company, Telstra, was pushing some malvertising similar to the attack we just documented*...
* https://blog.malwarebytes.org/malvertising-2/2015/08/malvertising-hits-online-dating-site-plentyoffish/
The infection chain goes like this:
media.telstra .com.au/home.html (Publisher)
frexw .co.uk/public/id-55048502/300×250.php (Malvertising)
gp-urti .info/bard-vb4735/vcyz-46820t.js (Malicious redirector)
goo .gl/s3LrVw (Abuse of Google URL shortener to load an exploit kit)
augpdoiof .info/document.shtml?AfWlx={redacted} (Nuclear Exploit Kit)
>> https://blog.malwarebytes.org/wp-content/uploads/2015/08/telstra_graph.png
While we did not collect the particular sample dropped in this campaign, it is quite likely to be the Tinba banking Trojan... The Google link has now been disabled:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/google.png
The malvertising attack lasted for a few days and was last seen on the 17th."
augpdoiof .info: 45.32.238.228: https://www.virustotal.com/en/ip-address/45.32.238.228/information/
gp-urti .info:
104.24.120.10: https://www.virustotal.com/en/ip-address/104.24.120.10/information/
104.24.121.10: https://www.virustotal.com/en/ip-address/104.24.121.10/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-24, 01:32
FYI...
Neutrino Campaign leveraging WordPress, Flash for CryptoWall
- http://research.zscaler.com/2015/08/neutrino-campaign-leveraging-wordpress.html
Aug 20, 2015 - "Neutrino Exploit Kit... in the past few days we've seen a massive uptick in the use of the kit. The cause for this uptick appears due to widespread WordPress site compromises... the image below illustrates the components involved in this campaign:
> https://4.bp.blogspot.com/-f2_q0ogBa9I/VdZGAFpgoHI/AAAAAAAAAYU/s7NvxOgAHZs/s1600/WordPress_Neutrino_nexus.PNG
... there are multiple recent changes in the Neutrino code, some that are normally characteristics of Angler Exploit Kit, but others that remain unique to Neutrino... The goal of this campaign is to completely and fully compromise the site, which includes adding a webshell, harvesting credentials, and finally injecting an iframe that loads a Neutrino landing page... the primary IP for the observed Neutrino landing pages is '185.44.105.7' which is owned by VPS2DAY .com. Many of the domains pointing to that IP utilize 'xyz', 'ga', 'gq', and 'ml' TLDs. Taking a look at the whois data for some of these domains, a common attribute seems to be the name 'Max Vlapet' for .XYZ domains... This campaign also reconfirms that Neutrino Exploit Kit activity is on the rise and is still a major player in the exploit kit arena..."
- http://it.slashdot.org/story/15/08/22/030246/wordpress-hacks-behind-surging-neutrino-ek-traffic
Aug 22, 2015
185.44.105.7: https://www.virustotal.com/en/ip-address/185.44.105.7/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-24, 14:18
FYI...
Fake 'Message from scanner' SPAM – PDF malware
- http://myonlinesecurity.co.uk/message-from-scanner-fake-pdf-malware/
24 Aug 2015 - "'Message from scanner' pretending to come from scanner.coventrycitycentre@ brianholt .co.uk with a zip attachment but a completely -empty/blank- body of the email is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Message-from-scanner.png
24 August 2015: Sscanner15081208190.zip: Extracts to: Sscanner15081208190.exe
Current Virus total detections: 3/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/891f5c4ca2a835e32b773b6179b21e9737000a862bce81229fbc8b8930992e38/analysis/1440408248/
- http://blog.dynamoo.com/2015/08/malware-spam-message-from-scanner.html
24 Aug 2015 - "... malicious executable Sscanner15081208190.exe embedded into the attachment Sscanner15081208190.zip . This executable has a detection rate of just 5/54*. The Hybrid Analysis report** shows the malware POSTing to:
smboy .su/mu/tasks.php
.SU (Soviet Union) domains are almost always bad news. If you can block them on your web filter then I recommend that you do so. This particular site is hosted on 95.172.146.73 (RTComm-Sibir, Russia). The network range of 95.172.146.0/23 does seem to contain some legitimate Russian-language sites, but you might want to -block- the whole range to be on the safe side. The payload is unknown, but typically malware like this will drop either the Dyre banking trojan or some sort of ransomware."
* https://www.virustotal.com/en/file/891f5c4ca2a835e32b773b6179b21e9737000a862bce81229fbc8b8930992e38/analysis/1440414098/
** https://www.hybrid-analysis.com/sample/891f5c4ca2a835e32b773b6179b21e9737000a862bce81229fbc8b8930992e38?environmentId=1
95.172.146.73: https://www.virustotal.com/en/ip-address/95.172.146.73/information/
___
German site dwdl .de -hacked- serving malware via 94.142.140.222
- http://blog.dynamoo.com/2015/08/popular-german-wesite-dwdlde-hacked.html
24 Aug 2015 - "... German media website dwdl .de has been -hacked- and is serving up malware, according to this URLquery report*. URLquery's IDS function detects what looks like the RIG Exploit kit:
> https://3.bp.blogspot.com/-pFLpyrW75e8/VdslyFeXKgI/AAAAAAAAG50/onTPoRZf0So/s1600/dwdl-de.png
The exploit is injected code pointing to a server at 94.142.140.222 (Marosnet Telecommunication Company, Russia) which in the example is using filter.michiganbeerhops .com which is a -hijacked- GoDaddy domain. The exploit only appears to work if the site is accessed via a search engine, which looks like a classic .htaccess hack. URLquery's script relationship chart shows this in action:
> https://3.bp.blogspot.com/-XrAJ6DxnJcM/VdsoSNqVIdI/AAAAAAAAG6A/meF5SsbUOeA/s640/domain_graph.php.gif
VirusTotal** gives an overview of other malicious domains on this server. It indicates that the following domains have been -hijacked- and malicious subdomains set up..."
(Long list at the dynamoo URL - top of this post.)
* http://urlquery.net/report.php?id=1440424952903
** 94.142.140.222: https://www.virustotal.com/en/ip-address/94.142.140.222/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-25, 13:04
FYI...
Fake 'Visa Card' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/08/malware-spam-visa-card-aug-2015.html
25 Aug 2015 - "This -fake- financial spam does not come from Ellesemere Engineering but is in fact a simple forgery with a malicious attachment:
From [david@ ellesmere .engineering]
To "'Sharon Howarth'" [sharon@ ellesmere .engineering]
Date Tue, 25 Aug 2015 09:52:47 +0200
Subject Visa Card Aug 2015
Visa Card payments this month
---
This email has been checked for viruses...
Attached is a document Visa Card Aug 2015.docm which I have seen in three different versions, containing one of -three- malicious macros... that then attempt to download a malicious binary from one of the following locations:
http ://e-projekt.ns1.internetdsl .pl/45gf3/7uf3ref.exe
http ://nathalieetalain.free .fr/45gf3/7uf3ref.exe
http ://landrevie.g.free .fr/45gf3/7uf3ref.exe
This executable has a detection rate of just 1/55* and the Malwr report** shows network traffic to:
91.239.232.9 (Hostpro Ltd, Ukraine)
I strongly recommend that you -block- that IP address. The payload to this is almost definitely the Dridex banking trojan."
* https://www.virustotal.com/en/file/d9b5eca403c6298be00a4854bc279e0046930cbb3dedf59926672b0207fc0f78/analysis/1440489790/
... Behavioural information
TCP connections
91.239.232.9: https://www.virustotal.com/en/ip-address/91.239.232.9/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
** https://malwr.com/analysis/YzFkMGQyNTdjYzdmNGFjNjk1NTc4ZjdjMjRjODg5NDY/
internetdsl .pl: 80.48.169.1: https://www.virustotal.com/en/ip-address/80.48.169.1/information/
free .fr: 212.27.48.10: https://www.virustotal.com/en/ip-address/212.27.48.10/information/
- http://myonlinesecurity.co.uk/visa-card-aug-2015-ellesmere-engineering-word-doc-macro-malware/
25 Aug 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/Visa-Card-Aug-2015.png
25 August 2015: Visa Card Aug 2015.docm - Current Virus total detections 7/55*
Downloads Dridex banking malware.
* https://www.virustotal.com/en/file/9d7f5f07fe16900b082bf5f38ef5f900de12bced7147ba60fa2775f4f6b22b80/analysis/1440499540/
___
Fake 'Dropbox' SPAM - leads to malware
- http://blog.dynamoo.com/2015/08/malware-spam-updatevacationsschedule092.html
25 Aug 2015 - "This -fake- Dropbox email leads to malware, hosted on the sharing service sugarsync .com.
From: June Abel via Dropbox [no-reply@ dropbox .com]
Date: 25 August 2015 at 12:59
Subject: June Abel shared "UPDATE_VACATIONS_SCHEDULE_09_2015.pdf" with you
June used Dropbox to share a file with you!
Click here to download.
© 2015 Dropbox
I have seen three different samples with different download locations:
https ://www.sugarsync .com/pf/D3941255_827_052066225?directDownload=true
https ://www.sugarsync .com/pf/D160756_82_6104120627?directDownload=true
https ://www.sugarsync .com/pf/D2694666_265_638165437?directDownload=true
In each case, the binary downloaded is identical and has a VirusTotal detection rate of 3/55*. Analysis is pending, but the payload appears to be the Dyre banking trojan.
UPDATE: The Hybrid Analysis report** shows traffic to 197.149.90.166 (Cobranet, Nigeria) which I recommend you block."
* https://www.virustotal.com/en/file/8f1d2ccdce1e260b4ec648a71210250eedaa8af5c9d8a7e64366343d9e384a4f/analysis/1440506327/
** https://www.hybrid-analysis.com/sample/8f1d2ccdce1e260b4ec648a71210250eedaa8af5c9d8a7e64366343d9e384a4f?environmentId=1
sugarsync .com: 74.201.86.21: https://www.virustotal.com/en/ip-address/74.201.86.21/information/
197.149.90.166: https://www.virustotal.com/en/ip-address/197.149.90.166/information/
___
Fake 'Invoice 26949' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/08/malware-spam-invoice-26949-from-i-spi.html
25 Aug 2015 - "My spam traps did not collect the body text from this message, so all I have is headers. However, this -fake- financial email is not from i-Spi Ltd and is instead a simple forgery with a malicious attachment:
From [sales@ ispitrade .com]
Date Tue, 25 Aug 2015 20:37:09 +0800
Subject Invoice 26949 from I - SPI Ltd
Attached is a file Inv_26949_from_I__SPI_Ltd_7888.doc which actually comes in several different versions... which contains a malicious macro... that downloads an executable from one of the following locations:
http ://landrevie.g.free .fr/45gf3/7uf3ref.exe
http ://e-projekt.ns1.internetdsl .pl/45gf3/7uf3ref.exe
http ://nathalieetalain.free .fr/45gf3/7uf3ref.exe
http ://claudio.locatelli .free .fr/45gf3/7uf3ref.exe
http ://spitlame.free .fr/45gf3/7uf3ref.exe
http ://nathalieetalain.free .fr/45gf3/7uf3ref.exe
This Hybrid Analysis report* shows network traffic to:
91.239.232.9 (Hostpro Ltd, Ukraine)
This is the same bad IP as found in this earlier spam run**, I recommend that you block it. The payload here is almost definitely the Dridex banking trojan."
* https://www.hybrid-analysis.com/sample/5e4b69e8ce31c8cf51cc6d5b49651bec9e239b7616f81744b656b7228a63a065?environmentId=1
** http://blog.dynamoo.com/2015/08/malware-spam-visa-card-aug-2015.html
- http://myonlinesecurity.co.uk/invoice-26949-from-i-spi-ltd-word-doc-macro-malware/
25 August 2015: Inv_26949_from_I__SPI_Ltd_7888.doc "... Downloads the -same- Dridex banking malware as described in today’s earlier malspam run of malicious word docs*..."
* http://myonlinesecurity.co.uk/visa-card-aug-2015-ellesmere-engineering-word-doc-macro-malware/
___
Browsefox variant High Stairs - browser hijackers
- https://blog.malwarebytes.org/security-threat/2015/08/browsefox-variant-high-stairs/
Aug 25, 2015 - "Browsefox aka Sambreel aka Yontoo is a family of browser hijackers. When advertised they promise to “customize and enhance your interaction with the websites you visit”, but in reality they are almost never a users choice install. They come -bundled- with other software at many major download sites and at best you will see this screen when the installation starts:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/main1.png
High Stairs is one of the latest additions to this family. It is being offered as a browser extension -without- making clear what it does for the user. If you want to have a look at the EULA and Privacy Policy you will have to visit their website:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/EULA.png
... The EULA clearly states that it allows the “Software” to use -any- means imaginable to deliver advertisements and that it will collect your data. The Privacy Policy lets you know that they will use, share and sell those data to any and all parent, subsidiary or affiliate companies. Bottom line, as long as it brings in cash. Browser hijackers of this family are VM aware, meaning they will not do a full install if they detect they are run on a Virtual Machine. Sometimes the files are downloaded and put in place, but the extensions are not installed and enabled. The -hijackers- from this family do provide browser extensions for IE, Firefox, Chrome and Opera (and probably more)... invisible iframes can be used to deliver anything and everything to your computer, ranging from advertisements (which is very likely in this case) to (in theory) exploit kits. In theory in this case means, that we haven’t seen any exploit kits being delivered through the advertisements these PUPs deliver, but if the PUP has a vulnerability or their network is compromised a third party could use this in the same manner as has been done with malvertisements on legitimate sites. This browser hijacker is relatively easy to remove. Other variants have been known to install services as well, making them a bit harder to tackle. Unfortunately “High Stairs” is not alone. We see a new Sanbreel variant at least a few times every week. The installer and the installed files are all detected as 'PUP.Optional.HighStairs.A'. Logs, more screenshots and removal instructions for “High Stairs” can be found on our forums*..."
* https://forums.malwarebytes.org/index.php?/topic/171926-removal-instructions-for-high-stairs/
:fear::fear: :mad:
AplusWebMaster
2015-08-26, 13:47
FYI...
Fake 'Scanned image - MX-2600N' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/scanned-image-from-mx-2600n-word-doc-macro-malware/
26 Aug 2015 - "'Scanned image from MX-2600N' pretending to come from noreply@ your email domain with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
The email looks like:
Reply to: noreply@ securityandprivacy .co.uk <noreply@ securityandprivacy .co.uk>
Device Name: Not Set
Device Model: MX-2600N
Location: Not Set
File Format: DOC MMR(G4)
Resolution: 200dpi x 200dpi
Attached file is scanned image in DOC format.
Use Microsoft(R)Word(R) of Microsoft Systems Incorporated to view the document.
26 August 2015: noreply@ securityandprivacy.co.uk_20150826_181106.doc
Current Virus total detections 7/57*:
Downloads Dridex banking malware from one of these locations:
detocoffee.ojiji .net/45ygege/097uj.exe (virus Total**)
students.johnbryce .co.il/nagare/45ygege/097uj.exe
groupedanso .fr/45ygege/097uj.exe
asterixpr.republika .pl/45ygege/097uj.exe
fotolagi .com/45ygege/097uj.exe
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/38736bb58af7e8a640656a661129d0150dd3a46c996f9fb91a6586108333c17d/analysis/1440582748/
** https://www.virustotal.com/en/file/e9167fdb431320b249a7874511986f668cb52bd62d3eb20ed2e74d9fe8c7102a/analysis/1440583201/
... Behavioural information
TCP connections
91.239.232.9: https://www.virustotal.com/en/ip-address/91.239.232.9/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
- http://blog.dynamoo.com/2015/08/malware-spam-scanned-image-from-mx.html
26 Aug 2015 - "... The email appears to come from the victim's own domain, but it does not. The "From" address on email is extremely easy to forge. So far I have seen three different malicious attachments, each one in the format noreply@ victimdomain.com_20150826_181106.doc with detection rates of around 7/56 [1] [2] [3] containing one of three malicious macros... which attempt to download a malicious component from one of the following locations:
http ://fotolagi .com/45ygege/097uj.exe
http ://asterixpr.republika .pl/45ygege/097uj.exe
http ://detocoffee.ojiji .net/45ygege/097uj.exe
This malicious binary currently has a VirusTotal detection rate of just 2/54. Automated analysis... shows network traffic to 91.239.232.9 (Hostpro Ltd, Ukraine) which has been used in serveral attacks recently. The payload is almost definitely the Dridex banking trojan."
1] https://www.virustotal.com/en/file/7bd4d8d48a4e64ee8bdd8814c805a8a5ff69ad0fe8200b86a10bfbe81e193b9d/analysis/1440583485/
2] https://www.virustotal.com/en/file/8143e0f0570c67142b7c9fb872e9723e409559711a3e23a0359cd1f21ddce90e/analysis/1440583498/
3] https://www.virustotal.com/en/file/5ce26cd8d2cf8df20f826384c37ab854f4dd2aa49d62b9dfdf89bbffb0c237bc/analysis/1440583515/
___
Fake 'invoice A4545945' SPAM - PDF malware
- http://myonlinesecurity.co.uk/screwfix-copy-of-invoice-a4545945-please-find-your-invoice-attached-fake-pdf-malware/
26 Aug 2015 - "'Copy of invoice A4545945. Please find your invoice attached' pretending to come from Screwfix Direct <online@ screwfix .com> with a zip attachment is another one from the current bot runs... The email looks like:
Dear Customer
Thank you for shopping at Screwfix.
As requested please find attached a copy of invoice: A4545945.
You will require a PDF file reader in order to view and print the invoice. Should your invoice not be attached please email invoice@ screwfix .com ensuring that you quote your order reference.
Please do not reply to this e-mail.
If you have any queries, please quote the Invoice Number: A4545945, when contacting us:
Phone: 0500 41 41 41 (03330 112 320 from a mobile) UK based Contact Centre
E-mail: online@ screwfix .com
Write to: Screwfix, Trade House, Mead Avenue, Yeovil, BA88 8RT ...
26 August 2015: Invoice_A3176864.zip: Extracts to: Invoice.scr
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a3bc75083b29d70f6c156d3f987bbe654b56f58708755528ecc7eeab13eee30a/analysis/1440580919/
___
Fake 'Invoices from UBM' SPAM - PDF malware
- http://myonlinesecurity.co.uk/your-invoices-from-ubm-fake-pdf-malware-2/
26 Aug 2015 - "'Your Invoices from UBM' pretending to come form UBM (UK) Limited <ubm@ ubm .com> with a zip attachment is another one from the current bot runs... The email looks like:
Dear Customer,
Please find attached your invoice(s) from UBM. If you have any queries regarding the invoice, payment or service delivered please don’t hesitate to contact us on the details below.
Regards,
UBM Receivables Team.
Tel : +44 207 921 8506 (21627)
Email : bogumila.murzyn@ ubm .com
Fax :
****PLEASE DO NOT REPLY TO THE EMAIL ADDRESS ubm@ ubm .com AS IT IS NOT MONITORED**** ...
26 August 2015:65550757_Invoices_26-AUG-2015.zip:
Extracts to: 65550757_Invoices_26-AUG-2015.scr ... which is the -same- Upatre malware that is described in today’s other malspam run with Zip attachments*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* http://myonlinesecurity.co.uk/screwfix-copy-of-invoice-a4545945-please-find-your-invoice-attached-fake-pdf-malware/
___
Fake 'new fax delivery svc' – PDF malware
- http://myonlinesecurity.co.uk/we-are-a-new-fax-delivery-service-fake-pdf-malware/
26 Aug 2015 - "A series of emails saying 'We are a new fax delivery service' with the subject reading Fax #[ random characters] from [random name] with a zip attachment is another one from the current bot runs... The email looks like:
You have a fax.
Data sent: Wed, 26 Aug 2015 14:08:41 +0000
TO: [redacted]
*********************************
We are a new fax delivery service – Walker-Gerlach.
Our company develops rapidly and services remain fastest and open to everyone.
As our slogan goes: “Fast. Cheap. Best quality.”
*********************************
-Or-
You have a fax.
Data sent: Wed, 26 Aug 2015 14:06:21 +0000
TO: [REDACTED]
*********************************
We are a new fax delivery service – Hirthe-Bayer.
Our company develops rapidly and services remain fastest and open to everyone.
As our slogan goes: “Fast. Cheap. Best quality.”
*********************************
26 August 2015: fax_jxJ3O9_Walker-Gerlach_Colton Leffler.zip
Extracts to: Invoice East Marta.exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/87a540174bab81d657b678ef03872a70113db3989609d290776773e9f8f0d62e/analysis/1440598735/
- http://blog.dynamoo.com/2015/08/fake-fax-spam-spoofs-multiple-senders.html
26 Aug 2015 - "... - fake- fax spam comes from random senders - company names and attachment names vary from spam to spam... Attached is a ZIP file combining various elements from the spam (for example, in this case it was fax_AhnxlQ8_Heaney, Vandervort and Hilll_Donny Kub.zip). This contains a malicious executable (e.g. Invoice Lake Janeview.exe) which currently has a 2/56* detection rate at VirusTotal. The Hybrid Analysis report** shows it phoning home to:
197.149.90.166 /260822U/Yd1D3h1R87/0/61-SP1/0/FDMBEFJBMKBEMM
197.149.90.166 /260822U/Yd1D3h1R87/41/5/42/FDMBEFJBMKBEMM
This pattern marks the malware out as being Upatre/Dyre. 197.149.90.166 is an IP address belonging to Cobranet in Nigeria which was also used in a similar attack yesterday.*** "
* https://www.virustotal.com/en/file/93b1f8dbe6a531475b90f1d426e918790960f924180ec3c172f037342f00a4d1/analysis/1440599515/
** https://www.hybrid-analysis.com/sample/93b1f8dbe6a531475b90f1d426e918790960f924180ec3c172f037342f00a4d1?environmentId=1
*** http://blog.dynamoo.com/2015/08/malware-spam-updatevacationsschedule092.html
___
Bank of America Invoice Spam
- http://threattrack.tumblr.com/post/127641667433/bank-of-america-invoice-spam
Aug 26, 2015 - "Subjects Seen
Invoice Annabell Yost
Typical e-mail details:
Dear Customer,
Invoice14768170 from Annabell Yost.
Sincerely,
Ellsworth Abbott
1-100-532-7314
Bank of America PLC.
Screenshot: https://40.media.tumblr.com/b3655d7b077d99d0da5d88c9fce8ba49/tumblr_inline_ntp5auEovG1r6pupn_500.png
Malicious File Name and MD5:
InvoiceFaker__Number.number(5)info_324986219861.exe (276646dc44bb3a2e4bf7ba21f207b5be)
Tagged: bank of america, Upatre
:fear::fear: :mad:
AplusWebMaster
2015-08-27, 13:14
FYI...
Angler Exploit Kit strikes MSN.com via Malvertising Campaign
- https://blog.malwarebytes.org/malvertising-2/2015/08/angler-exploit-kit-strikes-on-msn-com-via-malvertising-campaign/
Aug 27, 2015 - "The same ad network – AdSpirit .de – which was recently abused in malicious advertising attacks against a slew of top media sites was caught serving malvertising on MSN .com. This is the work of the -same- threat actors that were behind the Yahoo! malvertising. The incident occurred when people who where simply browsing MSN’s news, lifestyle or other portals were served with a malicious advertisement that silently loaded the Angler exploit kit and attempted to infect their computers. The ad request came from AppNexus, which loaded the booby-trapped advert from AdSpirit and the subsequent malvertising chain.
Infection chain:
msn .com/en-us/news/politics/dozens-of-clinton-emails-were-classified-from-the-start-us-rules-suggest/ar-BBlXPkl?ocid=iehp (publisher)
lax1.ib.adnxs .com/{redacted} (AppNexus Ad network)
pub.adspirit .de/adframe.php?pid=7&ord=[timestamp]prdclick_0 (AdSpirit Ad network)
trkp-a1009.rhcloud .com/?tr28-0a22 (OpenShift redhat Redirection)
fox23tv .com/?cn67CuYcDcbvV (Same ad but with redirection to malicious URL)
abbezcqerrd.irica.wieshrealclimate .com (iframe to exploit kit)
hapme.viwahcvonline .com (Angler EK landing page)
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/redir_flow.png
This time, rogue actors are leveraging RedHat’s cloud platform, rhcloud .com to perform multiple -redirections- to the Angler exploit kit (in the previous attack they were using Microsoft’s Azure). While we did not collect the malware payload associated with this campaign, we believe it is either Ad fraud or ransomware, Angler’s trademark. Angler has been acting up strange lately, for instance last week it fell out of favour briefly for the Neutrino EK when compromised sites decided to redirect to the latter. Following our report, AppNexus -deactivated- the creative in question and said they were investigating this issue in greater depth..."
viwahcvonline .com: 141.8.224.93: https://www.virustotal.com/en/ip-address/141.8.224.93/information/
> https://www.virustotal.com/en/url/a4c438e0b72054de22350f9d057dd3092d8f4d9644eb20558e0baeb8257f2078/analysis/
___
Fake 'resume' SPAM leads to Cryptowall
- http://blog.dynamoo.com/2015/08/malware-spam-reresume-leads-to.html
26 Aug 2015 at 22:48 - "This -fake- resume spam has a malicious payload. I got part way through decrypting it to discover that @Techhelplistcom had done all the hard bits which saved me some effort. This particular spam delivers a version of the Cryptowall ransomware. In the only sample I saw, the spam looks like this:
From: emmetrutzmoser@ yahoo .com
To:
Date: 26 August 2015 at 23:29
Subject: RE:resume
Signed by: yahoo .com
Hi! my name is Janet Ronald it is my resume!Awaiting your prompt reply
Best regards
Janet Ronald
Attached was a file Janet_Ronald_resume.doc [VT 5/56*] which contains a malicious macro... The format of this message is very similar to this other fake resume spam seen recently[1], and a key feature here is that the message is really sent through Yahoo! and is not a forgery.
1] http://blog.dynamoo.com/2015/08/malware-spam-gabriel-daniel-resume.html
Deobfuscating the macro shows that a file is downloaded from http :// 46.30.46.60 /444.jpg which is then run through a decoding mechanism to create (I think) %APPDATA%\278721985.exe. The Hybrid Analysis report** shows some of this in action, but Techhelplist[2] did the hard work of decrypting it..
> https://4.bp.blogspot.com/-gMHNsx2OEeE/Vd4xLWvpCAI/AAAAAAAAG6U/R7cFcGN5BGE/s1600/cryptowall.png
...
2] https://twitter.com/Techhelplistcom/status/636633492441268224
To save a bit of time, a helpful soul left a note on the VT scan of the fake JPEG which leads to this VT report*** on the actual executable itself, and this then leads to this rather informative Hybrid Analysis report[3] which has some nice screenshots.
3] https://www.hybrid-analysis.com/sample/853ee12c93e294225e9eda9b3dc9434f1bc0e06cb0c393fc3d32d311accbcf3c?environmentId=2
Out of all the IPs and domains listed in those reports, I think these are probably the priorities to block:
46.30.46.60 (Eurobyte, Russia)
linecellardemo .net / 23.229.194.224 (GoDaddy, US)
You might want to block the entire 46.30.46.0/24 range because.. well, Russia really."
* https://www.virustotal.com/en/file/df31db887b398acd01940fc16fc2d33388b366d3707cd96011733b98ddf99402/analysis/1440622900/
** https://www.hybrid-analysis.com/sample/df31db887b398acd01940fc16fc2d33388b366d3707cd96011733b98ddf99402?environmentId=1
*** https://www.virustotal.com/en/file/442b94326e76b1da36799d12f7adc88a419cc30afb21d0c5d1af21c42f732b93/analysis/1440622920/#comments
___
Fake 'Attachement' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/attachement-word-doc-or-excel-xls-spreadsheet-malware/
27 Aug 2015 - "A -blank- email with the subject of 'Attachement' pretending to come from your own email address with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
The email has a totally empty-blank body and just an XLS Excel spreadsheet attachment:
27 August 2015 : 20131030164403.xls - Current Virus total detections 4/57*
Downloads Dridex banking malware from http ://pintart .pt/43t3f/45y4g.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a5228a5e04b79e137c8b8a02781564101864ab3f94d47aadc7e14514340bd78b/analysis/1440669673/
** https://www.virustotal.com/en/file/0c3631f4cb7c6c20d671500f4c3b769457486b5afa0c685920d64c3c7297fb0e/analysis/1440670039/
... Behavioural information
TCP connections
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
23.14.92.27: https://www.virustotal.com/en/ip-address/23.14.92.27/information/
pintart .pt: 80.172.241.24: https://www.virustotal.com/en/ip-address/80.172.241.24/information/
___
Fake 'Payslip' SPAM - PDF malware
- http://myonlinesecurity.co.uk/payslip-for-period-end-date-27082015-fake-pdf-malware/
27 Aug 2015 - "'Payslip for period end date 27/08/2015' pretending to come from noreply@ fermanagh. gov.uk with a zip attachment is another one from the current bot runs... The email looks like:
Dear administrator
Please find attached your payslip for period end 27/08/2015
Payroll Section ...
Some emails have arrived malformed-and-damaged and look like:
This is a multi-part message in MIME format.
——————=_Next_25232_7367279505.4684370133215
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Dear ae48852507a
Please find attached your payslip for period end 27/08/2015
Payroll Section ...
27 August 2015: payslip.zip: Extracts to: payslip.scr
Current Virus total detections 3/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6bfc6e82b5a288ffa91a1cab9dae06c968b3bc36d5fd07d2557f517b79465298/analysis/
- http://blog.dynamoo.com/2015/08/malware-spam-payslip-for-period-end.html
27 Aug 2015 - "... Attached is a file payroll.zip which contains a malicious executable payroll.scr - or it would have done, but in my case the email was malformed and the archive was not attached properly. This executable has a detection rate of 3/56* and the Hybrid Analysis report** indicates that it sends traffic to a server at 197.149.90.166 (Cobranet, Nigeria) which has been used in a few recent attacks and is definitely worth blocking."
* https://www.virustotal.com/en/file/6bfc6e82b5a288ffa91a1cab9dae06c968b3bc36d5fd07d2557f517b79465298/analysis/1440677452/
** https://www.hybrid-analysis.com/sample/6bfc6e82b5a288ffa91a1cab9dae06c968b3bc36d5fd07d2557f517b79465298?environmentId=1
197.149.90.166: https://www.virustotal.com/en/ip-address/197.149.90.166/information/
___
Fake 'Girls List' Spam ...
- https://blog.malwarebytes.org/online-security/2015/08/girls-list-spam-landing-in-mailboxes/
Aug 27, 2015 - "... spammers are changing up their dating site spam tactics a little bit in the wake of the continued Ashley Madison fallout, with the below curious missives landing in spamtraps over the last day or so:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/crowdspam1.jpg
... emails are identical, and read as follows:
> https://blog.malwarebytes.org/wp-content/uploads/2015/08/crowdspam2.jpg
... well, they -would- read as follows if they had any text in them to read. The emails are entirely -blank- instead offering up two attachments called “girls_list”. A “girl list” would seem to conjure up visions of swiped data and things you’re not supposed to have access to; as it turns out, opening up the .HTML attachment -redirects- you in a browser to a -porn- dating site which splashes... many nude photos around the screen... These emails are already caught by Gmail as spam, but other providers may -not- be flagging them yet. While I’m sure there are lots of fun things you can do with a list, allowing yourself to be redirected-to-porno-spam is probably not one of them and you should avoid these mails. With websites and services jumping on the AM data bandwagon*, it’s clear that anything involving dating and lists is going to be a hot topic for some time to come. Don’t fall for it."
* http://www.troyhunt.com/2015/08/ashley-madison-search-sites-like.html
24 Aug 2015 - "... harvesting email addresses and spamming searched victims..."
___
Malvertising campaigns increase 325%
- http://net-security.org/malware_news.php?id=3088
26.08.2015 - "Cyphort* investigated the practices used by cyber criminals to inject malicious advertisements into legitimate online advertising networks. Researchers found that malvertising campaigns carried out by hackers increased 325 percent in the past year... The problem of malvertising isn’t going away and cyber criminals will continue finding ways to monetize their attacks. According to the Association of National Advertisers, ad-fraud will cost global advertisers more than $6 billion in 2015..."
* http://www.cyphort.com/category/malvertising/
:fear::fear: :mad:
AplusWebMaster
2015-08-28, 13:21
FYI...
Fake 'Payment Receipt' SPAM – xls malware
- http://myonlinesecurity.co.uk/dartford-crossing-payment-receipt-excel-xls-spreadsheet-malware/
28 Aug 2015 - "'Payment Receipt' pretending to come from donotreply@ dartford-crossing-charge.service .gov.uk with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Almost all of these malicious word documents appear to be blank or look something like this image when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/daerford-crossing-Payment-Receipt.png
28 August 2015: PaymentReceipt.xls - Current Virus total detections 5/56*:
Downloads Dridex banking malware from http ://cheaplaptops.pixub .com/3453/5fg44.exe (VirusTotal**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d15299c96ed5d869cfb53e42f39e2565b4c080ddb7f45dc7f178841d4b41bf8c/analysis/1440757199/
** https://www.virustotal.com/en/file/f04faffe8884d590a471c64b85f3240c1ed63b3b026faea98bfa1298c3d0b8fc/analysis/1440756592/
... Behavioural information
TCP connections
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
23.14.92.35: https://www.virustotal.com/en/ip-address/23.14.92.35/information/
91.239.232.9: https://www.virustotal.com/en/ip-address/91.239.232.9/information/
31.131.251.33: https://www.virustotal.com/en/ip-address/31.131.251.33/information/
pixub .com: 93.188.160.103: https://www.virustotal.com/en/ip-address/93.188.160.103/information/
___
Dropbox Spam
- http://threattrack.tumblr.com/post/127784805983/dropbox-spam
Aug 28, 2015 - "Subjects Seen:
Brad Waters shared “TP Resignation Letter 2.pdf” with you
Reed Contreras shared “TP Resignation Letter 2.pdf” with you
Typical e-mail details:
Brad used Dropbox to share a file with you!
Click here to view.
Screenshot: https://40.media.tumblr.com/5e54ebbf60e08681eabf792e77c83982/tumblr_inline_ntslh2x8Os1r6pupn_500.png
Malicious URLs:
newyearpartyistanbul .com/securestorage/getdocument.html
Malicious File Name and MD5:
TP Resignation Letter 2.scr (90a60d95b2f0db6722755e535e854e82)
Tagged: Dropbox, Upatre
newyearpartyistanbul .com: 93.89.224.6: https://www.virustotal.com/en/ip-address/93.89.224.6/information/
:fear::fear: :mad:
AplusWebMaster
2015-08-31, 20:24
FYI...
Fake 'FedEx delivery problem' SPAM – JS malware
- http://myonlinesecurity.co.uk/fedex-shipment-delivery-problem-0000639746-js-malware/
31 Aug 2015 - "An email with the subject of 'Shipment delivery problem #0000639746' pretending to come from FedEx... with a zip attachment that extracts to a JS file is another one from the current bot runs...The content of the email says :
Dear Customer,
Your parcel has arrived at August 28. Courier was unable to deliver the parcel to you.
Please, open email attachment to print shipment label.
Yours faithfully,
Jeffrey Kendall,
Operation Agent.
31 August 2015: FedEx_ID_0000639746.zip: Extracts to: FedEx_ID_0000639746.doc.js
Current Virus total detections 17/57*. I am not getting any payload via the automatic analysers so far although Wepawet indicates it connects to one of these sites:
selmaryachtmarket .com
riggst .com
harmacrebar .com ...
Update: managed to get the malware 92305548.exe (VirusTotal**) and ba892f004ed[1].gif (VirusTotal***)
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/bbf7013ea5a379a5baac93fdf6e2e26a344d1914382038127ebf763610e7b5c5/analysis/1441042826/
selmaryachtmarket .com: 174.137.191.22: https://www.virustotal.com/en/ip-address/174.137.191.22/information/
riggst .com: 108.175.152.86: https://www.virustotal.com/en/ip-address/108.175.152.86/information/
harmacrebar .com: 96.31.35.62: https://www.virustotal.com/en/ip-address/96.31.35.62/information/
** https://www.virustotal.com/en/file/aee17eb41e299114b62d19c2fa1fedca08be956b284fa7cb923350e523c39f7e/analysis/1441044798/
0/57
*** https://www.virustotal.com/en/file/4f74781a1ff472f8f7e5c5efac9cb9d93c839646d0f3e89b232b199a7f613fe0/analysis/1441029511/
1/56
:fear::fear: :mad:
AplusWebMaster
2015-09-01, 16:18
FYI...
Fake 'Private message' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-private-message.html
1 Sep 2015 - "This spam comes with a malicious attachment:
From: Adrien Abbott
Date: 1 September 2015 at 12:34
Subject: Private message notification 41447
You've received a private message. Please open the attached to view it.
Adrien Abbott
Chief Tactics Executive
home: 1-583-761-3793
work: 380.022.2492
twitter: @nicole
skype: nicole
messenger: nicole
I have only seen a single sample of this spam, and the attachment was not formatted properly making it harmless, however other -variants- could be more dangerous. If properly decoded, the attachment should have been named 89867740_Torphy and Sons_Adrien Abbott.zip containing a malicious executable jodie_okonofficia-quo.exe. This executable has a VirusTotal detection rate of just 2/56*, the Hybrid Analysis report** shows network activity consistent with this being Upatre dropping the Dyre banking trojan, with communications made to:
197.149.90.166 (Cobranet, Nigeria)
..which is an IP that has been used several times for this sort of attack recently and is worth blocking. The report details other IP addresses too, but this seems to be the key one to block or monitor."
* https://www.virustotal.com/en/file/8092a0200a1fbc9e1917aa58483af308120f22fe750e83ba944e0adfe7d51bc5/analysis/1441111004/
** https://www.hybrid-analysis.com/sample/8092a0200a1fbc9e1917aa58483af308120f22fe750e83ba944e0adfe7d51bc5?environmentId=1
- http://myonlinesecurity.co.uk/private-message-notification-fake-pdf-malware/
1 Sep 2015 - "... random names and email addresses from with a zip attachment is another one from the current bot runs... -hundreds- of other names. All details in the body of the email are random. The alleged sender matches the name in the body of the email and the attachment contains those names as well...
1 September 2015: 27121259_Zemlak-Rodriguez_Hans Mohr.zip: Extracts to: velmasuscipit.incidunt.exe
Current Virus total detections 1/57*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/27c1a31c9896a8f9fd6e62265934dcba3d6842c7b45932d1dad77ebe6701a73b/analysis/1441109597/
___
Fake 'Complaint notice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/complaint-notice-fake-pdf-malware/
1 Sep 2015 - "Following on from the earlier malspam run* we now have a series of emails with the subject of 'Complaint notice' [random numbers] also coming from random names and email addresses with a zip attachment is another one from the current bot runs...
* http://myonlinesecurity.co.uk/private-message-notification-fake-pdf-malware/
The content of the email says :
This is a complaint notification. Full details attached. Please notify us within 24 hours with taken actions.
Martine McDermott
Lead Metrics Designer
T: (104) 644-7068
F: 174.118.9422
-Or-
This is a complaint notification. Full details attached. Please notify us within 24 hours with taken actions.
Jordane Emard
Internal Intranet Designer
T: 576-698-2292
F: 1-167-549-0752
And -hundreds- of other names. All details in the body of the email are random. The alleged sender matches the name in the body of the email and the attachment contains those names as well...
1 September 2015: 8961683689_Bahringer-Jacobs_Martine McDermott.zip:
Extracts to: alekvoluptatibus-at.exe
Current Virus total detections 2/57*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/09873fd725eb7a1d7ea7914afc41c854627179b7371607251923fe0f7c5b17e5/analysis/1441122287/
- http://blog.dynamoo.com/2015/09/malware-spam-complaint-of-your-internet.html
1 Sep 2015 - "This spam comes with a malicious attachment:
From: Margret Kuhic
Date: 1 September 2015 at 16:10
Subject: Complaint of your Internet activity
This is a complaint notification. Full details attached. Please notify us within 24 hours with taken actions.
Margret Kuhic
Dynamic Communications Agent
T: 1-679-732-5379
F: 100.173.9045
All the sames I have seen have a corrupt attachment which is Base 64 encoded, it is possible that other people might receive a -valid- attachment though. The attachment was meant to be 723296788_Marquardt-Bailey_Margret Kuhic.zip containing the malicious executable june_stiedemannmolestiae.et.exe which has a VirusTotal detection rate of 2/56*. This Hybrid Analysis report** shows it to be just another variant of Update/Dyre with the same characteristics as the malspam seen earlier today***, sending traffic to an IP that I suggest you -block- or monitor:
197.149.90.166 (Cobranet, Nigeria)
Some other subjects spotted include:
Complaint notification 50646
Infringement of your Internet activity
Infringement notification 51494 "
* https://www.virustotal.com/en/file/17795e0988bd3a5326ef445c5d35a2e30c8b5bbad0e90d3242573f16e4e52e17/analysis/1441121661/
** https://www.hybrid-analysis.com/sample/17795e0988bd3a5326ef445c5d35a2e30c8b5bbad0e90d3242573f16e4e52e17?environmentId=1
*** http://blog.dynamoo.com/2015/09/malware-spam-private-message.html
___
Fake 'ACH rejection' SPAM – PDF malware
- http://myonlinesecurity.co.uk/ach-rejection-due-to-system-malfunctioning-fake-pdf-malware/
1 Sep 2015 - "An email with the subject of 'ACH rejection due to system malfunctioning' pretending to come from The ACH Network <Stevie.Espinoza@ nacha .org> with a link to download a zip attachment is another one from the current bot runs... The content of the email says :
ACH PAYMENT CANCELLED
The ACH Transaction (ID: 86440585067071), recently sent from your savings account (by you or any other person), was CANCELLED by other financial institution.
Rejection Reason: See details in the report below
Transaction Report: New Banking Details.pdf (Adobe Reader PDF)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2014 NACHA – The Electronic Payments Association
The link in the email sends you to http ://cheenichetty .com/securestorage/get_document.html where a zip file is downloaded automatically and you are -bounced- immediately to Dropbox and you think you were on Dropbox the whole time. These 'NACHA/ACH/The Electronic Payments Association payment cancelled' or 'payment rejected' emails are a persistent method of trying to deliver malware to your computer...
1 September 2015: New Banking Details.zip: Extracts to: New Banking Details.scr
Current Virus total detections 6/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/58e9c8f22f7d06cff615fb95ecdc201d902bf15c078ca2c9130e3a8d1926439f/analysis/1441127390/
cheenichetty .com: 160.153.50.129: https://www.virustotal.com/en/ip-address/160.153.50.129/information/
___
Your Worst Day In IT
- http://www.darkreading.com/partner-perspectives/tenable/your-worst-day-in-it/a/d-id/1321999
9/1/2015 - "At VMworld 2015 in San Francisco, I roamed the floor with a camera asking attendees, "What was your worst day in IT?" When we initially came up with this question, we thought everyone's worst day would have something to do with a security breach or malware. Turns out that hardware failures and human error are far more common. As much as we talk about threat protection, what we really need to watch out for is our equipment and ourselves."
:fear::fear: :mad:
AplusWebMaster
2015-09-02, 14:56
FYI...
Fake 'toll road invoice' SPAM – JS malware
- http://myonlinesecurity.co.uk/pay-for-driving-on-toll-road-invoice-00212297-js-malware/
2 Sep 2015 - "An email with the subject of 'Pay for driving on toll road, invoice #00212297' [ random numbered] pretending to come from E-ZPass Agent with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Pay-for-driving-on-toll-road-invoice-00212297-1024x476.png
2 September 2015: E-ZPass_00212297.zip: Extracts to: E-ZPass_00212297.doc.js
Current Virus total detections 2/57* which downloads 2 files 51053011.exe (virus total**) and 9360abf00281f3aa[1].gif (VirusTotal***) from a combination of these 3 sites
ihaveavoice2 .com
leikkihuone .com
etqy .com
... the 51053011.exe has a stolen digital signature from ESET Antivirus, which has been blocked and at least in Internet Explorer, Smart Filter warns about an invalid digital signature and blocks the file. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://www.virustotal.com/en/file/925b2e615c7c34c1020285ffd56b90d0a357f84aad008e51bc6a1770e693915b/analysis/1441160077/
*** https://www.virustotal.com/en/file/873ac56a261e84a5b23f43d5383d712964bec0d27c808339a52ac2698dd608e7/analysis/1441173275/
ihaveavoice2 .com: 50.116.104.205: https://www.virustotal.com/en/ip-address/50.116.104.205/information/
leikkihuone .com: 23.91.123.160: https://www.virustotal.com/en/ip-address/23.91.123.160/information/
etqy .com: "... query for etqy .com failed"
___
Fake 'order cancelled' SPAM - PDF malware
- http://myonlinesecurity.co.uk/the-shipment-of-your-ordered-goods-is-impossible-fake-pdf-malware/
2 Sep 2015 - "An email with the subject of 'The shipment of your ordered goods is impossible' pretending to come from random companies with a zip attachment is another one from the current bot runs... The content of the email says :
Hello!
Unfortunately, the delivery of you order # 003313 was cancelled since
the specified address of the recipient was not correct. You’re recommended to
complete the attached form and send it back or print it and get this package
on your own at our office.
Alf Gottlieb, Corporate Intranet Director ...
-Or-
Hello!
Unfortunately, the delivery of you order # 4534481 was cancelled since
the specified address of the recipient was not correct. You’re recommended to
complete the attached form and send it back or print it and get this package
on your own at our office.
Arnoldo Strosin, Dynamic Markets Producer
And hundreds of other random names and job titles and companies. Some of the subjects in this series of emails include:
The shipment of your ordered goods is impossible
The delivery of your ordered goods isn’t finished
The shipment of your parcel is impossible
The shipping of your parcel is impossible to complete
The shipping of your items has failed
The shipping of your items isn’t finished
The delivery of your items was cancelled
The shipping of your goods is impossible
The delivery of your parcel has failed ...
2 September 2015: orderHayes Flat.zip: Extracts to: orderYost Dale.exe
Current Virus total detections 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/181abcb33da097a74629da8e8ab270f02f99683700fa29051e234e6e2a614831/analysis/1441191343/
___
Fake 'Companies House' SPAM – PDF malware
- http://myonlinesecurity.co.uk/companies-house-webfiling-service-fake-pdf-malware/
2 Sep 2015 - "Another perennial email that constantly does the rounds has a subject matter about 'Companies House WebFiling service' and pretends to be either a complaint or a filing acknowledgement. They come with a zip attachment which is another one from the current bot runs... The content of the email says :
This message has been generated in response to the company complaint submitted to Companies House WebFiling service.
(CC01) Company Complaint for the above company was accepted on 02/09/2015.
The submission number is 1GS31QZLMK1BCRG
Please quote this number in any communications with Companies House.
All WebFiled documents are available to view / download for 10 days after their original submission. However it is not possible to view copies of accounts that were downloaded as templates.
Not yet filing your accounts online? See how easy it is…
Note: reference to company may also include Limited Liability Partnership(s).
Thank you for using the Companies House WebFiling service.
Service Desk tel +44 (0)303 1234 500 or email...
Note: This email was sent from a notification-only email address which cannot accept incoming email. Please do not reply directly to this message.
2 September 2015: Case_1GS31QZLMK1BCRG.zip: Extracts to: Case_081415.scr
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2fbc98468f5486be0dba974aa0d5ac3488bb60fee454a297b159655f3796de7b/analysis/1441193027/
:fear::fear: :mad:
AplusWebMaster
2015-09-03, 14:02
FYI...
Malvertising found on Dating Site Match[dot]com
- https://blog.malwarebytes.org/malvertising-2/2015/09/malvertising-found-on-dating-site-matchdotcom/
Sep 3, 2015 - "In an attack similar to the one that happened last month on PlentyOfFish, the UK version of online dating site Match .com was caught serving malvertising. Both companies are actually related since the Match Group bought out POF.com last summer. This latest malvertising incident is the work of the same gang using Google shortened URLs leading to the Angler exploit kit.
Infection flow:
Initial URL: uk.match .com/search/advanced_search.php
Malvertising: tags.mathtag .com/notify/js?exch={redacted}&price=0.361
Malvertising: newimageschool .com/adframe/banners/serv.php?uid=215&bid=14&t=image&w=728&h=90
Malicious Redirector: goo .gl/QU2x0w
Exploit Kit (Angler): med.chiro582help .com/carry.shtm?{redacted}
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/math.png
The malvertising goes through a Goo.gl shortened URL (already blacklisted) that loads the Angler exploit kit:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/google.png
Angler EK is known to serve the Bedep ad fraud Trojan as well as CryptoWall ransomware. The cost per thousand impressions (CPM) for the booby trapped ad was only 36 cents, which is nothing compared to how much infected computers can bring in terms of revenues. For instance, CryptoWall demands $5oo per victim. We alerted Match .com and the related advertisers but the malvertising campaign is still-ongoing via other routes."
chiro582help .com: 74.207.227.69: https://www.virustotal.com/en/ip-address/74.207.227.69/information/
___
Fake 'chat history' SPAM – PDF malware
- http://myonlinesecurity.co.uk/you-need-to-read-this-chat-history-fake-pdf-malware/
3 Sep 2015 - "An email with the subject of 'You need to read this chat history' coming from random senders and email addresses from with a zip attachment is another one from the current bot runs... The content of the email says :
Good day!
You should know this. View the chat history that I’ve attached. Remember
it’s strongly confidential, so please don’t show it to anyone.
Mrs. Edmund Schultz | (859) 913-2400
Toys | Hackett-Kiehn
And hundreds of other random names, email addresses, phone numbers and companies. Other subjects in this series include:
You should view this correspondence
Please view this correspondence
You need to view it
Please see it
You need to review this information
You need to review this chat history
Please see this messages
You need to read this chat history
You should read this messages
You should view this correspondence
And hundreds of other similar variations on the theme of messages and chat history...
3 September 2015: history Ward LockUG.zip: Extracts to: history Chelsea VillagePY.exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/256cbf204f7b7c73cc896a27ac8dd11e582872fc675065ddff985d92ee8ace33/analysis/1441271691/
___
Fake 'Invoice / credit note' SPAM - PDF malware
- http://myonlinesecurity.co.uk/invoice-or-credit-note-from-random-companies-fake-pdf-malware/
3 Sep 2015 - "The latest set of -Upatre- downloader emails are 'Invoice' or 'credit note' from random companies. An email with the subject of 'Invoice INV-91659 from [random company]' for [Your web domain] (random numbers) or 'Credit Note CN-85402 from [random company]' for [Your web domain] (random numbers) pretending to come from Accounts with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Invoice-INV-96032-from-Pharmacia-Corp-for-thespykiller.co_.uk-0394-1024x493.png
3 September 2015: Invoice INV-91659.zip: Extracts to: Invoice.scr
Current Virus total detections 1/56 . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/cd1164f4f319bf558d75528116bff0bbf8319153042a9f56dd79098ca334e5f8/analysis/1441279729/
___
Fake 'Lloyds Bank' SPAM – PDF malware
- http://myonlinesecurity.co.uk/customer-account-correspondence-lloyds-bank-commercial-finance-fake-pdf-malware/
3 Sep 2015 - "An email with the subject of 'Customer Account Correspondence' pretending to come from Lloyds Bank Commercial Finance <customermail@ lloydsbankcommercialfinance .co.uk> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Customer-Account-Correspondence-1024x490.png
3 September 2015: Lloyds-Commercial_Documents.zip: Extracts to: Lloyds-Commercial_Documents.scr
Current Virus total detections 3/56 . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/cd1164f4f319bf558d75528116bff0bbf8319153042a9f56dd79098ca334e5f8/analysis/1441281692/
___
Fake 'overdue balance' SPAM – PDF malware
- http://myonlinesecurity.co.uk/overdue-balance-from-random-companies-fake-pdf-malware/
3 Sep 2015 - "Following on from the earlier -Upatre- downloaders, the latest set of emails are about an overdue balance from random companies. An email with the subject of 'Urgent' e-mail letter of 'overdue balance' or 'Important reminder notice about outstanding balance' or very similar wording with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Important-reminder-letter-about-outstanding-remittances-1024x314.png
Some of the subjects so far seen include:
Important reminder letter about outstanding remittances
Urgent e-mail letter of overdue balance
Important reminder letter about outstanding remittances
Urgent letter of past due balance
Urgent reminder about your delinquent balance
Important reminder notice of delinquent remittances
Urgent reminder about outstanding balance ...
3 September 2015: documents Heidenreich MillsDE.zip: Extracts to: documents Stark LodgeFR.exe
Current Virus total detections 2/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/61117160bb1981f2668da4dc2592255e0ebba9db26ee0f00aaf076896ffc23eb/analysis/1441291670/
___
Fake 'Canadian Bank' SPAM - PDF malware
- http://myonlinesecurity.co.uk/you-have-received-a-secure-e-mail-vous-avez-reu-un-courriel-protg-canadian-imperial-bank-of-commerce-fake-pdf-malware/
3 Sep 2015 - "An email with the subject of 'You have received a secure e-mail / Vous avez reu un courriel protégé' pretending to come from Canadian Imperial Bank of Commerce <noreply@ cibc .com> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/CIBC-You-have-received-a-secure-e-mail-1024x580.png
3 September 2015: SecureMail.zip: Extracts to: SecureMail.scr
Current Virus total detections 6/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5bc46a26cb91f90e1fb53c09468a17fda00e23ba3584d7faa6803b70ac47f4d9/analysis/1441298777/
___
Skype Spam...
- https://blog.malwarebytes.org/fraud-scam/2015/09/steer-clear-of-this-skype-spam/
Sep 3, 2015 - "Over the last few weeks, there’s been a spam campaign taking place on Skype which involves the following steps:
> Scammers use an automated technique to break old/weak Skype passwords (this has been contested by Skype users in that forum thread*).
* http://community.skype.com/t5/Security-Privacy-Trust-and/Spoofed-message-from-contact/m-p/4038620#M47813
> They then use these accounts to send spam messages to contacts.
> The spam frequently hides the “real” destination by providing (say) a Baidu search engine link instead – along with the Skype Username of the person who clicked the link in the URL.
> The websites the “masked” URls lead to tend to use redirects – it’s possible they’ve been compromised – before dumping the end-user on a diet spam page.
Here’s an example of the spam currently going around:
>> https://blog.malwarebytes.org/wp-content/uploads/2015/09/skypespam0.jpg
“Hi [username] | baidu(dot)com/[URL string] advise”
Below you can see the initial landing page, the final destination and a screenshot of a Fiddler log:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/skypespam3.jpg
...
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/skypespam2.jpg?w=564
If your Skype password is in need of a spring clean... feel free to check out the list of hints and tips on the Skype Security page**."
** https://www.skype.com/en/security/
:fear::fear: :mad:
AplusWebMaster
2015-09-04, 14:50
FYI...
Fake 'RE:resume' SPAM / Cryptowall
- http://blog.dynamoo.com/2015/09/malware-spam-reresume-aka-what-happened.html
4 Sep 2015 - "This -fake- résumé spam leads to ransomware:
From: fredrickkroncke@ yahoo .com
Date: 5 September 2015 at 03:50
Subject: RE:resume
Signed by: yahoo.com
Hi my name is Teresa Alexander attach is my resume
Awaiting your prompt reply
Kind regards
Teresa Alexander
The attached document in this case is Teresa_Alexander_resume.doc, which upon opening asks you to enable active content:
> https://1.bp.blogspot.com/-f1xY7yoduuE/Ven599VsUyI/AAAAAAAAG88/qDKaCyJKegs/s1600/protected-document.png
Following these steps would be a Very-Bad-Idea as the malware would encrypt all your files on the disk. This malicious DOC file itself has a VirusTotal detection rate of 4/56*.
The Hybrid Analysis report** shows pretty clearly what is going on. An infection sequence begins, with the following domains and IPs contacted:
46.30.46.117 [Eurobyte LLC, Russia)
186.202.153.84 (gaiga .net)
192.186.235.39 (satisgoswamicollege .org)
52.88.9.255 (entriflex .com)
23.229.143.32 (eliasgreencondo .com)
-Blocking- those domains and IPs may be enough to stop the ransomware working. The malicious macro in the document drops a file carved_0.exe which has a detection rate of 4/56***.
Once the machine is infected, various "What happened to your files?" messages pop up, such as this one (from the Hybrid Analysis report):
> https://3.bp.blogspot.com/-KrTiQq4qfks/Ven8lPdB9_I/AAAAAAAAG9I/F61pWEz3pDM/s1600/cryptowall2.png
This further references another bunch of domains that you might want to -block- especially in a corporate environment:
namepospay .com
optiontosolutionbbs .com
optionpay2all .com
democraticash .com
This further Hybrid Analysis report**** on the dropped binary also identifies the following malicious site:
68.178.254.208 (erointernet .com)
... it is worth noting that the malware attempts to identify the IP address of the infected system by visiting ip-addr .es - although this is -not- a malcious site, you can consider it to be a potential indicator of compromise. The payload here is Cryptowall 3.0 and as is typical, removing the malware is easy.. but decrypting the files without paying the ransom is fearsomely difficult.
Recommended blocklist:
46.30.46.0/24
gaiga .net
satisgoswamicollege .org
entriflex .com
eliasgreencondo .com
erointernet .com
namepospay .com
optiontosolutionbbs .com
optionpay2all .com
democraticash .com "
* https://www.virustotal.com/en/file/6617b8f15f9dc0cec8928421497d9843d06b62d156385cda8a87a15d09f3897f/analysis/1441396906/
** https://www.hybrid-analysis.com/sample/17ea45dc9784c14a5ffe3a157491de981accad527915b1a807c289e6ceb0c06c?environmentId=1
*** https://www.virustotal.com/en/file/6617b8f15f9dc0cec8928421497d9843d06b62d156385cda8a87a15d09f3897f/analysis/1441396906/
**** https://www.hybrid-analysis.com/sample/6617b8f15f9dc0cec8928421497d9843d06b62d156385cda8a87a15d09f3897f?environmentId=1
___
Fake 'reservation confirmed' SPAM - PDF malware
- http://myonlinesecurity.co.uk/your-reservation-is-now-confirmed-booking-com-fake-pdf-malware/
4 Sep 2015 - "An email with the subject of 'Your reservation is now confirmed!' pretending to come from Booking .com with a zip attachment is another one from the current bot runs... The content of the email says:
Thanks! Your reservation is now confirmed.
To view additional information about your reservation, please open the attachment.
Booking number: 376627092
PIN Code: 6524
Email: [Redacted]
Your reservation: 1 night, 1 room
Check in: Saturday, September 05, 2015
(2:00 pm – 00:00 am)
Check out: Sunday, September 06, 2015
(until 12:00 pm)
Superior Double Room £1,799.68
VAT (20%) included £449.92
Total Price £2,249.60
Please note: additional supplements (e.g. extra bed) are not added to this total.
The total price shown is the amount you will pay to the property. Booking.com does not charge any reservation, administration or other fees.
You can easily change or cancel this booking for free before September 05 – 2015, to cancel or modify your reservation please complete the attached form and fax it to:
+1 888 850 5250
Have a great trip!
– The Booking.com Team
Copyright 1996 – 2013 Booking .com. All rights reserved.
This email was sent by Booking .com, Herengracht 597, 1017 CE Amsterdam, Netherlands
4 September 2015: Booking number 376627092.zip: Extracts to: Booking.scr
Current Virus total detections 6/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/07c3a23facdc59ae8ea8b07da3165c8adb5b448664a2eeb2575423f7c97b9e26/analysis/1441343056/
___
Fake 'account security' SPAM
- http://myonlinesecurity.co.uk/important-system-notification-about-account-security/
4 Sep 2015 - "An email with the subject of 'Important system notification about account security' coming from random companies and random email addresses with a zip attachment is another one from the current bot runs... However the attachment is defective and corrupt. If previous experience is anything to go by, the bad guys controlling the botnet will soon realise their mistake and send out a new batch of -working- emails and attachments. The content of the email says:
This is an automatically generated security system alert. It happens when something goes wrong with your account.
To view full details, please open the attached report.
Mrs. Myriam Dach
tel: 1-606-773-7379
Email : cyineosoy5964lqw@ allpromoprint .com
... other subjects include:
Notice concerning your account
Important system notification about your account protection ...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
___
Fake 'Order' SPAM - PDF malware
- http://myonlinesecurity.co.uk/order-is-finished-fake-pdf-malware/
4 Sep 2015 - "An email with the subject of 'Order is finished' coming from random companies and random email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Hello!
Many thanks for purchasing! Please retain attached transaction summary for your records.
Please do not respond to this e-mail message. It’s automatically generated.
Terence Kilback
tel: 936.953.8037
Lehner LLC
Email: ...
Other subjects in this series of emails include:
Your purchase is finished
Your order is finished
Your purchase is confirmed ...
4 September 2015: Krystel StreetMT_report.zip: Extracts to: Tristin LandBL_report.exe
Current Virus total detections 5/57 . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/203cfc5d93c887c20ae22812b7d33b229a768ac9fd9d7f2c3ada67ecaa48c50d/analysis/1441384453/
:fear::fear: :mad:
AplusWebMaster
2015-09-06, 17:30
FYI...
Fake 'Court appearance' SPAM - JS malware
- http://myonlinesecurity.co.uk/notice-of-appearance-in-court-js-malware/
5 Sep 2015 - "An email with the subject of 'Notice of appearance in Court #0000440904' [random numbered] pretending to come from County Court with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Notice-of-appearance-in-Court-0000440904.png
5 September 2015: 0000440904.zip: Extracts to: 0000440904.doc.js
Current Virus total detection 9/57* ... which downloads 2 files 14136619.exe (Virus total**) and 1e0e6fda2680957[1].gif (VirusTotal***) from a combination of these 3 sites:
selmaryachtmarket .com
fibrasinteticafm .com
laterrazzafiorita .it
... None of the automatic analysers even mention any reference to digital signatures whatsoever: Hybrid Analysis Win8.1 [1] | Hybrid Analysis Win 7 [2] | MALWR [3]
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1327708cb19e41778db7bb9327e2bb7b2ae1753cb7b0dff62e89846d5c9ae73e/analysis/1441437273/
** https://www.virustotal.com/en/file/2e63237cba07498e9ba0c5958e264c94aebf6a93432edb9c9f9f3e998860dc26/analysis/1441413005/
*** https://www.virustotal.com/en/file/753b137ff616a5a4b7ddf0117df2d3bdb375bffecbf8de8e8f0de910aa1c8474/analysis/1441438363/
1] https://www.hybrid-analysis.com/sample/2e63237cba07498e9ba0c5958e264c94aebf6a93432edb9c9f9f3e998860dc26?environmentId=3
2] https://www.hybrid-analysis.com/sample/2e63237cba07498e9ba0c5958e264c94aebf6a93432edb9c9f9f3e998860dc26?environmentId=1
3] https://malwr.com/analysis/ZDE5ODQxNTU1MWYxNGZkOTllNDA1NWMzNTM2ZGU1OTY/
selmaryachtmarket .com: 174.137.191.22: https://www.virustotal.com/en/ip-address/174.137.191.22/information/
fibrasinteticafm .com:
54.228.191.204: https://www.virustotal.com/en/ip-address/54.228.191.204/information/
45.55.195.124: https://www.virustotal.com/en/ip-address/45.55.195.124/information/
177.71.183.219: https://www.virustotal.com/en/ip-address/177.71.183.219/information/
54.241.242.142: https://www.virustotal.com/en/ip-address/54.241.242.142/information/
54.83.41.200: https://www.virustotal.com/en/ip-address/54.83.41.200/information/
177.71.188.70: https://www.virustotal.com/en/ip-address/177.71.188.70/information/
laterrazzafiorita .it: 208.43.65.115: https://www.virustotal.com/en/ip-address/208.43.65.115/information/
___
UK bank phish-sites on teamhelpers .com
- http://myonlinesecurity.co.uk/uk-bank-phishing-sites-on-teamhelpers-com/
5 Sep 2015 - "I received a couple of -phishing- emails this morning that both lead to UK bank phishing sites on teamhelpers .com. So far I have seen one for Halifax Bank and one for Lloyds Bank. The subjects include 'Your Halifax online banking needs updating' and 'Your Lloyds online banking needs updating'. I would not be at all surprised to find out that there are many other different UK bank phishing sites on teamhelpers .com. I just haven’t found them yet...
Screenshot1: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Your-Halifax-online-banking-needs-updating-1024x610.png
Screenshot2: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Your-Lloyds-online-banking-needs-updating-1024x612.png
They are both common subjects in a bank phishing attempt. We see them pretending to be from PayPal and your Bank or Credit Card, with a message saying some thing like :
There have been unauthorised or suspicious attempts to log in to your account, please verify
Your online banking needs updating
Your account has exceeded its limit and needs to be verified
Your account will be suspended !
You have received a secure message from < your bank>
We are unable to verify your account information
Update Personal Information
Urgent Account Review Notification
We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
Confirmation of Order
... These will NEVER be genuine emails from PayPal or Your Bank so don’t ever follow the link-in-the-email which leads to a website that looks at first glance like the genuine bank website. This particular phishing campaign starts with an email with-a-link. In this case to a newly created base domain teamhelpers .com Which is hosted on Godaddy .com... you would be very hard-pressed to tell the difference from the -fake- one and the genuine site. The only way is look at the address bar and in the -Genuine- bank site, when using Internet Explorer the entire address bar is in green. (in Chrome or Firefox, only the padlock symbol on the left of the browser is green)... This either means that the new domain has been hacked already due to insecurities in the site software and Godaddy servers or more likely that the entire site was set up to act as a -fraud- site and Godaddy are not being as efficient and proactive as they should be with weeding out fake registrations..."
Phish1: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/halifax_teamhelpers-1024x678.png
Phish2: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/lloyds_teamhelpers-1024x707.png
Genuine: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Halifax_real_site-1024x672.png
teamhelpers .com: 107.180.41.152: https://www.virustotal.com/en/ip-address/107.180.41.152/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-07, 15:17
FYI...
Fake 'Companies House' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-companies-house.html
7 Sep 2015 - "This spam does -not- come from Companies House, but is instead a simple forgery with a malicious attachment:
From "Companies House" [WebFiling@ companieshouse .gov.uk]
Date Mon, 7 Sep 2015 12:40:01 +0100
Subject RE: Case 0676414
The submission number is: 0676414
For more details please check attached file.
Please quote this number in any communications with Companies House.
All Web Filed documents are available to view / download for 10 days after their
original submission. However it is not possible to view copies of accounts that
were downloaded as templates.
Companies House Executive Agency may use information it holds to prevent
and detect fraud. We may also share such information, for the same purpose,
with other Organizations that handle public funds.
If you have any queries please contact the Companies House Contact Centre
on +44 (0)303 1234 500 or email enquiries@ companies-house .gov.uK
Note: This email was sent from a notification-only email address which cannot
accept incoming email. Please do not reply directly to this message...
The "case number" is random, and is reflected in the name of the attachment (in this case Case_0676414.zip) which in turn contains a malicious executable Case_0043258.scr which has an icon to make it look like a PDF file. This executable has a detection rate of 4/56*. The Hybrid Analysis report** shows that it communicates with 197.149.90.166 (Cobranet, Nigeria) which has been seen handling malicious traffic for the past couple of weeks. The payload is Upatre/Dyre."
* https://www.virustotal.com/en/file/c7a6bb9475912a7534deed4bba564b4f42152e4bd0ade5c087d77df6aa983252/analysis/1441627466/
** https://www.hybrid-analysis.com/sample/c7a6bb9475912a7534deed4bba564b4f42152e4bd0ade5c087d77df6aa983252?environmentId=1
197.149.90.166: https://www.virustotal.com/en/ip-address/197.149.90.166/information/
___
Fake 'scanner notice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/important-system-scanner-notice-fake-pdf-malware/
7 Sep 2015 - "An email with the subject of 'Important system scanner notice' coming from random companies and email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Hello!
Our system scanner indicates 69405063 error(s). Please see the attached documentation and contact with us ASAP.
Regards,
Online system security
Mrs. Kendall Howell
tel. 503-012-0597
Email : prabha@ klcc .com.my
The alleged sender matches the name of the company and email address in the body of the email. The numbers of errors are random. Some of the other subjects inn this series of -Upatre- downloaders include:
Important system e-mail
Protection shield system scanner report
Urgent security system notification
Protection shield system scanner e-mail
Security system scanner notification
Urgent system scanner notice
Protection shield system scanner e-mail
And -hundreds- of other variations along the same theme...
7 Serptember 2015: Cary PlazaGL_report-HUDY9Ife7_.zip: Extracts to: Imogene CoveBR_report.exe
Current Virus total detections 4/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/645a4eb88461f6b266510d023a9c6c9e58f1618d2b461261f7a3447494d6529d/analysis/1441621866/
___
Something evil on 184.105.163.192/26 ...
- http://blog.dynamoo.com/2015/09/something-evil-on-18410516319226-white.html
7 Sep 2015 - "... I spotted some Nuclear EK (or some other Flash exploit) traffic on our network which attracted my interest. The IP in question was 184.105.163.243* hosted on what appears to be a Hurricane Electric IP... I don't tend to see a lot of bad stuff on HE so I looked more closely at the IP WHOIS and saw it was part of a range 184.105.163.192/26... given the sheer volume of crap that White Falcon has hosted in the past and its current problem with exploit kits, I would definitely recommend blocking-traffic to 184.105.163.192/26 to be on the safe side."
(More detail at the dynamoo URL above.)
* 184.105.163.243: https://www.virustotal.com/en/ip-address/184.105.163.243/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-08, 13:49
FYI...
Evil network: 89.144.2.0/24 / Echo Romeo LLP (AS199762)
- http://blog.dynamoo.com/2015/09/something-evil-on-891442024-echo-romeo.html
8 Sep 2015 - "This post at malware.kiwi* caught my eye after a sort-of challenge by Techhelplist**. Well, the bottom line is that these get-rich-quick schemes are run by serious organised criminals who tend not to leave too many traces behind.
* http://malware.kiwi/compromised-pti-edu-email-accounts-phishing-campaign/
...
** https://twitter.com/Techhelplistcom/status/641107799796137984
This appears to be a binary options scam*** that is using illegally -hacked- sites as redirectors, and I suspect that it is using a botnet to send the spam in the first place, although this is not clear. Eventually, victims are sent via an affiliate link to a site searchingprofit .me...
*** http://www.cftc.gov/ConsumerProtection/FraudAwarenessPrevention/CFTCFraudAdvisories/fraudadv_binaryoptions
It turns out that dailybusinessdirect .com is hosted alongside a cluster of related domains on a set of IPs belonging to a firm called Echo Romeo LLP in the UK. From the research I have done, it appears that Echo Romeo are a legitimate small business doing web design and hosting. However, they operate an IP range 89.144.2.0/24 which seems to be almost completely full of spam, scam and malware sites... Echo Romeo have a portfolio on their site of designs they have done for customers. As far as I can tell, -none- of those customer sites are actually hosted in this IP address range. The first thing I noticed was a cluster of sites and IPs[4] that appear to be closely related to dailybusinessdirect .com:
4] http://pastebin.com/mieQQj5s
... Overall, the evil-ness factor of 89.144.2.0/24 seems very high indeed (for example, this Damballa report on POSeidon[5] shows how the bad guys moved to this netblock), and yet Echo Romeo LLP seems to be completely legitimate. I even went to the effort of checking them out at Companies House, and all seems OK. I wonder if perhaps the bad guys have either gained control of the IP block or have popped a large number of their servers?"
5] https://www.damballa.com/new-poseidon-spotted/
(More detail at the dynamoo URL at the top of this post.)
AS199762 (ECHOROMEO-AS)
> https://www.google.com/safebrowsing/diagnostic?site=AS:199762
- https://www.google.com/safebrowsing/diagnostic?site=t9e.net/
- https://www.google.com/safebrowsing/diagnostic?site=89.144.2.0/
searchingprofit .me: 82.192.91.16: https://www.virustotal.com/en/ip-address/82.192.91.16/information/
dailybusinessdirect .com: 89.144.2.158: https://www.virustotal.com/en/ip-address/89.144.2.158/information/
___
ipserver .su, 5.133.179.0/24 and 212.38.166.0/24
- http://blog.dynamoo.com/2015/09/ipserversu-5133179024-and-21238166024.html
8 Sep 2015 - "A follow-up to this post*, I took a look at the netblocks 5.133.179.0/24 and 212.38.166.0/24 suballocated to:
person: Oleg Nikol'skiy
address: British Virgin Islands, Road Town, Tortola, Drake Chambers
phone: +18552100465
e-mail: abuse@ ipserver .su
nic-hdl: ON929-RIPE
mnt-by: IPSERVER-MNT
changed: abuse@ ipserver .su 20150528
created: 2015-05-28T11:11:09Z
last-modified: 2015-05-28T11:11:09Z
source: RIPE
I'm going to say straight away that my methodology is flawed, but I will share what I have. Very many IPs in this range have hosted badness in the past year-and-a-bit (e.g. 5.133.179.165**), mostly using subdomains.. to the extent that there are too many sites to analyse easily if I take the data from a passive DNS service. Instead, I elected to use the DomainTools reverse DNS which limits the results to domains only (not subdomains) and these are mostly active sites. Running the list through my analyser checks that the IPs are valid, and would normally tell me things such as the Google Safebrowsing Diagnostics and SURBL rating... I would expect to see about 1% in a normal sample, and out of 399 sites it comes back with zero. In fact, none of these sites seem to have any web presence at all, and all the ones that I have tried come back with almost no references on Google at all. I am going to suggest that there is nothing of value in these IP ranges, and given that historically .SU domains have a bad reputation***, then my suggestion is that you block traffic to:
5.133.179.0/24
212.38.166.0/24
In the meantime I will continue digging.."
* http://blog.dynamoo.com/2015/09/something-evil-on-891442024-echo-romeo.html
** 5.133.179.165: https://www.virustotal.com/en/ip-address/5.133.179.165/information/
*** https://www.abuse.ch/?p=3581
Diagnostic page for AS20860 (IOMART-AS)
- https://www.google.com/safebrowsing/diagnostic?site=AS:20860
"... over the past 90 days, 289 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2015-09-08, and the last time suspicious content was found was on 2015-09-08... we found 6 site(s) on this network... that appeared to function as intermediaries for the infection of 9 other site(s)... We found 97 site(s)... that infected 127 other site(s)..."
___
Fake 'FedEx' SPAM - JS malware
- http://myonlinesecurity.co.uk/fedex-standard-overnight-we-could-not-deliver-your-parcel-js-malware/
8 Sep 2015 - "An email with the subject of 'We could not deliver your parcel, #00184416 [ random numbered]' pretending to come from FedEx Standard Overnight <kevin.swartz@ 189-38-86-3 .net2 .com.br> with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Customer,
We could not deliver your parcel.
Delivery Label is attached to this email.
Regards,
Kevin Swartz,
Station Agent.
8 September 2015: Delivery_Notification_00184416.zip: Extracts to: Delivery_Notification_00184416.doc.js
Current Virus total detections 9/56* ... which downloads 2 files 97823c.gif (VirusTotal**) | 12918408.exe (VirusTotal***) from a combination of these 3 sites:
dominaeweb .com
idsecurednow .com
les-eglantiers .fr
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/208fdb11e8530cd0b8cc50d91003c28bef96cdc66c721fe5af65726afa300416/analysis/1441689276/
** https://www.virustotal.com/en/file/5a80fca028805557c64d507cf35adc4108b7d240c5b95d9334e9d22e5b86fd18/analysis/1441689928/
*** https://www.virustotal.com/en/file/51b227a255f21f5df62f87233af7b01edf4c84f1ca8bf1aeca61e636062fbe7e/analysis/1441658746/
dominaeweb .com: 174.36.231.69: https://www.virustotal.com/en/ip-address/174.36.231.69/information/
idsecurednow .com: 96.31.36.46: https://www.virustotal.com/en/ip-address/96.31.36.46/information/
les-eglantiers .fr: 76.74.242.190: https://www.virustotal.com/en/ip-address/76.74.242.190/information/
___
Fake 'contract' SPAM - PDF malware
- http://myonlinesecurity.co.uk/edits-of-contract-fake-pdf-malware/
8 Sep 2015 - "An email with the subject of 'Edits of contract #oyMolGA of Tue, 08 Sep 2015 12:33:32 +0200 (random characters and times)' pretending to come from random companies and email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Good day,
Please check out the edits of contract 181254053. Pay your particular attention to
paragraphs 121.39 and 148.85.
Until this contract isn’t signed, an amount won’t be remitted. If you have any questions,
please mail or call me on my additional number 63779928.
Emmalee Schaden
phone: 842-690-4561
Robel, McCullough and Gibson
8 September 2015: agreement changes Bruen Mall_jEHqrF.zip: Extracts to: renewed agreement Harber Village.exe
Current Virus total detections 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/704807e20fc1a6de2c63d14120cbb939406dda931a04aaabfb4dc6a88b44c89e/analysis/1441708637/
___
PayPal Overpayment Scams that target Craigslist Sellers
- https://isc.sans.edu/diary.html?storyid=20115
Last Updated: 2015-09-08 - "... when people become familiar with the tactics employed by scammers, they will be less likely to get ripped off. With this in mind, I'd like to describe my recent interactions with miscreants who target sellers on Craigslist. This encounter, which involved SMS messages, emails and a click, is a variation of a PayPal-themed overpayment -scam- that has been quite prolific in the recent years... The -fake- PayPal message in my inbox clarified that I might not see the funds in my PayPal account until I sent money to the buyer's pickup agent using MoneyGram... Soon, I received two more messages claiming to be from PayPal and impressing upon me of the 'safety' of the transaction... more of my articles about online scams, take a look at How Victims Are Redirected to IT Support Scareware Sites* and Conversation With a Tech Support Scammer**."
(More detail at the isc URL at the top of this post.)
* https://isc.sans.edu/diary/How+Victims+Are+Redirected+to+IT+Support+Scareware+Sites/19487/
** https://zeltser.com/tech-support-scammer-conversation/
___
Com[dot]com site leads to -Fake- Daily Mail Article, Other Dodgy Sites
- https://blog.malwarebytes.org/fraud-scam/2015/09/comdotcom-site-leads-to-fake-daily-mail-article-other-dodgy-sites/
Sep 7, 2015 - "When news of “com .com” (previously owned by CNET) being quietly sold to dsparking .com*, a known entity in the realm of browser hijacking and domain squatting, had rippled within the security industry a couple of years ago, some experts expressed concern**...
* https://www.virustotal.com/en/domain/www.dsparking.com/information/
...
** https://blog.whitehatsec.com/why-com-com-should-scare-you/
... We recently encountered the URL, dw[DOT]com[DOT]com, that directed us to various destinations whenever we refresh it. Although this site is no longer accessible as we write this post, we were still able to visit one particular live URL destination that stood out among the rest during our testing. It is a -fake- Daily Mail news piece[3] reporting about British citizens finding a loophole wherein they can get the iPhone 6 for £1...
3] https://blog.malwarebytes.org/wp-content/uploads/2015/09/dailymail00.png
... All links on the fake Daily Mail article point to one URL, which then leads users to -random- destinations where they are offered freebies-behind-surveys or certain services... A little more digging around about dw[DOT]com[DOT]com has revealed that it also has a history of housing adware, PUPs[4], and spyware[5]... there are relatively few reports of com .com sites getting abused. That may be a good thing — at least for now; however, there may come a time when criminals would make full use of these sites for their malicious campaigns. So be advised, dear Reader, to avoid and proactively -block- them as early as now..."
4] https://www.herdprotect.com/domain-dw.com.com.aspx
5] https://www.f-secure.com/sw-desc/dw_com_com.shtml
dw .com .com: 54.201.82.69: https://www.virustotal.com/en/ip-address/54.201.82.69/information/
com .com: 209.132.243.234: https://www.virustotal.com/en/ip-address/209.132.243.234/information/
dsparking .com: 141.8.225.89: https://www.virustotal.com/en/ip-address/141.8.225.89/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-09, 15:22
FYI...
Fake 'Internship' SPAM – doc malware
- http://myonlinesecurity.co.uk/internship-word-doc-malware/
9 Sep 2015 - "An email with the subject of 'Internship' pretending to come from SAMETRICE BLACKBURN <pwlc@ healthassets .net> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Internship-1024x571.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode-1024x604.png
... 9 September 2015: My_Resume_7049.doc . Current Virus total detections 7/56*.
Downloads Dridex banking malware from http ://bakingsoda404 .com/dd/12345.exe (VirusTotal** 1/57)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/bcef317d97dc98bfc3d80f6ab42e35cb55da2344fcb0f4cdd8e526bea50cf01b/analysis/1441779828/
** https://www.virustotal.com/en/file/e38aa044c7324c7bf83aac7b441fa8b6610fb6b1ff318f8176273ac01a74f6e4/analysis/1441780825/
___
Fake 'new contract' SPAM - PDF malware
- http://myonlinesecurity.co.uk/we-have-submitted-a-new-contract-for-your-approval-please-view-the-attached-documentation-fake-pdf-malware/
9 Sep 2015 - "An email saying 'We have submitted a new contract for your approval. Please view the attached documentation' with the subject of 'Please view' pretending to come from FAX with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Please-view-1024x481.png
9 September 2015: renewed contract Blanda Common.zip: Extracts to: agreement Braden Views.exe
Current Virus total detections 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/afaccab3175e24bbbf2dde0d79f9216b30555b48cecc7f2ca5737a63ef1d7eb2/analysis/1441795477/
___
Fake 'MP2541' SPAM – PDF malware
- http://myonlinesecurity.co.uk/message-from-mp2541-fake-pdf-malware/
9 Sep 2015 - "An email with the subject of 'Message from “MP2541” (random numbers)' pretending to come from DoNotReply@ b(your own email domain) with a zip attachment is another one from the current bot runs... The content of the email says :
This E-mail was sent from “MP2541” (MP 2541).
Scan Date: Wed, 09 Sep 2015 10:33:34 GMT
Queries to: DoNotReply@ ...
9 September 2015: omp cheque.zip: Extracts to: omp cheque.scr
Current Virus total detections 4/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a61b06f03909b05e8130c7347cd66af6757280a7182880963f2f27c9071c8e51/analysis/1441799167/
___
Fake 'enrollment contract' SPAM – doc macro malware
- http://myonlinesecurity.co.uk/re-enrollment-contract-word-doc-macro-malware/
9 Sep 2015 - "An email with the subject of 'RE: enrollment contract' pretending to come from Calvin Hobbs <accounting@ steelgrill .com> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/enrollment-contract-1024x506.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode-1024x604.png
9 September 2015: charles_contract.doc - Current Virus total detections 2/56* ... Which goes through a convoluted download process via thetunaslab .com/wp-snapshots/sasa.txt (which simply contains the download link) and thetunaslab .com/wp-snapshots/66836487162.txt (a VB script to transform the downloaded .exe to a new location and name and autorun it) to end up with what is almost certainly a Dridex banking Trojan from http ://www. heavensound .it/wp-content/uploads/2015/06/pa.exe (VirusTotal 2/57 **)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/51440d736274490b2b764749601549f045baf776686b8f962005e0deec2f472e/analysis/1441810073/
** https://www.virustotal.com/en/file/f5d5218282dc56789951945d383e5c274e714998689743895a0dedabbbadc18e/analysis/1441811453/
... Behavioural information
TCP connections
93.170.105.115: https://www.virustotal.com/en/ip-address/93.170.105.115/information/
128.199.119.166: https://www.virustotal.com/en/ip-address/128.199.119.166/information/
___
'Famous Spy Software' - SCAM
- https://blog.malwarebytes.org/online-security/2015/09/thousands-of-hacked-sites-lead-to-offer-of-famous-spy-software/
Sep 9, 2015 - "... received a tip from one of our researchers, Steven Burn, who is continuously investigating on several persistent Facebook hacking scams... the individuals or group behind them merely rehashing the same lures and tactics; services that offer the hacking of Facebook accounts is one such scam. Using a single line of text to look for potential scam destinations, Burn came across not one but -thousands- of compromised sites offering this particular type of hacking service... Once users click any of the search result links, they are -redirected- multiple-times and then land on a page in the domain, trackphone[DOT]tk:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/trackphone.png
Clicking the big-green-button that says “Go to new site” directs to a page from mspy[DOT]com:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/mspy.png
... mSpy is a highly popular and controversial software that markets itself as a tool that a parent can use to monitor their child’s activities on their mobile devices -or- a tool that a doubting husband or wife can use to catch their cheating partners red handed... others who are contemplating on using tools similar to mSpy, especially if you’re a parent, we implore that you think this through carefully before using it, because you may inadvertently expose your child to harm more than good this way."
mspy .com: 104.20.26.47: https://www.virustotal.com/en/ip-address/104.20.26.47/information/
104.20.27.47: https://www.virustotal.com/en/ip-address/104.20.27.47/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-10, 13:22
FYI...
Fake 'QuickBooks Invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/quickbooks-invoice-payment-overdue-fake-pdf-malware/
10 Sep 2015 - "An email with the subject of 'Payment Overdue' pretending to come from QuickBooks Invoice <auto-invoice@ quickbooks .com> with a zip attachment is another one from the current bot runs... The content of the email says :
Please find attached your invoices for the past months. Remit the payment by 10/09/2015 as outlines under our “Payment Terms” agreement.
Thank you for your business,
Sincerely,
Rosendo Numbers
This e-mail has been sent from an automated system. PLEASE DO NOT REPLY.
The information contained in this message may be privileged, confidential and protected from disclosure...
10 September 2015: Invoice.zip: Extracts to: Invoice.scr
Current Virus total detections 0/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5eed6039d5073f26a4b347dfb2379d4c72d391a020f01ba2faf7fe2698c5b979/analysis/1441880136/
- http://blog.dynamoo.com/2015/09/malware-spam-payroll-received-by-intuit.html
10 Sep 2015 - "... Attached is a file payroll_report.zip which in turn contains a malicious executable payroll_report.scr which has a VirusTotal detection rate of 3/56*. The Hybrid Analysis report** shows traffic patterns that are consistent with the Upatre downloader -and- Dyre banking trojan. In particular, the malware contacts a familiar server at 197.149.90.166 (Cobranet, Nigeria) which you should definitely block ..."
* https://www.virustotal.com/en/file/5eed6039d5073f26a4b347dfb2379d4c72d391a020f01ba2faf7fe2698c5b979/analysis/1441886437/
** https://www.hybrid-analysis.com/sample/5eed6039d5073f26a4b347dfb2379d4c72d391a020f01ba2faf7fe2698c5b979?environmentId=1
197.149.90.166: https://www.virustotal.com/en/ip-address/197.149.90.166/information/
___
Fake 'America Airlines' SPAM – JS malware
- http://myonlinesecurity.co.uk/america-airlines-your-ticket-order-00000239643-js-malware/
10 Sep 2015 - "An email with the subject of 'Your ticket order #00000239643 approved' [random numbered] pretending to come from America Airlines with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/America-Airlines_Your-ticket-order-00000239643-approved-1024x504.png
10 September 2015: Order_00000239643.zip: Extracts to: Order_00000239643.doc.js
Current Virus total detections 13/57* ... which downloads 2 files 42809780.exe (Virus total 1/57 **) (Hybrid analysis***) and 3233543213348c1[1].gif (VirusTotal 10/56 [4]) (Hybrid Analysis[5]) from a combination of these 3 sites:
64.239.115.111: https://www.virustotal.com/en/ip-address/64.239.115.111/information/
les-eglantiers .fr: 76.74.242.190: https://www.virustotal.com/en/ip-address/76.74.242.190/information/
readysetgomatthew .com: 205.144.171.28: https://www.virustotal.com/en/ip-address/205.144.171.28/information/
See MALWR report[6] and Wepawet[7] ... which decodes or deobfuscates the javascript... note that the 42809780.exe has a -stolen- digital signature from Microsoft, which has been blocked (at least in Internet Explorer), Smart Filter warns about an invalid digital signature:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/corrupt-signature.png
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/db414dd5666ebc0f4323c612cce3212057d0fc652e45d3a33f5120636143d5bf/analysis/1441858346/
** https://www.virustotal.com/en/file/bf6fc83f1faa959a16a2a35650e44382e00608198f881f2cab72fe65fd14265c/analysis/1441845045/
*** https://www.hybrid-analysis.com/sample/bf6fc83f1faa959a16a2a35650e44382e00608198f881f2cab72fe65fd14265c?environmentId=1
4] https://www.virustotal.com/en/file/ca304658a124a4f39429425c674eacd69d2cb4463fd79775c5be184d747a02c5/analysis/1441859040/
5] https://www.hybrid-analysis.com/sample/ca304658a124a4f39429425c674eacd69d2cb4463fd79775c5be184d747a02c5?environmentId=1
6] https://malwr.com/analysis/ODEyYTNjZTNjNzM4NGE2YmFkZDQ2OWZiNzQ0OGZmMDk/
7] https://wepawet.iseclab.org/view.php?hash=23de9e6aad67d8a516acd6e60d90f4e9&type=js
___
Fake 'New Fax' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-new-fax-3901535011-uk2fax.html
10 Sep 2015 - "This -fake- fax spam comes with a malicious attachment:
From "UK2Fax" [fax2@ fax1.uk2fax .co.uk]
Date Thu, 10 Sep 2015 14:07:11 +0100
Subject New Fax - 3901535011
UK2Fax Fax2Email : New fax attached, received at 10/09/2015 10:26:29 GMT
Attached is a file Fax-3901535011.zip which in turn contains a malicious executable Fax-800312316.scr which is exactly the -same- Upatre/Dyre payload as seen in this attack also seen today*."
* http://blog.dynamoo.com/2015/09/malware-spam-payroll-received-by-intuit.html
___
'Spear-phishing' - Know the Risk, Raise Your Shield
- http://arstechnica.com/security/2015/09/us-counterintelligence-czar-tells-government-employees-raise-your-shields/
Sep 9, 2015 - "... the director of the National Counterintelligence and Security Center (NCSC) announced a "new counterintelligence campaign" focused on reducing the potential security damage done by the Office of Personnel Management data breaches. Called 'Know the Risk, Raise Your Shield', the campaign's opening salvo is a pair of spear-phishing awareness videos, urging people -not-to-click-on 'those links'*... The Office of the Director of National Intelligence, which the NCSC is part of, is pushing out materials for the campaign through its website and social media channels..."
* https://www.youtube.com/embed/videoseries?list=PLfaSGHp0IgDBzfD8dnJ3CpklC2vNkbtiD
Video 2:53
Know the Risk, Raise Your Shield
:fear::fear: :mad:
AplusWebMaster
2015-09-11, 13:48
FYI...
Fake 'e-invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-latest-e-invoice-from-tnt-1568467424-9445661-fake-pdf-malware/
11 Sep 2015 - "An email with the subject of 'Your latest e-invoice from TNT 1568467424 9445661 (random numbers)' pretending to come from eInvoicing <groupadminstubbinsDONOTREPLY@ tnt .com> with a zip attachment is another one from the current bot runs... The content of the email says :
PLEASE DO NOT RESPOND – Emails to this address are not monitored or responded to.
Please find attached your TNT Invoice. Please note that our standard payment terms require cleared funds in our account by the 15th of the month following the month of invoice.
IMPORTANT CONTACT DETAILS
To register an invoice query please contact us at ukinvoicequeries@ tnt .co.uk
To forward a remittance advice or confirm payment please contact us at tntuk.cash.allocation@ tnt .com
To set up a Direct Debit plan please contact us at tntdirectdebit@ tnt .co.uk
For quick and easy access to your invoices simply log in using your user name and password to https ://express .tnt .com/eInvoicing and you’ll be able to view and download your electronic invoices immediately.
If you have forgotten your user name or password please follow the above link where you will be able to reset your log-in details. If you are experiencing any technical issues with your e-Invoicing account please contact us at ukeinvoice@ tnt .co.uk
Rest assured, we operate a secure system, so we can confirm that the invoice PDF originates from TNT and is authenticated with a digital signature. Thank you for using e-invoicing...
11 September 2015: 1568467424_9445661.zip: Extracts to: 0230516548_6835403.scr
Current Virus total detections 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4d962c3ba8f89cc9ccad9fc2a943236fa86a4054b3b2e6339f859dbf2b746c59/analysis/1441967307/
___
Fake 'Sales Order' SPAM – PDF malware
- http://myonlinesecurity.co.uk/sales-order-acknowledgement-order-no-7m661725-your-reference-89-bud-fake-pdf-malware/
11 Sep 2015 - "An email with the subject of 'Sales Order Acknowledgement – Order No: 7M661725 – Your Reference: 89 /Bud (random numbers and names)' pretending to come from random companies and email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Please find attached your sales order acknowledgement
Order No: 7M661725
Account: MGQ313
Your Reference: 89 /Bud
Web Reference:
Kind Regards
Office Team
11 September 2015: SalesOrderAcknowledgement_2G060028.zip: Extracts to: SalesOrderAcknowledgement.scr
Current Virus total detections 0/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/955b41ec93d517b348a485b377848d102bdc74a81bb712ec416addc6c9997b8d/analysis/1441964692/
- http://blog.dynamoo.com/2015/09/malware-spam-sales-order.html
11 Sep 2015 - "This -fake- financial spam comes with a malicious payload:
From "reports@officeteam .co.uk" [reports@ officeteam .co.uk]
Date Fri, 11 Sep 2015 10:39:32 GMT
Subject Sales Order Acknowledgement - Order No: EF150085 - Your Reference: 14 /Geneva
Please find attached your sales order acknowledgement
Order No: EF150085...
... SalesOrderAcknowledgement_EF150085.zip which in turn contained a malicious executable SalesOrderAcknowledgement.scr which has a VirusTotal detection rate of 3/55*. The Hybrid Analysis report** shows that amongst other traffic, it communicates with a familiar Nigerian IP of 197.149.90.166 (Cobranet)... the payload is Upatre downloading the Dyre banking trojan."
* https://www.virustotal.com/en/file/955b41ec93d517b348a485b377848d102bdc74a81bb712ec416addc6c9997b8d/analysis/1441972298/
** https://www.hybrid-analysis.com/sample/955b41ec93d517b348a485b377848d102bdc74a81bb712ec416addc6c9997b8d?environmentId=1
___
Fake 'SOP Invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/sop-invoice-single-ppl-leeds-co-uk-fake-pdf-malware/
11 Sep 2015 - "An email with the subject of 'SOP Invoice (Single)' pretending to come from “Carlene Kidd” <Carlene.Kidd@ ppl-leeds .co.uk> (random names @ ppl-leeds .co.uk) with a zip attachment is another one from the current bot runs... The content of the email says :
Hi Nicolas
Please find attached copy Invoice No: J292G64W as requested.
Regards
Carlene
The attached file is a Sage Report in PDF (Adobe Acrobat) format. To view
the report you will need Acrobat Reader, available as a free download...
11 September 2015: Invoice_J292G64W.zip: Extracts to: invoice.scr
Current Virus total detections 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3b35c46305ed2c213d3257cb4e9b5d3c4b1171bf9410dfd01dd95379868c09af/analysis/1441965422/
___
Fake 'PO & New Order' SPAM – doc malware
- http://myonlinesecurity.co.uk/po-new-order-word-doc-rtf-exploit-malware/
11 Sep 2015 - "An email with the subject of 'PO & New Order' pretending to come from Sales with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/PO-New-Order-1024x599.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be -blank- or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode.png
11 September 2015: PO & New Order.doc - Current Virus total detections 23/56* .
Downloads http ://creativelinkspk .com/.css/ashok.exe (VirusTotal** 18/57). This looks like an old exploit CVE-2012-0158 that was fixed in MS12-027... but there is always a possibility that the exploit creators have added to it to work in modern office versions... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/259d002304dcd933598733d0b126a4882fcc8279a1af667e5999c30d0e7c0bb0/analysis/1441931051/
** https://www.virustotal.com/en/file/25bdb0eb8ddd9c219b1124642d41359d86493a5d1721f5cc30445e2e360f3d4c/analysis/1441887586/
creativelinkspk .com: 192.3.105.250: https://www.virustotal.com/en/ip-address/192.3.105.250/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-13, 14:24
FYI...
Fake 'Pretrial requirements' SPAM – JS malware
- http://myonlinesecurity.co.uk/pretrial-requirements-js-malware/
13 Sep 2015 - "An email with the subject of 'Pretrial requirements' pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Pretrial-requirements-1024x388.png
12 September 2015: pretrial_requirements488.zip: Extracts to: pretrial_requirements488.js
Current Virus total detections 21/57* . (Wepawet**) (MALWR***) which downloads multiple files including Adobe_update-S3NS81Y2MJC[1].exe (virus total 0/56 [4]) and Adobe_update-1SGMQ65OVG[1].exe (VirusTotal 0/57 [5]) and a genuine pdf (Adobe_update-BI5T99S2B9W[1].pdf) which displays an invoice to think that the entire download is innocent from a combination of these sites (this particular version only uses the first 2 sites, but if it cannot contact either of them, it will try each site in turn until it downloads the malware):
ERVINSOLAR .NET: 88.198.60.20: https://www.virustotal.com/en/ip-address/88.198.60.20/information/
JAIINSTITUTEFORPARENTING .NET: 50.62.232.1: https://www.virustotal.com/en/ip-address/50.62.232.1/information/
C3SMS .COM: 72.249.68.39: https://www.virustotal.com/en/ip-address/72.249.68.39/information/
www .prairiehouse .ie: 80.93.29.15: https://www.virustotal.com/en/ip-address/80.93.29.15/information/
DIGITALCONTACT .COM: 54.154.210.110: https://www.virustotal.com/en/ip-address/54.154.210.110/information/
LIVINGLAVIDAPYME .COM: 72.47.236.23: https://www.virustotal.com/en/ip-address/72.47.236.23/information/
LASALCHICHONERIA .COM: 72.47.236.23
AZHINEHPS .COM: 149.3.137.13: https://www.virustotal.com/en/ip-address/149.3.137.13/information/
XINHFURNITURE .COM: 112.78.2.205: https://www.virustotal.com/en/ip-address/112.78.2.205/information/
The PDF is genuine and obviously a stolen invoice from an Italian company Eco srl being -reused- to try to fool you into thinking that it is only an invoice being displayed while the other malware is silently downloaded and run in the background:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/eco_pdf-1024x619.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0ef3c63ee62fca913da44b8b070d3d8953e8dcd8608c06c6530e232977ea0eb7/analysis/1442130826/
** https://wepawet.iseclab.org/view.php?hash=7f38d9df842a87500e5be65061a149de&type=js
*** https://malwr.com/analysis/Mjk4ZDIyYjM2OTA1NGZhMmJiODFkZDM3MzNhOWM1ZTQ/
4] https://www.virustotal.com/en/file/1c12159581ea7e065e1feba7463feb50176cf30ee2272b10ced51674f48675ce/analysis/1442105203/
5] https://www.virustotal.com/en/file/459e1130d677ce75e1131358770dc0125757204bbdb927a4033f43d078f62202/analysis/1442131135/
:fear::fear: :mad:
AplusWebMaster
2015-09-14, 12:32
FYI...
HMRC Tax Refund / Phish ...
- https://blog.malwarebytes.org/fraud-scam/2015/09/avoid-this-hmrc-tax-refund-phish/
Sep 14, 2015 - "... here’s the spam mail, which is titled 'Tax Refund New Message Alert!':
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/hmrcform0.jpg
Some standouts:
1. The -typo- in the sender address. Yes, we already mentioned it but it’s such an amazingly silly way to blow the cover of an attempted phish that I’m going to point and roll my eyes at it twice.
2. Do Tax Departments send anybody emails with exclamation-marks in the subject? It doesn’t seem in line with the notion of serious people sending out serious tax emails, really.
3. “See this email? Yeah, don’t tell anyone about it okay? It’s our little secret. Cough cough.”
4. “Download and fill out a form” HMRC don’t send out mails about tax rebates.
5. “Allow 5 to 9 business days, because we won’t have enough time to rip-off the card details you just sent us if you’re checking your account every five minutes”.
Note that in the above example, the mail was sent to an Outlook account and was-flagged as spam – not all mail providers catch something, so it pays to always be on your guard.
Clicking the link offers up a HTML file download from: liveinlove(dot)us/index(dot)php:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/hmrcform1.jpg
Opening up the file in a browser will fetch elements of real HMRC pages to add that little extra splash of authenticity:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/hmrcform2.jpg
There is, of course, no HTTPS / padlock which one would hope sets off a few alarm bells. The form follows the common pattern of not letting you proceed unless you’ve entered information in the relevant boxes. They want full card details, bank name, security code, name, DOB, address – the works. Once the submit button is hit, the victim will be redirected to a real HMRC page via the liveinlove URL. It seems the website being used for this scam has been -hacked-... In a first for me, I’ve had to let someone know their site has been compromised via a wedding RSVP form. As the wedding was due to take place back in -2014- I’m not entirely sure someone will be there to pick up the message but we’ll see how it goes. Should you receive one of these mails, feel free to delete it."
liveinlove .us: 192.186.248.162: https://www.virustotal.com/en/ip-address/192.186.248.162/information/
___
Next Gen ATM Malware
- https://www.fireeye.com/blog/threat-research/2015/09/suceful_next_genera.html
Sep 11, 2015 - "You dip your debit card in an automated teller machine (ATM) and suddenly realize it is stuck inside, what happened?
a) You took too much time entering details.
b) There was an error in the network connection to the bank.
c) The machine is infected with malware and your card was intentionally retained to be ejected to the crooks once you walk away asking for help.
If you answered ‘c’ you might be correct! FireEye Labs discovered a new piece of ATM malware (4BDD67FF852C221112337FECD0681EAC) that we detect as Backdoor.ATM.Suceful (the name comes from a typo made by the malware authors), which targets cardholders and is able to retain debit cards on infected ATMs, disable alarms, or read the debit card tracks. ATM malware is not new, back in 2013 and 2014 threats like Ploutus[1] or PadPin[2] (Tyupkin) were used to empty ATMs in Mexico, Russia and other countries, but SUCEFUL offers a new twist by targeting the cardholders. SUCEFUL was recently uploaded to VirusTotal (VT) from Russia, and based on its timestamp, it was likely created on August 25, 2015. It might still be in its development phase; however, the features provided are shocking and never seen before in ATM malware:
> https://www.fireeye.com/content/dam/fireeye-www/blog/images/SUCEFUL/suceful1.png
Potential SUCEFUL capabilities in Diebold or NCR ATMs include:
1. Reading all the credit/debit card track data
2. Reading data from the chip of the card
3. Control of the malware via ATM PIN pad
4. Retention or ejection of the card on demand: This could be used to steal physical cards
5. Suppressing ATM sensors to avoid detection ..."
(More detail at the fireye URL above.)
:fear::fear: :mad:
AplusWebMaster
2015-09-15, 13:58
FYI...
Fake 'Payment Summary' SPAM – PDF malware
- http://myonlinesecurity.co.uk/payment-summary-group-certificate-for-201415-financial-year-paysliphss-health-nsw-gov-au-fake-pdf-malware/
15 Sep 2015 - "2 sets of emails pretending to come from payslip@ hss.health.nsw. gov.au with the subject of 'Payment Summary (Group Certificate) for 2014/15 financial year' or 'Payslip for the period 31 Aug 2015 to 14 sep 2015' with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Payment-Summary-Group-Certificate-1024x506.png
15 September 2015: PAYG-EoY-2014-15-11577085-181466719.zip: Extracts to: PAYG-EoY-2014-15-04831806-000718002.scr
Current Virus total detections 11/56*
15 September 2015: Payslip13526234054137704-78242.zip: Extracts to: Payslip00477196470196471-00038.scr
Current Virus total detections 6/57**
... Techhelplist.com have done a breakdown of these Upatre downloaders from yesterday’s versions of these emails with similar attachments... HERE[3] and Here[4].
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1557a4bf5fecd2fc71102f8a32ff2dc215c9181b1868bd58438619b9091cc6e9/analysis/1442293989/
** https://www.virustotal.com/en/file/c290b05920fa0947ef92cc30f405b8715d245b68f080ff90a8c75f6ed18dd977/analysis/1442282228/
3] https://techhelplist.com/spam-list/923-payment-summary-group-certificate-for-financial-year-malware
4] https://techhelplist.com/spam-list/924-payslip-for-the-period-date-to-date-malware
___
Fake 'Unsettled invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/unsettled-invoice-e-mail-notice-fake-pdf-malware/
15 Sep 2015 - "The latest -Upatre- style downloaders are attached to series of emails with the subject of 'Unsettled invoice e-mail notice' pretending to come from random addresses with a zip attachment is another one from the current bot runs... The content of the email says:
Hello dear customer,
I urgently ask you to settle an invoice from Tue, 15 Sep 2015 11:39:13 +0100
Other subjects in this malspam run include:
Unsettled invoice e-mail reminder
Important invoice e-mail notice
Overdue invoice e-mail reminder
Unsettled invoice notification
Outstanding invoice e-mail notice
Important invoice final reminder
The times are all random, but the dates all say Tue, 15 Sep 2015..
15 September 2015: Voluptas soluta laborum illum aperiam praesentium molestiae sequi..zip:
Extracts to: Consequatur sint consectetur qui esse..exe
Current Virus total detections 1/57*
This doesn’t actually appear to be Upatre and we haven’t managed to get any other downloads from it via automatic analysis so far... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e508a362c02b96c29a1257cab1dad4ff9577b1fa68f41fccb354f065e8f5d1a4/analysis/1442313814/
___
WhatsApp scam/SPAM ...
- https://blog.malwarebytes.org/fraud-scam/2015/09/dont-get-stuck-on-whatsapp-stickers/
Sep 15, 2015 - "We’ve spotted a WhatsApp scam using the same general template as the previously covered WhatsApp Elegant Gold*, located at:
stickers-whatsapp(dot)com
... which asks for your WhatsApp Number in return for some “stickers“. You typically have to pay for stickers via a number of Apps, so potential freebies are always going to pull in some eyeballs.
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/whatstickers1.jpg
It follows the familiar pattern of “Spam a bunch of people and we’ll give you what you want”, complete with inevitable Shyamalan-style plot twist at the end (no, your phone wasn’t a ghost the whole time). Here’s the spam request:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/whatstickers2.jpg
... As with other sites of a similar nature**, we advise you to not bother and stick to legit apps on your mobile store of choice if you really want to plaster your texts with images. All you’ll get for your time and trouble with these websites are adverts, PUPs and surveys (also, your phone was totally a ghost the whole time)."
* https://blog.malwarebytes.org/fraud-scam/2015/07/whatsapp-elegant-gold-hits-the-digital-catwalk/
** https://blog.malwarebytes.org/fraud-scam/2015/03/scams-pups-target-would-be-whatsapp-voice-users/
stickers-whatsapp(dot)com: 54.254.185.159: https://www.virustotal.com/en/ip-address/54.254.185.159/information/
___
Cisco router break-ins bypass cyber defenses
- http://www.reuters.com/article/2015/09/15/us-cybersecurity-routers-cisco-systems-idUSKCN0RF0N420150915
Sep 15, 2015 - "... researchers* say they have uncovered clandestine attacks across three continents on the routers that direct traffic around the Internet, potentially allowing suspected cyberspies to harvest vast amounts of data while going undetected. In the attacks, a highly sophisticated form of malicious software, dubbed "SYNful Knock'*, has been implanted in routers made by Cisco..."
* https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
Sep 15, 2015 - "... recent vendor advisories indicate that these have been seen in the wild. Mandiant can confirm the existence of at least -14- such router implants spread across four different countries: Ukraine, Philippines, Mexico, and India... Conclusion: ... It should be evident now that this attack vector is very much a reality and will most likely grow in popularity and prevalence..."
1] http://www.cisco.com/web/about/security/intelligence/integrity-assurance.html
:fear::fear: :mad:
AplusWebMaster
2015-09-16, 14:57
FYI...
Fake 'Renewed insurance policy' SPAM – PDF malware
- http://myonlinesecurity.co.uk/renewed-insurance-policy-e-mail-fake-pdf-malware/
16 Sep 2015 - "An email with the subject of 'Renewed insurance policy' e-mail pretending to come from random companies (all appearing to be either Australian or New Zealand addresses) with a zip attachment is another one from the current bot runs... The content of the email says :
Good afternoon,
This email address was specified to get a new insurance policy. Your policy is attached
Other subjects include:
Important insurance e-mail notice
Insurance policy e-mail notice
Health insurance notice
Renewed insurance policy e-mail notice
Important insurance e-mail
16 September 2015: 23720.zip: Extracts to: 96998.exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5adbfb4c61acd3f446554fd6dc1cbd09791c2880ea67b1b63fbd7056c2c3a709/analysis/1442351794/
___
Fake 'HSBC SecureMail' SPAM - malicious payload
- http://blog.dynamoo.com/2015/09/malware-spam-hsbc-securemail-you-have.html
16 Sep 2015 - "This -fake- HSBC email message has a malicious payload:
From: HSBC SecureMail [HSBCRepresentative_WilliamsBlankenship@ hsbc .co.uk]
Date: 16 September 2015 at 13:13
Subject: You have received a secure message ...
... file HSBC_Payment_87441653.zip which in turn contains a malicious executable HSBC_Payment_87441653.exe, this has a VirusTotal detection rate of 4/56*. Automated analysis is pending... but the payload is most likely to be Upatre/Dyre."
* https://www.virustotal.com/en/file/a0c4f616758a29bf0386de439c61729918a3637dab281089f2115ba8c35957c2/analysis/1442407433/
___
Fake 'Lloyds Bank' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/you-have-received-a-new-debit-and-lloyds-bank-pendeford-securities-please-read-action-required-word-doc-or-excel-xls-spreadsheet-malware/
16 Sep 2015 - "A BOGOF (Buy one, get one free) today pretending to come from various Lloyds bank email addresses with 2 different subjects both containing the same word macro downloader malware: 'You have received a new debit and Lloyds Bank – Pendeford Securities – Please Read Action Required/PI Documents/ Region code East 2/ 1831383/' with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshots:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Lloyds-Bank-Pendeford-Securities-Please-Read-Action-Required-1024x742.png
-Or-
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/You-have-received-a-new-debit-1024x511.png
DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode-1024x604.png
The version of this word doc that I received actually has this content which tries to suggest it is protected with an RSA digital signature key that needs you to enable macros and editing to be able to see the proper content. You definitely do-not-want-to-enable-macros or editing or you-will-be-infected:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/ReportonTitle0045168.1Final_doc-1024x597.png
16 September 2015: ReportonTitle0045168.1Final.doc - Current Virus total detections 4/53* .
The malicious macros in this malware are giving problems to the automatic analysers, who aren’t able to actually get the malware. The macro contacts:
obiectivhouse .ro/wp-content/plugins/maintenance/load/images/fonts-icon/
... which is an open directory where it gets various instructions to download the actual malware from http ://vandestaak .com/css/libary.exe and autorun it (VirusTotal**) which is itself an Upatre downloader that will download today’s version of the Dyre/dyreza/dridex banking Trojan malware... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/aeb8c585e9fcc35d5470bec8284e59a0a0150114c1f60d106a3b2f284ee6c8b4/analysis/1442403104/
** https://www.virustotal.com/en/file/0c91c33093c576294b6266fa21959bf45f8afc2c4fe55d3251cb2769266d628e/analysis/1442407381/
obiectivhouse .ro: 178.156.230.216: https://www.virustotal.com/en/ip-address/178.156.230.216/information/
- http://blog.dynamoo.com/2015/09/malware-spam-lloyds-bank-pendeford.html
16 Sep 2016 - "...In the sample I saw, there was a Word document ReportonTitle7117152.1Final.doc attached (detection rate 4/56*)... malicious macro. The macro attempts to download components from the following locations:
thebackpack .fr/wp-content/themes/salient/wpbakery/js_composer/assets/lib/prettyphoto/images/prettyPhoto/light_rounded/66836487162.txt
thebackpack .fr/wp-content/themes/salient/wpbakery/js_composer/assets/lib/prettyphoto/images/prettyPhoto/light_rounded/sasa.txt
obiectivhouse .ro/wp-content/plugins/maintenance/load/images/fonts-icon/66836487162.txt
obiectivhouse .ro/wp-content/plugins/maintenance/load/images/fonts-icon/sasa.txt
A further download then takes place from:
vandestaak .com/css/libary.exe
This has a detection rate of 3/56**. The general characteristics of this file make it a close match to the Upatre/Dyre payload of this concurrent spam run [3] (automated analysis is pending).
Recommended blocklist:
197.149.90.166
vandestaak .com
thebackpack .fr
obiectivhouse .ro "
* https://www.virustotal.com/en/file/aeb8c585e9fcc35d5470bec8284e59a0a0150114c1f60d106a3b2f284ee6c8b4/analysis/1442408475/
** https://www.virustotal.com/en/file/0c91c33093c576294b6266fa21959bf45f8afc2c4fe55d3251cb2769266d628e/analysis/1442411964/
3] http://blog.dynamoo.com/2015/09/malware-spam-hsbc-securemail-you-have.html
vandestaak .com: 213.179.202.11: https://www.virustotal.com/en/ip-address/213.179.202.11/information/
thebackpack .fr: 195.144.11.40: https://www.virustotal.com/en/ip-address/195.144.11.40/information/
obiectivhouse .ro: 178.156.230.216: https://www.virustotal.com/en/ip-address/178.156.230.216/information/
___
Fake 'Autopay information' SPAM – PDF malware
- http://myonlinesecurity.co.uk/autopay-information-fake-pdf-malware/
16 Sep 2015 - "An email with the subject of 'Autopay information' pretending to come from random companies with a zip attachment is another one from the current bot runs... The content of the email says :
Hello,
A new monthly invoice for the services is available to view online and is included as an attachment.
No action is required because you’ve signed up for the AutoPay.
Just review and retain this invoice #52467 for your records.
Other subjects in this series of emails include:
Settled invoice info
Online service invoice info ...
16 September 2015: Get new check MacGyver Station.zip: Extracts to: Repay insurance bill Ullrich Falls.exe
Current Virus total detections: 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/847e54508b08cff2a694451d5334f70c2e7c8347ef5f474dec9b3c8273558dad/analysis/1442410631/
___
Fake Amazon UK Mail - phish...
- https://blog.malwarebytes.org/fraud-scam/2015/09/fake-amazon-uk-mail-asks-you-to-verify-your-account-after-breach/
Sep 16, 2015 - "There is an Amazon phishing scam currently making rounds, so you better keep an eye on your inboxes, assuming your spam traps haven’t picked up on this one yet. And much like majority of phish campaigns, this one also begins with an email. The samples we retrieved all originated from the Linode server (24.236.39.51):
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/amazon-phish-mail.png
... The “Get Started” text is, of course, a link leading to the phishing page (screenshot below), which is at ukamazonverify[DOT]com:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/amazon-phish-page-one.png
... After text boxes have been filled out, the user is taken to another page asking for -more- details, which includes personally identifiable information (PII), payment card details, and account security details (screenshot below), while data about email address and password are saved to Verify.php, which is located within the domain:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/amazon-verify-page.jpg
Data that users enter on this page are saved to Finish.php after clicking the Validate button. The page then changes to tell users to wait as this site processes all their details, complete with a “spinny” indicator to denote that indeed some semblance of data processing is taking place at the background:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/amazon-phish-spinny.png
What users don’t realize is that they’re actually taking their cue from a GIF file, and not an actual indicator, as they wait for what happens next. In the end, they are directed to the real Amazon UK site.
ukamazonverify[DOT]com was created two-days-ago, along with other domains registered under a specific email address from 126[DOT]com, a popular email provider in China. Some browsers have already flagged the domain as a potential threat, which is great... when you see a similar email like the one above in your inbox, simply delete them..."
ukamazonverify[DOT]com: 103.42.180.253: https://www.virustotal.com/en/ip-address/103.42.180.253/information/
___
Fake 'New payment for tax refund' SPAM – JS malware
- http://myonlinesecurity.co.uk/new-payment-for-tax-refund-0000255599-js-malware/
16 Sep 2016 - "An email with the subject of 'New payment for tax refund #0000255599' [random numbered] pretending to come from Internal Revenue Service <office@ irs .gov> with a zip attachment is another one from the current bot runs... The content of the email says :
This is to inform you that your tax refund request has been processed.
Please find attached a copy of the approved 94035N form you have submitted.
Transaction type – Tax Refund
Payment method – Wire transfer
Amount – $ 3214.00
Status – Processed
Form – 94035N
Additional information regarding tax refunds can be found on our website...
Regards,
Internal Revenue Service
Address: 1111 Constitution Avenue, NW
Washington, DC 20224 ...
Phone: 1-800-829-1040
16 September 2015: Tax_Refund_0000255599_Processed.zip: Extracts to: Tax_Refund_0000255599_Processed.doc.js
Current Virus total detections 22/56* ... which downloads -3- files
53212428.exe (Virustotal 1/57 **)
13876688.exe (VirusTotal 2/57 ***) and
0cedc1[1].gif (VirusTotal 1/57 ****) from a combination of these 3 sites:
crossfitrepscheme .com
dickinsonwrestlingclub .com
les-eglantiers .fr
(MALWR[5])
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2af8cee2185ef4d9d4c29eeb8b126bd60eab7a749130d0024eda1fa87c01baa3/analysis/1442419074/
** https://www.virustotal.com/en/file/4d3c3075482d12b0b71e337e7c53ffa844959e63b7bafecb03bad847a091f09b/analysis/1442414485/
*** https://www.virustotal.com/en/file/d098f4b68a9ab8e477985d0cde798026b150d150a8f17853e57deff162a29eda/analysis/1442414434/
**** https://www.virustotal.com/en/file/52f8b985d9e725d19db68fa055e055f6073b07d360b3e2f32dfe92dc35d4e6b0/analysis/1442419912/
5] https://malwr.com/analysis/MDc5NThhYzRiMDIxNDY0Mjg0MDA5MDBlMzNmMDU0OTU/
crossfitrepscheme .com: 199.175.49.19: https://www.virustotal.com/en/ip-address/199.175.49.19/information/
dickinsonwrestlingclub .com: 72.20.64.58: https://www.virustotal.com/en/ip-address/72.20.64.58/information/
les-eglantiers .fr: 76.74.242.190: https://www.virustotal.com/en/ip-address/76.74.242.190/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-17, 14:39
FYI...
Fake 'E-Bill' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-shell-e-bill-for-week-38.html
17 Sep 2015 - "This -fake- financial spam comes with a malicious attachment:
From [invoices@ ebillinvoice .com]
To administrator@ victimdomain .com
Date Thu, 17 Sep 2015 11:10:15 GMT
Subject Shell E-Bill for Week 38 2015
Customer No : 28834
Email address : administrator@ victimdomain .com
Attached file name : 28834_wk38_2015.PDF
Dear Customer,
Please find attached your invoice for Week 38 2015.
In order to open the attached PDF file you will need
the software Adobe Acrobat Reader...
Yours sincerely
Customer Services...
Attached is a file 28834_wk38_2015.zip containing a malicious executable 67482_wk38_2015.scr which has a detection rate of 2/56*. Automated analysis is pending, but the payload is almost definitely Upatre/Dyre which has been consistently sending traffic to 197.149.90.166 (Cobranet, Nigeria) for some time now, so I suggest that you -block- or monitor that IP."
* https://www.virustotal.com/en/file/1d8ec411516159ec752aef930991d3c981c9d64ac8be7fe9121339df52fbda83/analysis/1442489503/
___
Fake 'REFURBISHMENT' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-hrwfmailerprodlancashirego.html
17 Sep 2015 - "This -fake- financial spam... comes in several different variants (I saw two):
From "Workflow Mailer" [hrwfmailerprod@ lancashire. gov.uk]
To hp_printer@ victimdomain .com
Date Thu, 17 Sep 2015 12:16:26 GMT
Subject FYI: Sent: Online Discussion Message for RFQ 6767609,1 (LCDC - NF014378 R.R. Donnelley & Sons Company - REFURBISHMENT)
__
From Mabel Winter
To hp_printer@ victimdomain .com
Sent Thu, 17 Sep 2015 12:12:26 GMT
ID 7216378
Number 6767609,1
Title Q3EX - 1C995408 R.R. Donnelley & Sons Company - REFURBISHMENT
Negotiation Preview Immediately upon publishing
Negotiation Open Immediately upon publishing
Negotiation Close September 21, 2015 10:00 am GMT
Company R.R. Donnelley & Sons Company
Subject ITT Clarifications
To view the message, please open attachment.
The other version I had mentioned "QMDM - 5J673827 CDW Computer Centers Inc. - REFURBISHMENT" instead. The attachment appears to have a randomly-generated name e.g. REFURBISHMENT 7216378.zip and REFURBISHMENT 4435708.zip which contain a malicious executable REFURBISHMENT 7015295.scr which has a VirusTotal detection rate of 3/55*. The payload appears to be Upatre/Dyre..."
* https://www.virustotal.com/en/file/ec80290064cdcad4d20ac6b610d26f1bc93bc7588815f277b946692a1c9b9f44/analysis/1442492094/
___
Fake 'Important notice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/important-notice-about-document-signing-fake-pdf-malware/
17 Sep 2015 - "An email with the subject of 'Important notice about document signing' pretending to come from random companies with a zip attachment is another one from the current bot runs... The content of the email says :
Hello,
You have been sent the document to sign it using Signority. To view this document, user’s personal data and secured link to signing, please open the attachment.
Regards,
The Signority Team
Other subjects in this malspam run delivering Upatre downloaders include:
Notice of documentation signing
Important notification of document signing
Important notice about documentation signing ...
17 September 2015: Gain infringement fine .zip: Extracts to: Send proposed sum .exe
Current Virus total detections 3/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/7bd9692f17ca135cae60bfb2a51b50893033d87c56f3f95adbf2908c8021df5b/analysis/1442507711/
:fear::fear: :mad:
AplusWebMaster
2015-09-18, 14:09
FYI...
Fake 'Transaction confirmation' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-transaction-confirmation.html
18 Sep 2015 - "This -fake- banking spam comes with a malicious attachment:
From donotreply@ lloydsbank .co.uk
Date Fri, 18 Sep 2015 11:52:36 +0100
Subject Transaction confirmation
Dear Customer,
Please see attached the confirmation of transaction conducted from Your
account. Kindly sign and forward the copy to us for approval.
Best regards,
Your personal Manager
Thora Blanda
tel: 0345 300 0000
LLOYDS BANK.
Attached is a file Notice.zip which contains a malicious executable Value mortgage policy .exe (note the rogue space) which has a VirusTotal detection rate of 3/55*. The Hybrid Analysis report** shows activity consistent with Upatre/Dridex including a key indicator of traffic to 197.149.90.166 in Nigeria."
* https://www.virustotal.com/en/file/129421186aed9a2bb2177fe5ab51342decca0f0b6508cae765dbc279d25c2568/analysis/1442574773/
** https://www.hybrid-analysis.com/sample/129421186aed9a2bb2177fe5ab51342decca0f0b6508cae765dbc279d25c2568?environmentId=1
___
Fake 'Approval' SPAM - PDF malware
- http://myonlinesecurity.co.uk/approval-of-the-pages-fake-pdf-malware/
18 Sep 2015 - "An email with the subject of 'Approval of the pages' pretending to come from random companies with a zip attachment is another one from the current bot runs... The content of the email says :
Hi,
Please take a quick look at the headlines of the attached docs.
As I’ve told you before, the main part of project is almost ready.
I guarantee that I’ll send it to you within this week.
Please remember: the attached information is strongly confidential.
Other subjects in this series of -Upatre- downloaders include:
Check out the following pages
Approval of renewed project part
See the part of work
Check updated part of work
Review updated pages
View renewed pages ...
18 September 2015: Do obligatory agreeement .zip: Extracts to: Maintain remittance fund .exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2b7ba26dcaefa42297d2308f97db51c646579e1fa149ba1ff59bcd7808da93ff/analysis/1442583621/
___
'Tax Credits Refund' - Phish ...
- https://blog.malwarebytes.org/fraud-scam/2015/09/warning-tax-credits-refund-phish/
Sep 18, 2015 - "... scammers leap onto the bandwagon with promises of tax credit refunds – effectively targeting those already most under threat from potential financial loss. If you’ve clicked-on-a-message along these lines in the last few days, you may want to get in touch with your bank as soon as possible. The message, which reads as follows, makes use of a Goo.gl shortening URL to -redirect- victims to what appears to be a compromised website:
"Dear valued customer, we are happy to inform you that you have a new tax credit refund from HMRC. Click on the following link [URL] to claim your HMRC refund"
... Here’s the stats for the shortened URL:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/taxcreditsphish1.jpg
• 731 clicks so far, with the majority of them coming from the UK.
• 440 of those were on iPhone, and 252 were using Android. Just 31 people were browsing via Windows.
• The shortened link is 4 days old, so the scam is pretty fresh.
Here’s the phishing page, located at savingshuffle(dot)com/hmrc/Tax-Refund(dot)php:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/taxcreditsphish3.jpg
As you can see, they want name, address, phone, email, telephone number, card details, sort code and account number. Further down the page, they also want some “Identity Verification” in the form of driving license number, national insurance number and mother’s maiden name. There’s also a pre-filled refund amount of £265.48 next to the submit button:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/taxcreditsphish4.jpg
... By the time you end up checking to see if the money has gone in, they’ll likely have tried to clean you out. Given we’re talking about those who might be severely affected by the changes to the tax credits system, this would be quite the blow to say the least (and even if you’re not impacted, it’s still not a nice thing to happen either way)... HMRC does -not- send out missives offering refunds."
savingshuffle(dot)com: 50.63.202.37: https://www.virustotal.com/en/ip-address/50.63.202.37/information/
___
Malicious SYNful Cisco router implant found on more devices...
- https://zmap.io/synful/
Sept 16, 2015 - "... The attack is known to affect Cisco 1841, 2811, and 3825 series routers, but may also affect similar Cisco devices... Further details on the -firmware- implant can be found in the original FireEye post:
> https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html
... by modifying ZMap to send the specially crafted TCP SYN packets. We completed four scans of the public IPv4 address space on September 15, 2015 and found -79- hosts displaying behavior consistent with the SYNful Knock implant. These routers belong to a range of institutions in -19- countries. We have found no immediate pattern in the organizations affected, but note a surprising number of routers in Africa and Asia (compared to IP allocations). We note that the -25- hosts in the United States belong to a single service provider on the East Coast, and that the hosts in both Germany and Lebanon belong to a single satellite provider that provides coverage to Africa. A map of devices is available here:
> https://zmap.io/synful/map.html "
> https://zmap.io/synful/graph.png
> https://www.eecs.umich.edu/eecs/about/articles/2013/zmap.html
>> http://net-security.org/malware_news.php?id=3104
18.09.2015
___
Fake 'Monthly account report' SPAM – PDF malware
17 Sep 2-15 - "An email with the subject of 'Monthly account report' pretending to come from info@ nab. com.au with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Monthly-account-report-1024x645.png
17 September 2015: Finance received statement .zip: Extracts to: Transfer online paying system cashback .exe
Current Virus total detections 2/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/084ae8f07ef3c60ff24475de5f9ab10d16d81fd057ae682919b1279ceea5c84f/analysis/1442524683/
:fear::fear: :mad:
AplusWebMaster
2015-09-19, 18:58
FYI...
Active malware campaign uses thousands of WordPress sites to infect visitors
15-day-old campaign has spiked in past 48 hours, with >5,000 new infections daily.
- http://arstechnica.com/security/2015/09/active-malware-campaign-uses-thousands-of-wordpress-sites-to-infect-visitors/
Sep 18, 2015 - "Attackers have hijacked thousands of websites running the WordPress content management system and are using them to infect unsuspecting visitors with potent malware exploits, researchers said Thursday. The campaign began 15 days ago, but over the past 48 hours the number of compromised sites has spiked, from about 1,000 per day on Tuesday to close to 6,000 on Thursday, Daniel Cid, CTO of security firm Sucuri, said in a blog post*. The hijacked sites are being used to -redirect- visitors to a server hosting attack code made available through the Nuclear exploit kit**, which is sold on the black market. The server tries a variety of different exploits depending on the operating system and available apps used by the visitor... On Thursday, Sucuri detected thousands of compromised sites, 95 percent of which are running on WordPress. Company researchers have not yet determined how the sites are being hacked, but they suspect it involves vulnerabilities in WordPress plugins. Already, 17 percent of the hacked sites have been blacklisted by a Google service that warns users before they visit booby-trapped properties... Administrators can use this Sucuri scanning tool*** to check if their site is affected by this ongoing campaign."
* https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-campaign.html
Sep 18, 2015
** https://heimdalsecurity.com/blog/nuclear-exploit-kit-flash-player/
*** https://sitecheck.sucuri.net/
Latest Wordpress update: https://forums.spybot.info/showthread.php?867-Alerts&p=466236&viewfull=1#post466236
___
Trojan targets online poker sites, peeks at players’ cards
Malware targets two of the largest gambling sites, PokerStars and Full Tilt Poker.
- http://arstechnica.com/security/2015/09/trojan-targets-online-poker-sites-peeks-at-players-cards/
Sep 18, 2015 - "Anybody who has ever played poker, online or offline, always suspects that they might be the victim of cheating when the cards aren't going their way. Now there's evidence to suspect that the hunch is real when it comes to two of the world's most popular online gambling portals. "Several hundred" gamblers on the Pokerstars and Full Tilt Poker platforms have been hit with a cheating trojan, according to ESET* security researcher Robert Lipovsky:
' Every once in a while, though, we stumble upon something that stands out, something that doesn’t fall into the “common” malware categories that we encounter every day — such as ransomware, banking trojans, or targeted attacks (APTs) — just to name a few of those that are currently causing the most problems. Today, we’re bringing you one of those uncommon threats — a trojan devised to target players of online poker.'
The latest Windows malware discovery, called Odlanor, comes two years after ESET warned of the PokerAgent botnet propagating on Facebook in connection to the Zynga Poker app..."
* http://www.welivesecurity.com/2015/09/17/the-trojan-games-odlanor-malware-cheats-at-poker/
17 Sep 2015
(Country locations infected with Odlanor)
- http://www.welivesecurity.com/wp-content/uploads/2015/09/ESET_Odlanor_infected.jpg
Threat Detail: http://virusradar.com/en/Win32_Spy.Odlanor/detail
:fear::fear: :mad:
AplusWebMaster
2015-09-21, 13:51
FYI...
Fake 'Paymark' SPAM – PDF malware
- http://myonlinesecurity.co.uk/paymark-transtrack-report-fake-pdf-malware/
21 Sep 2015 - "An email with the subject of 'Paymark TransTrack Report' pretending to come from Paymark TransTrack <onlineassist@ paymark .co.nz> with a zip attachment is another one from the current bot runs... The content of the email says:
Thank you for using the Paymark TransTrack Transaction Reporting email service.
Please find attached your requested transaction report.
The report is in PDF format, suitable for importing into a variety of finance and spreadsheet applications such as Xero, MYOB and Microsoft Excel.
The attached report is in a zip-formatted compressed file so you will need to extract it before viewing it.
If you experience any difficulties or would like more information about Paymark TransTrack please visit ...
This email was sent to [REDACTED]
This email has been filtered by SMX. For more information visit ...
21 September 2015: report.zip: Extracts to: report.scr
Current Virus total detections 6/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/32911bb8871ed6869eb3809b8001fb044199caeca203d600735d32e4af21eb0a/analysis/1442811837/
___
Fake 'Sage invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-sage-subscription-invoice-is-ready-fake-pdf-malware/
21 Sep 2015 - "An email with the subject of 'Your Sage subscription invoice is ready' pretending to come from noreply@ sage .com with a link-for-you-to-download a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Your-Sage-subscription-invoice-is-ready-1024x674.png
21 September 2015: invoice.zip: Extracts to: invoice.scr
Current Virus total detections 0/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a25f58a57a01ec6c14ad5118137afd0563d5f453f1b2bf73633ca692c3184edd/analysis/1442827749/
- http://blog.dynamoo.com/2015/09/malware-spam-your-sage-subscription.html
21 Sep 2015 - "... contains a malicious executable invoice.scr which has a VirusTotal detection rate of 1/56*. The Hybrid Analysis report** shows that this is -Upatre- dropping the Dyre banking trojan, and one key indication of infection is traffic to the IP 197.149.90.166 in Nigeria."
* https://www.virustotal.com/en/file/a25f58a57a01ec6c14ad5118137afd0563d5f453f1b2bf73633ca692c3184edd/analysis/1442835086/
** https://www.hybrid-analysis.com/sample/a25f58a57a01ec6c14ad5118137afd0563d5f453f1b2bf73633ca692c3184edd?environmentId=1
197.149.90.166: https://www.virustotal.com/en/ip-address/197.149.90.166/information/
___
Fake 'order not competed' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-order-is-not-competed-fake-pdf-malware/
21 Sep 2015 - "The Upatre malware spreading gang are hard at work again today with a new set of emails with the subject of 'Your order is not competed' pretending to come from random companies with a zip attachment is another one from the current bot runs... The body of the email simply contains the -name- of the attachment, so in this case the body reads: 'file: Receive rental contract.pdf'. Every email so far received has had a -different- subject and attachment name. Other subjects include:
Order isn’t done
Your order is not done
Order is not finished
Your order is not paid
Order is not processed ...
21 September 2015: Receive rental contract.zip: Extracts to: Imprint tax business.exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/18823bcb4f4a00f1ad58c6dfdbc04c709b4a24f338b1fddf9b2c5d0c1e2ba71e/analysis/1442828635/
___
Tainted Network - VPS Hosting of Latvia (91.226.32.0/23) ...
- http://blog.dynamoo.com/2015/09/tainted-network-kfciilluminationescomsn.html
21 Sep 2015 - "I've been seeing some injection attacks since last week utilising hosting services of VPS Hosting in Latvia. These are continuing today, with attacks like this one which sends traffic to:
[donotclick]kfc.i.illuminationes .com/snitch
This is hosted on 91.226.33.54. The exploit is not clear at this point, but some sources say that this is some sort of TDS kit. The URLquery transaction flowchart shows the attack in action:
> [url]https://2.bp.blogspot.com/-9JiDUjob_AI/Vf_J3mhrGEI/AAAAAAAAHDI/bDMRc9G0AF4/s1600/tds-ek.png
The injected script sends the keywords and referring site upstream... Although the attacks in the past few days only seem to have utilised 91.226.33.54, an analysis of the netblock... shows several bad or spammy sites in 91.226.32.0/23, so my recommendation is that you banish (-block-) this range from your network."
* https://urlquery.net/report.php?id=1442826023324
illuminationes .com: 91.226.32.69: https://www.virustotal.com/en/ip-address/91.226.32.69/information/
91.226.33.54: https://www.virustotal.com/en/ip-address/91.226.33.54/information/
> https://www.virustotal.com/en/domain/kfc.i.illuminationes.com/information/
___
NSW Health Payslip Spam
- http://threattrack.tumblr.com/post/129567671538/nsw-health-payslip-spam
Sep 21, 2015 - "Subjects Seen
Payslip for the period 21 Aug 2015 to 21 sep 2015
Typical e-mail details:
This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender.
Views expressed in this message are those of the individual sender, and are not necessarily the views of NSW Health or any of its entities.
Screenshot: https://40.media.tumblr.com/433050ff0f62b72379fdd04b4f512c3b/tumblr_inline_nv151zgxyC1r6pupn_500.png
Malicious File Name and MD5:
Payslip-21092015.scr (fa73a8adc4a7a1b037b8dded1eb9ac90)
Tagged: NSWHealth, Upatre
___
iOS users endangered by Trojanized apps from the App Store
- http://net-security.org/malware_news.php?id=3105
21.09.2015 - "Unknown malware pushers have managed to trick Apple into offering for download from the company's official App Store a considerable number of malicious apps - apps that collect device information and try to get users' iCloud login credentials. The current list* of infected iOS apps includes many extremely popular apps in China and the rest of the world..."
Malware XcodeGhost Infects 39 iOS Apps ...
* http://researchcenter.paloaltonetworks.com/2015/09/malware-xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of-millions-of-users/
Sept 18, 2015
- http://researchcenter.paloaltonetworks.com/2015/09/more-details-on-the-xcodeghost-malware-and-affected-ios-apps/
Sep 21, 2015
- https://blog.malwarebytes.org/mac/2015/09/xcodeghost-malware-infiltrates-app-store/
Sep 21, 2015
___
Skype 'glitch' preventing some users from making calls
- http://www.reuters.com/article/2015/09/21/us-microsoft-skype-idUSKCN0RL0YC20150921
Sep 21, 2015 - "Skype, Microsoft's online telephone and video service, said some users are unable to make calls on Monday because their settings show that they and their contacts are offline, even when they are logged in. In an updated blog post*, Skype also said some messages to group chats are not being delivered and that users who are not already signed in may face difficulty while accessing their accounts:
> http://heartbeat.skype.com/2015/09/skype_presence_issues.html
Skype added that users could experience delays in seeing changes made to their accounts, such as credit balance and profile details. Users may also face difficulty loading web pages on the Skype Community... In an earlier post, Skype had said its instant messaging and Skype for Web services were not facing technical issues."
:fear::fear: :mad:
AplusWebMaster
2015-09-22, 15:11
FYI...
Malvertising attack hits Realtor .com visitors
- https://blog.malwarebytes.org/malvertising-2/2015/09/malvertising-attack-hits-realtor-com-visitors/
Sep 22, 2015 - "... malvertising keeps on striking high profile sites. The latest victim is popular real estate website realtor.com, ranked third in its category with an estimated 28 million monthly visits... People browsing the site in the last few days may have been exposed to this malvertising campaign and consequently infected if their computers were -not- patched or did -not- have adequate security software. Like all other malvertising attacks, this one did -not- require to click on the -bogus- ad to get infected. The same gang that was behind the recent campaign we documented on this blog is still going at it using the same stealth tactics, which we will elaborate on a little more here:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/realtor_flow.png
Rogue advertisers are putting a lot of efforts into making ad banners that look legitimate and actually promote real products or services. We should also note that the use of SSL to encrypt web traffic is getting more and more common in the fraudulent ad business and that only makes tracking bad actors more difficult. We have alerted both the publisher (Realtor .com) and the ad serving technology platform (AdSpirit) about this attack and the latter has already taken action to disable the malicious creative... the Bedep Trojan (ad fraud, ransomware) via the Angler exploit kit."
___
Fake 'Dislike' Facebook scam ...
- http://www.theregister.co.uk/2015/09/22/facebook_dislike_survey_scam/
22 Sep 2015 - "Survey scammers have already capitalised on Facebook's tentative plans to develop a 'Dislike' button... no such app is yet available and the offers are a scam, designed to hoodwink people into filling in pointless online surveys or buying into get-rich-quick schemes. Survey scams are a well-worn short con on the internet that, at best, waste surfers' time while yielding nothing in return. Victims are not infrequently tricked into disclosing their mobile numbers through survey scams and are subsequently signed up to premium rate services. Either ruse might also be used to coax marks into handing over Facebook login credentials. More details on the resurgence of Facebook Dislike -scams- can be found in a blog post by security industry veteran Graham Cluley here*, and by on Sophos's Naked Security blog here**."
* https://grahamcluley.com/2015/09/right-cue-come-facebook-dislike-button-scams/
** https://nakedsecurity.sophos.com/2015/09/21/guess-what-facebook-dislike-scams-are-back/
___
Fake 'Grand Theft Auto online' scams ...
- https://blog.malwarebytes.org/fraud-scam/2015/09/gta-5-money-generator-scams-theyre-wheelie-bad/
Sep 22, 2015 - "Grand Theft Auto online is still as popular as ever, with new content being released soon and everybody ramping up their “Must play it now” levels to the max. Money makes the online GTA world go round, and you certainly need a lot of it to progress. With that in mind, you might want to avoid the following sites claiming to offer up ridiculous amounts of money via a few “simple steps”. First out of the gate, we have
gta5moneyserver(dot)com
... which has an amazing line in -faked- videogame site news pieces about their awesome money grabbing technique. Totally can’t see the Photoshop, guys:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/gtamoney1.jpg
...
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/gtamoney2.jpg
... The focus of this one is what they’ve chosen to call “Genius Theft Auto”, where you enter your Username into the box and a pile of money awaits (or something):
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/gtamoney3.jpg
... Elsewhere, we have
gta5moneyhackonline(dot)com
... which doesn’t beat about the bush, dispensing with pretty much everything other than a box asking for your info, desired money amount and a -survey- pop immediately after hitting the generate button... it’s a safe bet that every single “Money Generator” website you visit will end in little more than -spamming- a website to your friends, lots of -surveys- and the occasional download:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/gtamoney8.jpg
... you’ll likely see a burst of activity on the GTA fakeout front, so steer clear of the following:
Money generators
Free DLC generators
Rank improvement
Account unbanning
“DNS codes“
Follow these steps, and you won’t get caught up in a 'Grand Theft Internet'."
gta5moneyserver(dot)com: 104.152.168.16: https://www.virustotal.com/en/ip-address/104.152.168.16/information/
gta5moneyhackonline(dot)com: 162.255.118.48: https://www.virustotal.com/en/ip-address/162.255.118.48/information/
___
Fake 'Worldpay' SPAM - xls malware
- http://myonlinesecurity.co.uk/premium-charging-mi-package-for-merchant-82682006-fake-xls-excel-malware/
21 Sep 2015 - "An email with the subject of 'Premium Charging MI Package for Merchant 82682006' pretending to come from GEMS@ Worldpay .com with a zip attachment is another one from the current bot runs... The content of the email says :
*** Please do not reply to this Message *** Attached is the Management
Information to support your Monthly Invoice. Should you have any queries,
please refer to your usual helpdesk number.
This e-mail and any attachments are confidential, intended only for the
addressee and may be privileged. If you have received this e-mail in error,
please notify the sender immediately and delete it. Any content that does
not relate to the business of Worldpay is personal to the sender and not
authorised or endorsed by Worldpay. Worldpay does not accept responsibility
for viruses or any loss or damage arising from transmission or access.
Worldpay (UK) Limited (Company No: 58544680/ Financial Conduct Authority
No: 42068), Worldpay Limited (Company No:03424752 / Financial Conduct
Authority No: 640149), Worldpay AP Limited (Company No: 82351023 ...
21 September 2015: 82682006.zip: Extracts to: 70346783.scr
Current Virus total detections 9/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper Xls Excel file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e35bc813a4b09d99e259c4d14691b2411d7fe791e76b0506dcfe32c42a84dec1/analysis/1442846468/
:fear::fear: :mad:
AplusWebMaster
2015-09-23, 13:51
FYI...
Fake 'NDISPlan' SPAM – PDF malware
- http://myonlinesecurity.co.uk/ndisplan-fake-pdf-malware/
23 Sep 2015 - "An email with the subject of 'NDISPlan' pretending to come from random names @ndis .gov.au <filepoint@ dss .gov.au> with a zip attachment is another one from the current bot runs... The content of the email says:
You have received 1 secure file from Edgar.Townsend@ ndis .gov.au.
Use the secure link below to download.
Hi Loik, As requested, please find attached a copy of Shelby’s plan. Cheers, Edgar
Secure File Downloads:
Available until: 16 October 2015
Click link to download:
Shelby-MyNDISPlan.zip
681.07 KB, Fingerprint: 3F540085E625C8C2E5EB84A6B060E403 (What is this?)
You have received secure links within this email sent via filepoint.dss .gov.au. To retrieve the files, please click on the links above.
The link is to https ://www.sugarsync .com/pf/D8992504_764_6670557430?directDownload=true and not any gov.au site
Todays Date: Shelby-MyNDISPlan.zip: Extracts to: Shelby-MyNDISPlan.scr
Current Virus total detections 2/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/78073cd80cd2ce04aa2f089760a60ffc494bd241eaa9787b17573eb152692ba5/analysis/1442985111/
sugarsync .com: 74.201.86.21: https://www.virustotal.com/en/ip-address/74.201.86.21/information/
___
Fake 'Bankline ROI' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-bankline-roi-password-re.html
23 Sep 2015 - "This -fake- banking spam does not come from RBS, but is instead a simple forgery with a malicious attachment:
From "RBS" [secure.message@ rbs .co.uk]
Date Wed, 23 Sep 2015 11:28:48 GMT
Subject Bankline ROI - Password Re-activation Form
Please find the Re-activation form attached, send one per user ensuring only one
box is selected in section 3. A signatory on the bank mandate must sign the form.
Fax to 1850 826978 or alternatively you may wish to email the completed document,
by attaching it to an email and sendinsg it to banklineadministration@rbs.co.uk
On receipt of the completed form we will respond to the request within 2 working
hours and communicate this to the user by email.
Please note - The life-span of an activation code is 21 days; after this time, the
activation code will expire and a new one must be ordered.
Please be aware when choosing a new pin and password for the service, it is important
not to use pin/passwords that you have used before but to use completely different
details.
If you are the sole Standard Administrator may I take this opportunity to suggest
when you are reinstated on the system, to set up another User in a Standard Administrator
role. This will prevent you being locked out completely and allow you to order a
new activation code from within the system and reset your security sooner.
If you require any further assistance then please do not hesitate to contact us on
1850 310269 and one of our associates will be happy to assist you.
Regards
Bankline Product Support ...
In the sample I saw, the attached file was Bankline_Password_reset_3537684.zip containing a malicious exeucutable Bankline_Password_reset_8569474.scr which has a VirusTotal detection rate of 2/56*. The Hybrid Analysis report** shows behaviour consistent with Upatre/Dyre and shows that the malware communicates with a known bad IP of 197.149.90.166 (Cobranet, Nigeria) which I definitely recommend -blocking- or monitoring."
* https://www.virustotal.com/en/file/98c6cf1304a449f37d9b6e099388e0656b1f25d815316c668b1c91f703d87ad1/analysis/1443010402/
** https://www.hybrid-analysis.com/sample/98c6cf1304a449f37d9b6e099388e0656b1f25d815316c668b1c91f703d87ad1?environmentId=1
___
'DHL Courier' - Phish ...
- http://blog.dynamoo.com/2015/09/phish-shipment-label-dhl-courier.html
23 Sep 2015 - "This DHL-themed spam is actually a phishing email:
From: DHL Courier Services [roger@community .mile .org]
To:
Date: 23 September 2015 at 11:15
Subject: SHIPMENT LABEL
Signed by: community. mile.org
Dear customer,
Your shipment arrived at the post office.Our courier was unable to deliver the shipment to your address.To receive the shipment,please visit the nearestDHL office and take your mailing label with you.
The mailing label is attached in this email. Please print and show at the nearest DHL office to receive the shipment.
Thank you for using DHL services...
Attached is a PDF file shipmentt_label.pdf which is not malicious in itself, but contains a hypertext link (as you can see in this Hybrid Analysis report*):
> https://4.bp.blogspot.com/-dIqTVhvNLlI/VgKhYr-6ByI/AAAAAAAAHDw/gz2xk6GXVPk/s1600/dhl5.png
If the potential victim clicks "Click here" then they are directed to ow .ly/Sq9to and from there to a phishing page at br1-update .be/wg/lhd.php on 64.20.51.22 (Inetserver Inc, US) which belongs to a netblock 64.20.51.16/29 which -also- looks highly suspect:
> https://1.bp.blogspot.com/-mNlcOztRLbE/VgKjULTyCCI/AAAAAAAAHD8/osQ1Y-sftp0/s1600/dhl6.png
The phishing page itself is a complex script which is Base 64 encoded, then hex encoded... which is presumably phishing for email accounts. The spam itself appears to have been sent from a -compromised- webmail account at community .mile.org . For the moment, I would suggest that the entire 64.20.51.16/29 range is malicious and should be -blocked-."
* https://www.hybrid-analysis.com/sample/d70dfd1c8dd1af5888c1eb60a5d58ed70a91eaa12de72c9a0836dc7232db8e25?environmentId=1
br1-update .be: 64.20.51.22: https://www.virustotal.com/en/ip-address/64.20.51.22/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-24, 14:30
FYI...
Evil network: 64.20.51.16/29 ...
- http://blog.dynamoo.com/2015/09/evil-network-6420511629-interserver-inc.html
24 Sep 2015 - "This DHL-themed phish* got me looking at an IP address range of 64.20.51.16/29 which is a range belonging to Interserver Inc in the US, but which has been -reallocated- to a customer... the WHOIS details for that block are not valid..
* http://blog.dynamoo.com/2015/09/phish-shipment-label-dhl-courier.html
... an analysis of the sites currently and formerly hosted in that range indicate a very high proportion of -phishing- sites.. in fact, the range is a hotbed of sophisticated fraud sites, many of which seem to be undiscovered. I combined current reverse IP data from DomainTools and current and historical data from DNSDB and then ran them through an IP lookup and a check against the Google Safe Browsing... a very large number of sites -flagged- by SURBL in particular, amounting to 47 out of 167 sites (i.e. 28%) that I can identify as being currently hosted in that range. In addition, a large number of phishing and other malicious sites have been hosted on 64.20.51.16/29 in the past and are now hosted elsewhere...
Conclusion: I really just skimmed the surface with my analysis here, but it is clear that the 64.20.51.16/29 block is being used almost exclusively for fraud. Moreover, the fraud is extremely sophisticated involving things like -fake- business registries and couriers. It is also clear that the Pakistani web hosts apparently providing these services have been doing so for some time.
Recommended blocklist:
64.20.51.16/29
76.73.85.136/29
185.24.233.16 "
(Much more detail at the dynamoo URL at the top of this post.)
___
Fake 'Federal Fiscal evasion' SPAM - PDF malware
- http://myonlinesecurity.co.uk/federal-fiscal-evasion-notification-fake-pdf-malware/
24 Sep 2015 - "An email with the subject of 'Federal Fiscal evasion notification' pretending to come from random email addresses at random companies with a zip attachment is another one from the current bot runs... The content of the email says:
Hi
Last Monday our colleagues were delivered final notice letter of tax authority.
They are accusing You of tax avoidance that is considered a federal crime and might lead to considerable fines.
In the attachment kindly see scan-copy of above official notice.
You are highly asked inspect the enclosure very carefully so as to argue to the contrary later.
According to our executive management’s information the appointment with Internal Revenue authorities is to be confirmed this week.
We strictly advise You to be prepared for upcoming deposition because serious charges are brought against You.
Right after getting Your approval specialists will commence filling required form-sheets.
Katherine Dowson Senior Associate
Other subjects in this malspam run include:
Federal levy avoidance prosecution
Federal levy avoidance indictment
State Fiscal evasion charges
Federal levy avoidance conviction
Federal Fiscal dodging notification ...
24 September 2015: Doc_320762_Federal Fiscal evasion notification .pdf.zip:
Extracts to: timber carrier dive gamma.exe - Current Virus total detections 5/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1afea22bd677091b4318eded9a3129c03bf29d58569b6c2d9cd66b7ebb0b62df/analysis/1443113149/
___
Apple tackles XcodeGhost by removing apps, alerting devs and users
- http://net-security.org/malware_news.php?id=3111
24.09.2015 - "The XcodeGhost incident has demonstrated that however secure a system is thought to be, there's always a way in. It also shows how the very human tendency of trying to simplify and hasten the execution of a task can lead to decreased security. Apple has expanded on its initial comment about the malware and its proliferation in the App Store, and has explained that they have removed the infected apps from the store and that they are blocking submissions of new apps that contain the malware. They listed* the top 25 most popular apps impacted, among which is the popular messaging app WeChat, and noted that "after the top 25 impacted apps, the number of impacted users drops significantly."
Users are advised to update those apps as soon as possible (once they are available on the App Store once again). Uninstalling the affected apps until that time is also a good idea, although the company says that the found malware was only capable of harvesting some general information about the apps and the OS... This incident might ultimately prove very beneficial for both Apple and app developers. As noted above, the former has already decided to do something about the downloading difficulties developers outside the US are facing..."
* https://www.apple.com/cn/xcodeghost/#english
:fear::fear: :mad:
AplusWebMaster
2015-09-25, 12:49
FYI...
Fake 'Cancellation' SPAM – PDF malware
- http://myonlinesecurity.co.uk/cancellation-of-your-last-transaction-fake-pdf-malware/
25 Sep 2015 - "Another series of emails delivering Upatre downloaders with the subject of 'Cancellation of your last transaction' pretending to come from random companies and email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Unfortunately your remittance transfer was cancelled. Please verify your transaction details. Full info attached.
Other subjects in this malspam run include:
Cancellation of transaction
Suspension transaction
Invaild data in your transaction
Suspension your transaction
Blocking transaction
Problems with your last transaction ...
25 September 2015: Doc_26638351_Cancellation of your last transaction .pdf.zip
Extracts to: mgt emblem abreact.exe - Current Virus total detections 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5dbc3a6e3a4e3835b1175f6d75ee3e54052b0d22b9654324222fafa6225c3b57/analysis/1443176862/
___
Fake online -Avast- scanner
- https://blog.malwarebytes.org/social-engineering/2015/09/fake-online-avast-scanner/
Sep 25, 2015 - "... we came across a -fake- online scanner that abuses the good name of Avast. The idea to get you to visit this site is by waiting for someone to make a typo and end up at facebooksecuryti(dot)com; The site shows a picture of a pornographic nature just long enough to -redirect- you to the fake online scanner at avast(dot)services:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/site.png
The scanner page looks a bit like Jotti’s malware scan, and they have quite a few logos in common:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/jotti.png
The -fake- scanner will end up showing you that there is only one antivirus that can find a problem which is... you guessed it, avast! A bit predictable given the name and the logo of the site. This is where we hope that our readers would get very suspicious. A security software company offering to scan your computer using the scanning engines of competitors would be strange enough, but I’m sure if anyone did they would make it a fair competition and not declare themselves the one and only solution every time:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/prompt.png
It immediately offers you the options to “Install” or “Save” the file Avast.exe which is obviously -not- the installer for the actual Avast antivirus software. What the installer really does is drop an information stealing Trojan in several places on the victims system and point to them from two startup locations. One is a Run key for the current user pointing to a file in a temporary “System Restore” folder... This type of Trojan can be used to gather information on the victims’ computer and encrypt it. The encrypted information will be sent to the operator, who can determine which kind of information will be gathered from the compromised system... The files involved are detected as Trojan.InfoStealer.Generic and Stolen.Data. Thanks to our friend at hpHosts* for the tip."
* http://www.hosts-file.net/
avast(dot)services: 160.153.16.36: https://www.virustotal.com/en/ip-address/160.153.16.36/information/
> https://www.virustotal.com/en/url/20743f156f62a60968fc4adca2506e73e9521d63181e81122d380b7c649a036a/analysis/
2015-09-25
7/65
___
Scandinavian users hit with -fake- post office emails, ransomware
- http://net-security.org/malware_news.php?id=3112
25.09.2015 - "Scandinavian PC users are the latest group to be targeted with Cryptolocker ransomware. According to Heimdal Security*, the threat comes via email. The malware peddlers are impersonating the Norwegian, Swedish and Danish postal services, and are trying to trick users into believing that there has been a failed delivery of a package. They are instructed to click-on-the-link in the email, supposedly to download the document needed to claim the package at the post office, but what they'll get is an executable. Those users who -fail- to find this suspicious and run the file will have all their files encrypted (both on the computer and on connected devices), and will be faced with a ransom message... The emails are usually written in the victim's language, and are equipped with the logos and images associated with that country's postal services (e.g. in Denmark: Post Denmark and PostNord):
> http://www.net-security.org/images/articles/denmark-25092015.jpg
The delivered malware is Cryptolocker2. When the campaign was first noticed earlier this week, the delivered malware variant had an extremely low AV detection rate - only one out of 56 AV engines used by VirusTotal** flagged it as malware. Three days later, the numbers are better (34 out of 55), but the danger is still present. Anyone can fall for this type of scheme, although it has been most successful with home users and employees of small-to-medium size businesses. Users of all kinds should educate themselves about the danger, and first and foremost should stop clicking-on-links contained in emails whose senders they haven't verified..."
* https://heimdalsecurity.com/blog/security-alert-the-global-get-your-cryptolocker-as-a-package-campaign-continues/
** https://www.virustotal.com/en/file/1b41c32c55de43ddb3871260fd0ea30d067dc27840b7f63d857afa7f9267c73a/analysis/1442488273/
dshome .ru: 37.140.192.89: https://www.virustotal.com/en/ip-address/37.140.192.89/information/
___
Cisco releases tool for detecting malicious router implants
- http://net-security.org/malware_news.php?id=3114
25.09.2015 - "Cisco Systems has provided a tool* that allows -enterprise- users to scan their networks and discover if their routers have been compromised with malicious SYNful Knock implants:
* http://talosintel.com/scanner/
... If a compromised router is found, the scanner will provide instructions on what to do next. Users are can also contact the Cisco Product Security Incident Response Team (PSIRT) for help. The SYNful Knock router implant was first discovered by FireEye researchers, and other researchers have found instances of compromised routers around the world. The discovery came roughly a month after Cisco warned about attackers replacing the Cisco IOS ROMMON (IOS bootstrap) with a -malicious- ROMMON image, after gaining administrative or physical access to a Cisco IOS device. These compromises are not the result of the exploitation of a vulnerability, but of a legitimate feature that allows network admins to install an upgraded ROMMON image on IOS devices for their own purposes. For more technical details and tool caveats, check out McVey's blog post**."
** http://blogs.cisco.com/security/talos/synful-scanner
Sep 23, 2015 - "... We updated the tool to version 1.0.1."
:fear::fear: :mad:
AplusWebMaster
2015-09-28, 13:49
FYI...
Fake 'toll road payment' SPAM – PDF malware
- http://myonlinesecurity.co.uk/unsettled-toll-road-payment-reminder-fake-pdf-malware/
28 Sep 2015 - "Another load of emails from the Upatre downloaders with the subject of 'Unsettled toll road payment reminder' pretending to come from random companies and email addresses with a zip attachment is another one from the current bot runs... The content of the email says:
Good day!
Your toll road ticket #2515380112 is still unsettled. Please make a remittance to avoid additional fees within 12 days.
The copy of ticket is attached to this e-mail.
Other subjects in today’s malspam run include:
Turnpike road invoice reminder
Outstanding turnpike invoice message
Outstanding turnpike payment email reminder
Oustanding toll road ticket notification
Oustanding toll road payment notification
Unsettled toll road bill notice
Turnpike road bill reminder
Toll road bill notice
Toll road payment message
Turnpike road ticket notification
28 September 2015: Doc_9911815_Unsettled toll road payment reminder .pdf.zip:
Extracts to: copious strumpet kernel mode.exe
Current Virus total detections 3/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1b4a4b0f33096d31b99a64991ed664c9a0f5ad6b6d2dbccf325e4655d4fb08df/analysis/1443433322/
Similar: https://isc.sans.edu/diary.html?storyid=20191
2015-09-28
Screenshot: https://isc.sans.edu/diaryimages/images/Screen%20Shot%202015-09-28%20at%206_25_33%20AM.png
[1] https://www.virustotal.com/en/file/80237fc10155567a68163bfd5bbf0afc5cb521bfdd1d486e1c3682083b5f61f8/analysis/1443436044/
4/55
___
Fake 'latest proposal' SPAM – PDF malware
- http://myonlinesecurity.co.uk/the-latest-proposal-fake-pdf-malware/
28 Sep 2015 - "Another set of emails with Upatre downloaders involve the subject of 'The latest proposal' pretending to come from random email addresses and companies with a zip attachment is another one from the current bot runs... The content of the email says :
Good day,
I’ve attached a new project and business proposal to this e-mail. I suppose it will interest you.
... This message and any attachments are confidential and intended for the named
addressee(s) only.If you have received this message in error, please notify
immediately the sender, then delete the message. Any unauthorized modification,
edition, use or dissemination is prohibited. The sender does not be liable for
this message if it has been modified, altered, falsified, infected by a virus
or even edited or disseminated without authorization...
Other subjects in this Malspam run include:
My commercial proposal
Please read my new commercial proposal
Please read my new business project
Please view my new project
New business proposal
The latest proposal of common business ...
28 September 2015: Doc_21123802_My commercial proposal .pdf.zip:
Extracts to: attendee parent bank manage to.exe
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1d0508b269aad864b86a0267e8e688bebb25133058b89769a1136ef7e3b262b4/analysis/1443448919/
___
Pornhub, YouPorn - Malvertising ...
- https://blog.malwarebytes.org/malvertising-2/2015/09/pornhub-youporn-latest-victims-of-adult-malvertising-campaign/
Sep 28, 2015 - "The xHamster malvertising campaign we wrote about last week[1] was part of several attacks against many top adult sites. It is unclear whether this was a planned effort from threat actors but the timing is certainly strange. Over the week-end we detected -another- incident affecting Pornhub and YouPorn, some of the biggest adult websites with a combined 800 million monthly visits... Overview:
Publishers: Pornhub .com/YouPorn .com
Ad network: syndication.exoclick .com/{redacted}
Malicious code: trackitsup .com/cookiecheck.js?{redacted}
Redirection to exploit-kit: beatiful.sextubehard .pw/{redacted}
Angler Exploit Kit: knutterigemukaantulolleen.colleenmhammond .org
Rogue advertisers abused the ExoClick ad network by inserting a seemingly legitimate piece of code as an ad banner. The first documented instance of the ‘cookiecheck.js‘ campaign appears to have taken place on Sept. 19th according to this tweet from malware hunter Malekal:
> https://twitter.com/malekal_morte/status/645148983959113728
#Browlock #Ransomware at @Exoclick network...
'The ‘cookiecheck’ malvertising campaign. Rotating domain names all use the same JavaScript snippet.'
Fortunately, the malvertising on Pornhub and YouPorn did not last as long, thanks to an immediate action from both the publisher and ad network... During the past several months, high profile malvertising attacks against top adult sites have been sparse. This makes what we have seen during the past couple of weeks very unusual but also impactful given the sheer volume of traffic these sites receive. What’s more, the attack against top adult ad network TrafficHaus we documented last week[1] may have been the result of a security breach, according to a comment left on security blogger Graham Cluley’s site**. Users should make sure that their computers are fully patched and protected with several layers of security (the 3 A’s is a very effective line of defense: Anti-exploit, Antivirus, Anti-malware) in order to defeat malvertising and drive-by download attacks."
1] https://blog.malwarebytes.org/malvertising-2/2015/09/ssl-malvertising-campaign-targets-top-adult-sites/
Sep 24, 2015
* https://grahamcluley.com/2015/09/xhamster-malware/
Sep 25, 2015
** https://grahamcluley.com/2015/09/xhamster-malware/#comment-49405
Sep 27, 2015 - "... 89.187.142.208..."
> https://www.virustotal.com/en/ip-address/89.187.142.208/information/
Pornhub .com: 31.192.117.132: https://www.virustotal.com/en/ip-address/31.192.117.132/information/
exoclick .com: 178.33.165.129: https://www.virustotal.com/en/ip-address/178.33.165.129/information/
trackitsup .com: 80.86.89.178: https://www.virustotal.com/en/ip-address/80.86.89.178/information/
sextubehard .pw: "A temporary error occurred during the lookup..."
colleenmhammond .org: 184.168.221.56: https://www.virustotal.com/en/ip-address/184.168.221.56/information/
:fear::fear: :mad:
AplusWebMaster
2015-09-29, 14:23
FYI...
Fake 'Western Union' SPAM – PDF malware
- http://myonlinesecurity.co.uk/contract-61936417-about-to-expire-final-notice-western-union-business-solutions-online-fx-for-corporate-fake-pdf-malware/
29 Sep 2015 - "An email with the subject of 'Contract 61936417 About to Expire: Final Notice – Western Union Business Solutions Online FX for Corporate' pretending to come from Western Union via random email addresses and companies with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Contract-61936417-About-to-Expire-Final-Notice-Western-Union-Business-Solutions-Online-FX-for-Corporate-1024x779.png
29 September 2015: WU Business Contract 45827544.zip:
Extracts to: WU Business Contract 770352457.scr
Current Virus total detections 18/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6b0aaf37c4b1ff7897f575d01d32e1af596e59c882c9aada682df20f303d8b41/analysis/1443506282/
___
Fake 'Blocked profile' SPAM – PDF malware
- http://myonlinesecurity.co.uk/blocked-profile-management-notification-nab-bank-australia-fake-pdf-malware/
29 Sep 2015 - "An email with the subject of 'Blocked profile management notification' pretending to come from NAB Bank Australia with a zip attachment is another one from the current bot runs... The content of the email says :
Good day!
We have detected suspicious activity with Your Online-Banking profile. Please be informed that
the access and some capabilities of Your profile were restricted for security reasons. Temporarily
You cannot conduct transactions with online-banking profile. In order to obtain full management
powers You have to fill in and send back the attached form.
Please use codename for authorization (contained in the attachment).
Online-Banking profile: 8947626947780852875
Code Name: no doubt insolvent noncancerogenic
Our security department representative will contact You later to provide further instructions.
Regards,
Patrick Olsen
NAB Support Team.
29 September 2015: Bank_no doubt insolvent noncancerogenic_protection.zip:
Extracts to: whose noodle soullessness.exe
Current Virus total detections 15/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/55dc4a5993068d4d691a53e72dc7e7af4318d350c5a8aab27124d193aa407c38/analysis/1443507454/
___
Fake 'SantanderBillpayment' SPAM - malware attachment
- http://blog.dynamoo.com/2015/09/malware-spam-info-from.html
29 Sep 2015 - "This -fake- financial spam comes with a malicious attachment:
From "Santanderbillpayment-noreply@ SantanderBillPayment .co.uk" [Santanderbillpayment-noreply@ SantanderBillPayment .co.uk]
Date Tue, 29 Sep 2015 12:33:56 GMT
Subject Info from SantanderBillpayment .co.uk
Thank you for using BillPay. Please keep this email for your records.
The following transaction was received on 29 September 2015 at 09:11:36.
Payment type: VAT
Customer reference no: 0343884
Card type: Visa Debit
Amount: GBP 4,683.00
For more details please check attached payment slip.
Your transaction reference number for this payment is IR0343884.
Please quote this reference number in any future communication regarding this payment.
Yours sincerely,
Banking Operations ...
The attachment is named SantanderBillPayment_Slip0343884.zip although I have not been able to get a working copy. The payload is most likely the Upatre/Dyre banking trojan. My sources tell me that the current wave of this is phoning home to 197.149.90.166 in Nigeria which is worth -blocking- or monitoring."
___
Fake 'Attorney-client' SPAM – PDF malware
- http://myonlinesecurity.co.uk/attorney-client-agreement-fake-pdf-malware/
29 Sep 2015 - "An email with the subject of 'Attorney-client agreement' pretending to come from random names and random companies with a zip attachment is another one from the current bot runs... The content of the email says :
It went OK. The court understood that it may be that you might not have much relevant
information but he couldn’t rule as a matter of law that you had no relevant information
and did not need to appear. However he ordered the other side to make clear when they were
going to call you and provide information on that so that you are not standing around
waiting to be called. He also made it clear that I preserve my right to object to their
questions on grounds of relevance, so, you need to be available on Monday or Tuesday the
29th and 30th to appear but I will let you know as we get closer what time and day.
We will also need to prepare for your testimony the week before.
With regard to the other motions, the court ruled that they cannot present any evidence as
damages of costs incurred or the fee received while Gary Ferguson was representing the
Grover’s. That is pretty good ruling.
As to many of the other issues he simply punted them for trial, preserving our arguments
The only issue that we need to discuss is the Court’s willingness to consider their claim
for breach of contract. The court is going to allow them to assert a claim for breach of
contract. The Court indicated that it was a close call, but they have one paragraph in
their complaint suggesting a claim for breach of contract, but he limited the breach of
contract claim to their allegation that under the fee agreement you would not take any
money without paying the Grovers under your retainer agreement. That is the only breach
of contract claim. If you look at the retainer agreement attached, I don’t think it says
that (paragraph 1) . What it says is that if the case is settled, you can take your fee
and pay costs. However they are arguing that the whole case had to be settled before you
took any fee.
Even if that were the case, then you should have been able to receive the 63,665 at the end
of the case after they lost to Timpanogos (either under P&M’s agreement or your agreement.)
and they would’ve had to pay the costs. In other words, I think we have the stronger
argument here. And, if we win, we will be able to assert a claim for attorny’s fees.
But if they win, they also have that right.
However, because the court allowed them to assert this claim for breach of contract ruled
that he would allow me to conduct more limited discovery before trial if I think I needed to.
Upon first glance of the issue, I don’t think I need any additional discovery. But I wanted
to run this by you guys. Let me know your thoughts as soon as possible. He also said he
might consider bumping the trial if I tell him why I need to for this new claim. but I think
if it is limited to that issue. I don’t think ‘ll be able to convince him to bump the trial
unless I simply demand it.
I would like your thoughts.
Ana Marvin | Grady-Wintheiser | 49544 Josue Hills | Lake Kennith City, 32914
Direct: (628) 652-6347 | Facsimile: (628) 652-6347 ... vCard
This email is from a law firm and may contain privileged or confidential information.
Any unauthorized disclosure, distribution, or other use of this email and its contents
is prohibited. If you are not the intended recipient, please contact the sender and
delete this email. Thank you.
29 September 2015: View financial bargain.zip: Extracts to: Finish past due invoice.exe
Current Virus total detections 7/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c58be63f372925fc03c4aa0cb255d2757e6f58d27eb25e592eee921178205efb/analysis/1443537708/
___
Instagram Account preys on Trust Issues
- https://blog.malwarebytes.org/online-security/2015/09/this-instagram-account-preys-on-your-trust-issues/
Sep 29, 2015 - "Questionable posts from random users — usually from those with a significant number of (bot) followers — are already becoming not uncommon within the photo- and video- sharing social site, Instagram. In fact, we have encountered a number of them before, with some falsely claiming to increase your follower count — an attempt we’ve seen floating around on Twitter and Facebook in the past — and with others attesting to a mass purge of accounts unless they have been verified. Recently, we’ve discovered an attempt at baiting users with the lure of catching his/her potentially cheating partner red-handed using a “trusted” service. All one needs is their target’s phone number.
Enter @INSTANTPHONELOOKUP.
Below is mobile screenshot of the post that my test account received:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/dodgy-post.png
... whoever came up with this kind of bait has been following stories revolving around the Ashley Madison hacking incident, probably a little too closely. Anyway, the link on the profile page of @INSTANTPHONELOOKUP is a bit.ly shortened URL that points to the destination, cheaterslookup[DOT]com:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/dodgy-post-bitly.png
As of this writing, traffic to the destination has reached more than -100K- clicks since the bit.ly URL has been created last month. And this is just one of the many high-trafficked sub-pages from the same domain we’ve seen so far:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/bitly-destination-traffic.png
Clicking the shortened link points to try[DOT]textspy[DOT]us, wherein one is asked to enter their target’s mobile number. Once done, he/she sees a series of pages that were created to make him/her believe that the site is scanning for data related to the number. The final destination is an advertorial piece written on instantcheckmate[DOT]com... Users of Malwarebytes Anti-Malware are already protected from accessing cheaterslookup[DOT]com, including other sites such as the following that are found to be similar or related to it:
caughtcheating[DOT]co
spytext[DOT]us
textingspy[DOT]com
textspy[DOT]us
Although it’s tempting to try out such services either out of curiosity or for the fun of it, it’s still best to -avoid- shenanigans such as these. Your wallet and perhaps your partner will thank you for it."
caughtcheating[DOT]co: 192.64.119.193: https://www.virustotal.com/en/ip-address/192.64.119.193/information/
spytext[DOT]us: 162.255.119.144: https://www.virustotal.com/en/ip-address/162.255.119.144/information/
textingspy[DOT]com: 160.153.47.40: https://www.virustotal.com/en/ip-address/160.153.47.40/information/
textspy[DOT]us: 162.255.118.48: https://www.virustotal.com/en/ip-address/162.255.118.48/information/
instantcheckmate[DOT]com:
141.101.113.31: https://www.virustotal.com/en/ip-address/141.101.113.31/information/
190.93.242.31: https://www.virustotal.com/en/ip-address/190.93.242.31/information/
141.101.123.31: https://www.virustotal.com/en/ip-address/141.101.123.31/information/
190.93.241.31: https://www.virustotal.com/en/ip-address/190.93.241.31/information/
190.93.240.31: https://www.virustotal.com/en/ip-address/190.93.240.31/information/
cheaterslookup[DOT]com: 192.163.198.92: https://www.virustotal.com/en/ip-address/192.163.198.92/information/
___
Scam Texts 'Phish' for Banking Info
- https://www.bbb.org/blog/2015/09/scam-texts-phish-for-banking-info/
Sep 29, 2015 - "Watch out for this text message scam. Con artists are trying to fool users into sharing personal information by sending text messages that look like alerts from banks.
How the Scam Works:
You receive a text message that appears to be from a bank. It’s prompting you to update your profile and provides a link to a website. The link may even have the bank’s name as -part- of the domain...
If you click on the URL, you will be taken to a form that looks-like part of the bank’s website. The page will prompt to “confirm” your identity by entering your name, user ID, password and/or bank account number.
Don’t do it! Sharing this information puts you at-risk for identity theft.
Protect yourself from text message scams.
> Just hit delete! -Ignore- instructions to confirm your phone number or visit-a-link. Some scam texts instruct you to text “STOP” or “NO” to prevent future texts. But this is a common ploy by scammers to confirm they have a real, active phone number.
> Read your phone bill. Check your phone bill for services you haven’t ordered. Some charges may appear only once, but others might be monthly 'subscriptions'..."
___
Malvertising Via Google AdWords - Fake BSOD
- https://blog.malwarebytes.org/fraud-scam/2015/09/malvertising-via-google-adwords-leads-to-fake-bsod/
Sep 28, 2015 - "... fraudulent businesses also use online advertising as a way to reel in potential victims. This is nothing new and we have seen many examples of targeted keywords on search engine results before. Many times these rogue advertisers will abuse legitimate brands to trick people and provide services on behalf of these companies. Beyond copyright infringement laws, there is also the almost always present social engineering aspect that follows, to con people into spending hundreds of dollars for no good reason. And then you have advertisers that aren’t shy about doing their dirty deed at all. Take for example this recent campaign we spotted on AdWords, Google’s largest online advertising service:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/youtube_search.png
Here the crooks bid on the “youtube” keyword and got their ads displayed way at the top, before the organic search results. What’s interesting in this case is that the supposed destination URL is the actual YouTube.com site itself, and even placing the mouse over the ad shows a link to a YouTube channel. This really makes it look like a click-on-the-link would take you directly to YouTube but unfortunately that was not the case:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/flow2.png
Clicking on either one of the ads leads to a scary and convincing looking web page with the infamous Blue Screen of Death.The BSOD is a popular theme as of late and an effective way to display -bogus- but legitimate error codes that would trouble many internet users. As with most similar -scam- pages, users are instructed to call a toll-free ‘helpline’ to resolve their computer issues. This is no help line at all however; con artists are waiting for victims to phone in so that they can further scare them into purchasing expensive – and unnecessary – support packages. Innocent and unsavvy computer users will be defrauded from anywhere between $199 to $599. However, many online crooks don’t stop here, often committing identity theft and trying to empty out their victims’ bank accounts:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/BSODandpopup.png
The actors behind this particular malvertising attack had registered (at least) two domains to perform the illicit redirection from the Google advert to the BSOD page... Both of these domains are hosted on IP address 166.62.28.107 where the rest of the -fraudulent- sites also reside... We reported this campaign to Google and the bogus ads were pulled right away. The best defense against tech support scams (in all their forms) is awareness. For more information on this topic, please check out our help page*."
* https://blog.malwarebytes.org/tech-support-scams/
166.62.28.107: https://www.virustotal.com/en/ip-address/166.62.28.107/information/
___
Compromised WordPress Campaign - Spyware Edition
- http://research.zscaler.com/2015/09/compromised-wordpress-campaign-spyware.html
Sep 25, 2015 - "... started investigating multiple WordPress related security events earlier this month and came across a -new- widespread compromised WordPress campaign leading to the download of unwanted applications. This has been briefly covered by dynamoo* and has been reported by some users on official WordPress forums**...
* http://blog.dynamoo.com/2015/09/tainted-network-kfciilluminationescomsn.html
...
** https://wordpress.org/support/topic/virus-not-found-in-wordfence
During our research, we discovered that this campaign started in the first week of August, 2015 and has been fairly active since then resulting in over 20,000 security events to date from over 2,000 web pages. Majority of the WordPress sites affected by this campaign -are- running latest version 4.3.1 but the compromise could have occurred -prior- to the update... The infection starts when a user visits a compromised WordPress site. The compromised pages will have injected JavaScript... Although the target domains varied across the transactions that we saw, the associated server IP address has remained the same... The IP Address 91.226.33.54 associated with these domains is hosted in Latvia through a VPS hosting provider... In one of the cases, we observed the user is prompted to update the Flash Player as seen below:
> https://4.bp.blogspot.com/-GCAJIizxulc/VgQXxjFc8qI/AAAAAAAAASA/qqnQ6OVYElc/s1600/1.png
The page prompts the user to update or install a new flash player update. Regardless of the option the user selects, a -fake- Adobe Flash Player application is downloaded...
> https://3.bp.blogspot.com/-UpnA1hfbfSo/VgQXx6BOw5I/AAAAAAAAASI/4E96GKYaibs/s1600/2.png
... Conclusion: WordPress, being one of the most popular Content Management Systems & Blogging platform, remains an attractive target for cybercriminals. Unlike previous campaigns involving Malware Authors and Exploit Kit operators, the end payload getting served in this campaign involves spyware and potentially unwanted applications. These applications may seem innocuous but can facilitate malvertising based attacks through unsolicited advertisements..."
91.226.33.54: https://www.virustotal.com/en/ip-address/91.226.33.54/information/
2015-09-29
:fear::fear: :mad:
AplusWebMaster
2015-09-30, 13:02
FYI...
Fake 'Payment Summary' SPAM – PDF malware
- http://myonlinesecurity.co.uk/payment-summary-group-certificate-for-201415-financial-year-fake-pdf-malware/
30 Sep 2015 - "An email with the subject of 'Payment Summary (Group Certificate) for 2014/15 financial year' pretending to come from payslip@ hss.health.nsw. gov.au with a zip attachment is another one from the current bot runs... The content of the email says :
Please find attached a copy of your 2014/15 Payment Summary (Group Certificate).
Note: You will receive a separate payment summary for each Health Agency you worked for during the 2014/15 financial year. Payment Summaries are also available in Employee Self Service.
Further information, including fact sheets ...
For taxation advice and information, visit ...
Thank you,
Recruitment and Employee Transactional Services
HealthShare NSW ...
30 September 2015: PAYG-EoY-2014-15-77015286-008001475.zip:
Extracts to: PAYG-EoY-2014-15-77015286-008001475.scr
Current Virus total detections 3/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/357eede871cf78c4891425bd0f711a14f33a90f5d84546a712d9241b6b4662e2/analysis/1443589224/
___
Fake 'Optus agreement' SPAM – PDF malware
- http://myonlinesecurity.co.uk/completed-optus-agreement-no-rdre-211363-fake-pdf-malware/
30 Sep 2015 - "An email with the subject of 'Completed: Optus agreement no RDRE-211363' pretending to come from DocuSign via DocuSign <dse_eu8@ docusign .net> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/Completed-Optus-agreement-1024x647.png
30 September 2015: Optus agreement no RDRE-211363.zip:
Extracts to: Optus agreement no CDDO-248440.scr
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4fe126eea18a7b6f8fc0139784c1a90190683ef480e08c74b547e4b913ba74d3/analysis/1443586066/
___
Fake 'ein Foto' SPAM – jpg malware
- http://myonlinesecurity.co.uk/ein-foto-fake-jpg-malware/
30 Sep 2015 - "An email with the subject of 'ein Foto' pretending to come from Z@ t-mobile .de with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/09/ein-photo-1024x521.png
30 September 2015: 77895767_IMG ‘jpeg’.zip:
Extracts to: 77266374_IMG ‘jpeg’.JPEG.exe
Current Virus total detections 0/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper JPG (Image) file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/b4c9f5a6de8a5979ae2325c190527cd3dd9a98e69d108fb21a44caa67dd03b0d/analysis/1443597445/
___
Fake 'SWIFT transfer' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/09/malware-spam-fw-incoming-swift-clyde.html
30 Sep 2015 - "This -fake- banking email comes with a malicious attachment:
From "Clyde Medina" [Clyde.Medina@ swift .com]
Date Wed, 30 Sep 2015 12:35:56 GMT
Subject FW : Incoming SWIFT
We have received this documents from your bank regarding an incoming SWIFT transfer.
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are
confidential and are intended solely for the use of the person or entity to whom
the message was addressed. If you are not the intended recipient of this message,
please be advised that any dissemination, distribution, or use of the contents of
this message is strictly prohibited. If you received this message in error, please
notify the sender. Please also permanently delete all copies of the original message
and any attached documentation. Thank you.
Attached is a file SWIFT_transfer.zip which contains a malicious executable SWIFT_transfer.scr which currently has a detection rate of 2/56*. Automated analysis is pending, although the payload is almost definitely Upatre/Dyre..."
* https://www.virustotal.com/en/file/5a40ea145028c1f09ba4a78970359489380d75ce65f74cf662e60da779896e11/analysis/1443616096/
UPDATE: "The Hybrid Analysis report** shows Upatre/Dyre activity, including the malware phoning home to a familiar IP address of 197.149.90.166 in Nigeria which I recommend you -block- or monitor."
** https://www.hybrid-analysis.com/sample/5a40ea145028c1f09ba4a78970359489380d75ce65f74cf662e60da779896e11?environmentId=2
197.149.90.166: https://www.virustotal.com/en/ip-address/197.149.90.166/information/
2015-09-30
___
Optus DocuSign Spam
- http://threattrack.tumblr.com/post/130196981088/optus-docusign-spam
Sep 30, 2015 - "Subjects Seen
Completed: Optus agreement no AELT-773123
Typical e-mail details:
Carole Dean,
All parties have completed the envelope ‘Optus agreement no AELT-773123’.
Please find attached the signed agreement.
Malicious File Name and MD5:
Optus agreement no CDDO-248440.scr (ADCAED61174AF9FA4C1DB3F27A767316)
Screenshot: https://41.media.tumblr.com/fce5190eff6e1733726d81f67aa793d3/tumblr_inline_nvhoy953JK1r6pupn_500.png
Tagged: Optus, DocuSign, Upatre
___
ATM Skimmer Gang -firebombed- A/V Firm
- http://krebsonsecurity.com/2015/09/atm-skimmer-gang-firebombed-antivirus-firm/
Sep 29, 2015 - "... cybercime spills over into real-world, physical attacks... a Russian security firm whose operations were pelted with Molotov cocktail attacks after exposing an organized crime gang that developed and sold malicious software to steal cash from ATMs. The threats began not long after December 18, 2013, when Russian antivirus firm Dr.Web posted a writeup about a new Trojan horse program designed to steal card data from infected ATMs. Dr.Web received an email warning the company to delete all references to the ATM malware from its site. The anonymous party, which self-identified as the 'International Carders Syndicate', said Dr.Web’s ATM Shield product designed to guard cash machines from known malware 'threatens activity of Syndicate with multi-million dollar profit'... In an interview with KrebsOnSecurity, Dr.Web CEO Boris Sharov said the company did not comply with the demands. On March 9, 2014, someone threw a Molotov cocktail at the office of a third-party company that was distributing Dr.Web’s ATM Shield product. Shortly after that, someone attacked the same office again... After a third attack on the St. Petersburg office, a suspect who was seen running away from the scene of the attack was arrested but later released because no witnesses came forward to confirm he was the one who threw the bomb. Meanwhile, Sharov said Dr.Web detected two physical intrusions into its Moscow office... Sharov said Dr.Web analysts believe the group that threatened the attacks were not cyber thieves themselves but instead an organized group of programmers that had sold — but not yet delivered — a crimeware product to multiple gangs that specialize in cashing out hacked ATM cards... Sharov said he also believes that the group of malware programmers who sent the threats weren’t the same miscreants who threw the Molotov cocktails. Rather, Dr.Web maintains that those attacks were paid for and ordered over the Internet, for execution by strangers who answered a criminal help wanted ad... Sharov said his office got confirmation from a bank in Moscow that the team behind on the ATM Trojan that caused all the ruckus was operating out of Kiev, Ukraine. In the 18 months since then, the number of ATM-specific Trojans has skyrocketed, although the attackers seem to be targeting mainly Russian, Eastern European and European banks with their creations..."
(More detail at the krebsonsecurity URL above.)
:fear::fear: :mad:
AplusWebMaster
2015-10-01, 13:25
FYI...
Fake 'Please print' SPAM - doc malware
- http://myonlinesecurity.co.uk/chelsee-gee-ucblinds-please-print-word-doc-malware/
1 Oct 2015 - "An email with the subject of 'Please print' pretending to come from 'Chelsee Gee <chelsee@ ucblinds .co.uk> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Please-print-1024x742.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode-1024x604.png
01 October 2015 : Order-SO00653333-1.doc - Current Virus total detections 6/56 * . MALWR**
The Payload Security Hybrid analysis*** shows a download from www .ifdcsanluis .edu.ar/123/1111.exe [5]
(VirusTotal 1/57 [4]) which is most likely to be Dridex banking malware... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/436c99c88ea0a7312f3d60b127d0735e4698599b2f83b4df3a1dc67764235256/analysis/1443691578/
** https://malwr.com/analysis/NTU0YzdhOWQyOTIyNDhlYjgwNjlhOWIwMDRkMGJkNWQ/
*** https://www.hybrid-analysis.com/sample/436c99c88ea0a7312f3d60b127d0735e4698599b2f83b4df3a1dc67764235256?environmentId=1
4] https://www.virustotal.com/en/file/30cd60d723b84e16e832d467d66f5e95f09b19222deb80a636ac2e2465e9e9a0/analysis/1443690542/
5] "... There are frequently 5 or 6 download locations all delivering exactly the same malware..."
- http://blog.dynamoo.com/2015/10/malware-spam-please-print-chelsee-gee.html
1 Oct 2015 - "... received several copies of this, and the normal method is that there are several different email attachments.. 'will look at just one. Named Order-SO00653333-1.doc this file has a detection rate of 6/56*, and it contains this malicious macro... The Hybrid Analysis report** for this particular document shows the malware downloading from:
hobby-hangar .net/123/1111.exe
Other locations are:
miastolomza .pl/123/1111.exe
www .ifdcsanluis .edu.ar/123/1111.exe
www .norlabs .de/123/1111.exe
zahnrad-ruger .de/123/1111.exe
This binary has a VirusTotal detection rate of 2/56*** and the Hybrid Analysis report for that is here[4].
The payload is the Dridex banking trojan, and in fact this is the first Dridex I have seen in over a month after some of the alleged perpatrators were arrested[5].
Recommended blocklist:
miastolomza .pl
ifdcsanluis .edu.ar
norlabs .de
zahnrad-ruger .de
hobby-hangar .net "
* https://www.virustotal.com/en/file/761b17c4f926c403813b5c2c4c79f3d64c3b5d5a96e841e454fd5791e56f67db/analysis/1443701260/
** https://www.hybrid-analysis.com/sample/761b17c4f926c403813b5c2c4c79f3d64c3b5d5a96e841e454fd5791e56f67db?environmentId=1
*** https://www.virustotal.com/en/file/a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43/analysis/1443701636/
4] https://www.hybrid-analysis.com/sample/a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43?environmentId=1
5] http://krebsonsecurity.com/2015/09/arrests-tied-to-citadel-dridex-malware/
___
Tax Refund Due HMRC – Phish ...
- http://myonlinesecurity.co.uk/tax-refund-due-hmrc-phishing/
1 Oct 2015 - "One of the major common subjects in a phishing attempt is 'Tax return' and 'tax refunds' where especially in UK, you need to submit your Tax Return online. This email with a subject of 'Tax Refund Due' pretending to come from HMRC is more unusual in that it is directly targeted at a user by your full correct name instead of the usual 'dear Tax Payer' or such similar generic title. This one wants your personal details, email address and your credit card and bank details as well as driving licence and National Insurance number . Many of them are also designed to specifically steal your email, Facebook and other social network log in details. The information from this -phish- can make a new version of you and cause untold damage... It will NEVER be a genuine email from HMRC so don’t ever fill in the html ( webpage) form that comes attached to the email. Some versions of this phish will have a -link- to a website that looks at first glance like the genuine HMRC website. That is also false:
Tax Refund
Dear [REDACTED]
This is a reminder that you have not yet claimed your refund of 265.48 GBP. We have calculated that this the amount you will be refunded. Press Request Refund below in order to complete your refund request.
Please wait 4 weeks after making an online claim and 6 weeks after making a postal claim before contacting HMRC about the payment.
Terms & Conditions | Policy | Freedom of Information
The links in the email go to http ://www .revenue-apply .gov.uk.medi7.xyz/Tax-Refund.php? where if you aren’t very wary you won’t notice the fact that it is -not- a genuine gov.uk site but one ending in .xyz another reason to be-wary of these new domains that can be anything. If you follow the link you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Tax-Refund-Due_web_page.png
Once you fill in the details you are -bounced- on to the genuine HMRC site. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
___
Recent trends in Nuclear Exploit Kit activity
- https://isc.sans.edu/diary.html?storyid=20203
2015-10-01 - "Since mid-September 2015, I've generated a great deal of Nuclear exploit kit (EK) traffic after checking -compromised- websites. This summer, I usually found Angler EK. Now I'm seeing more Nuclear. Nuclear EK has also been sending -dual- payloads... I hadn't noticed it again from Nuclear EK until recently. This time, one of the payloads appears to be ransomware... To be clear, Nuclear EK isn't always sending two payloads, but I've noticed a dual payload trend with this recent increase in Nuclear EK traffic. Furthermore, on Wednesday 2015-09-30, the URL pattern for Nuclear EK's landing page changed... Like other EKs, Nuclear EK keeps evolving. We will continue to keep an eye on the situation and let you know of any significant developments. Packet captures of the 2015-09-30 Nuclear EK traffic are available..."
(More detail at the isc URL above.)
___
Commonwealth Bank NetBank Spam
- http://threattrack.tumblr.com/post/130271990733/commonwealth-bank-netbank-spam
Oct 1, 2015 - "Subjects Seen
First NetBank Third Party Payment
Typical e-mail details:
First NetBank Third Party Payment
Your first transfer to the following third party account(s) has been successfully processed:
From Account: **** **** **** 4362 MasterCard To Account(s): Raul Murphy 574-152 ***6782 Maestro $4,326.78 Credit help Date: 01/10/2015
Please check attached file for more information about this transaction.
Yours sincerely,
Commonwealth Bank of Australia
Malicious File Name and MD5:
CBA Third Party Payment 510569701.scr (3BBC3DBE68B6AB28F2516F8F814D8005)
Screenshot: https://36.media.tumblr.com/aa2ac3b404944698e722b7890bab7ed8/tumblr_inline_nvjro2JXzq1r6pupn_500.png
Tagged: Commonwealth Bank, Upatre
:fear::fear: :mad:
AplusWebMaster
2015-10-02, 13:05
FYI...
Fake 'SecureMail' SPAM - doc malware
- http://myonlinesecurity.co.uk/anz-bank-securemail-you-have-1-new-message-word-doc-malware/
2 Oct 2015 - "An email with the subject of 'SecureMail: You have 1 new message' pretending to come from ANZ Bank <secure@ anz .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
You have received a secure message
Read your secure message by opening SecureMessage.doc. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.
In order to view the attachment please open it using your email client (Microsoft Outlook, Mozilla Thunderbird, Lotus ).
First time users – will need to register after opening the attachment.
About Email Encryption please check our website ...
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode.png
... This particular version pretends to have a digital RSA key...
2 October 2015: SecureMail.doc - Current Virus total detections 11/56* ... Some antivirus companies are indicating that this is downloading Upatre which will in turn download Dyre or Dridex banking malware... Edit:.. the Upatre binary is -embedded- inside the word doc that gets extracted and run from %temp%/w1.exe (VirusTotal 21/56 **). So far I have only examined 1 version of this malware... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8c177787a0a0247663385e620636e294549f0e126bcb159019c41440f3437fda/analysis/1443754962/
** https://www.virustotal.com/en/file/c9fccadb69836a372c5c6a6b53eb2391c2c8732471a3213b46cdbc16a5af75b5/analysis/1443785738/
___
Fake 'PayPal' SPAM - fake app/Trojan
- http://net-security.org/malware_news.php?id=3119
2.10.2015 - "An email spam run impersonating PayPal is actively targeting German Android users and trying to trick them into downloading what is ostensibly the official PayPal app, but is actually a banking Trojan. The -fake email- looks pretty believable - the PayPal logo, (relatively) good German, some basic clean design - and some recipients were likely convinced into installing the app. According to Trend Micro researchers*, the malicious app is -not- hosted on Google Play. This is where the Android setting set on disallowing the installation of non-Market application can really save users. If a user proceeds with downloading and installing the app, the Trojan will ask to be made a "Device Administrator". This will help it hide from the user's sight and make it more difficult to remove, as well as allow it to perform a number of other changes:
> http://www.net-security.org/images/articles/paypal-fake-02102015.jpg
... The fake app/Trojan is able to perform UI hijacking, which will allow it to impersonate a number of legitimate apps when the user is required to enter their login credentials to perform an action. "Once the malware detects the real PayPal app is running, it will put up a fake UI on top of the real one, effectively hijacking the session and stealing the user’s PayPal credentials," they explained. The same thing happens when the victim tries to use the official online banking app of German Commerzbank, and several other banks popular in the country. Unfortunately for potential targets, the crooks behind this scheme are not only misusing the good name of PayPal to trick users into installing this Trojan. The same malware also comes disguised as Flash Player, game apps and adult apps. Users are advised to be careful about the apps they install (check the permissions it asks), and not to trust unsolicited emails urging them to download something."
* http://blog.trendmicro.com/trendlabs-security-intelligence/german-users-hit-by-dirty-mobile-banking-malware-posing-as-paypal-app/
___
'PDF version not supported' - Phish ...
- https://blog.malwarebytes.org/online-security/2015/10/this-pdf-version-is-not-supported-data-uri-phish/
Oct 2, 2015 - "We noticed a certain Bit .ly link getting some attention over the last few days, and stopped to take a closer look. The bit .ly link, which has had 1,901 clicks since September 7th (985 of occured over the last 3 days), shows numerous Email service referrers in the Bit.ly stats in relation to “Where this is being shared”. While we don’t have a copy of an -email- it seems a safe bet to think it would be one of those “You have an important document waiting” messages so beloved of spammers everywhere. We managed to find a hit for the Bit .ly link contained in a particular PDF document called “Scan002.pdf”. Piecing it all together, the run of play appears to be:
- Potential victim receives a “You have a document waiting” type missive via email (and possibly other channels).
- They either open an attached PDF document, or are linked to it directly (the latter would be a somewhat more cumbersome method).
- The PDF document, which does not appear to be malicious, displays the following:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/pdfphish3.jpg
'This PDF version is not supported. Click here to view online'
Clicking the Bit.ly link takes the clicker to
groovytouchmedia(dot)com/grail/pdnet(dot)html
From there, the URL will suddenly appear to make little sense to most people as it switches from something the above, to what may seem like a long line of gibberish:
> https://blog.malwarebytes.org/wp-content/uploads/2015/09/pdfphish1.jpg
What’s actually happening here is something called Data URI phishing, an attempt at disguising a phish attack from potential victims which we see every now and again*. After entering an email address and password, hitting the “Your Document” button leads to the following “Document has been removed” splash:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/pdfphish4.jpg
After this, the victim is forwarded on to the frontpage of a free file hosting service to complete the illusion. Regardless of how a “file waiting for you online” comes to your initial attention, always be wary and -never- hand over your login credentials to unfamiliar websites – especially if a random email should come into play. It simply isn’t worth the risk."
* https://blog.malwarebytes.org/fraud-scam/2015/01/avoid-this-outlook-phish/
groovytouchmedia(dot)com: 50.28.9.115: https://www.virustotal.com/en/ip-address/50.28.9.115/information/
>> https://www.virustotal.com/en/url/651b953ecf6c3878ae4e612a727b4836c183679518f48744c4178aa106028295/analysis/
:fear::fear: :mad:
AplusWebMaster
2015-10-03, 13:25
FYI...
Fake 'FedEx delivery' SPAM – JS malware
- http://myonlinesecurity.co.uk/fedex-international-next-flight-shipment-delivery-problem-js-malware/
Last revised or Updated on: 3rd Oct, 2015 - "An email with the subject of 'Shipment delivery problem #0000701821 [random numbered]' pretending to come from 'FedEx International Next Flight' with a zip attachment is another one from the current bot runs... The content of the email says :
Dear Customer,
We could not deliver your parcel.
You can review complete details of your order in the find attached.
Regards,
Johnny Cantrell,
Sr. Operation Agent...
... Other subjects in this set of malicious malspam include:
Problem with parcel shipping, ID:00000953180
Problems with item delivery, n.0000823595
Other senders pretend to be:
FedEx Standard Overnight
FedEx International MailService ...
2 October 2015: Delivery_Notification_0000701821.zip: Extracts to: Delivery_Notification_0000701821.doc.js
Current Virus total detections 2/57*... which should be contacting these 3 sites
alejandrosanchezvejar .com: 198.252.71.136: https://www.virustotal.com/en/ip-address/198.252.71.136/information/
icandymobile .com: 23.91.123.48: https://www.virustotal.com/en/ip-address/23.91.123.48/information/
laurenszedlak .com: 96.31.35.72: https://www.virustotal.com/en/ip-address/96.31.35.72/information/
... but doesn’t appear to be downloading any malware or actually contacting them (Payload Security Hybrid analysis**)
3 October 2015: Delivery_Notification_00000953180.zip:
Extracts to: Delivery_Notification_00000953180.doc.js
Current Virus total detections 8/57 ***... which contacts these 3 sites
clicks-tec .com: 96.31.35.72
dominaeweb .com: 174.36.231.69: https://www.virustotal.com/en/ip-address/174.36.231.69/information/
laurenszedlak .com: 96.31.35.72
... and downloads these files 74404411.exe (VirusTotal 4/57 [4]) and e13dbe35c0786[1].gif (VirusTotal 1/56 [5])
(Payload Security Hybrid analysis [6]) MALWR[7] Note: the automatic tools seem to have problems analysing these javascript files and aren’t getting the payload in many cases.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d94a7d5694df9c079443b2e52d0b1b3d44529cf3a9409c36f03ecfd58e7ca486/analysis/1443817957/
** https://www.hybrid-analysis.com/sample/d94a7d5694df9c079443b2e52d0b1b3d44529cf3a9409c36f03ecfd58e7ca486?environmentId=1
*** https://www.virustotal.com/en/file/3f2662d815b03c2fce41005b9aa4a070ca2ccd3850c3a9982ece5934d0908e0e/analysis/1443849155/
4] https://www.virustotal.com/en/file/e5af273c04c9c941a0e7d3615618ff1fd03b476eb72be968e93b82a854df9203/analysis/1443850296/
5] https://www.virustotal.com/en/file/3f2662d815b03c2fce41005b9aa4a070ca2ccd3850c3a9982ece5934d0908e0e/analysis/1443849155/
6] https://www.hybrid-analysis.com/sample/3f2662d815b03c2fce41005b9aa4a070ca2ccd3850c3a9982ece5934d0908e0e?environmentId=1
7] https://malwr.com/analysis/MGY2YTliOWFlMzE2NGY4ZWFjZWQxOTRlNDU5NmM3NWM/
:fear::fear: :mad:
AplusWebMaster
2015-10-05, 15:04
FYI...
Fake 'Invoices' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-your-invoices-incident.html
5 Oct 2015 - "This -fake- financial spam is not from Incident Support Group Ltd but is instead a simple -forgery- with a malicious attachment:
From repairs@ isgfleet .co.uk
Date Mon, 05 Oct 2015 15:47:11 +0700
Subject Your Invoices - Incident Support Group Ltd
Please find attached your invoices from Incident Support Group Ltd. If you wish to
change the email address we have used please email repairs@ isgfleet .co.uk with the
correct details.
In the sample I saw, the attached file was 216116.xls which has a VirusTotal detection rate of 6/56* and contains this malicious macro... which then downloads a compenent from the following location:
agridiotiko .com/432/4535.exe
Note that at the time of writing, I only have one sample of this. There are usually several versions of the attachment in these spam runs, with different download locations. The malicious binary has a detection rate of 4/56**. The VirusTotal report and this Hybrid Analysis report[3] indicate traffic to:
84.246.226.211 (ELB Multimedia, France)
Blocking or monitoring traffic to and from the port would probably be prudent. The payload is most likely the Dridex banking trojan.
UPDATES: Other download locations spotted so far:
www .poncho-zwerfkatten .be/432/4535.exe "
* https://www.virustotal.com/en/file/7c26fd0ff77b5f15a22381661a4d48ffd53fd48354ec0e8b3f7a8d3e1d67e758/analysis/1444035346/
** https://www.virustotal.com/en/file/8e4e8440b685a3bdcdd3c06b3c9b992b3872cd7e2b9cfde70296a4de7dca7f49/analysis/1444035400/
... Behavioural information
TCP connections
84.246.226.211: https://www.virustotal.com/en/ip-address/84.246.226.211/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
3] https://www.hybrid-analysis.com/sample/8e4e8440b685a3bdcdd3c06b3c9b992b3872cd7e2b9cfde70296a4de7dca7f49?environmentId=1
agridiotiko .com: 80.67.28.152: https://www.virustotal.com/en/ip-address/80.67.28.152/information/
poncho-zwerfkatten .be: Could not find an IP address for this domain name.
- http://myonlinesecurity.co.uk/your-invoices-incident-support-group-ltd-excel-xls-spreadsheet-malware/
5 October 2015: 216116.xls
Current Virus total detections 7/56*
Downloads conserpa.vtrbandaancha .net/432/4535.exe (VirusTotal**)
* https://www.virustotal.com/en/file/50530bc27d7a5d23de2fe4428f83b6bab7673e2fc30380a080306847f0fb0e8d/analysis/1444044622/
** https://www.virustotal.com/en/file/8e4e8440b685a3bdcdd3c06b3c9b992b3872cd7e2b9cfde70296a4de7dca7f49/analysis/1444040840/
... Behavioural information
TCP connections
84.246.226.211: https://www.virustotal.com/en/ip-address/84.246.226.211/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
vtrbandaancha .net: Could not find an IP address for this domain name.
:fear::fear: :mad:
AplusWebMaster
2015-10-06, 13:41
FYI...
Fake 'Copy of Invoice(s)' SPAM – doc malware
- http://myonlinesecurity.co.uk/copy-of-invoices-hammondsofknutsford-co-uk-word-doc-malware/
6 Oct 2015 - "An email with the subject of 'Copy of Invoice(s)' pretending to come from Anny Beckley <Anny@ hammondsofknutsford .co.uk> with a malicious word doc is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Copy-of-Invoices-1024x559.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode-1024x604.png
6 October 2015 : Q_46Q0VWHU4.DOC - Current Virus total detections 7/57*
Hybrid analysis** . ... A manual interpretation of the malicious macro gives me http ://measelaw .com/65yg3f/43g5few.exe which returns a 'not found' but a search by file name gives http ://rothschiller .net/~medicbt9/65yg3f3/43g5few.exe (VirusTotal 2/56 ***)... There appear to be 2 different files of that name on the server 1st one is 132 kb (VirusTotal 2/56 [4]) 2nd one is 285kb (VirusTotal 1/57 [5]). Further update: I am getting responses from the antivirus companies that the first file is Dridex... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d74b2bb9b4f01c372c1f5be43ac2428f72028ea23d7363fd5571bfd9f8155610/analysis/1444120771/
** https://www.hybrid-analysis.com/sample/d74b2bb9b4f01c372c1f5be43ac2428f72028ea23d7363fd5571bfd9f8155610?environmentId=5
*** https://www.virustotal.com/en/file/74a4752e05511b66858a9da1ef6d894ad354be6450ca4ac85b85c11554aec863/analysis/1444126336/
...Behavioural information
TCP connections
84.246.226.211: https://www.virustotal.com/en/ip-address/84.246.226.211/information/
92.123.225.120: https://www.virustotal.com/en/ip-address/92.123.225.120/information/
4] https://www.virustotal.com/en/file/74a4752e05511b66858a9da1ef6d894ad354be6450ca4ac85b85c11554aec863/analysis/1444126336/
...Behavioural information
TCP connections
84.246.226.211
92.123.225.120
5] https://www.virustotal.com/en/file/759cbdbd55a5cfb43a2757c115248d84774ea7fd9a114500c83564a19f3eb93c/analysis/1444126999/
...Behavioural information
TCP connections
84.246.226.211
92.123.225.120
measelaw .com: 216.87.186.107: https://www.virustotal.com/en/ip-address/216.87.186.107/information/
rothschiller .net: 162.144.72.10: https://www.virustotal.com/en/ip-address/162.144.72.10/information/
- http://blog.dynamoo.com/2015/10/malware-spam-copy-of-invoices-anny.html
6 Oct 2015 - "This -fake- financial spam does not come from Hammonds of Knutsford but is instead a simple forgery with a malicious attachment:
From Anny Beckley [Anny@ hammondsofknutsford .co.uk]
Date Tue, 06 Oct 2015 12:29:23 +0430
Subject Copy of Invoice(s)
Please find attached a copy of Invoice Number(s) 82105
In the two samples that I have seen, the attached file was named Q_46Q0VWHU4.DOC with a VirusTotal detection rate of 7/56*. This document contains a malicious macro... which downloads a further component from the following location:
rothschiller .net/~medicbt9/65yg3f3/43g5few.exe
This currently has a detection rate of just 1/56** and it appears to be saved as %TEMP%\rrdDhhm.exe . Note that there are usually several different document versions spammed out with different download locations, but the payload is the same in every case.
Automated analysis is pending, but the payload is almost definitely the Dridex banking trojan."
* https://www.virustotal.com/en/file/3275e353aededbcf66c8673af2800cf662ce6b147daaac525c3dafceaee05cd5/analysis/1444127245/
** https://www.virustotal.com/en/file/759cbdbd55a5cfb43a2757c115248d84774ea7fd9a114500c83564a19f3eb93c/analysis/1444128214/
... Behavioural information
TCP connections
84.246.226.211: https://www.virustotal.com/en/ip-address/84.246.226.211/information/
92.123.225.122: https://www.virustotal.com/en/ip-address/92.123.225.122/information/
___
Fake 'BL Draft' SPAM – PDF malware
- http://myonlinesecurity.co.uk/bl-draft-is-ready-for-review-cargosmart-fake-pdf-malware/
6 Oct 2015 - "An email with the subject of 'OOCL – B/L:4747679656(XIN YANG PU F2NM3) – BL Draft is Ready for Review' pretending to come from support@ cargosmart .com with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/BL-Draft-is-Ready-for-Review-1024x567.png
6 October 2015: 4747679656drft.zip: Extracts to: 4017334330drft.scr
Current Virus total detections 8/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/720ff0228fdd432b8385a9f7c6c063184fb0357bfab9b4ed0803117486fe761a/analysis/1444116810/
___
Fake 'WeTransfer' SPAM - malicious payload
- http://blog.dynamoo.com/2015/10/malware-spam-has-sent-you-file-via.html
6 Oct 2015 - "This -fake- "WeTransfer" spam comes with a malicious payload.
info@ucaqld .com .au has sent you a file via WeTransfer
1 message
WeTransfer 6 October 2015 at 13:36
To: [redacted]
info@ucaqld .com .au
sent you some files
‘Hey Nicole,
I have given you these federal reminder
Many thanks
Stacey'
Download
Files (101 KB total)
Document.doc
Will be deleted on
07 Oct, 2015
Get more out of WeTransfer, get Plus
About WeTransfer Contact= Legal Powered by Amazon Web Services
In this case, the malicious link is actually at..
storage-hipaa-2.sharefile .com/download.ashx?dt=dt3b07281f2b9440708a4b8a411e2f0e18&h=WAOCUIfIJJIYoHSVimogW83t4TXwSsltx0MYcStbmyQ%3d
The attachment is -malicious- in nature, but analysis is still pending. In the meantime, here is an initial Hybrid Analysis report*."
* https://www.hybrid-analysis.com/sample/3c642092835415c8f139d91341339b1b52a01576c099930f464319d2a89bf486?environmentId=1
(See 'Malicious Indicators')
> https://www.virustotal.com/en/domain/storage-hipaa-2.sharefile.com/information/
"... This domain has been seen to resolve to the following IP addresses.
2015-06-08 54.208.209.126"
54.208.209.126: https://www.virustotal.com/en/ip-address/54.208.209.126/information/
- http://myonlinesecurity.co.uk/infobogoroch-com-has-sent-you-a-file-via-wetransfer-word-doc-malware/
6 Oct 2015 - "An email with the subject of 'info@ bogoroch .com has sent you a file via WeTransfer' pretending to come from WeTransfer <noreply@ wetransfer .com> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/info@bogoroch.com-has-sent-you-a-file-via-WeTransfer-1024x848.png
The link behind the download is to https ://storage-hipaa-2.sharefile .com/download.ashx?dt=dt3b07281f2b9440708a4b8a411e2f0e18&h=WAOCUIfIJJIYoHSVimogW83t4TXwSsltx0MYcStbmyQ%3d
Other subjects seen in this malspam run include:
info@ bmonster .com has sent you a file via WeTransfer
info@ sundaymail .co.uk has sent you a file via WeTransfer
info@ bluepulse .com.au has sent you a file via WeTransfer ...
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...
6 October 2015 2015 : Document.doc - Current Virus total detections 2/56*.
... which doesn’t connect to a webserver but has the Upatre binary embedded inside the word doc that gets extracted and run from %temp%\< random name >.exe (VirusTotal 2/56**). So far I have only examined 1 version of this malware... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3c642092835415c8f139d91341339b1b52a01576c099930f464319d2a89bf486/analysis/1444143437/
** https://www.virustotal.com/en/file/4cfa68bba20b6df11c0739a021582427c36ee2efca36b584b5fc6d1769110079/analysis/1444140338/
___
Cisco security researchers disable big distributor of 'ransomware'
- http://www.reuters.com/article/2015/10/06/us-ransomware-cisco-idUSKCN0S01F020151006
Oct 6, 2015 - "... about half of computers infected with Angler were connecting to servers at a hosting provider in Dallas, which had been hired by criminals with stolen credit cards. The provider, Limestone Networks, pulled the plug on the servers and turned over data that helped show how Angler worked. The research effort, aided by carrier Level 3 Communications, allowed Cisco to copy the authentication protocols the Angler criminals use to interact with their prey. Knowing these protocols will allow security companies to cut off infected computers... Cisco said that since Limestone pulled the plug on the servers, new Angler infections had fallen off dramatically. Limestone's client relations manager told Reuters his company had unwittingly helped the spread of Angler before the Cisco investigation. Often sold in clandestine Internet forums or in one-to-one deals, exploit kits combine many small programs that take advantage of flaws in Web browsers and other common pieces of software. Buyers of those kits must also arrange a way to reach their targets, typically by sending spoof emails, hacking into websites or distributing malicious advertisements. Once they win control of a target's computer, exploit kit buyers can install whatever they want, including so-called ransomware. This includes a number of branded programs, also sold online, that encrypt users' computer files and demand payment to release them. -Talos- estimated that if three percent of infected users paid the ransom averaging $300, the criminals that had used the Limestone servers to spread Angler could have made about $30 million a year."
> http://blogs.cisco.com/security/talos/angler-exposed
Oct 6, 2015 - "... Angler is actually constructed in a proxy/server configuration. There is a single exploit server that is responsible for serving the malicious activity through multiple proxy servers. The proxy server is the system that users communicate with, allowing the adversary to quickly pivot and change while still shielding the exploit server from identification and exposure. Additionally, there is a health monitoring server that is conducting health checks, gathering information about the hosts that are being served exploits, and remotely erase the log files once they have been fetched. This health server revealed the scope and scale of the campaign, and helped allow us to put a monetary value on the activity. A single health server was seen monitoring 147 proxy servers over the span of a month and generating in excess of $3,000,000 USD in revenue. This single adversary was responsible for approximately half of the Angler activity we observed and is making more than $30,000,000 USD annually from Ransomware infections alone..."
- https://blog.opendns.com/2015/10/06/cisco-disrupts-major-ransomware-campaign/
Oct 6, 2015
> https://blog.opendns.com/wp-content/uploads/2015/10/IN_cisco-angler-infographic_100515.png
:fear::fear: :mad:
AplusWebMaster
2015-10-07, 13:37
FYI...
Fake 'Scanned document' SPAM - malicious payload
- http://blog.dynamoo.com/2015/10/malware-spam-scanned-document-from-mx.html
7 Oct 2015 - "This -fake- scanned document has a malicious payload attached:
From: xerox@ victimdomain .tld
Reply-To: xerox@ victimdomain .tld
Date: 7 October 2015 at 10:08
Subject: Scanned document from MX-2600N
Reply to: xerox@ victimdomain .tld victimdomain .tld
> Device Name: Not Set
Device Model: MX-2600N
Location: Not Set
File Format: XLS MMR(G4)
Resolution: 200dpi x 200dpi
Attached file is scanned document in XLS format... Attached is a file in the format xerox@ victimdomain .tld_20151007_160214 .xls (where victimdomain.tld is the victim's own domain), which has a VirusTotal detection rate of 3/56*. This Excel file contains a malicious macro... which in THIS case downloads a binary from the following location:
alarmtechcentral .com/fw43t2d/98kj6.exe
There will be other versions of the XLS file which will download components from other locations, however the payload will be the same, and it currently has a detection rate of 2/56**. The VirusTotal report indicates traffic to:
84.246.226.211 (ELB Multimedia, France)
Blocking traffic to and from that IP is recommended. Automated analysis is pending, please check back later. The payload is probably the Dridex banking trojan.
UPDATE: Here are the Hybrid Analysis reports for the XLS file[3] and executable[4]."
* https://www.virustotal.com/en/file/20b8c4dcefcb1fbb38c4bf63a504b30af9bfeb56923d4e2d52bf78ab8683f5bb/analysis/1444209423/
** https://www.virustotal.com/en/file/3409a5e117bcce19fc616ab870ab04b8bbdebd5952482ea932c3b02c609f8c10/analysis/1444209808/
... Behavioural information
TCP connections
84.246.226.211: https://www.virustotal.com/en/ip-address/84.246.226.211/information/
92.123.225.120: https://www.virustotal.com/en/ip-address/92.123.225.120/information/
3] https://www.hybrid-analysis.com/sample/20b8c4dcefcb1fbb38c4bf63a504b30af9bfeb56923d4e2d52bf78ab8683f5bb?environmentId=1
4] https://www.hybrid-analysis.com/sample/3409a5e117bcce19fc616ab870ab04b8bbdebd5952482ea932c3b02c609f8c10?environmentId=3
alarmtechcentral .com: 69.195.85.248: https://www.virustotal.com/en/ip-address/69.195.85.248/information/
- http://myonlinesecurity.co.uk/scanned-document-from-mx-2600n-excel-xls-spreadsheet-malware/
7 Oct 2015 - "An email with the subject of 'Scanned document from MX-2600N' pretending to come from a printer or scanner at your own email domain with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
... Device Name: Not Set
Device Model: MX-2600N
Location: Not Set
File Format: XLS MMR(G4)
Resolution: 200dpi x 200dpi
Attached file is scanned document in XLS format.
Use Microsoft(R)Excel(R) to view the document.
... these pretend to be sent from these email addresses at your own email domain or company:
Xerox@
Canon@
Printer@
MX-2600N@
Other subjects include:
Scanned image from MX-2600N
Scanned file from MX-2600N
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
7 October 2015: canon @... _20151007_160214.xls - Current Virus total detections 3/57*
Payload Security Hybrid analysis** shows that this downloads what is almost certainly Dridex banking malware from http ://frozenfoods2004 .com/fw43t2d/98kj6.exe (VirusTotal 3/56***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/7112c65769068574a64c25906293e916da288f442d1dcf0ee3b8a422d116cd13/analysis/1444209116/
** https://www.hybrid-analysis.com/sample/7112c65769068574a64c25906293e916da288f442d1dcf0ee3b8a422d116cd13?environmentId=1
*** https://www.virustotal.com/en/file/3409a5e117bcce19fc616ab870ab04b8bbdebd5952482ea932c3b02c609f8c10/analysis/1444209437/
... Behavioural information
TCP connections
84.246.226.211: https://www.virustotal.com/en/ip-address/84.246.226.211/information/
92.123.225.120: https://www.virustotal.com/en/ip-address/92.123.225.120/information/
frozenfoods2004 .com: 66.111.47.38: https://www.virustotal.com/en/ip-address/66.111.47.38/information/
___
Fake 'Confirmation' SPAM – doc malware
- http://myonlinesecurity.co.uk/red-funnel-ferries-confirmation-5838547-word-doc-malware/
7Oct 2015 - "An email that appears to come from 'Red Funnel Ferries' with the subject of 'Confirmation 5838547' pretending to come from post@ redfunnel .co.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/red_funnel-Confirmation-5838547-1024x760.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
7 October 2015: 5838547.doc - Current Virus total detections 6/55*
Downloads the same Dridex banking malware from http ://frozenfoods2004 .com/fw43t2d/98kj6.exe that was described in today’s earlier malspam run** of malicious office docs with macros... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9b15fe1a47a4eca6251e05f7fe8d79940d1333fad70d5e03a71d7b6e32f9c09e/analysis/1444215510/
** http://myonlinesecurity.co.uk/scanned-document-from-mx-2600n-excel-xls-spreadsheet-malware/
___
New Outlook mailserver attack steals massive number of passwords
Backdoor in Outlook Web Application operates inside target's firewall
- http://arstechnica.com/security/2015/10/new-outlook-mailserver-attack-steals-massive-number-of-passwords/
Oct 5, 2015 - "Researchers have uncovered advanced malware that can steal virtually all of a large organization's e-mail passwords by infecting its Outlook Web Application (OWA) mail server over an extended period of time. Researchers from security firm Cybereason discovered the malicious OWA module after receiving a call from an unnamed company that had more than 19,000 endpoints. The customer had witnessed several behavioral abnormalities in its network and asked Cybereason to look for signs of an infection. Within a few hours, the security firm found a suspicious DLL file loaded into the company's OWA server. While it contained the same name as a benign DLL file, this one was unsigned and was loaded from a different directory. The OWAAUTH.dll file contained a backdoor. Because it ran on the server, it was able to retrieve all HTTPS-protected server requests after they had been decrypted. As a result, the attackers behind this advanced persistent threat — the term given to malware campaigns that target a specific organization for months or years — were able to steal the passwords of just about anyone accessing the server. "The hackers in this case managed to gain a foothold into a highly strategic asset: the OWA server," Cybereason researchers wrote in a blog post published Monday*... Cybereason didn't say how widespread the attack is beyond it targeting the one customer. Chances are, malware as detailed as this isn't a one-off thing, so it wouldn't be surprising to see it hitting other large organizations."
* http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Labs-Analysis-Webmail-Sever-APT.pdf
- http://blogs.technet.com/b/exchange/archive/2015/10/07/no-new-security-vulnerability-in-outlook-web-access-owa.aspx
7 Oct 2015
:fear::fear: :mad:
AplusWebMaster
2015-10-08, 13:45
FYI...
Fake 'Norfolk Dance' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/receipt-from-norfolk-dance-word-doc-or-excel-xls-spreadsheet-malware/
8 Oct 2015 - "An email with the subject of 'Receipt from Norfolk Dance' pretending to come from <info@ norfolkdance .co.uk> with a malicious word doc attachment is another one from the current bot runs... Please find receipt for payment attached.
Many Thanks
Norfolk Dance
14 Chapel Field North
Norwich
Norfolk
NR2 1NY
Telephone: 01603 283399
E mail...
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...
8 October 2015: Receipt.doc - Current Virus total detections 2/56*
Downloads the same Dridex Banking malware from the same locations as described in today’s earlier malspam run of malicious macro enabled word docs**...
** http://myonlinesecurity.co.uk/swagbags-biz-new-order-confirmation-3535-word-doc-or-excel-xls-spreadsheet-malware/
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/70f483f464b7f5e2361fd9eb5a3a90dbaed5f6cda7ba7628d7f2d9050722ad4f/analysis/1444298476/
- http://blog.dynamoo.com/2015/10/malware-spam-receipt-from-norfolk-dance.html
8 Oct 2015 - "This -fake- financial email is not from Norfolk Dance but is instead a simply -forgery- with a malicious attachment:
From "info" [info@ norfolkdance .co.uk]
Date Thu, 08 Oct 2015 12:39:28 +0300
Subject Receipt from Norfolk Dance
Please find receipt for payment attached.
Many Thanks
Norfolk Dance
14 Chapel Field North
Norwich
Norfolk
NR2 1NY
Telephone: 01603 283399
E mail...
Attached is a file Receipt.doc which I have seen in two different versions (VT detection rate 4/56* and 3/56**) each containing a different malicious macro... which download a malicious binary from one of the following locations:
katastimataone .com/bvcb34d/983bv3.exe
archives.wnpvam .com/bvcb34d/983bv3.exe
This is saved as %TEMP%\fDe12.exe and currently has a VirusTotal detection rate of 4/55***. The VirusTotal report indicates traffic to the following IP:
198.61.187.234 (Rackspace, US). I recommend that you block traffic to this IP. Automated analysis is pending (check back later) but the payload is almost definitely the Dridex banking trojan..."
* https://www.virustotal.com/en/file/89642abbfd4e8cc382f155b1d1b27c1aa94ced34636c1c6d0f34de19914e1b29/analysis/1444298450/
** https://www.virustotal.com/en/file/c7e31528eb9b11bdb035d00095ed8b3ad3c4179c6960764a56ac8ff565ae7c86/analysis/1444298460/
*** https://www.virustotal.com/en/file/46d1a934e7335934236c903abbb6c82cb73ac9c2f13354edc3339b6357c71549/analysis/1444298587/
katastimataone .com: 209.139.209.187: https://www.virustotal.com/en/ip-address/209.139.209.187/information/
wnpvam .com: 38.96.175.221: https://www.virustotal.com/en/ip-address/38.96.175.221/information/
198.61.187.234: https://www.virustotal.com/en/ip-address/198.61.187.234/information/
___
Fake 'SwagBags Order' SPAM - doc malware
- http://myonlinesecurity.co.uk/swagbags-biz-new-order-confirmation-3535-word-doc-or-excel-xls-spreadsheet-malware/
8 Oct 2015 - "An email with the subject of 'New Order Confirmation: 3535' pretending to come from SwagBags .biz <customerservices@ swagbags .biz> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/New-Order-Confirmation-3535-SwagBags-1024x558.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content...
8 October 2015 : Invoice_3535.doc - Current Virus total detections 2/54*.
Both MALWR** and Payload security*** shows the download to be what looks like Dridex banking malware from http ://vsehochuti.unas .cz/bvcb34d/983bv3.exe (VirusTotal 1/56 [4])
Other download locations that I have been informed about are:
katastimataone .com/bvcb34d/983bv3.exe
swaineallen .uk/bvcb34d/983bv3.exe
archives.wnpvam .com/bvcb34d/983bv3.exe
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6cf70f0c0df1f9073326b5ae19726d68511f7938735069d4cd0c82f8ca31fe50/analysis/1444293293/
** https://malwr.com/analysis/YzJkMjBlNGY0NzM0NDUzOTllNzMyMzI3NThhOTlhOTY/
*** https://www.hybrid-analysis.com/sample/6cf70f0c0df1f9073326b5ae19726d68511f7938735069d4cd0c82f8ca31fe50?environmentId=1
4] https://www.virustotal.com/en/file/46d1a934e7335934236c903abbb6c82cb73ac9c2f13354edc3339b6357c71549/analysis/1444293943/
unas .cz: 88.86.117.145: https://www.virustotal.com/en/ip-address/88.86.117.145/information/
katastimataone .com: 209.139.209.187: https://www.virustotal.com/en/ip-address/209.139.209.187/information/
swaineallen .uk: 94.136.40.15: https://www.virustotal.com/en/ip-address/94.136.40.15/information/
wnpvam .com: 38.96.175.221: https://www.virustotal.com/en/ip-address/38.96.175.221/information/
___
Fake 'Deposit' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-deposit-payment-frederico.html
8 Oct 2015 - "This -fake- financial email does not comes from Frederico Kessler but is instead a simple -forgery- with a malicious attachment:
From Frederico Kessler [Frederico.Kessler@ Gamesys .co.uk]
Date Thu, 08 Oct 2015 04:14:23 -0700
Subject Deposit Payment
Hi,
Attached is receipt of transfer regarding the deposit increase for our new contract
to the Cherry Tree Cottage.
Let me know if its all sorted.
Frederico Kessler
Product Owner | Games Platform
[cid:9DCD81C9-9267-4802-AAE1-B3AF9887E131]
[gamesysign]
4th Floor, 10 Piccadilly
London, W1J 0DD
Email...
Attached is a malicious Excel document named Payments Deposit.xls which comes in -five- different versions... each containing a slightly modifed macro... which downloads a malicious executable from the following locations:
archives.wnpvam .com/bvcb34d/983bv3.exe
swaineallen .uk/bvcb34d/983bv3.exe
katastimataone .com/bvcb34d/983bv3.exe
vsehochuti.unas .cz/bvcb34d/983bv3.exe
dmedei.3x .ro/bvcb34d/983bv3.exe
These download locations have been in use for a couple of other spam runs.. [2] but now the payload has been altered and has a VirusTotal detection rate of 3/56*. That VirtusTotal report and this Hybrid Analysis report** show traffic to:
198.61.187.234 (Rackspace, US). I recommend that you block traffic to that IP."
* https://www.virustotal.com/en/file/8030e075bd21b43f759a7095f34773df6316a5c38ea2956e6acfa76d0e82bd84/analysis/1444305640/
... Behavioural information
TCP connections
198.61.187.234: https://www.virustotal.com/en/ip-address/198.61.187.234/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
** https://www.hybrid-analysis.com/sample/8030e075bd21b43f759a7095f34773df6316a5c38ea2956e6acfa76d0e82bd84?environmentId=6
2] http://blog.dynamoo.com/2015/10/malware-spam-receipt-from-norfolk-dance.html
wnpvam .com: 38.96.175.221: https://www.virustotal.com/en/ip-address/38.96.175.221/information/
swaineallen .uk: 94.136.40.15: https://www.virustotal.com/en/ip-address/94.136.40.15/information/
katastimataone .com: 209.139.209.187: https://www.virustotal.com/en/ip-address/209.139.209.187/information/
unas .cz: 88.86.117.145: https://www.virustotal.com/en/ip-address/88.86.117.145/information/
3x .ro: 89.42.39.160: https://www.virustotal.com/en/ip-address/89.42.39.160/information/
___
Fake 'eBay Invoice' SPAM - PDF malware
- http://myonlinesecurity.co.uk/your-ebay-invoice-is-ready-fake-pdf-malware/
8 Oct 2015 - "An email with the subject of 'Your eBay Invoice is Ready' pretending to come from eBay <ebay@ ebay .com> with a zip attachment is another one from the current bot runs... The content of the email which shouldn’t fool anybody because it has -no- eBay logos or links and is totally in plain text, which EBay -never- sends because they want to grab you and get you on the eBay site spending money, says :
PLEASE DO NOT RESPOND – Emails to this address are not monitored or responded to.
Dear Customer,
Please open the attached file to view invoice.
If the attachment is in PDF format you may need Adobe Acrobat Reader to read or download this attachment...
This email has been scanned by the Symantec Email Security.cloud service.
This email and any attachment are intended solely for the addressee, are strictly confidential and may be legally privileged. If you are not the intended recipient... Blah, blah, blah.
8 October 2015: ebay_4175127742232_081015.zip: Extracts to: ebay_4175127742232_081015.exe
Current Virus total detections 4/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/435dd0aa3913593544496d81ccab776e14c169263f277aeeb86ca699ef747643/analysis/1444304267/
___
Fake 'HMRC Online Service Complaints' SPAM – PDF malware
- http://myonlinesecurity.co.uk/online-service-complaints-submission-received-by-hm-revenue-and-customs-fake-pdf-malware/
8 Oct 2015 - "An email with the subject of 'Online Service Complaints – Submission received by HM Revenue and Customs' pretending to come from HMRC Complaints <helpdesk@ ir-efile .gov.uk> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Online-Service-Complaints-Submission-received-by-HM-Revenue-and-Customs-1024x556.png
8 October 2015: HMRC.Complaint.zip: Extracts to: HMRC.Complaint.scr
Current Virus total detections 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/345e1cf51b6e3ae7dbe60b50e803e494145c63affd104ae7a7cb62c2c33c6818/analysis/1444302682/
___
Fake 'eFax' .doc attachment - malware
- https://isc.sans.edu/diary.html?storyid=20225
Last Updated: 2015-10-08 - "... Below is a screenshot from the malspam example Wayne sent us. Links in the email -all- went to the appropriate eFax URLs. The attached Word document is the -only- malicious part of the message:
> https://isc.sans.edu/diaryimages/images/2015-10-08-ISC-diary-image-01a.jpg
... Looking at the email headers, you'll find the recipient's email server received the message from a Unified Layer IP address at 67.222.39.168... The Word document has macros. If macros are enabled, the document will try to drop malware and infect the Windows host:
> https://isc.sans.edu/diaryimages/images/2015-10-08-ISC-diary-image-03.jpg
Below are indicators of compromise (IOCs) for the malware associated with this malspam:
185.42.15.7 - babsuptono .ru - POST /gate.php
151.236.10.194 - toftereventhi .ru - POST /gate.php
93.171.158.226 - buteventheckand .ru - POST /gate.php
136.243.24.4 - germantest.redsnapper .net - GET /m.exe
... Attachment name: fax_message_326-816-3257.doc
First submission: 2015-10-06 14:28:27 UTC
Virus Total link* - Hybrid-Analysis link** ..."
* https://www.virustotal.com/en/file/9686caf5e37a676ce63054959dfe7ab3e09863f86fd13fb720dc2921621aa8a5/analysis/
** https://www.hybrid-analysis.com/sample/9686caf5e37a676ce63054959dfe7ab3e09863f86fd13fb720dc2921621aa8a5?environmentId=2
185.42.15.7: https://www.virustotal.com/en/ip-address/185.42.15.7/information/
151.236.10.194: https://www.virustotal.com/en/ip-address/151.236.10.194/information/
93.171.158.226: https://www.virustotal.com/en/ip-address/93.171.158.226/information/
136.243.24.4: https://www.virustotal.com/en/ip-address/136.243.24.4/information/
"... same signature": https://www.hybrid-analysis.com/search?query=signatureid%3Anetwork-1
:fear::fear: :mad:
AplusWebMaster
2015-10-09, 10:51
FYI...
Fake 'contract' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/contract-word-doc-or-excel-xls-spreadsheet-malware/
8 Oct 2015 - "An email with the subject of 'contract' pretending to come from random companies and email addresses with a zip file containing a malicious word doc attachment is another one from the current bot runs... The email looks like:
Dear customer,
I’m sending you a new contract of the project (Double ordinary certificate)
-Or-
Dear customer,
I’m sending you a new contract of the project (Information about updated summary)
The name in brackets in the body of the email matches the name of the zip attachment that contains the word doc which also has random names... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Excel_macro_protected-mode.png
8 October 2015: Double ordinary certificate.zip - Extracts to: Collect corporate business inventories.doc
Current Virus total detections 3/56* ... which doesn’t connect to a webserver but has the Upatre binary embedded inside the word doc inside a rtf file that gets extracted and run from %temp%\w13.exe (VirusTotal 3/57**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a70501f92f222723a0d6d836df0a22371175a68b5218334fdae20fb48db69d03/analysis/1444322597/
** https://www.virustotal.com/en/file/adcf5faaac14ec77c173beb22a34aa8f174049184196758f9623285de85af2e4/analysis/1444323758/
___
Fake 'GTA V for Mobile' sites lead to 'Surveys'
- https://blog.malwarebytes.org/online-security/2015/10/gta-v-for-mobile-sites-lead-to-surveys/
Oct 8, 2015 - "... GTA V used as -bait- in many cases... here's one which focuses on the allure of portability to reel in unsuspecting fans of the title. A number of sites are claiming to offer up mobile versions of the game, despite it requiring an Xbox 360 / Xbox One / PS3 / PS4 / decent gaming PC to run – not to mention the disk space taken up, which is a fair amount to say the least (you aren’t going to find many phones with -50GB- available just to be able to install a game). The sites in question are:
gta5forpsp(dot)com
androidgta5(dot)com
iosgta5(dot)com
Despite this, mobile gamers are being told they can run it on Android, iOS and PSP. The three sites we looked at all share similar designs, displaying what they claim to be GTA V running on the aforementioned devices and a download link:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/gtahandheld11.jpg
... they also use the well worn technique of saying “As seen on…” and listing numerous well known online publications (none of which appear to mention their mysterious version of GTA V)... the creators of the Grand Theft Auto titles, Rockstar Games, don’t mention a handheld version of GTA V anywhere either. It’s almost like it doesn’t exist. This is probably a good time to make a callback to that -50GB- game size, and then see how big one of the mobile downloads is:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/gtahandheld4.jpg
... If in doubt, check the official website of a game developer and discover straight from the source which platform your desired evening’s entertainment runs on. In the above case, there is -no- official version of GTA V for handhelds whatsoever..."
gta5forpsp(dot)com: 91.121.223.39: https://www.virustotal.com/en/ip-address/91.121.223.39/information/
androidgta5(dot)com: https://www.virustotal.com/en/url/025d79aed8df93ec300d6d3c8f08c8282323e8cc27dba4f2b52833cbe73653e1/analysis/
iosgta5(dot)com: https://www.virustotal.com/en/url/08361bab9668cd14a75caea107c271b4e26ecc1b2015c8c178f4928323623744/analysis/
:fear::fear: :mad:
AplusWebMaster
2015-10-09, 12:12
FYI...
Fake 'DHL invoice' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/your-latest-dhl-invoice-mse7396821-word-doc-or-excel-xls-spreadsheet-malware/
9 Oct 2015 - "An email that appears to come from DHL with the subject of 'Your latest DHL invoice : MSE7396821' pretending to come from e-billing.uk1@ dhl .com with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Your-latest-DHL-invoice-MSE7396821-1024x549.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...
9 October 2015 : MSE7396821.doc - Current Virus total detections 5/56*
Downloads a Dridex banking malware http ://roadmark .co.uk/fsf4fd32/8ik6sc.exe which is saved as %temp%\vtsabd.exe (VirusTotal 2/56**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9f2ed6c452fb3575495b9fdfc00caa51bdb9aa6d56af0014f0448ccda8a8c223/analysis/1444382592/
** https://www.virustotal.com/en/file/07be668d67a90794eb0e83302275adc8330ac20dea08d6a5e62965daf0d17374/analysis/1444382939/
... Behavioural information
TCP connections
86.105.33.102: https://www.virustotal.com/en/ip-address/86.105.33.102/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
roadmark .co.uk: 88.208.252.196: https://www.virustotal.com/en/ip-address/88.208.252.196/information/
- http://blog.dynamoo.com/2015/10/malware-spam-your-latest-dhl-invoice.html
9 Oct 2015 - "... In the only sample I have seen, the attached file is named MSE7396821.doc and has a VirusTotal detection rate of 5/55*. This contains a malicious macro... which downloads a file from the following location:
flexicall .co.uk/fsf4fd32/8ik6sc.exe
There will undoubtedly be different versions of the document with different download locations. This binary is saved as %TEMP%\vtsAbd.exe and has a VirusTotal detection rate of 2/54**. That VirusTotal report, this Malwr report[3] and this Hybrid Analysis report[4] show network traffic to:
86.105.33.102 (Data Net SRL, Romania)
I recommend that you block traffic to and from that IP address. The payload appears to be the Dridex banking trojan."
* https://www.virustotal.com/en/file/d34435cc5780f450438716372a57417a079dde909a2f72a81a67b46fcdfd6f8a/analysis/1444381402/
** https://www.virustotal.com/en/file/07be668d67a90794eb0e83302275adc8330ac20dea08d6a5e62965daf0d17374/analysis/1444381818/
... Behavioural information
TCP connections
86.105.33.102: https://www.virustotal.com/en/ip-address/86.105.33.102/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
3] https://malwr.com/analysis/NTMwN2Q3OWVkZmFkNDg0ZWI5NGMwNzViOGNmYzIzOWU/
4] https://www.hybrid-analysis.com/sample/d34435cc5780f450438716372a57417a079dde909a2f72a81a67b46fcdfd6f8a?environmentId=3
flexicall .co.uk: 109.228.12.96: https://www.virustotal.com/en/ip-address/109.228.12.96/information/
"... same signature": https://www.hybrid-analysis.com/sample/d34435cc5780f450438716372a57417a079dde909a2f72a81a67b46fcdfd6f8a?environmentId=3
:fear::fear: :mad:
AplusWebMaster
2015-10-12, 14:37
FYI...
Fake 'Insurance' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-insurance.html
12 Oct 2015 - "This spam does not come from No Letting Go but is instead a simple forgery with a malicious attachment.
From [accounts@ nolettinggo .co.uk]
Date Mon, 12 Oct 2015 11:43:16 +0330
Subject Insurance
Dear all
Please find attached insurance paperwork including EL certificate. Invoices
will follow at the beginning of November.
Regards
Karen
In the only sample I have seen so far, the attachment name is SKMBT_C36014102815580.doc which has a VirusTotal detection rate of 8/56*. This particular document contains this malicious macro... which downloads a malware component from the following location:
ukenterprisetours .com/877453tr/rebrb45t.exe
The usual pattern is that there are several different versions of the document downloading from different locations, but the payload is the same in all cases. This binary is saved as %TEMP%\gicage.exe and has a detection rate of 2/56**. That VirusTotal report and this Hybrid Analysis report[3] show network traffic to:
149.210.180.13 (TransIP BV, Netherlands)
I strongly recommend that you block or monitor traffic to this IP. The payload is the Dridex banking trojan..."
* https://www.virustotal.com/en/file/fc4bd160119744f41bfdb71d7bde347c12b3b1263528bfbc7f836bfd813007ef/analysis/1444637908/
** https://www.virustotal.com/en/file/0572ee84a21904e6ce63a8001c4549d48de57d54f666275ac69190bbb94446dc/analysis/1444638547/
... Behavioural information
TCP connections
149.210.180.13: https://www.virustotal.com/en/ip-address/149.210.180.13/information/
92.123.225.120: https://www.virustotal.com/en/ip-address/92.123.225.120/information/
3] https://www.hybrid-analysis.com/sample/fc4bd160119744f41bfdb71d7bde347c12b3b1263528bfbc7f836bfd813007ef?environmentId=3
ukenterprisetours .com: 46.20.120.64: https://www.virustotal.com/en/ip-address/46.20.120.64/information/
- http://myonlinesecurity.co.uk/nolettinggo-co-uk-insurance-word-doc-malware/
12 Oct 2015 - "An email that appears to come from nolettinggo .co.uk with the subject of 'Insurance' pretending to come from accounts@ nolettinggo .co.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/insurance-nolettinggo-1024x497.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
12 October 2015 : SKMBT_C36014102815580.doc - Current Virus total detections 7/55*
.. Downloads Dridex banking malware from http ://capricorn-cleaning .co.uk/877453tr/rebrb45t.exe
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/4287b74ab29ff490474af7c8e36f1419f492c2246c24403b44b76abae76f9efa/analysis/1444635759/
capricorn-cleaning .co.uk: 109.108.129.21: https://www.virustotal.com/en/ip-address/109.108.129.21/information/
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-water-services-invoice.html
12 Oct 2015 - "This -fake- financial email is not from United Utilities but is instead a simple forgery with a malicious attachment:
From "UUSCOTLAND" <UUSCOTLAND@ uuplc .co.uk>
Date Mon, 12 Oct 2015 17:12:12 +0530
Subject Water Services Invoice
Good Morning,
I hope you are well.
Please find attached the water services invoice summary for the billing period of
12 September 2015 to 12 October 2015.
If you would like any more help, or information, please contact me...
Kind regards
Melissa
Melissa Lears
Billing Specialist
Business Retail
United Utilities Scotland
T: 0345 0726077 (26816)...
The information contained in this e-mail is intended only for the individual to whom it is addressed. It may contain legally privileged or confidential information or otherwise be exempt from disclosure. If you have received this Message in error or there are any problems, please notify the sender immediately and delete the message from your computer. You must not use, disclose, copy or alter this message for any unauthorised purpose...
Attached to the email is a file 12 October 2015 Invoice Summary.doc which comes in at least -four- different versions (VirusTotal results: [1] [2] [3] [4]) which contain a macro... Download locations spotted so far are:
ukenterprisetours .com/877453tr/rebrb45t.exe
eventmobilecatering .co.uk/877453tr/rebrb45t.exe
thewimbledondentist .co.uk/877453tr/rebrb45t.exe
cardiffhairandbeauty .co.uk/877453tr/rebrb45t.exe
All those download locations are on UK sites, but there are three apparently unrelated IP addresses in use:
46.20.120.64: https://www.virustotal.com/en/ip-address/46.20.120.64/information/
109.108.129.21: https://www.virustotal.com/en/ip-address/109.108.129.21/information/
213.171.218.221: https://www.virustotal.com/en/ip-address/213.171.218.221/information/
This is saved as %TEMP%\gicage.exe and has a VirusTotal detection rate of just 1/56[5]...
149.210.180.13 (TransIP BV, Netherlands)
86.105.33.102 (Data Net SRL, Romania)
I would recommend blocking traffic to both those IPs. The payload is the Dridex banking trojan.
Recommended blocklist:
149.210.180.13: https://www.virustotal.com/en/ip-address/149.210.180.13/information/
86.105.33.102: https://www.virustotal.com/en/ip-address/86.105.33.102/information/
.
1] https://www.virustotal.com/en/file/da2cac6b46e2ca605dc8afa5d9c8a75e813c1c0d276c65b55bf16254fdcf4057/analysis/1444652575/
2] https://www.virustotal.com/en/file/b209b71606f294e241ed75105f11bf194360aadf8aa415aaa9138bb97abb22c7/analysis/1444652586/
3] https://www.virustotal.com/en/file/b0a43774c6e27788bd52503cbf2ba4388b7c0e159e46ad11aa140728f721b61e/analysis/1444652597/
4] https://www.virustotal.com/en/file/fc4bd160119744f41bfdb71d7bde347c12b3b1263528bfbc7f836bfd813007ef/analysis/1444652607/
5] https://www.virustotal.com/en/file/d389ae390f7301644fceec70eb63300c542b0522ba6ac1c278b0c160dd010802/analysis/1444652695/
- http://myonlinesecurity.co.uk/water-services-invoice-uuscotland-united-utilities-scotland-word-doc-malware/
12 Oct 10`5 - "An email that appears to come from United Utilities Scotland with the subject of 'Water Services Invoice' pretending to come from UUSCOTLAND <UUSCOTLAND@ uuplc .co.uk> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Water-Services-Invoice-1024x690.png
.. DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
...
12 October 2015: 12 October 2015 Invoice Summary.doc - Current Virus total detections 8/55*
... Downloads from the same locations as described in today’s earlier malspam run** of malicious word docs, but delivers an updated Dridex version (VirusTotal 1/56 ***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b209b71606f294e241ed75105f11bf194360aadf8aa415aaa9138bb97abb22c7/analysis/1444654116/
** http://myonlinesecurity.co.uk/nolettinggo-co-uk-insurance-word-doc-malware/
*** https://www.virustotal.com/en/file/d389ae390f7301644fceec70eb63300c542b0522ba6ac1c278b0c160dd010802/analysis/1444652695/
... Behavioural information
TCP connections
86.105.33.102: https://www.virustotal.com/en/ip-address/86.105.33.102/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'Invoice 1377' SPAM - PDF malware
- http://myonlinesecurity.co.uk/invoice-1377-peachsoftware-co-uk-fake-pdf-malware/
12 Oct 2015 - "An email with the subject of 'Invoice 1377' pretending to come from info@ peachsoftware .co.uk with a zip attachment is another one from the current bot runs... The content of the email says:
Please see invoice attached
12 October 2015: invoice-1377.zip: Extracts to: invoice-1377.exe
Current Virus total detections 4/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5596573bb9ac8a26a4d15b6918478439c89ac8a142c02f3bff9730fd7b9cf0ca/analysis/1444648227/
___
Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles
- http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/
7 Oct 2015 - "Summary: While tracking a suspected Iran-based threat group known as Threat Group-2889[1] (TG-2889), Dell SecureWorks Counter Threat Unit™ (CTU) researchers uncovered a network of fake LinkedIn profiles. These convincing profiles form a self-referenced network of seemingly established LinkedIn users. CTU researchers assess with high confidence the purpose of this network is to target potential victims through social engineering. Most of the legitimate LinkedIn accounts associated with the fake accounts belong to individuals in the Middle East, and CTU researchers assess with medium confidence that these individuals are likely targets of TG-2889.
Fake LinkedIn accounts: The 25 fake LinkedIn accounts identified by CTU researchers fall into two categories: fully developed personas (Leader) and supporting personas (Supporter). The table in the Appendix lists details associated with the accounts. The level of detail in the profiles suggests that the threat actors invested substantial time and effort into creating and maintaining these personas. The photos used in the fake accounts are likely of innocent individuals who have no connection to TG-2889 activity...
Legitimate endorsers of -fake- TG-2889 LinkedIn accounts by country:
> http://www.secureworks.com/assets/image_store/png/image007_500px.png
... Ongoing threat: Updates to profile content such as employment history suggest that TG-2889 regularly maintains these fake profiles. The persona changes and job alterations could suggest preparations for a new campaign, and the decision to reference Northrup Grumman and Airbus Group may indicate that the threat actors plan to target the aerospace vertical. It is likely that TG-2889 maintains personas that have not yet been identified, and that other threat groups also use this tactic. CTU researchers advise organizations to educate their users of the specific and general risks:
- Avoid contact with known fake personas.
- Only connect to personas belonging to individuals they know and trust.
- Adopt a position of sensible caution when engaging with members of colleagues' or friends' networks that they have not -verified- outside of LinkedIn.
When evaluating employment offers originating from LinkedIn, seek confirmation that the individual is legitimate by directly contacting the individual's purported employer. Organizations may want to consider policing abuse of their brand on LinkedIn and other social media sites..."
:fear::fear: :mad:
AplusWebMaster
2015-10-13, 14:31
FYI...
Fake 'Customer Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/quickhostuk-customer-invoice-word-doc-malware/
13 Oct 2015 - "An email appearing to come from 'QuickHostUK' with the subject of 'Customer Invoice' pretending to come from QuickHostUK <info@ quickhostuk .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear customer,
This is a notice that an invoice has been generated on 11/10/2015.
Your payment method is: Credit/Debit Card
Invoice #302673
Amount Due: £40.00GBP
Due Date: 18/10/2015
Invoice Items
Fully Managed Hosting – Starter (18/10/2015 – 17/11/2015) £40.00GBP
Sub Total: £40.00GBP
Credit: £0.00GBP
Total: £40.00GBP
Payment will be taken automatically on 18/10/2015 from your credit card on record with us. To update or change the credit card details we hold for your account please login...
13 October 2015: Invoice-302673.doc - Current Virus total detections 5/56*
... Which downloads Dridex banking malware from http ://thelureofnoma .com/~web/34fc34t45t/8ijfew.exe (VirusTotal 1/53**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e11453a59492d91a0925f7e28ca711d3695813beccee7a081898420f9b627774/analysis/1444732952/
** https://www.virustotal.com/en/file/9f937b9f15be07f35bf109477f6a57e675f22429a0ebeecd4bdaee002330f7b6/analysis/1444733145/
thelureofnoma .com: 69.72.240.66: https://www.virustotal.com/en/ip-address/69.72.240.66/information/
___
Fake 'Bank - Third Party Payment' SPAM – PDF malware
- http://myonlinesecurity.co.uk/commonwealth-bank-of-australia-first-netbank-third-party-payment-fake-pdf-malware/
13 Oct 2015 - "An email appearing to come from 'Commonwealth Bank of Australia' with the subject of 'First NetBank Third Party Payment' pretending to come from NetBankNotification@ cba .com.au with a zip attachment is another one from the current bot runs... The content of the email says :
First NetBank Third Party Payment
Your first transfer to the following third party account(s) has been successfully processed:
From Account: **** **** **** 6439 MasterCard
To Account(s): Bonnie Sharpe 511-187 ***7654 AMEX $6,990.72 Assistance to Refugees
Date: 13/10/2015
Please check attached file for more information about this transaction.
Yours sincerely,
Commonwealth Bank of Australia
Please do not reply. To confirm this is a genuine email sent by the Bank, please check your inbox on the NetBank home page.
Message: 932750168
13 October 2015: CBA Third Party Payment 932750168.zip: Extracts to: CBA Third Party Payment 949078743.scr
Current Virus total detections 10/57*... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/0bbb0cf30454687ae422e301eb707ac3e7c791acf87ddfe3fdadc2545b0740f8/analysis/1444709718/
:fear::fear: :mad:
AplusWebMaster
2015-10-14, 13:47
FYI...
Flash 0-Day used in Pawn Storm...
>> http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/
Oct 14, 2015 - "... the attackers behind Pawn Storm are using a new Adobe Flash zero-day exploit in their latest campaign. Pawn Storm is a long-running cyber-espionage campaign known for its high-profile targets and usage of the first Java zero-day we’ve seen in the last couple of years... Based on our analysis, the Flash zero-day affects at least Adobe Flash Player versions 19.0.0.185 and 19.0.0.207... We have notified Adobe about our discovery and are working with them to address this security concern. Updates to this entry will be made once more information is available."
'Just released 10.13.2015 .'Suggest Flash be -disabled- immediately until a new fix/release from Adobe is available...
* 'Suggest Java be disabled, too. Next scheduled release of Java update due 10.20.2015.
- https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/10/13/patch-tuesday-october-2015
Oct 13, 2015 - "... Oracle will have their CPU later this month, on the 20th..."
___
Fake 'DocuSign' SPAM – PDF malware
- http://myonlinesecurity.co.uk/docusign-completed-optus-agreement-no-jtjw-650508-fake-pdf-malware/
14 Oct 2015 - "An email with the subject of 'Completed: Optus agreement no JTJW-650508' pretending to come from thiaminenz570@ cintas .com; on behalf of; 'DocuSign via DocuSign <dse_eu1@ docusign .net>' with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Completed-Optus-agreement_docusign-1024x780.png
14 October 2015: Optus agreement no JTJW-650508.zip: Extracts to: Optus agreement no LPRH-300726.scr
Current Virus total detections 6/56*... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/20ecca005e18a7c4c7f5ca2696edf98d22df9c73cacd0601c6263d064dac36b2/analysis/1444797213/
___
Fake 'SMSF Gateway Svc Msg' SPAM – PDF malware
- http://myonlinesecurity.co.uk/australia-post-smsf-gateway-service-message-fake-pdf-malware/
14 Oct 2015 - "An email with the subject of 'Australia Post SMSF Gateway Service Message' pretending to come from SMSF Gateway Team <SMSFGateway-NO-REPLY@ smsfmsg .auspost .com.au> with a zip attachment is another one from the current bot runs... The content of the email says:
We’re pleased to advise you that the Australia Post SMSF Gateway Service has received a superannuation contribution message.
The details of this message are in the attached PDF.
The contribution payment should appear in your nominated bank account with a payment reference number listed in the PDF to allow for easy reconciliation.
Kind Regards
The SMSF Gateway Team ...
14 October 2015: Contribution448772241.zip: Extracts to: Contribution308911799.scr
Current Virus total detections 4/56*... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/7220b1e202086914c187e9437b0e5f5d5bec7b1b7b53bfc5d8c7e0f6d4ec272f/analysis/1444789129/
___
FBI, Security Vendors Partner for DRIDEX Takedown
- http://blog.trendmicro.com/trendlabs-security-intelligence/us-law-enforcement-takedown-dridex-botnet/
Oct 13, 2015 - "Multiple command-and-control (C&C) servers used by the DRIDEX botnet have been taken down by the Federal Bureau of Investigation (FBI), following the action taken by the National Crime Agency (NCA) in the UK. US law enforcement officials obtained court orders that resulted in the seizure of multiple servers used by DRIDEX. This crippled the malware’s C&C network, which is used by the malware to send the stolen information to the cybercriminals and to download configuration files that include the list of targeted banks. Furthermore, charges have been made against Andrey Ghinkul, aka Andrei Ghincul and Smilex, the Moldovan administrator of the botnet. Taking down cybercriminals is no small feat. Tracking down and shutting down cybercrime operations requires the constant collaboration of researchers and law enforcement agencies, each providing their own expertise. The takedown of the command-and-control (C&C) network used by the banking malware DRIDEX is the latest example of that partnership’s success... DRIDEX has slowly been making a name for itself this past year and has been viewed as the successor to the Gameover Zeus (GoZ) malware. Its prevalence in the threat landscape can be attributed to its business model, P2P (peer-to-peer) architecture, and unique routines. Unlike other malware, DRIDEX operates using the BaaS (Botnet-as-a Service) business model. It runs several bot networks, each identified by a number and each containing a specific set of target banks. Our investigation revealed that its target banks mostly come from the US and Europe (particularly Romania, France, and the UK)... users in the US and the UK accounted for more than 35% of DRIDEX infections:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/10/dridex.jpg
The P2P architecture of DRIDEX was built as an improved version of GoZ’s architecture. Learning from the GoZ takedown, creators of DRIDEX added a another layer in its architecture before the command-and-control (C&C) server. Apart from these, DRIDEX is also equipped to remove or hide tracks in the system. Similar to the Chthonic variant of ZBOT, it uses an invisible persistence technique which involves writing autostart reg key upon system shutdown and deleting autostart reg key upon system startup. However, only DRIDEX cleans up the stored configuration in the registry and changes the malware copy location. DRIDEX is easily spread using malicious email attachments, usually Microsoft Office documents that contain macros. The use of macros could be seen as one way of ensuring a higher chance of successful attacks. Macros are commonly used in automated and interactive documents. The feature is usually deactivated by default, but if it was already enabled prior to the attack, the attack commences without any additional requirements. Otherwise, the attack must use a strong social engineering lure in order to convince the user to enable the feature. Furthermore, we found that the macro code contains garbage and useless code... While the takedown of the C&C servers now prevents DRIDEX from executing malicious activities, total cleanup still requires users to ensure that DRIDEX has been removed from their systems..."
>>> http://www.justice.gov/usao-wdpa/pr/bugat-botnet-administrator-arrested-and-malware-disabled
Oct 13, 2015 - "... Victims of Bugat/Dridex may use the following webpage created by US-CERT for assistance in removing the malware:
> https://www.us-cert.gov/dridex ..."
Oct 13, 2015
:fear::fear: :mad:
AplusWebMaster
2015-10-15, 14:15
FYI...
Fake 'Scan' SPAM - doc malware
- http://myonlinesecurity.co.uk/ray-white-scan-2015-10-14-52954-p-m-word-doc-malware/
15 Oct 2015 - "An email with the subject of '[Scan] 2015-10-14 5:29:54 p.m.' pretending to come from 'Ray White <rw@raylian .co.uk>' with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Scan-2015-10-14-52954-pm-1024x357.png
15 October 2015: 2015-10-14 5-29-54 p.m..doc . Current Virus total detections 4/54*
... Which downloads Dridex banking malware from http ://23.229.157.230/~gwhill2377/86575765/6757645.exe (VirusTotal 0/53**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/dc7754256622945c6574a806e5c35d59cad40e111d66fd0495bbeedd6213130b/analysis/1444898925/
** https://www.virustotal.com/en/file/2587300cc5c250b1c79e664363d1ca81d61e7e063b90212ab222753f8c0f6e04/analysis/1444899628/
... Behavioural information
TCP connections
89.32.145.12: https://www.virustotal.com/en/ip-address/89.32.145.12/information/
88.221.14.138: https://www.virustotal.com/en/ip-address/88.221.14.138/information/
23.229.157.230: https://www.virustotal.com/en/ip-address/23.229.157.230/information/
> https://www.virustotal.com/en/url/d4ece27daccce8915be08ce4590464732ba0e5a907b791b894dc0a78621fd790/analysis/
- http://blog.dynamoo.com/2015/10/malware-spam-scan-2015-10-14-52954-pm.html
15 Oct 2015 - "This rather terse spam email has a malicious attachment. It does not come from Raylian but is instead a simple forgery:
From Ray White [rw@ raylian .co.uk]
Date Thu, 15 Oct 2015 10:56:35 +0200
Subject [Scan] 2015-10-14 5:29:54 p.m.
Amanda's attached.
In the only sample I saw, the attachment was named 2015-10-14 5-29-54 p.m..doc which has a VirusTotal detection rate of 4/56 and which contains this malicious macro... The Hybrid Analysis report* shows this particular version (there will be others) downloading a binary from:
sdhstribrnalhota .xf .cz/86575765/6757645.exe
Despite the apparently random name, this is a real business website (SDH Stříbrná Lhota) that has been compromised. This binary has a detection rate of just 2/56** and is saved as %TEMP%\CrowSoft1.exe. The Hybrid Analysis report*** for this indicates connections to:
89.32.145.12 (Elvsoft SRL, Romania / Coreix, UK)
195.154.251.123 (Online SAS / Iliad Entreprises / Poney Telecom, France)
The payload appears to be the Dridex banking trojan, still going strong despite reports of arrests in the crime gang responsible.
Recommended blocklist:
89.32.145.12
195.154.251.123
* https://www.hybrid-analysis.com/sample/5f211cfd6cd1b01dda2d29ab143b5bc7f32425945630b63c3b93f60c1d1ce857?environmentId=1
** https://www.virustotal.com/en/file/2587300cc5c250b1c79e664363d1ca81d61e7e063b90212ab222753f8c0f6e04/analysis/1444903993/
... Behavioural information
TCP connections
89.32.145.12: https://www.virustotal.com/en/ip-address/89.32.145.12/information/
88.221.14.138: https://www.virustotal.com/en/ip-address/88.221.14.138/information/
*** https://www.hybrid-analysis.com/sample/2587300cc5c250b1c79e664363d1ca81d61e7e063b90212ab222753f8c0f6e04?environmentId=1
:fear::fear: :mad:
AplusWebMaster
2015-10-16, 12:06
FYI...
Fake 'DHL' SPAM - PDF malware
- http://myonlinesecurity.co.uk/dhl-australia-return-consignment-startrack-express-fake-pdf-malware/
16 Oct 2015 - "An email that appears to come from 'DHL Australia' with the subject of 'Return consignment AVD524417' pretending to come from DSC.AU.Returns@ dhl .com with a zip attachment is another one from the current bot runs... The content of the email says :
BOOKING OF YOUR CONTROLLED RETURN
Print off labels (on a LASER printer as this will ensure driver can scan barcode) and affix to carton.
Please ensure all other labels are removed from carton.
You can book your own freight by calling our Carrier Partner Startrack Express on 12 18 58 quoting Reference No. 524417
Alternatively, DHL will call within 3 business days after labels are sent to assist in booking in your freight for collection.
Quote the consignment Number that is on your labels (attached to your email with prefix AVD)
Startrack Express will provide you with a booking number, please retain this number.
Below is a mandatory TRANSFER SUMMARY. This must be completed prior to the arrival of driver; if not complete, this may result in a futile pick up.
Goods are required back into warehouse no later than 7 working days. Please ensure good are ready for collection.
STARTRACK EXPRESS TRANSFER SUMMARY REPORT ...
16 October 2015: FL-AVD524417.zip: Extracts to: FL-AVD084542.exe
Current Virus total detections 5/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/af52fc56d9f65203ebb425af6120440552b4853d32941b07d9b47332f6ee6917/analysis/1444969428/
___
Backdoor Zegost delivered via Hacking Team exploit
- http://research.zscaler.com/2015/10/chinese-backdoor-zegost-delivered-via.html
Oct 16, 2015 - "... In past two months, we've spotted multiple instances of Zegost Backdoor Trojan installation attempts leveraging Hacking Team's Adobe Flash exploit (CVE-2015-5119) payload. These attacks do not appear to be targeted, but the payload involved in the infection cycle has some resemblance to recent APT payloads from HttpBrowser & the PlugX RAT family. Attack Chain: The infection cycle starts with a legitimate Chinese real estate and shopping site www[.]kongquechang[.]com, which appears to have been compromised by the attackers and contains an injected script. The injected script will cause a series of -redirects- leading to Hacking Team's exploit payload... Attackers are abusing the Chinese URL shortening service t .cn to -redirect- victims to the attack server and also Baidu's URL shortening service dwz .cn to deliver the Adobe Flash exploit payload... Below is the complete list of C&Cs it tries to connect.
80.247.233.18: https://www.virustotal.com/en/ip-address/80.247.233.18/information/
91.121.82.113: https://www.virustotal.com/en/ip-address/91.121.82.113/information/
69.164.213.85: https://www.virustotal.com/en/ip-address/69.164.213.85/information/
79.143.191.147: https://www.virustotal.com/en/ip-address/79.143.191.147/information/
199.241.30.233: https://www.virustotal.com/en/ip-address/199.241.30.233/information/
162.243.12.14: https://www.virustotal.com/en/ip-address/162.243.12.14/information/
188.93.73.90: https://www.virustotal.com/en/ip-address/188.93.73.90/information/
195.154.184.240: https://www.virustotal.com/en/ip-address/195.154.184.240/information/
Conclusion: The use of a legitimate certificate in signing malware executables to evade security detection is not new but is still very effective. The malware author aims to exploit the Code-Signing Certificate based whitelisting approach by signing their samples..."
(More detail at the zscaler URL at the top.)
kongquechang[.]com: Could not find an IP address for this domain name.
:fear::fear: :mad:
AplusWebMaster
2015-10-19, 12:54
FYI...
Fake 'Invoice / PO' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-cos007202-stephanie.html
19 Oct 2015 - "This -fake- financial spam does not come from Bombardier Transportation but is instead a simple -forgery- with a malicious attachment:
From "Stephanie Greaves" [sgreaves@ btros .co.uk]
Date Mon, 19 Oct 2015 12:06:42 +0430
Subject COS007202
Good morning,
Please see attached purchase order.
Kind regards,
Stephanie Greaves
Administration Apprentice
Bombardier Transportation (Rolling Stock) UK Ltd
Electronics, Cabling, & Interior Division
Litchurch Lane, Derby, DE24 8AD
Attached is a file COS007202.doc which comes in at least three different versions (VT results [1] [2] [3]) each containing a slightly different malicious macro... Analysis of the documents is pending, but they will almost definitely drop the Dridex banking trojan...
UPDATE: According to these Hybrid Analysis reports [4] [5] [6] , those macros download from the following locations:
euroagroec .com/35436/5324676645.exe
demo9.iphonebackstage .com/35436/5324676645.exe
webmatique .info/35436/5324676645.exe
The binary they download has a VirusTotal detection rate of 3/56[7] and is saved as %TEMP%\CrowSoft1.exe. Both the VirusTotal and Hybrid Analysis reports show what looks like malicious traffic going to:
157.252.245.49 (Trinity College Hartford, US)
I recommend that you -block- traffic to that IP..."
1] https://www.virustotal.com/en/file/357807e192b591045f47e75eb8bf90ffd836334896975cead383459fabf05cf7/analysis/1445246850/
2] https://www.virustotal.com/en/file/44805663bb4a9593cef0aa693f363dbd60ccf4ce50fe04ed9ce6e96f1ff57212/analysis/1445246860/
3] https://www.virustotal.com/en/file/843fa344144221549eb5f11619601a5af465debf701d5ca8c65c0de997f1d3e5/analysis/1445246874/
4] https://www.hybrid-analysis.com/sample/357807e192b591045f47e75eb8bf90ffd836334896975cead383459fabf05cf7?environmentId=3
5] https://www.hybrid-analysis.com/sample/44805663bb4a9593cef0aa693f363dbd60ccf4ce50fe04ed9ce6e96f1ff57212?environmentId=3
6] https://www.hybrid-analysis.com/sample/843fa344144221549eb5f11619601a5af465debf701d5ca8c65c0de997f1d3e5?environmentId=1
7] https://www.virustotal.com/en/file/a640ebf7551d4f7cc6c4e910aea7434b3ebc6b2a08b4763d93165af20a8bb571/analysis/1445249638/
___
Fake 'Online banking app form' SPAM - PDF malware
- http://myonlinesecurity.co.uk/online-banking-application-form-crm-fake-pdf-malware/
19 Oct 2015 - "An email appearing to come from Nat West Leicester Business Banking Customer Support with the subject of 'Online banking application form********* CRM:013545192' (random numbers) pretending to come from 'NW – Leicester CRT <Leicester.CMT@ NatWest .com> with a zip attachment is another one from the current bot runs... The content of the email says:
Please find enclosed the requested online application form which
you will need to complete and return to myself via the post.
Kind Regards
Janine Lyles
Relationship Manager’s Assistant
Leicester Business Banking Customer Support
1st Floor
1 Granby Street
Leicester
LE1 6EJ
Tel: 0116 2752435
Fax: 0116 2575469
E Mail ...
19 October 2015: Online banking upd appl form.zip: Extracts to: Online banking upd appl form.scr
Current Virus total detections 3/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d46d08b4ee94c57efa56f55fdf995a88b64b3bd63a077577b5888fc750743d33/analysis/1445250902/
:fear::fear: :mad:
AplusWebMaster
2015-10-20, 12:23
FYI...
Fake 'P.O.' SPAM - PDF malware
- http://myonlinesecurity.co.uk/purchaseorder-dr67cv_30hj-from-xstrata-by-emerson-vicky-prod-fake-pdf-malware/
20 Oct 2015 - "An email appearing to come from Xstrata with the subject of 'PurchaseOrder DR67CV_30HJ' from 'Xstrata' by 'Emerson, Vicky (PROD)' pretending to come from XstrataQLD@ axis.ventyx .com with a zip attachment is another one from the current bot runs... The content of the email says :
Please find attached a PurchaserOder from Xstarta for your action. It has been sent via Mincom Axis.
This PurhcaseOrder is in PDF format and can be viewed with Adobe Acrobat Reader. You may ACCEPT or REJECT this PurchaseOrdre from this email by following the isntructions below. In either case, an email will be generated for you to send to the Buyer via Mincom Axis. Type in any notes or comments you wish to convey to the buyer in the email Body and send the email but do not modify any part of the email Subject.
To ACCEPT the whole PucrhaseOrder, click the following link and complete your details ...
20 October 2015: PurchaseOrder_9EP31W_52M1_707850624.zip: Extracts to: PurchaseOrder_816785634_036545298.exe
Current Virus total detections 6/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a8b8640efb893458b808f00bdad7d0f2a0e013df2dfa330f9fbd2ef225372e56/analysis/1445314610/
___
Fake 'P.O.' SPAM - doc malware
- http://blog.dynamoo.com/2015/10/malware-spam-purchase-order-no-48847.html
20 Oct 2015 - "This -fake- financial spam comes with a malicious payload:
From Harminder Saund [MinSaund77@ secureone .co.uk]
Date Tue, 20 Oct 2015 16:08:53 +0700
Subject Purchase Order No: 48847
Attached is a copy of our Purchase Order number 48847
Harminder Saund
Secure One
The sender's email address varies slightly, for example:
MinSaund77@ secureone .co.uk
MinSaund92@ secureone .co.uk
MinSaund94@ secureone .co.uk
MinSaund013@ secureone .co.uk
Attached is a file PO_48847.DOC which I have seen two different versions of so far (VirusTotal [1] [2]) each containing a slightly different malicious macro... There are probably different versions of the document with different macros. Automated analysis is pending, however the payload is most likely the Dridex Shifu banking trojan. Please check back for updates..."
1] https://www.virustotal.com/en/file/9f598aa8751d9a7b5a6afe1d6e1e930d92c2131bd2f7c1839ba94307934b1e91/analysis/1445335728/
2] https://www.virustotal.com/en/file/a8e2788f371decce59d5cf7f02b7cf187406ae277e370fea112b58a437a55577/analysis/1445335747/
UPDATE: So far, three download locations have been identified..
ladiesfirst-privileges .com/656465/d5678h9.exe
papousek.kvalitne .cz/656465/d5678h9.exe
pmspotter. wz.cz/656465/d5678h9.exe
This file is downloaded as %TEMP%\shhg32c.exe and it has a VirusTotal detection rate of 4/56*... The Hybrid Analysis reports [1] [2] indicate that it calls home to:
fat.uk-fags .top / 188.166.250.20 (Digital Ocean, Singapore)
I recommend that you -block- traffic to that IP."
* https://www.virustotal.com/en/file/b1cffc6091e5dc9a15ca81787e986abdbf90b42125c39798f44d7ff9d7b740e8/analysis/1445341067/
1] https://www.hybrid-analysis.com/sample/9f598aa8751d9a7b5a6afe1d6e1e930d92c2131bd2f7c1839ba94307934b1e91?environmentId=3
2] https://www.hybrid-analysis.com/sample/a8e2788f371decce59d5cf7f02b7cf187406ae277e370fea112b58a437a55577?environmentId=3
___
Fake 'NOTIFICATION' SPAM - xls malware
- http://blog.dynamoo.com/2015/10/malware-spam-gomez-sanchezpostmailbella.html
20 Oct 2015 - "This spam comes with a malicious attachment:
From "GOMEZ SANCHEZ"[postmail@ bellair .net]
To
Date Tue, 20 Oct 2015 13:14:56 +0430
Subject victim@ victimdomain .tld
Congratulations
Print out the attachment file fill it and return it back by fax or email
Yours Sincerely
GOMEZ SANCHEZ
The "Subject" is the victim's own email address. Attached is a file FINAL NOTIFICATION.xls which comes (so far) in three different variants (VirusTotal [1] [2] [3]) contains one of -three- malicious macros... Analysis of the payload is pending, but is likely to be the Dridex Shifu banking trojan. Please check back later..."
1] https://www.virustotal.com/en/file/c9602e7c64ea66b4a90f9ad6ccabcbba4243dd04cbb87554a056e97239900258/analysis/1445335252/
FINAL NOTIFICATION .xls - 4/56
2] https://www.virustotal.com/en/file/80ded7a1e98b524e7b4a123a741892a40b862d3f05d949ae88f401e94c4b1a6a/analysis/1445335267/
FINAL NOTIFICATION-2 .xls - 4/54
3] https://www.virustotal.com/en/file/7f5fa44008064ca6cf59cf165770e4db8a7764bd14cf92586b8ecb65de756756/analysis/1445335281/
FINAL NOTIFICATION-3 .xls - 4/56
UPDATE: So far, three download locations have been identified..
ladiesfirst-privileges .com/656465/d5678h9.exe
papousek.kvalitne .cz/656465/d5678h9.exe
pmspotter.wz. cz/656465/d5678h9.exe
This file is downloaded as %TEMP%\shhg32c.exe and it has a VirusTotal detection rate of 4/56*... The Hybrid Analysis reports [1] [2] indicate that it calls home to:
fat.uk-fags .top / 188.166.250.20 (Digital Ocean, Singapore)
I recommend that you block traffic to that IP."
* https://www.virustotal.com/en/file/b1cffc6091e5dc9a15ca81787e986abdbf90b42125c39798f44d7ff9d7b740e8/analysis/1445341067/
1] https://www.hybrid-analysis.com/sample/c9602e7c64ea66b4a90f9ad6ccabcbba4243dd04cbb87554a056e97239900258?environmentId=3
2] https://www.hybrid-analysis.com/sample/7f5fa44008064ca6cf59cf165770e4db8a7764bd14cf92586b8ecb65de756756?environmentId=3
ladiesfirst-privileges .com: 159.253.148.199: https://www.virustotal.com/en/ip-address/159.253.148.199/information/
papousek.kvalitne .cz: 88.86.117.145: https://www.virustotal.com/en/ip-address/88.86.117.145/information/
pmspotter.wz. cz: 88.86.117.153: https://www.virustotal.com/en/ip-address/88.86.117.153/information/
Shifu banking trojan: http://news.softpedia.com/news/shifu-banking-trojan-comes-with-its-own-antivirus-to-keep-other-malware-at-bay-490580.shtml
:fear::fear: :mad:
AplusWebMaster
2015-10-21, 13:02
FYI...
Fake 'E-Toll' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-e-toll-account-statement-fake-pdf-malware/
21 Oct 2015 - "An email with the subject of 'Your E-Toll account statement' pretending to come from RMSETollDontReply@ rms.nsw. gov.au with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Valued Customer,
Please find attached your E-Toll account statement.
If you would like to claim Cashback please:
Simply login to your account and click on the ‘Claim Cashback’ link on the Account Overview screen. Follow the easy steps and submit your claim online. Please note: Online claims can only be completed on E-Toll accounts with online access.
Mail the E-Toll transaction statements that list your toll usage for eligible trips and a completed Cashback rebate form to the following address: Roads and Maritime Services M5 Cashback Locked Bag 3 Dubbo NSW 2830
Rebates must be claimed within 12 calendar months of the end of the Cashback quarter.
Thank you for choosing E-Toll
Regards
The E-Toll Team Roads and Maritime Services
To view documents in PDF format, you must have Adobe Acrobat PDF reader software version 5 or above installed on your computer.
This email was sent to you by Roads and Maritime Services. This is an unmonitored email address so please do not reply to this email...
21 October 2015: Oct 2015ST.zip: Extracts to: Oct 2015ST.exe
Current Virus total detections 3/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e5342f1cd9a70222854eb8f5e1ed6cfec4b57389ad85a9ce070fb464d428687a/analysis/1445398880/
___
Fake 'Delayed tax return' SPAM - PDF malware
- http://myonlinesecurity.co.uk/australian-taxation-office-delayed-tax-returns-over-30-days-fake-pdf-malware/
21 Oct 2015 - "An email that appears to come from Australian Taxation Office with the subject of 'Delayed tax returns over 30 days' pretending to come from DelayedReturn <DelayedReturn@ ato. gov.au> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Delayed-tax-returns-over-30-days-1024x769.png
21 October 2015: TaxAgentReport516177320151020230248.zip: Extracts to: TaxAgentReport061836020151020223957.exe
Current Virus total detections 5/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/42a4eaa76aba21927a3f3480b656c71dad7ed1f309429b9b090c415dd0d51f64/analysis/1445398912/
___
Fake 'INVOICE' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-invoice-for-payment_21.html
21 Oct 2015 - "This -fake- financial spam is not from Lancashire Police but is a simple -forgery- with what appears to be a malicious attachment.
From: Whitehead, Lyn [Lyn.Whitehead@ lancashire.pnn.police .uk]
Date: 21 October 2015 at 10:15
Subject: INVOICE FOR PAYMENT - 7500005791
Hello
Please find attached an invoice that is now due for payment.
Regards
Lyn
Lyn Whitehead (10688)
Business Support Department - Headquarters
Email: Lyn.Whitehead@ lancashire.pnn.police .uk ...
The attachment appears contain some sort of malicious OLE object rather than a macro, but so far I have not been able to analyse it. Furthermore, this document does not seem to open properly in other applications, so I suspect that it contains an unknown exploit. Analysis is still pending. The VirusTotal report shows a detection rate of zero. The Malwr report is inconclusive. Other analysis is pending please check back.
UPDATE 1: Another version of this is in circulation, also with zero detections at VirusTotal... The Hybrid Analysis for both samples in inconclusive...
UPDATE 2: An analysis of the documents shows an HTTP request to:
ip1.dynupdate.no-ip .com:8245
All this returns is the IP address of the computer opening the document. Although not malicious in itself, you might want to look out for it as an indicator of compromise...
UPDATE 4: The Hybrid Analysis reports for the documents can be found here [1] [2] [3] show that the macros... in the document download a binary from the following locations:
www .sfagan.co .uk/56475865/ih76dfr.exe
www .cnukprint .com/56475865/ih76dfr.exe
www .tokushu. co.uk/56475865/ih76dfr.exe
www .gkc-erp .com/56475865/ih76dfr.exe
At present this has a zero detection rate at VirusTotal*... Those reports in addition to this Malwr report[4] indicate malicious traffic to the following IPs:
89.32.145.12 (Elvsoft SRL, Romania / Coreix Ltd, UK)
119.47.112.227 (Web Drive Ltd, New Zealand)
195.154.251.123 (Online SAS / Iliad Entreprises / Poney Telecom, France)
157.252.245.49 (Trinity College Hartford, US)
The payload is probably the Shifu banking trojan.
Recommended blocklist:
89.32.145.12
119.47.112.227
195.154.251.123
157.252.245.49 "
1] https://www.hybrid-analysis.com/sample/9a202c2fa7e5eae2e586e2db61ce3dc9d267ce334e81d699db3307d79d3e77a5?environmentId=1
2] https://www.hybrid-analysis.com/sample/aa7a05241105fd2da8e3b8c170baf7cee7a267230a1d462ff8f4a55784a89469?environmentId=1
3] https://www.hybrid-analysis.com/sample/9372b5d6122903a95daa5bcc4c1a51eb98c41d838e83d17296013e6d00b2b621?environmentId=1
4] https://malwr.com/analysis/NjE3YmRhOWE4NzFjNGM2M2JkZDI2NTRkZDE2ZTk1ZDM/
* https://www.virustotal.com/en/file/375ebf45b6ca6b13290efad5f4df6cdaec09e39620c2b64e31e355b3f848c19a/analysis/1445428911/
... Behavioural information
TCP connections
119.47.112.227: https://www.virustotal.com/en/ip-address/119.47.112.227/information/
8.254.218.14: https://www.virustotal.com/en/ip-address/8.254.218.14/information/
195.154.251.123: https://www.virustotal.com/en/ip-address/195.154.251.123/information/
___
Fake 'PNC' SPAM - PDF malware
- http://myonlinesecurity.co.uk/your-pnc-bank-online-statement-is-ready-to-be-viewed-fake-pdf-malware/
21 Oct 2015 - "An email with the subject of 'Your PNC Bank Online Statement is ready to be viewed' pretending to come from PNCBank_Statements@ pnc .com with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Your-PNC-Bank-Online-Statement-is-ready-to-be-viewed-1024x550.png
21 October 2015: Statement_7208_10212015.zip: Extracts to: Statement_3374_10212015.zip.scr
Current Virus total detections 5/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/f628d09d91227bf46c503a44f33a1d887a5314fc656cd1ac41c31e7d4c633cf2/analysis/1445449142/
___
Chrome -clone- 'eFast' serves ads, collects info
- http://net-security.org/malware_news.php?id=3129
21.10.2015 - "A Google Chrome lookalike browser dubbed 'eFast' is being actively pushed onto users. The software is at best annoying and unwanted, and at worst can lead users to malware. Posing as a legitimate application that will benefit users, eFast is actually only helpful to its creators - it sidelines other browsers, generates intrusive online ads (the creators are paid for each click), redirects users to potentially malicious pages, and monitors their Internet browsing activity, which is then sold to third party companies. "eFast Browser is mostly proliferated as a 'bundle' with other (mostly free) software," PC Risk's Tomas Meskauskas warns*. "Users do not expect bundled applications to be concealed, and thus, developers intentionally hide them within the 'Custom' or 'Advanced' settings. Users who rush the download/installation processes and skip this section often inadvertently install potentially unwanted programs. In doing so, they expose their systems to risk of infection and compromise their privacy"... During installation, eFast will attempt to -replace- Chrome if that is already installed, by deleting all the shortcuts to it on your taskbar and desktop. "To make sure that you will use your new browser, eFast makes itself the default browser and takes over some file-associations. File-associations are settings that determine which program will run when files with a certain extension are opened," Malwarebytes' Pieter Arntz explains**..."
* https://www.pcrisk.com/removal-guides/9480-ads-by-efast-browser
eFast Browser removal instructions
** https://blog.malwarebytes.org/online-security/2015/10/efast-browser-hijacks-file-associations/
:fear::fear: :mad:
AplusWebMaster
2015-10-22, 12:58
FYI...
Fake 'Invoice Summary.doc' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-water-services-invoice_22.html
22 Oct 2015 - "This -fake- invoice does not comes from United Utilities Scotland, but is instead a simple forgery with a malicious attachment...
From "UUSCOTLAND" [UUSCOTLAND@ uuplc. co.uk]
Date Thu, 22 Oct 2015 19:30:13 +0700
Subject Water Services Invoice
Good Morning,
I hope you are well.
Please find attached the water services invoice summary for the billing period of
22 September 2015 to 22 October 2015.
If you would like any more help, or information, please contact me on 0345 0726077.
Our office is open between 9.00am and 5.00pm Monday to Friday. I will be happy to
help you. Alternatively you can email me at uuscotland@uuplc.co.uk.
Kind regards
Melissa
Melissa Lears
Billing Specialist
Business Retail
United Utilities Scotland ...
So far I have seen -three different- versions of the attachment, all named 22 October 2015 Invoice Summary.doc with detection rates of about between 4/55 and 7/55 at VirusTotal [1] [2] [3] containing... malicious macros... Analysis of the documents is pending, but one key indicator is that the file appears to be saved as %TEMP%\bluezone3.exe. Check back later for updates."
1] https://www.virustotal.com/en/file/f8013369d58fbaaf15ebd320ce18510705b9462bfa0d0cf71892311d376b9cf5/analysis/1445520172/
2] https://www.virustotal.com/en/file/ab229e22f51cac1cc62c676f44839f12e75f7ca70b86c92f036c979172730a21/analysis/1445520186/
3] https://www.virustotal.com/en/file/3f3baaefba7dfdb7b54727e03d60c2de365c1b426885f1e9f79ad7f895d67793/analysis/1445520199/
UPDATE 1: This VirusTotal report* also identifies the following download locations:
beauty.maplewindows .co.uk/t67t868/nibrd65.exe
dtmscomputers .co.uk/t67t868/nibrd65.exe
namastetravel .co.uk/t67t868/nibrd65.exe
This file has a VirusTotal detection rate of 2/54** and that report indicates network traffic to: 198.74.58.153 (Linode, US)
Further analysis is pending, in the meantime I suggest that you -block- traffic to the above IP."
* https://www.virustotal.com/en/file/ab229e22f51cac1cc62c676f44839f12e75f7ca70b86c92f036c979172730a21/analysis/1445520186/
** https://www.virustotal.com/en/file/5fa54fea81f3a840f314a6923e98347f06a88c02082346392aa38186847dd033/analysis/1445521267/
198.74.58.153: https://www.virustotal.com/en/ip-address/198.74.58.153/information/
___
Fake Java "pop-ups for Download"
- https://blog.malwarebytes.org/online-security/2015/10/this-isnt-the-java-i-ordered/
Oct 22, 2015 - "... The downloaded file is called setup.exe and is recognized by a few scanners* that detect this file as potentially unwanted adware. (PUP.Optional.Media)... It installs a program called Media Downloader version 1.5:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/warning4w.png
The other one I want to show you is not actually a pop-up, but a background image that was made to look like one:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/site1w.png
Clicking this “Install” button downloads and prompts you to install a bundler that does install Java version 1.8.25 but not until they have offered the other components of the bundle. In this case I had to “Decline” Norton360, Weatherbug, PC Mechanic and Stormfall Age of War. Note that the latest version for my system is Version 8 Update 65. Version 8u25 is over a year old. Paying attention to the UAC prompt could have saved us some work here. Super IS (Fried Cookie Ltd.) somehow doesn’t have that official ring to it to convince me that this is the Java installer I was promised:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/UACpromptw.png
Probably triggered by the critical patch update that was released by Oracle there are some sites that use this opportunity to lure users into using Java prompt -lookalikes- or bundled installers (for outdated versions). As always, get your software from trusted sources..."
* https://www.virustotal.com/nl/file/5e04690a37361abb0556f4fa50881d3ea1bb9766253d8deb2453c6a282ab02a9/analysis/
___
Email account credentials - PHISH
- http://myonlinesecurity.co.uk/email-account-credentials-phishing/
22 Oct 2015 - "I came across this slightly different email -phishing- attempt this morning... The original email is quite bland, but just enticing enough to persuade a user to click and fill in the forms...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/weebly_phishing_email-1024x338.png
If you did follow the link, you would see a webpage looking like this:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/weebly_phishing_fillfree-1024x565.png
This site is hosted on a free hosting company weebly .com. Unfortunately these free hosts have minimal checks and it is easy to put up almost anything that can infect a user or act as a phishing site. Weebly does eventually respond to abuse reports but in my experience they are quite slow and take a long time to think about whether the site contravenes their T&Cs. Do -not- fill in the forms otherwise your email account will be compromised. You -never- need to give your email account password to anybody."
___
Apple Invoice - Phish
- https://blog.malwarebytes.org/fraud-scam/2015/10/steer-clear-of-this-apple-invoice-phish/
Oct 22, 2015 - "... a blatant attempt to swipe your payment information. Couched in the well-worn guise of a supposed Apple Store refund, the mail wants potential victims to hand over their Apple ID / password and then a chunk of personal / payment details:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/applephis01.jpg
... Of course, you probably did not authorise any sort of purchase for a “CoPilot Premium HD” which is exactly the “Oh no my money, I must retrieve it” reaction they’re banking on (unless you actually did buy one of these, in which case things might get a little confusing). Nothing will have people rushing to click buttons and hand over information faster than the possibility of someone making unauthorised payments – clicking the refund links will take them to a -fake- login, via a -redirect- on a potentially compromised t-shirt website. The phish pages themselves are located at
aut0carhire(dot)com/index/user12-appleid/index(dot)html
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/applephish1.jpg
After handing over Apple ID credentials, the victim is taken to the next step which involves them giving name, address, DOB and full payment information:
> https://blog.malwarebytes.org/wp-content/uploads/2015/10/applephish2.jpg
... Unfortunately, hitting the “Cancel Transaction” button here would be pretty much the exact opposite of cancelling a transaction and victims could expect to see many more actual payments suddenly leaving their bank account. If you have this sitting in your mailbox, delete it. If you’ve already sent the scammers your details, notify your bank and cancel the card – while keeping an eye out for any dubious payments. Apple themed phish scams are a popular choice for criminals, and whether faced with iTunes logins, “Find my phone” fakeouts, iCloud shenanigans or payment receipts such as the one above, recipients should be wary and – if in doubt – head to -official- Apple pages* to find out if a payment really is being processed."
* http://www.apple.com/shop/account/home
aut0carhire(dot)com: 97.74.181.128: https://www.virustotal.com/nl/ip-address/97.74.181.128/information/
>> https://www.virustotal.com/nl/url/6ac6c4879678706c9672cd88e1ee4a6a5f725086915baaa08db3094f72d0f05e/analysis/
:fear::fear: :mad:
AplusWebMaster
2015-10-23, 13:57
FYI...
Fake 'cleaning invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-cleaning-invoice-deborah.html
23 Oct 2015 - "This -fake- financial spam comes with a malicious attachment:
From "deborah Sherer" [thesherers@ westnet .co.uk]
Date Fri, 23 Oct 2015 17:03:19 +0700
Subject cleaning invoice
Hello
attached is invoice for payment
thanks
Deborah Sherer
---
This email has been checked for viruses ...
Attached is a file Cleaning022958.doc which comes in three different versions (VirusTotal results [1] [2] [3]) containing a macro... and downloads a malicious binary from one of the following locations:
www .bhtfriends .org/tydfyyur54/43e67tko.exe
zomb.webzdarma .cz/tydfyyur54/43e67tko.exe
nisanyapi .com/tydfyyur54/43e67tko.exe
This is saved as %TEMP%\lenderb2.exe and has a VirusTotal detection rate of just 1/55* (that's just a generic detection by Kaspersky). That VirusTotal report plus this Hybrid Analysis report** show network traffic to:
195.154.251.123 (Online SAS / Iliad Entreprises / Poney Telecom, France)
Private sources also identify these following IPs as part of the C2 infrastructure:
157.252.245.49 (Trinity College Hartford, US)
198.74.58.153 (Linode, US)
68.168.100.232 (Codero, US)
The payload appears to be the Dridex banking trojan.
Recommended blocklist:
195.154.251.123
157.252.245.49
198.74.58.153
68.168.100.232 "
1] https://www.virustotal.com/en/file/4554fd639d5fe714dd65894af6fe5f96805f5da26bd0a8437ddb7d8e5c93df7b/analysis/1445595890/
2] https://www.virustotal.com/en/file/d8259073a5f3f0019bd5047fcb5149c0450ff8a6743f3e415db491389edc5344/analysis/1445595902/
3] https://www.virustotal.com/en/file/2e2afd4f2eab5514eff15e62ccd1d1610a137419caa15eca8383417843ba716f/analysis/1445595912/
* https://www.virustotal.com/en/file/a7fad7fc6421ba714f8b0dab8bc00adec860fb4059713ae68ec018f65ab174d0/analysis/1445595923/
** https://www.hybrid-analysis.com/sample/a7fad7fc6421ba714f8b0dab8bc00adec860fb4059713ae68ec018f65ab174d0?environmentId=1
___
Fake 'Credit Note' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-credit-note-cn-06536-from.html
23 Oct 2015 - "This -fake- financial spam has a malicious attachment:
From: Accounts [message-service@ post.xero .com]
Date: 23 October 2015 at 15:08
Subject: Credit Note CN-06536 from Trump Hotels & Casino Resorts Inc. for [redacted] (2752)
Hi Mattie,
Attached is your credit note CN-06536 for 8954.41 GBP.
This has been allocated against invoice number
If you have any questions, please let us know.
Thanks,
Avnet, Inc.
The message is neither from Avnet, Xero or Trump Hotels, but is a simple forgery. Attached is a file Credit Note CN-06536.doc .. but it's actually a -ZIP- file rather than a DOC file. Whoops. Renaming the .DOC to .ZIP creates a valid archive, and the executable inside is named Credit Note CN-83607.exe and has a VirusTotal detection rate of 4/55*. VT identifies this as Upatre which implies that the payload is the Dyre banking trojan... the current version of Update/Dyre phones home to 197.149.90.166 (Cobranet, Nigeria) which I strongly recommend you block.
UPDATE: The Hybrid Analysis report is here**, reporting the Nigerian IP and also showing that the malware saves itself as:
%TEMP%\homebast.exe
C:\Windows\mLunoMqU.exe "
* https://www.virustotal.com/nl/file/9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761/analysis/1445609013/
** https://www.hybrid-analysis.com/sample/9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761?environmentId=1
197.149.90.166: https://www.virustotal.com/nl/ip-address/197.149.90.166/information/
___
Fake 'Scan Data' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-docucentre-v-c6675-t2-scan.html
23 Oct 2015 - "This -fake- document scan appears to originate from within the victim's own organisation, but doesn't. Instead it comes with a malicious attachment.
From: DocuCentre-V C6675 T2 [reception@ victimdomain .com]
Reply-to: reception@ victimdomain .com
Date: 23 October 2015 at 09:23
Subject: Scan Data from FX-D6DBE1
Number of Images: 1
Attachment File Type: DOC
Device Name: DocuCentre-V C6675 T2
Device Location:
Attached is a file 22102015160213-0001.doc which comes in a few different versions. The payload is Dridex and all the files and downloaded binaries are the same as used in this spam run*."
* http://blog.dynamoo.com/2015/10/malware-spam-cleaning-invoice-deborah.html
___
Fake 'Receipt for Payment' SPAM - PDF malware
- http://myonlinesecurity.co.uk/thank-you-for-filing-your-taxes-with-freetaxusa-receipt-for-payment-fake-pdf-malware/
23 Oct 2015 - "An email saying 'Thank you for filing your taxes with FreeTaxUSA' with the subject of 'Receipt for Payment' pretending to come from random companies and email addresses with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Receipt-for-Payment-1024x939.png
23 October 2015: unjammed black fly.zip: Extracts to: 9842548_2377731824.exe
Current Virus total detections 2/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/nl/file/cae02b6c3da2922c6ee9dff95a589bfdd877c8aa231caf959c091d8ac95aa527/analysis/1445596923/
___
Western Union Business Solutions Spam
- http://threattrack.tumblr.com/post/131744694803/western-union-business-solutions-spam
Oct 23, 2015 - "Subjects Seen:
Order 49746970 Booked - Western Union Business Solutions Online FX for Corporate
Typical e-mail details:
Please be advised that Order 49746970 totaling 70,494.00 USD has been booked on Oct 23 2015.
Click on the attached file to view details of the order or to print a receipt.
This email was sent by Western Union Business Solutions. We respect your right to privacy.
Thank you for using Western Union Business Solutions.
Sincerely,
Western Union Business Solutions
Malicious File Name and MD5:
westernunion_order_receipt.exe (E4510056BB38A37EE7AE485AA6C4B36A)
Screenshot: https://40.media.tumblr.com/356fe0f2e0891dc75b6dceac7dd39ac8/tumblr_inline_nwobc8fpqk1r6pupn_500.png
Tagged: Western Union, Upatre
___
Paypal - PHISH... again.
- http://myonlinesecurity.co.uk/paypal-your-account-access-is-limited-phishing/
23 Oct 2015 - "... There are a few major common subjects in a phishing attempt involving either PayPal or your Bank or Credit Card, with a message saying some thing like:
There have been unauthorised or suspicious attempts to log in to your account, please verify
Your Account Access Is Limited
Your account has exceeded its limit and needs to be verified
Your account will be suspended !
You have received a secure message from < your bank>
We are unable to verify your account information
Update Personal Information
Urgent Account Review Notification
We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
Confirmation of Order
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Paypal-Your-Account-Access-Is-Limited-1024x780.png
... the links to the -phishing- website are behind the 'update your info' button or the 'update now' link... The eventual site is the highlighted part of the very long url which goes via googleadservices. Now many phishers have been using google search links to persuade a recipient to click-a-link. Hovering over the link in an email will show google which most people would think was safe... The only way is look at the address bar and in the -Genuine- PayPal site, when using Internet Explorer the entire address bar is in green. (in Chrome or Firefox, only the padlock symbol on the left of the browser is green)...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/reactivepay_paypal_phish.png
This one wants your personal details, your Paypal account log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details..."
___
Fake 'Notice to Appear' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-notice-to-appear.html
22 Oct 2015 - "This -fake- legal spam comes with a malicious attachment:
From: District Court
Date: 22 October 2015 at 19:03
Subject: Notice to Appear
Notice to Appear,
This is to inform you to appear in the Court on the October 27 for your case hearing.
Please, prepare all the documents relating to the case and bring them to Court on the specified date.
Note: The case may be heard by the judge in your absence if you do not come.
You can review complete details of the Court Notice in the attachment.
Sincerely,
Michael Newell,
District Clerk
Attached is a file Notice_to_Appear_00800614.zip which in turn contains a malicious script Notice_to_Appear_00800614.doc.js... This obfuscated script translates into something a bit more understandable which clearly references the following domains:
www .flowarrior .com
www .abama .org
littlefacesofpanama-association .com
The Hybrid Analysis report* shows that it downloads a file as %TEMP%\5883173.exe which has a VirusTotal detection rate of 5/55** (possibly Cridex). It references the following IPs as being highly suspect:
91.121.108.77 (OVH, France)
78.24.220.229 (TheFirst-RU, Russia)
A -large- number of IPs are queried... I have not had the chance to check those individual IP addresses, but I recommend that you -block- the following two at least:
91.121.108.77
78.24.220.229 "
* https://www.hybrid-analysis.com/sample/8df4e7a63c257fa95dd3cde83a3db033b3fe33d5429ecb2a1e7e6470103c898f?environmentId=1
** https://www.virustotal.com/nl/file/daf4d96a121c9e4935082d4e0264088ff352f14d868f8720d8fa7e4f99c82f05/analysis/1445547994/
> https://www.virustotal.com/nl/url/37eaf1a92d41215d876adb1dcb784e18acbeb95cf9caa6f02cffc8a785c51464/analysis/
___
G DATA Malware Report H1 2015
- https://www.gdata-software.com/g-data/newsroom/news/article/g-data-releases-malware-report-for-the-first-half-of-2015
Oct 22, 2015 - "... G DATA, is releasing their H1 2015 Malware Report, which looks at malware over the first half of 2015. Among the findings, researchers discovered a 64.8 percent spike of new malware strains as compared to the first half of 2014. This averages out to 12 new strains per minute. In all, the total number of malware strains this year is expected to be well above the level of 2014, with the U.S., China and France hosting the most malicious and fraudulent websites. In looking more closely at the banking industry, researchers found that Wells Fargo was the most frequently targeted financial services company by banking Trojans, and the Swatbanker family was the mostly frequently seen banking Trojan in the 6 month period, followed by the ZeuS family... websites related to the healthcare industry were most frequently classified as malicious (26.6 percent), with technology and telecom a distant second. The most commonly seen malware campaign was “Money Rain,” promising various ways to easily acquire money. While this campaign was seen on websites for all of the categories researched, 37 percent of the websites that were clearly connected to Money Rain were in the healthcare industry. Also of note, a new category, personal ads and dating, was revealed to be in the top 10 list of most prevalent malicious and fraudulent websites.
> https://static.gdatasoftware.com/110/_processed_/diagram_website_categories_H1_2015_v1_EN_HL_lowres_48890w417.jpg
Additional Key Findings Include:
• The "Top 10" list of prevented malware attacks is dominated by adware and Potentially Unwanted Programs (PUP). Dealply and Graftor are the most prevalent families in this field.
• Ukraine is new to the Top 10 list of countries most frequently found to be hosting malicious websites with 5% of the activity, putting the country in fourth place. This could potentially be due to the political havoc occurring in this region.
• Exploits for vulnerabilities are now being integrated into exploit kits after just a few days. Users who do not keep their systems up-to-date will easily fall victim to cyber criminals.
• The vulnerabilities in Adobe Flash were most frequently abused to silently and automatically attack and compromise PCs (Exploit)..."
PDF - Full report: https://public.gdatasoftware.com/Presse/Publikationen/Malware_Reports/G_DATA_PCMWR_H1_2015_EN.pdf
> https://static.gdatasoftware.com/110/_processed_/diagram_malware_count_H1_2015_v1_EN_HL_lowres_48866w800.jpg
:fear::fear: :mad:
AplusWebMaster
2015-10-26, 13:52
FYI...
Fake 'Tax Invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/mbie-companies-office-tax-invoice-fake-pdf-malware/
26 Oct 2015 - "An email with the subject of 'MBIE Companies Office Tax Invoice' pretending to come from revenue@ med.govt .nz with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/MBIE-Companies-Office-Tax-Invoice-1024x557.png
26 October 2015: Notification20151026_MCX79GF[_var=nSYMBOL]-54.zip: Extracts to: Notification20151026-AUNK7401f-26.exe
Current Virus total detections 0/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/771ab3b09f03b3d1dff6fd1c73a86602352b29decd3009b1bfae9197ea7b017b/analysis/1445819602/
___
Fake 'Sales Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-nc-242455-zmj-your-norwich.html
26 Oct 2015 - "This -fake- financial spam does not come from Norwich Camping but is instead a simple -forgery- with a malicious attachment:
From "Norwich Camping" [sales@ norwichcamping .co.uk]
Date Mon, 26 Oct 2015 13:43:14 +0430
Subject #NC-242455-Zmj Your Norwich Camping Order has shipped!
You Norwich Camping & Leisure order "#NC-242455-Zmj" has now been shipped. Your chosen
payment method has now been charged.
Kind regards,
The Norwich Camping & Leisure
Attached is a file invoice-2425.doc of which I have only seen a single sample so far with a VirusTotal detection rate of 5/55*. The document contains this malicious macro... which apparently downloads a malicious binary to %TEMP%\|ZipCock32.exe ... it is most likely that it downloads the Dridex banking trojan.
UPDATE: According to this Hybrid Analysis report** version of the malicious document downloads an executable from:
img1.buyersbestfriend. com/76r56e87y8/65df78.exe
This has a VirusTotal detection rate of 5/55***. That report indicates malicious traffic to:
195.154.251.123 (Online SAS / Iliad Entreprises / Poney Telecom, France)
I recommend that you block traffic to that IP."
* https://www.virustotal.com/en/file/e66201d2899796e2bedfffedd2f70aa58afa06af546d92fa41e2604a284d3af7/analysis/1445854612/
** https://www.hybrid-analysis.com/sample/e66201d2899796e2bedfffedd2f70aa58afa06af546d92fa41e2604a284d3af7?environmentId=2
*** https://www.virustotal.com/en/file/231c6f348604eaf77747a1fdf83fab8431d1976f19e87c8eb1f22169be1a64cf/analysis/1445857776/
... Behavioural information
TCP connections
195.154.251.123: https://www.virustotal.com/en/ip-address/195.154.251.123/information/
88.221.14.130: https://www.virustotal.com/en/ip-address/88.221.14.130/information/
___
Fake 'PHS docs' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-your-new-phs-documents-are.html
26 Oct 2015 - "This spam does not come from PHSOnline, but is instead a simple -forgery- with a malicious attachment.
From "PHSOnline" [documents@ phsonline .co.uk]
Date Mon, 26 Oct 2015 20:28:50 +0700
Subject Your new PHS documents are attached
I don't have a copy of the body text for these messages, but the attachment is named G-A0287580036267754265.doc which comes in -three- different versions... containing a macro... which downloads a malicious binary from one of the following locations:
tranquilosurf .com/~info/76r56e87y8/65df78.exe
masaze-rumburk .cz/76r56e87y8/65df78.exe
img1.buyersbestfriend .com/76r56e87y8/65df78.exe
The Hybrid Analysis reports those those documents are here: [1] [2] [3]. The file is saved as %TEMP%\ZipCock32.exe and this has VirusTotal detection rate of just 1/55[4]. The Hybrid Analysis report for this binary[5] shows it downloading from the following location:
195.154.251.123 (Online SAS / Iliad Entreprises / Poney Telecom, France)
This is almost definitely the Dridex banking trojan. Note that the documents and download locations appear to be the -same- as the one use in this earlier attack*, but the payload has now changed."
* http://blog.dynamoo.com/2015/10/malware-spam-nc-242455-zmj-your-norwich.html
1] https://www.hybrid-analysis.com/sample/11d137631d43b731e633ebf8dfecbd41bd5ca16f93be48678789a3fd275f3d50?environmentId=1
2] https://www.hybrid-analysis.com/sample/8448dce775043e0fe09bf0dadaf7c7dabf901c129c503ef7f2668e4e2b6766aa?environmentId=2
3] https://www.hybrid-analysis.com/sample/e66201d2899796e2bedfffedd2f70aa58afa06af546d92fa41e2604a284d3af7?environmentId=2
4] https://www.virustotal.com/en/file/abf627bab3a442891ec12aa583c68ed70b6258e52b7d86ff0b36e3275fe99879/analysis/1445868517/
5] https://www.hybrid-analysis.com/sample/abf627bab3a442891ec12aa583c68ed70b6258e52b7d86ff0b36e3275fe99879?environmentId=1
___
Despite takedown, the Dridex botnet is running again
- http://www.computerworld.com/article/2997513/security/despite-takedown-the-dridex-botnet-is-running-again.html
Oct 26, 2015 - " Spam emails containing the Dridex malware are being seen almost daily despite the arrest of one of its key operators in August. The finding confirms that while law enforcement can claim temporary victories in fighting cybercriminal networks, it's sometimes difficult to completely shut down their operations... Dridex, also referred to as Cridex or Bugat, is advanced malware that collects financial login details and other personal information that can be used to drain bank accounts. The U.S. and U.K. said the Dridex botnet - or the collection of computers infected with the malware - had been disrupted following their operations. Two weeks before the DOJ's announcement, Palo Alto Networks wrote* that it noticed a drop in Dridex activity but that it resumed again around the start of October. Much of that activity has now resumed, wrote Brad Duncan, a security researcher with Rackspace, on the Internet Storm Center blog**... there appear to be more files labeled as Dridex on VirusTotal... Although some of the samples be could mislabeled, it backs up what Palo Alto noticed..."
* http://researchcenter.paloaltonetworks.com/2015/10/dridex-is-back-and-targeting-the-uk/
Oct 1, 2015
** https://isc.sans.edu/diary/Botnets+spreading+Dridex+still+active/20295
Last Updated: 2015-10-24
- http://www.secureworks.com/cyber-threat-intelligence/threats/dridex-bugat-v5-botnet-takeover-operation/
13 Oct 2015 - "... The malware... steals credentials, certificates, cookies, and other sensitive information from a compromised system, primarily to commit Automated Clearing House (ACH) and wire fraud. As of this publication, authorities have linked the botnet to an estimated £20 million (approximately $30.5 million) in losses in the UK, and at least $10 million in losses in the United States. Dridex was created from the source code of the Bugat banking trojan (also known as Cridex) but is distinct from previous Bugat variants, particularly with respect to its modular architecture and its use of a hybrid peer-to-peer (P2P) network to mask its backend infrastructure and complicate takedown attempts..."
:fear::fear: :mad:
AplusWebMaster
2015-10-27, 12:45
FYI...
Fake 'Payslip' SPAM – PDF malware
- http://myonlinesecurity.co.uk/datacom-pay-systems-payslip-for-period-ending-27oct2015-fake-pdf-malware/
27 Oct 2015 - "An email with the subject of 'Payslip for period ending 27/Oct/2015' pretending to come from Datacom Pay Systems <powerpay@ datacom .co.nz> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/datacom-Payslip-for-period-ending-1024x677.png
27 October 2015: Payslip 27Oct2015.zip: Extracts to: Payslip 27Oct2015.scr
Current Virus total detections 12/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2f15063ec9de09b5f11c6603d3414d9bd288563800c8daa7ae88975cc88e357d/analysis/1445921468/
- http://threattrack.tumblr.com/post/132013797878/datacom-payslip-spam
27 Oct 2015 - "Subjects Seen
Payslip for period ending 27/Oct/2015
Typical e-mail details:
Dear Customer,
Attached is your payslip for period ending 27/Oct/2015.
Please note the attached payslip is password protected - the password is the same as your employee self service login password.The content of this email and its attachments are confidential. If you are not the intended recipient of this message please contact Datacom on 0800 856 856 or +64 9 366 1150.This email message has been sent from an unmanned account. Please do not reply to this address...
Screenshot: https://41.media.tumblr.com/73f75ce999ef5347d35f14b398f1f88c/tumblr_inline_nwvp5bRrXw1r6pupn_500.png
Malicious File Name and MD5:
payslip (1CE90078C006CFEE77248E8EDFD68BD2)
Tagged: Datacom, Upatre
___
Fake 'BACS Remittance' SPAM - PDF malware
- http://myonlinesecurity.co.uk/cyngor-sir-ddinbych-taliad-bacs-denbighshire-cc-bacs-remittance-fake-pdf-malware/
27 Oct 2015 - "An email with the subject of 'Cyngor Sir Ddinbych – Taliad BACS / Denbighshire CC – BACS Remittance' pretending to come from credbills@ denbighshire .gov.uk > <credbills@ denbighshire .gov.uk> with a zip attachment is another one from the current bot runs... The content of the email says :
Gweler manylion taliad BACS yn atodedig
Please see attached Bacs Remittance ...
The information contained in this e-mail message and any files transmitted with it is intended solely for the use of the individual or entity to whom they are addressed. If you have received this e-mail in error please notify the sender immediately. The contents of this e-mail represents the views of the individual(s) named above and do not necessarily represent the views of Denbighshire County Council. However, as a Public Body, Denbighshire County Council may be required to disclose this e-mail [or any response to it] under legislative provisions...
27 October 2015: DenbighshireCC.zip: Extracts to: DenbighshireCC.zip
Current Virus total detections 0/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1dda68b78e84caf63bb32cae2dc1bd82111e49db85d127a36cb715e2e4ef3b16/analysis/1445942099/
New_Cardholder_Application_scr
- http://blog.dynamoo.com/2015/10/malware-spam-cyngor-sir-ddinbych-taliad.html
27 Oct 2015 - "I've never had malware spam in Welsh before.. this is not from Denbighsire County Council, but is instead a simple -forgery- with a malicious attachment:
From "credbills@ denbighshire .gov.uk" [credbills@ denbighshire .gov.uk]
Date Tue, 27 Oct 2015 17:46:01 +0530
Subject Cyngor Sir Ddinbych - Taliad BACS / Denbighshire CC - BACS Remittance
Gweler manylion taliad BACS yn atodedig
Please see attached Bacs Remittance ...
Mae'r wybodaeth a gynhwysir yn yr e-bost hwn ac unrhyw ffeiliau a drosglwyddir gydag
o wedi eu bwriadu yn unig ar gyfer pwy bynnag y cyfeirir ef ato neu atynt. Os ydych
wedi derbyn yr e-bost hwn drwy gamgymeriad, hysbyswch yr anfonwr ar unwaith os gwelwch
yn dda...
Attached is a file DenbighshireCC.zip which contains a malicious executable DenbighshireCC.scr. This has a VirusTotal detection rate of 5/55*. The Hybrid Analysis report** shows characterstics common to the Upatre/Dyre banking trojan. In particular it identifies traffic to a know bad IP:
197.149.90.166 (Cobranet, Nigeria)
I strongly recommend that you -block- traffic to that IP."
* https://www.virustotal.com/en/file/1dda68b78e84caf63bb32cae2dc1bd82111e49db85d127a36cb715e2e4ef3b16/analysis/1445953248/
** https://www.hybrid-analysis.com/sample/1dda68b78e84caf63bb32cae2dc1bd82111e49db85d127a36cb715e2e4ef3b16?environmentId=2
___
Fake 'VeriFone' SPAM – PDF malware
- http://myonlinesecurity.co.uk/verifone-services-uk-and-ireland-ltd-fake-pdf-malware/
27 Oct 2015 - "An email with the subject of 'VeriFone Services UK and Ireland Ltd' pretending to come from donotreply_invoices@ verifone .com with a zip attachment is another one from the current bot runs... The content of the email says :
Please see attached Invoice(s).
Thanks and Regards,
VeriFone Services UK and Ireland Ltd
Confidentiality Note: This email message contains information that is confidential. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution or copying of this message is prohibited. If you have received this message or attachment in error, please notify us immediately by email and delete the original. Thank you.
While we use standard virus checking software, we accept no responsibility for viruses or anything similar in this email or any attachments. We also do not accept any responsibility for any changes to, or interception of, this email or any attachment after it leaves our information system. This electronic message, including attachments, is intended only for the use of the individual or company named above or to which it is addressed. The information contained in this message shall be considered confidential and proprietary...
27 October 2015: 20151027104526.zip: Extracts to: 20151027104526.scr
Current Virus total detections 0/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1dda68b78e84caf63bb32cae2dc1bd82111e49db85d127a36cb715e2e4ef3b16/analysis/1445943801/
___
Fake 'RBS' SPAM – PDF malware
- http://myonlinesecurity.co.uk/sunderland-city-council-hester-knapp-rbs-cardholder-application-form-fake-pdf-malware/
27 Oct 2015 - "An email appearing to come from Sunderland City Council with the subject of 'RBS Cardholder Application Form' pretending to come from Hester Knapp <Hester.Knapp@ sunderland .gov.uk> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/RBS-Cardholder-Application-Form-Sunderland-City-Council-1024x540.png
27 October 2015: New_Cardholder_Application_Hester_Knapp.zip: Extracts to: New_Cardholder_Application_Hester_Knapp.scr
Current Virus total detections 0/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1dda68b78e84caf63bb32cae2dc1bd82111e49db85d127a36cb715e2e4ef3b16/analysis/1445943801/
- http://blog.dynamoo.com/2015/10/malware-spam-rbs-cardholder-application.html
27 Oct 2015 - "This -fake- financial spam does not come from Sunderland City Council, but is instead a simple -forgery- with a malicious attachment:
From "Wm Palmer" [Wm.Palmer@ sunderland .gov.uk]
Date Tue, 27 Oct 2015 18:39:34 +0700
Subject RBS Cardholder Application Form
Dear Customer,
We now have the go ahead from Corporate Procurement to apply to RBS for your Corporate
Purchase Card. Please find attached the RBS application form which requires your
signature as cardholder on page 2. Also please add the date. Once done can you scan
the document and email it back to me or alternatively post it back to me c/o Purchase
Card Administration Team, Transactional Finance, Room 1.34, Civic Centre, Sunderland
SR2 7DN.
Kind regards,
Wm.
Wm Palmer
Purchase Ordering Officer ...
Attached is a file New_Cardholder_Application_Wm_Palmer.zip containing a malicious executable New_Cardholder_Application.scr - which is exactly the -same- malware as used in this other fake council spam run today*."
* http://blog.dynamoo.com/2015/10/malware-spam-cyngor-sir-ddinbych-taliad.html
:fear::fear: :mad:
AplusWebMaster
2015-10-28, 13:27
FYI...
Attackers are turning -MySQL- servers into DDoS bots
- http://net-security.org/malware_news.php?id=3134
28.10.2015 - "Someone has been compromising MySQL servers around the world and using them to mount DDoS attacks. The latest targets of these attacks are an (unnamed) US hosting provider and a Chinese IP address. Most of the servers affected in this campaign are located in India, China, Brazil and the Netherlands, but others can be found around the globe:
> http://www.net-security.org/images/articles/pie-28102015.jpg
"We believe that the attackers compromised MySQL servers to take advantage of their large bandwidth. With these resources, the attackers could launch bigger DDoS campaigns than if they used traditional consumer targets," Symantec researchers explained*. "MySQL is also the second most popular database management system in the world, giving the attackers a wide range of potential targets." The researchers didn't say how many servers in total were compromised. The attackers used a variant of the Chickdos Trojan to make the servers listen to their commands. The variant is very similar to the initial Chickdos Trojan first spotted by cyber defenders in December 2013. The attackers perform an SQL injection attack in order to install a malicious user-defined function (UDF) on the target server, which is then loaded into MySQL and executed... The researchers advised admins -never- to run SQL servers with administrator privileges (if possible), and to regularly patch apps** that use them..."
* http://www.symantec.com/connect/app#!/blogs/mysql-servers-hijacked-malware-perform-ddos-attacks
28 Oct 2015 - "... identified active command-and-control (C&C) servers for Chikdos are as follows:
•183.60.202.16: 10888
•61.160.247.7: 10991
•103.17.118.124: 10991 ..."
** http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
"... contains -30- new security fixes for Oracle MySQL. 2 of these vulnerabilities may be remotely exploitable without authentication..."
Trojan.Chikdos: https://www.symantec.com/security_response/writeup.jsp?docid=2013-121708-1045-99
___
Fake 'Ikea' SPAM - doc malware
- http://myonlinesecurity.co.uk/ikea-thank-you-for-your-order-word-doc-malware/
28 Oct 2015 - "An email with the subject of 'Thank you for your order!' pretending to come from DoNotReply@ ikea .com with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Ikea-Thank-you-for-your-order-1024x479.png
28 October 2015 : IKEA receipt 607656390.doc - Current Virus total detections 4/55* .
.. Downloads looks like Dridex banking malware from experassistance .fr/4f67g7/d6f7g8.exe
(VirusTotal 2/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/03626c8036299e08b705f193337d44934ee45ddc373a368c71e8ef073ec674e8/analysis/1446022494/
** https://www.virustotal.com/en/file/05f4aa3d5df39c403a51237a6762c062c079480d974de61a4424d3c2d0b26d95/analysis/1446023464/
- http://blog.dynamoo.com/2015/10/this-fake-order-spam-does-not-come-from.html
28 Oct 2015 - "This -fake- order spam does not come from IKEA but is instead a simple -forgery- with a malicious attachment.
From: DoNotReply@ ikea .com
Date: 28 October 2015 at 08:57
Subject: Thank you for your order
Order acknowledgement:
To print, right click and select print or use keys Ctrl and P.
Thank you for ordering with IKEA Shop Online. Your order is now being processed. Please check your order and contact us as soon as possible if any details are incorrect. IKEA Customer Relations, Kingston Park, Fletton, Peterborough, PE2 9ET. Tel: 0203 645 0015 ...
Attached is a file IKEA receipt 607656390.doc which contains this malicious macro and which has a VirusTotal detection rate of 4/55*...
UPDATE 1: The reverse .it analysis** of the first sample shows a download from:
alvarezsantos .com/4f67g7/d6f7g8.exe
This dropped binary has a detection rate of just 2/55*. Two further samples have now been seen (VT results [1] [2]) and according to the analysis of one them, it downloads from:
experassistance .fr/4f67g7/d6f7g8.exe
... Two further samples have now been seen (VT results [1] [2]) and according to the analysis[3] of one them, it downloads from:
experassistance.fr/4f67g7/d6f7g8.exe
... UPDATE 2: A further reverse .it analysis[4] shows another download location of:
www .retrogame .de/4f67g7/d6f7g8.exe ..."
* https://www.virustotal.com/en/file/92f733da9ba440f0632b495a32742d47a5cb296f49127f210e14de412e371bf8/analysis/1446023495/
** https://www.hybrid-analysis.com/sample/92f733da9ba440f0632b495a32742d47a5cb296f49127f210e14de412e371bf8?environmentId=2
1] https://www.virustotal.com/en/file/03626c8036299e08b705f193337d44934ee45ddc373a368c71e8ef073ec674e8/analysis/1446024071/
2] https://www.virustotal.com/en/file/246ec2f4cdf0e18dc874644a09c369232ec70821a4b11a40dd7c133afb2ad70d/analysis/1446024082/
3] https://www.hybrid-analysis.com/sample/03626c8036299e08b705f193337d44934ee45ddc373a368c71e8ef073ec674e8?environmentId=1
4] https://www.hybrid-analysis.com/sample/246ec2f4cdf0e18dc874644a09c369232ec70821a4b11a40dd7c133afb2ad70d?environmentId=1
___
Fake 'eFax' SPAM - doc malware
- http://myonlinesecurity.co.uk/efax-message-from-booking-com-hylafa-1-pages-caller-id-031207944200-word-doc-malware/
28 Oct 2015 - "An email with the subject of 'eFax message' from “Booking.com – HylaFa” – 1 page(s), Caller-ID: 031207944200 pretending to come from eFax <message@ inbound .efax .com> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/eFax-message-from-Bookingdotcom-HylaFa-1024x640.png
28 October 2015 : FAX_20151028_1445421437_89.doc - Current Virus total detections 4/55*
... downloads -same- malware from the -same- locations as described in today’s earlier malspam run involving word docs**..."
* https://www.virustotal.com/en/file/92f733da9ba440f0632b495a32742d47a5cb296f49127f210e14de412e371bf8/analysis/1446026859/
** http://myonlinesecurity.co.uk/ikea-thank-you-for-your-order-word-doc-malware/
- http://blog.dynamoo.com/2015/10/malware-spam-efax-message-from.html
28 Oct 2015 - "This fake fax spam comes with a malicious attachment:
From: eFax [message@ inbound .efax .com]
Date: 28 October 2015 at 10:08
Subject: eFax message from "Booking.com - HylaFa" - 1 page(s), Caller-ID: 031207944200
Fax Message [Caller-ID: 031207944200]
You have received a 1 page fax at 2015-10-28 08:57:17 GMT.
* The reference number for this fax is lon1_did14-1445421403-1407880525-89.
View this fax using your Microsoft Word...
The attachment FAX_20151028_1445421437_89.doc is the -same- as used in this spam run* and the payload is the Dridex banking trojan."
* http://blog.dynamoo.com/2015/10/this-fake-order-spam-does-not-come-from.html
___
Fake 'ADP' SPAM - PDF malware
- http://myonlinesecurity.co.uk/adp-payroll-invoice-with-a-password-protected-zip-attachment-fake-pdf-malware/
28 Oct 2015 - "An email with the subject of 'ADP Payroll Invoice' pretending to come from ADPClientServices@ adp .com <billing.address.updates@ adp .com> with a password protected zip attachment is another one from the current bot runs... The content of the email says :
Your ADP Payroll invoice is attached for your review. If you have any questions regarding this invoice, please contact your ADP service team at the number provided on the invoice for assistance.
Important: Please open the attached file using your temporary password. Your temporary password is: 941VAX332ED
Please note that your bank account will be debited within one banking business day for the amount(s) shown on the invoice.
Thank you for choosing ADP Payroll.
Please do not respond to this message. It comes from an unattended mailbox.
28 October 2015: invoice381624185029.zip: Extracts to: invoice381624185029.exe
Current Virus total detections 3/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/895e23a7f5094fbab7b1392c56c4e3d50154c6d141d26a3933c3a09e47fe33bc/analysis/1446048560/
___
Fake 'résumé' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-id9828myresume.html
27 Oct 2015 - "This fake résumé spam comes with a malicious attachment. It seems that the names are randomly-generated from a list.
From: Trinh [zhanxing1497kcuo@ 163 .com]
Date: 27 October 2015 at 18:30
Subject: id:9828_My_Resume
Signed by: 163 .com
Good afternoon!!! my name is Bobette Gloster. my resume is doc file.
I would appreciate your immediate attention to this matter.
Yours faithfully
Bobette Gloster
In this case the attachment was named Bobette_resume_1817.doc however this will vary. The VirusTotal analysis of the document gives a detection rate of 8/55*, mostly detecting a generic macro downloader... the Hybrid Analysis** of the document shows traffic coming FROM 46.30.41.150 (EuroByte LLC, Russia) and being POSTED to the following:
all-inclusiveresortstravel .com
designtravelagency .com
bigboattravel .com
cpasolutiononline .com
ciiapparelblog .com
The first three are on 108.167.140.175 and the second two are on 192.185.101.210 which are both allocated to WebSiteWelcome customers. I would assume that those two servers are completely -compromised-. The Hybrid Analysis report** shows that the malware has some characteristics that make it look like -ransomware-.
Recommended blocklist:
46.30.41.150: https://www.virustotal.com/en/ip-address/46.30.41.150/information/
108.167.140.175: https://www.virustotal.com/en/ip-address/108.167.140.175/information/
192.185.101.210: https://www.virustotal.com/en/ip-address/192.185.101.210/information/
UPDATE: This Tweet*** indicates that the payload is Cryptowall."
* https://www.virustotal.com/en/file/6f26e30b99bc668efacaf2da2a38037c9509f02099323d65a48ad758fe88d9ad/analysis/1445972310/
** https://www.hybrid-analysis.com/sample/6f26e30b99bc668efacaf2da2a38037c9509f02099323d65a48ad758fe88d9ad?environmentId=1
*** https://twitter.com/Techhelplistcom/status/659038278746685440
:fear::fear: :mad:
AplusWebMaster
2015-10-29, 13:30
FYI...
Fake 'Doc Scan' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/10/malware-spam-documents-for-review-and.html
29 Oct 2015 - "This -fake- document scan email has a malicious attachment:
From: Sarah [johnson@ jbrakes .com]
Date: 29 October 2015 at 08:27
Subject: Documents for Review and Comments
Hi Morning,
Attached are the return documents.
Call me if you need anything.
See you soon.
Sarah
The attached file is SCANNED DOCS,jpg.z which is a type of compressed file. If you have the right file decompression software, it will extact a malicious executable SCANNED DOCS,jpg.exe which has a VirusTotal detection rate of 17/55*. According to various automated analysis tools [1] [2] [3] it drops a file %TEMP%\XP000.TMP\M.exe which itself has a detection rate of 19/54**. Out of all the standard analysis tools I have used, only Comodo CAMAS identified the network traffic, a POST to:
eyeseen .net/swift/gate.php
This is hosted on a SoftLayer IP of 198.105.221.5 in Singapore. A quick look at VirusTotal*** indicates a lot of badness on this IP address, so it is probably one worth blocking. The payload is Pony / Fareit, which is basically a password stealer."
* https://www.virustotal.com/en/file/9fd03451e18b8c33caca6d89aee260886e2b6a2e77f2d6af9d6981389e7822e3/analysis/1446107638/
** https://www.virustotal.com/en/file/4d988335170d2922d6d68d2c6387617c6d53bb12983859436fbf31b65a541887/analysis/1446108516/
*** https://www.virustotal.com/en/ip-address/198.105.221.5/information/
1] https://www.virustotal.com/en/file/9fd03451e18b8c33caca6d89aee260886e2b6a2e77f2d6af9d6981389e7822e3/analysis/1446107638/
2] https://www.hybrid-analysis.com/sample/9fd03451e18b8c33caca6d89aee260886e2b6a2e77f2d6af9d6981389e7822e3?environmentId=2
3] https://malwr.com/analysis/MGQ1ZDcyMzc4NGM0NDY2ODhhZTkxNDU4YjgwODY5YTE/
___
Fake 'eBay Invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/your-ebay-invoice-is-ready-fake-pdf-malware-2/
29 Oct 2015 - "An email with the subject of 'Your eBay Invoice is Ready' pretending to come from eBay <ebay@ ebay .com> with a zip attachment is another one from the current bot runs... The content of the email says :
PLEASE DO NOT RESPOND – Emails to this address are not monitored or responded to.
Dear Customer,
Please open the attached file to view invoice.
If the attachment is in PDF format you may need Adobe Acrobat Reader to read or download this attachment. If you require Adobe Acrobat Reader this is available at no cost...
This email has been scanned by the Symantec Email Security.cloud service.
This email and any attachment are intended solely for the addressee, are strictly confidential and may be legally privileged. If you are not the intended recipient any reading, dissemination, copying or any other use or reliance is prohibited. If you have received this email in error please notify the sender immediately by email and then permanently delete the email.
29 October 2015: ebay_591278156712819_291015.zip: Extracts to: ebay_591278156712819_291015.exe
Current Virus total detections 1/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/311132c9f241d4f0be5982e1680751d3051b38291d0aaf2821e27520de356773/analysis/1446114782/
___
Fake 'Your Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/heather-crawford-barclaycomms-com-your-invoice-i0000040777-word-doc-malware/
29 Oct 2015 - "An email with the subject of 'Your Invoice I0000040777' pretending to come from Heather Crawford <h.crawford@ barclaycomms .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Dear Customer. Please find attached your Invoice. Invoice Number: 0000040777 Invoice Date: 28/10/2015 Invoice Total: 78.40 Invoice Description: Barclay Fresh Direct Debit 1 V (x1.00000)
This e-mail, and any attachment, is confidential. If you have received it in error, please delete it from your system, do not use or disclose the information in any way, and notify me immediately. The contents of this message may contain personal views which are not the views of Barclay Communications, unless specifically stated.
29 October 2015: I0000040777.doc - Current Virus total detections 3/55*
... Downloads Dridex banking malware from
0319225577 .com/46435/087965.exe (VirusTotal 0/55**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... Many versions pretend to have a digital RSA key and say you need to enable editing and Macros to see the content. Do NOT enable Macros... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a793aef1bbcdef406c90a4166cc5a42032c703aaf485b00027c24a63dee602af/analysis/1446115712/
** https://www.virustotal.com/en/file/f34b930f9c34ad376295db9aaaad6016b64fd78df25bb920531eef2224628ecd/analysis/1446114950/
0319225577 .com: 180.182.51.81: https://www.virustotal.com/en/ip-address/180.182.51.81/information/
___
Fake 'FedEx Label' SPAM - doc malware
- http://myonlinesecurity.co.uk/confirmation-from-fedex-emailonline-label-walmart-com-return-word-doc-malware/
29 Oct 2015 - "An email about Walmart .com Returns with the subject of 'Confirmation from FedEx Email/Online Label' pretending to come from FedEx Email/Online Label NoReply <no-reply@ packagetrackr .com> with a malicious word doc is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Confirmation-from-FedEx-Email-Online-Label-1024x589.png
29 October 2015: label_737929223.doc - Current Virus total detections 2/55* . Analysis via Payload Security hybrid analysis** tells me that it downloads writeonlabels .biz/media/system/m.exe
(VirusTotal 0/55***) and posts some information to dethetear .ru/sliva/gate.php. This looks a bit like the behaviour of the new Shifu banking malware which combines the worse elements of Dridex, Zeus, Pony and all the other information stealers... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/4be1077cdd7e821b3999b9c24c1e9070eadf87163ee27773e61197b68e21edda/analysis/1446133593/
** https://www.hybrid-analysis.com/sample/4be1077cdd7e821b3999b9c24c1e9070eadf87163ee27773e61197b68e21edda?environmentId=1
*** https://www.virustotal.com/en/file/85b523825c7a1ec3da4621ae01bca7dab592663f62eb0b0bcb9928818c87d4f9/analysis/1446135044/
:fear::fear: :mad:
AplusWebMaster
2015-10-30, 12:57
FYI...
Fake 'Purchase Order' SPAM - doc malware
- http://myonlinesecurity.co.uk/clare-harding-carters-packaging-ltd-purchase-order-0000035394-customer-09221-word-doc-malware/
30 Oct 2015 - "An email with the subject of 'Purchase Order 0000035394 customer 09221' pretending to come from Clare Harding <purchasing@ carterspackaging .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Purchase-Order-0000035394-customer-09221-1024x727.png
30 October 2015: Purchase Order 0000035394.DOC - Current Virus total detections 4/55*
... Downloads ankarasogukhavadepo .com/45y3f34f/7jh4wqd.exe which appears to be Dridex banking malware (VirusTotal 1/55**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/57e7eb6c8a742767101ed847d9697fc17cdbea9dc129b99aefe67276ad346957/analysis/1446197496/
** https://www.virustotal.com/en/file/5c095d6ea6739cc51a1526ea02614f0a66793a4dc301ead5955d9951f550c79c/analysis/1446198752/
- http://blog.dynamoo.com/2015/10/malware-spam-purchase-order-0000035394.html
30 Oct 2015 - "This -fake- financial spam does not come from Carters Packaging Ltd but is instead a simple forgery with a malicious attachment... Carters Packaging are on the ball and have put a big notice on their site, which is nice work:
>> https://4.bp.blogspot.com/-kH6ud4vSuxo/VjNd-6pk1yI/AAAAAAAAHRM/a21HfVrgZ6w/s400/carters-packaging.png "
___
Fake 'Domain Suspension Notice' SPAM - Cryptowall ransomware payload
- http://blog.dynamoo.com/2015/10/malware-spam-domain-domain-suspension.html
29 Oct 2015 - "There appear to be many versions of this spam, aimed at domain owners and apparently coming from the actual registrar of the domain. For added authenticity, the owner's name is included in the spam...
From: ENOM, INC. [abuse@ enom.com .org]
Date: 30 October 2015 at 04:11
Subject: Domain ... Suspension Notice
Dear Sir/Madam,
The following domain names have been suspended for violation of the ENOM, INC. Abuse Policy ...
Click here and download a copy of complaints we have received...
... clicking on the link goes to edecisions .com/abuse_report.php?LAPTOP-MEMORY.COM and downloads a file LAPTOP-MEMORY.COM_copy_of_complaints.pdf.scr - it looks more authentic because the domain name is in the file download, but in fact you can specify -any- domain name and it gives a matching file. Before we look at the analysis of the downloaded executable, let's look at the domain name edecisions .com. It looks like the sort of domain that might contain abuse reports, but in fact it is a -hijacked- GoDaddy domain hosted on 65.78.174.100 and a quick look at VirusTotal* indicates that one of the other 4 sites on the same server was also -compromised- and was serving up malware in 2013. This is definitely a good candidate to block... several compromised domains on the same server, indicating that the entire box has been popped..."
* https://www.virustotal.com/en/ip-address/65.78.174.100/information/
... UPDATE: The payload appears to be the Cryptowall ransomware."
(More detail and IP's to block at the dynamoo URL above.)
edecisions .com: 65.78.174.100: https://www.virustotal.com/en/url/95408a08330bbc19c9c834725b4830b4855bfb564f386c74d4ff0df30e9e6f20/analysis/
>> http://support.melbourneit.com.au/articles/help/Spam-Alert-27th-October-2015
27 Oct 2015 - "... advise that any customer that receives the email is to -delete- it immediately. If you are unsure of the validity of your emails please check the email headers to determine the source and return path for the email address..."
:fear::fear: :mad:
AplusWebMaster
2015-11-02, 13:50
FYI...
Fake 'Purchase Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-purchase-order-37087-por.html
2 Nov 2015 - "This -fake- financial spam does not come from K. Stevens (Leicester) Ltd but is instead a simple -forgery- with a malicious attachment.
From Margaret Wimperis [MargaretWimperis@ biasbinding .com]
Date Mon, 02 Nov 2015 18:28:23 +0700
Subject Purchase Order 37087-POR
Hi
Please confirm receipt of order
Kind regards
Margaret
K. Stevens (Leicester) Ltd. Portishead Road, Leicester LE5 0JL Reg. No. 3125088
This email and any attachments are believed to be virus free, however
recipients are responsible for appropriate virus checks. The email and
attachments are confidential to the addressee and unauthorised use, copying or
retention by others is prohibited...
Attached is a file PORDER.DOC which comes in three different versions (although I only have two samples [1] [2]) containing a malicious macro... which download a binary from the following locations:
saltup .com/34g3f3g/68k7jh65g.exe
landprosystems .com/34g3f3g/68k7jh65g.exe
jambidaily .com/34g3f3g/68k7jh65g.exe
This binary has a detection rate of 4/55* and according that that VirusTotal report, this reverse.it report** this Malwr report*** it contacts the following IP:
128.199.122.196 (DigitalOcean, Singapore)
I strongly recommend that you -block- that IP. The payload is likely to be the Dridex banking trojan..."
1] https://www.virustotal.com/en/file/b3c483e304a52e2e5724e7b637146da62d285a37736461d4280366c98ee74125/analysis/1446464337/
2] https://www.virustotal.com/en/file/d997184e5277a9ede634999c6cfaea0d64f7009ff6727c71d58d9d676530ae5e/analysis/1446464348/
* https://www.virustotal.com/en/file/f5332dbba418832e779b6bcbd654a1507012a057730fb2abcaa1d6ba9c04f316/analysis/1446464493/
** https://www.hybrid-analysis.com/sample/f5332dbba418832e779b6bcbd654a1507012a057730fb2abcaa1d6ba9c04f316?environmentId=1
128.199.122.196: https://www.virustotal.com/en/ip-address/128.199.122.196/information/
*** https://malwr.com/analysis/ZmJlZDJlMzY3YjcxNDYwZDgxYjM2ODQ5MjdhMzU5NDY/
- http://myonlinesecurity.co.uk/purchase-order-37087-por-margaret-wimperis-k-stevens-leicester-ltd-word-doc-malware/
2 Nov 2015
"... 2 November 2015: PORDER.DOC - Current Virus total detections 3/55*
... Downloads Dridex banking malware from one of these locations:
saltup .com/34g3f3g/68k7jh65g.exe (VirusTotal 4/55**)
landprosystems .com/34g3f3g/68k7jh65g.exe
jambidaily .com/34g3f3g/68k7jh65g.exe ..."
* https://www.virustotal.com/en/file/b3c483e304a52e2e5724e7b637146da62d285a37736461d4280366c98ee74125/analysis/1446470703/
** https://www.virustotal.com/en/file/f5332dbba418832e779b6bcbd654a1507012a057730fb2abcaa1d6ba9c04f316/analysis/1446464493/
___
Fake 'American Airlines' SPAM - doc malware
- http://myonlinesecurity.co.uk/american-airlines-e-ticket-confirmation-word-doc-malware/
2 Nov 2015 - "An email appearing to be an American Airlines E-Ticket with the subject of 'E-Ticket Confirmation' pretending to come from American Airlines@ aa .com <notify@ hvacprofessional .net> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/American_-Airlines_E-Ticket1-1024x553.png
2 November 2015 : ticket_AA77799543.doc - Current Virus total detections 4/55*
... Contains an embedded ole object that drops a pony malware pu .exe (VirusTotal 2/55**), posts -stolen- information to
- http ://wicytergo .ru/sliva/gate.php
- http ://unlaccothe .ru/sliva/gate.php
- http ://thetedrenre .ru/sliva/gate.php
... Which in turn downloads Dyreza banking malware from one of these 3 sites:
- http ://eextensions .co/m.exe
- http ://www.10203040 .at/m.exe
- http ://www.eshtari .me/m.exe (VirusTotal 2/55***)
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/7e28f1b5f5738a3ce1e38dc80a169cf0850b5f22015bd9555f7ad1d48b9f7b47/analysis/1446486517/
** https://www.virustotal.com/en/file/aa6f1f2db2afd7f37f1b2133881bdbc0fdd7515cbde8749bf21d1fcabe372982/analysis/1446486884/
*** https://www.virustotal.com/en/file/857ac93ea68f74636be147e264e0803e0921341a372b1b5711c7c541555abb82/analysis/1446487008/
:fear::fear: :mad:
AplusWebMaster
2015-11-03, 13:28
FYI...
Fake 'Delivery Confirmation' SPAM - doc malware
- http://myonlinesecurity.co.uk/delivery-confirmation-0068352929-acuvue-com-word-doc-malware/
3 Nov 2015 - "An email with the subject of 'Delivery Confirmation: 0068352929' pretending to come from ACUVUE_DEL <ship-confirm@ acuvue .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
PLEASE DO NOT REPLY TO THIS E-MAIL. IT IS A SYSTEM GENERATED MESSAGE.
Attached is a pdf file containing items that have shipped
Please contact us if there are any questions or further assistance we can provide
3 November 2015: Advance Shipping Notification 0068352929.DOC - Current Virus total detections 3/54*
... Downloads http ://goalaskatours .com/45gce333/097j6h5d.exe looks like Dridex banking malware (VirusTotal 4/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5b343d8163cc250ecfb56f63c753421decfde5f36c7a7559819129e4a377f464/analysis/1446542730/
** https://www.virustotal.com/en/file/bbf503d960c62e2aadb5aa270aa05b0f937b28be1b7cca3cad0339fb59273493/analysis/1446544379/
... Behavioural information
TCP connections
128.199.122.196: https://www.virustotal.com/en/ip-address/128.199.122.196/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
- http://blog.dynamoo.com/2015/11/malware-spam-delivery-confirmation.html
3 Nov 2015 - "... this Hybrid Analysis report* show network communications to the following IPs:
128.199.122.196 (Digital Ocean, Singapore)
75.99.13.123 (Cablevision, US)
198.74.58.153 (Linode, US)
221.132.35.56 (Ho Chi Minh City Post and Telecom Company, Vietnam)
The payload is most likely to be the Dridex banking trojan.
Recommended blocklist:
128.199.122.196
75.99.13.123
198.74.58.153
221.132.35.56 "
* https://www.hybrid-analysis.com/sample/bbf503d960c62e2aadb5aa270aa05b0f937b28be1b7cca3cad0339fb59273493?environmentId=1
___
Fake 'New Invoice' SPAM - PDF malware
- http://myonlinesecurity.co.uk/new-invoice-from-documents-online-fake-pdf-malware/
3 Nov 2015 - "An email with the subject of 'New Invoice from Documents Online' pretending to come from Documents Online Limited <sales@ documentsonline .co.uk> with a zip attachment is another one from the current bot runs... The content of the email says :
Dear Customer,
This is a notice that an invoice has been generated against your account, details of the invoice are as follows:
Invoice #241
Amount Due: 90.00GBP
Due Date: 01/12/2015
Payment Method: Bank Transfer
Invoice Items
... 75.00GBP
Sub Total: 75.00GBP
20.00% UK VAT: 15.00GBP
Credit: 0.00GBP
Total: 90.00GBP
Please find attached a copy of this invoice in PDF format for your records.
IMPORTANT: Please open the attached file using your temporary password. Your temporary password is: UCZ941QXO941 ...
3 November 2015: Invoice-241.zip: Extracts to: Invoice-241.exe
Current Virus total detections 0/53* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d0da209f011c514c1b15e8ccca3f94618d279439a28394067b6579d171e515c3/analysis/1446550339/
- http://blog.dynamoo.com/2015/11/malware-spam-new-invoice-from-documents.html
3 Nov 2015 - "... Attached is a password-protected ZIP file Invoice-241.zip.. which in turn contains a malicious executable Invoice-241.zip.exe ...
UPDATE: This Hybrid Analysis report* shows traffic consistent with Upatre dropping the Dyre banking trojan, including traffic to the well known bad IP of:
197.149.90.166 (Cobranet, Nigeria)"
* https://www.hybrid-analysis.com/sample/d0da209f011c514c1b15e8ccca3f94618d279439a28394067b6579d171e515c3?environmentId=1
___
Fake 'Dispatch order' SPAM - PDF malware
- http://myonlinesecurity.co.uk/josh-carr-intermodal-management-system-dispatch-order-19579282466206-fake-pdf-malware/
3 Nov 2015 - "An email with the subject of 'Dispatch order – 19579282466206' pretending to come from Josh Carr <Josh.Carr@ imstransport .com> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Dispatch-order-19579282466206-1024x660.png
3 November 2015: 5969141.zip: Extracts to: 0810121.scr
Current Virus total detections 0/41* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/17bb16ddc31f39e2d6bf3447863fbd6d1bf47f3e69c1946818ee46bbb6305b57/analysis/1446564559/
___
Angler -and- Nuclear EK's integrate Pawn Storm Flash Exploit
- http://blog.trendmicro.com/trendlabs-security-intelligence/angler-and-nuclear-exploit-kits-integrate-pawn-storm-flash-exploit/
Nov 3, 2015 - "... We found -two- vulnerabilities that were now being targeted by exploit kits, with one being the recent Pawn Storm Flash zero-day. Starting on October 28, we found that these two vulnerabilities were being targeted by the Angler and Nuclear exploit kits. (The second vulnerability was a Flash vulnerability that worked on versions up to 18.0.0.232; we are currently working with Adobe to confirm the CVE number for this exploit)... Our latest research confirms that the two exploit kits abusing the Diffie-Hellman key exchange, with some minor differences from the previous usage. This is being done to hide their network traffic and to get around certain security products. The changes are an attempt to make analysis of their key exchange by researchers more difficult. The Angler EK has made the following changes to its usage of the Diffie-Hellman protocol. They add some obfuscation to what had previously been a relatively clear and obvious process... activity for the Angler exploit kit was higher in the earlier weeks of October; perhaps the addition of these vulnerabilities is an attempt to raise the traffic levels of the exploit back to the earlier levels. Users in Japan, the United States, and Australia were the most affected..."
Current Flash version - 19,0,0,226
Test here: https://www.adobe.com/software/flash/about/
:fear::fear: :mad:
AplusWebMaster
2015-11-04, 16:07
FYI...
Fake 'Transport' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-email-from-transport-for.html
4 Nov 2015 - "This -fake- Transport for London spam is a variation of something used before. It does not actually come from TfL, but is a simple -forgery- with a malicious attachment:
From "Transport for London" [noresponse@ cclondon .com]
Date Wed, 4 Nov 2015 14:33:44 +0100
Subject Email from Transport for London
Dear Customer
Please open the attached file to view correspondence from Transport for London.
If the attachment is in PDF format you may need Adobe Acrobat Reader to read or download
this attachment...
Thank you for contacting Transport for London.
Business Operations
Customer Service Representative ...
This email has been scanned by the Symantec Email Security.cloud service...
Attached is a file 6305093.zip of which I have seen just one sample, containing a malicious executable 6305093.scr (MD5 6a4cce90ba28720fa9e6813f681b1f75) which has a VirusTotal detection rate of 7/54*. This Hybrid Analysis report** shows it communicating with the well-known malicious IP address of 197.149.90.166 (Cobranet, Nigeria) which I recommend you block. The payload here seems to be Upatre dropping the Dyre banking trojan."
* https://www.virustotal.com/en/file/2e82c5534c04bcf50c9afb9dd5e28bba23c418fbfa0ffed19645a30de56b25aa/analysis/1446645968/
** https://www.hybrid-analysis.com/sample/2e82c5534c04bcf50c9afb9dd5e28bba23c418fbfa0ffed19645a30de56b25aa?environmentId=1
:fear::fear: :mad:
AplusWebMaster
2015-11-05, 14:28
FYI...
Fake 'Document from AL-KO' SPAM - doc malware
- http://myonlinesecurity.co.uk/document-from-al-ko-word-doc-malware/
5 Nov 2015 - "An email with the subject of 'Document from AL-KO' pretending to come from info@ alko .co.uk with a malicious word doc attachment is another one from the current bot runs... The email looks like:
This document is DOC created by Osiris OSFAX(R) V3.5.
It can be viewed and printed with Microsoft Word(R)
5 November 2015: Document from AL-KO.doc - Current Virus total detections 0/54*.
... Downloads Dridex banking malware from:
www .mazzoni-hardware .de/f75f9juu/009u98j9.exe
deklompjes .nl/~maurice/f75f9juu/009u98j9.exe
members.dodo .com.au/~mfranklin17/f75f9juu/009u98j9.exe
www .www .www.enhancedpixel .com/f75f9juu/009u98j9.exe (VirusTotal 3/54**)
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/134f4cd2f17b312083bee6fb6d502dd0dd3b70f5716b8d17aae8acdcbad0e610/analysis/1446722835/
** https://www.virustotal.com/en/file/17ac88233dfe1197ecca2ed4c2560d95be595123c725d75f839f9d101c9de3e4/analysis/1446723789/
... Behavioural information
TCP connections
75.99.13.123: https://www.virustotal.com/en/ip-address/75.99.13.123/information/
23.62.99.160: https://www.virustotal.com/en/ip-address/23.62.99.160/information/
- http://blog.dynamoo.com/2015/11/malware-spam-document-from-al-ko.html
5 Nov 2015 - "... detection rate of 4/54*... Other automated analyses [5] [6] show network traffic to:
128.199.122.196 (Digital Ocean, Singapore)
75.99.13.123 (Cablevision, US)
The payload appears to be the Dridex banking trojan.
Recommended blocklist:
128.199.122.196
75.99.13.123 "
* https://www.virustotal.com/en/file/17ac88233dfe1197ecca2ed4c2560d95be595123c725d75f839f9d101c9de3e4/analysis/1446729564/
5] https://www.hybrid-analysis.com/sample/17ac88233dfe1197ecca2ed4c2560d95be595123c725d75f839f9d101c9de3e4?environmentId=2
6] https://malwr.com/analysis/MTNjODQ1MmE0MjRiNGJmOTg4MzYyODFiYzg0MzY2ZWE/
128.199.122.196: https://www.virustotal.com/en/ip-address/128.199.122.196/information/
___
Fake 'Billing' SPAM – PDF malware
- http://myonlinesecurity.co.uk/monthly-billing-920493380924127516-e-online-data-amerikicks-fake-pdf-malware/
5 Nov 2015 - "An email with the subject of 'Monthly Billing 920493380924127516 – e-Online Data – amerikicks' coming from random companies, email addresses and names with a zip attachment is another one from the current bot runs... The content of the email says :
Amerikick Studios
Invoice #: 920493380924127516
Please use the HelpDesk for all problems/questions/suggestions. It is located at the bottom of the admin pages.
A full report in the attachment.
Billing for Nov 2015
This is your Payment Gateway monthly invoice...
5 November 2015: Final overdue bill order document.zip: Extracts to: 745348208.exe
Current Virus total detections 1/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2ba09e25d6d9f0b9a5f0db14a6eb6e792270a2ec71e4d377f3a761055b726560/analysis/1446738837/
___
Fake 'subpoena' attachment SPAM - doc malware
- http://myonlinesecurity.co.uk/i-got-this-subpoena-in-my-mail-box-today-doug-little-cardataconsultants-com-word-doc-malware/
5 Nov 2015 - "An email saying 'I got this subpoena in my mail box today' with the subject of 'sued used' pretending to come from dlittle@ cardataconsultants .com with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... Nobody is being sued. Nobody is actually sending a subpoena to you by email. The email looks like:
I got this subpoena in my mail box today, saying that I have been sued by you.
I am sorry but I don’t even know what this is.
I am attaching a scanned copy , please let me know what this is about
Doug Little
Special Services Co-ordinator
CarDATA Consultants
Phone 289-981-2733 ...
5 November 2015 : subpoena.doc - Current Virus total detections 2/54*
This malicious word doc has -2- copies of a RTF file embedded inside it (MALWR**) that when extracted deliver an embedded fareit password stealing malware pm3.exe (VirusTotal 2/55***) that posts information to http ://littonredse .ru/gate.php
These malicious word docs normally also drop an Upatre downloader that in turn downloads a Dyreza banking malware... the macro inside the word doc seems to indicate that it should...
Update: somewhere along the line it also downloads:
- http ://s.teamzerostudio .com/x1.exe (VirusTotal[4])...
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/15db7d387b7e6dcbb7ea6a502526c7103329fab1cd4e05db406cd93efe55fff6/analysis/
** https://malwr.com/analysis/NTY3ZjEwMmU0NGE3NGRmOGI2OTllNTE5ODhmMTliYTI/
*** https://www.virustotal.com/en/file/6a37daf10204852ee3780f17cc5976b6e0c52bfd300efa1670b4135ea70ef674/analysis/1446742200/
... Behavioural information
TCP connections
80.78.251.32: https://www.virustotal.com/en/ip-address/80.78.251.32/information/
119.81.144.82: https://www.virustotal.com/en/ip-address/119.81.144.82/information/
4] https://www.virustotal.com/en/file/e17449a3562f42b1b799ccd2e1a573fd901e55ce455b863de5efe9bbd7922095/analysis/1446746740/
___
PayPal Spam
- http://threattrack.tumblr.com/post/132616332398/paypal-spam
Nov 5, 2015 - "Subjects Seen:
Your PayPal Invoice is Ready
Typical e-mail details:
Dear PayPal Customer,
Please open the attached file to view invoice.
Your monthly account statement is available anytime; just log in to your account. To correct any errors, please contact us through our Help Centre.
Malicious File Name and MD5:
paypal_955154675414192_110515.exe (2364e385b3fe22c9381e20a72ce520e5)
Screenshot: https://40.media.tumblr.com/d36cf5a54dce047e6e1278e51dff00e8/tumblr_inline_nxcxmgW7nZ1r6pupn_500.png
Tagged: PayPal, Upatre
___
Trojanized adware; 20K popular apps caught in the crossfire
- https://blog.lookout.com/blog/2015/11/04/trojanized-adware/
Nov 4, 2015 - "Auto-rooting adware is a worrying development in the Android ecosystem in which malware roots the device automatically after the user installs it, embeds itself as a system application, and becomes nearly impossible to remove. Adware, which has traditionally been used to aggressively push ads, is now becoming trojanized and sophisticated. This is a new trend for adware... detected over 20,000 samples of this type of trojanized adware masquerading as legitimate top applications, including Candy Crush, Facebook, GoogleNow, NYTimes, Okta, Snapchat, Twitter, WhatsApp, and many others..."
- http://net-security.org/malware_news.php?id=3144
05.11.2015
- http://arstechnica.com/security/2015/11/new-type-of-auto-rooting-android-adware-is-nearly-impossible-to-remove/
Nov 4, 2015
___
Instagram 'free $50 Xbox cards' - Phish ...
- https://blog.malwarebytes.org/online-security/2015/11/nice-instagram-shame-about-the-code-generator/
Nov 5, 2015
> https://blog.malwarebytes.org/wp-content/uploads/2015/11/xboxinsta1-300x261.jpg
"... This tiled effect is achieved by uploading pieces of the larger image one by one, and could well help to attract attention from anybody interested in free $50 Xbox cards... it’s certainly a lot better looking than most similar promo splashes we see elsewhere... It claims to be a code generator, and wants visitors to enter an email-address-to-proceed after having selected their chosen reward. After hitting the 'Generate Code' button, the would-be recipient of free Xbox goodness sees one of those “We’re doing hacking stuff, honest” boxes pop up in the middle of the screen complete with regulation standard green text on black background:
> https://blog.malwarebytes.org/wp-content/uploads/2015/11/xboxinsta3.jpg
... convincing people to fill in surveys has been around for many years, yet they continue to bring in those hopeful of a little free console cash. I’ve seen pretty much every variation of the above there is, and have yet to see a single supposed code generator which actually did just that. All you’ll get for your time and trouble is handing over personal information to marketers and / or potentially unwanted downloads. And after you’ve done all of that, there’s still no guarantee you’ll get anything at the end of it. Our advice is -not- to bother with offers such as these – no matter how nice their Instagram page looks."
:fear::fear: :mad:
AplusWebMaster
2015-11-06, 13:51
FYI...
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-invoice-00004232-from.html
6 Nov 2015 - "This -fake- invoice does not come from Timber Solutions but is instead a simple -forgery- with a malicious attachment:
From: Kes [kerryadamson@ bigpond .com]
Date: 6 November 2015 at 11:07
Subject: Invoice #00004232; From Timber Solutions
Hi, please find attached our invoice for goods ordered under Order
No. 11146, which will be delivered tomorrow. Please pay into the
account, details of which are at the foot of the invoice. Kes
Attached is a file ESale.xls which I have seen just a single variant of across multiple emails. This has a VirusTotal detection rate of 3/54* and contains this malicious macro... which (according to this Hybrid Analysis report**) downloads a binary from:
advancedgroup .net .au/~incantin/334g5j76/897i7uxqe.exe
..this is saved as %TEMP%\tghtop.exe and has a detection rate of... zero***. Automated analysis of this binary [1] [2] shows network traffic to:
89.108.71.148 (Agava Ltd, Russia)
I strongly recommend that you -block- traffic that that IP. The payload is most likely to be the Dridex banking trojan."
* https://www.virustotal.com/en/file/5be589570751f4d8ead65ec9ce502637464568eca45f35dca61a195e6cb35f90/analysis/1446810013/
** https://www.hybrid-analysis.com/sample/5be589570751f4d8ead65ec9ce502637464568eca45f35dca61a195e6cb35f90?environmentId=1
*** https://www.virustotal.com/en/file/994de37c90fcb8a15746bc8c39659a559dec586e2c391aba4189b5450e5d07f7/analysis/1446810177/
... Behavioural information
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
88.221.14.163: https://www.virustotal.com/en/ip-address/88.221.14.163/information/
1] https://www.hybrid-analysis.com/sample/994de37c90fcb8a15746bc8c39659a559dec586e2c391aba4189b5450e5d07f7?environmentId=1
2] https://malwr.com/analysis/NGE4ZDEzNWM4OTY4NGJjMGFhMjNmMDUyM2UxZDM0OGY/
___
Fake 'Order Notification' SPAM - PDF malware
- http://myonlinesecurity.co.uk/order-notification-72742018-for-opportunities-beyond-obstacles-2015-complimentary-registration-fake-pdf-malware/
5 Nov 2015 - "An email appearing to come from the 'London housing foundation' about tickets for a conference with the subject of 'Order Notification 72742018 for Opportunities Beyond Obstacles 2015 – Complimentary Registration' pretending to come from jayk@ lhf .org.uk with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Order-Notification-72742018-for-Opportunities-Beyond-Obstacles-2015-Complimentary-Registration-1024x546.png
5 November 2015: barf vermilion.zip: Extracts to: 018648187082.exe
Current Virus total detections 0/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e07d6c40cd9199559f4fe90515f7a583a1d2a073d58182ca9548f2bb037a96a2/analysis/1446759940/
___
Cryptowall 4.0 released ...
- http://net-security.org/malware_news.php?id=3145
06.11.2015 - "Cryptowall 4 (although the number is not mentioned in the new, changed ransom note) is not drastically different from version 3. According to malware researcher Nathan Scott*, it uses the same encryption, installation method, Decrypt Service site, communication method, C&C server, and ransom payment domains.
* http://www.bleepingcomputer.com/news/security/cryptowall-4-0-released-with-new-features-such-as-encrypted-file-names/
... Palo Alto Networks researchers have so far spotted** -ten- unique instances of CryptoWall version 4, and have provided SHA256 hashes for each sample they analyzed... performing regular backups of important files is highly advised - in the case that you fall for the scheme, you wont have to pay the ransom because your files can be restored."
** http://researchcenter.paloaltonetworks.com/2015/11/cryptowall-v4-emerges-days-after-cyber-threat-alliance-report/
Nov 5, 2015
> http://researchcenter.paloaltonetworks.com/wp-content/uploads/2015/11/crypto2.png
- http://www.hotforsecurity.com/blog/cryptowall-4-0-returns-to-the-wild-posing-as-good-guy-12985.html
Nov 5, 2015
___
DirectRev Ad loads Flash Exploit, CryptoWall...
- https://blog.malwarebytes.org/malvertising-2/2015/11/directrev-advert-loads-self-sufficient-flash-exploit-cryptowall/
Nov 5, 2015 - "We have been observing a series of -malvertising- attacks using an unusual but familiar delivery method recently... instead of relying on an exploit kit to compromise the victims’ machines, this technique simply relies on a disguised Flash advert that downloads its own exploit and payload. We previously encountered this attack pattern on two occasions, one for a Sparta Ad and another that involved RTB platform DirectRev. This latest attack features various ad platforms leading to a booby-trapped DirectRev ad...
> https://blog.malwarebytes.org/wp-content/uploads/2015/11/Final_flow.png
... The Flash exploit is hosted on sensentive[.]com... The malware payload, CryptoWall, is retrieved from gearsmog[.]com... Both domains were created only a few seconds apart but reside on different IP addresses: 80.240.135.208 and 178.62.150.20..."
80.240.135.208: https://www.virustotal.com/en/ip-address/80.240.135.208/information/
178.62.150.20: https://www.virustotal.com/en/ip-address/178.62.150.20/information/
:fear::fear: :mad:
AplusWebMaster
2015-11-09, 14:45
FYI...
Fake 'OUTSTANDING INVOICES' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-outstanding-invoices-steve.html
9 Nov 2015 - "This -fake- financial email does not come from Resimac but is instead a simple -forgery- with a malicious attachment.
From "Steve McDonnell" [stevem@ resimac .co.uk]
Date Mon, 09 Nov 2015 18:24:23 +0530
Subject OUTSTANDING INVOICES
Dear,
Please find attached invoices 1396 & 1406 which are now outstanding.
I should be grateful if you would let me know when they are going to be paid.
Kind Regards
Steve McDonnell
Company Secretary
Resimac Ltd
Unit 11, Poplars Industrial Estate ...
I have only seen a single sample of this with an attachment named Invoices001396,1406-11.2015.xls which has a VirusTotal detection rate of 3/54* ... which contains this malicious macro... which (according to this Hybrid Analysis report**) in this case downloads a binary from:
www .davidcaballero .com/87yte55/6t45eyv.exe
The VirusTotal detection rate for this binary is 3/55***. That report indicates network traffic to:
89.108.71.148 (Agava Ltd, Russia)
Other analyses are pending, however I strongly recommend that you block traffic to that IP. The payload is likely to be the Dridex banking trojan."
* https://www.virustotal.com/en/file/6c9952b0712c9726373be21b1db570bcaf73d66a4dc286b383b773a654c68fc3/analysis/
** https://www.hybrid-analysis.com/sample/6c9952b0712c9726373be21b1db570bcaf73d66a4dc286b383b773a654c68fc3?environmentId=1
*** https://www.virustotal.com/en/file/3172fc122a9d6ee1cea1ead656502f9336bb62351878ebc1473b48857744a673/analysis/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
213.229.173.59: https://www.virustotal.com/en/ip-address/213.229.173.59/information/
- http://myonlinesecurity.co.uk/outstanding-invoices-steve-mcdonnell-resimac-co-uk-excel-xls-spreadsheet-malware/
9 Nov 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/OUTSTANDING-INVOICES-1024x561.png
"... 9 November 2015: Invoices001396,1406-11.2015.xls
Current Virus total detections 8/55* ... Downloads Dridex banking malware from
www .davidcaballero .com/87yte55/6t45eyv.exe ... DO NOT follow the advice they give to enable macros or enable editing to see the content... look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6c9952b0712c9726373be21b1db570bcaf73d66a4dc286b383b773a654c68fc3/analysis/
___
Fake 'Amendment/Agreement' SPAM - sharefile .com malware
- http://blog.dynamoo.com/2015/11/malware-spam-random-name-shared.html
5 Nov 2015 - "This -fake- Dropbox spam appears to come from randomly-generated people..
From: Sandy Schmitt via Dropbox [no-reply@ dropbox .com]
Date: 9 November 2015 at 11:41
Subject: Sandy Schmitt shared "Amendment or the Agreement_09-11-2015.zip" with you
Sandy used Dropbox to share a file with you!
Click here to view...
> https://1.bp.blogspot.com/-cua7HAy0dJU/VkCWITBajDI/AAAAAAAAHUU/3waO1sgAHnk/s400/fake-dropbox.png
The link in the email actually goes to sharefile .com where it downloads a file Amendment or the Agreement_09-11-2015.zip containing a malicious executable Amendment or the Agreement_09-11-2015.scr which has a VirusTotal detection rate of 2/54*. Automated analysis is inconclusive [1] [2] but you can guarantee that this is nothing good. Because of the low detection rates, it might be worth -temporarily- blocking sharefile .com."
* https://www.virustotal.com/en/file/47de271bdf0bbe10f19cff2bb53846ba805824cf18a00577d0ea9dcce4585d00/analysis/1447072746/
1] https://www.hybrid-analysis.com/sample/47de271bdf0bbe10f19cff2bb53846ba805824cf18a00577d0ea9dcce4585d00?environmentId=1
2] https://malwr.com/analysis/MTU3N2U2ZmI3ZDEyNDExMzg5YWU1ZjJjNzE2MDFiYmE/
___
New crypto-ransomware targets Linux web servers
- http://net-security.org/malware_news.php?id=3148
09.11.2015 - "There's a new piece of crypto-ransomware out there, but unlike most malware of this particular type, this one is mainly directed at web servers running on Linux. The threat has been dubbed Linux Encoder by Dr. Web researchers, and is currently detected by a small fraction of AV solutions*:
> http://www.net-security.org/images/articles/ransom-09112015-big.jpg
... "Once launched with administrator privileges, the Trojan (...) downloads files containing cybercriminals' demands and a file with the path to a public RSA key. After that, the malicious program starts as a daemon and deletes the original files," the researchers explained**. "Subsequently, the RSA key is used to store AES keys which will be employed by the Trojan to encrypt files on the infected computer"... It encrypts a wide variety of files - including Office, documents, image files, HTML and PHP files, archives, DLLs and EXE files - and adds the .encrypted extension to them. Instructions on what to do in order to get the files decrypted are included in each directory. Dr. Web researchers are working on a technology that can help decrypt data encrypted by this malware, but in the meantime the best protection against its destructiveness is to backup crucial files regularly..."
* https://www.virustotal.com/en/file/fd042b14ae659e420a15c3b7db25649d3b21d92c586fe8594f88c21ae6770956/analysis/
** https://news.drweb.com/show/?i=9686&lng=en&c=5
:fear::fear: :mad:
AplusWebMaster
2015-11-10, 13:07
FYI...
Fake 'Itinerary' SPAM - malcious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-itinerary-c003ns39-no.html
10 Nov 2015 - "This rather terse -fake- business spam does not come from Click Travel but is instead a simple -forgery- with a malcious attachment:
From: no-reply@ clicktravel .com [mailto:no-reply@ clicktravel .com]
Sent: Tuesday, November 10, 2015 11:21 AM
Subject: Itinerary #C003NS39
Please see document attached
Attached is a file Hotel-Fax-V0045G2B_8308427510989318361.xls which contains this malicious macro... which (according to this Hybrid Analysis report*) downloads a component from:
www .clemenciaortiz .com/87yte55/6t45eyv.exe
So far I have only seen one sample of this, there are likely to be others with different download locations but the same binary. This executable file has a detection rate of 2/55** and that VirusTotal report and this Malwr report*** indicate traffic to the following IP:
89.108.71.148 (Agava Ltd, Russia)
I strongly recommend blocking traffic to that IP address. The payload is the Dridex banking trojan."
* https://www.hybrid-analysis.com/sample/89f5ad1914f34c192f93d72db0e0f98befd5e55ee862e66ccc621dd0d0b61af9?environmentId=1
** https://www.virustotal.com/en/file/1beda47146b1dd7a2ca7210e83bec3b1bc45c51f9eb97ece446983e6324741cc/analysis/1447152223/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
*** https://malwr.com/analysis/MjI4MmQzNWVlMzFhNGE0Yjk2MmFhMDgzOTM5MmZjYTA/
___
Linux Encoder victims catch a lucky break: flaw in the malware
- http://net-security.org/malware_news.php?id=3151
10.11.2015 - "... the good news is that the malware makers have made a mistake that allowed Bitdefender researchers to recover the AES encryption key without having to decrypt it with the RSA private key held by the criminals... "We looked into the way the key and initialization vector are generated by reverse-engineering the Linux.Encoder.1 sample in our lab," they added. "We realized that, rather than generating secure random keys and IVs, the sample would derive these two pieces of information from the libc rand() function seeded with the current system timestamp at the moment of encryption. This information can be easily retrieved by looking at the file’s timestamp. This is a huge design flaw that allows retrieval of the AES key without having to decrypt it with the RSA public key sold by the Trojan’s operator(s)." This knowledge allowed them to create an effective decryption script, and given that this piece of ransomware targets more tech savvy users, they should not have a problem deploying it (check out this blog post* for the download link and instructions on how to use it)... They advised users never to run applications that they don’t completely trust, and to backup often - and keep the backup away from the system. In this particular case, that was the initial way to avoid paying the ransom, as the Trojan also encrypted backups found on the server."
* http://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails-on-predictable-encryption-key/
___
Fake 'PO99631' SPAM - xls malware
- http://myonlinesecurity.co.uk/po99631-mark-singleton-gilkes-pumping-systems-direct-excel-xls-spreadsheet-malware/
10 Nov 2015 - "An email with the subject of 'PO99631' pretending to come from Mark Singleton <m.singleton@ gilkes .com> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Please find PO99631 attached.
Kind Regards
Mark Singleton Sourcing Specialist Gilkes Pumping Systems Direct: +44 (0) 1539 790051
Tel: +44 (0) 1539 720028 Fax: +44 (0) 1539 732110 Gilbert Gilkes & Gordon Ltd ・Kendal ・Cumbria ・LA9 7BZ・United Kingdom
Registered Office: Gilbert Gilkes & Gordon Ltd. Kendal, Cumbria, LA9 7BZ Registration No: 173768 England & Wales
10 November 2015 : 99631 RBE.xls - Current Virus total detections 4/42*
... Same Dridex banking malware is downloaded as described in today’s earlier malspam run of malicious office documents**..."
* https://www.virustotal.com/en/file/89f5ad1914f34c192f93d72db0e0f98befd5e55ee862e66ccc621dd0d0b61af9/analysis/1447173398/
** http://myonlinesecurity.co.uk/itinerary-c003ns39-clicktravel-com-excel-xls-spreadsheet-malware/
___
Fake 'PayPal' SPAM - PDF malware
- http://myonlinesecurity.co.uk/your-paypal-extras-mastercard-bill-payment-has-been-sent-fake-pdf-malware/
9 Nov 2015 - "An email with the subject of 'Your PayPal Extras MasterCard bill payment' has been sent pretending to come from admin@ eight-point .com with a zip attachment is another one from the current bot runs... The content of the email says :
Hello customer,
Your payment for 654.35 USD has been sent.
Recipient: PayPal Extras MasterCard® Payment Method: Echeck Payment Amount: 654.35 USD Payment Date: Mon, 09 Nov 2015 22:04:27 +0100 Details in the attachment
Thanks for choosing the PayPal Extras MasterCard®.
Sincerely, PayPal ...
PayPal Email ID PP0822 – yrV3fNFlU5JL13 ...
9 November 2015: firm prices swordplay.zip: Extracts to: 353444754788.exe
Current Virus total detections 8/54* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a5ea7f981a3bcba7886e398753e3ccf8021958ce670c2ce76681c064c7a5669f/analysis/
:fear::fear: :mad:
AplusWebMaster
2015-11-11, 12:45
FYI...
Fake 'scanner' SPAM - xls macro malware
- http://myonlinesecurity.co.uk/scanneryour-own-email-domain-email-sent-from-aficio-mp-c5000-excel-xls-spreadsheet-malware/
11 Nov 2015 - "An email with -no- subject pretending to come from a scanner at your own email domain about a document from 'Aficio MP C5000' with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
This E-mail was sent from “RNPF137EA” (Aficio MP C5000).
Scan Date: Wed, 11 Nov 2015 12:53:35 +0300
Queries to: scanner@ [redacted]
11 November 2015: 20151029110925329.xls - Current Virus total detections 4/54*
... downloads http ://conesulmodelismo .com.br/87yte55/6t45eyv.exe ... likely to be Dridex banking malware although completely undetected at the moment (VirusTotal 0/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b2818610715f6e8e9a480b8fb731b1408be157a7f75ca36f0dd34efd28598822/analysis/1447235888/
** https://www.virustotal.com/en/file/a0ba8ae36f33597858d12db1ed576d1b9278d41b58d29d984b4b753d6570e5e9/analysis/1447236803/
TCP connections
95.154.203.249: https://www.virustotal.com/en/ip-address/95.154.203.249/information/
8.253.82.142: https://www.virustotal.com/en/ip-address/8.253.82.142/information/
conesulmodelismo .com.br: 200.169.17.48: https://www.virustotal.com/en/ip-address/200.169.17.48/information/
___
Fake 'PayPal' refund SPAM - malicious link
- http://blog.dynamoo.com/2015/11/malware-spam-refund-from-bowater.html
11 Nov 2015 - "This -fake- PayPal email leads to malware:
From: service@ paypal .co.uk
Date: 11 November 2015 at 16:27
Subject: Refund from Bowater Incorporated
Bowater Incorporated has just sent you a refund
Wed, 11 Nov 2015 17:27:26 +0100
Transaction ID: 47E30904DC4145388
Dear Customer,
Bowater Incorporated has just sent you a full refund of £7849.90 GBP for your purchase.
If you have any questions about this refund, please contact Bowater Incorporated
The refund will go to your PayPal account. It may take a few moments for this transaction to appear in your account.
To see all the transaction details, please download and view from the link below ...
Merchant information
Bowater Incorporated Note from merchant
None provided
Original transaction details
Description Unit price Qty Amount
Purchase from Bowater Incorporated £7849.90 GBP 1 £7849.90 GBP
Insurance: ----
Total: £7849.90 GBP
Refund to PayPal Balance: £7849.90 GBP
Invoice Number: 59266315
Yours sincerely,
PayPal ...
The -link- in the email goes to a download location at sharefile .com which leads to a file transaction details.zip containing a malicious executable 'transaction details.scr'. This binary has a VirusTotal detection rate of just 1/55*. The Hybrid Analysis report** shows network traffic consistent with Upatre download the Dyre banking trojan. One key IP address in 197.149.90.166 (Cobranet, Nigeria) which is well worth blocking."
* https://www.virustotal.com/en/file/6193e4256d68b6f21dd3cd165cc25b9d1502dbff5c8613fd0b63584cc3301fd3/analysis/1447260291/
** https://www.hybrid-analysis.com/sample/6193e4256d68b6f21dd3cd165cc25b9d1502dbff5c8613fd0b63584cc3301fd3?environmentId=1
- http://myonlinesecurity.co.uk/refund-from-agco-corporation-paypal-fake-pdf-malware/
11 Nov 2015 - "An email that looks like it comes from -PayPal- with the subject of 'Refund from AGCO Corporation' pretending to come from service@ paypal .co.uk with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Refund-from-AGCO-Corporation-1024x544.png
11 November 2015: transaction details.zip: Extracts to: transaction details.scr
Current Virus total detections 1/53* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6193e4256d68b6f21dd3cd165cc25b9d1502dbff5c8613fd0b63584cc3301fd3/analysis/1447256652/
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-invoice-si823610-from.html
11 Nov 2015 - "This -fake- invoice does not come from OfficeFurnitureOnline .co.uk but is instead a simple -forgery- with a malicious attachment.
From accounts [accounts@ equip4work .co.uk]
Date Wed, 11 Nov 2015 14:54:33 +0400
Subject Invoice SI823610 from OfficeFurnitureOnline .co.uk Order Ref 4016584
Please find attached a sales invoice from OfficeFurnitureOnline .co.uk.
This email address is only for account enquiries, please check your confirmation
for any information regarding the order details or delivery lead times.
Thank you for your order.
Attached is a file SI823610.XLS which I have seen only one version of in several samples of the email. Usually there are different variants. In this case, the spreadsheet contains this malicious macro... and has a VirusTotal score of 4/54*. According to this Hybrid Analysis report** it then downloads a malicious binary from:
kdojinyhb .wz.cz/87yte55/6t45eyv.exe
In turn, this binary has a detection rate of zero***. Those two reports plus this Malwr report[4] show between them malicious traffic to the following IPs:
95.154.203.249 (Iomart / Rapidswitch, UK)
182.93.220.146 (Ministry Of Education, Thailand)
89.32.145.12 (Elvsoft SRL / Coreix , Romania / UK)
The payload is the Dridex banking trojan.
Recommended blocklist:
95.154.203.249
182.93.220.146
89.32.145.12
wz.cz "
* https://www.virustotal.com/en/file/173189a2f4247f80faf91e160294099f12fa8718659a2633e662fbd9d03280c6/analysis/1447239924/
** https://www.hybrid-analysis.com/sample/173189a2f4247f80faf91e160294099f12fa8718659a2633e662fbd9d03280c6?environmentId=1
*** https://www.virustotal.com/en/file/a0ba8ae36f33597858d12db1ed576d1b9278d41b58d29d984b4b753d6570e5e9/analysis/1447240051/
TCP connections
95.154.203.249: https://www.virustotal.com/en/ip-address/95.154.203.249/information/
8.253.82.142: https://www.virustotal.com/en/ip-address/8.253.82.142/information/
4] https://malwr.com/analysis/YjVhM2M1MmQ1NzQ5NGM2Yzk4MGEzY2NkNzk3MTQ5ZDI/
___
Anti-Virus alone is not enough ...
- https://blog.malwarebytes.org/security-threat/2015/11/three-reasons-why-anti-virus-alone-is-no-longer-enough/
Nov 11, 2015 - "... The malware ecosystem has changed drastically in the past 10 years, to the point that the old precautions are just no longer enough. Here are the three top reasons for this:
• You don’t have to click to get hit. In the past, it was sufficient to simply avoid clicking on suspect links or visiting bad sites. This is no longer the case because of new attack vectors like malvertising. In a malvertising attack, a legitimate site unknowingly pulls malicious content from a bad site, and the malicious content seeks ways (often exploits) to install itself on your computer. You may have heard these attacks called “drive by downloads.” Just by visiting a good site on the wrong day, you get infected...
• Traditional AV response times to new threats are too slow. According to data compiled by Panda Research, traditional AV only stops 30-50 percent of new zero-hour malware when it’s first seen. A few take up to eight hours to reach even the 90 percent level, with the majority needing a full 24 hours. And it takes them a full seven days to get to the high 90’s. That’s a whole lot of time to be missing protection. A recent study by the Enterprise Strategy Group showed that almost -half- of the enterprises polled had suffered a successful malware attack even though they were running anti-virus.
• Exploits are everywhere. Many software products, notably including Java and Flash, were designed in an era when computer security was a much less serious concern. And the worst part of exploit based malware is that the time from the initial exploit to detection and remediation – is on average almost a year...
... we believe in what’s called a layered approach to security.
• The layered approach is just like using a seat belt and an airbag – they both help keep you safe, but they work in different ways. In layered security, you don’t put all your eggs in the AV basket – you use multiple types of defense, each of which has its own strengths, and does different things. An anti-malware program is a zero-day focused, lightweight product that works with your traditional anti-virus product to block threats that AV misses. An anti-exploit program takes a different – yet still complimentary – approach. While anti-malware concerns itself with the what – files, URLs, domains, and so forth, anti-exploit worries about the how. How is a particular application behaving, and is it only performing actions which are expected? Using advanced behavior analysis, anti-exploit can stop a compromise at the beginning of the attack chain, rather than waiting until malware is already installed. And of course, you can augment your vendor provided protection by simply maintaining your computer according to the Three Basic Rules of Online Security, written by expert Brian Krebs:
• Don’t install software you didn’t explicitly request
• Keep your installed software up to date
• If you no longer need a piece of software, uninstall it..."
:fear::fear: :mad:
AplusWebMaster
2015-11-12, 12:45
FYI...
Fake 'Invoice' SPAM - xls malware
- http://myonlinesecurity.co.uk/debbie-haydon-mvmilk-co-uk-invoice-excel-xls-spreadsheet-malware/
12 Nov 2015 - "An email with the subject of 'Invoice' pretending to come from Debbie Haydon <debbie@ mvmilk .co.uk> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Thank you for your order. Your Invoice – V414980 – is attached.
As agreed this invoice will NOT be sent via post.
If you have any questions regarding the attached invoice please telephone our office on 01708 688422.
kind regards
12 November 2015: V414980.XLS - Current Virus total detections 3/54*
... Downloads Dridex banking malware from:
http ://aniretak .wz.cz/5t546523/lhf3f334f.exe -or-
http ://sanoko .jp/5t546523/lhf3f334f.exe (VirusTotal **)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b4afaeb8c54b24c0d3de694407ddab56ba68bdd625410a72e6f918a73bf3a41d/analysis/1447326664/
** https://www.virustotal.com/en/file/77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39/analysis/
TCP connections
95.154.203.249: https://www.virustotal.com/en/ip-address/95.154.203.249/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'Remittance Advice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-remittance-advice.html
12 Nov 2015 - "This fake financial spam does -not- come from Norfolk County Council but is instead a simple -forgery- with a malicious attachment:
From AccountsPayable@ Norfolk .gov.uk
Date Thu, 12 Nov 2015 14:09:46 +0430
Subject Remittance Advice
Dear Sir/Madam,
Please find attached your remittance advice.
Regards,
NCC ...
Attached is a file 6134443_101115_141851.xls which apparently comes in two or three versions, although I have only seen one with a VirusTotal detection rate of 3/54* and containing this malicious macro... These documents then download a malicious binary from:
aniretak .wz.cz/5t546523/lhf3f334f.exe
sanoko .jp/5t546523/lhf3f334f.exe
www .delianfoods .com/5t546523/lhf3f334f.exe
This binary has a VirusTotal detection rate of 3/54**, and that report plus this Hybrid Analysis report*** show malicious traffic to:
95.154.203.249 (Iomart Hosting / Rapidswitch, UK)
182.93.220.146 (Ministry of Education, Thailand)
The payload is the Dridex banking trojan.
Recommended blocklist:
95.154.203.249
182.93.220.146 "
* https://www.virustotal.com/en/file/b4afaeb8c54b24c0d3de694407ddab56ba68bdd625410a72e6f918a73bf3a41d/analysis/1447326664/
** https://www.virustotal.com/en/file/1abf731b8d681d0beccd2eb390be8a61a01bb706a6a625a6d55b5f78a31cb50b/analysis/1447326681/
*** https://www.hybrid-analysis.com/sample/77eb7b7e4593cffacf7a4f30590f3235bbc00c95e1c99726383c8910eef2dc39?environmentId=1
___
Fake 'e-Transfer' SPAM - Dyre banking trojan
- http://blog.dynamoo.com/2015/11/malware-spam-fyi-interac-e-transfer-to.html
12 Nov 2015 - "This -fake- financial spam leads to malware:
From: Bank of Montreal [notify@ payments .interac.ca]
Date: 30 September 2015 at 13:34
Subject: FYI: INTERAC e-Transfer to Guillaume Davis accepted
Dear Customer
The INTERAC e-Transfer for $2997.60 (CAD) you sent to Guillaume Davis was accepted. The transfer is now complete.
Recipient's message: A message was not provided
Thank you for using Bank of Montreal INTERAC e-Transfer Service.
Please follow the link below to download the transaction details ...
The -link- in the email downloads a file INTERAC e-Transfer transaction details.doc which has a VirusTotal detection rate of just 1/53*. Analysis of the malicious code within the downloaded document is pending, however the use of sharefile .com is consistent with the delivery of the Dyre banking trojan."
* https://www.virustotal.com/en/file/fbcd41ac2b4da177e97eb2696703b64c53512ec6aaa7743e4b1feb0c23bfd2ba/analysis/1447342765/
- http://myonlinesecurity.co.uk/fyi-interac-e-transfer-to-rafael-rubery-accepted-royal-bank-of-canada-word-doc-malware/
12 Nov 2015 - "... These are spoofing loads of different Canadian Banks. So far I have also seen Canadian Imperial Bank of Commerce, Royal Bank of Canada, Bank of Montreal all with random names for the recipients of the -fake- INTERAC 'e-Transfer' Service...
12 November 2015: INTERAC e-Transfer transaction details.doc - Current Virus total detections 1/53*
MALWR** which contains an embedded rtf file(VirusTotal 2/54***) , which in turn has an embedded dyre / dyreza banking malware (VirusTotal[4])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/fbcd41ac2b4da177e97eb2696703b64c53512ec6aaa7743e4b1feb0c23bfd2ba/analysis/1447344188/
** https://malwr.com/analysis/OGUxMTUyM2FlOTQ3NDFmNjk2MTMwNzYzNTQ4NDFkNjI/
*** https://www.virustotal.com/en/file/a4ebe247830b8d831d2bd6a3b5a87686ee1c9cc59077dbcfa71b763b46a6cd01/analysis/1447345292/
4] https://www.virustotal.com/en/file/8ad398c290ca18eed2deab055073f3053fa67d4845736c7be9d1e58e94600632/analysis/1447345341/
___
Buhtrap gang distributed malware thru Ammyy’s remote desktop software
- http://net-security.org/malware_news.php?id=3154
12.11.2015 - "... Researchers noticed in late October that, for about a week, visitors to ammyy .com were downloading an installer that contained malware along with the Ammyy product. While Ammyy Admin is legitimate software, it has a long history of being used by fraudsters, and several security products detect it as a Potentially Unsafe Application. Similarly, Download .com, a major download site, doesn’t provide a direct-download link to Ammyy software to users, instead listing the Ammyy Admin page for information purposes only. However, Ammyy Admin is still widely used: Ammyy’s website lists clients that include TOP500 Fortune companies as well as Russian banks. According to the investigation, -five- different malware families were distributed through Ammyy’s website during the recent incident. The first malware, the Lurk downloader, was distributed on October 26. Next was Corebot on October 29, then Buhtrap on October 30, and finally Ranbyus and Netwire RAT on November 2.
Although these families are not linked, the droppers that could potentially have been downloaded from Ammyy’s website were the same in every case. Thus it is quite possible that the cybercriminals responsible for the website hack sold the access to different groups. Of the malware distributed via Ammyy’s website, of particular interest is the install package used in Operation Buhtrap. “The fact that cybercriminals now use strategic web compromises is another sign of the gap closing between techniques used by cybercriminals and by actors behind so called Advanced Persistent Threats,” said Jean-Ian Boutin, Malware Researcher at ESET."
- http://www.welivesecurity.com/2015/11/11/operation-buhtrap-malware-distributed-via-ammyy-com/
:fear::fear: :mad:
AplusWebMaster
2015-11-13, 13:32
FYI...
'Magnitude EK' activity increases via Malvertising attacks
- https://blog.malwarebytes.org/exploits-2/2015/11/magnitude-exploit-kit-activity-increases-via-malvertising-attacks/
Nov 13, 2015 - "During the past few days we have noticed a higher than usual number of 'malvertising attacks' pushing the Magnitude exploit kit – which had been relatively quiet – to drop ransomware. Magnitude EK is one of those exploit kits we don’t hear about as much in comparison to others such as Angler EK or Nuclear EK. Its unique URL pattern makes it easy to spot from the clutter of network traffic captures because it uses chained subdomains typically ending in a shady Top Level Domain like -pw- (Palau Pacific island)... Perhaps this increased activity is due to the fact that Magnitude EK is the third exploit kit to leverage the latest Flash Player vulnerability (CVE-2015-7645*) recently patched by Adobe... CryptoWall was dropped via two separate malware binaries..."
* Latest Flash version is -19.0.0.245- check yours to avoid trouble:
> https://www.adobe.com/software/flash/about/
___
Fake 'Telstra bill' SPAM - xls malware
- http://myonlinesecurity.co.uk/our-new-telstra-bill-for-account-2000514059862-is-attached-excel-xls-spreadsheet-malware/
13 Nov 2015 - "An email with the subject of 'our new Telstra bill for account 2000514059862 is attached' pretending to come from telstraemailbill_noreply8@ online .telstra .com with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Your-new-Telstra-bill-for-account-2000514059862-is-attached-1024x580.png
13 November 2015: TRPB_1_1107991874.pxls - Current Virus total detections 3/54*
... some of these emails have a plxs attachment which I never heard of. It is either a mistake by the malware bot sender or it is a new excel extension that needs a new version of excel to open it. My gut feel is that it was a mistake and the P added in error. Renaming the file to a simple xls makes it work as normal and shows a download of Dridex banking malware from
http ://rgr-sa .ch/~testing/345u754/433fd.exe (VirusTotal 3/53**). Many other copies of the email had a -normal- xls extension... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21.png
...The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9ce4022b73e9c9f656de082d6ae6374d1aa4e391ac06597c218a32255b0a4ef4/analysis/1447408547/
** https://www.virustotal.com/en/file/0173188d48bbc9dc5cefb6adb8fd0cd12e546b5c9e87c296fecf7bc102f65293/analysis/1447409290/
TCP connections
78.47.66.169: https://www.virustotal.com/en/ip-address/78.47.66.169/information/
88.221.14.122: https://www.virustotal.com/en/ip-address/88.221.14.122/information/
___
Fake 'Invoice' SPAM - xls malware
- http://myonlinesecurity.co.uk/november-invoice-inv-9771-from-eye-on-books-excel-xls-spreadsheet-malware/
13 Nov 2015 - "An email with the subject of 'November Invoice INV-9771' from 'Eye on Books' pretending to come from Charles Klvana <message-service@ post .xero .com> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Hi,
Please find attached this months invoice for Xero & Receiptbank software. You’ve completed a direct debit form, so this will have been paid from your nominated account, so please don’t send through payment separately.
Thanks again for your business, it’s greatly appreciated.
Kind regards,
Charles Klvana
EYE ON BOOKS
13 November 2015 : Invoice INV-9771.xls - Current Virus total detections 3/52* ... the same malware downloading the same Dridex banking malware as described in this post**..."
* https://www.virustotal.com/en/file/ceaec1cb1c1b6856cf1f2b607bc1eae7e350ddecd25b7232ff496a34aa688eb2/analysis/1447409851/
** http://myonlinesecurity.co.uk/our-new-telstra-bill-for-account-2000514059862-is-attached-excel-xls-spreadsheet-malware/
___
Fake 'Statements' SPAM - xls malware
- http://myonlinesecurity.co.uk/statements-and-related-documents-for-october-david-bartels-miriam-benda-professionals-ashgrove-excel-xls-spreadsheet-malware/
13 Nov 2015 - "The -third- version of a Dridex dropper today so far is an email with the subject of 'Statement(s) and related document(s) for October' pretending to come from David Bartels <davebartels228@ gmail .com> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear Sir/Madam
Please find attached:
Your Statement(s) and related document(s) for October.
Regards,
Miriam Benda
Professionals Ashgrove
13 November 2015: Mai49621.xls Same malware although -renamed- that downloads the same Dridex banking malware from the same locations as described in today’s earlier malspam runs [1] [2]...
1] http://myonlinesecurity.co.uk/november-invoice-inv-9771-from-eye-on-books-excel-xls-spreadsheet-malware/
2] http://myonlinesecurity.co.uk/our-new-telstra-bill-for-account-2000514059862-is-attached-excel-xls-spreadsheet-malware/
___
Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/november-invoice-78909675-wahl-canada-word-doc-malware/
13 Nov 2015 - "An email with the subject of 'November Invoice #78909675' pretending to come from Logan Courtney <CourtneyLogan8935@ olivainsurance .com> (probably random, -faked- headers) with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Hello ,
Please review the attached copy of your Electronic document.
A paper copy of this document is being mailed, but this email is being sent in addition for your convenience.
Thank you for your business,
Wahl Canada Inc.
NOTICE OF CONFIDENTIALITY. This communication, including any information transmitted with it, is intended only for the use of the individual(s) to which it is addressed and is confidential. If you are not an intended recipient...
13 November 2015: INVOICE-78909675.doc - Current Virus total detections 0/54*
This has an embedded ole object in base 64 format that I couldn’t manually decode however MALWR** showed it connecting to http ://109.234.37.214 /alikaps/terminator.php where it downloaded ulysse.exe (VirusTotal 1/51***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/87aa26f16d507f66386c2f1d60f00499aab7aaeeea723d5bb848abbc9f2f4055/analysis/1447416661/
** https://malwr.com/analysis/NWYyMzAwNGM5OTFiNGNmZWI0MTU4MDc2MjFiZjIzMTg/
*** https://www.virustotal.com/en/file/7ce325939050960112a5c038734e6db2ea0789fdacdfa1110b276e78dd192c25/analysis/1447417050/
TCP connections
85.214.152.31: https://www.virustotal.com/en/ip-address/85.214.152.31/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
109.234.37.214: https://www.virustotal.com/en/ip-address/109.234.37.214/information/
> https://www.virustotal.com/en/file/e3ea28357fafb0bb70de56983bac7f780c8a5cfd3c784e0965331dd7af3933d2/analysis/
ulysse.exe 0/54
___
Fake 'Payment Confirmation' SPAM - doc malware
- http://myonlinesecurity.co.uk/transaction-and-payment-confirmation-from-spilo-worldwide-word-doc-malware/
13 Nov 2015 - "An email with the subject of 'Transaction and Payment Confirmation' from Spilo Worldwide pretending to come from random names, companies and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Transaction and Payment Confirmation from Spilo Worldwide
13 November 2015: Spilo_Worldwide_payment_17650687.doc - Current Virus total detections 0/54*
This is another one of the -new- type macro downloaders that I first saw earlier today that have an embedded base 64 file inside the word doc that uses a post command to a php file on a remote server instead of the more usual -get- to download malware. MALWR analysis shows that this one contacts http ://91.223.88.54 /alikaps/terminator.php to download a different Dridex version by the same file name ulysse.exe from today’s earlier one (VirusTotal 0/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/4e56c84d20accba4f66496221a0d192cd5e7760690f6a9e71fcb3f973b095566/analysis/1447423504/
** https://www.virustotal.com/en/file/e3ea28357fafb0bb70de56983bac7f780c8a5cfd3c784e0965331dd7af3933d2/analysis/1447425228/
91.223.88.54: https://www.virustotal.com/en/ip-address/91.223.88.54/information/
> https://www.virustotal.com/en/file/e3ea28357fafb0bb70de56983bac7f780c8a5cfd3c784e0965331dd7af3933d2/analysis/
ulysse.exe 0/54
... Behavioural information
TCP connections
85.214.152.31: https://www.virustotal.com/en/ip-address/85.214.152.31/information/
> https://www.virustotal.com/en/file/e3ea28357fafb0bb70de56983bac7f780c8a5cfd3c784e0965331dd7af3933d2/analysis/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
:fear::fear: :mad:
AplusWebMaster
2015-11-16, 14:00
FYI...
Fake 'DHL' SPAM - PDF malware
- http://myonlinesecurity.co.uk/dhl-express-credit-card-billing-adjustment-ref-3383095-fake-pdf-malware/
16 Nov 2015 - "... An email with the subject of 'DHL Express – Credit Card Billing Adjustment. Ref# 3383095' pretending to come from eInvoicing <groupadminstubbinsDONOTREPLY@ tnt .com> with a zip attachment is another one from the current bot runs... The content of the email says :
DHL Express Customer:
The attached file details adjustments that have been made to shipping charges originally billed to your credit card. These adjustments are for charges or credits that have occurred after the initial processing of your shipment(s). These adjustments have been applied to your credit card and will appear on your next credit card statement.
All shipments are subject to the terms and conditions contained in the DHL Express Tariff and the DHL Express Terms and Conditions of Service...
16 November 2015: dhl16112015_6987878544212.zip: Extracts to: dhl16112015_6987878544212exe
Current Virus total detections 2/54* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/9eadcc852b87429dfb8c7e61da7951a8fb8c28eb88ec91d90eea290248747dff/analysis/1447663550/
___
Fake 'Toll' SPAM - xls malware
- http://myonlinesecurity.co.uk/toll-ipec-invoicestatement-80458249-excel-xls-spreadsheet-malware/
16 Nov 2015 - "An email with the subject of 'Toll IPEC invoice/statement (80458249)' pretending to come from ipecar@ tollgroup .com with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Please find attached your current Toll IPEC invoice/statement..
Should you have a query with your account, please contact the telephone number detailed on your invoice/statement or email your enquiry to ipecar@ tollgroup .com
16 November 2015 : 80458249_1519.pxls - Current Virus total detections 3/55*
... Downloads Dridex banking malware from http ://gospi .eu/~gospi/45yfqfwg/6ugesgsg.exe (VirusTotal 1/55**)... the xls spreadsheet has been accidentally renamed to pxls, so windows doesn’t know what to do with it. Some versions then were PXLS and some proper XLS... Other download locations include www .kolumbus .fi/~kf0963/45yfqfwg/6ugesgsg.exe and piotrektest .cba .pl/45yfqfwg/6ugesgsg.exe ... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/cefc0857a0dda3991bdad3aa3800b1175c96c7acb8feaa6cffed0b79ce649a13/analysis/1447675709/
** https://www.virustotal.com/en/file/46aeb8a5464513ae306610154e55fdcd8646f5d79904d40bc729cf0de7c3e100/analysis/1447675703/
TCP connections
182.93.220.146: https://www.virustotal.com/en/ip-address/182.93.220.146/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'Invoices' SPAM - doc malware
- http://myonlinesecurity.co.uk/accounting-specialist-metropolitan-an-rr-donnelley-company-2-invoices-attached-word-doc-malware/
16 Nov 2015 - "An email with the subject of '2 Invoices Attached' pretending to come from random names, companies and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Good morning,
Please see the attached invoices and remit payment according to the terms listed at the bottom of the invoice. If you have any questions please let us know.
Thank you!
Loris Lecomte
Accounting Specialist| Metropolitan, An RR Donnelley Company
16 November 2015 : invoices_59830277.doc - Current Virus total detections 2/55*
... Downloads Dridex banking malware from http ://185.80.53.15 /bermuda/triangle.php and other locations (VirusTotal 2/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f00bc4f8f7d88fb8866aa98d0eebebca0f2f1210745c33495f4caaf860dfe116/analysis/1447685993/
** https://www.virustotal.com/en/file/2e8a7fe250d97d0157a4ae4c4a675ccf5693db2d5cf2f0409c72e8df835bf94f/analysis/1447692609/
TCP connections
85.214.152.31: https://www.virustotal.com/en/ip-address/85.214.152.31/information/
88.221.14.130: https://www.virustotal.com/en/ip-address/88.221.14.130/information/
185.80.53.15: https://www.virustotal.com/en/ip-address/185.80.53.15/information/
___
Fake 'Remittance' SPAM - doc malware
- http://myonlinesecurity.co.uk/cook-medical-cook-remittance-advice-ach-word-doc-malware/
16 Nov 2015 - "An email with the subject of 'COOK Remittance Advice-ACH' pretending to come from random companies, names and email addresses with a malicious word doc or attachment is another one from the current bot runs... The email looks like:
Please find attached your Remittance Details for the funds that will be deposited to your bank account, PLEASE ALLOW 1-2 BUSINESS DAYS.
Cook Medical is now sending through the bank the addenda information including your remit information.
If you are not seeing your addenda information in your bank reporting you may have to contact your local bank representative.
Accounts Payable
16 November 2015: invoice_details_59282006.doc - Current Virus total detections 3/54*
... Downloads the same Dridex banking malware from the same locations as described in this earlier post**..."
* https://www.virustotal.com/en/file/b284caf6cf031ed3ac01a7149a6779f34be62cce8be132418f83a548603f4b58/analysis/1447694373/
** http://myonlinesecurity.co.uk/accounting-specialist-metropolitan-an-rr-donnelley-company-2-invoices-attached-word-doc-malware/
___
Fake 'DoT' SPAM - xls malware
- http://myonlinesecurity.co.uk/dot-payment-receipt-excel-xls-spreadsheet-malware/
16 Nov 2015 - "An email with the subject of 'DoT Payment Receipt' pretending to come from donotreply@ transport .gov .uk with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
[Automated message. Do not reply]
Thank you for your payment. It is important that you print this receipt and record the receipt number as proof of your payment. You may be asked to provide your receipt details should you have an enquiry regarding this payment.
DISCLAIMER
This email and any attachments are confidential and may contain legally privileged
and/or copyright material. You should not read, copy, use or disclose any of the
information contained in this email without authorisation. If you have received it in
error please contact us at once by return email and then delete both emails. There is
no warranty that this email is error or virus free.
16 November 2015: PaymentReceipt.xls - Current Virus total detections 3/53*
... Same downloader that downloads the same Dridex banking malware from different locations as described in today’s other malspam run** ..."
* https://www.virustotal.com/en/file/ae7841ed3c8a41e19ed7c21b3b698cc2a287feadd0f7239057ce9aa4b5f6fd3e/analysis/1447676687/
** http://myonlinesecurity.co.uk/toll-ipec-invoicestatement-80458249-excel-xls-spreadsheet-malware/
- http://blog.dynamoo.com/2015/11/malware-spam-dot-payment-receipt.html
16 Nov 2015 - "... This binary has a detection rate of 3/53* and that VirusTotal report and this Malwr report** indicates malicious traffic to:
182.93.220.146 (Ministry Of Education, Thailand)
78.47.66.169 (Hetzner, Germany)
89.108.71.148 (Agava, Ltd)
221.132.35.56 (Post And Telecom Company, Vietnam)
The payload is the Dridex banking trojan...
Recommended blocklist:
cba.pl
182.93.220.146
78.47.66.169
89.108.71.148
221.132.35.56 "
* https://www.virustotal.com/en/file/e3ac1aa13026feb600371d2ae37a55b682d3efb857dd6573da7987f7c01f52de/analysis/1447681458/
** https://malwr.com/analysis/NDU0ZGQxZjBhOWNkNDZlZGI3Y2FkMjliYTllNzFlMDc/
___
Google ID: Profile Inaccurate – Phish...
- http://myonlinesecurity.co.uk/google-id-profile-inaccurate-phishing/
15 Nov 2015 - "An email saying 'Google ID: Profile Inaccurate' pretending to come from Google Support [secure@ googleaccountaudit .com] is a phishing attempt. One of the major common subjects in this sort of phishing attempt is 'Your password will expire soon' or 'update your email' or 'your profile is inaccurate' or 'needs updating' or something very similar. This one wants your Google Account log in details, name, credit/debit card, birthdate, address, telephone etc. In fact just about everything that will identify you & take over your accounts and identity... The original email looks like:
From: Google Support [mailto: secure@ googleaccountaudit .com]
Sent: 15 November 2015 13:30 To: [REDACTED]
Subject: Google ID: Profile Inaccurate
[redacted] Account Notice
Please confirm your Google Account [redacted]
We have attempted to get in touch with you on three previous occasions with reference to the European Commissions eID service Regulation (EU) N°910/2014 that requires us ‘Google Inc’ to check the authenticity of Google users in Europe. Because your Google account [redacted] has now passed the deadline it’s at risk of termination within 48 hours unless you review your details... We apologize for any inconivnece this may cause but unless this is addressed your Google account [redacted] will be suspended pending deletion from all Google services.
Confirm Google Account
Forgot your password? Reset it now
Sincerely, Google Support Team
© 2015 Google Inc. 3488 Amphitheatre Drive, Mountain View, CA 41845 You [redacted] have received this mandatory email service announcement to update you about important changes to your Google product or account .
... [DO NOT] follow the link, you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Google-ID-Profile-Inaccurate_1-1024x550.png
... If you do fill in the details you get sent on to the next page:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Google-ID-Profile-Inaccurate_2-1024x561.png
All of these emails use Social engineering tricks to persuade you to follow the links or open the attachments that come with the email... make sure you have “show known file extensions enabled“..."
___
MS 'Outlook Web Access' – Phish ...
15 Oct 2015 - "... a lot of phishing attempts against Microsoft Outlook Web Access (Microsoft Outlook Web App (formerly known as Outlook on the Web or Outlook Web Access) is a browser-based email client. Outlook Web App lets you access your Microsoft Exchange Server mailbox from almost any web browser.) These sort of phishing attempts are much harder to protect against, because the OWA web address will -not- be a Microsoft website or any common site name but is normally a subdomain or part of your own company web domain. To make it harder, many companies do have numerous different email domains, so email messages might come from any of the company domains. To make it even more plausible, many companies have policies that insist on a user updating and changing their passwords every 30 or 60 or 90 days... One of the major common subjects in this sort of phishing attempt is Your password will expire soon or update your email or something very similar. This one wants only wants your email log in details...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Your-password-will-expire-soon_email-1024x420.png
... The from address is -spoofed- to read from Administrator <s.moran@ whitgift .co.uk> whereas a very high proportion of them will be spoofed to appear to come from Administrator @ your own email domain. If you are unwise enough to follow the link you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Your-password-will-expire-soon-1024x514.png
... If you do fill in the details you get sent on to the next page saying :
Your information was successfully submitted, please ensure that you entered your email details correctly; to enable us complete your security updates. If you have entered your details wrongly kindly click back and refill in details correctly.
N.B Please be informed that filling in the wrong details will be resulting to the deactivation of your email address.
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Your-password-will-expire-soon2-1024x355.png
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email... Or whether it is a straight forward attempt, like this one, to steal your personal, bank, credit card or email and social networking log in details..."
:fear::fear: :mad:
AplusWebMaster
2015-11-17, 16:28
FYI...
Britain to build cyber attack forces to tackle IS, hackers
- http://www.reuters.com/article/2015/11/17/us-britain-security-cybersecurity-idUSKCN0T604K20151117
Nov 17, 2015 - "British spies are building elite cyber offensive forces to strike at Islamic State fighters, hackers and hostile powers, finance minister George Osborne said on Tuesday after warning militants wanted to launch deadly digital attacks. Islamic State was trying to develop the capability to attack British infrastructure such as hospitals, power networks and air traffic control systems with potentially lethal consequences, Osborne said. In response, Britain will bolster spending on cyber defenses, simplify its state cyber structures and build its own offensive cyber capability to attack adversaries... Britain's new cyber attack forces will be run jointly between GCHQ and the Defence Ministry and will target individual hackers, criminal gangs, militant groups and hostile powers, using a "full spectrum" of actions, Osborne said..."
___
Casino Malvertising Campaign
- https://blog.malwarebytes.org/malvertising-2/2015/11/the-casino-malvertising-campaign/
Nov 17, 2015 - "We identified one of the largest malvertising campaigns in recent months going through -10- different ad domains receiving massive volumes of Internet traffic. Although we only recently uncovered and reported this campaign, telemetry data indicates that it actually started on October 21, making this at least a three-week operation. This malvertising attack preyed on visitors to sketchy websites offering anything from torrents of copyrighted movies, live streams of the latest flicks, or pirated software. The malicious ads would automatically (no click required) redirect users to a casino website used as decoy to silently load malicious iframes from disposable domains which ultimately lead to the Angler exploit kit. In one case, the casino website was a direct gateway to Angler EK. The ad networks were almost all registered via Domains By Proxy LLC, meaning -no- information was available about the registrant but they were all through GoDaddy and on the same ASN: AS15169. This made us believe that they were actually all related to one another. Moreover, one of them, AdCash, did have a point of contact and this is how we were able to report the incidents. A look at some of the stats behind those ad domains shows some staggering numbers. According to SimilarWeb a service that estimates website traffic and provides various analytics, these ad networks generated over 2 -billion- visits in October. To be clear, this is -not- how many people were exposed to malvertising since this only affected a few particular rogue campaigns, and not all campaigns running on these networks... before September, the traffic on those three domains was quasi nonexistent but all of the sudden spiked through the roof for a combined total of over 1 million visits:
> https://blog.malwarebytes.org/wp-content/uploads/2015/11/similarweb.png
... a very large number of people were exposed to malware because of this campaign. Over the three-week course, several different payloads were dropped by Angler EK. We found the infamous CryptoWall ransomware as well as the Bunitu Trojan... We contacted AdCash on November 10th and the following day the malvertising attacks appeared to have stopped. However, on November 14th we observed -another- incident again also using one of the casino websites but with a .space domain now to redirect to Angler EK... We will continue to monitor and report future incidents we encounter via this ad network and take necessary actions to protect our users from malware.
Highlights:
• Torrent, crack, video sites targeted
• Malvertising via AdCash and related networks (> 2 billion traffic)
• Casino websites used a decoy/redirectors ( > 1 million traffic)
• Angler exploit kit
• Over 30 different malware payloads
• Three-week campaign ..."
> https://blog.malwarebytes.org/wp-content/uploads/2015/11/Casino_Flow.png
___
Blackhole EK resurfaces...
- https://blog.malwarebytes.org/exploits-2/2015/11/blast-from-the-past-blackhole-exploit-kit-resurfaces-in-live-attacks/
Nov 17, 2015 - "... a threat actor is using the defunct Blackhole exploit kit in active drive-by download campaigns via -compromised- websites. We noticed Java and PDF exploits collected by our honeypot which we haven’t seen in ages. Looking closer at the structure of this attack, we were surprised when we realized this was the infamous Blackhole. Blackhole’s author, Paunch, was arrested in October 2013 and while criminals kept using the kit for the next few months, the exploits slowly deprecated and lost value because of lack of development. The new drive-by download attacks we caught over the weekend rely on the same structure as the original Blackhole, even reusing the old PDF and Java exploits. The only difference is the malware payload being dropped, which is current and had very -low- detection on VirusTotal... Although the exploits are old, there are probably still vulnerable computers out there who could get compromised. We also noticed that the author behind this Blackhole edition was working on new landing pages, so it is possible there might be additional changes in the future... Indicators of compromise: Server IP: 88.208.0.217 ..."
:fear::fear: :mad:
AplusWebMaster
2015-11-18, 14:13
FYI...
Fake 'Statement' SPAM - xls malware
- http://myonlinesecurity.co.uk/paul-barnett-copy-statement-bausch-lomb-excel-xls-spreadsheet-malware/
18 Nov 2015 - "An email with the subject of 'Copy Statement' pretending to come from Barnett, Paul <Paul.Barnett@ bausch .com> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Copy-Statement-Paul-Barnett-1024x509.png
18 November 2015 : Statement client 0091293(1).xls - Current Virus total detections 4/54*
... Downloads Dridex banking malware from one of these locations http ://www.samsoncontrols .co.uk/h64gf3/89j6cx.exe -or-
http ://iraqiairways .co.uk/h64gf3/89j6cx.exe (VirusTotal 2/39**)
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e7038a8bf45436ae129f5ca49870675404a1d3af6987e47b6dd8f1b337c11097/analysis/1447836428/
** https://www.virustotal.com/en/file/6c02eed279f26a69678edc7b254316173c79f04a36c6f9fb61701478d318ed40/analysis/1447837417/
TCP connections
182.93.220.146: https://www.virustotal.com/en/ip-address/182.93.220.146/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'Invoices' SPAM – PDF malware
- http://myonlinesecurity.co.uk/cic-invoices-fake-pdf-malware/
18 Nov 2015 - "An email about CIC Group Invoices with the subject of 'Invoices' pretending to come from CIC Group <admin@ cic .fr> with a zip attachment is another one from the current bot runs... The content of the email says:
... Please review the attached invoices and pay them at your earliest convenience. Feel free to contact us if you have any questions.
Thank you.
18 November 2015: facture_37854634_181115.zip: Extracts to: facture_37854634_181115.exe
Current Virus total detections 3/54*
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/24692e4c3f215a41f6b514efc21549a4fc60b2587c5d79f6954a369b5fed401e/analysis/1447850791/
___
Fake 'invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-or-payment-word-doc-malware/
18 Nov 2015 - "An email with random subjects that are 2 or 3 letters and then the word invoice or payment, like 'ZV Payment' or 'MU Invoice' or 'SBN Payment' pretending to come from random names, companies and email addresses with a random named malicious word doc attachment is another one from the current bot runs... The email looks like:
Processing Number: M19Q0R5VG842B
A new Status: Error
Total Amount: 20741.84 Great Britain Pounds
Please click the document attached with this email to see more info.
-Or-
Payment: L6174S1E
Status: Authorised
Transaction Total: 23018.32 GBP
Please click the document attached with this email to get more information.
-Or-
Transaction: S1970110
A new State: Voided
Total Amount: 35079.44 Great Britain Pounds
Please check the file attached with this email to have more info.
18 November 2015: VTJ0W7M7VX5.doc - Current Virus total detections 4/55*
MALWR analysis** shows a connection to http ://classic-eng .com/ge.jpg?7538 and a download AhkD7UHKJjGS08990.exe (VirusTotal 4/55**). Full analysis of this download is pending but is very likely to be Dridex banking malware... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/eeb99c54a862b88ab73e5e0369f5c61ca20293f903f08a8d88c562307fc193de/analysis/1447830052/
** https://malwr.com/analysis/OTY2Y2QwMTA0Y2QwNDhhZmJlNmQxMTQxMmU1NWUzMjQ/
*** https://www.virustotal.com/en/file/9c9763f22d9764adcc427fc3d916874de298899a010ed8746745c136149e7834/analysis/1447831128/
TCP connections
78.129.133.249: https://www.virustotal.com/en/ip-address/78.129.133.249/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'Receipt' SPAM - xls malware
- http://myonlinesecurity.co.uk/here-is-your-credit-card-receipt-attached-xls-spreadsheet-malware/
18 Nov 2015 - "An email saying 'Here is your credit card receipt attached' with the subject of 'Receipt' pretending to come from Mike <mike@xencourier .co .uk> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Hi
Here is your credit card receipt attached. VAT invoice to follw in due course.
Best regards
Mike
This email is free from viruses and malware ...
18 November 2015: scan0001.xls - Current Virus total detections 6/55*
MALWR analysis** shows me that this is the -same- malware dropper attempting to download an updated version of the Dridex banking malware as described in today’s earlier malspam run***
http ://www .samsoncontrols .co .uk/h64gf3/89j6cx.exe (the company has removed the malware and hopefully cleaned and fixed the vulnerabilities that allowed them to be used as a conduit for malware distribution). Warning: there were other locations mentioned earlier that might still be live. The http ://iraqiairways .co.uk/h64gf3/89j6cx.exe is still -live- and giving an updated version (virustotal[4])... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/26506a03b76c6244df28db631f94dfd145753431adff482083223146ecb1f91b/analysis/1447851533/
** https://malwr.com/analysis/N2JiNDk1ZjRmZmNkNDE0Nzg3ZjdiZTcwZjE3Zjg4MTM/
*** http://myonlinesecurity.co.uk/paul-barnett-copy-statement-bausch-lomb-excel-xls-spreadsheet-malware/
4] https://www.virustotal.com/en/file/5c71fa337a8d536de1c35b793a52fa88ee2302bfae8a16dd39c40d4115b4e65e/analysis/1447851743/
TCP connections
203.172.180.195: https://www.virustotal.com/en/ip-address/203.172.180.195/information/
8.253.82.62: https://www.virustotal.com/en/ip-address/8.253.82.62/information/
- http://blog.dynamoo.com/2015/11/malware-spam-receipt-mike.html
18 Nov 2015 - "... it has a malicious attachment scan0001.xls which appears to come in at least -three- different versions... These contain a malicious macro... they attempt to download a malicious binary from the following locations:
www .eurocontainers .it/h64gf3/89j6cx.exe
www .asnp .it/h64gf3/89j6cx.exe
www .samsoncontrols .co.uk/h64gf3/89j6cx.exe [file not found]
This binary has a detection rate of 7/54* and that VirusTotal report and this Malwr report** both indicate malicious network traffic to:
203.172.180.195 (Ministry Of Education, Thailand)..."
* https://www.virustotal.com/en/file/5c71fa337a8d536de1c35b793a52fa88ee2302bfae8a16dd39c40d4115b4e65e/analysis/1447858997/
TCP connections
203.172.180.195: https://www.virustotal.com/en/ip-address/203.172.180.195/information/
8.253.82.62: https://www.virustotal.com/en/ip-address/8.253.82.62/information/
** https://malwr.com/analysis/MTU2YTZiMGU3MTc0NGQzODk4MTU1OTNlOTYyMzljZDY/
___
Fake 'InTuIT' SPAM - malware
- http://myonlinesecurity.co.uk/quickbooks-intuit-important-notification-malware/
Nov 18, 2015 - "An email saying you need to update your InTuIT QuickBooks with the subject of 'INTUIT Important Notification' pretending to come from INTUIT QB <qbsupport@ services .intuit .com> with a zip attachment is another one from the current bot runs... Other subjects in this malspam series include:
• INTUIT QB
• INTUIT Please Notify!
• INTUIT QB
• INTUIT QuickBooks
• INTUIT QB Security Warning
• INTUIT Attention
• Intuit QuickBooks Online: Browser Update
• Intuit QuickBooks Online: Supported Browsers
• INTUIT Supported Browsers Update
• INTUIT Security Warning
Other alleged senders include:
• INTUIT QB <services@ quickbooks .intuit .com>
• quickbooks <qbsecuritycenter@ intuit .com>
• INTUIT QB <services@ quickbooks .intuit .com>
• QuickBooks Online <security@ services .qb .intuit .com> ...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/INTUIT-Important-Notification-1024x662.png
18 November 2015: INTUIT-Browser-up1247.zip: Extracts to: up1247.exe
Current Virus total detections 2/55*
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like an icon of an excel file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/48d7e9385ba7708019e1817c6fe76f706bb36dd1433b017b9b6330436efe0606/analysis/1447857402/
TCP connections
89.163.249.75: https://www.virustotal.com/en/ip-address/89.163.249.75/information/
188.247.102.215: https://www.virustotal.com/en/ip-address/188.247.102.215/information/
UDP communications
8.8.8.8: https://www.virustotal.com/en/ip-address/8.8.8.8/information/
- http://blog.dynamoo.com/2015/11/mystery-intuit-quickbooks-spam-leads-to.html
18 Nov 2015 - "... Screenshot:
> https://1.bp.blogspot.com/-jqzrc2_aW3Y/Vkyln1SIkyI/AAAAAAAAHYk/zEfd1xsli1c/s400/intuit.png
The -link- in the email goes to:
kompuser .com/system/logs/update/doc.php?r=download&id=INTUIT-Browser-up1247.zip
This downloads a file INTUIT-Browser-up1247.zip which in turn contains a malicious executable up1247.exe ... which has a VirusTotal detection rate of 2/54*. That VirusTotal report and this Hybrid Analysis report** show that the malware POSTs data to:
onbrk .in/p7yqpgzemv/index.php
The payload is unknown... the same nameservers and have also been used for malicious activity going back to August... Recommended blocklist:
31.210.116.68
188.247.102.215
89.163.249.75
95.173.164.212
kompuser .com
onbrk .in ..."
(More at the dynamoo URL above.)
* https://www.virustotal.com/en/file/48d7e9385ba7708019e1817c6fe76f706bb36dd1433b017b9b6330436efe0606/analysis/1447863072/
TCP connections
89.163.249.75: https://www.virustotal.com/en/ip-address/89.163.249.75/information/
188.247.102.215: https://www.virustotal.com/en/ip-address/188.247.102.215/information/
UDP communications
8.8.8.8: https://www.virustotal.com/en/ip-address/8.8.8.8/information/
** https://www.hybrid-analysis.com/sample/48d7e9385ba7708019e1817c6fe76f706bb36dd1433b017b9b6330436efe0606?environmentId=1
- https://security.intuit.com/alert.php?a=271
11/18/15
- https://security.intuit.com/alert.php?a=270
11/18/15
___
Infoblox - DNS Threat report
- http://net-security.org/malware_news.php?id=3155
18.11.2015 - "The creation of DNS infrastructure by cybercriminals to unleash exploit kits increased 75 percent in the third quarter of 2015 from the same period in 2014, according to Infoblox:
> http://www.net-security.org/images/articles/infoblox-112015.jpg
... Highly skilled attackers can create exploit kits, which are packages for delivering a malware payload, and then sell or rent these toolkits to those with little technical experience - vastly increasing the ranks of malicious attackers capable of going after individuals, businesses, schools, and government agencies. -Four- exploit kits - Angler, Magnitude, Neutrino, and Nuclear - accounted for -96- percent of total activity in the category for the third quarter. Most exploit kit attacks are distributed through spam emails or compromised web sites, or are embedded in online ads. When users click a link in the emails or ads, the exploit kit takes advantage of vulnerabilities in popular software to deliver a malware payload that can perform actions such as planting ransomware, capturing passwords for bank accounts, or stealing an organization’s data. Cybercriminals need the DNS to register domains for building the “drive-by” locations where exploit kits lie in wait for users, and for communicating with command-and-control servers that send instructions to infected devices and extract information..."
> https://www.infoblox.com/dns-threat-index
Video: 2:49
:fear::fear: :mad:
AplusWebMaster
2015-11-19, 13:29
FYI...
Fake 'Shipping notification' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-shipping-notification.html
19 Nov 2015 - "This rather terse spam does -not- come from Ceva Logistics but is instead a simple -forgery- with a malicious attachment.
From: noreply@ cevalogistics .com
Date: 19 November 2015 at 10:27
Subject: [Shipping notification] N3043597 (PB UK)
There is -no- body text and the "N" number is randomly generated. All samples I have seen contain a file called shipping-notification.xls which is in the same in all cases, containing this malicious macro... it has a VirusTotal detection rate of 2/54*. The comments on that VirusTotal report plus this Hybrid Analysis report** indicate a malicious binary is downloaded from:
iwcleaner .co.uk/8i65h4g53/o97i76u54.exe
This has an MD5 of e0d24cac5fb16c737f5f016e54292388 and a detection rate of 2/54*** and this Hybrid Analysis report[4] shows malicious traffic to the following IP (which I recommend you block):
182.93.220.146 (Ministry of Education, Thailand)
The payload is almost definitely the Dridex banking trojan."
* https://www.virustotal.com/en/file/f8f6572a592f40a0b1a0c126fc2d4cb45b9cafaf0ccda76b0dfe940e7355531b/analysis/1447929870/
** https://www.hybrid-analysis.com/sample/f8f6572a592f40a0b1a0c126fc2d4cb45b9cafaf0ccda76b0dfe940e7355531b?environmentId=1
*** https://www.virustotal.com/en/file/477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892/analysis/1447930055/
TCP connections
182.93.220.146: https://www.virustotal.com/en/ip-address/182.93.220.146/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
4] https://www.hybrid-analysis.com/sample/477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892?environmentId=2
___
Fake 'Google invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-your-google-invoice-is.html
19 Nov 2015 - "This -fake- invoice does not come from Google, but is instead a simple -forgery- with a malicious attachment:
From: billing-noreply@ google .com
Date: 19 November 2015 at 12:40
Subject: Your Google invoice is ready
Attached to this email, please find the following invoice:
Invoice number: 1630884720
Due date: 19-Nov-2015
Billing ID: 34979743806
Please follow instructions on the invoice for remitting payment. If you have questions, please contact collections-uk@ google .com.
Yours Sincerely,
The Google Billing Team
Billing ID: 0349-7974-3806
The attachment is named 1630884720.doc which comes in at least two versions (VirusTotal analysis [1] [2]) and which contains a malicious macro... Analysis of the documents is still pending (please check back), although the payload is almost definitely the Dridex banking trojan."
1] https://www.virustotal.com/en/file/bdc8d17deb40bc0f43f2bdc7e4f79941c710db6655604e713b827d8a6406f553/analysis/1447936837/
2] https://www.virustotal.com/en/file/09d966d562b3933398df19c9d153adfa8c72e5040dcb5e9a0366daba2b68aca2/analysis/1447937222/
- http://myonlinesecurity.co.uk/your-google-invoice-is-ready-word-doc-malware/
19 Nov 2015
"19 November 2015: 1630884720.doc - Current Virus total detections 3/54*
... Downloads Dridex banking malware from bhoomiconsultants .com/8i65h4g53/o97i76u54.exe (VirusTotal 1/54**)..."
* https://www.virustotal.com/en/file/bdc8d17deb40bc0f43f2bdc7e4f79941c710db6655604e713b827d8a6406f553/analysis/1447942173/
** https://www.virustotal.com/en/file/5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a/analysis/1447944295/
TCP connections
182.93.220.146: https://www.virustotal.com/en/ip-address/182.93.220.146/information/
8.254.218.142: https://www.virustotal.com/en/ip-address/8.254.218.142/information/
___
Fake 'Invoice and VAT Receipt' SPAM - xls malware
- http://myonlinesecurity.co.uk/invoice-and-vat-receipt-edmun11118_181859-accountedmun11118-postcode-anywhere-excel-xls-spreadsheet-malware/
19 Nov 2015 - "An email with the subject of 'Invoice and VAT Receipt EDMUN11118_181859 [Account:EDMUN11118]' pretending to come from support@ postcodeanywhere .com with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Invoice-and-VAT-Receipt-EDMUN11118_181859-Account-EDMUN11118-1024x559.png
19 November 2015: EDMUN11118_181859.xls - Current Virus total detections 5/54*
... tries to download Dridex banking malware from http ://lapelsbadges .com/8i65h4g53/o97i76u54.exe which at the present time is not resolving for me. Usually there are several download locations all delivering the same dridex malware... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3e8698c52b6469a78b34a45d504e75beb866c2ccd3a273eb116a0bd342ecc5cb/analysis/1447943292/
- http://blog.dynamoo.com/2015/11/malware-spam-invoice-and-vat-receipt.html
19 Nov 2015 - "... The attachment is EDMUN11118_181859.xls... download(s) a file... has a VirusTotal detection rate of 1/54* and that VirusTotal report indicates it phoning home to:
182.93.220.146 (Ministry Of Education, Thailand)
I strongly recommend that you -block- that IP address. The payload is the Dridex banking trojan..."
* https://www.virustotal.com/en/file/5ab7b06d5d7a043726e9b4a23419fec293cea016d2efb1f263b03fb2be3cb03a/analysis/1447949778/
TCP connections
182.93.220.146: https://www.virustotal.com/en/ip-address/182.93.220.146/information/
8.254.218.142: https://www.virustotal.com/en/ip-address/8.254.218.142/information/
___
Exploit kits... change tactics
- https://isc.sans.edu/diary.html?storyid=20391
Last Updated: 2015-11-19 - "... computers directed to an EK? It often happens through compromised websites. Threat actors compromise legitimate websites, and pages from these compromised servers have injected script that connects the user's computer to an EK server. This happens behind the scenes, and the user is unaware... Threat actors often use another server as a gate between the compromised website and the EK server. I often call it a "redirect" because it redirects traffic from a compromised website to the EK... The gate is most often another compromised website. Less often, the gate is a dedicated server established by the threat actor. At times, threat actors have used Pastebin or a URL shortner like goo.gl as the gate. In some cases, you might find a second or -third- gate before you get to the EK... All of this is transparent to the unsuspecting user. Fortunately, many security professionals study EK traffic. Specific trends are quickly identified, security professionals share the data, and automated detection is usually available within a day or two. Threat actors know this. Criminals occasionally change tactics in how they direct traffic from compromised websites to their EK servers. For example, earlier this week I noticed a change by an actor using Rig EK. On Monday 2015-11-16, this threat actor was using a distinct gate path. By Wednesday 2015-11-18, the gate patterns had distinctly changed... On Monday 2015-11-16, this actor was using a two gates between the compromised website and Rig EK...
> https://isc.sans.edu/diaryimages/images/2015-11-19-ISC-diary-image-01.jpg
On Wednesday 2015-11-18, the same actor had switched to a single gate. These single gates appeared to be hosted on -other- compromised websites...
> https://isc.sans.edu/diaryimages/images/2015-11-19-ISC-diary-image-02.jpg
... The first group of Rig EK intercept came from Monday 2015-11-16. The second group came from Wednesday 2015-11-18. Although I could not identify this actor, the traffic represents the -same- criminal group. I'm basing my assessment on the malware payload. Each payload exhibited the -same- behavior on both occasions... I saw Rig EK and the same post-infection traffic after viewing -more- compromised websites on Wednesday 2015-11-18. You'll find the compromised legitimate website, followed by a single gate. Rig EK was on 46.40.46.146 using the domains ftg .askgreatquestions .com, ghf .askmoregetmore .com -or- erf .closelikeapro .com. Post-infection traffic was seen on 62.76.42.21 using the domain alohajotracks .com, just like we saw before on Monday... I've seen a wide variety of paths from compromised websites to an EK server, so this isn't a comprehensive review on the topic. This is just one example. Don't get me started on -malvertizing- which is a much more complicated chain of events..."
(More detail at the isc URL at the top.)
46.40.46.146: https://www.virustotal.com/en/ip-address/46.40.46.146/information/
62.76.42.21: https://www.virustotal.com/en/ip-address/62.76.42.21/information/
:fear::fear: :mad:
AplusWebMaster
2015-11-20, 13:02
FYI...
Fake 'transfer' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-jean-pierre-kibung.html
20 Nov 2015 - "This spam looks like an advanced free fraud, but instead it comes with a malicious attachment. The email appears to originate from within the victim's own domain, but this is a simple -forgery- and does -not- mean that you have been hacked.
From: Jean Pierre Kibungu [jpie.kibungu@ victimdomain]
Date: 20 November 2015 at 09:56
Subject: 0150363108788101_02416060_1.xls
Please find attached the swift of the transfer of $30000.
Kind regards
Jean Pierre Kibungu
INCAT
JEAN PIERRE KIBUNGU AVAR-DA-VISI
GENERAL MANAGER
INCAT OILFIELD LOGISTICS (DRC) LTD
Site:
Mob: + 243 998 01 95 01
Headoffice:
Tel. +44(0) 1534 758859
Fax: +44(0) 1534 758834
The telephone number does match that of a genuine company in Jersey, but they are -not- sending this spam. The attachment is named 0150363108788101_02416060_1.xls and so far I have seen just one version of this with a VirusTotal detection rate of 4/53*. It contains this malicious macro...
UPDATE: Sources tell me there are at least two variants with download locations of:
betterimpressions .com/~impressions/65y3fd23d/87i4g3d2d2.exe
192.186.227.64 /~irma1026/65y3fd23d/87i4g3d2d2.exe
This has an MD5 of d410a45dc4710ea0d383dee81fbbcb6f and a VirusTotal detection rate of 4/52**. According to that VirusTotal report and this Malwr report***, it makes a network connection to:
157.252.245.32 (Trinity College, US)
I strongly recommend that you -block- traffic to that IP."
* https://www.virustotal.com/en/file/5198124f754f016e89dc12f104dc1a0b5a831dc36b469e53f8df2cf86bff4f6b/analysis/1448014325/
** https://www.virustotal.com/en/file/7bbd0d18ce7e8c3388794f5f2a24ff4c6f63a1ce935d3a1f8bf9312480523e32/analysis/1448014994/
TCP connections
157.252.245.32: https://www.virustotal.com/en/ip-address/157.252.245.32/information/
88.221.14.145: https://www.virustotal.com/en/ip-address/88.221.14.145/information/
*** https://malwr.com/analysis/Y2FhM2MzZDE1YjQxNDAzODk5MjE3ZDQ2ODJjZDY2MGM/
- http://myonlinesecurity.co.uk/jean-pierre-kibungu-0150363108788101_02416060_1-xls-excel-xls-spreadsheet-malware/
20 Nov 2015 - "... The email looks like:
Please find attached the swift of the transfer of $30000.
Kind regards
Jean Pierre Kibungu ...
20 November 2015 : 0150363108788101_02416060_1.xls - Current Virus total detections 4/53*
... Analysis of this is pending but is almost certain to be a Dridex banking malware downloader... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e9d4132e9e99e946d8805a824a61f9a624aa0ffc26c2aa5b5a7383edee0a2043/analysis/1448011659/
___
Fake 'Reprint Document' SPAM - doc malware
- http://myonlinesecurity.co.uk/reprint-document-archive-eurocarparts-com-word-doc-malware/
20 Nov 2015 - "A concurrent malspam run involving malicious word docs is an email with the subject of 'Reprint Document archive' pretending to come from tracey.beedles@ eurocarparts .com with a malicious word doc attachment is another one from the current bot runs... The email simply says:
Attached is a Print Manager form.
Format = Word Document Format File (DOC)
20 November 2015 : pmB3A6.doc - Current Virus total detections 4/53*
This also downloads the same Dridex malware from a -different- location irisbordados .com/65y3fd23d/87i4g3d2d2.exe than I saw in the other malspam run**... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8cc83aed3a3080d0b0e699dbfeb1a6d24e59575c1ed5de418967696591d2aa80/analysis/1448020152/
** http://myonlinesecurity.co.uk/jean-pierre-kibungu-0150363108788101_02416060_1-xls-excel-xls-spreadsheet-malware/
- http://blog.dynamoo.com/2015/11/malware-spam-reprint-document-archive.html
20 Nov 2015 - "... if you look at the Hybrid Analysis report* and others, the executable masquerades as mbar.exe / Malwarebytes Anti-Rootkit. The payload is most likely to be the Dridex banking trojan.
Screenshot: https://4.bp.blogspot.com/-VtkH94G_sZM/Vk8dqyZt79I/AAAAAAAAHY8/XE1KJvXAdZ8/s1600/fake-mbar.png
... Recommended blocklist:
157.252.245.32
89.32.145.12 "
* https://www.hybrid-analysis.com/sample/8c4586a133d6631144a0ea720f1bab03c78b2ac677e90a46af14aac0194b92c3?environmentId=1
:fear::fear: :mad:
AplusWebMaster
2015-11-22, 22:50
FYI...
relode .com - SPAM...
- http://blog.dynamoo.com/2015/11/spam-relodecom-and-matt-tant-part-ii.html
21 Nov 2015 - "Matt Tant and the moron spammers from relode .com are at it again.
From: Matt Tant [matthew@ relode .com]
To: "donotemail@ wearespammers .com" [donotemail@ wearespammers .com]
Date: 21 November 2015 at 22:40
Subject: Snagajob integration added
This just in! In addition to our Craigslist and Indeed integrations, we have just pushed an integration with Snagajob! Do you post only on Craigslist, or do you post on multiple job posting sites?...
I've covered these CAN-SPAM busting idiots before*..."
* http://blog.dynamoo.com/2015/11/spam-relodecom-and-matt-tant.html
17 Nov 2015
___
- http://centralops.net/co/DomainDossier.aspx
relode .com
aliases
addresses
198.185.159.144: https://www.virustotal.com/en/ip-address/198.185.159.144/information/
198.185.159.145: https://www.virustotal.com/en/ip-address/198.185.159.145/information/
198.49.23.144: https://www.virustotal.com/en/ip-address/198.49.23.144/information/
198.49.23.145: https://www.virustotal.com/en/ip-address/198.49.23.145/information/
:fear::fear: :mad:
AplusWebMaster
2015-11-23, 11:54
FYI...
WordPress + Angler EK = compromise for some...
- https://blog.malwarebytes.org/hacking-2/2015/11/catching-up-with-the-eitest-compromise-a-year-later/
Nov 23, 2015 - "We are seeing -dozens- of WordPress sites compromised recently with the same malicious code -redirecting- to the Angler exploit kit. The attack involves conditionally embedded large snippets of code at the bottom of the sites’ source page. It is important to stress this is a conditional injection because webmasters trying to identify the issue may -not- see it unless they browse from a fresh IP address and a particular user-agent (Internet Explorer being the most likely to get hit)... The -rogue- code loads a Flash video file from a -suspicious- top-level domain name such as .ga, .tk or .ml which is used to -redirect- visitors to the Angler exploit kit. This is the same attack pattern we documented over a year ago (Exposing the Flash ‘EITest’ malware campaign*)... The latest WordPress version is 4.3.1. This particular ‘EITest campaign’ never actually stopped and saw an increase in the last few months which has been sustained up until now... Angler EK exploits Flash Player... If your WordPress site has been affected, keep in mind that the malicious injected code is just part of the symptoms from having your site hacked. It’s important to identify backdoors, .htaccess modifications as well as the original entry point, by looking at your access and error logs..."
* https://blog.malwarebytes.org/exploits-2/2014/10/exposing-the-flash-eitest-malware-campaign/
Latest Wordpress: https://wordpress.org/news/2015/09/wordpress-4-3-1/
Latest Flash: https://helpx.adobe.com/security/products/flash-player/apsb15-28.html
___
Fake 'Employee Documents' SPAM - xls malware
- http://myonlinesecurity.co.uk/employee-documents-internal-use-pretending-to-come-from-hr-at-your-own-email-domain-excel-xls-spreadsheet-malware/
23 Nov 2015 - "An email with the subject of 'Employee Documents Internal Use' pretending to come from HR at your own email domain or company with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
DOCUMENT NOTIFICATION, Powered by NetDocuments
DOCUMENT NAME: Employee Documents
DOCUMENT LINK: [Link removed]
This message may contain information that is privileged and confidential. If you received this transmission in error, please notify the sender by reply email and delete the message and any attachments.
23 November 2015: Employee Documents(1928).xls - Current Virus total detections 4/54*
... Connects to and downloads kunie .it/u654g/76j5h4g.exe. It is very likely that the downloaded malware will be Dridex banking malware, although some antiviruses are indicating a -cryptowall- ransomware (VirusTotal 6/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3665b64b8d6e58c03be3d19afda66fd778ca3c9794eaecf06a9b882f60967102/analysis/1448270398/
** https://www.virustotal.com/en/file/e55f89332662a8139c37a381fc7d13e660db3b0a34f62a0b2b44be4055686bfb/analysis/1448270247/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
90.84.59.51: https://www.virustotal.com/en/ip-address/90.84.59.51/information/
- http://blog.dynamoo.com/2015/11/malware-spam-employee-documents.html
23 Nov 2014 - "... Attached is a file Employee Documents(1928).xls ... sources tell me that there are -three- different versions downloading from the following locations:
kunie .it/u654g/76j5h4g.exe
oraveo .com/u654g/76j5h4g.exe
www .t-tosen .com/u654g/76j5h4g.exe
The downloaded binary has a detection rate of just 1/54*. That VirusTotal report and this Hybrid Analysis report** show network connections to the following IPs:
89.108.71.148 (Agava Ltd, Russia)
89.32.145.12 (Elvsoft SRV, Romania / Coreix, UK)
157.252.245.32 (Trinity College Hartford, US)
The payload is probably the Dridex banking trojan...
Recommended blocklist:
89.108.71.148
89.32.145.12
157.252.245.32 "
* https://www.virustotal.com/en/file/4e5fa43aa2f95edc99656d9187946e5cf5874b3b4a63b895a0de1f5e61272560/analysis/1448276542/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
8.254.218.126: https://www.virustotal.com/en/ip-address/8.254.218.126/information/
** https://www.hybrid-analysis.com/sample/4e5fa43aa2f95edc99656d9187946e5cf5874b3b4a63b895a0de1f5e61272560?environmentId=1
___
Fake 'UKMail tracking' SPAM - doc malware
- http://myonlinesecurity.co.uk/ukmail-988271023-tracking-information-word-doc-malware/
23 Nov 2015 - "An email with the subject of 'UKMail 988271023 tracking information' pretending to come from no-reply@ ukmail .com with a malicious word doc attachment is another one from the current bot runs... The email looks like:
UKMail Info!
Your parcel has not been delivered to your address November 23, 2015, because nobody was at home.
Please view the information about your parcel, print it and go to the post office to receive your package.
Warranties
UKMail expressly disclaims all conditions, guarantees and warranties, express or implied, in respect of the Service...
23 November 2015: 988271023-PRCL.doc - Current Virus total detections 4/54*
... Connects to & downloads an updated Dridex banking malware from
xsnoiseccs .bigpondhosting .com/u654g/76j5h4g.exe (VirusTotal 3/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8e2d48a763b0fdfa61a2af12b69a6babe859c4c6347211c6e43f52b5236a914e/analysis/1448280511/
** https://www.virustotal.com/en/file/98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c/analysis/1448282238/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
23.62.99.136: https://www.virustotal.com/en/ip-address/23.62.99.136/information/
- http://blog.dynamoo.com/2015/11/malware-spam-ukmail-988271023-tracking.html
23 Nov 2015 - "... The attachment is named 988271023-PRCL.doc ... This binary has a VirusTotal detection rate of 5/54*. That VirusTotal report plus this Hybrid Analysis report** and Malwr report*** indicate malicious traffic... The payload is likely to be the Dridex banking trojan...
Recommended blocklist:
157.252.245.32
89.32.145.12
89.108.71.148
91.212.89.239
89.189.174.19
122.151.73.216
37.128.132.96
195.187.111.11
37.99.146.27
77.221.140.99
195.251.145.79 "
* https://www.virustotal.com/en/file/98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c/analysis/1448285502/
** https://www.hybrid-analysis.com/sample/98700dbf8aab16f57032eb5b49c8c0443d31d6f74eba0bcfcf7b458a740dc03c?environmentId=1
*** https://malwr.com/analysis/ODJhYmE3NGY1ZDI4NDg3NzlmZjQ1NjM0ZDM2NmFhM2I/
___
Dyreza trojan evolves for Win10
- http://www.itnews.com.au/news/dyreza-trojan-evolves-for-windows-10-412101
Nov 23 2015 - "Notorious banking trojan Dyreza has evolved to target the Windows 10 operating system, according to cyber-security firm Heimdal*. The new feature of this pernicious strain of malware includes support for Windows 10, so cyber-criminals can stay up to date with the developments of their prey as well as the ability to latch on to Microsoft Edge, Window's 10's replacement for the much-maligned internet explorer. Heimdall also noted that this new version of Dyreza “kills a series of processes linked to endpoint security software, in order to make its infiltration in the system faster and more effective”. Nearly 100,000 machines have apparently infected by Dyreza worldwide and Dyreza strains have been developed for just about every kind of Windows operating system in recent memory including Windows 7 through 10 as well as Winserver 2003 and Vista... Occasionally known as -Dyre- this particular trojan digs itself right into a users' browser. From there, it directs users to modified versions of otherwise legitimate webpages. If Dyreza is installed on a computer, it might steal online banking details as a user logs into what they think is a normal online -banking- webpage. It commonly spreads itself in large swathes of phishing emails in a tactic is known as 'spray and pray'. But once Dyreza does hits a target, it collects users data and becomes part of a botnet, allowing the attacker to receive the critical information from many users... The research also notes that this new strain arrives just in time for the holidays, with Christmas, Thanksgiving and more importantly, Black Friday, the US's post-thanksgiving shopping event, just around the corner..."
* https://heimdalsecurity.com/blog/security-alert-new-dyreza-variant-supports-windows-10-edge/
___
Cybercriminal Underground - 2015
- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/prototype-nation-the-chinese-cybercriminal-underground-in-2015/
Nov 23, 2015 - "... Data leaked in the underground allows cybercriminals to commit various crimes like financial fraud, identity and intellectual property theft, espionage, and extortion. Chinese cybercriminals have managed to enhance the way they share data as seen in the case of SheYun, a search engine created specifically to make leaked data to users available. Over the last few years, we have been keeping track of the shift of prices of goods and services traded in the Chinese underground. Previously, we saw compromised hosts, DDoS attack tools services, and remote access Trojans (RATs) being sold. Today, social engineering tools have been added to the market.
Carding devices: Cash transactions are slowly becoming a thing of the past, as evidenced by the adoption of electronic and mobile payment means.
• PoS skimmers - Tampered PoS devices are sold to resellers who may or may not know that these devices are rigged. Some PoS skimmers come with an SMS-notification feature that allows the cybercriminal to access the stolen data remotely every time the device is used.
• ATM skimmers – Commonly sold on B2B websites, these fraud-enabling devices allowed fraudsters to carry out bank fraud and actual theft. The devices have keypad overlays that are used to steal victims’ PINs.
• Pocket skimmers – These small, unnoticeable magnetic card readers can store track data of up to 2,048 payment cards. They do not need to be physically connected to a computer or a power supply to work. All captured data can be downloaded onto a connected computer..."
___
21% of Brits have been hit by cyber gits
- http://www.theinquirer.net/inquirer/news/2436052/21-percent-of-brits-have-been-hit-by-cyber-gits
Nov 23 2015 - "ACCORDING TO A REPORT from Deloitte*, one in five British people has been the victim of a security breach... The report says that the ongoing explosion in business and consumer data presents an increasingly tempting target for those with evil intent. It warns companies that most consumers expect them to take responsibility for protecting their data. However, it adds that most consumers do not have a clue what that means... 'Our 2015 report found that 84 percent of consumers expect companies to be held responsible for ensuring the security of user data and personal information online'... Deloitte found that two-thirds of punters would pull their personal data out of firms if they could do so easily, while 52 percent are -not- happy with the way their data is used. Only about a third said that they are aware of the fact that their data is taken and used. Thirteen percent were completely clueless on collection. These people are reading the wrong websites..."
* http://www2.deloitte.com/uk/en/pages/consumer-business/articles/consumer-data-under-attack.html
:fear::fear: :mad:
AplusWebMaster
2015-11-24, 13:44
FYI...
Fake 'Billing' SPAM - Cryptowall
- http://blog.dynamoo.com/2015/11/malware-spam-serafinibillingstatement.html
24 Nov 2014 - "This -fake- financial spam leads to ransomware:
From: Scrimpsher [mumao82462308wd@ 163 .com]
Date: 24 November 2015 at 16:57
Subject: Serafini_Billing_Statement 2003
Signed by: 163 .com
Hi Please see attached a copy of your statement for the month of Nov 2015
Sincerely
Lynda Ang
As with many recent ransomware attacks, this appears to have been sent through webmail (it really is from 163 .com, it is -not- being spoofed). Attached is a file Statement.zip which contains a malicious javascript statement.js ... [vT 7/53*] which then downloads a component from:
46.30.45.73 /mert.exe
That IP belongs to Eurobyte LLC in Russia. I recommend that you -block- it. This is saved as %TEMP%\122487254.exe and it has a VirusTotal detection rate of 5/55**... The application's icon and metadata is designed to make it look like a copy of VNC, but instead the VirusTotal detection indicates that it is Cryptowall. This Hybrid Analysis report*** demonstrates the ransomware in action most clearly..."
> https://2.bp.blogspot.com/-JVJIL7NuZPE/VlS3xQHC9cI/AAAAAAAAHaY/zOys_bRHNDw/s640/cryptowall.png
(More detail at the dynamoo URL above.)
* https://www.virustotal.com/en/file/7e8ef4bbd228a5ec3e2fa48fefc79566d98557a05696815a2c2d02a18f1c5872/analysis/1448391057/
** https://www.virustotal.com/en/file/bca0d0f9bef8d1134976ae2f0e760c25477092f56ab8e4e0ff883628d4c6b3ae/analysis/1448390921/
*** https://www.hybrid-analysis.com/sample/bca0d0f9bef8d1134976ae2f0e760c25477092f56ab8e4e0ff883628d4c6b3ae?environmentId=1
46.30.45.73: https://www.virustotal.com/en/ip-address/46.30.45.73/information/
- http://centralops.net/co/DomainDossier.aspx
163 .com
aliases
addresses
123.58.180.8: https://www.virustotal.com/en/ip-address/123.58.180.8/information/
123.58.180.7: https://www.virustotal.com/en/ip-address/123.58.180.7/information/
___
Fake 'Scan' SPAM - doc malware
- http://myonlinesecurity.co.uk/scan-as-requested-new-hope-specialist-care-ltd-newhopecare-co-uk-melissa-oneill-word-doc-malware/
24 Nov 2015 - "An email with the subject of 'Scan as requested' pretending to come from Melissa O’Neill <adminoldbury@ newhopecare .co.uk> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Scan-as-requested-1024x718.png
24 November 2015: 20151009144829748.doc - Current Virus total detections 5/53*
... Downloads Dridex banking malware from
http ://afrodisias .com .tr/7745gd/4dgrgdg.exe (VirusTotal 4/55**)
Update: other download locations discovered include
www .costa-rica-hoteles-viajes .com/~web/7745gd/4dgrgdg.exe and janaduchanova .wz .cz/7745gd/4dgrgdg.exe
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/eedcabef646f97e4195f4ab5b6d52286be283af9bc09533707916b5c09c36df1/analysis/1448358595/
** https://www.virustotal.com/en/file/983d40eed31734cffa2324f1e4221207a322669005f134a32d21e5e62fc5f43a/analysis/1448359094/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
88.221.14.130: https://www.virustotal.com/en/ip-address/88.221.14.130/information/
- http://blog.dynamoo.com/2015/11/malware-spam-scan-as-requested-melissa.html
24 Nov 2015 - "... This has a VirusTotal detection rate of 4/55*. That VT analysis and this Malwr analysis** and these two Hybrid Analysis reports [1] [2] show network traffic to:
157.252.245.32 (Trinity College Hartford, US)
89.108.71.148 (Agava Ltd, Russia)
89.32.145.12 (Elvsoft SRV, Romania / Coreix, UK)
88.86.117.153 (SuperNetwork, Czech Republic) ...
Recommended blocklist:
157.252.245.32
89.108.71.148
89.32.145.12
88.86.117.153 "
* https://www.virustotal.com/en/file/983d40eed31734cffa2324f1e4221207a322669005f134a32d21e5e62fc5f43a/analysis/1448361171/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
88.221.14.130: https://www.virustotal.com/en/ip-address/88.221.14.130/information/
** https://malwr.com/analysis/ZDU2YWU5YWQxZDg4NDY0ZDkyYjQ0ODA5NGFiYzQzYTE/
1] https://www.hybrid-analysis.com/sample/c73476f6d3a076c8c330ec84b12ea4c6b2b6a526e968af940bbf2ace57a7bce3?environmentId=1
2] https://www.hybrid-analysis.com/sample/983d40eed31734cffa2324f1e4221207a322669005f134a32d21e5e62fc5f43a?environmentId=1
___
Fake 'FED Wire' SPAM - xls malware
- http://myonlinesecurity.co.uk/important-fdic-fed-wire-and-ach-restrictions-excel-xls-spreadsheet-malware/
24 Nov 2015 - "The second batch of malspam today using malicious office docs with macros is an email with the subject of 'IMPORTANT. FDIC. FED Wire and ACH Restrictions" pretending to come from FDIC, Federal Reserve Bank <administration@ usfederalreservebank .com> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/FED-Wire-and-ACH-Restrictions.png
24 November 2015: aes_E851174777E.xls - Current Virus total detections 3/56*
The MALWR analysis shows us that it downloads various files from a combination of http ://rmansys .ru/utils/inet_id_notify.php and http ://s01.yapfiles .ru/files/1323961/435323.jpg .
The only file I get that is malicious is test.exe that looks like it was -renamed- from the 435323.jpg on download by the macro inside this office doc. (VirusTotal 5/56**). I am unsure what malware this actually is, but is doesn’t look like it is Dridex... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d4e2ce1ad86ab80f4995ca4b204607f5b47a4aa3601f1c0dba94c1c1969a4462/analysis/1448364813/
** https://www.virustotal.com/en/file/51ecc51440442fcb393c7925b8696f95ea8656f967761cfdad3f14f1d1f6cd54/analysis/1448365505/
TCP connections
89.108.101.61: https://www.virustotal.com/en/ip-address/89.108.101.61/information/
90.156.241.111: https://www.virustotal.com/en/ip-address/90.156.241.111/information/
217.197.126.52: https://www.virustotal.com/en/ip-address/217.197.126.52/information/
- http://blog.dynamoo.com/2015/11/malware-spam-federal-reserve-bank.html
24 Nov 2015 - "This spam does -not- come from the Federal Reserve Bank, but is instead a simple -forgery- with a malicious attachment... According to this Malwr report[1] it drops all sorts of files including _iscrypt.dll [VT 0/54*] and 2.exe [VT 2/54**] which is analysed in this Malwr report[2] and this Hybrid Analysis report[3]. It is unclear as to what it does (ransomware? remote access trojan?), but it appears that the installation may be password protected...
Recommended blocklist:
185.26.97.120
90.156.241.111
89.108.101.61
95.27.132.170
217.197.126.52
88.147.168.112
217.19.105.3
UPDATE: This Hybrid Analysis report[4] shows various web pages popping up from the Excel spreadsheet, including MSN and Lidl. The purpose of this is unknown."
* https://www.virustotal.com/en/file/2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc/analysis/1448378403/
** https://www.virustotal.com/en/file/02781337bf4bb742747d24242255a233adab6bbfedd31c733cd20e0400460d3d/analysis/1448378422/
1] https://malwr.com/analysis/NWMzNjQwMWQ3MDk5NGI3NmIyY2MyOWU5NmM1NTk3MzQ/
2] https://malwr.com/analysis/MGQ3NjdkYmMyMmI3NDVlNDljYWRhOTA2MWE0MTAwM2Y/
3] https://www.hybrid-analysis.com/sample/02781337bf4bb742747d24242255a233adab6bbfedd31c733cd20e0400460d3d?environmentId=1
4] https://www.hybrid-analysis.com/sample/ba824c9dfc2dfe4b3ac70377e250bf5f1dce24858e63e98114bc39d3e6298cbe?environmentId=1]
___
Fake 'Abcam Despatch' SPAM - xls malware
- http://myonlinesecurity.co.uk/abcam-despatch-cce5303255-ordersabcam-com-excel-xls-spreadsheet-malware/
24 Nov 2015 - "The 3rd set today of malspam emails using malicious office docs is an email with the subject of 'Abcam Despatch [CCE5303255]' pretending to come from orders@ abcam .com with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Abcam-Despatch-1024x550.png
24 November 2015: invoice_1366976_08-01-13.xls - Current Virus total detections 6/56*
... which is actually a zip file that when extracted gives you -several- docs or xls files [1] [2] [3] [4] [5] [6]. MALWR analysis of some of them show that they contact & download a Dridex banking malware from these locations amongst others:
http ://janaduchanova .wz.cz/7745gd/4dgrgdg.exe (VirusTotal 1/55**)
http ://afrodisias.com .tr/7745gd/4dgrgdg.exe
http ://www.costa-rica-hoteles-viajes .com/~web/7745gd/4dgrgdg.exe
http ://biennalecasablanca .ma/7745gd/4dgrgdg.exe
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8f2ad887047b224900e7cfe4527d907d47b50d64fe507c95a031c6ee3ee58d81/analysis/1448365689/
1] https://www.virustotal.com/en/file/4b2166b3affb04bcbe4c743b5cb932ff4e368f01d5d0bcbae0ba8e025cc38b24/analysis/1448365924/
2] https://www.virustotal.com/en/file/6c632bc22749fae9e4c22d3fb365111ac3d31b74dcbf2bec2de96fe9a9f2cc80/analysis/1448366059/
3] https://www.virustotal.com/en/file/ad7300ccb2b9cf76ace9c6e43a6333c4638e92cefe4ac5bda22e80929eba9192/analysis/1448366422/
4] https://www.virustotal.com/en/file/2db0ae3ad5f38c6ff39be773811c123278fd12a9954bfa0074d8da2d91d793af/analysis/1448366042/
5] https://www.virustotal.com/en/file/2db0ae3ad5f38c6ff39be773811c123278fd12a9954bfa0074d8da2d91d793af/analysis/1448366042/
6] https://www.virustotal.com/file/1e472a0437b2c7a0e8d13100e1b0d1bbfb6585a6b3eed40f1368d48d1ebba7cf/analysis/1448361214/
** https://www.virustotal.com/en/file/3cf465bb1424a465d3b212604288dd81c26e8b2b701cc06cfdd762feb3bafe01/analysis/1448365319/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
- http://blog.dynamoo.com/2015/11/malware-spam-abcam-despatch-cce5303255.html
24 Nov 2015 - "... The attachment name is invoice_1366976_08-01-13.xls ... This binary has a detection rate of 2/55* and phones home to the following IPs (according to this**):
157.252.245.32 (Trinity College Hartford, US)
89.108.71.148 (Agava Ltd, Russia)
89.32.145.12 (Elvsoft SRV, Romania / Coreix, UK)..
Recommended blocklist:
157.252.245.32
89.108.71.148
89.32.145.12 "
* https://www.virustotal.com/en/file/3cf465bb1424a465d3b212604288dd81c26e8b2b701cc06cfdd762feb3bafe01/analysis/1448369154/
TCP connections
89.108.71.148: https://www.virustotal.com/en/ip-address/89.108.71.148/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
** https://www.hybrid-analysis.com/sample/6c632bc22749fae9e4c22d3fb365111ac3d31b74dcbf2bec2de96fe9a9f2cc80?environmentId=1
:fear::fear: :mad:
AplusWebMaster
2015-11-25, 13:52
FYI...
Fake Paypal PHISH
- http://myonlinesecurity.co.uk/paypal-urgent-your-card-has-been-stopped-phishing/
25 Nov 2015 - "There are a few major common subjects in a phishing attempt. Lots of them are either PayPal or your Bank or Credit Card, with a message saying some thing like:
• Urgent: Your card has been stopped !
• There have been unauthorised or suspicious attempts to log in to your account, please verify
• Your account has exceeded its limit and needs to be verified
• Your account will be suspended !
• You have received a secure message from < your bank>
• We are unable to verify your account information
• Update Personal Information
• Urgent Account Review Notification
• We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
• Confirmation of Order
The original email looks like this. It will NEVER be a genuine email from PayPal or Your Bank so don’t ever follow the links or fill in the html ( webpage) form that comes attached to the email.
Screenshot1: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/paypal-Urgent-Your-card-has-been-stopped-1024x675.png
Screenshot2: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/fake_paypal-site-1024x531.png
If you fill in the email address and password you get:
Screenshot3: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/fake_paypal-site_2-1024x519.png
... Which is a typical phishing page that looks very similar to a genuine PayPal update page, if you don’t look carefully at the URL in the browser address bar. This one wants your personal details, your Paypal account log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or click-the-link in the email..."
___
Fake 'NatWest' phish
- http://myonlinesecurity.co.uk/service-status-natwest-phishing/
25 Nov 2015 - "An email with the subject of 'Service status – NatWest' pretending to come from NatWest <natwest@ bt .net> is one of the phishing scams I have seen today... it is worth mentioning because it combines 2 different approaches. 1st it has a link in the body of the email and 2nd it attaches a html page inviting you to open it... Any Natwest customer would or should know that emails would -never- come from natwest@ bt .net but hundreds of recipients will still click-on-the-link or open the html page because it is there & they ain’t thinking right and they -always- click on every email they get...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Service-status-NatWest-1024x631.png
The link in this case goes to http ://www .voyageitalie .com/N/n.html which -redirects- to: http ://www .paragonpakistan .pk/site/home/
The attached html file simply says <META HTTP-EQUIV=”Refresh” CONTENT=”0; url= http ://www .voyageitalie .com/N/n.html”> so sending you to the site which looks like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/fake-Nat-West-Site-1024x1014.png
... All of these emails use Social engineering tricks to persuade you to open-the-attachments that come with the email or click-the-link in the email..."
___
DRIDEX SPAM ...
- http://blog.trendmicro.com/trendlabs-security-intelligence/dridex-spam-runs-resurface-against-us-targets/
Nov 25, 2015
Distribution of victims, October 13 to November 23
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/11/dridex-chart-2.jpg
Spam used to spread DRIDEX - 1
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/11/DRIDEX_resurrects_06.jpg
Spam used to spread DRIDEX - 2
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/11/DRIDEX_resurrects_07.jpg
"... DRIDEX botnets that have been around as early as August 2014... development further validates previous findings that the DRIDEX botnet was -not- totally taken down..."
___
Security Bug in Dell PCs shipped since August 2015
- http://krebsonsecurity.com/2015/11/security-bug-in-dell-pcs-shipped-since-815/
Nov 24, 2015 - "All new Dell laptops and desktops shipped since August 2015 contain a serious security vulnerability that exposes users to online eavesdropping and malware attacks. Dell says it is prepping a fix for the issue... Dell says the eDellRoot certificate was installed on all new desktop and laptops shipped from August 2015 to the present day. According to the company, the certificate was intended to make it easier for Dell customer support to assist customers in troubleshooting technical issues with their computers..."
malware samples signed by eDellRoot
- http://myonlinesecurity.co.uk/malware-samples-signed-by-edellroot/
25 Nov 2015
Dell Windows Systems Pre-Installed TLS Root CA
- https://isc.sans.edu/diary.html?storyid=20411
Last Updated: 2015-11-24
Response - eDellroot Certificate / Dell Corporate blog
- http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2015/11/23/response-to-concerns-regarding-edellroot-certificate
23 Nov 2015
Dell Computers Contain CA Root Certificate Vulnerability
- https://www.us-cert.gov/ncas/current-activity/2015/11/24/Dell-Computers-Contain-CA-Root-Certificate-Vulnerability
Nov 24, 2015
>> http://arstechnica.com/security/2015/11/dell-apologizes-for-https-certificate-fiasco-provides-removal-tool/
Nov 24, 2015
___
Ransomware safety tips - online retailers
- http://net-security.org/malware_news.php?id=3162
25.11.2015 - "Cybercriminals have developed a destructive new form of ransomware that targets online retailers. They scan websites for common vulnerabilities and use them to install malware that encrypts key files, images, pages and libraries, as well as their backups. The criminals behind these attacks then hold them hostage, and website operators must pay a ransom in anonymous cryptocurrency to unlock the files..."
(More at the URL above.)
___
FBI has lead in probe of 1.2 billion stolen Web credentials: documents
- http://www.reuters.com/article/2015/11/24/us-usa-cyberattack-russia-idUSKBN0TD2YN20151124
Nov 24, 2015 - "A hacker who once advertised having access to user account information for websites like Facebook (FB.O) and Twitter (TWTR.N) has been linked through a Russian email address to the theft of a record 1.2 billion Internet credentials, the FBI said in court documents. That hacker, known as "mr.grey," was identified based on data from a cybsecurity firm that announced in August 2014 that it had determined an alleged Russian crime ring was responsible for stealing information from more than 420,000 websites, the documents said. The papers, made public last week by a federal court in Milwaukee, Wisconsin, provide a window into the Federal Bureau of Investigation's probe of what would amount to the largest collection of stolen user names and passwords. The court papers were filed in support of a search warrant the FBI sought in December 2014 and that was executed a month later related to email records. The FBI investigation was prompted by last year's announcement by Milwaukee-based cybersecurity firm Hold Security that it obtained information that a Russian hacker group it dubbed -CyberVor- had stolen the 1.2 billion credentials and more than 500 million email addresses. The FBI subsequently found lists of domain names and utilities that investigators believe were used to send spam, the documents said. The FBI also discovered an email address registered in 2010 contained in the spam utilities for a "mistergrey," documents show. A search of Russian hacking forums by the FBI found posts by a "mr.grey," who in November 2011 wrote that if anyone wanted account information for users of Facebook, Twitter and Russian-based social network VK, he could locate the records. Alex Holden, Hold Security's chief information security officer, told Reuters this message indicated mr.grey likely operated or had access to a database that amassed stolen data from computers via malware and viruses.
Facebook and Twitter declined comment. The FBI declined to comment, and U.S. Justice Department had no immediate comment. The probe appears to be distinct from another investigation linked to Hold Security's reported discovery that 420,000 websites, including one for a JPMorgan Chase & Co (JPM.N) corporate event, were -targeted- by the Russian hackers. In a case spilling out of the discovery of the JPMorgan breach, U.S. prosecutors this month charged three men with engaging in a cyber-criminal enterprise that stole personal information from more than 100 million people. Prosecutors accused two Israelis, Gery Shalon and Ziv Orenstein, and one American, Joshua Samuel Aaron, of being involved in a variety of schemes fueled by hacking JPMorgan and 11 other companies. An indictment in Atlanta federal court against Shalon and Aaron names as a defendant an unidentified hacker believed to be in Russia."
> http://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html
:fear::fear: :mad:
AplusWebMaster
2015-11-26, 15:54
FYI...
Fake 'Payment' SPAM - leads to Dridex
- http://blog.dynamoo.com/2015/11/random-payment-spam-leads-to-dridex.html
26 Nov 2015 - "I have only seen one version of this -spam- message so far:
From: Basia Slater [provequipmex@ provequip .com .mx]
Date: 26 November 2015 at 12:00
Subject: GVH Payment
I hope you had a good weekend.
Please check the payment confirmation attached to this email. The Transaction should appear on your bank in 2 days.
Basia Slater
Accountant
Comerica Incorporated
This sample had a document name of I654WWFR3C6.doc which has a VirusTotal detection rate of 6/55*, containing this malicious macro... The Malwr report** for this version indicates a download from:
harbourviewnl .ca/jo.jpg?6625
According to that Malwr report, it drops a file YSpq2bkGVIi5yaPcv6667.exe (MD5 6c14578c2b77b1917b3dee9da6efcd56) which has a detection rate of 1/53***. The Hybrid Analysis report[4] and Malwr report[5] for that indicates malicious traffic to:
94.73.155.10 (Telekomunikasyon Anonim Sirketi, Turkey)
199.175.55.116 (VPS Cheap INC, US)
Note that 94.73.155.12 is mentioned in this other Dridex report today[6], both IPs form part of a small subnet of 94.73.155.8/29 suballocated to one "Geray Timur Akkurt"... an additional download location of:
gofishretail .com/jo.jpg?[4-digit-random-number]
with an additional C2 location of:
113.30.152.170 (Net4india , India)
Recommended blocklist:
94.73.155.8/29
199.175.55.116
113.30.152.170 "
* https://www.virustotal.com/en/file/be65b6dc6d178a8a76f9cee061f180a4439ed6e0a420cf533c1d12ab8397d054/analysis/1448541871/
** https://malwr.com/analysis/YjQ4ZDM3ODU0YmZlNGJhZWI1NDlkYjY2MzgyYjhhMWY/
*** https://www.virustotal.com/en/file/d45c0463489cf01d03009f4ffc33b817b707a6a982de1cd2b64bd414e84fe2ef/analysis/1448543018/
4] https://www.hybrid-analysis.com/sample/d45c0463489cf01d03009f4ffc33b817b707a6a982de1cd2b64bd414e84fe2ef?environmentId=1
5] https://malwr.com/analysis/ZjU5NzYyYmE2NzZlNDA3MDk1YjdkNWY0YTQwZTJhYzM/
6] http://blog.dynamoo.com/2015/11/malware-spam-invoice-document-si528880.html
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-invoice-document-si528880.html
26 Nov 2015 - "This -fake- invoice does not come from Hider Food Imports Ltd but is instead a simple -forgery- with a malicious attachment.
From Lucie Newlove [lucie@ hiderfoods .co.uk]
Date Thu, 26 Nov 2015 16:03:04 +0500
Subject Invoice Document SI528880
Please see attached Invoice Document SI528880 from HIDER FOOD IMPORTS LTD.
ARE YOU AWARE THAT OUR NEW WEBSITE IS NOW AVAILABLE?
Please contact our Sales Department for details.
Hider Food Imports Ltd
REGISTERED HEAD OFFICE
Wiltshire Road,
Hull
East Yorkshire
HU4 6PA
Registered in England Number : 842813 ...
The attached file is SI528880.xls of which I have seen just one sample with a VirusTotal detection rate of 2/54*, and it contains this malicious macro... which according to this Hybrid Analysis report** downloads a malicious component from:
naceste2.czechian .net/76t89/32898u.exe
This executable has a detection rate of just 1/54*** and... shows network traffic to the following IPs:
94.73.155.12 (Telekomunikasyon Anonim Sirketi, Turkey)
8.253.44.158 (Level 3, US)
37.128.132.96 (Memset, UK)
91.212.89.239 (Uzinfocom, Uzbekistan)
185.87.51.41 (Marosnet, Russia)
42.117.2.85 (FPT Telecom Company, Vietnam)
192.130.75.146 (Jyvaskylan Yliopisto, Finland)
195.187.111.11 (Szkola Glowna Gospodarstwa Wiejskiego, Poland)
5.63.88.100 (Centr, Kazahkstan)
The payload is probably the Dridex banking trojan...
Recommended blocklist:
94.73.155.12
191.234.4.50
8.253.44.158
37.128.132.96
91.212.89.239
185.87.51.41
42.117.2.85
192.130.75.146
195.187.111.11
5.63.88.100 "
* https://www.virustotal.com/en/file/8eaf82866a72e1428cbfe6956fbdb1d5d05efb2e2853dfb3b5dc38fa04d2cc57/analysis/1448535919/
** https://www.hybrid-analysis.com/sample/8eaf82866a72e1428cbfe6956fbdb1d5d05efb2e2853dfb3b5dc38fa04d2cc57?environmentId=1
*** https://www.virustotal.com/en/file/224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94/analysis/1448537540/
:fear::fear: :mad:
AplusWebMaster
2015-11-27, 14:03
FYI...
Fake 'Tax Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/aline-tax-invoice-40525-bruce-sharpe-brucealinepumps-com-word-doc-malware/
27 Nov 2015 - "An email with the subject of 'Aline: Tax Invoice #40525' pretending to come from Bruce Sharpe <bruce@ alinepumps .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Good day, Please find attached Tax Invoice as requested. Many thanks for your call. Bruce Sharpe.
27 November 2015 : Tax Invoice_40525_1354763307792.doc - Current Virus total detections 0/55*
Malwr Analysis** show us it downloads Dridex banking malware from
http ://www .alpenblick-beyharting .de/76f6d5/54sdfg7h8j.exe (VirusTotal 1/55***). Other download sites so far discovered include
hostingunlimited .co.uk/76f6d5/54sdfg7h8j.exe
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5c4a25a2dfb508f328a36fe4a733b0a91bc7b432be48a5e8cf89eddd5c030ff7/analysis/1448615839/
** https://malwr.com/analysis/NDhmMDBhNWQ0ZGM0NDg1Nzg5MWM1NTM1ZDU0NjRiYTk/
kidsmatter2us .org: 198.57.243.108: https://www.virustotal.com/en/ip-address/198.57.243.108/information/
> https://www.virustotal.com/en/url/f134a41cf87e07e780062c457cf3d5ec5b7179e6d5ed32ae12e1beda750e1683/analysis/
*** https://www.virustotal.com/en/file/7b57b6e639731c1ff6090ecc031f4dc850654cb409cfa3de0321fa86bb8df4f8/analysis/1448615736/
TCP connections
94.73.155.12: https://www.virustotal.com/en/ip-address/94.73.155.12/information/
8.254.218.126: https://www.virustotal.com/en/ip-address/8.254.218.126/information/
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-invoice-ivan-jarman.html
27 Nov 2015 - "This -fake- invoice does not come from Sportsafe UK Ltd but is instead a simple -forgery- with a malicious attachment.
From Ivan Jarman [IJarman@ sportsafeuk .com]
Date Fri, 27 Nov 2015 17:21:27 +0530
Subject Invoice
Sent 27 NOV 15 09:35
Sportsafe UK Ltd
Unit 2 Moorside
Eastgates
Colchester
Essex
CO1 2TJ
Telephone 01206 795265
Fax 01206 795284
I have received several copies of the spam with the same attachment named S-INV-BROOKSTRO1-476006.doc with a VirusTotal detection rate of 1/54* and which contains this malicious macro... This Malwr report** shows the macro downloads from:
kidsmatter2us .org/~parentsm/76f6d5/54sdfg7h8j.exe
The executable has a detection rate of 3/55**. The Hybrid Analysis report*** shows network traffic to:
198.57.243.108 (Unified Layer, US)
94.73.155.12 (Telekomunikasyon Anonim Sirketi, Turkey)
77.221.140.99 (ZAO National Communications / Infobox.ru, Russia)
37.128.132.96 (Memset, UK)
37.99.146.27 (Etihad Atheeb Telecom Company, Saudi Arabia)
217.160.110.232 (1&1, Germany)
202.137.31.219 (Linknet, Indonesia)
91.212.89.239 (Uzinfocom, Uzbekistan)
The payload is probably the Dridex banking trojan.
Recommended blocklist:
198.57.243.108
94.73.155.8/29
77.221.140.99
37.128.132.96
37.99.146.27
217.160.110.232
202.137.31.219
91.212.89.239 "
> https://malwr.com/analysis/ZDhkOTA1ZjA0ZTNkNDNkYWI1NTA2NzkwNmFkNzkxOGE/
- http://myonlinesecurity.co.uk/invoice-ivan-jarman-ijarmansportsafeuk-com-word-doc-malware/
27 Nov 2015
"... 27 November 2015: S-INV-BROOKSTRO1-476006.doc - Current Virus total detections *
... Downloads the 3rd different -Dridex- version that I have seen today from
http ://kidsmatter2us .org/~parentsm/76f6d5/54sdfg7h8j.exe (VirusTotal **)..."
* https://www.virustotal.com/en/file/94e9965cc66ca20e1ae3ed4f1c74159be6552ee9045b26f2c89ad5e5fa10626f/analysis/1448627008/
** https://www.virustotal.com/en/file/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc/analysis/1448627380/
___
Fake 'Transfer' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/spam-integrated-petroleum-services.html
27 Nov 2015 - "This malicious email sample was sent in by a contact (thank you), and contains a malicious attachment:
From: Integrated Petroleum Services
Sent: Friday, November 27, 2015 10:24 AM
Subject: Transfer
Hello,
Please find attached the transfer order sent on Friday 27.
Best Regards
Hugo
Attached is a file 20151126-291-transfer.xls (VT 1/53*) containing this malicious macro... which (according to this Malwr report**) downloads from:
pathenryiluminacion.i8 .com/76f6d5/54sdfg7h8j.exe
This binary has a VirusTotal detection rate of 3/55***. The payload is the same as found in this spam run[4]."
* https://www.virustotal.com/en/file/2f674382ddc5ce13b35b4ad5efbd87af8dee02f7bebcd4cd67dd18947b8bfec1/analysis/1448630394/
** https://malwr.com/analysis/ZDhkOTA1ZjA0ZTNkNDNkYWI1NTA2NzkwNmFkNzkxOGE/
*** https://www.virustotal.com/en/file/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc/analysis/1448630483/
4] http://blog.dynamoo.com/2015/11/malware-spam-invoice-ivan-jarman.html
64.136.20.56: https://www.virustotal.com/en/ip-address/64.136.20.56/information/
> https://www.virustotal.com/en/url/c53d4e2e5d2f451cf27180f96e86668c769087233206a35400aa132bdc5d47cc/analysis/
___
Older Dell devices affected by eDellRoot ...
- http://www.computerworld.com/article/3008890/security/older-dell-devices-also-affected-by-dangerous-edellroot-certificate.html
Nov 26, 2015 - "... Tests performed inside a Windows 10 virtual machine revealed that the DSDTestProvider certificate gets left behind on the system when the Dell System Detect tool is uninstalled... users who want to remove it from their system must do so -manually- after they uninstall DSD. This can be done by pressing the Windows key + r, typing certlm.msc and hitting Run. After allowing the Microsoft Management Console to execute, users can browse to Trusted Root Certification Authorities > Certificates, locate the DSDTestProvider certificate in the list, right click on it and delete it..."
> http://www.dell.com/support/article/us/en/19/SLN300321
>> https://dellupdater.dell.com/Downloads/APP009/DellCertFix.exe
___
Holiday Phishing Scams and Malware Campaigns
- https://www.us-cert.gov/ncas/current-activity/2015/11/25/US-CERT-Alerts-Users-Holiday-Phishing-Scams-and-Malware-Campaigns
Nov 26, 2015 - "... Ecards from unknown senders may contain -malicious- links. Fake advertisements or shipping notifications may deliver -infected- attachments. Spoofed email messages and fraudulent posts on social networking sites may request support for phony causes..."
(More at the us-cert URL above.)
- http://research.zscaler.com/2015/11/black-friday-deals-on-malware-scams.html
Nov 27, 2015 - "... the trend in phishing activity tends to rise with the amount of online shopping traffic, which comes with the added risk of -scammers- taking advantage of a consumers better judgement..."
Beware the holiday scams coming to your email inbox
- http://www.infoworld.com/article/3008458/social-engineering/beware-the-holiday-scams-coming-to-your-email-inbox.html
Nov 28, 2015
:fear::fear: :mad:
AplusWebMaster
2015-11-30, 13:37
FYI...
Fake 'Order Accepted' SPAM - doc malware
- http://myonlinesecurity.co.uk/order-pc299139pps-accepted-contractvehicles-co-uk-word-doc-malware/
30 Nov 2015 - "An email with the subject of 'Order PC299139PPS Accepted' pretending to come from CVLink <noreply@ contractvehicles .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/Order-PC299139PPS-Accepted-1024x561.png
30 November 2015: PC299139PPS.doc - Current Virus total detections 1/55*
MALWR analysis** shows us it downloads what looks like a Dridex banking malware from
http ://members.chello .at/~antitrack_legend/89u87/454sd.exe (VirusTotal 3/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d3a0c88f9071214468edcb72127144af19bf64837d25366332200e97edda81c4/analysis/1448873990/
** https://malwr.com/analysis/NWE5YWEzNTdiNzEzNGNjZjgyNjlkYWQzMTc2ODExZmI/
*** https://www.virustotal.com/en/file/bc054e7d840f8e93c599c0bff2686fd9486509eca968700da1bcd1622a6caf2f/analysis/1448873756/
___
Fake 'Message' SPAM - malware attachment
- http://blog.dynamoo.com/2015/11/malware-spam-message-from.html
30 Nov 2015 - "I have only one sample of this rather terse email with -no- body text:
From: scan@ victimdomain
Reply-To: scan@ victimdomain
To: hiett@ victimdomain
Date: 30 November 2015 at 09:22
Subject: Message from mibser_00919013013
The spam appears to originate from within the victim's own domain, but it does not. In the sample I saw, the attachment was named Smibser_00915110211090.xls, had a VirusTotal detection rate of 3/54* and contained this malicious macro... According to this Hybrid Analysis report** and this Malwr report*** the macro downloads a malicious executable from:
velitolu .com/89u87/454sd.exe
This binary has a detection rate of 3/55****. Automated report tools [1] [2] show network traffic to:
94.73.155.12 (Cizgi Telekomunikasyon Anonim Sirketi, Turkey)
42.117.2.85 (FPT Telecom Company, Russia)
89.189.174.19 (Sibirskie Seti Novokuznetsk, Russia)
5.63.88.100 (Centr, Kazakhstan)
The payload is likely to be the Dridex banking trojan...
Recommended blocklist:
94.73.155.12
42.117.2.85
89.189.174.19
5.63.88.100 "
* https://www.virustotal.com/en/file/ac97c8d2b89e4d39c890a73a84ec7f0e3cbedcc8431037149e5d5f68518206fe/analysis/1448880036/
** https://www.hybrid-analysis.com/sample/ac97c8d2b89e4d39c890a73a84ec7f0e3cbedcc8431037149e5d5f68518206fe?environmentId=2
*** https://malwr.com/analysis/YjgwNGJkYzc0ZTY4NGUxODg3MzliOWUzODBiODNhNTk/
**** https://www.virustotal.com/en/file/2078db0becb99c19f4a9fbab2b1cb7c6b2af2095659bcfbc034998e62688b8f9/analysis/1448880465/
1] https://malwr.com/analysis/ZTk4OWY0OWFjOGQ2NDZiMWEwOGFlNWY4ZDU5MDIzOTk/
2] https://www.hybrid-analysis.com/sample/2078db0becb99c19f4a9fbab2b1cb7c6b2af2095659bcfbc034998e62688b8f9?environmentId=1
___
Fake 'QUICKBOOKS' SPAM - leads to malware
- http://blog.dynamoo.com/2015/11/malware-spam-intuit-qb-quickbooks.html
Nov 30, 2015 - "This -fake- Intuit QuickBooks spam leads to malware:
From: QUICKBOOKS ONLINE [qbservices@ customersupport .intuit .com]
Date: 30 November 2015 at 10:42
Subject: INTUIT QB
As of November 5th, 2015, we will be updating the browsers we support. We encourage you to upgrade to the latest version for the best online experience. Please proceed the following link, download and install the security update for all supported browsers to be on top with INTUIT online security!
InTuIT. | simplify the business of life
© 2015 Intuit Inc. All rights reserved. Intuit and QuickBooks are registered trademarks of Intuit Inc. Terms and conditions, features, support, pricing, and service options subject to change without notice.
Screenshot: https://3.bp.blogspot.com/-jqzrc2_aW3Y/Vkyln1SIkyI/AAAAAAAAHYo/GOHMdVkAYWg/s400/intuit.png
The spam is almost identical to this one[1] which led to Nymaim ransomware:
> http://www.welivesecurity.com/2013/07/02/the-home-campaign-overstaying-its-welcome/
In this particular spam, the email went to a landing page at updates .intuitdataserver-1 .com/sessionid-7ec395d0628d6799669584f04027c7f6 which then attempts to download a -fake- Firefox update*. This executable has a VirusTotal detection rate of 3/55**... The Hybrid Analysis report*** shows the malware attempting to POST to mlewipzrm .in which is multihomed on:
89.163.249.75 (myLoc managed IT AG, Germany)
188.209.52.228 (BlazingFast LLC, Ukraine / NForce Entertainment, Romania)
95.173.164.212 (Netinternet Bilgisayar ve Telekomunikasyon San. ve Tic. Ltd. Sti., Turkey)
The nameservers for mlewipzrm .in are NS1 .REBELLECLUB .NET and NS2 .REBELLECLUB .NET which are hosted on the following IPs:
210.110.198.10 (KISTI, Korea)
52.61.88.21 (Amazon AWS, US) ...
As far as I can tell, these domains are hosted on the following IPs:
52.91.28.199 (Amazon AWS, US)
213.238.170.217 (Eksen Bilisim, Turkey)
75.127.2.116 (Foroquimica SL / ColoCrossing, US)
I recommend that you -block- the following IPs and/or domains:
52.91.28.199
213.238.170.217
5.135.237.209
196.52.21.11
75.127.2.116
210.110.198.10
52.61.88.21
89.163.249.75
188.209.52.228
95.173.164.212 ..."
(More listed at the dynamoo URL above.)
* https://urlquery.net/report.php?id=1448887234353
** https://www.virustotal.com/en/file/d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0/analysis/1448887362/
flashplayer19_ga_update.exe - 3/55
*** https://www.hybrid-analysis.com/sample/d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0?environmentId=1
1] http://blog.dynamoo.com/2015/11/mystery-intuit-quickbooks-spam-leads-to.html
___
Fake 'Message' SPAM - xls malware
- http://myonlinesecurity.co.uk/message-from-mibser_00919013013-pretending-to-come-from-scan-your-own-email-domain-excel-xls-spreadsheet-malware/
30 Nov 2015 - "An email with the subject of 'Message from mibser_00919013013' pretending to come from scan@ your own email domain with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email has a totally -blank- body and just an XLS (Excel spreadsheet) attachment...
30 November 2015: Smibser_00915110211090.xls - Current Virus total detections 4/55*
... Download’s Dridex banking malware from
dalamantransferservicesrentacar .com/89u87/454sd.exe (VirusTotal 1/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e8086811b9b4271ee48756e721d1d10cc36a63408de7b4cc9584bb5c65106603/analysis/1448888284/
** https://www.virustotal.com/en/file/3763f09f26dbe26ba8000b69a1821bf1f3c12409ef83c4af81e249ef67da91f4/analysis/1448889035/
TCP connections
94.73.155.12: https://www.virustotal.com/en/ip-address/94.73.155.12/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
___
Fake 'Invoice Attached' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/invoice-attached-accounting-specialist-usbank-gh-industrial-co-ltd-word-doc-or-excel-xls-spreadsheet-malware/
30 Nov 2015 - "An email with the subject of 'Invoice Attached' pretending to come from random names, companies and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Good morning,
Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice. If you have any questions please let us know.
Thank you!
Mr. Susie Weber
Accounting Specialist| USBank, GH Industrial Co., Ltd
30 November 2015: invoice_details_68171045.xls - Current Virus total detections 1/55*
MALWR analysis** shows us that it downloads http ://gallinda28trudi .com/v12/free17ld.exe (VirusTotal 3/55***) which is a Nymain Ransomware as described by Dynamoo****... The XLS macro drops/creates a UpdateWinrar.js that instructs the victim’s computer to download the file & rename it as %temp%\UpdOffice.exe then automatically run it, so making you think that it is an Office update if you see any alerts about the file running... DO NOT enable macros or editing, no matter how plausible the instructions appear to be:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/invoice_details_68171045_xls-1024x602.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/2dcbe136c4d08ee6a7a918e7088cb461d9ca2e52db7cef79352ff940e245b6d7/analysis/1448892567/
** https://malwr.com/analysis/YTkzYjYxZGJiOTRhNDZjYjg2NGQ4ZDhiOGIxZjAyZjI/
Hosts: 31.184.234.5: https://www.virustotal.com/en/ip-address/31.184.234.5/information/
*** https://www.virustotal.com/en/file/d6dfe0521d13b069864b93d77a5465706f1544fd78b5c6bd556fa37d7ca0a7b0/analysis/1448887816/
FlashPlayerUpdate.exe
**** http://blog.dynamoo.com/2015/11/malware-spam-intuit-qb-quickbooks.html
___
Fake 'Sales Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/11/malware-spam-sales-invoice-opi599241.html
30 Nov 2015 - "This -fake- financial spam is not from James F Kidd, but is instead a simple -forgery- with a malicious attachment:
From: orders@ kidd-uk .com
Date: 30 November 2015 at 13:42
Subject: Sales Invoice OP/I599241 For ANDSTRAT (NO.355) LTD
Please see enclosed Sales Invoice for your attention.
Regards from Accounts at James F Kidd
( email: accounts@ kidd-uk .com )
I have seen a single copy of this spam with an attachment invoice574206_1.doc which has a VirusTotal detection rate of 3/55*. This Malwr report** indicates that in this case there may be an error in the malicious macro. The Hybrid Analysis report is inconclusive. This document is presumably attempting to drop the Dridex banking trojan...
UPDATE: I have received two more samples, one names invoice574206/1.pdf and the other invoice574206/1.doc. Both are Word documents (so the one with the PDF extension will not open). The VirusTotal detection rates are 7/54[3] and 4/55[4]. One of these two also produces an error when run. The working attachment (according to this Malwr report[5] and Hybrid Analysis report[6]) downloads a malicious binary from:
bjdennehy .ie/~upload/89u87/454sd.exe
This has a VirusTotal detection rate of 3/54[6]... Automated analysis tools... show malicious traffic to:
94.73.155.12 (Cizgi Telekomunikasyon Anonim Sirketi, Turkey)
103.252.100.44 (PT. Drupadi Prima, Indonesia)
89.108.71.148 (Agava Ltd, Russia)
91.223.9.70 (Elive Ltd, Ireland)
41.136.36.148 (Mauritius Telecom, Mauritius)
185.92.222.13 (Choopa LLC, Netherlands)
42.117.2.85 (FPT Telecom Company, Vietnam)
195.187.111.11 (Szkola Glowna Gospodarstwa Wiejskiego, Poland)
37.128.132.96 (Memset Ltd, UK)
37.99.146.27 (Etihad Atheeb Telecom Company, Saudi Arabia)
41.38.18.230 (TE Data, Egypt)
89.189.174.19 (Sibirskie Seti Novokuznetsk, Russia)
122.151.73.216 (M2 Telecommunications Group Ltd, Australia)
185.87.51.41 (Marosnet Telecommunication Company LLC, Russia)
217.197.159.37 (NWT a.s., Czech Republic)
41.56.123.235 (Wireless Business Solutions, South Africa)
91.212.89.239 (Uzinfocom, Uzbekistan)...
Recommended blocklist:
94.73.155.12
103.252.100.44
89.108.71.148
91.223.9.70
41.136.36.148
185.92.222.13
42.117.2.85
195.187.111.11
37.128.132.96
37.99.146.27
41.38.18.230
89.189.174.19
122.151.73.216
185.87.51.41
217.197.159.37
41.56.123.235
91.212.89.239 "
(More detail at the dynamoo URL above.)
* https://www.virustotal.com/en/file/cae16277d342331f4223a470bcad614b4cf1ed2a169125bee5f6a31ccdef2a15/analysis/1448893229/
** https://malwr.com/analysis/N2YwM2Q0YzU1OTk0NDRiN2FjNWVmNjUzNjQzYzc5ZTQ/
3] https://www.virustotal.com/en/file/420884ef405ddb16f761b833128bede8916eb54fb16d787914b5eacd994c2831/analysis/1448894274/
4] https://www.virustotal.com/en/file/5ca00b2ad7913e8c24703701eddc356b1428a999f9d8104d3361c572dd85f541/analysis/1448894280/
5] https://malwr.com/analysis/ZjMwYTdmMzBiMTVlNDM0ODg2ZWI2NmRlMDg5NWUyMzE/
6] https://www.hybrid-analysis.com/sample/3763f09f26dbe26ba8000b69a1821bf1f3c12409ef83c4af81e249ef67da91f4?environmentId=1
___
Fake 'Paypal' phish...
- http://myonlinesecurity.co.uk/your-access-is-limited-modainpelle-com-paypal-phishing/
30 Nov 2015 - "An email saying 'Your Access Is Limited' coming from PayPal Team <scanner@ modainpelle .com>
While at first glance this appears to be a typical PayPal phish, there are a few differences... There are a few major common subjects in a phishing attempt. Lots of them are either PayPal or your Bank or Credit Card, with a message saying some thing like:
• Your Access Is Limited
• Urgent: Your card has been stopped !
• There have been unauthorised or suspicious attempts to log in to your account, please verify
• Your account has exceeded its limit and needs to be verified
• Your account will be suspended !
• You have received a secure message from < your bank>
• We are unable to verify your account information
• Update Personal Information
• Urgent Account Review Notification
• We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
• Confirmation of Order
The original email looks like this. It will NEVER be a genuine email from PayPal or Your Bank so don’t ever follow the links or fill in the html (webpage) form that comes attached to the email.
The link in this case goes to http ://www .hocine1990.ehost-services239 .com/index/ ... This particular phishing campaign starts with an email with a link...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/modain_pelle_payapal_phish-1024x740.png
The website looks similar to this typical example of a PayPal phishing site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/fake_paypal-site-1024x531.png
If you fill in the email address and password you get an intermediate page apologising for any inconvenience looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/e_host_paypal_phish-1024x524.png
Then get sent on to a page looking like this one from an earlier PayPal Phish:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/11/fake_paypal-site_2-1024x519.png
Which is a typical phishing page that looks very similar to a genuine PayPal update page, if you don’t look carefully at the URL in the browser address bar. This one wants your personal details, your Paypal account log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details..."
:fear::fear: :mad:
AplusWebMaster
2015-12-01, 13:20
FYI...
Fake 'Card Receipt' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-card-receipt-tracey-smith.html
1 Dec 2015 - "This -fake- financial spam does not come from AquAid, but is instead a simple -forgery- with a malicious attachment. Poor AquAid were hit by the same thing several time earlier this year.
From "Tracey Smith" [tracey.smith@ aquaid .co.uk]
Date Tue, 01 Dec 2015 10:54:15 +0200
Subject Card Receipt
Hi
Please find attached receipt of payment made to us today
Regards
Tracey
Tracey Smith| Branch Administrator
AquAid | Birmingham & Midlands Central
Unit 35 Kelvin Way Trading Estate | West Bromwich | B70 7TP
Telephone: 0121 525 4533
Fax: 0121 525 3502
Mobile: 07795328895
Email: tracey.smith@ aquaid .co.uk ...
Attached is a file CAR014 151238.doc which comes in at least two different versions with a VirusTotal detection rate of 3/55 for both [1] [2]. According to these Malwr reports [3] [4] the macro in the document downloads a file from one of the following locations:
rotulosvillarreal .com/~clientes/6543f/9o8jhdw.exe
data.axima .cz/~krejcir/6543f/9o8jhdw.exe
This binary has a detection rate of 3/54*. The Malwr report** for that file shows that it phones home to:
94.73.155.12 (Cizgi Telekomunikasyon Anonim Sirketi, Turkey)
There are other bad IPs in the 94.73.155.8 - 94.73.155.15 range, so I strongly recommend that you -block- all traffic to 94.73.155.8/29. These two Hybrid Analysis reports [5] [6] also show malicious traffic to the following IPs:
89.248.99.231 (Interdominios S.A., Spain)
103.252.100.44 (PT. Drupadi Prima, Indonesia)
89.108.71.148 (Agava Ltd, Russia)
221.132.35.56 (Post and Telecom Company, Vietnam)
78.24.14.20 (VSHosting s.r.o., Czech Republic)
The payload here is probably the Dridex banking trojan...
Recommended blocklist:
94.73.155.8/29
89.248.99.231
103.252.100.44
89.108.71.148
221.132.35.56
78.24.14.20 "
1] https://www.virustotal.com/en/file/2e477962b4d2f68c508c9f4fb557d6043aed7e523e74d98993dca34d82a6579a/analysis/1448964063/
2] https://www.virustotal.com/en/file/dec8babe98f74c83f9e3c903f2d8d76cfd23c7835b2d1c98265a4bef2e7ea334/analysis/1448964077/
3] https://malwr.com/analysis/YTY5ZmVkYzg4ZDgzNDhjNWFlOTcyZGUyOGQ0MWQ0ZWE/
4] https://malwr.com/analysis/MWRhNzE0N2NhN2RlNGE4NjllYTk2NGE5NzMxMWUxY2Y/
* https://www.virustotal.com/en/file/6c0893a5477d185813e588b5bf816005d124065bfbbd4f8a6b37f1b211039c79/analysis/1448964517/
** https://malwr.com/analysis/ZWNkZTQ4NWQ1ODU0NGFlMzhmOGM4NTFiMDU3MDE3Zjk/
5] https://www.hybrid-analysis.com/sample/2e477962b4d2f68c508c9f4fb557d6043aed7e523e74d98993dca34d82a6579a?environmentId=1
6] https://www.hybrid-analysis.com/sample/dec8babe98f74c83f9e3c903f2d8d76cfd23c7835b2d1c98265a4bef2e7ea334?environmentId=1
___
Fake 'Request for payment' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/request-for-payment-pgs73329-pgs-services-rebecca-hughes-word-doc-or-excel-xls-spreadsheet-malware/
1 Dec 2015 - "An email with the subject of 'Request for payment (PGS/73329)' pretending to come from PGS Services Limited <rebecca@ pgs-services .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Request-for-payment-PGS73329-1024x541.png
1 December 2015: 3-6555-73329-1435806061-3.doc - Current Virus total detections 4/55*
MALWR** shows me that it downloads http ://cru3lblow.xf .cz/6543f/9o8jhdw.exe (VirusTotal 1/52***) which looks like a revised/updated Dridex binary... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e5d4ef652d3560896baf628f63ff9b4330e4a29bafa4d6107cb2b947f2e34d88/analysis/1448972343/
** https://malwr.com/analysis/YjRiNGYwOWM2OTY5NGE3OGEzYzdkMWQ1MjgxOGYyODk/
88.86.117.154: https://www.virustotal.com/en/ip-address/88.86.117.154/information/
*** https://www.virustotal.com/en/file/b8e71df7a2236f1cf65ba6be02a6615217b61166e71164979d23d7254a446d1b/analysis/1448972854/
TCP connections
157.252.245.29: https://www.virustotal.com/en/ip-address/157.252.245.29/information/
23.14.92.19: https://www.virustotal.com/en/ip-address/23.14.92.19/information/
94.73.155.12: https://www.virustotal.com/en/ip-address/94.73.155.12/information/
> https://www.virustotal.com/en/url/16f5c52087562f649062da32a8d4b0cc5419731eaaeeac7e51107e81c927d2fd/analysis/
- http://blog.dynamoo.com/2015/12/malware-spam-request-for-payment.html
1 Dec 2015 - "This spam email is confused. It's either about a watch repair or property maintenance. In any case, it has a malicious attachment...
From: PGS Services Limited [rebecca@ pgs-services .co.uk]
Date: 1 December 2015 at 12:06
Subject: Request for payment (PGS/73329)...
RST Support Services Limited
Rotary Watches Ltd...
Full details are attached to this email in DOC format...
Attached is a file 3-6555-73329-1435806061-3.doc which comes in at least three different versions... The payload is probably the Dridex banking trojan...
Recommended blocklist:
94.73.155.8/29
89.32.145.12
221.132.35.56
157.252.245.29 "
___
Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-96914158-fastco-antoine-lambert-superman-malware-word-doc-malware/
1 Dec 2015 - "An email with the subject of 'Invoice #96914158 – Fastco' coming from Antoine Lambert <LambertAntoine85@ tellas .gr> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Here is the Fastco Corp. Invoice we talked about earlier today. Please cost code and get it back to me.
Thanks, Antoine Lambert
... coming from random compromised email accounts and have random invoice numbers...
1 December 2015: INVOICE_96914158.doc - Current Virus total detections 2/56*
This word doc contains a base64 encoded ole object which MALWR** shows us contacts
http ://31.210.119.169 /superman/kryptonite.php and downloads clarkent.exe (VirusTotal ***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/7794bcf54ecedb24121ea9da6f948e4319a4f7b79652715e6acb6c2c88aa0227/analysis/1448981594/
** https://malwr.com/analysis/YTRjMzMyZjgxNjZkNGY5OTk3YTZlODA3MjQ4ODU0ZmI/
*** https://www.virustotal.com/en/file/66a3524b6bbec37ead74fcc7f3a218017c2cc2cba6eeb891364407318e1684c1/analysis/1448982333/
TCP connections
157.252.245.27: https://www.virustotal.com/en/ip-address/157.252.245.27/information/
191.234.4.50: https://www.virustotal.com/en/ip-address/191.234.4.50/information/
:fear::fear: :mad:
AplusWebMaster
2015-12-02, 12:03
FYI...
Fake 'Purchase Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-purchase-order-124658-gina.html
2 Dec 2015 - "This -fake- financial spam is not from CliniMed Limited but is instead a simple -forgery- with a malicious attachment:
From Gina Harrowell [gina.harrowell@ clinimed .co.uk]
Date Wed, 02 Dec 2015 01:53:41 -0700
Subject Purchase Order 124658
Sent 2 DEC 15 09:18
CliniMed Ltd
Cavell House
Knaves Beech Way
Loudwater
High Wycombe
Bucks
HP10 9QY ...
Attached is a file P-ORD-C-10156-124658.xls which I have seen two versions of (VirusTotal results [1] [2]) which contain a malicious macro... which according to these automated analysis reports [3] [4] [5] [6] pulls down an evil binary from:
det-sad-89 .ru/4367yt/p0o6543f.exe
vanoha.webzdarma .cz/4367yt/p0o6543f.exe
There may be other versions of the Excel document with different download locations, but the payload will be the same. This has a VirusTotal detection rate of 1/55* and those previous reports plus this Malwr report** indicate malicious network traffic to the following IPs:
193.238.97.98 (PJSC Datagroup, Ukraine)
94.73.155.12 (Cizgi Telekomunikasyon Anonim Sirketi, Turkey)
89.32.145.12 (Elvsoft SRL, Romania / Coreix, UK)
The payload is probably the Dridex banking trojan...
Recommended blocklist:
193.238.97.98
94.73.155.8/29
89.32.145.12 "
1] https://www.virustotal.com/en/file/96a1cc638a0beecce0fd3ada82901009993d0ef5f76dac4e6ccf30ce2d3bc8ea/analysis/1449050700/
2] https://www.virustotal.com/en/file/e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6/analysis/1449050710/
3] https://malwr.com/analysis/OGRiYjI0MGUxZDNmNDVlMDg3MGE5OGMzNTFmNThjMDk/
4] https://malwr.com/analysis/ZWYyZjQ5MTRjNGRkNDdkNjg0NDczM2RlODVmNTcxNjg/
5] https://www.hybrid-analysis.com/sample/96a1cc638a0beecce0fd3ada82901009993d0ef5f76dac4e6ccf30ce2d3bc8ea?environmentId=1
6] https://www.hybrid-analysis.com/sample/e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6?environmentId=1
* https://www.virustotal.com/en/file/db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210/analysis/1449050819/
TCP connections
193.238.97.98: https://www.virustotal.com/en/ip-address/193.238.97.98/information/
90.84.59.27: https://www.virustotal.com/en/ip-address/90.84.59.27/information/
** https://malwr.com/analysis/OTBlMTJjZDYzNDYzNDFjZTlmMmY1NWQ0OTBkMDhlZjA/
- http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/
2 Dec 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Purchase-Order-124658-1024x686.png
25 February 2015: P-ORD-C-10156-124658.xls - Current Virus total detections 5/55*
MALWR analysis** shows us that it downloads what looks like Dridex Banking malware from
http ://vanoha.webzdarma .cz/4367yt/p0o6543f.exe (VirusTotal 1/55***)...
* https://www.virustotal.com/en/file/e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6/analysis/1449050502/
** https://malwr.com/analysis/OGRiYjI0MGUxZDNmNDVlMDg3MGE5OGMzNTFmNThjMDk/
*** https://www.virustotal.com/en/file/db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210/analysis/1449051414/
TCP connections
193.238.97.98: https://www.virustotal.com/en/ip-address/193.238.97.98/information/
90.84.59.27: https://www.virustotal.com/en/ip-address/90.84.59.27/information/
___
Fake 'Payment Request' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-aline-payment-request.html
2 Dec 2015 - "This -fake- financial spam is not from Aline Pumps but is instead a simple -forgery- with a malicious attachment. In any cases Aline are an Australian company, they would -not- be sending out invoices in UK pounds.
From: Bruce Sharpe [bruce@ alinepumps .com]
Date: 2 December 2015 at 09:44
Subject: Aline Payment Request
ATTENTION: ACCOUNTS PAYABLE
Dear Sir/Madam,
Overdue Alert
Our records show that your current balance with us is £2795.50 of which £2795.50 is still overdue.
Your urgent attention and earliest remittance of this amount would be appreciated.
We value your business and we would like to resolves any issues as quickly as possible. I am personally available on (02) 8508 4900 or bruce@ alinepumps .com
Sincerely,
Bruce Sharpe - Accounts Receivable ...
Attached is a file Statement_1973_1357257122414.doc which comes in at least three versions (although I have only seen two), with VirusTotal results of 4/55 [1] [2] and automated analysis [3] [4] shows download locations of:
pivarimb .wz.cz/4367yt/p0o6543f.exe
allfirdawhippet .com/4367yt/p0o6543f.exe
apparently there is another download location of
sebel .fr/4367yt/p0o6543f.exe
In any case, the downloaded binary is the same and has a detection rate of 3/55*. The Malwr analysis** and this Hybrid Analyis*** shows it phoning home to:
193.238.97.98 (PJSC DATAGROUP, Ukraine)
I strongly recommend that you -block- traffic to that IP."
1] https://www.virustotal.com/en/file/d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6/analysis/1449054590/
2] https://www.virustotal.com/en/file/e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d/analysis/1449054600/
3] https://malwr.com/analysis/MDkzNDFlZjAyYTQ5NGUyYmJjNGZkODM4YWNmNDA1OWU/
4] https://malwr.com/analysis/Mjc5MjdkZDI5ODI2NDdmYmEwODU2YjFkMjI0NjViNjY/
* https://www.virustotal.com/en/file/450349f6ceede5c78f6eb26af82b1e5e7771b269fbb5bba7419d5a26d6b03f0c/analysis/1449054750/
** https://malwr.com/analysis/NTE3Nzg2NjU1MmQ2NGVjZGEzZDgyZWZjYmViMGQwMjc/
*** https://www.hybrid-analysis.com/sample/e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d?environmentId=1
- http://myonlinesecurity.co.uk/aline-payment-request-alinepumps-com-bruce-sharpe-word-doc-or-excel-xls-spreadsheet-malware/
2 Dec 2015 - "Following on from last week’s Malspam run* pretending to come from Aline pumps is today’s email with the subject of 'Aline Payment Request' pretending to come from Bruce Sharpe <bruce@ alinepumps .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
* http://myonlinesecurity.co.uk/aline-tax-invoice-40525-bruce-sharpe-brucealinepumps-com-word-doc-malware/
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Aline-Payment-Request-1024x575.png
2 December 2015: Statement_1973_1357257122414.doc - Current Virus total detections 4/56*
MALWR analysis** shows us that it downloads Dridex Banking malware from
http ://pivarimb.wz .cz/4367yt/p0o6543f.exe (VirusTotal ***). This is an updated version from today’s earlier malspam run[1] of malicious office docs with macros..."
* https://www.virustotal.com/en/file/e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d/analysis/1449053035/
** https://malwr.com/analysis/Mjc5MjdkZDI5ODI2NDdmYmEwODU2YjFkMjI0NjViNjY/
88.86.117.153
193.238.97.98
191.234.4.50
*** https://www.virustotal.com/en/file/450349f6ceede5c78f6eb26af82b1e5e7771b269fbb5bba7419d5a26d6b03f0c/analysis/1449053672/
TCP connections
193.238.97.98
8.254.218.62
1] http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'November Invoice' SPAM - JS malware
- http://myonlinesecurity.co.uk/november-invoice-37330118-js-malware-teslacrypt/
2 Dec 2015 - "An email with the subject of 'November Invoice' #37330118 [random numbered] pretending to come from random names and senders with a zip attachment is another one from the current bot runs... The content of the email says:
Hello ,
Please review the attached copy of your Electronic document.
A paper copy of this document is being mailed, but this email is being sent in addition for your convenience.
Thank you for your business.
2 December 2015: invoice_37330118.zip: Extracts to: INVOICE_main_BD3847636213.js
Current Virus total detections 2/54* which downloads a Teslacrypt ransomware from
http ://74.117.183.84 /76 .exe (VirusTotal 3/55**) and tries to contact a combination of these sites
ccfinance .it | ecaequeeessa .com | schonemaas .nl | cic-la-banque .org and either download additional malware or upload stolen data from your computer (MALWR***). Our friends over at Techhelplist[1] have posted a fuller breakdown of this one... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/312b3d5e220ea5d27761eca7af4d321f540c7484adff38886d03277688e8cb66/analysis/1449062157/
** https://www.virustotal.com/en/file/fbe5799be2874e75a46729d870b4760f2db6efc8284d87e51ca09204dfe12bd7/analysis/1449062699/
*** https://malwr.com/analysis/ZmYzOTUzMjY1YWJmNDA2Njk3MmVmMDUwNmMxZmFhZTg/
74.117.183.84: https://www.virustotal.com/en/ip-address/74.117.183.84/information/
> https://www.virustotal.com/en/url/f51f62d8a6bb70839bff5c9180c1ec019e4afcfff4f753fa550f48a1bf596395/analysis/
1] https://techhelplist.com/spam-list/987-november-invoice-malware
- http://blog.dynamoo.com/2015/12/malware-spam-november-invoice-60132748.html
2 Dec 2015 - "... Attached is a file invoice_60132748.zip which contains a malicious obfuscated script INVOICE_main_BD3847636213.js... and this downloads a malicious file from:
74.117.183.84 /76.exe?1
... The Malwr report* and Hybrid Analysis** indicates that this communicates with the following compromised domains:
ccfinance .it
ecaequeeessa .com
schonemaas .nl
cic-la-banque .org
Both those reports indicate that this is the Teslacrypt ransomware:
> http://1.bp.blogspot.com/-b_75tajtmR8/Vl8Clj-vY8I/AAAAAAAAHbk/PuYBCSWsYOI/s1600/teslacrypt.png
Furthermore, the Hybrid Analysis report** also shows other traffic to:
tsbfdsv.extr6mchf .com
alcov44uvcwkrend .onion .to
rbtc23drs.7hdg13udd .com ...
Recommended blocklist:
74.117.183.84
5.39.222.193
ccfinance .it
ecaequeeessa .com
schonemaas .nl
cic-la-banque .org
extr6mchf .com
alcov44uvcwkrend .onion .to
7hdg13udd .com "
* https://malwr.com/analysis/OWM5NWIxYTQ4OTkyNGQ0ZmFjMGNhOGQ2MTYxOWQ5ZjI/
** https://www.hybrid-analysis.com/sample/fbe5799be2874e75a46729d870b4760f2db6efc8284d87e51ca09204dfe12bd7?environmentId=1
___
Fake 'Adler Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-your-adler-invoice-no-uk.html
2 Dec 2015 - "This -fake- financial spam does not come from Adler Manufacturing Limited but is instead a simple forgery. It is meant to have a malicious attachment, but all of the samples I have seen are malformed.
From: service@ adlerglobal .com
Date: 2 December 2015 at 11:36
Subject: Your Adler Invoice No. UK 314433178 IN
Dear Customer,
Thank you very much for having placed your order with Adler.
Your goods have been shipped. Please see attached invoice for payment of
your order.
For your convenience, you will find several payment methods described on the
attached invoice (please be sure to include your Adler Order #).
If you have any questions, feel free to contact us.
Best Regards,
Your Adler Customer Service Team...
Supposedly attached is a document MD220EML.XLS but instead all the samples I see just have a Base 64 encoded section instead. Shame. If you go to the effort of decoding them, they are two moderately detected malicious documents (VirusTotal results [1] [2]) which according to these Malwr reports [3] [4] downloads a binary from:
vanoha.webzdarma .cz/4367yt/p0o6543f.exe
det-sad-89 .ru/4367yt/p0o6543f.exe
These download locations were seen earlier, but the payload has -changed- to one with a detection rate of 4/55*. Those earlier Malwr reports indicate malicious traffic to:
193.238.97.98 (PJSC DATAGROUP, Ukraine)
I strongly recommend that you -block- traffic to that IP. The payload is likely to be the Dridex banking trojan."
1] https://www.virustotal.com/en/file/6f756ad74b156855a02175b9adce34a3e5b6de38275f30e449bf14aa9ecef527/analysis/1449064630/
2] https://www.virustotal.com/en/file/ebbddbbc330fa3917c2f6e5b2b84c7fa039cdc142d97a30a35f9b975031d90e5/analysis/1449064641/
3] https://malwr.com/analysis/NzRmOGExNTNkYzg1NDA5NTljMzQ5M2NiYWVkYTZkNDY/
4] https://malwr.com/analysis/MTk0YWQ0ODRkM2ZhNGRmYTkxMGZiYWNlYTgwOTBjZWQ/
* https://www.virustotal.com/en/file/d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f/analysis/1449064895/
___
Fake 'Shell E-bill' SPAM - doc malware
- http://myonlinesecurity.co.uk/shell-fuel-card-e-bill-0765017-for-account-b500101-31122014-word-doc-malware/
2 Dec 2015 - "The bad actors are either getting lazy or concentrating their efforts on old email templates that have attracted good returns previously. There seems to be a theme of reusing old email templates this week but this one from last year without even bothering to change the date is sheer idleness by the bad actor sending them. An email with the subject of 'Shell Fuel Card E-bill 0765017 for Account B500101 31/12/2014' pretending to come from Fuel Card Services <adminbur@ fuelcardgroup .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
Please note that this message was sent from an unmonitored mailbox which is unable to accept replies. If you reply to this e-mail your request will not be actioned. If you require copy invoices, copy statements, card ordering or card stopping please e-mail support@ fuelcardservices .com quoting your account number which can be found in the e-mail below...
E-billing
From: adminbur@ fuelcardservices .com
Sent: Wed, 02 Dec 2015 19:25:57 +0530
To: [REDACTED]
Subject: Shell Fuel Card E-bill 0765017 for Account B500101 31/12/2014
Account: B500101
Please find your e-bill 0765017 for 30/10/2015 attached.
To manage you account online please click xxxxx
If you would like to order more fuel cards please click xxxxx
If you have any queries, please do not hesitate to contact us.
Regards
Cards Admin.
Fuel Card Services Ltd
T 01282 410704
F 0844 870 9837 ...
2 December 2015: ebill0765017.doc - Current Virus total detections 6/55*
MALWR** The word docs are the same as described in todays earlier malspam runs... however the Dridex malware downloaded from http ://sebel .fr/4367yt/p0o6543f.exe is an -updated- variant (VirusTotal 4/55***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c/analysis/1449064154/
** https://malwr.com/analysis/N2U3N2UzNzI1NTI2NDgzMjhmYjJhODAyOGRiYWI2NWU/
*** https://www.virustotal.com/en/file/d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f/analysis/1449064895/
sebel .fr: 213.186.33.19: https://www.virustotal.com/en/ip-address/213.186.33.19/information/
> https://www.virustotal.com/en/url/48cf3c6f7a34d9e1905a2a30c6f8dd95625aceb15bb7845159a008edf4767cdd/analysis/
- http://blog.dynamoo.com/2015/12/malware-spam-shell-fuel-card-e-bill.html
2 Dec 2015 - "... The attachment is name ebill0765017.doc and it comes in two different versions. The payload appears to be -identical- to this spam run* earlier today. The payload is the Dridex banking trojan."
* http://blog.dynamoo.com/2015/12/malware-spam-aline-payment-request.html
___
Fake 'Paypal' phish...
- http://myonlinesecurity.co.uk/dear-paypal-customer-paypal-phishing/
2 Dec 2015 - "The phishing bots have got a bit confused today and can’t decide if they are imitating PayPal or HMRC to steal your money and identity. An email saying 'Dear Paypal Customer' pretending to come from online-service @hmrc .gov .uk ...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Dear-Paypal-Customer-1024x550.png
The link in this case goes to http ://blood4u .org/apple .com which has an -old- style PayPal log-in page:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/blood4u_paypal_phish-1024x519.png
The red warning in the URL bar shows that Internet Explorer smart filter knows about it & alerts to it being -fake- and dangerous, which is a typical phishing page that looks very similar to a genuine old style PayPal update page, if you don’t look carefully at the URL in the browser address bar. This one wants your personal details, your Paypal account log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details..."
blood4u .org: 108.179.232.158: https://www.virustotal.com/en/ip-address/108.179.232.158/information/
> https://www.virustotal.com/en/url/b579941607817453df4b9b14a9c5dd1505161981f1ffc0e8de670d778fd734e7/analysis/
:fear::fear: :mad:
AplusWebMaster
2015-12-03, 13:01
FYI...
Fake 'Scanned image' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-scanned-image-from-mx-2600n.html
3 Dec 2015 - "This -fake- scanned image document appears to come from within the victim's own domain, but it is in fact just a simple -forgery- with a malicious attachment.
From: no-reply@ victimdomain .tld
Date: 3 December 2015 at 08:12
Subject: Scanned image from MX-2600N
Reply to: no-reply@ victimdomain .tld [no-reply@ victimdomain .tld]
Device Name: Not Set
Device Model: MX-2600N
Location: Not Set
File Format: DOC MMR(G4)
Resolution: 200dpi x 200dpi
Attached file is scanned image in DOC format.
Use Microsoft(R)Word(R) of Microsoft Systems Incorporated
to view the document.
Attached is a file named no-reply@victimdomain.tld_20151203_3248.doc which I have seen just a single sample of so far with a VirusTotal detection rate of 2/55*, and which contains this malicious macro... Automated analysis tools [1] [2] show that the macro downloads a component from the following location:
vinsdelcomtat .com/u5y432/h54f3.exe
There will probably be other versions of the document downloading from other locations, but for the moment the binary will be the same. This has a detection rate of 3/55** and this Malwr report*** shows that it communicates with a known bad IP of:
193.238.97.98 (PJSC DATAGROUP, Ukraine)
I strongly recommend that you -block- traffic to that IP. The payload is most likely to be the Dridex banking trojan."
* https://www.virustotal.com/en/file/b1da03fd4b627dd17018b22ead8e7ae29c425852fb155f1e3fc601dacb9f7853/analysis/1449134658/
1] https://malwr.com/analysis/MDUzNDZiY2ExNDgyNGQyM2EzNjAzYTdmMzI4YmEzM2Y/
2] https://www.hybrid-analysis.com/sample/b1da03fd4b627dd17018b22ead8e7ae29c425852fb155f1e3fc601dacb9f7853?environmentId=1
** https://www.virustotal.com/en/file/f3cf469da393c2a1eb4ddff67676974bca79006b81e2d378dee1b08c04f624e6/analysis/1449135336/
*** https://malwr.com/analysis/NWVlYmQ2NzYwYjA4NDdiZGIzZjU4ZGI0NmFiODA1ZDI/
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-invoice-from-datanet.html
3 Dec 2015 - "This -fake- financial email does not come from Datanet but is instead a simple -forgery- with a malicious attachment:
From: Holly Humphreys [Holly.Humphreys@ datanet .co.uk]
Date: 3 December 2015 at 08:57
Subject: Invoice from DATANET the Private Cloud Solutions Company
Dear Accounts Dept :
Your invoice is attached, thank you for your business.
If you have any queries please do not hesitate to contact us.
Regards ...
Holly Humphreys
Operations
Datanet - Hosting & Connectivity...
I have seen only one sample of this spam with an attachment with a somewhat interesting name of C:\\Users\\HOLLY~1.HUM\\AppData\\Local\\Temp\\Inv_107666_from_DATANET.CO..xls which saves on my computer as C__Users_HOLLY~1.HUM_AppData_Local_Temp_Inv_107666_from_DATANET.CO..xls. This contains this malicious macro... and has a VirusTotal detection rate of 3/55*. According to this Malwr report** and this Hybrid Analysis*** the XLS file downloads a malicious binary from:
encre .ie/u5y432/h54f3.exe
There will probably be other versions of this document downloading from other locations too. This has a VirusTotal detection rate of just 1/55**** and that report plus this Malwr report[5] indicate malicious network traffic to:
162.208.8.198 (VPS Cheap, US / Sulaiman Alfaifi, Saudi Arabia)
94.73.155.12 (Cizgi Telekomunikasyon Anonim Sirketi, Turkey)
78.47.66.169 (Hetzner, Germany)
The payload is almost definitely the Dridex banking trojan.
Recommended blocklist:
162.208.8.198
94.73.155.8/29
78.47.66.169
UPDATE: I have seen another version of the document... and a VirusTotal result of 3/54[6]. According to this Malwr report[7] it downloads from:
parentsmattertoo .org/u5y432/h54f3.exe "
* https://www.virustotal.com/en/file/b6aec60340d848714df78289f6734d4b3d877dacaea7e70e78bed0ccd4b8b4e7/analysis/1449136696/
** https://malwr.com/analysis/N2Q4MGIyMmY4YjU3NDVkY2JiZmVkMGRjNTVkYzA0ZTM/
*** https://www.hybrid-analysis.com/sample/b6aec60340d848714df78289f6734d4b3d877dacaea7e70e78bed0ccd4b8b4e7?environmentId=2
**** https://www.virustotal.com/en/file/b6aec60340d848714df78289f6734d4b3d877dacaea7e70e78bed0ccd4b8b4e7/analysis/1449136696/
5] https://www.hybrid-analysis.com/sample/b6aec60340d848714df78289f6734d4b3d877dacaea7e70e78bed0ccd4b8b4e7?environmentId=2
6] https://www.virustotal.com/en/file/69baedcd4300842e9d2c7c2938bbfcfdb65cf384c6fd8e3b2622f2e1546c9bb7/analysis/1449137162/
7] https://malwr.com/analysis/MGE3YTQ1YThlM2M2NDFjNzgyZjVkOGI0ZDYxOWNjNzg/
- http://myonlinesecurity.co.uk/invoice-from-datanet-the-private-cloud-solutions-company-holly-humphreys-excel-xls-spreadsheet-malware/
3 Dec 2015
"... one from the current bot runs...:
3 December 2015: C___Users__HOLLY~1.HUM__AppData__Local__Temp__Inv_107666_from_DATANET.CO..xls
Current Virus total detections 3/55* - MALWR** tells us that it downloads http ://encre .ie/u5y432/h54f3.exe (VirusTotal 1/55***) which is likely to be Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b6aec60340d848714df78289f6734d4b3d877dacaea7e70e78bed0ccd4b8b4e7/analysis/1449138312/
** https://malwr.com/analysis/N2Q4MGIyMmY4YjU3NDVkY2JiZmVkMGRjNTVkYzA0ZTM/
*** https://www.virustotal.com/en/file/69baedcd4300842e9d2c7c2938bbfcfdb65cf384c6fd8e3b2622f2e1546c9bb7/analysis/1449137162/
TCP connections
94.73.155.12: https://www.virustotal.com/en/ip-address/94.73.155.12/information/
8.254.218.14: https://www.virustotal.com/en/ip-address/8.254.218.14/information/
78.47.66.169: https://www.virustotal.com/en/ip-address/78.47.66.169/information/
___
Fake 'ICM - Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-icm-invoice-2393.html
3 Dec 2015 - "This -fake- financial spam does not come from Industrial Cleaning Materials but is instead a simple -forgery- with a malicious attachment:
From "Industrial Cleaning Materials (ICM)" [sales@ icmsupplies .co.uk]
Date Thu, 03 Dec 2015 18:22:34 +0700
Subject ICM - Invoice #2393
Dear Customer,
Please find invoice 2393 attached.
Kind Regards,
ICM
Industrial Cleaning Materials ...
I have seen two version of the attachment order_2393.doc with VirusTotal results of 2/54 [1] [2] and the Malwr reports [3] [4] show that they download a component from:
www .ofenrohr-thermometer .de/u5y432/h54f3.exe
ante-prima .com/u5y432/h54f3.exe
This has a VirusTotal detection rate of 1/53*. The payload appears to be the -same- as the one in this spam run earlier today** and looks like the Dridex banking trojan."
1] https://www.virustotal.com/en/file/00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51/analysis/1449142268/
2] https://www.virustotal.com/en/file/5346af151cce45adc3d8fbf583ecc8f4d4b8a699f67048bb0b932eca61357935/analysis/1449142290/
3] https://malwr.com/analysis/ZjY1YWQ3NmQ3MzI4NDFhY2EzYzU4OTAwNGViNjBmYjc/
4] https://malwr.com/analysis/NDIyYzY5YjZjZGYwNDdjNWI3NDBhMDJhYWU0MWU0NDY/
* https://www.virustotal.com/en/file/69baedcd4300842e9d2c7c2938bbfcfdb65cf384c6fd8e3b2622f2e1546c9bb7/analysis/1449142424/
TCP connections
94.73.155.12: https://www.virustotal.com/en/ip-address/94.73.155.12/information/
8.254.218.14: https://www.virustotal.com/en/ip-address/8.254.218.14/information/
78.47.66.169: https://www.virustotal.com/en/ip-address/78.47.66.169/information/
** http://blog.dynamoo.com/2015/12/malware-spam-invoice-from-datanet.html
- http://myonlinesecurity.co.uk/icm-invoice-2393-industrial-cleaning-materials-word-doc-malware/
3 Dec 2015 - "... another one from the current bot runs...
3 December 2015 : order_2393.doc - Current Virus total detections 2/52*
MALWR** shows a download from http ://www.ofenrohr-thermometer .de/u5y432/h54f3.exe (VirusTotal 0/47**) which is the same Dridex banking Trojan from today’s other malspam runs... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/00ab8a1a2bfa99a92e0cacaaf1e7ca1af6c8cc0eab6f070f157ec9c2d7f03a51/analysis/1449141906/
** https://www.virustotal.com/en/file/69baedcd4300842e9d2c7c2938bbfcfdb65cf384c6fd8e3b2622f2e1546c9bb7/analysis/1449142424/
TCP connections
94.73.155.12: https://www.virustotal.com/en/ip-address/94.73.155.12/information/
8.254.218.14: https://www.virustotal.com/en/ip-address/8.254.218.14/information/
78.47.66.169: https://www.virustotal.com/en/ip-address/78.47.66.169/information/
___
Apple Account Audit – Phish...
- http://myonlinesecurity.co.uk/apple-account-audit-phishing/
3 Dec 2015 - "An email saying 'Apple Account Audit' coming from Apple <secure@ icloudresources .co.uk> is a -phishing- email that is designed to steal your Apple/ITunes account details as well as your credit card & other bank details. This one wants your personal details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Apple-Account-Audit-1024x722.png
The link in the email goes to http ://itunesconsumerhelp .com/myicloud/?email=victim@ victimdomain .com
-If- you -open- the attached html file you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Applephish1-1024x579.png
... the phisher has set up the website so that unless you either click through from the email or insert a email address in the format they require, you get a -fake- domain ['Account'] suspended notice..."
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/apple_fake_suspended-1024x453.png
The emails come from real newly created domains that sound and look like genuine Apple domains. The emails all have proper SPF and DKIM headers to help them get-past-spam-filters... All of these emails use Social engineering tricks to persuade you to open-the-attachments that come with the email..."
___
Facebook Phish...
- https://blog.malwarebytes.org/fraud-scam/2015/12/facebook-phishers-lure-users-with-free-video-app/
Dec 3, 2015 - "... Recently, we’ve seen a campaign... -baiting- users with a -free- “Facebook video application”:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/sp-original.png
... It asks for the user’s account credentials in order to access this so-called app. Once they are provided, the fake Facebook page saves the data onto a PHP page on its domain. We’ve seen a similar campaign hosted on another fake Facebook page, facebookstls[DOT]com:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/stls.png
... Should you encounter the above pages, or something similar, steer clear. We also advise our readers who are unfamiliar with -phishing- campaigns on Facebook and what to do if they realized that their credentials have been -stolen- to refer to this page* on the Help Center section**..."
* https://www.facebook.com/help/217910864998172/
** https://www.facebook.com/help/
facebookstls[DOT]com: 185.86.210.113: https://www.virustotal.com/en/ip-address/185.86.210.113/information/
Close named site: http://trafficlight.bitdefender.com/info?url=http://facebooksk.info
"... Scammers can set up -fake- escrow websites and -fake- shipping companies. While promising to provide escrow services, once payment is made, the -fake- escrow website will take the money and disappear. These -scams- work hand in hand with fake shipping companies and target small businesses, such as restaurants, catering companies, etc. While purchasing large quantities of products, the scammers use stolen credit card numbers or counterfeit checks to complete the sale, and request that the items be shipped with a private third party shipping company, which only accepts payments through some wire transfer service..."
:fear::fear: :mad:
AplusWebMaster
2015-12-04, 12:11
FYI...
Fake 'receipt' SPAM - xls malware
- http://myonlinesecurity.co.uk/pws-ltd-perpetual-watchservices-receipt-of-payment-word-doc-or-excel-xls-spreadsheet-malware/
4 Dec 2015 - "An email with the subject of 'receipt of payment' pretending to come from Perpetual Watchservices <perpetualwatchservices@ yahoo .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Hi ,
thank you for payment , please find attachment with receipt.
Best regards,
Irina
PWS LTD
41-A Great Underbank
Stockport
SK1 1NE
Opening Times: Monday- Friday 8:30-4:30
0161-480-90880161-480-9088
4 December 2015: Receipt-13764(1).doc - Current Virus total detections 4/54*
... hybrid analysis** shows us that it downloads what looks like a Dridex banking Trojan from
gwsadmin.globalwinestocks .com/325r3e32/845t43f.exe (VirusTotal 3/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6dca1e3b7f3b2cd5bfd011a08c45922b52188cdc4491f2ef6f72c0ab8cc469b9/analysis/1449224485/
** https://www.hybrid-analysis.com/sample/6dca1e3b7f3b2cd5bfd011a08c45922b52188cdc4491f2ef6f72c0ab8cc469b9?environmentId=2
*** https://www.virustotal.com/en/file/74a56c5bd7c328c152a26c0102e7501a0d9b385ba80d62297a11e78fd6918b7f/analysis/1449224741/
:fear::fear: :mad:
AplusWebMaster
2015-12-07, 12:50
FYI...
Fake 'Shipping Doc' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/transglobal-express-shipping-documentation-tg-1569311-word-doc-or-excel-xls-spreadsheet-malware/
7 Dec 2015 - "An email that appears to come form Transglobal Express with the subject of 'Transglobal Express – Shipping Documentation (TG-1569311)' pretending to come from sales@ transglobalexpress .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Transglobal-Express-Shipping-Documentation-TG-1569311-1024x599.png
7 December 2015: 1569311-1Z2X12A50495162278.doc - Current Virus total detections 7/55*
MALWR** tells us it downloads http ://www.lama .rs/87tr65/43wedf.exe Which is likely to be the Dridex banking Trojan (VirusTotal 1/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/557dfab57c2fc5b29977910a09a366cd4471a5414171570ff720d569f3b9532f/analysis/1449481851/
** https://malwr.com/analysis/Mzk2ZTkxMjUxZGM2NGQwZGIwZGYwOTIyOWQ5MDEzMjU/
*** https://www.virustotal.com/en/file/842cb91f42f468ee17f125318f4d54d7b5836a71371e1d6fa865199710881d8d/analysis/1449482026/
TCP connections
23.113.113.105: https://www.virustotal.com/en/ip-address/23.113.113.105/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
- http://blog.dynamoo.com/2015/12/malware-spam-transglobal-express.html
7 Dec 2015 - "... -fake- shipping spam does not come from Transglobal Express but is instead a simple -forgery- with a malicious attachment...
Attached is a file 1569311-1Z2X12A50495162278.doc which in the samples I have seen has a detection rate of 7/55* and which contains this malicious macro... According to this Malwr report**, the macro downloads a binary from:
www .lama .rs/87tr65/43wedf.exe
This has a VirusTotal detection rate of just 1/54***. Those two reports plus this Hybrid Analysis[4] indicate network traffic to:
23.113.113.105 (AT&T Internet Services, US)
I strongly recommend that you -block- traffic to that IP. The payload here is almost definitely the Dridex banking trojan."
* https://www.virustotal.com/en/file/557dfab57c2fc5b29977910a09a366cd4471a5414171570ff720d569f3b9532f/analysis/1449482367/
** https://malwr.com/analysis/Mzk2ZTkxMjUxZGM2NGQwZGIwZGYwOTIyOWQ5MDEzMjU/
*** https://www.virustotal.com/en/file/842cb91f42f468ee17f125318f4d54d7b5836a71371e1d6fa865199710881d8d/analysis/1449482582/
TCP connections
23.113.113.105: https://www.virustotal.com/en/ip-address/23.113.113.105/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
4] https://www.hybrid-analysis.com/sample/842cb91f42f468ee17f125318f4d54d7b5836a71371e1d6fa865199710881d8d?environmentId=1
___
Fake 'Apple receipt' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-your-receipt-from-apple.html
7 Dec 2015 - "This -fake- receipt does not come from an Apple Store, but is instead a simple -forgery- with a malicious attachment:
From: manchesterarndale@ apple .com
Date: 7 December 2015 at 09:43
Subject: Your receipt from Apple Store, Manchester Arndale
Thank you for shopping at the Apple Store.
To tell us about your experience, click here.
Attached is a file emailreceipt_20150130R2155644709.xls which in the sample I analysed has a VirusTotal detection rate of 6/53*. According to this Malwr report**, the attachment downloads a malicious binary from:
steveyuhas .com/~steveyuhas/87tr65/43wedf.exe
This has a VirusTotal detection rate of precisely zero***. Those reports indicate network traffic to:
23.113.113.105 (AT&T Internet Services, US)
This is the -same- IP as seen in this earlier spam run[4], and I strongly recommend that you -block- it. The payload is likely to be the Dridex banking trojan."
* https://www.virustotal.com/en/file/7d3cde6c92562a2ef510957f57b6f89deee72c09e4a67781878e61dace42351c/analysis/1449485846/
** https://malwr.com/analysis/ZmEzNTI1NmVlNDJkNDM0ODgyNzRlZDA1YzQyZDE2YjY/
*** https://www.virustotal.com/en/file/d669379ad2f0af5f5df9940a7f2247883e9beb2e96a791a0c0ac9869ca9c49d9/analysis/1449486079/
TCP connections
23.113.113.105: https://www.virustotal.com/en/ip-address/23.113.113.105/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
4] http://blog.dynamoo.com/2015/12/malware-spam-transglobal-express.html
- http://myonlinesecurity.co.uk/your-receipt-from-apple-store-manchester-arndale-word-doc-or-excel-xls-spreadsheet-malware/
7 Dec 2015 - "An email with the subject of 'Your receipt from Apple Store, Manchester Arndale' pretending to come from manchesterarndale@ apple .com with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Your-receipt-from-Apple-Store-Manchester-Arndale-1024x381.png
7 December 2015: emailreceipt_20150130R2155644709.xls - Current Virus total detections 6/55*
MALWR shows us that it downloads from http ://steveyuhas .com/~steveyuhas/87tr65/43wedf.exe which looks to be an -updated- version of what is probably the Dridex banking Trojan (VirusTotal **)..."
* https://www.virustotal.com/en/file/7d3cde6c92562a2ef510957f57b6f89deee72c09e4a67781878e61dace42351c/analysis/1449485130/
** https://www.virustotal.com/en/file/d669379ad2f0af5f5df9940a7f2247883e9beb2e96a791a0c0ac9869ca9c49d9/analysis/1449486079/
TCP connections
23.113.113.105: https://www.virustotal.com/en/ip-address/23.113.113.105/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
___
Fake 'Payment Advice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/payment-advice-for-vendor0000113915-london-borough-of-richmond-word-doc-or-excel-xls-spreadsheet-malware/
7 Dec 2015 - "An email with the subject of 'Payment Advice For Vendor0000113915' pretending to come from LBRichmondRemittance@ richmond .gov.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
The London Borough of Richmond upon Thames Accounts Payable team, are pleased to announce we can now e-mail your remittance advice.
Please find attached a remittance advice for a payment you will receive in the next 2 working days.
If this is not the preferred email address you wish to receive remittance advises, please could you
email accounts.payable@ richmond .gov.uk quoting your vendor number (found on remittance
attached) and details of your preferred email address so we can update our records.
Please Note
Remittances sent from LB Richmond Remittance will include payments made on behalf of:
Achieving for Children
LBRuT Local Authority
LBRuT Pension Fund
SW Middlesex Crematorium Board ...
7 December 2015: Payment Advice For Vendor0000113915.DOC London Borough of Richmond
Current Virus total detections 7/55* which is the -same- downloader (although renamed) which downloads the -same- Dridex banking Trojan from the -same- locations as previously described in this earlier post**..."
* https://www.virustotal.com/en/file/557dfab57c2fc5b29977910a09a366cd4471a5414171570ff720d569f3b9532f/analysis/1449489721/
Latest: 1569311-1Z2X12A50495162278.doc
** http://myonlinesecurity.co.uk/transglobal-express-shipping-documentation-tg-1569311-word-doc-or-excel-xls-spreadsheet-malware/
___
Reader’s Digest... other WP Sites Compromised, Push Angler EK
- https://blog.malwarebytes.org/online-security/2015/11/readers-digest-and-other-wordpress-sites-compromised-push-angler-ek/
Nov 26, 2015 - "Update 12/01: Reader’s Digest contacted us and said they are working on the site’s security.
We’re seeing another uptick in WordPress compromises, using a slightly different modus operandi than the EITest campaign we recently blogged about, being responsible for a large number of infections via the Angler exploit kit. The attack consists of a -malicious- script injected within compromised WordPress sites that launches another URL whose final purpose is to load the Angler exploit kit. Site owners that have been affected should keep in mind that those -injected- scripts/URLs will vary over time, although they are all using the same pattern...The website of popular magazine Reader’s Digest is one of the victims of this campaign and people who have visited the portal recently should make sure they have not been infected. The payload we observed at the time of capture was Bedep which loaded Necurs a backdoor Trojan, but that of course can change from day to day...
> https://blog.malwarebytes.org/wp-content/uploads/2015/11/rd.png
... IOCs: Redirectors (non exhaustive list)..."
(More detail at the malwarebytes URL above.)
Also: http://arstechnica.com/security/2015/11/hey-readers-digest-your-site-has-been-attacking-visitors-for-days/
Nov 30, 2015 - "... people can be exposed to drive-by malware attacks even when visiting sites they know and trust. It's always a good idea to install security updates as soon as they become available. Readers are also advised to consider uninstalling Flash, Java, and other browser extensions from their computers, or alternatively to use them only on a handful of important sites that require it. For the time being, people should assume Reader's Digest -isn't- safe to visit. This post will be updated if that status changes."
:fear::fear: :mad:
AplusWebMaster
2015-12-08, 13:05
FYI...
Fake 'Updated Statement' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-updated-statement-2323191.html
8 Dec 2015 - "This -fake- financial spam does not come from Buildbase but is instead a simple -forgery- with a malicious attachment.
From: David Lawale [David.Lawale@ buildbase .co.uk]
Date: 8 December 2015 at 10:58
Subject: Updated Statement - 2323191
Hi,
Please find attached copy updated statement as your account has 3 overdue incoices. Is there any reasons why they haven’t yet been paid?
Kind Regards
David
David Lawale | Credit Controller | Buildbase ...
Attached is a file 151124142451_0001.xls which I have seen come in -two- versions so far (VirusTotal results [1] [2]). Analysis of this malware is pending, but it most likely leads to the Dridex banking trojan."
1] https://www.virustotal.com/en/file/16e0876b2b1ea42fe4fd8fae50d3deb2a06c9fe79283e6570e6d2c470fb44113/analysis/1449572556/
2] https://www.virustotal.com/en/file/9103b12a7a3e9fc89106472ae2f1a1a0fe005993f920245c7ba610787bbe0e33/analysis/1449572877/
UPDATE 2: According to the comments in this post and also some other sources, the the macros download from:
gulteknoofis .com/76re459/98uy76t.exe
kinderdeszorns .de/76re459/98uy76t.exe
agencjareklamowalodz .com/76re459/98uy76t.exe
This has a detection rate of 4/55*... the malware phones home to:
216.189.52.147 (High Speed Web/Genesis 2 Networks, US)
23.113.113.105 (AT&T, US)
221.132.35.56 (Ho Chi Minh City Post and Telecom Company, Vietnam)
78.47.66.169 (Hetzner, Germany)
Recommended blocklist:
216.189.52.147
23.113.113.105
221.132.35.56
78.47.66.169 "
* https://www.virustotal.com/en/file/f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030/analysis/1449578058/
- http://myonlinesecurity.co.uk/updated-statement-2323191-david-lawale-buildbase-co-uk-word-doc-or-excel-xls-spreadsheet-malware/
8 Dec 2015 - "An email with the subject of 'Updated Statement – 2323191' pretending to come from David Lawale <David.Lawale@ buildbase .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
8 December 2015 : 151124142451_0001.xls - Current Virus total detections 6/54* (VT2 - 6/54**)
Updated: This downloads http ://gulteknoofis .com/76re459/98uy76t.exe -or-
http ://agencjareklamowalodz .com/76re459/98uy76t.exe (VirusTotal 3/55***) Which is almost certainly Dridex banking Trojan..."
* https://www.virustotal.com/en/file/16e0876b2b1ea42fe4fd8fae50d3deb2a06c9fe79283e6570e6d2c470fb44113/analysis/
** https://www.virustotal.com/en/file/9103b12a7a3e9fc89106472ae2f1a1a0fe005993f920245c7ba610787bbe0e33/analysis/1449572877/
*** https://www.virustotal.com/en/file/f32547b5bb4abe56e6ba6ba0676466735ce8aa50be4beb1d90e43438c7296030/analysis/1449575422/
TCP connections
216.189.52.147: https://www.virustotal.com/en/ip-address/216.189.52.147/information/
104.86.111.136: https://www.virustotal.com/en/ip-address/104.86.111.136/information/
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-exb-uk-ltd-invoice-sales.html
8 Dec 2015 - "This -fake- financial spam does not come from EXB (UK) Ltd but is instead a simple -forgery- with a malicious attachment.
From: Sales [sales@ exbuk .co.uk]
Date: 8 December 2015 at 12:03
Subject: EXB (UK) Ltd Invoice
Dear Sirs,
Please find attached our invoice, Thank you for your order
Best Wishes
EXB (UK) Ltd
Attached is a Word document named Invoice 1195288 from EXB (UK) Limited.doc which comes in at least -three- different versions (VirusTotal results [1] [2] [3]) and which contain a complex macro... that fails to run in automated analysis tools... The payload (if it works) is likely to be the Dridex banking trojan."
1] https://www.virustotal.com/en/file/e6a377255640dbf81385a147028f892ee73b1b11d1d51132a9a38ffc5b9f2318/analysis/1449576023/
2] https://www.virustotal.com/en/file/498dfed3a8827721add5459cf70e84bf81cbda20bd66643f17c5e27198f14c3b/analysis/1449576032/
3] https://www.virustotal.com/en/file/2d29deb1967bb546eb4bb1ee7e4f98cfa270614942c1da00edde82dfdb729c2e/analysis/1449576039/
- http://myonlinesecurity.co.uk/exb-uk-ltd-invoice-word-doc-or-excel-xls-spreadsheet-malware/
8 Dec 2015 - "An email with the subject of 'EXB (UK) Ltd Invoice' pretending to come from Sales <sales@ exbuk .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
8 December 2015: Invoice 1195288 from EXB (UK) Limited.doc - Current Virus total detections 6/55*
... It is highly likely that it will download the -same- Dridex banking malware from the same locations as today’s earlier malspam**..."
* https://www.virustotal.com/en/file/e6a377255640dbf81385a147028f892ee73b1b11d1d51132a9a38ffc5b9f2318/analysis/1449576427/
** http://myonlinesecurity.co.uk/updated-statement-2323191-david-lawale-buildbase-co-uk-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Invoice' SPAM – JS malware Teslacrypt
- http://myonlinesecurity.co.uk/invoice-from-cimquest-ingear-js-malware-teslacrypt/
8 Dec 2015 - "An email with the subject of 'Invoice from CimQuest INGEAR' coming from random senders and email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Dear Customer ,
Please review the attached copy of your Invoice (number: NI16157660) for an amount of $400.46.
Thank you for your business
2 September 2015: invoice_copy_16157660.zip: Extracts to: doc_H4QPKCVlWBE.js
Current Virus total detections 2/56* - MALWR** tells us it downloads 840135.exe teslacrypt malware (VirusTotal 3/55***) and the associated txt and html files telling you how to pay-the-ransom to recover your files.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2f7ac8ae721d6d96cfbff41652debbee18d0f81675b3325071750718c5c666d5/analysis/1449577730/
** https://malwr.com/analysis/ZTg0ZDM2NzU0OTJkNDBjZWI2YmM3MzY4Zjk1Yjg1OWI/
50.63.210.1: https://www.virustotal.com/en/ip-address/50.63.210.1/information/
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
173.201.96.1: https://www.virustotal.com/en/ip-address/173.201.96.1/information/
*** https://www.virustotal.com/en/file/68314d4b297fb19fd34e8ce5beedf7d90619da6fa394076bf5016d467ada5d2b/analysis/1449576976/
___
Fake 'Courier Service invoice' SPAM - JS malware
- http://myonlinesecurity.co.uk/random-courier-service-invoice-leads-to-possible-malware-js-malware/
8 Dec 2015 - "An email with the subject of 'Invoice #CS-34169266' [random numbered] pretending to come from a random named Courier Service with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Customer
Your invoice appears below. Please remit payment at your earliest convenience.
Thank you for your business – we appreciate it very much.
Sincerely,
Louie Gomez Courier Service
All the names of the alleged senders matches the name in the body of the email although none are courier services. All the sender email addresses are random...
8 December 2015: invoice_copy_34169266.zip: Extracts to: invoice_SCAN_InT9b.js
Current Virus total detections 4/55*. MALWR analysis** shows it downloads what looks like a genuine Avira installation from one of these sites prestakitchen .com and acsbrokerage .com...
Update: Some -other- versions of these JavaScript downloaders attached to similar emails pretending to be courier invoices are downloading what looks like a teslacrypt malware. One location is 46.151.52.197 /85.exe [VirusTotal 3/55***for js downloader] [MALWR[4]] [VirusTotal for 85.exe 2/55[5]]
[malwr[6] for 85.exe].. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/fe8431103cf688d2ffb607fbea3883d8a4f7957cab50a9f1a06a9b94cd2a8b86/analysis/1449601718/
** https://malwr.com/analysis/YjkwYzIyMmQ4YzI5NGJiOWE5ZjI1Yjc0ZjlhYTM0NGU/
63.247.90.80
185.93.187.90
184.168.138.1
169.54.129.13
8.254.249.94
23.5.245.163
23.222.171.250
23.222.166.108
*** https://www.virustotal.com/en/file/9757d8cb2c3d20c7523654475965b6f03eb4cb0fc94730ec88617b528a64f9b7/analysis/1449601551/
4] https://malwr.com/analysis/N2FhZjg5NzNiNjE2NDUyOWFjNmQ1MGNkYmM4NGVjZDg/
46.151.52.197
78.47.139.102
89.161.139.233
83.143.81.14
50.62.123.1
50.63.71.1
192.163.250.195
5] https://www.virustotal.com/en/file/037a9761f33cfa22e1fc90c44f4d40f01421e19a05a75ae9c09633300fea55de/analysis/1449605987/
6] https://malwr.com/analysis/MTdiMzUwNjc3MDY0NGU1NGE0NzZiYmYzZmU1ODhmODM/
78.47.139.102
89.161.139.233
83.143.81.14
50.62.123.1
50.63.71.1
192.163.250.195
:fear::fear: :mad:
AplusWebMaster
2015-12-09, 14:51
FYI...
Fake 'Invoice' SPAM - js malware teslacrypt
- http://myonlinesecurity.co.uk/your-order-89518498-corresponding-invoice-42e64a46-random-sales-department-manager-fretter-js-malware-teslacrypt/
9 Dec 2015 - "An email with the subject of 'Your order #89518498 – Corresponding Invoice #42E64A46' [random numbered] pretending to come from a random named Sales Department Manager at Fretter Inc. with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Valued Customer,
We are pleased to inform you that your order #89518498 has been processed and ready to be dispatched. However, according to our records, above mentioned invoice is still unpaid.
We would highly appreciate if you sent your payment promptly. For your information, don’t hesitate to check the invoice enclosed to this letter or contact us directly.
In case if you have already sent your payment, please disregards this letter and kindly allow us up to 3 business days to clear the incoming payment.
We look forward to your remittance and will the dispatch the goods.
Thank you for choosing our services we sincerely hope to continue doing business with you again.
Sincerely,
Evan Hampton
Sales Department Manager
Fretter Inc. ...
All the names of the alleged senders matches the name in the body of the email although -none- are genuine sales department mangers. All the sender email addresses are random...
9 December 2015: copy_invoice_89518498.zip: Extracts to: invoice_copy_XEmx4n.js
Current Virus total detections 2/53*. MALWR analysis** shows it downloads and automatically runs http ://softextrain64 .com/86.exe (virustotal 3/55***) a Teslacrypt ransomware Trojan that encrypts your files. If you look at the malwr analysis it shows the virtual machine being encrypted which shows how dangerous these ransomware Trojans are. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c06e6d92c407936cfc9a392f5366692869a8ab233cbabffc9262c03f3cf48f2f/analysis/1449666881/
** https://malwr.com/analysis/YjgyNmU3ZmQ5NThmNDBmZmE3YmMzOWNhYTMxMjU1NWE/
192.227.158.229
78.47.139.102
83.143.81.14
50.62.123.1
50.63.71.1
192.163.250.195
173.201.96.1
89.161.139.233
*** https://www.virustotal.com/en/file/d8d14223267f5378f65bed1d5a0aa914a001c4d0aaebb7ff3b92a11e2ec3c7d5/analysis/1449666957/
softextrain64 .com: 194.135.83.55: https://www.virustotal.com/en/ip-address/194.135.83.55/information/
192.227.158.229: https://www.virustotal.com/en/ip-address/192.227.158.229/information/
>> https://www.virustotal.com/en/url/de18a8a16d94a04eb9ff423e61c7ce816fbef2d3396bdf4a854b5c0df0eba301/analysis/
>> https://en.wikipedia.org/wiki/TeslaCrypt
>>> http://blogs.cisco.com/security/talos/teslacrypt
___
- http://myonlinesecurity.co.uk/invoice-62579723-from-datacorp-inc-js-malware-teslacrypt/
9 Dec 2015 - "An email with the subject of 'Invoice #62579723 from DataCorp Inc' [random numbered] pretending to come from a random named Junior accountant at DataCorp Inc with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Customer,
Reference nr. 62579723-2801
Our internal records show that you have an outstanding balance dating on your account. Previous invoice was for $987.34 and have yet to receive your payment.
You can find the copy of the invoice enclosed to this letter.
In case if you have already transferred the payment you can disregards this payment notice. In all other case, please be so kind and forward us the amount stated in full until the end of the month.
As our agreement indicates, all outstanding balances after 30 days are subject to the 7% interest fee.
Thank you in advance for your cooperation.
Sincerely,
Leif Valentine
Junior Accountant
DataCorp Inc. ...
All the names of the alleged senders matches the name in the body of the email although -none- are genuine junior accountants. All the sender email addresses are random...
9 December 2015: copy_invoice_62579723.zip: Extracts to: invoice_copy_KEoHWB.js
Current Virus total detections 5/54*. MALWR analysis** shows it downloads and automatically runs
http ://softextrain64 .com/86.exe (virustotal 3/55***) a Teslacrypt ransomware Trojan that encrypts your files. This 86.exe is -different- to today’s earlier version[4] although the -same- download locations. This is another one of the spoofed icon files..."
* https://www.virustotal.com/en/file/3e277b9aa6ac810985988206d4804c6c0d4d2c917e2ec86ab6d4ac9f32a3ab47/analysis/1449691313/
** https://malwr.com/analysis/ZGM2MDNkYmUzOGU3NDQ0OGI2ZmE3ZGQzYjg5ZGI4MzY/
192.3.52.235
78.47.139.102
83.143.81.14
*** https://www.virustotal.com/en/file/e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37/analysis/1449689393/
4] http://myonlinesecurity.co.uk/your-order-89518498-corresponding-invoice-42e64a46-random-sales-department-manager-fretter-js-malware-teslacrypt/
___
Fake 'order' SPAM - leads to Teslacrypt ransomware
- http://blog.dynamoo.com/2015/12/fake-fretter-inc-leads-to-teslacrypt.html
9 Dec 2015 - "This email claims to be from the long-dead retailer Fretter Inc, but it is not. Instead it comes with a -malicious- attachment leading to Teslacrypt ransomware.
From: Tonia Graves [GravesTonia8279@ ikom .rs]
Date: 9 December 2015 at 14:50
Subject: Your order #11004118 - Corresponding Invoice #B478192D
Dear Valued Customer,
We are pleased to inform you that your order #11004118 has been processed and ready to be dispatched. However, according to our records, above mentioned invoice is still unpaid.
We would highly appreciate if you sent your payment promptly. For your information, don't hesitate to check the invoice enclosed to this letter or contact us directly.
In case if you have already sent your payment, please disregards this letter and kindly allow us up to 3 business days to clear the incoming payment.
We look forward to your remittance and will the dispatch the goods.
Thank you for choosing our services we sincerely hope to continue doing business with you again.
Sincerely,
Tonia Graves
Sales Department Manager
Fretter Inc. ...
There sender's name and the reference numbers change in each version. Attached is a file copy_invoice_11004118.zip which in turn contains a malicious script [VT 5/54*] which in the sample I investigated was named invoice_iU9A2Y.js... The Malwr report** for that script shows it downloading from:
softextrain64 .com/86.exe?1
The script itself shows an alternate location of:
46.151.52.197 /86.exe?1
This has a VirusTotal detection rate of 3/55***. A Malwr report[4] on just the executable plus this Hybrid Analysis report[5] shows it connecting to:
gjesdalbrass .no
It also tries to identify the IP address of the host by connecting to http ://myexternalip .com/raw which is a benign service that you might consider to be a good indicator of compromise. You can see in the screenshots of that Malwr report that this is ransomware - specifically Teslacrypt.
Recommended blocklist:
gjesdalbrass .no
softextrain64 .com
46.151.52.197 "
* https://www.virustotal.com/en/file/03d566ca97769813d1a2c8b10cf3fccf98276699cf39a1e6e6c45a6e7fdbbb69/analysis/1449689090/
** https://malwr.com/analysis/NzgyYmEyZmM2MjkxNDAyMzlhNWU5YjRiMGQyMzhhOTM/
*** https://www.virustotal.com/en/file/e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37/analysis/1449689393/
4] https://malwr.com/analysis/NzgyYmEyZmM2MjkxNDAyMzlhNWU5YjRiMGQyMzhhOTM/
5] https://www.hybrid-analysis.com/sample/e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37?environmentId=1
___
News Site “The Independent” Hacked, Leads to TeslaCrypt Ransomware
- http://blog.trendmicro.com/trendlabs-security-intelligence/blog-of-news-site-the-independent-hacked-leads-to-teslacrypto-ransomware/
Dec 8, 2015 - "The blog page of one of the leading media sites in the United Kingdom, The Independent has been compromised, which may put its millions of readers at risk of getting infected with ransomware. We have already informed 'The Independent' about this security incident. However, the site is still currently compromised and users are -still- at risk. It should be noted that only the blog part of the website – which uses WordPress – is impacted; the rest of The Independent’s online presence seem unaffected. WordPress is a very popular blogging platform that has seen more than its fair share of attacks and compromises from threat actors and cybercriminals looking to infect users... Angler Exploit Kit is the most active exploit kit to date that integrated Abobe Flash zero-day vulnerabilities related to the Hacking Team leak... tracked the number of hits to the TDS between compromised sites leading to Angler EK (not just The Independent blog) and have seen as many as -4,000- hits a day. The real number could be bigger...
Number of users redirected from compromised sites leading to Angler EK
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/12/new_independent_graph.png
Updated on December 8, 2015, 7:15 PM PST (UTC -8): We have edited this entry to reflect the current status of communications with The Independent and the current threat. As of this writing, the site is -still- compromised and serving various malware threats to users."
:fear::fear: :mad:
AplusWebMaster
2015-12-10, 13:22
FYI...
Fake 'Payment Notice' SPAM - leads to ransomware
- http://blog.dynamoo.com/2015/12/malware-spam-foreman-ltd-last-payment.html
10 Dec 2015 - "This -fake- financial spam does not come from the long-defunct Foreman & Clark, but instead it comes with a malicious attachment that leads to ransomware.
From: Harlan Gardner
Date: 10 December 2015 at 08:48
Subject: Reference Number #20419955, Last Payment Notice
Dear Client,
This e-mail is pursuant to your contract with Foreman&Clark Ltd. for our services date November 15, 2015 for the amount of $8,151.
Your failure to pay as per the December 1, 2015 invoice equals to the breach of our contract.
Please, acknowledge the receipt of this e-mail within three business days. Please, make your payment to the corresponding account, stated in the invoice attached no later than January 2, 2016.
In case you fail to respond to this e-mail we well be compelled to pursue all the necessary legal actions.
Thank you beforehand for your attention to this case.
Looking forward to hearing back from you.
Sincerely,
Harlan Gardner
Sales Manager
Foreman&Clark Ltd...
In the sample I saw, the attachment was named copy_invoice_20419955.zip which contained this malicious obfuscated script which has a VirusTotal detection rate of 2/55*. When deobfuscated it becomes a bit clearer as to what it does, with an attempted download from:
46.151.52.196 /86.exe?1
softextrain64 .com/86.exe?1
This pattern is the same as the spam run yesterday**. The downloaded binary has an MD5 of 42b27f4afd1cca0f5dd2130d3829a6bc, a detection rate of 5/55*** and the Malwr report[4] indicates that it pulls data from the following domains:
graysonacademy .com
grassitup .com
grupograndes .com
crown.essaudio .pl
garrityasphalt .com
gjesdalbrass .no
The characteristics of this malware indicate the Teslacrypt ransomware.
Recommended blocklist:
46.151.52.196
softextrain64 .com
gjesdalbrass .no
graysonacademy .com
grassitup .com
grupograndes .com
crown.essaudio .pl
garrityasphalt .com "
* https://www.virustotal.com/en/file/27bff3b4831ebb298fa82377e09356a0361ea04234fc4fbb1154923673020608/analysis/1449741728/
** http://blog.dynamoo.com/2015/12/fake-fretter-inc-leads-to-teslacrypt.html
*** https://www.virustotal.com/en/file/8dd55c162d343c4593f14871428db69bbfbcc9c2b2fa85ac0264923ffd2f1ad1/analysis/1449742342/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
83.143.81.14: https://www.virustotal.com/en/ip-address/83.143.81.14/information/
4] https://malwr.com/analysis/YjA5OGFlZjJiZWZlNDk0MmJiMjAzYjVjYTI0YThhNjI/
___
Fake 'STMT' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-stmt-acwl-15dec12-120106.html
10 Dec 2015 - "This -fake- financial email does not come from MAM Software but is instead a simple forgery with a malicious attachment.
From: accounts@ mamsoft .co.uk [statements@ mamsoft .co.uk]
Date: 10 December 2015 at 11:35
Subject: STMT ACWL-15DEC12-120106
The following are attached to this email:
XACWL-15DEC12-120106.DOC
Attached is a file XACWL-15DEC12-120106.DOC which I have only seen one variant of so far, with a VirusTotal detection rate of 6/54*. According to the Malwr analysis**, it downloads a file from:
life.1pworks .com/76t7h/76gjk.exe
There will probably be other versions of the document with different download locations. This executable has a detection rate of 2/54*** and according to this Malwr report[4] it contacts:
136.145.86.27 (University Of Puerto Rico, Puerto Rico)
Other analysis is pending, in the meantime I recommend that you -block- traffic to that IP. The payload is probably the Dridex banking trojan."
* https://www.virustotal.com/en/file/71802a450cd4678b00147d607b30b6a1d4edf738446fa6ad25ddf3cab252fec0/analysis/1449747380/
** https://malwr.com/analysis/ZWI1NjA3Y2U5OTU3NDMxOTlhZTA4M2I2ZTU5MzU3ZDI/
*** https://www.virustotal.com/en/file/5314fde2ed059597ceefd24e94ff13d97c33375f20b0aea4f6a8d855aa048dc8/analysis/1449747675/
4] https://malwr.com/analysis/N2U2ZjNhN2E1ZWIzNDI2YmEwYTEzZWQwNDIwN2RmYWQ/
136.145.86.27
13.107.4.50
___
Fake 'Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-order-311286-acknowledged.html
10 Dec 2015 - "This -fake- financial spam does not come from Touchstone Lighting but is instead a simple -forgery- with a malicious attachment.
From: sales@ touchstonelighting .co.uk
Date: 10 December 2015 at 12:02
Subject: Order 311286 Acknowledged
There is -no- body text. Attached is a malicious Word document 'Order Acknowledgement.doc' which appears to be exactly the -same- as the payload used for this spam run*."
* http://blog.dynamoo.com/2015/12/malware-spam-stmt-acwl-15dec12-120106.html
___
Fake 'Scanned doc' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/scanned-document-from-mx-4100n-from-your-own-email-domain-word-doc-or-excel-xls-spreadsheet-malware/
10 Dec 2015 - "An email with the subject of 'Scanned document from MX-4100N' pretending to come from MX-4100N <mx-4100n@'your email domain> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Reply to: “MX-4100N” <mx-4100n@ victimcompany>
Device Name: Not Set
Device Model: MX-4100N
Location: Not Set
File Format: XLS MMR(G4)
Resolution: 200dpi x 200dpi
Attached file is scanned document in XLS format.
... these are -not- coming from your own company or email domain.
10 December 2015: mx-4100n@[redacted]_20151210_141946.xls - Current Virus total detections 3/55*
Downloads Dridex banking Trojan from jin.1pworks .com/76t7h/76gjk.exe (VirusTotal 6/55**). There appear to be -several- different subdomains of 1pworks .com delivering this malware... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f159e13d884133c50784e07fb620637952c9219cac5b88e56447d18c6305264e/analysis/1449764254/
** https://www.virustotal.com/en/file/7127176506171d1ca452dbd307f3e48c35b8c4c465b49627e099dc126b661d8c/analysis/1449764179/
1pworks .com: 120.136.10.15: https://www.virustotal.com/en/ip-address/120.136.10.15/information/
___
Fake 'Last Payment' SPAM - teslacrypt ransomware
- http://myonlinesecurity.co.uk/reference-number-45285286-last-payment-notice-foremanclark-ltd-teslacrypt-malware/
10 Dec 2015 - "An email with the subject of 'Reference Number #45285286, Last Payment Notice' [random numbered] pretending to come from a random named Junior accountant at Foreman&Clark Ltd. with a zip attachment is another one from the current bot runs... The content of the email says :
Dear Client,
This e-mail is pursuant to your contract with Foreman&Clark Ltd. for our services date November 15, 2015 for the amount of $2,396.
Your failure to pay as per the December 1, 2015 invoice equals to the breach of our contract.
Please, acknowledge the receipt of this e-mail within three business days. Please, make your payment to the corresponding account, stated in the invoice attached no later than January 2, 2016.
In case you fail to respond to this e-mail we well be compelled to pursue all the necessary legal actions.
Thank you beforehand for your attention to this case.
Looking forward to hearing back from you.
Sincerely,
Karen Wood
Sales Manager
Foreman&Clark Ltd...
10 December 2015: copy_invoice_45285286.zip: Extracts to: invoice_gnEDzT.js
Current Virus total detections 2/55*. MALWR analysis** shows it downloads and automatically runs http ://softextrain64 .com/80.exe (virustotal ***) a Teslacrypt ransomware Trojan that encrypts your files. This domain was involved in a similar attack yesterday but at time of posting appears to be down. Alternative download locations from yesterday are still -live- and issuing malware so some versions of the javascript file -will- download a working teslacrypt. So far I got 46.151.52.196 /86.exe (virustotal5/55[4]) 80.exe (virustotal4/54[5])... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/27bff3b4831ebb298fa82377e09356a0361ea04234fc4fbb1154923673020608/analysis/1449741728/
** https://malwr.com/analysis/MTQ3MTFlNGY3YjU0NDIzNWE4NTUyYWE5OTgxMDY5Nzc/
185.117.72.65
78.47.139.102
83.143.81.14
*** https://www.virustotal.com/en/file/8dd55c162d343c4593f14871428db69bbfbcc9c2b2fa85ac0264923ffd2f1ad1/analysis/1449742342/
4] https://www.virustotal.com/en/file/8dd55c162d343c4593f14871428db69bbfbcc9c2b2fa85ac0264923ffd2f1ad1/analysis/1449742342/
5] https://www.virustotal.com/en/file/b96e54607b342d02734649140941ebdabbbe465bdf81f4a354a591fb2dac3b5d/analysis/1449765933/
___
Fake 'Payment Request' SPAM - teslacrypt ransomware
- http://myonlinesecurity.co.uk/payment-request-ref-nr-128268282015-william-perkins-customer-service-department-realty-solutions-teslacrypt-malware/
10 Dec 2015 - "An email with the subject of 'Payment Request, Ref. nr: 12826828/2015' [random numbered] pretending to come from William Perkins Customer Service Department at Realty Solutions with a zip attachment is another one from the current bot runs... The content of the email says :
Dear Valued Client,
The purpose of this e-mail is to follow up with you on a matter of your payment of invoice #3A5AB8AF with a Ref. nr: 12826828/2015.
As of today, your outstanding past due balance is -$9,458, as detailed on the statement and account report attached to this e-mail.
To keep your account active and avoid any additional charges for the late payment, please remit payment in full immediately.
In case you have already transferred the amount or feel that there can be any kind of error, don’t hesitate to let us know.
Thank you for your time and attention. We are looking forward to hearing back from you on this urgent matter.
Regards,
William Perkins
Customer Service Department
Realty Solutions ...
10 December 2015: SCAN_invoice_12826828.zip: Extracts to: invoice_FIrFhy.js
Current Virus total detections 6/54* MALWR analysis** shows it downloads and automatically runs http ://46.151.52.231 /87.exe (virustotal 7/55***) a Teslacrypt ransomware Trojan that encrypts your files. This domain was involved in a similar attack yesterday and earlier today. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/094348c61d87cdd59ede17374d7cb88693b6751db33b34f6d89e575228abb090/analysis/1449768665/
** https://malwr.com/analysis/ODIzMzYxYzUzYzc2NDAwMTkwZWFjMjVkYTUwYTkzYTU/
46.151.52.231
78.47.139.102
213.185.88.133
*** https://www.virustotal.com/en/file/4e7db0c159e45c0cf8ab447aaf8194e85c08846f49a997de68dcf112e9fb8945/analysis/1449769533/
:fear::fear: :mad:
AplusWebMaster
2015-12-11, 11:52
FYI...
Fake 'Payment' SPAM - teslacrypt ransomware
- http://myonlinesecurity.co.uk/generic-our-finance-department-has-processed-your-payment-leads-to-teslacrypt-ransomware/
11 Dec 2015 - "An email with the subject of 'Payment Nr: 63679716/E219EC3C' [random numbered] pretending to come from random names at random companies with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Client,
Our finance department has processed your payment, unfortunately it has been declined.
Please, double check the information provided in the invoice down below and confirm your details.
Thank you for understanding.
All the sender email addresses are random...
11 December 2015: SCAN_invoice_06630453.zip: Extracts to: invoice_6bOnJR.js
Current Virus total detections 1/51*. MALWR analysis*** shows it downloads and automatically runs http ://46.151.52.231 /87.exe (virustotal 7/53***) a Teslacrypt ransomware Trojan that encrypts your files. This domain was involved in a similar attack previously and earlier yesterday. This current series of teslacrypt droppers try to contact soft2webextrain .com for the malware...
Update: soft2webextrain .com is -live- again and currently downloading soft2webextrain .com/87.exe ... Be aware the bad actors controlling these domains regularly update this malware at random periods throughout the day and night to try to bypass antivirus detections. They are using varying 2 digit numbers between 80 and 89 and each different number delivers a different file#. The 3 sites delivering this series of Teslacrypt currently are:
soft2webextrain .com/87.exe
softextrain64 .com/86.exe
46.151.52.231 /87.exe
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c9a049e14b46912c9e54ce87ee64ac26287196d69b7b9bbb0925b0256f60c119/analysis/1449787904/
** https://malwr.com/analysis/Y2I1Y2E5YjY1MTg4NGU1NjkyNjVhNDdjNDMxMjQ3M2I/
46.151.52.231
78.47.139.102
213.185.88.133
*** https://www.virustotal.com/en/file/b57ca40eab68c52c47e979fae218dcb91cb833caeadd53538695b12f5f70c51c/analysis/1449814119/
- http://blog.dynamoo.com/2015/12/malware-spam-invoice-66626337ba2deb0f.html
11 Dec 2015 - "I have only seen one sample of this -fake- invoice spam, so it is possible that the invoice references and sender names are randomly generated.
From: Jarvis Miranda
Date: 11 December 2015 at 08:25
Subject: Invoice #66626337/BA2DEB0F
Dear Client,
Our finance department has processed your payment, unfortunately it has been declined.
Please, double check the information provided in the invoice down below and confirm your details.
Thank you for understanding.
In the sample I saw, the attached file was named SCAN_invoice_66626337.zip which contained a malicious javascript... with a VirusTotal detection rate of 5/54*... it is trying to download a binary from:
soft2webextrain .com/87.exe?1
46.151.52.231 /87.exe?1
This behaviour can be seen in these automated reports [1] [2]. The downloaded executable has a detection rate of 6/55**... This Malwr report[3] gives a clearer indication of what the binary is doing, attempting to pull information from:
kochstudiomaashof .de
The screenshots[3] indicate clearly that this is ransomware, specifically Teslacrypt.
Note that the soft2webextrain .com domain is on the -same- server as softextrain64 .com seen yesterday, so 185.118.64.183 (CloudSol LLC, Russia) can be considered to be malicious.
UPDATE: I didn't spot originally that the "soft2webextrain .com" website is -multhomed- with another IP address on 149.202.234.190 which is an OVH IP allocated to a customer "Dmitry Shestakov" an which forms a small block of 149.202.234.188/30 which is probably also worth blocking.
UPDATE 2: I made an error with one of the IP addresses and specified 185.118.64.183 and it should have been 185.118.64.182.
Recommended blocklist:
185.118.64.182
149.202.234.188/30
46.151.52.231
kochstudiomaashof .de "
* https://www.virustotal.com/en/file/bcaea56e7d1e46ed7c78b2f8ff7cca0cf51f6c1840d1d2d2e593caecb2f4b048/analysis/1449828974/
1] https://malwr.com/analysis/ZGE3YmQxZjNiNDJmNGRkNWJmMjYyYzhhZGRkNTc1OTk/
46.151.52.231
78.47.139.102
213.185.88.133
2] https://www.hybrid-analysis.com/sample/bcaea56e7d1e46ed7c78b2f8ff7cca0cf51f6c1840d1d2d2e593caecb2f4b048?environmentId=1
3] https://malwr.com/analysis/MGE5NWViZjU2MjM3NDg3NDhjMmQyMDE3ZmQxNzFjM2Y/
78.47.139.102
213.185.88.133
** https://www.virustotal.com/en/file/9c289d9426d6f565cb640d2ccb49ee0af989463cbdb7cbdab6110997808c4061/analysis/1449829134/
___
Malvertising Attacks via Nuclear EK Pushes Ransomware
- https://blog.malwarebytes.org/malvertising-2/2015/12/spike-in-malvertising-attacks-via-nuclear-ek-pushes-ransomware/
Dec 11, 2015 - "We’ve been monitoring a malvertising campaign very closely as it really soared during the past week. The actors involved seem to be the same as the ones behind the self-sufficient Flash malverts/exploits we’ve documented before and reported by security researcher Kafeine* (Spartan EK).
* http://malware.dontneedcoffee.com/2015/10/cve-2015-7645.html
One single domain (easy-trading.biz) is relaying all traffic to other ‘ad networks’ and ultimately to the Nuclear exploit kit. That domain still hosts the malicious Flash file (CVE-2015-7645) that it previously used in standalone attacks. Now instead, it points its traffic directly to Nuclear EK, which also attempts to exploit CVE-2015-7645 as seen in the picture below:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/MBAE1.png
This malvertising campaign receives traffic from multiple sources, including the AdCash ad network which we promptly informed. According to our telemetry, this attack is accounting for about -half- of -all- malvertising activity we are seeing now. Interestingly, most victims from this campaign are outside of the US and UK and mainly in certain parts of Europe and South America. The payload distributed by the exploit kit is a downloader which retrieves several over pieces of malware including ransomware..."
(More detail at the malwarebytes URL above.)
45.63.13.175: https://www.virustotal.com/en/ip-address/45.63.13.175/information/
>> https://www.virustotal.com/en/url/8228458981ab078dd950414e10b0414de8f26ce17ace7e2aa0629b12f71e2475/analysis/
104.131.212.117: https://www.virustotal.com/en/ip-address/104.131.212.117/information/
___
LATENTBOT...
- https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html
Dec 11, 2015 - "... recently uncovered LATENTBOT, a new, highly-obfuscated BOT that has been in-the-wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless. Through our Dynamic Threat Intelligence (DTI), we have observed multiple campaigns targeting multiple industries in the United States, United Kingdom, South Korea, Brazil, United Arab Emirates, Singapore, Canada, Peru and Poland – primarily in the financial services and insurance sectors. Although the infection strategy is not new, the final payload dropped – which we named LATENTBOT – caught our attention since it implements several layers of obfuscation, a unique exfiltration mechanism, and has been very successful at infecting multiple organizations..."
(More detail at the fireeye URL above.)
___
LLoyd’s Bank - Phish...
- https://blog.malwarebytes.org/fraud-scam/2015/12/avoid-this-lloyds-bank-phish-attempt/
Dec 11, 2015 - "... steer clear of the following phishing email, which plays on the “We noticed you’re logged in from different locations, and now you have to do something about it” trick to entice potential victims into logging in on a site they should avoid:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/lloydphish1.jpg
... Clicking-the-link will take them to
mok-tr(dot)com/why/new/index(dot)html phishing page:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/lloydphish2.jpg
Despite showing a copy of a LLoyd’s login page and displaying numerous clickable links, -none- of them work save for the part asking for credentials – what you’re looking at is essentially one large .png file with a login box jammed in the middle. The page asks for User ID, Password and Memorable Word before -redirecting- them to the real Lloyd’s website... they don’t go down the route of so many other similar phishes and ask for bank details or other personal information... One other potentially related thing to note: a common piece of advice to ensure you’re on the correct banking website is to look for the green padlock*, which will let you know if the connection to the site is encrypted (and often give additional information about site ownership). In this case, the Lloyd’s Banking Group website – lloydsbankinggroup(dot)com – has -no- HTTPs, because there’s nowhere on the site where you’d need to do any logging in / sending of personal information. It’s there to give general information about the financial services group, their brands and other relevant information...
* https://support.mozilla.org/en-US/kb/how-do-i-tell-if-my-connection-is-secure
... the LLoyd’s Bank website (where you’d actually login and do bank related activities) located at lloydsbank(dot)com -does- ...
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/lloydcert2.jpg
... please ensure that you navigate to your banking portal of choice directly and -always- treat a supposed bank login page missing a HTTPs padlock with suspicion..."
___
Basic ASLR - not in 3 A-V's...
- http://it.slashdot.org/story/15/12/10/1853225/avg-mcafee-kaspersky-antiviruses-all-had-a-common-bug
Dec 10, 2015 - "Basic ASLR was -not- implemented in 3 major antivirus makers, allowing attackers to use the antivirus itself towards attacking Windows PCs. The bug, in layman terms, is: the antivirus would select the same memory address space every time it would run. If attackers found out the memory space's address, they could tell their malicious code to execute in the same space, at the same time, and have it execute with root privileges, which most antivirus have on Windows PCs. It's a basic requirement these days for software programmers to -use- ASLR (Address Space Layout Randomization) to -prevent- their code from executing in predictable locations. Affected products: AVG, McAfee, Kaspersky. All "quietly" issued fixes."
___
Spy Banker Trojan Telax abusing Google Cloud Servers
- http://research.zscaler.com/2015/12/new-spy-banker-trojan-telax-abusing.html
Dec 10, 2015 - "... malware authors are leveraging Google Cloud Servers to host the initial Spy Banker Downloader Trojan, which is responsible for downloading and installing Spy Banker Trojan Telax. The attackers are using social engineering tactics, such as offering coupon vouchers and free software applications like WhatsApp and Avast antivirus, to lure the end user into downloading and installing the malicious payload. Social networking sites Facebook and Twitter are primarily being used to spread a shortened URL (using bit.ly service) that points to a Google Cloud Server hosting the malicious payload with .COM or .EXE file extensions... The malware authors are actively pushing out new versions of Telax (latest version 4.7) binaries and are abusing Google Cloud Servers to host the payload for infection. There is no vulnerability exploit being used in this campaign and the attackers are solely relying on social engineering to infect the end users..."
(More detail at the URL above.)
:fear::fear: :mad:
AplusWebMaster
2015-12-14, 14:02
FYI...
Fake 'Scan' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-scan-from-samsung-mfp.html
14 Dec 2015 - "This -fake- scanned document does not come from Cardiff Galvanizers but is instead a simple -forgery- with a malicious attachment.
From: Gareth Evans [gareth@ cardiffgalvanizers .co.uk]
Date: 14 December 2015 at 10:43
Subject: FW: Scan from a Samsung MFP
Regards
Gareth
-----Original Message-----
Please open the attached document. It was scanned and sent to you using a
Samsung MFP. For more information on Samsung products and solutions, please
visit http ://www .samsungprinter .com.
This message has been scanned for malware...
I have seen just a single sample of this, named Untitled_14102015_154510.doc and with a VirusTotal detection rate of 7/54*. It contains a malicious macro... which according to this Malwr report** downloads a malicious binary from:
test1.darmo .biz/437g8/43s5d6f7g.exe
There will probably be other versions of the document downloading from the same location. The binary has a VirusTotal detection rate of 1/54***. Those two reports plus this Hybrid Analysis[4] indicate network traffic to the following malicious IPs:
199.7.136.84 (Megawire, Canada)
221.132.35.56 (Ho Chi Minh City Post And Telecom Company, Vietnam)
202.69.40.173 (Gerrys Information Technology (PVT) Ltd, Pakistan)
78.47.66.169 (Hetzner, Germany)
The payload is likely to be the Dridex banking trojan...
Recommended blocklist:
199.7.136.84
221.132.35.56
202.69.40.173
78.47.66.169 "
* https://www.virustotal.com/en/file/33fee8120dc8e45b20dd17060ed941a9b90142d9254a2ec5ec89196015f6380a/analysis/1450090998/
** https://malwr.com/analysis/MzIzODE0ZjBjYjhlNGE0Nzk5NzExOGNmMGMwYWQwZWM/
*** https://www.virustotal.com/en/file/142e24ba1fdcf998986e526bf2e85dfbc9fe627e5b7b29033ffb45ace6e2c716/analysis/1450091531/
4] https://www.hybrid-analysis.com/sample/33fee8120dc8e45b20dd17060ed941a9b90142d9254a2ec5ec89196015f6380a?environmentId=1
- http://myonlinesecurity.co.uk/fw-scan-from-a-samsung-mfp-gareth-evans-garethcardiffgalvanizers-co-uk-word-doc-or-excel-xls-spreadsheet-malware/
14 Dec 2015
14 December 2015: Untitled_14102015_154510.doc - Current Virus total detections 7/54*
"MALWR** tells us that it downloads what looks like Dridex banking Trojan from
test1 .darmo .biz/437g8/43s5d6f7g.exe (VirusTotal 1/53***)..."
* https://www.virustotal.com/en/file/33fee8120dc8e45b20dd17060ed941a9b90142d9254a2ec5ec89196015f6380a/analysis/1450090998/
** https://malwr.com/analysis/MzIzODE0ZjBjYjhlNGE0Nzk5NzExOGNmMGMwYWQwZWM/
*** https://www.virustotal.com/en/file/142e24ba1fdcf998986e526bf2e85dfbc9fe627e5b7b29033ffb45ace6e2c716/analysis/1450092293/
___
Fake 'resume' SPAM - JS malware cryptowall
- http://myonlinesecurity.co.uk/resume-js-malware/
14 Dec 2014 - "An email coming from random names and random email addresses pretending to be a resume with a zip attachment is another one from the current bot runs... The content of the email says :
Hi, my name is Kent Mckay
Please find my resume in the attachment
Thank you,
Kent Mckay
14 December 2015: Kent Mckay.zip: Extracts to: Kent Mckay.js
Current Virus total detections 0/54* which MALWR** shows us downloads -3- files from
http ://updatemicrosoft2015 .ru/exe/ 1.jpg (virus total 3/54***) and 2.jpg (VirusTotal 2/55[4]) 3.jpg (virustotal 4/55[5]) and posts to http ://updateserviceavast .ru/p/gate.php and http ://bademlik .com/4XQIPH.php?g=lzm39hr73u5jiah. The js downloader -renames- the downloaded jpg files to .exe and auto runs them.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/360082ac28812a790ce71a8fa33841fb24bb2e5f158c09a968abcb004ef41077/analysis/1450092597/
** https://malwr.com/analysis/ZmQ3NmUxY2QwNzllNDRiZmIyOTE5YmE3N2EwNjI3NDY/
89.252.41.9
213.238.171.181
91.209.96.118
*** https://www.virustotal.com/en/file/1211456a8b7c7fb9e5bdfa601dc288886f71af012c555badd94796f4146a342d/analysis/1450083835/
4] https://www.virustotal.com/en/file/7f0090c808750d6b64e35075bfee802799603da55bac2a44f53b990e1d16ce73/analysis/1450083847/
5] https://www.virustotal.com/en/file/81f0271f775bcd84449bf2e5d00d96eabd1868ba3afb6f15e00cc99b0a988f82/analysis/1450083824/
___
Fake 'Invoice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/invoice-14-12-15-thunderbolts-limited-enquiriesthunderbolts-co-uk-word-doc-or-excel-xls-spreadsheet-malware/
14 Dec 2015 - "An email with the subject of 'Invoice 14 12 15' pretending to come from THUNDERBOLTS LIMITED <enquiries@ thunderbolts .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email which must be confused because the attachment is an XLS ( Excel) spreadsheet simply says:
This message contains 2 pages in PDF format.
14 December 2015: fax00163721.xls - Current Virus total detections 5/54*
MALWR** shows us it downloads http ://exfabrica .org/437g8/43s5d6f7g.exe which is the -same- Dridex banking malware as described in today’s other malspam run*** involving malicious office docs with macros... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/ee2aef690cce4b6d61b3ae429e307527da893e4898dd421ed72a5fd3110a5296/analysis/1450093861/
** https://malwr.com/analysis/MDliNWRhN2NkZTRhNDJkODkyMjUwNGEzYTRjNzAxM2Q/
46.165.204.143
199.7.136.84
184.28.188.186
*** http://myonlinesecurity.co.uk/fw-scan-from-a-samsung-mfp-gareth-evans-garethcardiffgalvanizers-co-uk-word-doc-or-excel-xls-spreadsheet-malware/
- http://blog.dynamoo.com/2015/12/malware-spam-invoice-14-12-15.html
14 Dec 2015 - "This terse fake financial spam is -not- from the awesomely-named Thunderbolts Limited but is instead a simple forgery with a malicious attachment:
From: THUNDERBOLTS LIMITED [enquiries@ thunderbolts .co.uk]
Date: 14 December 2015 at 11:15
Subject: Invoice 14 12 15
This message contains 2 pages in PDF format.
Curiously, the bad guys have gone as far as to include a -fake- header to make it look like a fax:
X-Mailer: ActiveFax 3.92
Attached is a file fax00163721.xls which is fairly obviously -not- a PDF document. So far I have seen two versions of this with a detection rate of 6/55 [1] [2] and which these Malwr reports [3] [4] indicate download a malicious binary from:
exfabrica .org/437g8/43s5d6f7g.exe
test-cms.reactive .by/437g8/43s5d6f7g.exe
This binary has a detection rate of 0/54*. That VirusTotal report and this Hybrid Analysis** both show traffic to:
199.7.136.84 (Megawire, Canada)
This malware is likely to be Dridex. Given that it is similar to the one found here***, I would recommend blocking network traffic to:
199.7.136.84
221.132.35.56
202.69.40.173
78.47.66.169 "
1] https://www.virustotal.com/en/file/ee2aef690cce4b6d61b3ae429e307527da893e4898dd421ed72a5fd3110a5296/analysis/1450099936/
2] https://www.virustotal.com/en/file/65edb1c82d397307060ced539dc790ccf55110ac1acb5c8eb7210a27f679751f/analysis/1450099949/
3] https://malwr.com/analysis/MDliNWRhN2NkZTRhNDJkODkyMjUwNGEzYTRjNzAxM2Q/
4] https://malwr.com/analysis/MjgzY2MxMjJlZTA4NDFlNGE4NjBhNjgzYzdhOGRlMDg/
* https://www.virustotal.com/en/file/951d723f780fd5ecca06b45491f5865e10934fe986de06052630a53a4f2f4ade/analysis/1450100026/
** https://www.hybrid-analysis.com/sample/951d723f780fd5ecca06b45491f5865e10934fe986de06052630a53a4f2f4ade?environmentId=1
*** http://blog.dynamoo.com/2015/12/malware-spam-scan-from-samsung-mfp.html
___
Fake 'Invoice 15069447' SPAM - macro malware
- http://myonlinesecurity.co.uk/invoice-15069447-from-cleansing-service-group-macro-malware/
14 Dec 2015 - "An email with the subject of 'Invoice 15069447' from Cleansing Service Group pretending to come from CSG <accounts@ csg .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/csg-1-1024x330.png
14 December 2015: 15069447.doc - Current Virus total detections 8/54*
MALWR is timing out so I am unable to fully determine the payload, but the VirusTotal report indicates that it is the -same- downloader that was spammed out earlier under different names, so it is a high probability that it is the -same- Dridex banking Trojan as described in today’s earlier malspam run**
Note: the Dridex malware -does- get regularly updated on the compromised delivery servers and it is very common to see 8 or 10 slightly different versions throughout the day... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8ba640a663d4202b321f1d37a1748f62c4181595d74d1d1c4aee71288b341192/analysis/1450097979/
** http://myonlinesecurity.co.uk/fw-scan-from-a-samsung-mfp-gareth-evans-garethcardiffgalvanizers-co-uk-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'invoice_scan' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-israel-burke-bcp.html
14 Dec 2015 - "This -fake- invoice comes with a malicious attachment:
From: Israel Burke [BurkeIsrael850@ business .telecomitalia .it]
Date: 14 December 2015 at 15:00
Subject: Israel Burke
Dear Customer:
Attached please find an invoice(s) for payment. Please let us know if you have any questions.
We greatly appreciate your business!
Israel Burke
BCP Transportation, Inc.
I have only seen one sample of this, it is possible that the company name and sender names are randomly generated. The attachment in this case was named invoice_scan_76926455.doc and has a detection rate of 3/55*. Despite the name, this is -not- a Word document but is an XML document... containing ActiveMIME data. The Malwr report** for this indicates network traffic to:
109.234.34.224 (McHost.Ru, Russia)
80.96.150.201 (SC-Nextra Telecom SRL, Romania)
That Malwr report shows a dropped binary named qqqew.exe which has a VirusTotal detection rate of 5/55***. I am not certain of the payload, but I suspect that this Word document is dropping -Upatre- leading to the Dyre banking trojan...
Recommended blocklist:
109.234.34.224
80.96.150.201 "
* https://www.virustotal.com/en/file/43b0067e8d71e9d30443b9577b77d4c988740d1c061d40902393bd0684768c95/analysis/1450109838/
** https://malwr.com/analysis/MDRiYjI0OTlmNTFlNDhlNTk0MGQ5MTRlZWYyODNjMjQ/
109.234.34.224
80.96.150.201
184.28.188.192
*** https://www.virustotal.com/en/file/3c031af5772cf5e277ec8485f106bc9b666171c3d63f0b010f6dfe313e9f51cf/analysis/1450110752/
___
Fake 'Customer Invoice' SPAM - macro malware
- http://myonlinesecurity.co.uk/cargill-customer-invoice-04498752-macro-malware/
14 Dec 2015 - "An email with the subject of 'Cargill Customer Invoice 04498752' [random numbers] coming from random email addresses and names with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear Customer,
Attached is the invoice for the product(s) and/or service(s) you recently purchased.
We appreciate doing business with you!
Regards,
Cargill Animal Nutrition ...
14 December 2015: invoice_scan_04498752.doc - Current Virus total detections 3/53*
MALWR** shows us it connects to http ://193.111.63.142 /jamaica/kingston.php where it downloads juniorgong.exe (VirusTotal 5/55***). According to Dynamoo[4] (Who had similar docs with different email subjects) this binary seems to be -upatre- which will download and run Dyre/Dyreze banking Trojan. (MALWR[5]) Although MALWR doesn’t actually show any download. I am also seeing the same email mentioned by Dynamoo which pretends to be an invoice from BCP Transportation, Inc and is also coming from random senders with random invoice numbers in the attachment. My copies all had 'Invoice December 2015' as the subject and the bodies looked like:
Dear Customer:
Attached please find an invoice(s) for payment. Please let us know if you have any questions.
We greatly appreciate your business!
Lula Craft
BCP Transportation, Inc.
All of these had the name in the body matching the alleged sender and the attachment delivered the -same- Upatre/Dyreze payload as mentioned above... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d373dec2eaeb1563519a7a9c41f4a952d20237138f944a4a2665c45ebedacbd8/analysis/1450110683/
** https://malwr.com/analysis/ZWNiMmEwZGJhNTBmNGU5Njg0NThkYTc3MzY5NDg0Y2Y/
193.111.63.142
80.96.150.201
13.107.4.50
4] http://blog.dynamoo.com/2015/12/malware-spam-israel-burke-bcp.html
5] https://malwr.com/analysis/MTJjYWIxYzRjMmQ5NGFjNjg1NjUzZWQzOGZkYzE0OTQ/
80.96.150.201
184.28.188.192
___
Fake 'order #83472521' SPAM - JS malware Teslacrypt
- http://myonlinesecurity.co.uk/your-order-83472521-11-money-way-pittsburgh-pa-15226-js-malware-teslacrypt/
14 Dec 2015 - "An email with the subject of 'Your order #83472521' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Valued Customer,
This letter was sent to you as a formal notice that you are obligated to repay our company the sum of 2,932$ which was advanced to you from our company on October 16, 2015.
Please, find the invoice enclosed down below.
This amount must be repaid until the date of maturity to payment obligation, December 28, 2015 and you have failed to repay our company the same despite repeated requests for this payment.
Thank you in advance for your prompt attention to this matter. We look forward to your remittance. If you have any questions, please do not hesitate to contact us.
Sincerely,
Emanuel Lyons
11 Money Way
Pittsburgh, PA 15226
14 December 2015: invoice_83472521_scan.zip: Extracts to: invoice_copy_KRe6PE.js
Current Virus total detections 2/54* which downloads Teslacrypt ransomware from
miracleworld1 .com/91.exe (VirusTotal 5/54**). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/352d02914e940da3b43ee7a6506f1633143a67b188153a3e01571bbcddf97470/analysis/1450106174/
** https://www.virustotal.com/en/file/4393d6c64d9598b1acc2788b5804c3835f17d34017642f39b5f7015f6a926372/analysis/
miracleworld1 .com: 5.178.71.5: https://www.virustotal.com/en/ip-address/5.178.71.5/information/
> https://www.virustotal.com/en/url/5de5f9ec4a6ea91e780f1040aca83f11b3ff1342b6f48e4dcb366bc813ef582a/analysis/
83.69.233.102: https://www.virustotal.com/en/ip-address/83.69.233.102/information/
___
Fake 'Last Payment Notice' SPAM - JS malware teslacrypt
- http://myonlinesecurity.co.uk/reference-number-63481002-last-payment-notice-sandor-inc-js-malware-teslacrypt/
14 Dec 2015 - "An email with the subject of 'Reference Number #63481002, Last Payment Notice' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs... The content of the email says :
Dear Customer,
We regret to inform you that due to your unpaid debt amount of $745.47 to Sandor Inc., from November 31, 2015 we have passed your case to the court.
Your prompt attention is required to resolve this issue.
Attached you can find your invoice and case information to review.
14 December 2015: invoice_63481002_scan.zip: Extracts to: invoice_ss4vYy.js
Current Virus total detections 3/54* which downloads Teslacrypt ransomware from either firstwetakemanhat .com/91.exe or miracleworld1 .com/91.exe (VirusTotal 5/54**) Which is the -same- teslacrypt ransomware as described in this slightly earlier run today***. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/06a3059a2cfbdf9c283c1d90444b6d9c4c044958e692d470ad0c554a664a9add/analysis/1450113436/
** https://www.virustotal.com/en/file/4393d6c64d9598b1acc2788b5804c3835f17d34017642f39b5f7015f6a926372/analysis/
*** http://myonlinesecurity.co.uk/your-order-83472521-11-money-way-pittsburgh-pa-15226-js-malware-teslacrypt/
firstwetakemanhat .com: 84.200.69.60: https://www.virustotal.com/en/ip-address/84.200.69.60/information/
> https://www.virustotal.com/en/url/6aba9401d553870053d023be1df5c40717581fece3ee0fcd8d1858012d98b5df/analysis/
193.150.0.78: https://www.virustotal.com/en/ip-address/193.150.0.78/information/
> https://www.virustotal.com/en/url/e2865df98187f8e4ecd2ae10a22749c67d5600e18d0c2c77fe7814fee2846cf6/analysis/
___
Fake 'invoice #92277208' SPAM - JS malware Teslacrypt
- http://myonlinesecurity.co.uk/agri-basics-invoice-92277208-and-92277209-320-golden-shore-suite-350-js-malware-teslacrypt/
14 Dec 2015 - "An email with the subject of 'Agri Basics invoice #92277208 and 92277209' [random numbered] coming from random email addresses and names with a zip attachment is another one from the current bot runs... The content of the email says :
Please find attached invoice #92277208.
Have a nice day
Matthew Daniels
Accounts Receivable
320 Golden Shore, Suite 350
Long Beach, CA 90802
The name of the Accounts receivable matches the alleged sender...
14 December 2015: invoice_92277208_scan.zip: Extracts to: invoice_SCAN_kHps3.js
Current Virus total detections 4/56* which downloads teslacrypt ransomware from either firstwetakemanhat .com/91.exe or miracleworld1 .com/91.exe (VirusTotal 1/56**) this is an -updated- teslacrypt from today’s earlier runs***. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/94d07e60c3fa8f4bd01c57fe719b29bc4680611942223869dd17390f4dde9f93/analysis/1450119089/
** https://www.virustotal.com/en/file/63d33d0a37ac792ac0b8d8d80bb6744414661db2754d3da4260632fe2fe377b8/analysis/1450124215/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
69.175.2.106: https://www.virustotal.com/en/ip-address/69.175.2.106/information/
*** http://myonlinesecurity.co.uk/reference-number-63481002-last-payment-notice-sandor-inc-js-malware-teslacrypt/
___
'Outlook account has been disabled' - MS PHISH ...
- http://myonlinesecurity.co.uk/microsoft-outlook-account-has-been-disabled-phishing/
14 Dec 2015 - "We are seeing a lot of phishing attempts against Microsoft office and outlook accounts. This one starts with an email with the subject 'Microsoft outlook account has been disabled' pretending to come from Contact <admin@ 'microsoftexchangee'.com>. One of the major common subjects in this sort of phishing attempt is 'Your password will expire soon' or 'update your email' or something very similar. This one wants only wants your email / Microsoft account login details... The original email simply says:
Your Microsoft outlook account has been disabled
Please reactive it : Click here
The link behind the click here starts with a Google short URL link https ://goo .gl/hFbJ9K which sends you invisibly to http ://clameurs.dijon .fr/wp-content/plugins/wp-calameo/net.html which then automatically sends you without anybody realising you even went via a -hidden- link to http ://www.microsoft-outlook .link/network/login_/ which can very easily be mistaken for a genuine Microsoft site. The domain the emails come from also can be easily mistaken for a genuine Microsoft domain... you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/fake-microsoft365-log-in-1024x542.png
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email... it is a straight forward attempt, like this one, to -steal- your personal, bank, credit card or email and social networking login details..."
:fear::fear: :mad:
AplusWebMaster
2015-12-15, 13:22
FYI...
Fake 'Unpaid Invoice' SPAM - leads to Teslacrypt
- http://blog.dynamoo.com/2015/12/malware-spam-reference-number-89044096.html
15 Dec 2015 - "This -fake- financial spam comes with a malicious attachment.
From: Carol Mcgowan
Date: 15 December 2015 at 09:09
Subject: Reference Number #89044096, Notice of Unpaid Invoice
Dear Valued Customer,
It seems that your account has a past due balance of $263,49. Previous attempts to collect the outstanding amount have failed.
Please remit $263,49 from invoice #89044096 within three days or your account will be closed, any outstanding orders will be cancelled and this matter will be referred to a collection agency.
The payment notice is enclosed to the letter down below.
Attached is a file invoice_89044096_scan.doc which has a VirusTotal detection rate of 2/54*, and which contains this malicious macro... which attempts to download a binary from the following location:
thewelltakeberlin .com/92.exe
This domain was registered only today, and at the moment is not resolving properly. The payload here is likely to be Teslacrypt... Nameservers are dns1.saymylandgoodbye .in and dns2.saymylandgoodbye .in hosted on 5.178.71.5 (Serverius, Netherlands) and 83.69.233.102 (Awax Telecom, Russia)...
Recommended minimum blocklist:
thewelltakeberlin .com
83.69.233.102
5.178.71.5
UPDATE: There is a good analysis of this malware at TechHelpList** including the C2 domains involved."
* https://www.virustotal.com/en/file/1cfd5890006c047ef571119325b2642b2b3d349645b7f6a287adf05fd75981ea/analysis/1450174494/
** https://techhelplist.com/spam-list/1007-reference-number-notice-of-unpaid-invoice-malware
___
Fake 'Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-order-ps007xx20000584.html
15 Dec 2015 - "This rather brief spam does -not- come from Petty Wood but is instead a simple -forgery- with a malicious attachment:
From: Nicola Hogg [NHogg@ pettywood .co.uk]
Date: 15 December 2015 at 10:14
Subject: Order PS007XX20000584
There is -no- body text, but instead there is an attachment PS007XX20000584 - Confirmation with Photos.DOC which has a VirusTotal detection rate of 5/55* and it contains a malicious macro... which (according to this Malwr report**) downloads a binary from:
kutschfahrten-friesenexpress .de/8iy45323f/i87645y3t23.exe
There are probably other versions of the document with different download locations. This malicious executable has a detection rate of 2/54*** and between them these three reports [1] [2] [3] indicate malicious traffic to:
199.7.136.84 (Megawire Inc, Canada)
221.132.35.56 (Ho Chi Minh City Post And Telecom Company, Vietnam)
The payload here is likely to be the Dridex banking trojan...
Recommended blocklist:
199.7.136.84
221.132.35.56 "
* https://www.virustotal.com/en/file/28e5175f9dec6a1d176db23e5e4e068a0782e02c046c049d3f90b0884d626e77/analysis/1450176653/
** https://malwr.com/analysis/OWUxMzViM2ExZGE0NDhhYmExODVkYmFkZGUwOWZjMTc/
*** https://www.virustotal.com/en/file/6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217/analysis/1450176769/
1] https://www.virustotal.com/en/file/6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217/analysis/1450176769/
2] https://malwr.com/analysis/ZmNkNjEzNTM0ZDQ1NDU2NTg0ZjA2ZDI2MjZjYzc3MTI/
3] https://www.hybrid-analysis.com/sample/6b20d33e98443022bf235d483f3dcbe607dfea9cf86f191489b730b8eb22e217?environmentId=1
___
Fake 'Voucher' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-invoice-for-voucher-ach-2.html
15 Dec 2015 - "This -fake- financial spam does not come from Affordable Car Hire but is instead a simple -forgery- with a malicious attachment.
From: Reservations [res@ affordablecarhire .com]
Date: 15 December 2015 at 11:50
Subject: Invoice for Voucher ACH-2-197701-35
Affordable Car Hire
Payment Link For BookingACH-2-197701-35
Please find attached your invoice for reservation number ACH-2-197701-35 ...
I have only seen a single sample, with an attachment ACH-2-197701-35-invoice.xls which has a VirusTotal detection rate of 3/54*. According to this Malwr report, it downloads a malicious binary from:
usahamanfaat .com/8iy45323f/i87645y3t23.exe
The payload here is the Dridex banking trojan, and it is identical to the one found in this spam run**."
* https://www.virustotal.com/en/file/387a4cd7950332ac59a134359b61de78be30cc3076f45f7599c9ab8b9f533af7/analysis/1450182473/
** http://blog.dynamoo.com/2015/12/malware-spam-order-ps007xx20000584.html
___
Fake 'Invoice Attached' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-invoice-attached.html
15 Dec 2015 - "This -fake- financial spam has a malicious attachment:
From: Ernestine Harvey
Date: 15 December 2015 at 11:34
Subject: Invoice Attached
Good morning,
Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice. If you have any questions please let us know.
Thank you!
Mr. Ernestine Harvey
Accounting Specialist| Bank of America, N.A., Cabot Oil & Gas Corp.
The sender name varies randomly, except in the email they are all signed "Mr." even if they have female names... The attachments are named in the format invoice_12345678_scan.doc - the filenames are randomly-generated and indeed every attachment seems to be unique. Typical VirusTotal detection rates are around 3/54*... attempted downloads from:
modern7technologiesx0 .tk/x1656/dfiubgh5.exe
forbiddentextmate58 .tk/x1656/ctruiovy.exe
temporary777winner777 .tk/x1656/fdgbh44b.exe
former12futuristik888 .tk/x1656/fdgjbhis75.exe
Note that these are all .TK domains.. and they are all hosted on exactly the same server of 31.184.234.5 (GTO Ltd, Montenegro). A look at VirusTotal's report for that IP* gives another malicious domain of:
servicexmonitoring899 .tk
I would suggest that the entire 31.184.234.0/24 range looks pretty questionable.
Anyway, the downloaded binary has a VirusTotal detection rate of 4/55** and the comments indicate that rather surprisingly this is the Nymaim ransomware [5]. The Hybrid Analysis*** indicates network traffic to xnkhfbc .in on 200.195.138.156 (Szabo & Buhnemann, Brazil). But in fact that domain seems to move around a lot and has recently been seen on the following IPs:
41.224.12.178 (Orange Tunisie Internet, Tunisia)
51.255.59.248 (OVH, France)
78.107.46.8 (Corbina Telecom, Russia)
95.173.163.211 (Netinternet, Turkey)
118.102.239.53 (Dishnet, India)
140.116.161.33 (TANET, Taiwan)
185.114.22.214 (Osbil Technology Ltd., Turkey)
192.200.220.42 (Global Frag Networks, US)
200.195.138.156 (Szabo & Buhnemann Ltda, Brazil)
210.150.126.225 (HOSTING-NET, Japan)
There are a bunch of bad domains associated with this malware but the only other one that seems to be active is oxrdmfdis.in.
Recommended blocklist:
31.184.234.5
41.224.12.178
51.255.59.248
78.107.46.8
95.173.163.211
118.102.239.53
140.116.161.33
185.114.22.214
192.200.220.42
200.195.138.156
210.150.126.225
xnkhfbc.in
oxrdmfdis.in
UPDATE: A source tells me (thank you) that servicexmonitoring899 .tk is now resolving to 78.129.252.19 (iomart, UK) that has also recently hosted these following domains:
google-apsm .in
specre .com
ganduxerdesign .com
www .ganduxerdesign .com
upmisterfliremsnk .net
tornishineynarkkek .org
tornishineynarkkek2 .org
Some of these domains are associated with Rovnix[4]."
* https://www.virustotal.com/en/ip-address/31.184.234.5/information/
** https://www.virustotal.com/en/file/34eb0c91ff39e09a4f9e07777949b00b8289f739f570cc74e991d2d591d5e08f/analysis/1450185850/
*** https://www.hybrid-analysis.com/sample/34eb0c91ff39e09a4f9e07777949b00b8289f739f570cc74e991d2d591d5e08f?environmentId=1
4] https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/
5] http://www.welivesecurity.com/2013/10/23/nymaim-browsing-for-trouble/
___
Tainted network: vds24 .net on OVH
- http://blog.dynamoo.com/2015/12/tainted-network-dmitry-shestakov.html
15 Dec 2015 - "vds24 .net (apparently belonging to "Dmitry Shestakov ") is a Russian reseller of OVH servers that has come up on my radar a few times in the past few days [1] [2] [3] in connection with domains supporting Teslacrypt malware and acting as landing pages for the Angler exploit kit. Curious as to what was hosted on the vds24 .net I set about trying to find out their IP address ranges. This proved to be somewhat difficult as they are spread in little chunks throughout OVH's IP space. I managed to identify:
5.135.58.216/29
5.135.254.224/29
51.254.10.128/29
51.254.162.80/30
51.255.131.64/30
149.202.234.116/30
149.202.234.144/30
149.202.234.188/30
149.202.237.68/30
176.31.24.28/30
178.32.95.152/29
178.33.200.128/26
Then using a reverse DNS function, I looked up all the domains associated with those ranges (there were a LOT) and then looked the see which were active plus their SURBL and Google ratings... There may well be legitimate domains in this range, but out of 1658 domains identified, 1287 (77.6%) are flagged by SURBL as being spammy. Only 11 (0.7%) are identified as malicious, but in reality I believe this to be much higher. In particular, the following IP ranges seem to be clearly bad from those ratings:
51.254.10.131
51.254.162.81
51.255.131.66
51.255.142.101
149.202.234.190
149.202.237.68
178.33.200.138
I can see -61- active IPs in the vds24 .net range, so perhaps it is only a small proportion. However, depending on your network stance, you may want to consider blocking -all- the IP ranges specified above just to be on the safe side."
1] http://blog.dynamoo.com/2015/12/malware-spam-your-order-12345678-11.html
2] http://blog.dynamoo.com/2015/12/malware-spam-invoice-66626337ba2deb0f.html
3] https://twitter.com/ConradLongmore/status/675310855559503872
___
Fake 'Remittance Advice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-rockspring-remittance.html
15 Dec 2015 - "This -fake- financial spam comes with a malicious attachment:
From: Kristina Salinas
Date: 15 December 2015 at 14:59
Subject: Rockspring Remittance Advice - WIRE
Dear Customer,
Please find attached your Remittance Details for the funds that will be deposited to your bank account on December 15th.
Rockspring Capital is now sending through the bank the addenda information including your remit information.
If you are not seeing your addenda information in your bank reporting you may have to contact your local bank representative.
Accounts Payable
Attached is a malicious document with a -random- name. I have only seen one sample so far with a VirusTotal detection rate of 3/55*. The Malwr report** indicates that -same- behaviour as this earlier spam run*** which is dropping Nymaim ransomware."
* https://www.virustotal.com/en/file/329712f73f7cfd67baa563ef75ed0b6bd9d10d56bc70f5725b27f773770a607a/analysis/1450192082/
** https://malwr.com/analysis/MDQ1MWQzNjcwODU4NDVmMjgxZDY4Y2Y0ZTU5N2NhZjI/
31.184.234.5
*** http://blog.dynamoo.com/2015/12/malware-spam-invoice-attached.html
:fear::fear: :mad:
AplusWebMaster
2015-12-16, 14:26
FYI...
Fake 'e-Invoice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/your-e-invoices-from-barrett-steel-services-ltd-samantha-morgan-word-doc-or-excel-xls-spreadsheet-malware/
16 Dec 2015 - "An email with the subject of 'Your e-Invoice(s) from Barrett Steel Services Ltd' pretending to come from samantha.morgan@ barrettsteel .com with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear Customer,
Please find attached your latest Invoice(s).
Kind Regards,
Samantha Morgan,
Barrett Steel Services Ltd,
Phone: 01274654248
Email: samantha.morgan@ barrettsteel .com
PS
Have you considered paying by BACS ? Our details can be found on the attached invoice.
Please reply to this email if you have any queries.
You can use the link below to perform an Experian credit check...
16 December2015:e-Invoice Barrett Steel Services Ltd.doc - Current Virus total detections 4/54*
MALWR** shows us this downloads what looks like Dridex banking Trojan from http ://wattplus .net/98g654d/4567gh98.exe (VirusTotal 4/53***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a3d10e08999093b212be81c3294c0e4dbb90a9a5783179c1158b6fe20af15ed2/analysis/1450263394/
** https://malwr.com/analysis/MzMxYjE0NGIyZDAyNGNjODkzOTBiYTljOWI0ODk3Mjg/
181.224.138.100
199.7.136.84
*** https://www.virustotal.com/en/file/4985218139506968b541187195a7612ed6da398c88a8ba124201820a617d7d25/analysis/1450263681/
- http://blog.dynamoo.com/2015/12/malware-spam-your-e-invoices-from.html
16 Dec 2015 - "This -fake- financial spam does not come from Barrett Steel Services Ltd but is instead a simple -forgery- with a malicious attachment:
From: samantha.morgan@ barrettsteel .com
Date: 16 December 2015 at 09:44
Subject: Your e-Invoice(s) from Barrett Steel Services Ltd
Dear Customer,
Please find attached your latest Invoice(s).
Kind Regards,
Samantha Morgan,
Barrett Steel Services Ltd,
Phone: 01274654248
Email: samantha.morgan@ barrettsteel .com
PS
Have you considered paying by BACS ? Our details can be found on the attached invoice.
Please reply to this email if you have any queries...
Attached is a file e-Invoice Barrett Steel Services Ltd.doc which I have seen just a single variant of, with a VirusTotal detection rate of 4/54* which according to this Malwr analysis** downloads a malicious binary from the following location:
wattplus .net/98g654d/4567gh98.exe
This downloaded binary has a detection rate of 4/53*** and according to this Malwr report[4] it attempts to contact:
199.7.136.84 (Megawire, Canada)
I strongly recommend that you -block- traffic to that IP. Other analysis is pending. The payload is almost definitely the Dridex banking trojan."
* https://www.virustotal.com/en/file/a3d10e08999093b212be81c3294c0e4dbb90a9a5783179c1158b6fe20af15ed2/analysis/1450263394/
** https://malwr.com/analysis/MjQ2NmE3NzZmNjJhNDBiOWFmZTdkYmZjMGI3MzhlMTc/
199.7.136.84
*** https://www.virustotal.com/en/file/4985218139506968b541187195a7612ed6da398c88a8ba124201820a617d7d25/analysis/1450263681/
4] https://malwr.com/analysis/MjQ2NmE3NzZmNjJhNDBiOWFmZTdkYmZjMGI3MzhlMTc/
199.7.136.84
___
Fake 'Your Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-documentation-your-order.html
16 Dec 2015 - "This -fake- financial spam is not from John S. Shackleton (Sheffield) Ltd but is instead a simple -forgery- with a malicious attachment. It is the second spam in a day pretending to be from a steel company.
From Jonathan Carroll [Jonathan@ john-s-shackleton .co.uk]
Date Wed, 16 Dec 2015 11:11:09 -0000
Subject Documentation: Your Order Ref: SGM249/013
Your Order: SGM249/013
Our Order: 345522
Advice Note: 355187
Despatch Date: 22/12/15
Attachments:
s547369.DOC Shackleton Invoice Number 355187
John S. Shackleton (Sheffield) Ltd
4 Downgate Drive
Sheffield
S4 8BU
Tel: 0114 244 4767
Fax: 0114 242 5965 ...
I have only seen a single sample of this spam, with an attachment s547369.DOC which has a VirusTotal detection rate of 4/55*. According to this Malwr Report** it downloads a malicious binary from:
bbbfilms .com/98g654d/4567gh98.exe
This binary has a detection rate of 4/53*** and is the -same- payload as found in this spam run[4], leading to the Dridex banking trojan."
* https://www.virustotal.com/en/file/bc471b68a6e48be738409a32e4ae063a15cbeeb70551c48a3d52ffc4b161b85d/analysis/1450264586/
** https://malwr.com/analysis/ZTIyYWM4Y2ZlOTUwNDE4MjlhZjFiNzYxZThmOTI5NjE/
199.91.68.54
199.7.136.84
*** https://www.virustotal.com/en/file/4985218139506968b541187195a7612ed6da398c88a8ba124201820a617d7d25/analysis/1450264859/
4] http://blog.dynamoo.com/2015/12/malware-spam-your-e-invoices-from.html
- http://myonlinesecurity.co.uk/documentation-your-order-ref-sgm249013-john-s-shackleton-sheffield-ltd-office-macro-malware/
16 Dec 2015 - "An email with the subject of 'Documentation: Your Order Ref: SGM249/013' pretending to come from Jonathan Carroll <Jonathan@'john-s-shackleton'.co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Your Order: SGM249/013 Our Order: 345522 Advice Note: 355187 Despatch Date: 22/12/15 Attachments: s547369.DOC Shackleton Invoice Number 355187
John S. Shackleton (Sheffield) Ltd
4 Downgate Drive
Sheffield
S4 8BU
Tel: 0114 244 4767
Fax: 0114 242 5965 ...
16 December 2015: s547369.DOC - Current Virus total detections 4/56*
MALWR shows us this downloads what looks like Dridex banking Trojan from http ://bbbfilms .com/98g654d/4567gh98.exe which is the -same- malware as described in this slightly earlier malspam run** of malicious Office docs..."
* https://www.virustotal.com/en/file/bc471b68a6e48be738409a32e4ae063a15cbeeb70551c48a3d52ffc4b161b85d/analysis/1450261722/
** http://myonlinesecurity.co.uk/your-e-invoices-from-barrett-steel-services-ltd-samantha-morgan-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Invoice No. 4515581' SPAM - macro malware
- http://myonlinesecurity.co.uk/invoice-no-4515581-brunel-promotions-co-uk-calendars-and-diaries-of-bristol-limited-office-macro-malware/
16 Dec 2015 - "An email with the subject of 'Invoice No. 4515581' [random numbers] pretending to come from Sharon Samuels <sharons775@ brunel-promotions .co.uk> the numbers after sharons are random so almost everybody gets a -different- sharons sender number @ brunel-promotions .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Good morning
Please find attached your latest invoice, for your attention.
Please be advised that your goods have been despatched for delivery.
Regards
Sharon
Calendars and Diaries of Bristol Limited...
16 December 2015: IN4515581.xls - Current Virus total detections 4/55*
MALWR** shows us that it downloads Dridex banking Trojan from http ://printempsroumain .org/98g654d/4567gh98.exe which appears to be a slightly different version from today’s earlier Malspam run. Dridex does update frequently throughout the day and changes file # regularly to try to avoid antivirus detections..."
* https://www.virustotal.com/en/file/54a00046f9841e947c3a146c240923563408f70bb5958dd091eeaddf3adf1635/analysis/1450270016/
** https://malwr.com/analysis/OTE2MzhhM2YxNzVkNGU4ZmJhMmI3Zjg1OTE0YjdiOTI/
194.24.228.5
199.7.136.84
___
Fake 'Unpaid Invoice' SPAM - leads to Teslacrypt
- http://blog.dynamoo.com/2015/12/malware-spam-unpaid-invoice-from.html
16 Dec 2015 - "This -fake- financial spam is -not- from Staples or Realty Solutions but is instead a simple -forgery- with a malicious attachment.
From: Virgilio Bradley
Date: 16 December 2015 at 14:37
Subject: Unpaid Invoice from Staples Inc., Ref. 09846839, Urgent Notice
Dear Valued Customer,
This letter is a formal notice to you taking in consideration the fact that you are obligated to repay our company the sum of $767,90 which was advanced to you from our company on November 21st, 2015.
You now have two options: forward your payment to our office by January 17, 2016 or become a party in a legal action. Please be advised that a judgment against you will also damage your credit record.
Please acknowledge the receipt of the invoice attached and the e-mail, no later than December 31, 2015.
Regards,
Virgilio Bradley
Customer Service Department
Realty Solutions
182 Shobe Lane
Denver, CO 80216
The names, amounts and reference numbers -change- from email to email. The attachment has the same name of the reference (e.g. invoice_09846839_copy.doc) but despite this I have only seen one version with a VirusTotal detection rate of just 1/55*. According to this Malwr report**, the macro in the document downloads a binary from:
iamthewinnerhere .com/97.exe
This appears to be Teslacrypt ransomware and it has a detection rate of 5/53***. Unlike some other malware, the domain iamthewinnerhere .com has been registered specifically to host this malware, and is located on:
185.69.152.145 (Hosting Ukraine Ltd, Ukraine)
84.200.69.60 (Ideal-Hosting UG, Germany) ...
Recommended minimum blocklist:
iamthewinnerhere .com
185.69.152.145
84.200.69.60 "
* https://www.virustotal.com/en/file/37a2a137a91eab96ff0876892e5c498814ed53d118fc30f5534737993324cfd0/analysis/1450277884/
** https://malwr.com/analysis/OTE2YjVlNTUxMmRmNDJiZWE0MTQ1MzdlYmRjYjg5YmY/
185.69.152.145
78.47.139.102
*** https://www.virustotal.com/en/file/e81173dd782598a3525c316e17cebe599dd4f60f2d4c8c28b73ddea43245bfb6/analysis/1450278299/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
192.254.189.98: https://www.virustotal.com/en/ip-address/192.254.189.98/information/
- http://myonlinesecurity.co.uk/unpaid-invoice-from-staples-inc-ref-80053334-urgent-notice-realty-solutions-office-macro-malware-delivering-teslacrypt-ransomware/
16 Dec 2015 - "An email with the subject of 'Unpaid Invoice' from Staples Inc., Ref. 80053334, Urgent Notice' [random numbers] coming from random senders and email addrresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear Valued Customer,
This letter is a formal notice to you taking in consideration the fact that you are obligated to repay our company the sum of $155,74 which was advanced to you from our company on November 21st, 2015.
You now have two options: forward your payment to our office by January 17, 2016 or become a party in a legal action. Please be advised that a judgment against you will also damage your credit record.
Please acknowledge the receipt of the invoice attached and the e-mail, no later than December 31, 2015...
16 December 2015: invoice_80053334_copy.doc - Current Virus total detections 0/53*
MALWR** shows us that this downloads from iamthewinnerhere .com/97.exe (VirusTotal 6/54***) which appears to be Teslacrypt ransomware rather than the usual Dridex we have been seeing with these office macros. Unlike a lot of other currently spreading malware which is being delivered through compromised sites, the domain iamthewinnerhere .com has been registered specifically to host this malware..."
* https://www.virustotal.com/en/file/37a2a137a91eab96ff0876892e5c498814ed53d118fc30f5534737993324cfd0/analysis/1450281302/
** https://malwr.com/analysis/OTE2YjVlNTUxMmRmNDJiZWE0MTQ1MzdlYmRjYjg5YmY/
185.69.152.145
78.47.139.102
*** https://www.virustotal.com/en/file/e81173dd782598a3525c316e17cebe599dd4f60f2d4c8c28b73ddea43245bfb6/analysis/1450278299/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
192.254.189.98: https://www.virustotal.com/en/ip-address/192.254.189.98/information/
___
Fake 'account past due' SPAM - office macro / teslacrypt ransomware
- http://myonlinesecurity.co.uk/your-account-has-a-debt-and-is-past-due-office-macro-malware-delivering-teslacrypt-ransomware/
16 Dec 2015 - "An email with the subject of 'Your account has a debt and is past due' coming from random senders and email addrresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Dear Customer,
Our records show that your account has a debt of $612.{rand(10,99)}}. Previous attempts of collecting this sum have failed.
Down below you can find an attached file with the information on your case.
16 December 2015: invoice_10166218_copy.doc - Current Virus total detections 2/55*
MALWR** shows us that this downloads from iamthewinnerhere .com/80.exe (VirusTotal 11/54***) which appears to be Teslacrypt ransomware rather than the usual Dridex we have been seeing with these office macros. Unlike a lot of other currently spreading malware which is being delivered through compromised sites, the domain iamthewinnerhere .com has been registered specifically to host this malware... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/ff0f08fc470b4ef4fc82b3c9844134c871aa23d5dcd02f24bee532145545fccf/analysis/1450282241/
** https://malwr.com/analysis/YWZlZmQ5YTRiYzFkNGQ0NjgxYjYyZGY0MzE1OTQxNTg/
185.69.152.145
78.47.139.102
192.254.189.98
192.185.21.121
162.144.12.170
72.167.1.1
192.254.250.243
78.110.50.123
*** https://www.virustotal.com/en/file/bb63a3d6dd6fb07b67826f184a82856bb70b1c6d8d372b9ab5c212ecb9d428cd/analysis/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
192.254.189.98: https://www.virustotal.com/en/ip-address/192.254.189.98/information/
___
'You have been hacked' – Phish...
- http://myonlinesecurity.co.uk/only-apps-com-you-have-been-hacked-phishing-scam/only-apps_email/
16 Dec 2015 - "... this email message which is very weird and appears to be a phishing attempt that spectacularly fails:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/only-apps_email-1024x635.png
... The alleged registrant Michael Huber has also been spotted in at least 1 previous scam and phishing attempt [1] with -fake- details:
1] https://www.phishtank.com/phish_detail.php?phish_id=3440367&frame=details
Address lookup
canonical name only-apps .com
addresses
146.0.74.182: https://www.virustotal.com/en/ip-address/146.0.74.182/information/
89.35.134.132: https://www.virustotal.com/en/ip-address/89.35.134.132/information/
... The sending email address just tracks back to what looks like a scummy email marketing scam site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/appseeking-1-1024x599.png
appseeking .com: 62.75.194.45: https://www.virustotal.com/en/ip-address/62.75.194.45/information/ "
___
'Your PayPal account has been limited' – Phish
- http://myonlinesecurity.co.uk/your-paypal-account-has-been-limited-phishing/
16 Dec 2015 - "Quite a big PayPal phishing spam run today saying 'Your PayPal account has been limited' pretending to come from PayPal <confirmagain@ ppservice .com>...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/paypal-account-limited-email-1024x757.png
The link in this case goes to http ://hiperkarma .hu/vsase/savdm/ligofren.htm which -redirects- you to http ://www .adventurehaliburton .com/message/newone/websrc.htm?cmd=-submit?IOF4U3OFTN9CT98GJV945MJVG945IIIRTHMJOGGVRTOVJ4G5OC589V459JERGTMOGVJKLDV48934C57654CERI54VGTR which has an old style PayPal log in page looking like this screenshot:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/adventure_haliburton_paypal_phish-1024x662.png
... Which is a typical phishing page that looks very similar to a genuine old style PayPal update page, if you don’t look carefully at the URL in the browser address bar. This one wants your personal details, your Paypal account log in details and your credit card and bank details along with mother’s maiden name and other info to -steal- your identity. Many of them are also designed to specifically -steal- your email, facebook and other social network log in details..."
:fear::fear: :mad:
AplusWebMaster
2015-12-17, 12:42
FYI...
Fake '12/16 A Invoice' SPAM - office malware
- http://myonlinesecurity.co.uk/1216-a-invoice-broadband-invoice-office-malware/
17 Dec 2015 - "An email pretending to be a broadband invoice with the subject of '12/16 A Invoice' coming from random names and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
Hi,
Please find attached a recharge invoice for your broadband.
Many thanks,
Valeria Larson
The name of the alleged sender matches the name in the body of the email. All the attachment invoice numbers are random...
17 December 2015: invoice63548716.doc - Current Virus total detections 0/52*
... contains an embedded object in base64 encoded format which is most likely Upatre which MALWR** shows us contacts http ://109.234.37.214 /chicken/bacon.php and downloads and automatically runs luxary.exe (VirusTotal 3/54***) The MALWR analysis[4] is somewhat inconclusive but might suggest Dridex or Dyre banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents appear to be blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a93233dea9b85c139562ee6ccfcbfe787105e721e6a1f1961e4c031d211a9b99/analysis/
** https://malwr.com/analysis/MDg5NmVjNWI4YTljNGU1Yzk4YjdiMzk2NWNiOTJjNDc/
5.9.99.35
109.234.37.214
80.96.150.201
184.25.56.93
*** https://www.virustotal.com/en/file/a92650e85ad41e246a59a1eeae52a8bd311e7a5a1b7bb7bcb84c4a0d9169b57d/analysis/1450340515/
4] https://malwr.com/analysis/MmRjZWYyNjJlYmM1NGM3M2I5ZjM1ZjJiYzEwZmVmZjk/
80.96.150.201
184.25.56.100
- http://blog.dynamoo.com/2015/12/malware-spam-1216-invoice.html
17 Dec 2015 - "This -fake- financial spam leads to malware:
From: Kelley Small
Date: 17 December 2015 at 08:39
Subject: 12/16 A Invoice
Hi,
Please find attached a recharge invoice for your broadband.
Many thanks,
Kelley Small
The sender's name is randomly generated... There is an attachment in the format invoice36649009.doc where the number is randomly generated. This comes in at least -six- different versions but they do not appear to be uniquely generated (VirusTotal results [1] [2]...). Detection rates are close to zero. The Malwr reports for those documents is a mixed bag [3] [4]..., but overall they spot data being POSTed to:
179.60.144.18 /chicken/bacon.php
91.203.5.169 /chicken/bacon.php
Sources tell me there is another download location of:
195.191.25.145 /chicken/bacon.php
Those IPs are likely to be malicious and belong to:
179.60.144.18 (Veraton Projects Ltd, Netherlands)
91.203.5.169 (Denis Pavlovich Semenyuk / TutHost, Ukraine)
195.191.25.145 (Hostpro Ltd, Ukraine)
They also GET from:
savepic .su/6786586.png
A file karp.exe is dropped with an MD5 of 1fbf5be463ce094a6f7ad345612ec1e7 and a detection rate of 3/54[5]. According to this Malwr report[6] this communicates with:
80.96.150.201 (SC-Nextra Telecom SRL, Romania)
It's not clear what the payload is, but probably some sort of banking trojan such as Dridex.
Recommended blocklist:
80.96.150.201
179.60.144.18
91.203.5.169
195.191.25.145
savepic .su "
1] https://www.virustotal.com/en/file/7d37ee9e0cbd82a2f710944b2b200c7683e47064d801c055e8e196bfa43a2c2b/analysis/1450341961/
2] https://www.virustotal.com/en/file/e9b5e63688ad11f03d981c4ae90ae7f86381c947fe8dbbcd6712b287e1d25eb4/analysis/1450341971/
3] https://malwr.com/analysis/MmIxMWRlOTI2MzYxNDBmNmI3ZWQ1N2MxYjZhODdmZWM/
4] https://malwr.com/analysis/MDM0ZGE3MTlhM2VjNGVlOGE1ZmVmM2ZhODhkNmM3NmQ/
5] https://www.virustotal.com/en/file/a92650e85ad41e246a59a1eeae52a8bd311e7a5a1b7bb7bcb84c4a0d9169b57d/analysis/1450342614/
6] https://malwr.com/analysis/MTM4M2NlMDFlYTRiNGMzZDk4YTE1MTk0MjY0Y2I3ODQ/
___
Fake 'Fuel Card Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-your-latest-right-fuel.html
17 Dec 2015 - "This -fake- financial email is not from Right Fuel Card Company but is instead a simple forgery with a malicious attachment.
From: Right Fuel Card Company [invoice@ rightfuelcard .co.uk]
Date: 17 December 2015 at 11:11
Subject: Your Latest Right Fuel Card Invoice is Attached
Please find attached your latest invoice.
PLEASE ALSO NOTE OUR NEW OPENING HOURS ARE:
Monday - Thursday 9am - 5pm
Friday 9am - 3pm...
Should you have any queries please do not hesitate to call us on 0845 625 0153 (Calls to this number cost 5 pence per minute plus your telephone company's access charge) or via email to info@rightfuelcard.co.uk.
Regards
Customer Services
The Right Fuelcard Company Limited
Attached is a file A01CardInv1318489.xls - at present I only have a single sample of this. VirusTotal is down at the moment so I cannot tell you the detection rate. The Malwr analysis* shows behaviour consistent with several Dridex runs going on this morning, with a download from:
infosystems-gmbh .de/65dfg77/kmn653.exe
The payload is the Dridex banking trojan, and is identical to the payload here[1], here[2] and here[3]."
* https://malwr.com/analysis/YWUxNzc3YmY2ZGMxNGEzOWFlMWJiOWRmNDI0MjcyN2Q/
217.69.162.183
151.80.142.33
1] http://blog.dynamoo.com/2015/12/malware-spam-email-from-transport-for.html
2] http://blog.dynamoo.com/2015/12/malware-spam-james-wheatley-sent-you.html
3] http://blog.dynamoo.com/2015/12/malware-spam-currys-pc-world.html
- http://myonlinesecurity.co.uk/your-latest-right-fuel-card-invoice-is-attached-word-doc-or-excel-xls-spreadsheet-malware/
17 Dec 2015 - "An email with the subject of 'Your Latest Right Fuel Card Invoice is Attached' pretending to come from Right Fuel Card Company <invoice@ rightfuelcard .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Your-Latest-Right-Fuel-Card-Invoice-is-Attached-1024x549.png
17 December 2015: A01CardInv1318489.xls - Current Virus total detections *
MALWR** shows it downloads http ://ghsoftware .de/65dfg77/kmn653.exe which is the -same- Dridex banking malware as today’s earlier malspam run***..."
*
** https://malwr.com/analysis/NjJiMDJlMWU0ZjMyNDJmNGJiMDk1ZjE5OTk4ZjU0ZTk/
82.165.100.180
151.80.142.33
*** http://myonlinesecurity.co.uk/james-wheatley-sent-you-an-document-file-sent-by-whatsapp-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Required your attention' SPAM – js malware telsacrypt
- http://myonlinesecurity.co.uk/required-your-attention-js-malware-leading-to-teslacrypt/
17 Dec 2015 - "An email with the subject of 'Required your attention' coming from random email addresses and names with a zip attachment is another one from the current bot runs... The content of the email says:
Dear Partner,
As per your request, we have made special prices for you, which leave us only a very small margin.
Kindly find attached the prices with your personal discount, and if you need anything else, dont hesitate to contact us.
Our best wishes, The sales team
17 December 2015: SCAN_PRICES_64904074.zip - Extracts to: invoice_copy_CYcpbM.js
Current Virus total detections 7/53* ... which downloads teslacrypt ransomware from either
whatdidyaysay .com/80.exe -or- iamthewinnerhere .com/80.exe (VirusTotal 1/53**). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected.,,"
* https://www.virustotal.com/en/file/e3a09da6295d2beed0e4bc2d9b330e96415f770b0b7612b1b11536cc650c3ad9/analysis/1450348471/
** https://www.virustotal.com/en/file/3bd64b8300ccb21d217868df0686c6fadf1de0290caf975d3bbd3a68b64662b1/analysis/
whatdidyaysay .com: A temporary error occurred during the lookup...
iamthewinnerhere .com: 5.178.71.10: https://www.virustotal.com/en/ip-address/5.178.71.10/information/
- http://blog.dynamoo.com/2015/12/malware-spam-required-your-attention.html
17 Dec 2015 - "This spam email has a malicious attachment:
From: Brittany Quinn
Date: 17 December 2015 at 10:52
Subject: Required your attention
Dear Partner,
As per your request, we have made special prices for you, which leave us only a very small margin.
Kindly find attached the prices with your personal discount, and if you need anything else, don’t hesitate to contact us.
Our best wishes, The sales team
The sender's name varies from email to email, as does the name of the attachment but it in a format similar to SCAN_PRICES_01106759.zip. Contained within is a malicious obfuscated Javascript with a detection rate of 6/54* which is a bit clear when deobfuscated, and it downloads from:
whatdidyaysay .com/97.exe?1
iamthewinnerhere .com/97.exe?1
This has a detection rate of 3/53**. Automated analysis is inconclusive [1] [2] but this is Teslacrypt and is likely to be similar in characteristics to this spam run***."
* https://www.virustotal.com/en/file/8fca374bed8b65aba5f9e5502dec38036aeb827170a96cbb249e8c43e55384e9/analysis/1450353478/
invoice_752WwU.js
** https://www.virustotal.com/en/file/0f09bc20aacdb9ac6a051a8c44694d772ccb3fe3855728ec2b50586c3ca65d24/analysis/1450353720/
97.exe
*** http://blog.dynamoo.com/2015/12/malware-spam-your-account-has-debt-and.html
1] https://www.hybrid-analysis.com/sample/0f09bc20aacdb9ac6a051a8c44694d772ccb3fe3855728ec2b50586c3ca65d24?environmentId=1
2] https://malwr.com/analysis/NzBlYjI5NmIwNDA3NGY5NWE5NzU3OGY4MGM2Yzg1YzQ/
___
Fake 'PHS documents' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-your-new-phs-documents-are.html
17 Dec 2015 - "This convincing-looking -fake- financial email does -not- come from PHS, but is instead a simple forgery with a malicious attachment:
From: PHSOnline [documents@ phsonline .co.uk]
Date: 17 December 2015 at 11:48
Subject: Your new PHS documents are attached
Dear Customer
Due to a temporary issue with delivering your document(s) via your online account, please find the attached in DOC format for your convenience.
We apologize for you being unable to view your accounts and documents online in the usual manner. Please note that, in the interim, we will continue to deliver documents in this manner until the issue is fully resolved.
Regards
PHS Group
Effectively, this is a re-run of this spam from October*. I have only seen a single sample of this. There is a malicious Excel document attached, G-A0287580036267754265.xls with a VirusTotal detection rate of 4/54**. According to the Malwr report*** this attempts to download a binary from:
infosystems-gmbh .de/65dfg77/kmn653.exe
At present, this download location 404s but other versions of the document will probably have different download locations. The payload is the Dridex banking trojan, as seen several times today [1] [2]..."
* http://blog.dynamoo.com/2015/10/malware-spam-your-new-phs-documents-are.html
** https://www.virustotal.com/en/file/e92bfd84a3ec520dd1748b078efbe4e19b75489e509bea0abda9fc16e5c8866a/analysis/1450354676/
*** https://malwr.com/analysis/ZGZkZmQ4Y2JjNDllNDRiY2FiZDgxM2M0N2IxMTQzNjY/
1] http://blog.dynamoo.com/2015/12/malware-spam-email-from-transport-for.html
2] http://blog.dynamoo.com/2015/12/malware-spam-james-wheatley-sent-you.html
infosystems-gmbh .de: 217.69.162.183: https://www.virustotal.com/en/ip-address/217.69.162.183/information/
> https://www.virustotal.com/en/url/f5b2a03ae0fcdf04eb55182e1d9a90f299fdf60d1bd656df98a7ece90cd96aa5/analysis/
- http://myonlinesecurity.co.uk/your-new-phs-documents-are-attached-word-doc-or-excel-xls-spreadsheet-malware/
17 Dec 2015 - "An email with the subject of 'Your new PHS documents are attached' pretending to come from PHSOnline <documents@ phsonline .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Your-new-PHS-documents-are-attached-1024x561.png
17 December 2015: G-A0287580036267754265.xls - Current Virus total detections 4/54*
MALWR** shows us that it downloads Dridex banking malware from
http ://dirkjraab .de/65dfg77/kmn653.exe (VirusTotal 4/51***) Which is the same as these 2 earlier spam runs [1] [2]..."
* https://www.virustotal.com/en/file/3f7a58de77b6f010ec5e231ee3cb38f2fc598d0a379979de80dd93b119903fc3/analysis/1450353861/
** https://malwr.com/analysis/MmI4MWE2YmNkODYzNGQ0YzljYTFlN2EzNzY5YTkwMjc/
185.21.102.30
151.80.142.33
*** https://www.virustotal.com/en/file/d5e99af323be60dfd02ac4b76e892e1b65e94d24ea32067f9c6f68d963a52094/analysis/1450351607/
TCP connections
117.239.73.244: https://www.virustotal.com/en/ip-address/117.239.73.244/information/
8.253.82.158: https://www.virustotal.com/en/ip-address/8.253.82.158/information/
1] http://myonlinesecurity.co.uk/your-latest-right-fuel-card-invoice-is-attached-word-doc-or-excel-xls-spreadsheet-malware/
2] http://myonlinesecurity.co.uk/james-wheatley-sent-you-an-document-file-sent-by-whatsapp-word-doc-or-excel-xls-spreadsheet-malware/
:fear::fear: :mad:
AplusWebMaster
2015-12-19, 14:19
FYI...
PUPs Masquerade as Installer for Antivirus and Anti-Adware
- https://blog.malwarebytes.org/online-security/2015/12/pups-masquerade-as-installer-for-antivirus-and-anti-adware/
Dec 18, 2015 - "... two pieces of programs claiming to be two different security software, being housed in a domain purporting to be a safe antivirus download hub. The destination in question, however, has been known to serve a -fake- Malwarebytes installer. The domain is antivirus-dld[DOT]com, and users must avoid visiting it or -block- it with their browsers. Below are screenshots of its subdomains where users can supposedly download the AVG and AdwCleaner programs:
1. https://blog.malwarebytes.org/wp-content/uploads/2015/12/avg.png
...
2. https://blog.malwarebytes.org/wp-content/uploads/2015/12/adwcleaner.png
... -both- installers show differences in file names and hashes, they exhibit more identical markings than what we see on the surface... AV engines detect these as variants of the SoftPulse family... As this “Thank you” GUI window is displayed, the supposed program, in this case AVG, is then downloaded and installed automatically. Users can’t see this happening at first because the installer’s GUI is overlaying the real program’s GUI:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/avg05.png
Immediately after installation, the default browser opens to reveal an advertisement of an online dating site. We reckon that various ads are randomized:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/avg06.png
Clicking -any- of these links directs users to magno2soft[DOT]com, a domain that the Google Chrome browser blocks, tagging it as malicious. Additionally, we did a quick look up of their “24/7 free support” phone number—(+1) 844 326 2917—to see if something comes up. It turns out that this number is also used by -other- domains... We have also noted that their contents are also identical to Magno2soft’s. Be advised to -not- visit these sites as some of them automatically download an executable file... Domains like antivirus-dld[DOT]com may only appear legitimate, but they’re just hubs distributing pieces of software you may not want lurking in your hard drive."
antivirus-dld[DOT]com: 23.229.195.163: https://www.virustotal.com/en/ip-address/23.229.195.163/information/
magno2soft[DOT]com: 178.33.154.37: https://www.virustotal.com/en/ip-address/178.33.154.37/information/
> https://www.virustotal.com/en/url/583970208e30af9503e01edf34e9ebc052f9c430600de13bebe419648c2d9b8c/analysis/
:fear::fear: :mad:
AplusWebMaster
2015-12-20, 13:32
FYI...
Angler EK drops TeslaCrypt via recent Flash Exploit
- https://blog.malwarebytes.org/exploits-2/2015/12/angler-ek-drops-ransomware-newexploit/
Dec 19, 2015 - "On December 18, security company Fortinet blogged* about a possible new variant of the CryptoWall ransomware distributed via spam. Around the same time we discovered that the Angler exploit kit was also pushing this new ‘variant’. However it is not CryptoWall... but rather TeslaCrypt. Files are encrypted and appended with a .vvv extension. In order to recover those files, victims must pay $500USD or face the risk of seeing this amount double within less than a week...
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/newcryptowall.png
Angler EK uses a very recently patched flaw in Adobe Flash Player up to version 19.0.0.245** (CVE-2015-8446)**, making it the most lethal exploit kit at the moment..."
> https://www.virustotal.com/en/file/65f063c433dcfc40b2576216702b9e0f9f6fd2f7489f62fc35c880f0a4127092/analysis/1450545960/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
107.180.50.210: https://www.virustotal.com/en/ip-address/107.180.50.210/information/
109.232.216.57: https://www.virustotal.com/en/ip-address/109.232.216.57/information/
* http://blog.fortinet.com/post/new-cryptowall-variant-in-the-wild
** http://malware.dontneedcoffee.com/2015/12/angler-ek-is-exploiting-flash-1900245.html
>> https://forums.spybot.info/showthread.php?12890-Adobe-updates-advisories&p=467614&viewfull=1#post467614
*** https://www.adobe.com/software/flash/about/
:fear::fear: :mad:
AplusWebMaster
2015-12-20, 13:34
FYI...
Angler EK drops TeslaCrypt via recent Flash Exploit
- https://blog.malwarebytes.org/exploits-2/2015/12/angler-ek-drops-ransomware-newexploit/
Dec 19, 2015 - "On December 18, security company Fortinet blogged* about a possible new variant of the CryptoWall ransomware distributed via spam. Around the same time we discovered that the Angler exploit kit was also pushing this new ‘variant’. However it is not CryptoWall... but rather TeslaCrypt. Files are encrypted and appended with a .vvv extension. In order to recover those files, victims must pay $500USD or face the risk of seeing this amount double within less than a week...
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/newcryptowall.png
Angler EK uses a very recently patched flaw in Adobe Flash Player up to version 19.0.0.245** (CVE-2015-8446), making it the most lethal exploit kit at the moment..."
> https://www.virustotal.com/en/file/65f063c433dcfc40b2576216702b9e0f9f6fd2f7489f62fc35c880f0a4127092/analysis/1450545960/
TCP connections
78.47.139.102: https://www.virustotal.com/en/ip-address/78.47.139.102/information/
107.180.50.210: https://www.virustotal.com/en/ip-address/107.180.50.210/information/
109.232.216.57: https://www.virustotal.com/en/ip-address/109.232.216.57/information/
* http://blog.fortinet.com/post/new-cryptowall-variant-in-the-wild
** http://malware.dontneedcoffee.com/2015/12/angler-ek-is-exploiting-flash-1900245.html
>> https://forums.spybot.info/showthread.php?12890-Adobe-updates-advisories&p=467614&viewfull=1#post467614
*** https://www.adobe.com/software/flash/about/
:fear::fear: :mad:
AplusWebMaster
2015-12-21, 20:45
FYI...
Fake 'INVOICE' SPAM – doc/xls malware
- http://myonlinesecurity.co.uk/brenda-howcroft-swaledalefoods-co-uk-invoice-word-doc-or-excel-xls-spreadsheet-malware/
21 Dec 2015 - "... An email with the subject of 'Invoice' pretending to come from Brenda Howcroft <accounts@ swaledalefoods .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/swaledale_foods_invoice-1024x778.png
21 December 2015: Invoice 14702.doc - Current Virus total detections 1/53*
... waiting for analysis to complete on this but it is almost certain to be a downloader for Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5cd42eab4e25a306d0a88de092c2217175065b912ea09a9cb770a5942c22e5d8/analysis/1450699970/
- http://blog.dynamoo.com/2015/12/malware-spam-invoice-brenda-howcroft.html
21 Dec 2015 - "This -fake- financial spam does not come from Swaledale Foods but is instead a simple -forgery- with a malicious attachment.
From: Brenda Howcroft [accounts@ swaledalefoods .co.uk]
Date: 21 December 2015 at 10:46
Subject: INVOICE
Your report is attached in DOC format.
To load the report, you will need the free Microsoft® Word® reader, available to download...
Many thanks,
Brenda Howcroft
Office Manager
t 01756 793335 sales
t 01756 790160 accounts ...
Attached is a file Invoice 14702.doc which comes in at least -9- different versions... sources say that at least some versions download from the following locations:
110.164.184.28 /jh45wf/98i76u6h.exe
getmooresuccess .com/jh45wf/98i76u6h.exe
rahayu-homespa .com/jh45wf/98i76u6h.exe
This dropped file has a detection rate of 6/54*. The Hybrid Analysis report** plus some other sources indicate network traffic to:
199.7.136.88 (Megawire, Canada)
151.80.142.33 (OVH, France)
202.69.40.173 (Gerrys Information Technology (pvt) Ltd, Pakistan)
78.47.66.169 (Hetzner, Germany)
The payload is the Dridex banking trojan...
Recommended blocklist:
199.7.136.88
151.80.142.33
202.69.40.173
78.47.66.169 "
* https://www.virustotal.com/en/file/e44c46b780c8ead7258cb970c8ff2d17e28172be2dc610de228ced805f0991eb/analysis/1450707029/
TCP connections
199.7.136.88
13.107.4.5
** https://www.hybrid-analysis.com/sample/e44c46b780c8ead7258cb970c8ff2d17e28172be2dc610de228ced805f0991eb?environmentId=1
___
Backdoors in Juniper's firewalls ...
- http://net-security.org/secworld.php?id=19259
21 Dec 2015
>> https://isc.sans.edu/diary.html?storyid=20521
Last Updated: 2015-12-21 - "We decided to move to raise our "Infocon" to yellow over the backdoor in Juniper devices. We decided to do this for a number of reasons:
- Juniper devices are popular, and many organizations depend on them to defend their networks
- The "backdoor" password is now -known- and exploitation is trivial at this point. [2]
- With this week being a short week for many of us, addressing this issue -today- is critical.
Who is effected by this issue? Juniper devices running ScreenOS 6.3.0r17 through 6.3.0r20 are affected by the -fixed- backdoor password (CVE-2015-7755). [1]
Juniper devices running ScreenOS 6.2.0r15 through 6.2.0r18 and ScreenOS 6.3.0r12-6.3.0r20 are affected by the VPN decryption problem (CVE-2015-7756). [1] ... There are two distinct issues. First of all, affected devices can be accessed via telnet or ssh using a specific "backdoor" password. This password can not be removed or changed unless you apply Juniper's patch..."
(More detail at the isc URL above.)
1] https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&actp=search
2] https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor
Other references:
> https://www.imperialviolet.org/2015/12/19/juniper.html
>> https://gist.github.com/fox-srt/ca94b350f2a91bd8ed3f
- https://www.us-cert.gov/ncas/current-activity/2015/12/17/Juniper-Releases-Out-band-Security-Advisory-ScreenOS
Dec 17, 2015
Exploit attempts - Juniper Backdoor...
- https://isc.sans.edu/diary.html?storyid=20525
Last Updated: 2015-12-22 00:19:29 UTC - "We are detecting numerous login attempts against our ssh honeypots using the ScreenOS backdoor password. Our honeypot doesn't emulate ScreenOS beyond the login banner, so we do not know what the attackers are up to, but some of the attacks appear to be "manual" in that we do see the attacker trying different commands. We saw the first attempt at 17:43:43 UTC..."
___
DHL - Phish...
- http://myonlinesecurity.co.uk/shipping-document-inv-bl-dhl-phishing/
21 Dec 2015 - "An email with the subject of 'SHIPPING DOCUMENT & INV-BL' coming from Ionel Ghenade <ionel_ghenade@ yahoo .com> is a phishing attempt to gain log in details for your DHL account... I don’t suppose many recipients will actually have a DHL account, although some will. This email does come from Yahoo. I do not know whether the sender has had his account hacked or it is a yahoo account created just for this phishing attempt. If your DHL account does get compromised, they will use it to send illegal and -stolen- goods at your expense and you will be held responsible for that... The email has a mass of recipients in the to: box (about 100) so that is the first warning or a mass spam and something wrong. The content simply says:
Hello,
THE DHL DOCUMENT HAS BEEN SENT TO YOU AS AS DIRECTED.
Regards
... And has a html attachment to the email that at first glance appears to be a PDF attachment. If you are unwise enough to open the attachment. the first thing you see is a JavaScript pop up alerting you with this message:
Encripted DHL file, Your Email has been configured To view Document information, Sign in to continue!
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/dhl_js_popup.png
Press OK and you get:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/dhl_login-1024x917.png
Which of course looks like a DHL log in page, if you don’t look at the web address in the URL bar. In this case it is a local file on your computer, not a webpage. If you enter any email address and password, you are then sent to the genuine DHL site. This scam works because of the windows default behaviour to hide file extensions. In this case without the final extension HTML showing, you are mislead into thinking that it is a PDF file... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .html file it really is, so making it much more likely for you to accidentally open it..."
___
Password checks... ??
- http://myonlinesecurity.co.uk/are-your-passwords-secure/
21 Dec 2015 - "We keep seeing sites that offer to check your passwords and make sure they are safe and secure. One that popped up on Twitter today is:
- http://www.sbrcentre.co.uk/pages/3031/1/Check_Your_Password.html
This aims to educate you and suggest how long it would take to crack your password. Entering -any- password on any of these sites is a total mistake. All these sites that tell you how long and secure your password is, are pure snake oil and a high rating means absolutely -nothing- in the real world. First look at the site. It uses standard HTTP -not- an encrypted HTTPS connection, so in the event you have any problems on your network, anything you send to that site can be easily intercepted. Secondly, even though they say that they do not retain any passwords, how do you know that is true. A misconfiguration can easily store every password in plain text for any hacker to obtain and potentially track back to you. I made up a password to test it:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/sbrc_1-1024x546.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/sbrc_2-1024x548.png
... Check it out with a -fake- password but don’t rely on being safe because of that fake password. Most breaches come because of errors or user interaction not having a short password. Having a long, complicated password that would, take 17 trillion years to crack does not mean you are safe. A high proportion of password hacks either come from the website that holds your password and it doesn’t matter if it is 2 characters long or 20000 characters long, if the site doesn’t encrypt stored passwords and keep them in plain text for any hacker to get hold of via security holes in that site. The other primary password loss method is YOU, when you enter details on a -fake- website or respond to a -phishing- email and give away all your passwords or log in information’s. In many cases a long complicated password is a detriment because you cannot remember it and write it down on a sticky note pinned to the monitor for everyone to see. Either use a password manager or use an easy to remember pass -phrase- or combination or words that mean something to you & no-one else, rather than a single word."
:fear::fear: :mad:
AplusWebMaster
2015-12-22, 14:05
FYI...
Fake 'fax' SPAM - JS malware
- http://myonlinesecurity.co.uk/you-have-received-fax-document-00979545-interfax-online-js-malware/
22 Dec 2015 - "An email with the subject of 'You have received fax, document 00979545' [random numbered] pretending to come from Interfax Online <incoming@ interfax .net> with a zip attachment is another one from the current bot runs... The content of the email says :
A new fax document for you.
You can find your fax document in the attachment.
Scanned in: 50 seconds
File name: task-00979545.doc
Sender: Gerald Daniels
File size: 252 Kb
Pages sent: 3
Resolution: 200 DPI
Date of scan: Mon, 21 Dec 2015 19:39:17 +0300
Thank you for using Interfax!
2 September 2015: task-00979545.zip: Extracts to: task-00979545.doc.js
Current Virus total detections 10/54*. MALWR shows us it downloads -2- malware files 3009102.exe (virus total 4/53**) and 1af9fcbe48b1f[1].gif (VirusTotal 5/52***) and 1 innocent file from http ://martenmini .com/counter/? (long list of random characters). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e615192969ff324e47616c346556769cc124ea2f1f20b8bcb0043b4d969dedfc/analysis/1450770443/
** https://www.virustotal.com/en/file/4da8b8a558849506cfab72cc0b976c6c314396ebd92f3dee136a3ce58fdd2ed3/analysis/1450751819/
*** https://www.virustotal.com/en/file/e05e134d36fce6223aa7fbc6eb85649c5d3c0f8c2acf3ceac6d656df0123a59a/analysis/1450771087/
___
Fake 'New Account' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-british-gas-ac-no.html
22 Dec 2015 - "This -fake- financial email is not from TopSource, Trinity Restaurants or British Gas (the email seems a bit confused), but is instead a simple -forgery- with a malicious attachment.
From: trinity [trinity@ topsource .co.uk]
Date: 22 December 2015 at 10:36
Subject: British Gas - A/c No. 602131633 - New Account
Hi ,
Please refer to the attached invoice from British Gas, the account number on it is different from all the account numbers that we currently have in the system. Can you confirm if this is a new account so that we will create this in system.
Thanks & Regards,
Pallavi Parvatkar ...
Attached is a file British Gas.doc with... a VirusTotal detection rate of 2/54*. Analysis of the document is pending, however it will most likely drop the Dridex banking trojan.
UPDATE: These automated analyses [1] [2] show that the malicious document downloads from:
weddingme .net/786h8yh/87t5fv.exe
This has a VirusTotal detection rate of 3/54**. All those reports indicate malicious traffic to:
199.7.136.88 (Megawire, Canada)
151.80.142.33 (OVH, France)
The payload looks like Dridex...
Recommended blocklist:
199.7.136.88
151.80.142.33 "
* https://www.virustotal.com/en/file/03b0c3a0807327e33a14cedc2272940b7fe072c421552c591f88773b7ffc8e6b/analysis/1450781888/
1] https://www.hybrid-analysis.com/sample/03b0c3a0807327e33a14cedc2272940b7fe072c421552c591f88773b7ffc8e6b?environmentId=2
2] https://malwr.com/analysis/Yjc4NzYyMDg0NzFlNDc5Y2FlNWYyNjRkZjk4OTJkNWQ/
** https://www.virustotal.com/en/file/fea8e081c2a162f1b8084691ae086ec1a9d78848bc805c574bb9a38dbf159641/analysis/1450782995/
TCP connections
199.7.136.88
90.84.59.19
- http://myonlinesecurity.co.uk/british-gas-ac-no-602131633-new-account-trinity-word-doc-or-excel-xls-spreadsheet-malware/
22 Dec 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/British-Gas-Ac-No-602131633-New-Account-1024x690.png
22 December 2015 : British Gas.doc - Current Virus total detections 2/54*
Reverse it** shows a download of what looks like Dridex banking Trojan from
weddingme .net/786h8yh/87t5fv.exe (VirusTotal ***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/03b0c3a0807327e33a14cedc2272940b7fe072c421552c591f88773b7ffc8e6b/analysis/1450781888/
** https://www.reverse.it/sample/03b0c3a0807327e33a14cedc2272940b7fe072c421552c591f88773b7ffc8e6b?environmentId=1
*** https://www.virustotal.com/en/file/fea8e081c2a162f1b8084691ae086ec1a9d78848bc805c574bb9a38dbf159641/analysis/1450781177/
TCP connections
199.7.136.88
90.84.59.19
___
Fake 'PAYMENT RECEIVED' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-cwih8974-payment-received.html
22 Dec 2015 - "This -fake- financial spam does not come from Les Caves de Pyrene but is instead a simple -forgery- with a malicious attachment.
From: Avril Sparrowhawk [Avril.Sparrowhawk@lescaves.co.uk]
Date: 22 December 2015 at 11:14
Subject: CWIH8974 PAYMENT RECEIVED
Good afternoon
Thanks very much for your payment we recently from you, however there was a missed invoice. Can you just confirm this will be included in the next payment run, or whether there were any queries with this particular invoice?
I have attached the invoice for your reference.
Kind regards
Avril
Avril Sparrowhawk
Credit Controller
Les Caves De Pyrene
Pew Corner
Old Portsmouth Road
Artington
Guildford
GU3 1LP
' +44 (0)1483 554784
6 +44 (0)1483 455068 ...
Attached is a malicious document CWIH8974.doc of which I have seen just a single sample with a VirusTotal detection rate of 2/54*. There may be other variations of the document, but in this case it downloads a malicious binary from:
secure.novatronica .com/786h8yh/87t5fv.exe
This has a VirusTotal detection rate of 2/53** and is the -same- payload as found in this earlier spam run***, leading to the Dridex banking trojan."
* https://www.virustotal.com/en/file/8b3d7da4d1ec05c7d8547e17f07a27550387c15b1d19004caa0a173419c90b9f/analysis/1450784063/
** https://www.virustotal.com/en/file/fea8e081c2a162f1b8084691ae086ec1a9d78848bc805c574bb9a38dbf159641/analysis/1450784374/
TCP connections
199.7.136.88
90.84.59.19
*** http://blog.dynamoo.com/2015/12/malware-spam-british-gas-ac-no.html
- http://myonlinesecurity.co.uk/cwih8974-payment-received-les-caves-de-pyrene-avril-sparrowhawk-office-macro-malware-downloads-dridex/
22 Dec 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/CWIH8974-PAYMENT-RECEIVED-1024x753.png
22 December 2015: CWIH8974.doc - Current Virus total detections *
Payload Security Hybrid analysis** shows it downloads a Dridex banking Trojan from
secure.novatronica .com/786h8yh/87t5fv.exe which is the -same- payload as today’s earlier malspam run***..."
* https://www.virustotal.com/en/file/8b3d7da4d1ec05c7d8547e17f07a27550387c15b1d19004caa0a173419c90b9f/analysis/1450784063/
** https://www.hybrid-analysis.com/sample/8b3d7da4d1ec05c7d8547e17f07a27550387c15b1d19004caa0a173419c90b9f?environmentId=2
*** http://myonlinesecurity.co.uk/british-gas-ac-no-602131633-new-account-trinity-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'new payment terms' SPAM - PDF malware
- http://myonlinesecurity.co.uk/att-new-payment-terms-and-payment-fake-pdf-malware/
22 Dec 2015 - "An email with various subjects based around the theme of invoices or payments coming from random email addresses and senders with a zip attachment is another one from the current bot runs... Some of the subjects seen include:
ATT: / new payment terms and payment
Invoice Updated: # 15/12/2015 from DXB International, Inc.
FW: Payment for Invoice
The contents of the emails vary with each email and it is totally -random- which combination of subject and email body you will get. The attachment name remains consistent. Some of the ones I have seen include:
We appreciate your business.
Kind Regards,
Marketing and Sales Manager
Jimmie McCoy
-Or-
Receipts attached. Thank you
Sales Manager
Peter Skinner
-Or-
I have two sets as samples ready to ship Invoice # 0311683, 1 box, 1 lbs, $46.28 Please let us know how you want us to ship these goods.
Thanks & Best Regards,
Payroll Supervisor
Frederick Castillo ...
22 December 2015: Inv#186;-1089-12-2015_PDF.zip: Extracts to: Inv._Nº-1089-12-2015_PDF.exe
Current Virus total detections 2/54*. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c20cf1330cd5379027780fdfa6fd864349feb39e29469dc868366e7e584516d9/analysis/1450791506/
___
Fake 'MUST READ' SPAM - doc malware
- http://myonlinesecurity.co.uk/must-read-police-hunt-missing-terror-suspect-last-seen-in-camden-word-doc-malware/
22 Dec 2015 - "An email with the subject of 'MUST READ! Police hunt missing terror suspect last seen in Camden!' pretending to come from random names and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/MUST-READ-Police-hunt-missing-terror-suspect-last-seen-in-Camden-1024x712.png
22 December 2015: suspect details 44165680.doc - Current Virus total detections 4/54*
MALWR** shows a download from http ://31.41.44.224 /portal/portal.php which is named as govuk.exe
(VirusTotal 2/54***). I am not certain what the payload actually is yet and am awaiting full analysis.
Update: fast work from the host of 31.41.44.224 https ://www .cishost .ru/ who took down the malware very quickly... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/adf1c1860648a17f1267cd3f085b4995777ae7e5c9700dc444cf171d4114d097/analysis/1450796426/
** https://malwr.com/analysis/NTAxMjlkN2Q1ZDBiNDcyZmEwNWE2M2M4NTU0YjFmN2M/
*** https://www.virustotal.com/en/file/2ad0327f1f5dad1f5157cde3a1f4a8b05f10c58cded0788b5f22310e41638af7/analysis/1450796555/
portal.exe
31.41.44.224: https://www.virustotal.com/en/ip-address/31.41.44.224/information/
___
HSBC - Phish...
- https://blog.malwarebytes.org/fraud-scam/2015/12/hsbc-phish-your-account-is-currently-locked/
Dec 22, 2015 - "Customers of HSBC should -avoid- the following URL, which is (most likely) part of an email based phishing campaign. While we don’t have an example of an email to hand, we can certainly shine some light on the website itself which is:
hsbc-message(dot)com
... in the hopes of helping you to avoid a nasty surprise this holiday season:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/hsbclocked1.jpg
... They urge visitors to click next (because hey, that form expires today!) and continue with the process, which is little more than a straight lunge for payment information:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/hsbclocked2.jpg
... To be specific: Card number, expiration date, card verification code, and finally the ATM PIN number. After this, the victim is shown a “We’ll get back to you in 24 hours” message before being forwarded on to a HSBC website:
> https://blog.malwarebytes.org/wp-content/uploads/2015/12/hsbclocked3.png
From a quick scan of various websites, it seems HSBC scams are all the rage right now [1], [2], [3], [4] so please be extra careful with your logins. Scammers are always looking for a way to grab some fast cash, and regardless of whether they approach you by email, SMS or phonecall..."
1] https://twitter.com/Nicv27/status/676108831940870144
2] https://www.instagram.com/p/_XvF5ypr4M/
3] https://www.instagram.com/p/_W6zn3nX-A/
4] http://www.scamcallfighters.com/scam-call-19055814053-HSBC-Bank--Unauthorized-Activity-alert---DebitCard-locked--19055814053-Credit-Card--Bank-Acct--Fraud-35513.html
hsbc-message(dot)com: 98.139.135.129: https://www.virustotal.com/en/ip-address/98.139.135.129/information/
:fear::fear: :mad:
AplusWebMaster
2015-12-23, 14:59
FYI...
Fake 'invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-christmas-industrial.html
23 Dec 2015 - "This -fake- invoice has a malicious attachment:
From: Rachael Murphy
Date: 23 December 2015 at 13:05
Subject: Christmas Industrial Decorating invoice-50473367)
Good afternoon,
Please find attached 1 invoice for processing.
Regards and Merry Christmas!
Rachael Murphy
Financial Manager ...
This email has been scanned by the Symantec Email Security.cloud service.
The sender's name and reference number varies, the attachment is in the format invoice45634499.doc and it comes in at least -three- different versions (VirusTotal results [1] [2] [3]). Analysis is pending, the payload is likely to be the Dridex banking trojan."
1] https://www.virustotal.com/en/file/ae939a600c3912ea248e51c1e4692677fd3c98b506fea9dbebf67b1631e8920d/analysis/
2] https://www.virustotal.com/en/file/243f0c0b58098713ad2fcabfe00a0ab6d1914bd3e4423999f0b0962da535a591/analysis/
3] https://www.virustotal.com/en/file/902ffe1e6e62ae989690d58635f7562004ba944f065b89e8ee12987d4d95d665/analysis/
- http://myonlinesecurity.co.uk/christmas-industrial-decorating-invoice-22306947-word-doc-or-excel-xls-spreadsheet-malware/
23 Dec 2015 - "An email with the subject of 'Christmas Industrial Decorating invoice-22306947)' pretending to come from random senders and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Tony Monroe <MonroeTony50@ bors-spic .ro>
Date: Wed 23/12/2015 12:56
Subject: Christmas Industrial Decorating invoice-22306947) (random numbers)
Good afternoon,
Please find attached 1 invoice for processing.
Regards and Merry Christmas!
Tony Monroe
Financial Manager ...
23 December 2015: invoice22306947.doc - Current Virus total detections 2/54*
... automatic analysis is inconclusive but it appears to have the same payload as described in THIS post** which is most likely to be Dridex banking Trojan..."
* https://www.virustotal.com/en/file/ae939a600c3912ea248e51c1e4692677fd3c98b506fea9dbebf67b1631e8920d/analysis/1450875552/
** http://myonlinesecurity.co.uk/fw-meridian-acc-no-63835341-professional-fee-invoice-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Fee Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-fw-meridian-acc-no.html
23 Dec 2015 - "This -fake- financial spam comes with a malicious attachment. The sender's name and reference number is randomly generated.
From: Josie Ruiz
Date: 23 December 2015 at 11:38
Subject: FW: Meridian (Acc. No. 51588088) - Professional Fee Invoice
Dear Sir/Madam,
Re: Meridian Professional Fees
Please find attached our fee note for services provided, which we trust meets with your approval.
Payment should be made to Meridian International VAT Consulting Ltd. within the agreed payment terms.
We look forward to your remittance in due course.
Yours sincerely
Josie Ruiz
Financial CEO ...
The attachment has the same reference number as the subject, and there are at least -five- different versions... likely to be the Dridex banking trojan.
UPDATE 1: Hybrid Analysis of some of the samples [1] [2] shows some download locations:
146.120.89.92 /volkswagen/bettle.php
109.234.34.164 /volkswagen/bettle.php
Those IPs belong to:
146.120.89.92 (Ukrainian Internet Names Center LTD, Ukraine)
109.234.34.164 (McHost.Ru Inc, Russia)
This is actually an executable with a detection rate of 4/53*. The purpose of this executable is unknown, but it is certainly malicious. Analysis is still pending.
UPDATE 2: This Threat Expert report** and this Hybrid Analysis*** both report traffic to a presumably hacked server at:
104.131.59.185 (Digital Ocean, US)
Recommended blocklist:
104.131.59.185
146.120.89.92
109.234.34.164 "
* https://www.virustotal.com/en/file/c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b/analysis/1450879468/
** http://www.threatexpert.com/report.aspx?md5=265f3b610aed3745ba19fd795a748e57
*** https://www.hybrid-analysis.com/sample/c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b?environmentId=4
1] https://www.hybrid-analysis.com/sample/137d36e8d6943133eeb9c793578ee0e711538c6fe199375b1d7558780869b504?environmentId=1
2] https://www.hybrid-analysis.com/sample/fc36dec6db7c39af027008104decf7d3f8903f90a3a828e10bf53437ae6f182b?environmentId=4
- http://myonlinesecurity.co.uk/fw-meridian-acc-no-63835341-professional-fee-invoice-word-doc-or-excel-xls-spreadsheet-malware/
23 Dec 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/FW-Meridian-Acc-No-63835341-Professional-Fee-Invoice-1024x771.png
23 December 2015: invoice63835341.doc - Current Virus total detections 2/54*
... according to Dynamoo** this downloads from 109.234.34.164 /volkswagen/bettle.php which gave me a file called bettle.exe (VirusTotal ***)..."
* https://www.virustotal.com/en/file/936a4f89b69dea8640889dc3d895b1957e737a2ce670c7e38d627bcadf532ee3/analysis/1450873882/
** http://blog.dynamoo.com/2015/12/malware-spam-fw-meridian-acc-no.html
*** https://www.virustotal.com/en/file/c0c33a4985b8663d527bee198fbd8c2f934e124462b7e40f5448aabf21620f6b/analysis/1450879468/
___
Fake 'Invoice 70146427' SPAM - malicious attachment
- http://blog.dynamoo.com/2015/12/malware-spam-uksm-invoice-70146427.html
23 Dec 2015 - "This -fake- financial spam comes with a malicious attachment. It does -not- come from uksafetymanagement .co.uk but is instead a simple forgery.
From: Claire Carey
Date: 23 December 2015 at 12:01
Subject: UKSM Invoice 70146427
Good time of day,
Thank you for choosing UK Safety Management Ltd. to carry out your Portable Appliance Testing.
Please find enclosed your invoice.
Claire Carey...
The sender's name and reference number are randomly generated. Attached is a file in the format invoice29111658.doc which comes in at least -three- different versions... Analysis of the documents is pending. However, this is likely to be the Dridex banking trojan. The payload appears to be the -same- as the one found in this spam run*."
* http://blog.dynamoo.com/2015/12/malware-spam-fw-meridian-acc-no.html
___
Fake 'chasing payment' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/real-digital-chasing-payment-6910-47-real-digital-international-limited-word-doc-or-excel-xls-spreadsheet-malware/
23 Dec 2015 - "An email with the subject of 'REAL Digital chasing payment 6910.47' pretending to come from random email addresses and names with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/REAL-Digital-chasing-payment-1024x589.png
23 December 2015: invoice21891491.doc - Current Virus total detections 2/53*
ReverseIt analysis** is inconclusive and doesn’t show any payload, However it is likely to be the Dridex banking trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0cd4384c5b003d4ca0605b99f07c2e994cf6b581fdefd2adb621ffcd5d56dc57/analysis/1450873320/
** https://www.reverse.it/sample/d687828b342b1b3d11fee407eb1aaa63a2f72b0700b7975f05f7cdd79af3db50?environmentId=4
___
Tis the season for shipping and phishing
- https://securelist.com/blog/phishing/73174/tis-the-season-for-shipping-and-phishing/
Dec 23, 2015 - "... delivery services send email notifications and provide shipment tracking systems. However, this type of communication also creates the ideal conditions for cybercriminals to send phishing messages in the name of major delivery services, and we end up with an increase in the number of these messages. The fraudsters have a clear aim: to trick unwitting users into downloading a malicious program or entering their confidential data on a phishing site. For example, one scam message detected by Kaspersky Lab asked the user to fill in and sign a delivery form in order to receive a shipment. The message had a DOC file attached to it containing the exploit Exploit.MSWord.Agent.gg, which allowed the cybercriminal to, among other things, gain remote access to the infected computer:
> https://securelist.com/files/2015/12/shipping_phishing_eng_1.png
In another -scam- message the fraudsters write that the shipment is already at a DHL office, but the courier cannot deliver it because the delivery address is unclear. The recipient is asked to follow a link within 48 hours and enter the shipment number on the tracking page; otherwise, the shipment will be returned to the sender:
> https://securelist.com/files/2015/12/shipping_phishing_eng_2.png
A closer inspection reveals that none of the links in the message lead to the DHL site; instead they all point to the same URL packed with the help of a URL shortening service. Another typical fraudster trick is also used in the email – the victim is warned there is a limited amount of time to react (in this case, 48 hours). If the user fails to follow the link in time, the shipment will be returned to the sender. The plan is simple – distract users with warnings about the urgency of doing something quickly rather than giving them time to think things through logically. If unwitting users follow the link, they are taken to a specially crafted site in the corporate style of DHL, and are prompted to type in their login credentials to enter the shipment tracking system:
> https://securelist.com/files/2015/12/shipping_phishing_eng_3.png
... A similar situation exists around FedEx, another large delivery service provider. Kaspersky Lab has detected multiple phishing messages sent in the name of this company:
> https://securelist.com/files/2015/12/shipping_phishing_eng_4.png
There’s nothing new about this scheme – the victim enters account credentials on a crafted site in order to view information about a shipment:
> https://securelist.com/files/2015/12/shipping_phishing_eng_5.png
The fact that this site is -fraudulent- and has nothing to do with FedEx is clear from the URL in the browser address bar. The conclusion that can be made from the examples given above is that you shouldn’t be too trusting or inattentive while you are online. Never follow links in email messages; it’s safer if you manually type the URL of the required site in your browser address bar. Whenever a page prompts you to enter confidential data, always check the URL in the address bar first. If anything looks suspicious in the URL or in the website design, think-twice before entering any personal data. Last but not least, always keep your security software up to date; it should also include an anti-phishing tool that will help you keep your data confidential, and your money safe. That way, you will be in a good mood for the holidays."
___
Joomla 3.4.7 released
- https://www.joomla.org/announcements/release-news/5643-joomla-3-4-7-released.html
21 Dec 2015 - "Joomla! 3.4.7 is now available. This is a -security- release for the 3.x series of Joomla which addresses a -critical- security vulnerability and one low level security vulnerabilities. We strongly recommend that you update your sites immediately. This release only contains the security fixes; no other changes have been made compared to the Joomla 3.4.6 release..."
Installing Joomla
> https://docs.joomla.org/J3.x:Installing_Joomla
Upgrade Packages
> https://github.com/joomla/joomla-cms/releases/tag/3.4.7
- https://www.us-cert.gov/ncas/current-activity/2015/12/22/Joomla-Releases-Security-Update-CMS
Dec 22, 2015
:fear::fear: :mad:
AplusWebMaster
2015-12-24, 14:36
FYI...
Domain renewal SCAM
- http://myonlinesecurity.co.uk/domain-renewal-scam/
24 Dec 2015 - "Many (almost all of us) that have websites and .com domain names and haven’t chosen to use domain privacy will regularly get -scam- messages like this one, trying to fool us into thinking we have to pay these scammers to renew our domain name. They deliberately make it look & sound like a genuine domain renewal and hope that you won’t look carefully at the small print and see it is an SEO scam.
-Don’t- pay it and dump it in the bin:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/seo_domain_scam.png "
___
PayPal phish ...
- http://myonlinesecurity.co.uk/your-access-is-restricted-%E2%9C%94-paypal-phishing/
24 Dec 2015 - "A slightly different PayPal phishing spam run today saying 'Your Access Is restricted ✔' pretending to come from PayPal <jhon@ cilegonfab.co.id>. There are a few major common subjects in a phishing attempt. Lots of them are either PayPal or your Bank or Credit Card, with a message saying some thing like :
Urgent: Your card has been stopped !
Your Access Is restricted ✔
Your PayPal account has been limited
You sent a payment of $xxxx USD/GBP/ Euro to some company or person
There have been unauthorised or suspicious attempts to log in to your account, please verify
Your account has exceeded its limit and needs to be verified
Your account will be suspended !
You have received a secure message from < your bank>
We are unable to verify your account information
Update Personal Information
Urgent Account Review Notification
We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
Confirmation of Order ...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Your-Access-Is-restricted-1024x773.png
The link in this case goes to https ://updateinfo .fwd.wf/gb-uk/scr/?q=login&email=youremail@example .com
Note: the HTTPS Secure SSL login which is unusual for a phishing site and shows the effort that the phishers are starting to go to, in order to persuade you to give them your details:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/your-access-is-restricted_-paypal-phish-1024x575.png
Which is a typical phishing page that looks very similar to a genuine PayPal log in page, if you don’t look carefully at the URL in the browser address bar. One feature of note is the way the phishers try to block known anti-phishing or antivirus companies from getting to the page. I used the default email address they conveniently inserted and invented a random password and ended up with this 404 page... If I use a “genuine” email with a random password, I get this page (split into 2 screenshots for clarity):
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/your-access-is-restricted_-paypal-phish_3-1024x541.png
...
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/your-access-is-restricted_-paypal-phish_4-1024x568.png
... This one wants your personal details, your Paypal account log in details and your credit card and bank details along with mother’s maiden name and other info to steal your identity. Many of them are also designed to specifically steal your facebook and other social network log in details..."
___
Tesco bank phish ...
- http://myonlinesecurity.co.uk/your-recent-attempt-to-transfer-funds-tesco-bank-phishing/
24 Dec 2015 - "An email with the subject 'Your Recent Attempt to Transfer Funds' pretending to come from Tesco Bank is a currently spreading a phishing attempt. There are a few major common subjects in a phishing attempt. Lots of them are involve your Bank or Credit Card... This particular phishing campaign starts with an email with a link (all the social media icons in the email do go to genuine Tesco bank social media sites or to a company called Payoneer who say “Payoneer empowers global commerce by connecting businesses, professionals, countries and currencies with its innovative cross-border payments platform.”):
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Your-Recent-Attempt-to-Transfer-Funds-1024x636.png
Sends you to:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/tesco_cefix_phish-1024x602.png
If you fill in a user name you get a page asking for password and security number:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/tesco_cefix_phish_1-1024x561.png
Fill in that and you get to a typical phishing page.This one wants your personal details, your account log in details and your credit card and bank details. Many of them are also designed to specifically -steal- your email, Facebook and other social network log in details:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/tesco_cefix_phish_2-1024x693.png
... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or click-the-link in the email..."
:fear::fear: :mad:
AplusWebMaster
2015-12-27, 17:54
FYI...
Fake 'WhatsApp' SPAM - malware
- http://myonlinesecurity.co.uk/fake-whatsapp-a-sound-memo-has-been-received-aud-malware/
27 Dec 2015 - "An email appearing to be a WhatsApp notification with the subject of 'A sound memo has been received aud' pretending to come from WhatsApp <peter.kroell@ towncountry .at> (random email addresses) with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/WhatsApp-A-sound-memo-has-been-received-aud-1024x585.png
27 December 2015: mabella12.zip: Extracts to: gully.exe - Current Virus total detections 19/54*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/eb0b5f1511d927b7985dacb5326c8e1cf4c363989dbaab64770b531644aae953/analysis/1451228525/
TCP connections
50.63.202.44: https://www.virustotal.com/en/ip-address/50.63.202.44/information/
98.139.135.129: https://www.virustotal.com/en/ip-address/98.139.135.129/information/
108.166.170.106: https://www.virustotal.com/en/ip-address/108.166.170.106/information/
208.100.26.234: https://www.virustotal.com/en/ip-address/208.100.26.234/information/
141.8.225.124: https://www.virustotal.com/en/ip-address/141.8.225.124/information/
173.201.93.128: https://www.virustotal.com/en/ip-address/173.201.93.128/information/
:fear::fear: :mad:
AplusWebMaster
2015-12-28, 20:05
FYI...
AMEX - Phish...
- http://myonlinesecurity.co.uk/confirm-your-account-profile-american-express-phishing-attempt-fail/
28 Dec 2015 - "... An email with the subject of 'Confirm Your Account Profile! 12/28/2015' pretending to come from American Express Online <narobiprojectors@ inbox .com> (I have received several this afternoon/evening, all pretending to come from different names @ inbox .com)...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/Confirm-Your-Account-Profile-12-28-2015-1024x563.png
The -attached- HTML page which is complete with bad spelling mistakes and looks glaringly wrong would attempt to send your information (-if- you were unwise enough to fill in the page) to
http ://fantasticvacationhomes .com/verification3.php
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/bad-amex-phish-1024x693.png "
fantasticvacationhomes .com: 192.185.141.50: https://www.virustotal.com/en/ip-address/192.185.141.50/information/
___
Straight2Bank - Phish...
- http://myonlinesecurity.co.uk/straight2bank-website-changes-phishing/
28 Dec 2015 - "An email saying 'Straight2Bank Website changes' pretending to come from Straight2Bank <Milan.Colquhoun@ s2b.standardchartered .com> is one of today’s phishing attempts. I have received loads of these this morning and they are using several -different- phish sites... The link in the email directs you to a -fake site-, if you look at the fake website, you would be very hard-pressed to tell the difference from the fake one and the genuine site. The -only- way is look at the address bar and in the -Genuine- bank site, when using Internet Explorer the entire address bar is in green. (in Chrome or Firefox, only the padlock symbol on the left of the browser is green):
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/10/Straight2Bank-Possible-Irregular-Account-Activity-1024x758.png
... previous versions of phish attempts against this bank they only asked for passwords, log in details and pin numbers and didn’t ask for any other personal information... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or click-the-link in the email..."
:fear::fear: :mad:
AplusWebMaster
2016-01-02, 21:34
FYI...
Most vulnerabilities in 2015: Mac OS X, iOS, and Flash
- http://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilities-in-2015-mac-os-x-ios-and-flash/
Dec 31, 2015 - "Which software had the most publicly disclosed vulnerabilities this year? The winner is none other than Apple’s Mac OS X, with 384 vulnerabilities. The runner-up? Apple’s iOS, with 375 vulnerabilities. Rounding out the top five are Adobe’s Flash Player, with 314 vulnerabilities; Adobe’s AIR SDK, with 246 vulnerabilities; and Adobe AIR itself, also with 246 vulnerabilities.
For comparison, last year the top five (in order) were: Microsoft’s Internet Explorer, Apple’s Mac OS X, the Linux Kernel, Google’s Chrome, and Apple’s iOS. These results come from CVE Details*, which organizes data provided by the National Vulnerability Database (NVD). As its name implies, the Common Vulnerabilities and Exposures (CVE) system keeps track of publicly known information-security vulnerabilities and exposures... the 2015 list of the top 50 software products** in order of total distinct vulnerabilities..."
* http://www.cvedetails.com/top-50-vendors.php?year=2015
** http://1u88jj3r4db2x4txp44yqfj1.wpengine.netdna-cdn.com/wp-content/uploads/2015/12/cve_top_50_2015.png
Top 50 list of products categorized by company - Graphic:
> http://1u88jj3r4db2x4txp44yqfj1.wpengine.netdna-cdn.com/wp-content/uploads/2015/12/cve_top_50_company_2015.png
:fear::fear:
AplusWebMaster
2016-01-04, 17:48
FYI...
Evil network: 199.195.196.176/29...
- http://blog.dynamoo.com/2016/01/evil-network-19919519617629-roman.html
4 Jan 2016 - "199.195.196.176/29 is a small bunch of IPs hosting browser-hijacker sites, belonging to Hosting Services, Inc. in Utah and suballocated to a customer. Several domains are flagged by Google as leading to PUAs or malware [1] [2] [3] [4] [5] [6], and almost all those domains also have anonymous registrations... Blocking 199.195.196.176/29 or monitoring traffic to it might detect infected hosts, that appear to have a bunch of per-install crapware and other stuff installed."
(More detail at the dynamoo URL above.)
1] https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=yourfiledownloader.biz
2] https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=smile-files.com
3] https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=express-files.com
4] https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=yourfiledownloader.com
5] https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=down4loading.net
6] https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=yourfile-downloader.net
> http://centralops.net/co/DomainDossier.aspx
network:Network-Name:Dedicated Server
network:IP-Network:199.195.196.176/29
network:IP-Network-Block:199.195.196.176 - 199.195.196.183
network:Org-Name:Alyabiev, Roman
network:Street-Address:pr. Molodeznoi 7 kv. 101
network:City:Kemerovo
network:State:
network:Postal-Code:650044
network:Country-Code:RU ...
___
Ransom32: The first javascript ransomware
- https://isc.sans.edu/diary.html?storyid=20569
2016-01-04 - "... new variant and this one has been built using javascript. This malware -fakes- the NW.js framework. Once installed, connects to its C&C server on TOR network port 85 to get the bitcoin address and the crypto key used for encryption. This trend is not new and we have seen how malware is being built more and more sophisticated to avoid being detected by any antimalware control at the endpoint. You have to integrate endpoint security with network security and correlate any possible alerts that might indicate an incident happening, like a computer being connected to TOR network."
More info at: http://blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/
:fear::fear: :mad:
AplusWebMaster
2016-01-06, 12:51
FYI...
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-205611-49934798.html
6 Jan 2016 - "This -fake- financial spam has a malicious attachment. The sender's names, reference numbers and attachment names vary. Here is one example:
From: Bertha Sherman
Date: 6 January 2016 at 09:29
Subject: Invoice-205611-49934798-CROSSHILL SF
Dear Customer,
Please find attached Invoice 02276770 for your attention.
Should you have any Invoice related queries please do not hesitate to
contact either your designated Credit Controller or the Main Credit Dept. on
01635 279370.
For Pricing or other general enquiries please contact your local Sales Team.
Yours Faithfully,
Credit Dept' ...
I have seen at least -four- different attachments with names in a format similar to invoice40201976.doc... Malwr reports... show that the malware contained within POSTs to:
37.46.130.53 /jasmin/authentication.php
179.60.144.21 /jasmin/authentication.php
195.191.25.138 /jasmin/authentication.php
Those reports also show communication to other suspect IPs, giving:
94.158.214.45 (Noviton Ltd , Russia)
78.47.119.93 (Hetzner, Germany)
2.61.168.116 (Sibirtelecom, Russia)
37.46.130.53 (JSC Server, Russia)
179.60.144.21 (Veraton Projects Ltd, Netherlands)
195.191.25.138 (Hostpro Ltd, Ukraine)
This Hybrid Analysis* also shows similar characteristics. The macro drops a file tsx3.exe with a detection rate of 7/55**. The Malwr report*** doesn't give any particular insight as to what this is, but it is likely to be a banking trojan or ransomware. There are two other similar spam campaigns at the same time [1] [2], one of which POSTs to a McHost .RU IP in Russia:
109.234.34.224 /jasmin/authentication.php ...
Recommended blocklist:
94.158.214.45
78.47.119.93
2.61.168.116
37.46.130.53
179.60.144.21
195.191.25.138
109.234.34.224 "
* https://www.hybrid-analysis.com/sample/ae88860af1c56b8aa83629201f2ff1e2687297f192d2f57e34a8107f1aea5300?environmentId=2
** https://www.virustotal.com/en/file/44fa59e0a70887226f13231622ae84b4f58f48a50c818dcfb77261e14d8de933/analysis/1452075219/
*** https://malwr.com/analysis/MmFjNGZjZjllOWVlNDFlNTlhYzcxNDlkMmRhMmZjZWY/
1] http://blog.dynamoo.com/2016/01/malware-spam-invoice-for-ia20114520.html
2] http://blog.dynamoo.com/2016/01/malware-spam-payment-notification-from.html
- http://myonlinesecurity.co.uk/invoice-205611-88038421-crosshill-sf-word-doc-or-excel-xls-spreadsheet-malware/
6 Jan 2016 - "An email with the subject of 'Invoice-205611-88038421-CROSSHILL SF' coming from random email addresses and senders with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
6 January 2016: invoice88038421.doc - Current Virus total detections 2/56*
MALWR** shows tsx3.exe downloaded from http :// 37.46.130.53/jasmin/authentication.php (VirusTotal 6/56***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d160ee0dff91a4f1b0bbc62725dc193ae6f741cc6673563c0ecff0b083e8b284/analysis/1452072516/
** https://malwr.com/analysis/YTI1YTcwNjdmZjExNDM5YTk0YzNkZDI1YzExMWZjNGY/
*** https://www.virustotal.com/en/file/44fa59e0a70887226f13231622ae84b4f58f48a50c818dcfb77261e14d8de933/analysis/1452073223/
___
Fake 'Penalty Charge Notice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-for-ia20114520.html
6 Jan 2016 - "This -fake- financial spam comes with a malicious attachment. The sender's name, reference numbers and attachment names vary. It seems to be closely related to this spam run*.
From: Viola Carrillo
Date: 6 January 2016 at 09:53
Subject: Invoice for IA20114520
To Whom It May Concern,
Please find attached an invoice relating to Penalty Charge Notice Number IA20114520 along with a copy of the contravention.
In order to prevent this fine from escalating further we have paid this fine on your behalf. Should you have any queries concerning these charges please don’t hesitate to contact me.
Payment for this invoice will be taken by Direct Debit 9 working days from the date of this email.
Please refer to page 2, point 3.6 in your Terms and Conditions for information on Traffic Offences.
I have seen two variants of the attachment (VirusTotal results [1] [2]) and these two Malwr reports [3] [4] indicate identical characteristics to the payload in this spam run* which is also being sent out today."
* http://blog.dynamoo.com/2016/01/malware-spam-invoice-205611-49934798.html
1] https://www.virustotal.com/en/file/951a338251155bdbb1fbc5f1438350fc820ded6a078e38ffefe3e959d92edc70/analysis/1452076482/
2] https://www.virustotal.com/en/file/87436741d92562a67f8308e0d2a0a5e6702af67edf47a048ce8f1609d56e1174/analysis/1452076495/
3] https://malwr.com/analysis/NTIyNzhmYmUxOWQyNDY0MTlmZWNiZDFhMGY0OWUxNGQ/
195.191.25.138
78.47.119.93
13.107.4.50
4] https://malwr.com/analysis/YWZjODliMmRkYjVjNGFhZDkzM2FmOGNmMDYwMzNlNWQ/
195.191.25.138
78.47.119.93
13.107.4.50
- http://myonlinesecurity.co.uk/invoice-for-ia20122439-word-doc-or-excel-xls-spreadsheet-malware/
6 Jan 2016 - "The second of today’s Dridex downloaders... pretends to be a penalty-charge-notification is an email with the subject of 'Invoice for IA20122439' (random numbers) pretending to come from random senders with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
6 January 2016 : invoice20122439.doc - Current Virus total detections 2/56*
MALWR** shows us a download of tsx3.exe from http :// 109.234.34.224/jasmin/authentication.php
... this is the -same- Dridex payload as described in today’s slightly earlier Malspam run***..."
* https://www.virustotal.com/en/file/5fb6f71b58f4ee993fcc5219105c83e426d7e7503a2605ab25f002343690ff27/analysis/1452076028/
** https://malwr.com/analysis/MWFhNTVjZGI2NTI0NDUwMWFjZjVkYzhmNjFkY2JjZjc/
109.234.34.224
78.47.119.93
13.107.4.50
*** http://myonlinesecurity.co.uk/invoice-205611-88038421-crosshill-sf-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Payment notification' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/payment-notification-from-third-energy-services-limited-word-doc-or-excel-xls-spreadsheet-malware/
6 Jan 2016 - "The Third of today’s Dridex downloaders... pretends to be an energy statement is an email with the subject of 'Payment notification from Third Energy Services Limited' coming from random senders and random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Blair Maldonado <MaldonadoBlair76939@ ewb-mn .org>
Date: Wed 06/01/2016 10:29
Subject: Payment notification from Third Energy Services Limited
Body content:
Payment notification from Third Energy Services Limited
Third Energy Services Limited
Registered in England & Wales. Registered number: 50380220.
Registered office: 7th Floor. Portland House, Bressenden Place, London, UK, SW1E 5BH
Tel: 01944 759904 ot 0207 0420 800
This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Third Energy. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone...
6 January 2016: remit50380220.doc - Current Virus total detections 2/55*
MALWR** once again shows a download of tsx3.exe from http :// 195.191.25.138/jasmin/authentication.php which is the -same- Dridex banking malware as described in today’s earlier malspam runs [1] [2]..."
* https://www.virustotal.com/en/file/d7032313d309e89eb2e2b48dc9f934f415544e774f21972b81db63778a5f2c49/analysis/1452076128/
** https://malwr.com/analysis/ZmUwNWIzMjk5NDg0NDlkNDgzMGMyZWY0NWM2YmMxMjM/
195.191.25.138
94.158.214.45
78.47.119.93
13.107.4.50
2.61.168.116
1] http://myonlinesecurity.co.uk/invoice-for-ia20122439-word-doc-or-excel-xls-spreadsheet-malware/
2] http://myonlinesecurity.co.uk/invoice-205611-88038421-crosshill-sf-word-doc-or-excel-xls-spreadsheet-malware/
- http://blog.dynamoo.com/2016/01/malware-spam-payment-notification-from.html
6 Jan 2016 - "This -fake- financial email comes with a malicious attachment.
From: Addie Caldwell
Date: 6 January 2016 at 10:31
Subject: Payment notification from Third Energy Services Limited
Payment notification from Third Energy Services Limited...
... -three- different versions of the attachment (in the format remit85752524.doc or similar)... similar characteristics to this spam run* plus this additional URL:
109.234.34.224 /jasmin/authentication.php
This IP is allocated to McHost .RU in Russia and can be considered as malicious. The payload is unknown, but is possible Dridex.
Recommended blocklist:
94.158.214.45
78.47.119.93
2.61.168.116
37.46.130.53
179.60.144.21
195.191.25.138
109.234.34.224 "
* http://blog.dynamoo.com/2016/01/malware-spam-invoice-205611-49934798.html
___
Fake 'BACS PAYMENT' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-sta19778072-bacs-payment.html
6 Jan 2016 - "This -fake- financial spam comes with different sender names, reference details and attachment names. However, in all cases the attachment is malicious.
From: Forrest Cleveland
Date: 6 January 2016 at 11:23
Subject: STA19778072 - BACS PAYMENT
Importance: High
Hello,
Wasn’t sure who to email.
I don’t know if you have been asked but Statestrong Products Ltd are making one payment today for two cars. Could you let me know when it is in the account please as these are both collections tomorrow...
So far I have seen -three- different attachment variants... same general characteristics as this spam run*. However in this case the dropped file tsx3.exe has been updated and the -new- version has a detection rate of 6/54**. The Malwr report*** indicates very similar traffic to before.
Recommended blocklist:
94.158.214.45
78.47.119.93
2.61.168.116
37.46.130.53
179.60.144.21
195.191.25.138
109.234.34.224 "
* http://blog.dynamoo.com/2016/01/malware-spam-invoice-205611-49934798.html
** https://www.virustotal.com/en/file/dc3cb08c6ad3e2e725c8a02b6eb4d9b69ce133672dffa979018dbddb29356e9d/analysis/1452080581/
*** https://malwr.com/analysis/NjUyZjQ4YTUyMjc4NDkyNzkzY2E2N2I1NjIxYjcyNTc/
78.47.119.93
165.254.102.181
- http://myonlinesecurity.co.uk/sta37626091-bacs-payment-word-doc-or-excel-xls-spreadsheet-malware/
6 Jan 2016 - "The 4th of today’s Dridex malspam downloaders... email with the subject of 'STA37626091 – BACS PAYMENT' (random numbers) coming from random email addresses and senders with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/STA37626091-BACS-PAYMENT-1024x535.png
6 January 2016: remit37626091.doc - Current Virus total detections *
MALWR** shows us it once again downloads tsx3.exe which looks like Dridex banking malware from http :// 37.46.130.53/jasmin/authentication.php (VirusTotal ***) this looks like an updated version from earlier, but Dridex is known to update at frequent intervals throughout the day, often as frequently as -hourly- ..."
* https://www.virustotal.com/en/file/e81de936f778ba8a551c8f98c51489609a74451ce3ad43c0d9c62de20549f1b6/analysis/1452079135/
** https://malwr.com/analysis/MjEyZjhkOWI0YzlhNGZjNjg3YzgyMTY2NzAzODk3NTA/
37.46.130.53
78.47.119.93
13.107.4.50
*** https://www.virustotal.com/en/file/dc3cb08c6ad3e2e725c8a02b6eb4d9b69ce133672dffa979018dbddb29356e9d/analysis/1452078831/
___
Fake 'Unilet Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-unilet-invoice-67940597.html
6 Jan 2016 - "This fake invoice seems to be a bit confused as to who is sending it. It has a malicious attachment.
From: Desiree Doyle
Date: 6 January 2016 at 12:29
Subject: Unilet Invoice 67940597
Hello,
Please find attached another invoice to pay please by BACS.
Thanks
Desiree Doyle
Accounts Department
-----Original Message-----
From: Desiree Doyle
Sent: 06 January 2016 12:30
To: Desiree Doyle
Subject: Scanned from a Xerox Multifunction Device
Please open the attached document. It was scanned and sent to you using a Xerox Multifunction Device.
Attachment File Type: pdf, Multi-Page
Multifunction Device Location: Melbury House-MG01
Device Name: 7225 ...
The attachment has a random name in the format remit41071396.doc and I have seen -three- different versions with quite low detection rates [1] [2] [3]. The Malwr reports for these [4] [5] [6] indicate that it has the -same- behaviour as the spam documented here*, dropping a file tsx.exe ..."
1] https://www.virustotal.com/en/file/bc5b67ccc2a64b5e57604298243484c8b2c0b75c8907dc1fccb1fdc28fc1cef4/analysis/1452084584/
2] https://www.virustotal.com/en/file/93c14c1c73babc520851543ced92d5db87b0a75b982ff604ff75bd3b97cbcb0b/analysis/1452084616/
3] https://www.virustotal.com/en/file/9b383e701963418ecae1777bc60f414068a33f3d2f453642a183792d09db299e/analysis/1452084631/
4] https://malwr.com/analysis/Yjk3ZWRhYTEyZjU3NDQ2ZmJhMmMwZWQ3NWI1ZDQ5MGQ/
37.46.130.53
2.61.168.116
78.47.119.93
13.107.4.50
94.158.214.45
5] https://malwr.com/analysis/NmZmMTM2MzE5NTQ2NGExNGEyN2U1ZTU4YTNhNzVmNjY/
179.60.144.21
6] https://malwr.com/analysis/YjE1NzljMWJhOWYzNGVlYTk4NzBmM2EwNGE4NzQxZDU/
37.46.130.53
78.47.119.93
13.107.4.50
* http://blog.dynamoo.com/2016/01/malware-spam-invoice-205611-49934798.html
- http://myonlinesecurity.co.uk/unilet-invoice-58520927-scanned-from-a-xerox-multifunction-device-bournemouth-university-word-doc-malware/
6 Jan 2016 - "Yet another Dridex downloader coming in an email with the subject of 'Unilet Invoice 58520927' (random numbers) pretending to come from random senders and random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Unilet-Invoice-58520927-1024x518.png
6 January 2016: remit58520927.doc - Current Virus total detections 2/56*
MALWR** once again shows us tsx3.exe being downloaded from http :// 37.46.130.53/jasmin/authentication.php (VirusTotal 6/54***) -Same- Dridex Banking malware as THIS earlier malspam[4]..."
* https://www.virustotal.com/en/file/8c13782003efc770e7e9592db5ca4a8507cdfbe3733b2faa279eaddc4f576079/analysis/1452083864/
** https://malwr.com/analysis/NTM3Yzg2MmQzNDgwNDljZmI3OGE5M2JjYjk5ODBlNGI/
37.46.130.53
78.47.119.93
13.107.4.50
*** https://www.virustotal.com/en/file/dc3cb08c6ad3e2e725c8a02b6eb4d9b69ce133672dffa979018dbddb29356e9d/analysis/1452083988/
4] http://myonlinesecurity.co.uk/sta37626091-bacs-payment-word-doc-or-excel-xls-spreadsheet-malware/
___
Facebook “Page Disabled” Phish - wants your Card Details
- https://blog.malwarebytes.org/fraud-scam/2016/01/facebook-page-disabled-phish-wants-your-card-details/
Jan 6, 2015 - "Fake Facebook Security pages are quite a common sight, and there’s a “Your page will be disabled unless…” -scam- in circulation at the moment on random Facebook comment sections which you should steer clear of. The scam begins with a message like this:
Warning!!!
Your page will be disabled.
Due to your page has been reported by other users.
Please re-confirm your page in order to avoid blocking. You violate our terms of service. If you are the original owner of this account, please re-confirm your account in order to avoid blocking.
If the multiple exclamation marks and generally terrible grammar didn’t give the game away, the following request certainly might:
To complete your pages account please confirm Http below:
https(dot)lnkd(dot)in/bNF9BUY?Facebook.Recovery.page
"Attention"
If you do not confirm, then our system will automatically block your account and you will not be able to use it again.
Thank you for the cooperation helping us improve our service.
The Facebook Team
... Google Safe Browsing flags the final destination as a dubious website: and fires up a “Deceptive site ahead” warning:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/fakefacebook1.jpg
... After harvesting your Facebook credentials, they then go after payment information:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/fakefacebook3.jpg
... Should the victim enter their information and hit the button, they’ll be forwarded on to the real Facebook Security Facebook page. There’s also a “Confirm Paypal” button which leads to a phish for -that- service, too:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/fakefacebook4.jpg
The above page is located at:
report-fanpage(dot)gzpot(dot)com/Next/paypal(dot)com(dot)htm
Make no mistake, this is one phishing scam that could cost you a lot more than your Facebook login. Should you be sent any attempts at panicking you into entering your logins on a so-called “Security Page”, you should give both destination URL and comment sender a very wide berth."
> https://www.virustotal.com/en/url/f78cb3a1177a61d22671dc0aa790d34952e4acde35a27d2d40547f795ba7d6a8/analysis/
report-fanpage.gzpot .com: 31.170.166.81: https://www.virustotal.com/en/ip-address/31.170.166.81/information/
> https://www.virustotal.com/en/url/ad1def30238c978bc8963540f5d6f0ffc025cef3e600002a2642ac79554796a9/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-01-07, 12:30
FYI...
Malvertising - Pop-under Ads sends CryptoWall4
- https://blog.malwarebytes.org/malvertising-2/2016/01/malvertising-campaign-via-pop-under-ads-sends-cryptowall-4/
Jan 7, 2016 - "We have caught a new malvertising campaign on the PopAds network launching the Magnitude exploit kit via pop-under ads. A pop-under is an ad window that appears behind the main browser window and typically remains open until the user manually closes it. Unsuspecting victims running -outdated- versions of the Flash Player were immediately infected with the CryptoWall ransomware. This campaign started around January 1st with ads mostly placed on various adult and video streaming sites and lead to an increase in Magnitude EK activity. Infection flow overview:
serve.popads .net/servePopunder.php?cid={redacted}
{redacted}.name/
Magnitude EK domain ...
According to our data, this attack mainly targeted European users:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/graphic.png
CryptoWall 4 infection: Once a system is infected, personal files are encrypted and usable as indicated in the dreaded CryptoWall ransom page:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/ransompage.png
To recover pictures, documents and other import files, users are asked to pay in order to receive a “decryption” key... Prevention: Ransomware is one particular type of malware where prevention and backups are more important than ever. Since this particular attack relies on web exploits to infect the machine, it is crucial to keep your browser and related plugins up-to-date. You may also want to consider disabling or removing the Flash Player altogether since it has suffered a high number of zero-day exploits in recent history (even the latest version was vulnerable)..."
popads .net: 184.154.76.140: https://www.virustotal.com/en/ip-address/184.154.76.140/information/
- http://www.csoonline.com/article/3019991/security/malvertising-campaign-used-a-free-certificate-from-lets-encrypt.html
Jan 7, 2016
___
Fake 'Angel Springs' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-your-latest-documents-from.html
7 Jan 2016 - "This -fake- financial spam comes with a malicious attachment. The name of the sender varies, as does the reference number in the subject field that matches the attachment name.
From: Leonor Stevens
Date: 7 January 2016 at 10:13
Subject: Your Latest Documents from Angel Springs Ltd [1F101177]
Dear Customer,
Please find attached your latest document (s). You may have noticed that we have changed the way you receive your new attached documents from Angel Springs. Following feedback from our customers we've invested in upgrading our billing systems to make things a little easier for you.
Here's a few ways we've made it easier for you:
Your new documents are now attached to your email. You don't have to follow a link now to get to your documents...
The three samples I have sent for analysis... show an initial communication with:
176.103.62.108 /ideal/jenny.php
91.223.88.205 /ideal/jenny.php
These IPs belong to:
176.103.62.108 (Ivanov Vitaliy Sergeevich, Ukraine)
91.223.88.205 (Private Person Anton Malyi, Ukraine)
I note that 91.223.88.204 also hosts some bad things.. and the entire 176.103.48.0/20 block has a history of evil-ness... Note that there are probably other download locations. Check back later if you are interested.
These malicious documents drop a binary geroin.exe which has a detection rate of 3/54*. The Malwr report** for this shows it phoning home to:
78.47.119.93 (Hetzner, Germany)...
Recommended blocklist:
176.103.48.0/20
91.223.88.204/30
78.47.119.93 "
* https://www.virustotal.com/en/file/95b06f05be081a6013439f219b91b5536b81393a1c1a58a3b76b522b0539403d/analysis/1452162035/
** https://malwr.com/analysis/NGY4M2MzMWQzYjE1NDczYjgzMjVkODdjZTdmZGM4NDQ/
- http://myonlinesecurity.co.uk/your-latest-documents-from-angel-springs-ltd-090190f1-word-doc-or-excel-xls-spreadsheet-malware/
7 Jan 2016 - "... an email with the subject of 'Your Latest Documents from Angel Springs Ltd [090190F1]' (random characters) pretending to come from random names and random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From:Shanna Bolton <BoltonShanna6995@ dsldevice .lan>
Date:Thu 07/01/2016 08:57
Subject: Your Latest Documents from Angel Springs Ltd [090190F1] ...
Dear Customer,
Please find attached your latest document (s). You may have noticed that we have changed the way you receive your new attached documents from Angel Springs. Following feedback from our customers we’ve invested in upgrading our billing systems to make things a little easier for you.
Here’s a few ways we’ve made it easier for you:
Your new documents are now attached to your email. You don’t have to follow a link now to get to your documents...
7 January 2016: 090190F181854503.doc - Current Virus total detections 2/54*
... downloads geroin.exe which looks like Dridex banking malware from http ://91.223.88.205 /ideal/jenny.php (VirusTotal 3/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a635ff28d941692b0ad63c14fe6be278dea4e1eed8d266edef9d054173356f25/analysis/1452161327/
** https://www.virustotal.com/en/file/95b06f05be081a6013439f219b91b5536b81393a1c1a58a3b76b522b0539403d/analysis/1452162035/
___
Fake 'Ibstock Group Invoice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/ibstock-group-invoice-38178369-1912-4024-80-word-doc-or-excel-xls-spreadsheet-malware/
7 Jan 2016 - "... an email with the subject of 'Invoice 38178369 19/12 4024.80' pretending to come from random senders and random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Invoice-38178369-1912-402480-1024x746.png
7 January 2016: invoice38178369.doc - Current Virus total detections *
Downloads the -same Dridex banking malware from http ://193.201.227.12 /ideal/jenny.php as described in this slightly earlier post:
> http://myonlinesecurity.co.uk/your-latest-documents-from-angel-springs-ltd-090190f1-word-doc-or-excel-xls-spreadsheet-malware/
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/39965e4be8b82285553f2f758c4914bbcf00dd062dada7dbd9f7b399831ef0ff/analysis/1452163655/
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-01147665-1912.html
7 Jan 2016 - "This -fake- financial spam is not from the Ibstock Group but instead contains a malicious attachment. It is closely related to this spam* which was sent out earlier today.
From: Amber Smith
Date: 7 January 2016 at 10:38
Subject: Invoice 01147665 19/12 £4024.80 ...
Many thanks for the payment. There’s just one invoice that hasn’t been paid and doesn’t seem to have a query against it either.
Its invoice 01147665 19/12 £4024.80 P/O ETCPO 35094
Can you have a look at it for me please?
Thank-you !
Kind regards
Amber Smith
Credit Control
Finance Department
Ibstock Group ...
The sender's name varies, as does the reference number which matches the name of the attachment. I have seen three unique samples so far... show these documents communicating with:
193.201.227.12/ideal/jenny.php
91.223.88.205/ideal/jenny.php
176.103.62.108/ideal/jenny.php
IPs are allocated to:
176.103.62.108 (Ivanov Vitaliy Sergeevich, Ukraine)
91.223.88.205 (Private Person Anton Malyi, Ukraine)
193.201.227.12 (PE Tetyana Mysyk, Ukraine)
As before, a binary geroin.exe is dropped which communicates with:
78.47.119.93 (Hetzner, Germany)
The payload is the Dridex banking trojan. The recommended blocklist and sample MD5s can be found in this post*."
* http://blog.dynamoo.com/2016/01/malware-spam-your-latest-documents-from.html
___
Fake 'Close Invoice Finance Limited' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-close-invoice-finance.html
7 Jan 2016 - "This fake financial spam comes with a malicious attachment:
From: Carey Cross
Date: 7 January 2016 at 11:35
Subject: Close Invoice Finance Limited Statement 1/1
Dear Customer,
Please find attached your latest statement from Close Brothers Invoice Finance.
Your username is 05510/0420078
Your password should already be known to you...
Regards
Close Brothers Invoice Finance
The sernder's name will vary, as will the attachment name. I have only seen a single sample at the moment with a detection rate of 2/54*. Functionally, the payload is identical to that found in this earlier spam run**, and it drops the Dridex banking trojan."
* https://www.virustotal.com/en/file/c03c7b8891f59c3a0378f0de7bf689d5ba90c61f885f4e0e717a0051e736bfa2/analysis/1452167385/
** http://blog.dynamoo.com/2016/01/malware-spam-your-latest-documents-from.html
- http://myonlinesecurity.co.uk/close-invoice-finance-limited-statement-11-word-doc-or-excel-xls-spreadsheet-malware/
7 Jan 2016 - "... an email with the subject of 'Close Invoice Finance Limited Statement 1/1' pretending to come from random email addresses and names with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
7 January 2016: invEF362145.doc - Current Virus total detections 2/56*
Downloads the -same- Dridex banking malware from http :// 193.201.227.12/ideal/jenny.php as described in today’s earlier posts [1] [2]..."
* https://www.virustotal.com/en/file/ec05418c39c951b8e4fa7a134fc2900937bd276850cb74f40e07bd4c3f792971/analysis/1452168289/
1] http://myonlinesecurity.co.uk/ibstock-group-invoice-38178369-1912-4024-80-word-doc-or-excel-xls-spreadsheet-malware/
2] http://myonlinesecurity.co.uk/your-latest-documents-from-angel-springs-ltd-090190f1-word-doc-or-excel-xls-spreadsheet-malware/
:fear::fear: :mad:
AplusWebMaster
2016-01-08, 13:07
FYI...
Fake 'Invoice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/invoice-from-dsv-7ff6ab68-aria-u-k-ltd-61694956-customer-ref-alex-munro-segb-word-doc-or-excel-xls-spreadsheet-malware/
8 Jan 2016 - "An email with the subject of 'Invoice from DSV 7FF6AB68, ARIA (UK) LTD, 61694956, Customer ref: ALEX MUNRO, SE/GB' pretending to come from random senders and random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Melba Schneider <SchneiderMelba36@ euro-net .pl>
Date: Fri 08/01/2016 10:47
Subject: Invoice from DSV 7FF6AB68 , ARIA (U K) LTD, 61694956, Customer ref: ALEX MUNRO, SE/GB
Invoice/Creditnote no.: 7FF6AB68
Total Amount: GBP 60,00
Due Date: 28.01.2016
If you have any questions to this invoice/creditnote please contact the person written in the upper right corner of the invoice.
Please see attached document.
Best Regards
Melba Schneider
DSV Road Limited
Scandinavia House ...
8 January 2016: logmein_pro_receipt.xls - Current Virus total detections 1/54*
MALWR** shows us a download of hram.exe from http :// 194.28.84.79/softparade/spanish.php which looks like Dridex banking malware (virusTotal 4/56***)... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/40651a3f726e9412bd61ffdadf2ed99578021773ac96ff51193d45d8ad02449b/analysis/1452250187/
** https://malwr.com/analysis/NWEyMzUwNWUxNzE0NGM0YjhjOTQzNDc2NDJjOThkYmI/
194.28.84.79
78.47.119.93
*** https://www.virustotal.com/en/file/a34025464cba28089bad700c3d548c962dc38b1e7f26d57835ddc0a9bd3b38b0/analysis/1452250858/
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-from-dsv-723a36b7.html
8 Jan 2016 - "This -fake- financial spam is not from DSV Road Limited but is instead a simple forgery with a malicious attachment.
From: Hoyt Fowler
Date: 8 January 2016 at 10:49
Subject: Invoice from DSV 723A36B7 , ARIA (U K) LTD, 04995672, Customer ref: ALEX MUNRO, SE/GB
Invoice/Creditnote no.: 723A36B7
Total Amount: GBP 60,00
Due Date: 28.01.2016
If you have any questions to this invoice/creditnote please contact the person written in the upper right corner of the invoice.
Please see attached document.
Best Regards
Hoyt Fowler
DSV Road Limited
Scandinavia House ...
... In this case, the attachment was named INV-SE723A36B7.doc and had a VirusTotal detection rate of 1/55*. According to this Malwr report**, the sample attempts to download a further component:
194.28.84.79 /softparade/spanish.php
There will most likely be a couple of other download locations too (check back later for more). This IP address belongs to Hostpro in Ukraine. Those other locations are likely to be in Ukraine too. A file named hram.exe is dropped onto to target system with a detection rate of 4/54***. The Malwr report indicates that this communicates with:
78.47.119.93 (Hetzner, Germany)
This is a -critical- IP to block, as we also saw it in use yesterday. The payload is most likely the Dridex banking trojan...
Recommended blocklist:
78.47.119.93
194.28.84.79 "
* https://www.virustotal.com/en/file/40651a3f726e9412bd61ffdadf2ed99578021773ac96ff51193d45d8ad02449b/analysis/1452252108/
** https://malwr.com/analysis/MjI0NDM4NWVlZGNmNGY0OGI0ZGRiZTFkYTFiY2RmODQ/
194.28.84.79
78.47.119.93
*** https://www.virustotal.com/en/file/a34025464cba28089bad700c3d548c962dc38b1e7f26d57835ddc0a9bd3b38b0/analysis/1452252679/
___
'Let’s Encrypt'... abused by Malvertisers
- http://blog.trendmicro.com/trendlabs-security-intelligence/lets-encrypt-now-being-abused-by-malvertisers/
Jan 6, 2016 - "... the potential for 'Let’s Encrypt' being -abused- has always been present. Because of this, we have kept an eye out for -malicious- sites that would use a Let’s Encrypt certificate. Starting on December 21, we saw activity going to a malvertising server, with traffic coming from users in Japan. This campaign led to sites hosting the Angler Exploit Kit, which would download a banking Trojan (BKDR_VAWTRAK.AAAFV) onto the affected machine:
Daily hits to malvertising server:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/01/Lets-Encrypt-2-01.png
... The malvertisers used a technique called “domain shadowing”. Attackers who have gained the ability to create subdomains under a legitimate domain do so, but the created subdomain leads to a server under the control of the attackers. In this particular case, the attackers created ad.{legitimate domain}.com under the legitimate site... Traffic to this created subdomain was protected with HTTPS and a Let’s Encrypt certificate... The domain hosted an ad which appeared to be related to the legitimate domain to disguise its traffic. Parts of its redirection script have also been moved from a JavaScript file into a .GIF file to make identifying the payload more difficult. Anti-AV code similar to what we found in the September attack is still present. In addition, it uses an open DoubleClick -redirect- ... users should also be aware that a “secure” site is -not- necessarily a safe site, and we also note that the best defense against exploit kits is still keeping software up-to-date to minimize the number of vulnerabilities that may be exploited..."
> http://news.netcraft.com/archives/2015/10/12/certificate-authorities-issue-hundreds-of-deceptive-ssl-certificates-to-fraudsters.html
> http://news.netcraft.com/wp-content/uploads/2016/09/pie.png
Fraudulent Digital Certificates
- https://technet.microsoft.com/en-us/library/security/2607712.aspx
> https://www.fdic.gov/news/news/financial/2004/fil2704a.html
:fear::fear: :mad:
AplusWebMaster
2016-01-09, 20:16
FYI...
Russian ISP prevents Cisco from Shutting Down Cybercriminal Gang
- http://yro.slashdot.org/story/16/01/09/1422216/uncooperative-russian-isp-prevents-cisco-from-shutting-down-cybercriminal-gang
Jan 09, 2016 - "Cisco's Talos research team* has managed to identify and partially shut down a cyber-criminal group that is using the RIG exploit kit to infect users with spambots via a malvertising campaign**. Their investigation led them back to Russian ISP Eurobyte, who didn't bother answering critical emails and allowed the campaign to go on even today. In October 2015, Cisco's researchers also thwarted the activity of another group of cyber-criminals that made around $30 million from distributing ransomware."
* http://blog.talosintel.com/2016/01/rigging-compromise.html
Jan 7, 2016 - "... when a provider is notified of malicious activity it is their responsibility to at least acknowledge the abuse and work to validate and, if legitimate, take the system offline. Webzilla did just that in our experience, but Eurobyte has not. This lack of response led Talos to make the decision to blacklist large portions of the provider's network to ensure that our customers are protected since reporting the abuse alone is not enough."
** http://news.softpedia.com/news/uncooperative-russian-isp-prevents-cisco-from-shutting-down-cybercriminal-gang-498667.shtml
___
LLoyds bank - 'update to our mobile banking app' – Phish
- http://myonlinesecurity.co.uk/lloyds-bank-the-update-to-our-mobile-banking-app-phishing-scam/
9 Jan 2016 - "... Today’s example is an email received with a subject of 'UPDATE NOTIFICATION' pretending to come from Lloyds plc <info@ glc .com>. Mobile apps and mobile banking is the new big thing and banks are encouraging users to use mobile banking... This one wants your personal bank log-in details in order to steal all your money. Many of them are also designed to specifically steal your email, facebook and other social network log in details... The original email looks like this, It will NEVER be a genuine email from Your bank, or any other financial body so don’t ever follow the link or fill in the html (webpage) form that comes attached to the email... If you are unwise enough to follow the link which goes to http ://toxicwingsli .com/op.htm and then -redirects- you to http ://joelcomm .net/wp-content/l10yds/1e9644d8cb4d7dc77c5770ae1b84b3fa/ you see a webpage looking like the genuine Lloyds log in page, look carefully at the url in the top bar and you can see it isn’t Lloyds at all but a fake site:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/05/lloyds-bank-tax-refund-phish_webpage1.png
If you still haven’t realised that it is a phishing attempt and give them your username & password, you will be sent to the next page which asks for your memorable information. You then get bounced on to the genuine Lloyds Bank site..."
toxicwingsli .com: 166.62.118.179: https://www.virustotal.com/en/ip-address/166.62.118.179/information/
joelcomm .net: 23.235.226.77: https://www.virustotal.com/en/ip-address/23.235.226.77/information/
:fear::fear: :mad:
AplusWebMaster
2016-01-11, 13:05
FYI...
Fake 'latest invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-your-latest-invoice-from.html
11 Jan 2016 - "This -fake- financial spam does not come from UKFast but is instead a simple -forgery- with a malicious attachment.
From UKFast Accounts [accounts@ ukfast .co.uk]
Date Mon, 11 Jan 2016 11:00:10 +0300
Subject Your latest invoice from UKFast No.1228407
I am unable to determine what the body text is at the moment. In this case, the attachment was named Invoice-1228407.doc and has a VirusTotal detection rate of 3/54*. The Malwr report** shows that the malicious macro... downloads an executable from:
www .vmodal .mx/5fgbn/7tfr6kj.exe
This binary has a detection rate of 2/54***... This Malwr report[4] for the dropped file indicates network traffic to:
114.215.108.157 (Aliyun Computing Co, China)
I strongly recommend that you -block- traffic to that IP. The payload is the Dridex banking trojan."
* https://www.virustotal.com/en/file/0c75cdcb3d1425eadba7e73cc6684c9a4d77c9b013cb10625b6c0a7c928aa11b/analysis/1452505104/
** https://malwr.com/analysis/MTliNWQ5Nzc2ZjE5NGUzZmI5MDAzMzgxNGVmYzQyZDU/
185.21.134.14
114.215.108.157
13.107.4.50
*** https://www.virustotal.com/en/file/fa6d07f2801e3c5fdca7bc9bda8659f5ae2e47d7f993d912719ae8af8774cd0b/analysis/1452505941/
TCP connections
114.215.108.157: https://www.virustotal.com/en/ip-address/114.215.108.157/information/
8.253.82.158: https://www.virustotal.com/en/ip-address/8.253.82.158/information/
110.77.142.156: https://www.virustotal.com/en/ip-address/110.77.142.156/information/
4] https://malwr.com/analysis/NTYzMjk4ZjlmOGUzNDFlNjliMjYwNTE4ZWQ1NTA2Mzg/
- http://myonlinesecurity.co.uk/your-latest-invoice-from-ukfast-no-1228407-word-doc-or-excel-xls-spreadsheet-malware/
11 Jan 2016 - "An email with the subject of 'Your latest invoice from UKFast No.1228407' pretending to come from UKFast Accounts <accounts@ ukfast .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: UKFast Accounts <accounts@ukfast.co.uk>
Date: Mon 11/01/2016 09:00
Subject: Your latest invoice from UKFast No.1228407
Hi,
Thank you for choosing UKFast. Please find attached your latest invoice. You can also download it.
As you have chosen to pay by Direct Debit there’s nothing more you need to do, payment will be taken on or after the date stated on your invoice.
Should you have any queries relating to this invoice please raise an invoice query from within MyUKFast. Alternatively you can contact us on 0845 458 3535.
Remember you can view all your invoices, set who should receive these alerts and much more all via MyUKFast.
Kind Regards ...
11 January 2016: Invoice-1228407.doc - Current Virus total detections 3/54*
downloads Dridex banking malware from http ://www .vmodal .mx/5fgbn/7tfr6kj.exe (VirusTotal 1/55**)
... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0c75cdcb3d1425eadba7e73cc6684c9a4d77c9b013cb10625b6c0a7c928aa11b/analysis/1452505104/
** https://www.virustotal.com/en/file/fa6d07f2801e3c5fdca7bc9bda8659f5ae2e47d7f993d912719ae8af8774cd0b/analysis/1452507654/
TCP connections
114.215.108.157: https://www.virustotal.com/en/ip-address/114.215.108.157/information/
8.253.82.158: https://www.virustotal.com/en/ip-address/8.253.82.158/information/
110.77.142.156: https://www.virustotal.com/en/ip-address/110.77.142.156/information/
___
Fake 'E-Service' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-e-service-europe-ltd.html
11 Jan 2016 - "This -fake- financial spam does not come from E-Service (Europe) Ltd but is instead a simple -forgery- with a malicious attachment:
From Andrew Williams [andrew.williams@ eurocoin .co.uk]
Date Mon, 11 Jan 2016 17:07:38 +0700
Subject E-Service (Europe) Ltd Invoice No: 10013405
Dear Customer,
Please find your invoice attached from E-Service (Europe) Ltd. We kindly ask you
to make payment for all transactions on or before their due date.
Please contact E-Service (Europe) if you have any issues or queries preventing your
prompt payment ...
E-Service have been exceptionally quick about posting an update on their Twitter page*.
* https://twitter.com/EServiceUK/status/686496655831625728
However, they have -not- been hacked at all as it is trivially easy to forge an email message. The attachment is a malicious Excel spreadsheet which leads to the Dridex banking trojan. So far, I have seen -five- different versions of the attachment, all named Invoice 10013405.XLS ... The Malwr reports for the attachment... show that the macro in the spreadsheet downloads a file from the following locations:
arellano .biz/5fgbn/7tfr6kj.exe
pastorsschoolinternational .org/5fgbn/7tfr6kj.exe
www.c0-qadevtest .net/5fgbn/7tfr6kj.exe
This dropped file has a detection rate of 1/55**. It is the -same- binary as found in this earlier spam run*** which phones home to:
114.215.108.157 (Aliyun Computing Co, China)
This is an IP that I strongly recommend blocking..."
** https://www.virustotal.com/en/file/fa6d07f2801e3c5fdca7bc9bda8659f5ae2e47d7f993d912719ae8af8774cd0b/analysis/1452509215/
TCP connections
114.215.108.157
8.253.82.158
110.77.142.156
*** http://blog.dynamoo.com/2016/01/malware-spam-your-latest-invoice-from.html
- http://myonlinesecurity.co.uk/e-service-europe-ltd-invoice-no-10013405-word-doc-or-excel-xls-spreadsheet-malware/
11 Jan 2016 - "An email with the subject of 'E-Service (Europe) Ltd Invoice No: 10013405' pretending to come from with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Andrew Williams <andrew.williams@ eurocoin .co.uk>
Date: Mon 11/01/2016 10:22
Subject: E-Service (Europe) Ltd Invoice No: 10013405
Dear Customer,
Please find your invoice attached from E-Service (Europe) Ltd. We kindly ask you to make payment for all transactions on or before their due date.
Please contact E-Service (Europe) if you have any issues or queries preventing your prompt payment...
11 January 2016: loInvoice 10013405.XLS - Current Virus total detections 7/54*
Downloads from http ://arellano .biz/5fgbn/7tfr6kj.exe which the -same- Dridex banking malware as described in this slightly earlier post**..."
* https://www.virustotal.com/en/file/181b9f2edd20e398c42ee86afe8158d3552302031a3c57777b58c934012bb5fd/analysis/1452509257/
** http://myonlinesecurity.co.uk/your-latest-invoice-from-ukfast-no-1228407-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Kaseya Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-kaseya-invoice-1ed0c068.html
11 Jan 2016 - "This -fake- financial email has a malicious attachment:
From: Terry Cherry
Date: 11 January 2016 at 10:48
Subject: Kaseya Invoice - 1ED0C068
Dear Accounts Payable,
Thank you for your purchase of Kaseya Licenses. Attached please find our invoice for your purchase under the K2 Software Catalog.
Our bank details for wire transfer are included on the attached invoice.
Should you wish to submit payment via credit card, please contact our customer service department (billing-cs@ kaseya .com) for assistance with adding card details through our portal.
Please do not hesitate to let us know if you have any questions.
Thanks again for your patronage.
Sincerely,
Terry Cherry
Kaseya Customer Invoicing ...
The sender's name, references and attachments may vary. This appears to be a spam from Dridex 120, and it is a characteristic that there is a very-large-number-of-variants of the attachments. In this case, I analysed three different attachments with detection rate of about 2/55 [1].. and which according to these Malwr reports [4].. downloads a binary from the following locations:
5.189.216.10 /montana/login.php
77.246.159.154 /montana/login.php
109.234.39.40 /montana/login.php
All of these IPs should be considered to be malicious:
5.189.216.10 (LLHost Inc, Netherlands)
77.246.159.154 (JSC Server, Russia)
109.234.39.40 (McHost.ru, Russia)
A binary named trap.exe ... a detection rate of 5/54[7] is downloaded. According to this Malwr report[8] the executable phones home to:
78.47.119.93 (Hetzner, Germany)
The payload is the Dridex banking trojan.
Recommended blocklist:
78.47.119.93
5.189.216.10
77.246.159.154
109.234.39.0/24 "
1] https://www.virustotal.com/en/file/e051bde40843f378cba92496ebd942cf0fbc98fcba4b1c0dfdb98659a65e5f70/analysis/1452510008/
4] https://malwr.com/analysis/MjY3NDlmNmM0NzIyNGRhNmEzYWFlOTdkM2UwM2FjY2M/
7] https://www.virustotal.com/en/file/943502daf8a5bef46c8eb6a4b780e52014fed8efdf382e6a619cf40d3f8dbb20/analysis/1452510360/
8] https://malwr.com/analysis/NTA1YzViMzVhNTEwNGZhYjhkYzczMmNmNWU4ZjQyOWM/
- http://myonlinesecurity.co.uk/kaseya-invoice-dd5a9977-word-doc-or-excel-xls-spreadsheet-malware/
11 Jan 2016 - "An email with the subject of 'Kaseya Invoice – DD5A9977' pretending to come from random names, companies and random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Alvin Fry <FryAlvin59518@ attrazioneviaggi .it>
Date: Mon 11/01/2016 11:00
Subject: Kaseya Invoice – DD5A9977
Dear Accounts Payable,
Thank you for your purchase of Kaseya Licenses. Attached please find our invoice for your purchase under the K2 Software Catalog.
Our bank details for wire transfer are included on the attached invoice.
Should you wish to submit payment via credit card, please contact our customer service department (billing-cs@ kaseya .com) for assistance with adding card details through our portal.
Please do not hesitate to let us know if you have any questions.
Thanks again for your patronage...
11 January 2016: Invoice-19071543.doc - Current Virus total detections 2/55*
downloads the -same- Dridex banking malware form the same locations as described in THIS post**..."
* https://www.virustotal.com/en/file/8ee76c23e1b824df6ae40bc7f1b9ae5a464255fc8873385d879665436755b06c/analysis/1452515923/
** http://myonlinesecurity.co.uk/invoice-11jan15-61828018-gb-word-doc-or-excel-xls-spreadsheet-malware/
___
Fake 'Invoice-11JAN15' SPAM - leads to malware
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-11jan15-53771728-gb.html
11 Jan 2016 - "This rather generic looking spam email leads to malware:
From: Raleigh Frazier [FrazierRaleigh8523@ amnet .net.au]
Date: 11 January 2016 at 11:20
Subject: Invoice-11JAN15-53771728-GB
Dear Customer,
Please find attached Invoice 53771728 for your attention.
Should you have any Invoice related queries please do not hesitate to
contact either your designated Credit Controller or the Main Credit Dept. on
02051 2651180.
For Pricing or other general enquiries please contact your local Sales Team.
Yours Faithfully,
Credit Dept'
The name of the sender, references and attachment name varies. There are at least -three- different variations of the attachment, probably more. Detection rates are approximately 2/55*... and these Malwr reports [4].. indicate that the behaviour is very similar to the one found in this spam run**."
* https://www.virustotal.com/en/file/d8f1f700036dc50f3c10dae8fe4552d4f200fbe586827d5d4d1fd3fda8dc5665/analysis/1452511471/
4] https://malwr.com/analysis/YjA0MjRlM2E4YzQ4NGYzZWExNGNmMjgyMmIxZDBiODc/
** http://blog.dynamoo.com/2016/01/malware-spam-kaseya-invoice-1ed0c068.html
:fear::fear: :mad:
AplusWebMaster
2016-01-12, 13:11
FYI...
Fake 'Lattitude Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-lattitude-global.html
12 Jan 2016 - "This -fake- financial spam comes from random senders and with different reference details. It does not come from Lattitude Global Volunteering but is instead a simple -forgery- with a malicious attachment.
From: Darius Green
Date: 12 January 2016 at 09:33
Subject: Lattitude Global Volunteering - Invoice - 3FAAB65
Dear customer,
Please find attached a copy of your final invoice for your placement in Canada.
This invoice needs to be paid by the 18th January 2016.
Due to recent increases on credit card charges, we prefer that you make a payment for your invoice on a bank transfer our bank details are.
You must provie your invoice number or account reference when you make the payment in order for us to allocate the payment to your account.
Account Name: Lattitude Global Volunteering
Bank: Barclays Bank
Sort Code: 20-71-03
Account No. 20047376
IBAN: GB13BARC20710320047376
SWIFBIC: BARCGB22
Kind regards
Luis Robayo
Accounts Department
Lattitude Global Volunteering ...
I have personally only seen two samples so far with detection rates of 2/55 [1] [2]. These two Malwr reports [3] [4] plus some private sources indicate that the attachments download from the following locations:
31.131.20.217/shifaki/indentification.php
185.125.32.39/shifaki/indentification.php
5.34.183.41/shifaki/indentification.php
5.149.254.84/shifaki/indentification.php
This is characteristic of spam sent by the Dridex 120 botnet. All the IPs can be considered to be -malicious- and should be blocked.
31.131.20.217 (PE Skurykhin Mukola Volodumurovuch, Ukraine)
185.125.32.39 (Sembol Internet Hizmetleri ve Dis Ticaret Ltd, Turkey)
5.34.183.41 (ITL Company, Ukraine)
5.149.254.84 (Fortunix Networks, Netherlands)
A file kfc.exe is dropped onto the target system which has a detection rate of 6/52*... Those previous Malwr reports indicate that it phones home to a familiar IP of:
78.47.119.93 (Hetzner, Germany)
Recommended blocklist:
78.47.119.93
31.131.20.217
185.125.32.39
5.34.183.41
5.149.254.84 "
1] https://www.virustotal.com/en/file/94c66221fb77ffadfb467b31c13c68547d3986ceebdf2cfc2e4128dc9f8a5055/analysis/1452594409/
2] https://www.virustotal.com/en/file/192b9a75350118b42a59a1fb8cea4b01d2c76b6d913c7fbd69621262b924bf76/analysis/1452594427/
3] https://malwr.com/analysis/YzM3NTc3MjFlMWQ0NDUyMzkyZDQ2YThhZmQyMDYxMjM/
4] https://malwr.com/analysis/MzdjNGRjNmE0OTRiNGU1YTlmOGYwNTMxM2Q2NjM3ZjM/
* https://www.virustotal.com/en/file/9e3533df3199b8c0026c54f889bc62f686e65e737ea088d792ac290d157cd9a8/analysis/1452595124/
- http://myonlinesecurity.co.uk/lattitude-global-volunteering-invoice-af6643a-luis-robayo-word-doc-or-excel-xls-spreadsheet-malware/
12 Jan 2016 - "An email with the subject of 'Lattitude Global Volunteering – Invoice – AF6643A' (random numbers) pretending to come from random names, companies and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
12 January 2016: Invoice – AF6643A.doc - Current Virus total detections 2/54*
MALWR analysis** shows it downloads Dridex banking malware from http :// 5.149.254.84/shifaki/indentification.php named as 120CR.exe Which looks suspiciously familiar from recent days (VirusTotal 6/54***)..."
* https://www.virustotal.com/en/file/341d584ed0bd96f37f1d44033f8bbeb8b06ec6209dd601d20e6c5942da0925c0/analysis/1452591731/
** https://malwr.com/analysis/ZTFjNWI2ZjU1NDJmNGI3YThjYzdjYWE5MDRkZDE0MGU/
5.149.254.84
78.47.119.93
*** https://www.virustotal.com/en/file/9e3533df3199b8c0026c54f889bc62f686e65e737ea088d792ac290d157cd9a8/analysis/1452592072/
___
Fake 'payment' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/mgu-transaction-ai-transaction-vl-payment-aj-transfer-word-doc-or-excel-xls-spreadsheet-malware/
12 Jan 2016 - "An email with the subject on the -theme- of payment, transaction, Transfer coming from random email addresses and random people with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... These malicious word docs appear to based on the Black Energy dropper described HERE:
> https://isc.sans.edu/forums/diary/BlackEnergy+XLS+Dropper/20601/
The email looks like:
From: Random senders like Hermione Acevedo <info@ gistparrot .com> or Avye Brown <werbeteam@ gmx .de>
Date: Tue 12/01/2016 06:02
Subject: Random subjects like Fwd: MGU Transaction, AI Transaction, VL Payment, AJ Transfer
Good morning
Please find the receipt attached to this message. The Transaction will be posted on your account in two days.
Regards
Hermione Acevedo
-Or-
Good Day
Please check the invoice enclosed with this message. The Transaction will be posted on your bank within 1-2 days.
Best regards
Avye Brown
12 January 2016: 51U5P05W22P34.doc - Current Virus total detections 1/54*
ReverseIT analysis**. These are very -different- to previous macro word docs. This one contacts
crechemploi .be/wpl.jpg?ICpz8scC0AI=35 (VirusTotal 0/54***) and downloads an -image- file wpl.jpg which is extremely large 245kb for a small image. It looks like it has embedded -malware- inside it which in this example is named 3088239.exe (VirusTotal 2/55[4])... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a41de1df39801027357e92f37395d95efe8b80d710e605bdaf653d2a637b331d/analysis/1452581898/
** https://www.reverse.it/sample/fa7bcfcf2091d153ab1c38468b24eb153c363906747c76aff28648b9eef1aa69?environmentId=1
195.154.231.179: https://www.virustotal.com/en/ip-address/195.154.231.179/information/
104.224.128.163: https://www.virustotal.com/en/ip-address/104.224.128.163/information/
*** https://www.virustotal.com/en/file/9ebc9781a78bd6069d4ae75cc12597c8977450abb8b816843242457a5b37b673/analysis/1452584610/
4] https://www.virustotal.com/en/file/a2dc8bc955d115ca439e0648a8255a424079f85cac298d636d34596ee5a294ca/analysis/1452585387/
crechemploi .be: 195.154.231.179: https://www.virustotal.com/en/ip-address/195.154.231.179/information/
___
Fake 'Payment Advice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-payment-advice-0002014343.html
12 Jan 2016 - "This -fake- financial spam is not from Wipro but is instead a simple -forgery- with a malicious attachment.
From: Bhavani Gullolla [bhavani.gullolla1@ wipro .com]
Date: 12 January 2016 at 09:51
Subject: Payment Advice - 0002014343
Dear Sir/Madam,
This is to inform you that we have initiated the electronic payment through our Bank.
Please find attached payment advice which includes invoice reference and TDS deductions if any.
Transaction Reference :
Vendor Code :9189171523
Company Code :WT01
Payer/Remitters Reference No :63104335
Beneficiary Details :43668548/090666
Paymet Method : Electronic Fund Transfer
Payment Amount :1032.00
Currency :GBP
Processing Date :11/01/2016 ...
The attachment is randomly-named in the format 9705977867.doc which I have seen in two different versions with detection rates of 5/54 [1] [2], and according to the Malwr reports [3] [4] they both download a -malicious- binary from:
hotpointrepair .info/u5y4g3/76u54g.exe
This download location is characteristic of the Dridex 220 botnet. The downloaded binary has a detection rate of 4/55* and this Malwr report** shows network traffic to:
199.231.189.9 (Interserver Inc, US)
I strongly recommend that you -block- this IP address..."
1] https://www.virustotal.com/en/file/ed2a2813c4d64ae740ccee7b665d3c1756c4426ff0f04f54d9945fa7b5125a7b/analysis/1452596943/
2] https://www.virustotal.com/en/file/a887e50a3a598782b26f62bc67fb4a35b2de3be2ca21ac54946a7840cf79068d/analysis/1452596954/
3] https://malwr.com/analysis/NWFkMjdkMDZhNmJjNDQ3NjhhZGNjMzA0NWIwOGJlZDg/
66.147.242.93
199.231.189.9
8.254.249.78
4] https://malwr.com/analysis/MTRjMDQ4OGM2MWM3NGIxMTgxYzFkNmY2OGExYWVmZjk/
66.147.242.93
199.231.189.9
184.28.188.195
* https://www.virustotal.com/en/file/de3e1e28e00de566ae30de5a114404d4e06829a438b97a996f068b076e04ea3b/analysis/1452597607/
** https://malwr.com/analysis/MjMyMzQ1MDA3ODQ2NDc0OGExNjFjNzNhOWM3MmZlMDU/
199.231.189.9
13.107.4.50
hotpointrepair .info: 66.147.242.93: https://www.virustotal.com/en/ip-address/66.147.242.93/information/
> https://www.virustotal.com/en/url/dd4a8a5db505dd6bf2f6e7a9240acccbd0ad7bccbb239984e787dd7493b611b3/analysis/
___
Fake 'Sales Invoice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/sales-invoice-sin040281-from-charbonnel-et-walker-limited-corinne-young-word-doc-or-excel-xls-spreadsheet-malware/
12 Jan 2016 - "An email with the subject of 'Sales Invoice SIN040281 from Charbonnel et Walker Limited' pretending to come from Corinne Young <corinne.young@ charbonnel .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Sales-Invoice-SIN040281-From-Charbonnel-et-Walker-Limited-1024x464.png
12 January 2016: SIN040281.DOC - Current Virus total detections 4/55*
Downloads Dridex banking malware from http ://hotpointrepair .info/u5y4g3/76u54g.exe (VirusTotal 1/55**)
-same- Dridex malware as other malspam runs. Note: Dridex updates frequently during the day, so you might get a different malware version... DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/08/protected-view-macros_21-1024x412.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f70be755410ab5cb13a7549074154ee73e2b20de6c28c17348ace8b49e4ad21f/analysis/1452601210/
** https://www.virustotal.com/en/file/05211a1043db3316680432f3c7bc84e7748f4731f54014eb4cf41c05db2d93c2/analysis/1452599104/
TCP connections
199.231.189.9: https://www.virustotal.com/en/ip-address/199.231.189.9/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
hotpointrepair .info: 66.147.242.93: https://www.virustotal.com/en/ip-address/66.147.242.93/information/
> https://www.virustotal.com/en/url/dd4a8a5db505dd6bf2f6e7a9240acccbd0ad7bccbb239984e787dd7493b611b3/analysis/
___
'LloydsLink online website changes' - PHISH
- http://myonlinesecurity.co.uk/lloydslink-online-website-changes-phishing/
12 Jan 2016 - "... Today’s example is an email received with a subject of 'LloydsLink online website changes' pretending to come from LloydsLink online <Hugo.Batzold@ lloydslink.online .lloydsbank .com>.
We have been seeing these sort of emails for -numerous- banks recently... Note the 0 instead of the o in the second Lloyds. you see a webpage looking identical to the genuine Lloydslink log-in page, look carefully at the url in the top bar and you can see it isn’t Lloyds at all but a -fake- site:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/lloydslink_phishing_scam-1024x365.png
If you still haven’t realised that it is a phishing attempt and give them your username & password, you will then get bounced on to the -genuine- Lloyds Bank site:
> https://lloydslink.online.lloydsbank.com/Logon/Logon.xhtml
... and think that you just didn’t enter details correctly or mistyped a digit and need to re-enter them and won’t even pay any attention, until you get the dreaded letter or phone call saying someone has emptied your bank account. All of these emails use Social engineering tricks to persuade you to follow the links or open the attachments that come with the email..."
___
Ransom32 – the malicious package
- https://blog.malwarebytes.org/intelligence/2016/01/ransom32-look-at-the-malicious-package/
Jan 11, 2016 - "Ransom32 is a new ransomware implemented in a very atypical style. Emisoft provides a good description of its functionality here:
> http://blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/
... we will focus on some implementation details of the malicious package. Ransom32 is delivered as an executable, that is in reality a autoextracting WinRAR archive. By default it is distributed as a file with .scr extension:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/ransom32_scr.png
The WinRAR script is used to drop files in the specified place and autorun the unpacked content... Installation directory created in %TEMP%... The unpacked content consist of following files:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/ransom32_content.png
chrome.exe spoofs Google’s browser, but in reality it is an element responsible for preparing and running the Node JS application (that is the -main- part of the ransomware). After the chrome.exe is run from the %TEMP% folder, it installs the above files into %APPDATA% -in folder Chrome Browser:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/installed.png
... After encrypting the files, the ransom nag-window is displayed. The gui is generated by javascript, with the layout defined by the included CSS:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/ransom32_screen.png
The internet connection is operated via included Tor client – renamed to rundll32.exe ...
Conclusion: In the past, malware authors cared mostly about small size of their applications – that’s why early viruses were written in assembler. Nowadays, technologies used and goals have changed. The most important consideration is not the size, but the ability to imitate legitimate applications, for the purpose of avoiding detection. Authors of Ransom32 went really far in this direction. Their package is huge in comparison to typical samples. It consists of various elements, including legitimate applications – i.e the tor client (renamed to rundll32.exe). The technology that they have chosen for the core – Node JS – is a complete change of direction from the malware written in low-level languages. However, compiled Java Script (although it works about 30 percent slower than not compiled) is not very popular and there is lack of tools to analyze it – which makes it a good point for malware authors, who gain some level of code protection..."
(More detail at the malwarebytes URL at the top.)
:fear::fear: :mad:
AplusWebMaster
2016-01-13, 12:05
FYI...
MS account security info verification – Phish
- http://myonlinesecurity.co.uk/microsoft-account-security-info-verification-phishing/
13 Jan 2016 - "... phishing attempts against Microsoft office and outlook accounts. This one starts with an email with the subject 'Microsoft account security info verification' pretending to come from Microsoft <security-noreply@ account .microsoft .com> . One of the major common subjects in this sort of phishing attempt is 'Your password will expire soon' or 'update your email' or something very similar. This one wants only wants your email / Microsoft account log in details...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Microsoft-account-security-info-verification-1024x550.png
The link behind the 'Upgrade Now' is http ://tenga .my/wp-content/outnew/index.php?email=victim@doamain.com. If you are unwise enough to follow the link you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/12/fake-microsoft365-log-in-1024x542.png
... which is a very good imitation of a genuine Microsoft 365 log on page. If you do fill in the email and password, you immediately get sent to the genuine Office 365 log on page and you just think that you might have entered the email or password incorrectly and do it again. All of these emails use Social engineering tricks to persuade you to follow links or open the attachments that come with the email..."
tenga .my: 181.224.159.177: https://www.virustotal.com/en/ip-address/181.224.159.177/information/
> https://www.virustotal.com/en/domain/tenga.my/information/
___
Fake 'Scanned Document' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/scanned-document-mrh-solicitors-word-doc-or-excel-xls-spreadsheet-malware/
13 Jan 2016 - "An email with the subject of 'Scanned Document MRH Solicitors' pretending to come from Color @ MRH Solicitors <color93@ yahoo .co.uk> (random color numbers) with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Color @ MRH Solicitors <color93@ yahoo .co.uk>
Date: Wed 13/01/2016 08:26
Subject: Scanned Document
Find the attachment for the scanned Document
13 January 2016: ScannedDocs122151.xls - Current Virus total detections 7/54*
Downloads Dridex banking malware from http ://armandosofsalem .com/l9k7hg4/b4387kfd.exe (VirusTotal 3/56**)...
DO NOT follow the advice they give to enable macros or enable editing to see the content. Most of these malicious word documents either appear to be totally blank or look something like these images when opened in protected view mode, which should be the default in Office 2010, 2013, 2016 and 365:
> http://myonlinesecurity.co.uk/?attachment_id=5895
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/44a43187f34fb80c70cd32f735b4884e35b8468ec539253cc985c50955a8a9e0/analysis/1452675230/
** https://www.virustotal.com/en/file/e0b89421d82e4ba8ba4dc5c29a6415830288be9c87380af7fa79ff8c1ecc34e8/analysis/1452675552/
armandosofsalem .com: 192.254.189.167: https://www.virustotal.com/en/ip-address/192.254.189.167/information/
- http://blog.dynamoo.com/2016/01/malware-spam-scanned-document-color-mrh.html
13 Jan 2016 - "... The Hybrid Analysis* of the dropped binary shows attempted network traffic to the following domains:
exotelyxal .com
akexadyzyt .com
ekozylazal .com
These are hosted on an IP worth blocking:
158.255.6.128 (Mir Telematiki Ltd, Russia)"
* https://www.hybrid-analysis.com/sample/e0b89421d82e4ba8ba4dc5c29a6415830288be9c87380af7fa79ff8c1ecc34e8?environmentId=4
b4387kfd.exe
___
Fake 'Order' SPAM - doc malware
- http://myonlinesecurity.co.uk/order-0046033777-ref-markethill-church-john-russell-yesss-co-uk-word-doc-malware/
13 Jan 2016 - "An email with the subject of 'Order 0046/033777 [Ref. MARKETHILL CHURCH]' pretending to come from JOHN RUSSELL <John.Russell@ yesss .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Order-0046033777-Ref-MARKETHILL-CHURCH-1024x966.png
13 January 2016: Order 0046_033777 [Ref. MARKETHILL CHURCH].doc - Current Virus total detections 6/55*
MALWR** shows a download from http ://amyzingbooks .com/l9k7hg4/b4387kfd.exe which will be a Dridex banking malware (VirusTotal 2/55***). This site was used in earlier Dridex downloads today but -different- versions were offered... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/68b2d16d7c676e23b04db0793609d1196a7d1223139c2f6e2286555a7caf3f0c/analysis/1452694400/
** https://malwr.com/submission/status/OWI1N2Y1NmRkMDk3NDlhZWI3MzliMmQ4YTdhOWY2NDA/
*** https://www.virustotal.com/en/file/37ccb1fc8c465f9ff028c172c2a424af61fd72322c91f9fe4c410225dec2c10d/analysis/1452695776/
TCP connections
85.25.200.103: https://www.virustotal.com/en/ip-address/85.25.200.103/information/
- http://blog.dynamoo.com/2016/01/malware-spam-order-0046033777-ref.html
13 Jan 2016 - "... This binary has a detection rate of 4/53*. The Hybrid Analysis** shows the malware phoning home to:
85.25.200.103 (PlusServer AG, Germany)
I recommend that you -block- traffic to that IP."
* https://www.virustotal.com/en/file/37ccb1fc8c465f9ff028c172c2a424af61fd72322c91f9fe4c410225dec2c10d/analysis/1452699929/
** https://www.hybrid-analysis.com/sample/37ccb1fc8c465f9ff028c172c2a424af61fd72322c91f9fe4c410225dec2c10d?environmentId=1
:fear::fear: :mad:
AplusWebMaster
2016-01-14, 13:23
FYI...
Fake 'scanner' SPAM - doc malware
- http://myonlinesecurity.co.uk/message-from-local-network-scanner-jpaoscanner-at-your-own-email-domain-word-doc-malware/
14 Jan 2016 - "An empty or blank email with the subject of 'Message from local network scanner' pretending to come from jpaoscanner at your own email domain with a malicious word doc attachment is another one from the current bot runs... The attachment to these are named Scann16011310150.docf . Note the F after the doc which effectively makes them useless because windows doesn’t know what to do with them and asks you. They will open in Word, if you tell them to, and do contain a malicious macro that will infect you.
Update: a second batch a few minutes after the first run now has a proper word doc attachment, although the body is still -blank- . The email looks like:
From: jpaoscanner@ ....co.uk
Date:Thu 14/01/2016 10:52
Subject: Message from local network scanner
Body content: EMPTY
12 January 2016: Scann16011310150.docf - Current Virus total detections 2/53*
downloads Dridex banking malware from 199.59.58.162 :80 /~admin1/786h5g4/9787g4fr4.exe (VirusTotal 3/56**)
(reverseIT***)
12 January 2016: Scann16011310150.doc - Current Virus total detections 3/54[4]
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/ecacd3a97c4e59783185934db7bfa2bfd51815c4180792de04bc227c9c30725d/analysis/1452768488/
** https://www.virustotal.com/en/file/944fe9e3e332c9399ce3954e4f00864552bf8b43f83f06dfa8b670529eaa0bc6/analysis/1452770219/
*** https://www.reverse.it/sample/ecacd3a97c4e59783185934db7bfa2bfd51815c4180792de04bc227c9c30725d?environmentId=1
Contacted Hosts:
199.59.58.162: https://www.virustotal.com/en/ip-address/199.59.58.162/information/
188.138.88.14: https://www.virustotal.com/en/ip-address/188.138.88.14/information/
4] https://www.virustotal.com/en/file/15d2d0d9622cf7f3d070d2c19d7d94e64f5c642771ed9a93fc59859e48a9f832/analysis/1452769443/
- http://blog.dynamoo.com/2016/01/malware-spam-message-from-local-network.html
14 Jan 2016 - "This -fake- document scan comes with a malicious attachment.
From: jpaoscanner@ victimdomain .tld
Date: 14 January 2016 at 10:45
Subject: Message from local network scanner
There is no body text, and the email appears to come from within the victim's own domain, but this is just a simple forgery. Attached is a file Scann16011310150.docf which comes in at least -five- different versions...
Hybrid Analysis shows one of the samples in action, downloading a binary from:
www .willsweb .talktalk .net/786h5g4/9787g4fr4.exe
This has a detection rate of 3/55*. That same analysis reports that it phones home to:
188.138.88.14 (PlusServer AG, France)...I strongly recommend that you -block- traffic to that IP..."
* https://www.virustotal.com/en/file/944fe9e3e332c9399ce3954e4f00864552bf8b43f83f06dfa8b670529eaa0bc6/analysis/1452771350/
TCP connections
188.138.88.14: https://www.virustotal.com/en/ip-address/188.138.88.14/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
___
800 risk experts from 40 countries identify the top global business risks
- http://net-security.org/secworld.php?id=19327
14 Jan 2016
> http://www.net-security.org/images/articles/agcs-012016-1.jpg
>> http://www.net-security.org/images/articles/agcs-012016-2.jpg
___
Evil network: 46.30.40.0/21...
- http://blog.dynamoo.com/2016/01/evil-network-463040021-eurobyte-llc-and.html
13 Jan 2016 23:23 - "... From looking around, it seemed that whoever Eurobyte rented servers to had an unhealthy interest in CryptoWall and the Angler EK. Eurobyte is a Russian hosting company, which in turn is a customer of Webzilla in the Netherlands... there are -thousands- of subdomains hosted in the 46.30.40.0/21 range, where the main domain (e.g. www) is hosted in a completely -different- location. The subdomains are then used to host malware such as the Angler Exploit Kit... What appears to be going on here is a domain shadowing attack on a massive scale[1], primarily leading victims to exploit kits. There do appear to be some genuine Russian-language sites hosted in this block. But if you don't tend to send visitors to Russian sites, I would very strongly recommend -blocking- 46.30.40.0/21 from your network... The attack is known sometimes as 'domain shadowing'... While researching this topic, I discovered that Talos had done some similar work* which also pointed a finger at Eurobyte and their very lax control over their network."
* http://blog.talosintel.com/2016/01/rigging-compromise.html
Jan 7, 2016 - "... when a provider is notified of -malicious- activity it is their responsibility to at least acknowledge the abuse and work to validate and, if legitimate, take the system offline. Webzilla did just that in our experience, but Eurobyte has not. This lack of response lead Talos to make the decision to blacklist large portions of the provider's network to ensure that our customers are protected since reporting the abuse alone is not enough."
1] http://blogs.cisco.com/security/talos/angler-domain-shadowing#shadowing
:fear::fear: :mad:
AplusWebMaster
2016-01-15, 14:58
FYI...
Fake 'order #7738326' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-your-order-7738326-from.html
15 Jan 2016 - "This -fake- financial spam does not come from The Safety Supply Company but is instead a simple -forgery- with a malicious attachment:
From: Orders - TSSC [Orders@ thesafetysupplycompany .co.uk]
Date: 15 January 2016 at 09:06
Subject: Your order #7738326 From The Safety Supply Company
Dear Customerl
Thank you for your recent purchase.
Please find the details of your order through The Safety Supply Company attached to this email.
Regards,
The Sales Team
So far I have seen just a single sample, with an attachment Order.doc which has a VirusTotal detection rate of 4/55*... likely to be the Dridex banking trojan. This Hybrid Analysis** on the first sample shows it downloading from:
149.156.208.41 /~s159928/786585d/08g7g6r56r.exe
That download IP belongs to Academic Computer Centre CYFRONET AGH, Poland. This executable also seems to commicate with:
216.117.130.191 (Advanced Internet Technologies Inc., US)
41.38.18.230 (TE Data, Egypt)
5.9.37.137 (Hetzner, Germany)
I have now seen another version of the DOC file [VT 4/54***] which has similar characteristics[4]... This related spam run gives some additional download locations:
nasha-pasika .lviv .ua/786585d/08g7g6r56r.exe
arm .tv/786585d/08g7g6r56r.exe
Sources also tell me that there is one at:
204.197.242.166 /~topbun1/786585d/08g7g6r56r.exe
Recommended blocklist:
88.208.35.71
216.117.130.191
116.12.92.107
46.32.243.144
195.96.228.199
161.53.144.25
41.38.18.230
204.197.242.166
149.156.208.41 "
* https://www.virustotal.com/en/file/6fe8531afeb6d5e668700044ef7ab172d55ceaee189c2ac7115f5e377e854996/analysis/1452849120/
** https://www.hybrid-analysis.com/sample/6fe8531afeb6d5e668700044ef7ab172d55ceaee189c2ac7115f5e377e854996?environmentId=1
*** https://www.virustotal.com/en/file/b6096978373629c2bd7d3bd53ca2fd3cf7edc5283247532acc550f1fb9e73a5d/analysis/1452849706/
4] https://www.hybrid-analysis.com/sample/b6096978373629c2bd7d3bd53ca2fd3cf7edc5283247532acc550f1fb9e73a5d?environmentId=1
- http://myonlinesecurity.co.uk/your-order-7738326-from-the-safety-supply-company-word-doc-or-excel-xls-spreadsheet-malware/
15 Jan 2016 - "An email with the subject of 'Your order #7738326 From The Safety Supply Company' pretending to come from 'Orders – TSSC <Orders@ thesafetysupplycompany .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Orders – TSSC <Orders@ thesafetysupplycompany .co.uk>
Date: Fri 15/01/2016 09:20
Subject: Your order #7738326 From The Safety Supply Company
Dear Customerl
Thank you for your recent purchase.
Please find the details of your order through The Safety Supply Company attached to this email.
Regards,
The Sales Team
15 January 2016: Order.doc - Current Virus total detections 4/54*
downloads Dridex banking malware from 149.156.208.41 /~s159928/786585d/08g7g6r56r.exe (VirusTotal 2/53**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e3c044115cc1318f4998680702eb7921ae3df444e0a6c2df528a83848b1c9de0/analysis/1452851905/
** https://www.virustotal.com/en/file/2d198392e831739f7f76ade37c08e66bd9f55e6e6fcc97f60c1a11ce8eef4988/analysis/1452851228/
___
SPAM with damaged or broken office doc or XLS attachments
- http://myonlinesecurity.co.uk/kelly-pollard-carecorner-co-uk-statement-damaged-or-broken-office-doc-or-xls-attachment/
15 Jan 2016 - "The Dridex bots are still not having a good day today. The -3rd- malformed/damaged/broken malspam is an email with the subject of 'Statement pretending to come from Kelly Pollard <kelly.pollard@ carecorner .co.uk> with a -damaged- attachment that is supposed to be a malicious word doc or XLS spreadsheet attachment... Some malformed or misconfigured email servers might attempt to fix the broken email and actually deliver a working copy.
The damaged/broken attachment has a name something like Statement 012016.doc
Downloading this one from quarantine on my server gives what looks like a genuine word doc, unlike the earlier ones. VirusTotal Detections 7/55* which will attempt to download Dridex banking malware... (waiting for analysis) please check back later..."
* https://www.virustotal.com/en/file/69cc8a270f66c6a25b54dce950d93694c627e01c2b912c5122b03fd38b28199a/analysis/1452864034/
Statement 012016.doc
- http://blog.dynamoo.com/2016/01/malware-spam-fail-statement-kelly.html
15 Jan 2016 - "This fake financial spam is meant to have a malicious attachment, but it is corrupt:
From Kelly Pollard [kelly.pollard@ carecorner .co.uk]
Date Fri, 15 Jan 2016 13:56:01 +0200
Subject Statement
Your report is attached in DOC format.
Kelly Pollard
Marketing Manager ...
The attachment is named Statement 012016.doc but due to an error in the email it is corrupt, and is either zero length or will produce garbage. If it were to work, it would produce a payload similar to that found here* and here**, namely the Dridex banking trojan. This is the -third- corrupt Dridex run today..."
* http://blog.dynamoo.com/2016/01/malware-spam-scanned-image-from-mx.html
15 Jan 2015
** http://blog.dynamoo.com/2016/01/malware-spam-fail-reservation.html
15 Jan 2015
:fear::fear: :mad:
AplusWebMaster
2016-01-18, 14:09
FYI...
Fake 'Invoice January' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-fail-invoice-january-baird.html
18 Jan 2016 - "This -fake- financial spam does not come from J. Thomson Colour Printers but is instead a simple -forgery- with a malicious attachment.
From "A . Baird" [ABaird@ jtcp .co.uk]
Date Mon, 18 Jan 2016 16:17:20 +0530
Subject Invoice January
Hi,
We have been paid for much later invoices but still have the attached invoice as
outstanding.
Can you please confirm it is on your system and not under query.
Regards
Alastair Baird
Financial Controller ...
Because the email has an error in it, the attachment cannot be downloaded or will appear to be corrupt. This follows on from a similar bunch of corrupt spam messages on Friday... The payload is meant to be the Dridex banking trojan...
UPDATE: A source (thank you!) tells me that the various versions of the document should download a binary from one of the following locations:
emirelo .com/786585d/08g7g6r56r.exe
esecon .com.br/786585d/08g7g6r56r.exe
outago .com/786585d/08g7g6r56r.exe
This binary has an MD5 of 971b9f7a200cff489ee38011836f5240 and a VirusTotal detection rate of 3/54*. The same source identifies the following C2 servers which are worth blocking:
192.232.204.53 (WebSiteWelcome, US)
110.77.142.156 (CAT BB Net, Thailand)
216.117.130.191 (Advanced Internet Technologies Inc, US)
202.69.40.173 (Gerrys Information Technology (pvt) Ltd, Pakistan)
Recommended blocklist:
192.232.204.53
110.77.142.156
216.117.130.191
202.69.40.173 "
* https://www.virustotal.com/en/file/26c2b5342953b73cd2e73aff7dc49a880ecdd3725d3882c95c8ba6990a5c4bcf/analysis/
TCP connections
192.232.204.53: https://www.virustotal.com/en/ip-address/192.232.204.53/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
- http://myonlinesecurity.co.uk/invoice-january-alastair-baird-abairdjtcp-co-uk-damaged-or-broken-office-doc-or-xls-attachment/
18 Jan 2016 - "The Dridex bots are -still- not having a good day today. On Friday they sent -3- different malformed/damaged /broken malspams. Today, the first damaged/malformed broken one is an email with the subject of 'Invoice January- pretending to come from A . Baird <ABaird@ jtcp .co.uk> with a -damaged- attachment that is supposed to be a malicious word doc or XLS spreadsheet attachment... The -damaged/broken- attachment has a name something like INV-IN174074-2016-386.doc
Downloading this one from quarantine on my server gives what looks like a genuine word doc..
VirusTotal Detections 5/55* which will attempt to download Dridex banking malware from
[emirelo .com/786585d/08g7g6r56r.exe] (VirusTotal 3/54**) Payload Security /Reversit Analysis***
The email looks like:
From: A . Baird <ABaird@ jtcp .co.uk>
Date: Mon 18/01/2016 09:45
Subject: Invoice January
Hi,
We have been paid for much later invoices but still have the attached invoice as outstanding.
Can you please confirm it is on your system and not under query.
Regards
Alastair Baird
Financial Controller ...
This email attachment contains what appears to be a genuine word doc or Excel XLS spreadsheet with either a macro script or an embedded OLE object that when run -will- infect you. Modern versions of Microsoft office, that is Office 2010, 2013, 2016 and Office 365 should be automatically set to higher security to protect you...
By default protected view is enabled and macros are disabled, UNLESS you or your company have enabled them. If protected view mode is turned off and macros are enabled then opening this malicious word document will infect you, and simply previewing it in windows explorer or your email client might well be enough to infect you...
DO NOT follow the advice they give to enable macros or enable editing to see the content..."
* https://www.virustotal.com/en/file/629bfdd9fd255d74e40cd893475ea662d5e1dd12268d7114fec77666350d46a9/analysis/1453114324/
** https://www.virustotal.com/en/file/26c2b5342953b73cd2e73aff7dc49a880ecdd3725d3882c95c8ba6990a5c4bcf/analysis/1453115492/
192.232.204.53: https://www.virustotal.com/en/ip-address/192.232.204.53/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
*** https://www.reverse.it/sample/629bfdd9fd255d74e40cd893475ea662d5e1dd12268d7114fec77666350d46a9?environmentId=1
Contacted Hosts
194.24.228.5: https://www.virustotal.com/en/ip-address/194.24.228.5/information/
192.232.204.53: https://www.virustotal.com/en/ip-address/192.232.204.53/information/
___
Fake 'Statements' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-fail-statements-alison.html
18 Jan 2016 - "This -fake- financial email does not come from J Thomson Colour Printers but is instead a simple forgery with a malicious attachment.
From Alison Smith [ASmith@ jtcp .co.uk]
Date Mon, 18 Jan 2016 18:27:36 +0530
Subject Statements
Sent 12 JAN 16 15:36
J Thomson Colour Printers
14 Carnoustie Place
Glasgow
G5 8PB ...
Attached is a file S-STA-SBP CRE (0036).xls which is actually -corrupt- due to a monumental failure by the bad guys. The payload is meant to be the Dridex banking trojan, but since -Friday- the attachments have been messed up and will either appear to be garbage or zero length. The payload itself should look similar to this one*, also spoofing the same company."
* http://blog.dynamoo.com/2016/01/malware-spam-fail-invoice-january-baird.html
- http://myonlinesecurity.co.uk/j-thomson-colour-printers-alison-smith-asmithjtcp-co-uk-statements-damaged-or-broken-office-doc-or-xls-attachment/
18 Jan 2016 - "... damaged/broken attachment has a name something like S-STA-SBP CRE (0036).xls ... it would if fixed, download -Dridex- from the same locations as today’s earlier malspam runs..."
___
LastPass - Phish...
- https://www.seancassidy.me/lostpass.html
2016-01-18 - "... discovered a -phishing- attack against LastPass that allows an attacker to steal a LastPass user's email, password, and even two-factor auth code, giving full access to all passwords and documents stored in LastPass. I call this attack 'LostPass'... Because LastPass trained users to expect notifications in the browser viewport, they would be none the wiser. The LastPass login screen and two-factor prompt are drawn in the viewport as well:
> https://www.seancassidy.me/images/lastpass_login.png
...
> https://www.seancassidy.me/images/lastpass_2fa.png
... Here's an image of LastPass and LostPass for Firefox on Windows 8 side-by-side. Which one is which?:
> https://www.seancassidy.me/images/lastpass_firefox.png "
:fear::fear: :mad:
AplusWebMaster
2016-01-19, 15:25
FYI...
Fake 'Insurance' SPAM - doc malware
- http://myonlinesecurity.co.uk/thank-you-for-purchasing-from-cheaper-travel-insurance-14068156-insureandgo-com-word-doc-malware/
19 Jan 2016 - "The Dridex bots are still having problems again today. Their latest attempt is an email with the subject of 'Thank you for purchasing from Cheaper Travel Insurance – 14068156' pretending to come from info87@ Resellers.insureandgo .com (the info number is random) with a malicious word doc attachment is another one from the current bot runs... While they appear to have fixed the malware attachments, they instead have introduced a new bug and are sending broken emails with -garbled- content... when corrected it will look something like this:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/CHEAPER-TRAVEL.png
19 January 2016: 14068156.doc - Current Virus total detections 4/55*
[MALWR**] attempts to download Dridex banking malware from
http :// www .cnbhgy .com/786585d/08g7g6r56r.exe but seems to be having problems and timing out... Update: it eventually downloaded (VirusTotal 2/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6c64233883bbf2f2711334218aa280a40f38450c4ff59ab2a9f0dfd89fd5c0c4/analysis/1453193244/
** https://malwr.com/analysis/ODliNGI1NmZkMDcxNDgxZTkxNjNlMmQ1MDFjYmNiNDc/
123.1.157.76
216.59.16.175
13.107.4.50
*** https://www.virustotal.com/en/file/ea05dd2ce2721b4faddab320f0424be7c1c57a9433d337175358e472044d66dd/analysis/1453194356/
TCP connections
216.59.16.175
8.254.218.14
- http://blog.dynamoo.com/2016/01/malware-spam-thank-you-for-purchasing.html
19 Jan 2016 - "This -fake- financial spam comes with a malicious attachment:
Header screenshot: http://www.insureandgo.com/emails/0708/cheaper_header.jpg
Your policy number: MF/CP/205121/14068156
Dear customer, Thank you for buying your travel insurance from Cheaper.
Your policy documents are attached.
Date: 18/01/2016
Amount: £849.29
Quote number: 21272810
Policy number: MF/CP/205121/14068156 ...
The sender appears to be from info[some-random-number]@ Resellers.insureandgo .com, but it is just a simple forgery. Attached is a malicious Word document that I have seen -five- different versions... download locations as:
www .cnbhgy .com/786585d/08g7g6r56r.exe
seaclocks .co .uk/786585d/08g7g6r56r.exe
mosaicambrosia .com/786585d/08g7g6r56r.exe
This has a VirusTotal result of 3/54*.... combined with this Hybrid Analysis** show traffic to:
216.59.16.175 (Immedion LLC, US / VirtuaServer Informica Ltda, Brazil)
195.96.228.199 (Bulgarian Academy Of Sciences, Bulgaria)
200.57.183.176 (Triara.com, S.A. de C.V., Mexico)
62.109.133.248 (Ignum s.r.o, Czech Republic)
103.23.154.184 (Ozhosting.com Pty Ltd, Australia)
41.38.18.230 (TE Data, Egypt)
202.137.31.219 (Linknet, Indonesia)
176.53.0.103 (Network Devices, Turkey)
The payload is the Dridex banking trojan, and this activity is consistent with the botnet 220 campaign...
Recommended blocklist:
216.59.16.175
195.96.228.199
200.57.183.176
62.109.133.248
103.23.154.184
41.38.18.230
202.137.31.219
176.53.0.103
* https://www.virustotal.com/en/file/ea05dd2ce2721b4faddab320f0424be7c1c57a9433d337175358e472044d66dd/analysis/1453194985/
TCP connections
216.59.16.175
8.254.218.14
** https://www.hybrid-analysis.com/sample/ea05dd2ce2721b4faddab320f0424be7c1c57a9433d337175358e472044d66dd?environmentId=4
___
Fake 'Payment overdue' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-daily-mail-payment-overdue.html
19 Jan 2016 - "This -fake- financial spam does not come from the Daily Mail, but is instead a simple -forgery- with a malicious attachment:
From Raashida Sufi [Raashida.Sufii@ dmgmedia .co.uk]
Date Tue, 19 Jan 2016 11:40:37 +0300
Subject Daily Mail - Payment overdue
Hi,
I have currently taken over from my colleague Jenine so will be your new POC going
forward.
I have attached an invoice that is currently overdue for £360.00. Kindly email me
payment confirmation today so we can bring your account up to date?
Kind Regards
Rash Sufi ...
I have seen -three- different versions of the malicious attachment Invoice.doc (VirusTotal results 4/53[1]...). The Malwr analysis of these documents [4]... shows that the payload is identical to the Dridex banking trojan described here*."
1] https://www.virustotal.com/en/file/3604a62174609eec5b2ee8c586c32cbc2815275354e54dd6fdf5bf295846a1ed/analysis/1453197760/
4] https://malwr.com/analysis/ZGRmYTEwN2JhN2ZhNDQ2YmIxMjQxZWI0MGM2ODM3ZGY/
23.229.242.73
216.59.16.175
13.107.4.50
* http://blog.dynamoo.com/2016/01/malware-spam-thank-you-for-purchasing.html
- http://myonlinesecurity.co.uk/daily-mail-payment-overdue-dmgmedia-co-uk-raashida-sufi-word-doc-malware/
19 Jan 2016 - "... an email with the subject of 'Daily Mail – Payment overdue'... with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Daily-Mail-Payment-overdue-1024x775.png
19 January 2016: Invoice.doc - Current Virus total detections 4/53*
This will download Dridex banking malware [ http :// www .cnbhgy .com/786585d/08g7g6r56r.exe ] which is the same location and malware as today’s earlier malspam run**..."
* https://www.virustotal.com/en/file/37c82c81e802cbc4c04c8c530378d194d868dc9d8ad2f614e5255636dde9870a/analysis/1453195633/
** http://myonlinesecurity.co.uk/thank-you-for-purchasing-from-cheaper-travel-insurance-14068156-insureandgo-com-word-doc-malware/
___
Fake 'Remittance Advice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-remittance-advice-1b859e37.html
19 Jan 2016 - "This -fake- financial does not come from Bellingham + Stanley but is instead a simple -forgery- with a malicious attachment. Reference numbers and sender names will vary.
From: Adeline Harrison [HarrisonAdeline20@ granjacapital .com.br]
Date: 19 January 2016 at 09:45
Subject: Remittance Advice 1B859E37
For the attention of Accounts Receivable,
We are attaching an up to date remittance advice detailing the latest payment on your account.
Please contact us on the email address below if you would like your remittance sent to a different email address, or have any queries regarding your remittance.
Kind regards,
Adeline Harrison ...
I have seen at least -four- different variations of the attachment, named in the format remittance_advice14DDA974.doc ... Malwr reports... show those samples communicating with:
http :// 179.60.144.19/victor/onopko.php
http :// 5.34.183.127/victor/onopko.php
Those IPs are:
179.60.144.19 (Veraton Projects, Netherlands)
5.34.183.127 (ITL Company, Ukraine)
UPDATE 1: this related spam run also downloads from:
91.223.88.206/victor/onopko.php
This is allocted to "Private Person Anton Malyi" in Ukraine. A file aarab.exe is dropped... [VT 4/53*] which appears to communicate** with:
198.50.234.211 (OVH, Canada)
I strongly recommend that you -block- traffic to that IP. The payload is the Dridex banking trojan, this attack is consistent with botnet 120.
UPDATE 2: This other Dridex 120 spam run[1] uses different download locations:
46.17.100.209 /aleksei/smertin.php
31.131.20.217 /aleksei/smertin.php
The dropped "aarab.exe" file is also different... and a detection rate of just 2/54***.
Recommended blocklist:
198.50.234.211
179.60.144.19
5.34.183.127
91.223.88.206
46.17.100.209
31.131.20.217 "
* https://www.virustotal.com/en/file/6c9565c210b592ebbf9c4fdb19802432a6dcfc1e2ca8cd234f13bd26d17b610d/analysis/1453202263/
** https://malwr.com/analysis/OWMwZWMzOGIwNTEyNGFlZTg4OTFkOTcxZmNhYjNkNjk/
198.50.234.211
13.107.4.50
1] http://blog.dynamoo.com/2016/01/malware-spam-remittance-advice-for.html
*** https://www.virustotal.com/en/file/ed3649af70a6c52dfc26ebd17da25af4ce645fd93b7b817683d4477e8ad09a6f/analysis/1453211427/
- http://myonlinesecurity.co.uk/remittance-advice-for-invoice-04050722-from-c-tech-word-doc-malware/
19 Jan 2016 - "Dridex is definitely back with a vengeance today. The latest one of a long line is an email with the subject of 'Remittance Advice For Invoice 04050722' from C-Tech (random numbers) pretending to come from random names and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Carey Lucas <LucasCarey44@ search4what .com>
Date: Tue 19/01/2016 09:41
Subject: Remittance Advice For Invoice 04050722 From C-Tech
Dear Accounts
Please find attached our current remittance advice.
Kind Regards
Carey Lucas MAAT
Accounts Assistant ...
19 January 2016: C-Tech Remittance04050722.doc - Current Virus total detections 3/55*
downloads an -updated- Dridex banking malware from the ones described in this earlier run** from
http :// 46.17.100.209 /aleksei/smertin.php or http :// 31.131.20.217 /aleksei/smertin.php (VirusTotal 2/54***)
Each attempt at download seems to give me a -different- named file... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/64f4774973808bf09b6336ee05ff710e95e46c695cdab3ed8194be85215e8024/analysis/1453211898/
** http://myonlinesecurity.co.uk/ac-4330007-remittance-advice-industrial-electronic-wiring-ltd-word-doc-or-excel-xls-spreadsheet-malware/
*** https://www.virustotal.com/en/file/ed3649af70a6c52dfc26ebd17da25af4ce645fd93b7b817683d4477e8ad09a6f/analysis/1453211427/
aarab.exe
46.17.100.209: https://www.virustotal.com/en/ip-address/46.17.100.209/information/
31.131.20.217: https://www.virustotal.com/en/ip-address/31.131.20.217/information/
___
Twitter is back up ...
- http://www.theinquirer.net/inquirer/news/2442343/twitter-is-back-up-and-running-after-major-outage
Jan 19 2016 - "... Twitter was down for a decent time this morning. Long enough for people to start noticing and complaining about it on things like Facebook and in person... Twitter's status page*, which is presented through Yahoo's Tumblr, shows a trio of recent incidents..."
* http://twitterstatus.tumblr.com/
___
2016 Cisco Annual Security Report
- http://blogs.cisco.com/security/forewarned-is-forearmed-announcing-the-2016-cisco-annual-security-report
Jan 19, 2016 - "Our just-released 2016 Cisco Annual Security Report (ASR*) presents a challenging cybersecurity landscape: cyber defense teams are fighting to keep up with rapid global digitization while trying to integrate dozens of vendor solutions, speed up detection, and educate their organizations from top to bottom... attackers grow more bold, flexible, and resilient by the day, setting up professional infrastructures that look a lot like what we’d find in legitimate businesses. On the global front, we see fluctuations in cyber Internet governance across regions, which inhibits collaboration and the ability to respond to attacks... This years’ ASR reveals that attackers increasingly use legitimate online resources to launch their malicious campaigns. Though the news might speak to zero-day attacks, hackers also continue to deploy age-old malware to take advantage of weak spots such as unpatched servers. Aging infrastructure opens up green-field attack surfaces while uneven or inconsistent security practices remain a challenge... Other key insights from the 2016 ASR include a growing encryption trend (particularly HTTPS) for web traffic, which often provides a false sense of security to users—and for companies, potentially cloaks suspicious activity. We are also seeing more use of compromised WordPress servers to support ransomware, bank fraud, and phishing attacks. Alarmingly, between February and October 2015, the number of compromised WordPress installations used by cybercriminals grew by more than 221%... Increased attention, measurable results, added resilience, and focusing on what we can control are all possible now – so let’s capitalize on the moment before it’s too late."
(More detail at the cisco URL above.)
* http://www.cisco.com/c/m/en_us/offers/sc04/2016-annual-security-report/index.html?KeyCode=001031952
:fear::fear: :mad:
AplusWebMaster
2016-01-20, 12:40
FYI...
The 25 worst passwords of 2015
- https://nakedsecurity.sophos.com/2016/01/20/these-are-the-25-worst-passwords-of-2015-did-yours-make-the-list/
20 Jan 2016
> https://sophosnews.files.wordpress.com/2016/01/worst-password-rank-list.png
___
Fake 'Tax Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/tax-invoice-in092649-baton-lock-ltd-karin-edwards-word-doc-malware/
20 Jan 2016 - "The Dridex bots seem to have fixed their problems with this email pretending to be a tax invoice with the subject of 'Tax Invoice IN092649' pretending to come from Karin Edwards <karin.edwards@ batonlockuk .com> with a malicious word doc or Excel XLS spreadsheet attachment which downloads Dridex banking Trojan/Malware... The email looks like:
From: Baton Lock Ltd <karin.edwards@ batonlockuk .com>
Date:Wed 20/01/2016 10:36
Subject: Tax Invoice IN092649
Tax Invoice IN092649 from Baton Lock Ltd.
Best Regards
Karin Edwards
Baton Lock Ltd
20 January 2016: Tax Invoice IN092649.DOC - Current Virus total detections 3/54*
Downloads Dridex banking malware... and will update if there is any difference]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3ebada4bdb10580276af822248f574ac24ca3f13c6fa830f2d9549e3b004bb70/analysis/1453285912/
1] http://myonlinesecurity.co.uk/your-compliment-ref-398864-rachael-love-aylesbury-vale-district-council-environmental-health-and-licensing-damaged-or-broken-office-doc-or-xls-attachment/
- http://blog.dynamoo.com/2016/01/malware-spam-tax-invoice-in092649-karin.html
20 Jan 2016 - "This -fake- financial spam is not from Baton Lock Ltd but is instead a simple -forgery- with a malicious attachment.
From: Karin Edwards [karin.edwards@ batonlockuk .com]
Date: 20 January 2016 at 09:34
Subject: Tax Invoice IN092649
Tax Invoice IN092649 from Baton Lock Ltd.
Best Regards
Karin Edwards
Baton Lock Ltd
Attached is a file Tax Invoice IN092649.DOC which comes in at least two different versions (VirusTotal results [1] [2]) which according to these Malwr reports [3] [4] downloads from:
www .lassethoresen .com/98jh6d5/89hg56fd.exe
www .helios .vn/98jh6d5/89hg56fd.exe
The dropped file is [I]Dridex, the same as used in this campaign*."
* http://blog.dynamoo.com/2016/01/malware-spam-your-device-is-on-its-way.html
1] https://www.virustotal.com/en/file/4c55ff370a5a0307cb1ceb5c7176f41798c0930d6767ef509461115c589dfa86/analysis/1453286684/
2] https://www.virustotal.com/en/file/f5790c6e715a66feb5cb3524622c07eb0e475819a1e95c01ed4a8cb761ac88b0/analysis/1453286698/
3] https://malwr.com/analysis/N2VlNmM3NTIyYjY5NGI1Nzg4MDYwNWRjMmMwM2MyNTE/
198.173.254.216
37.49.223.235
62.221.68.80
216.224.175.92
13.107.4.50
4] https://malwr.com/analysis/MzNjNGI1MzAxYjg3NDBlN2I0M2IyYjI3NDgzZTNiOGY/
103.28.38.14
216.224.175.92
13.107.4.50
___
Fake 'Invoice / Credit Note' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-credit-note.html
20 Jan 2016 - "This -fake- financial spam is not from Express Newspapers but is instead a simple -forgery- with a malicious attachment:
From: georgina.kyriacoumilner@ express .co.uk
Reply-To: hannah.johns@ express .co.uk
Date: 20 January 2016 at 14:28
Subject: Invoice / Credit Note Express Newspapers (S174900)
Please find attached Invoice(s) / Credit Note(s) from Express Newspapers...
N.B. Please do not reply to this email address as it is not checked.
Kind Regards,
Express Newspapers...
Attached is a file S174900.DOC which comes in at least three different versions... and the Malwr reports for those... shows the following download locations:
www .helios .vn/98jh6d5/89hg56fd.exe [404 error]
202.191.112.60 /~n02022-1/98jh6d5/89hg56fd.exe
www .lassethoresen .com/98jh6d5/89hg56fd.exe
These are the same locations as seen here*, but now the payload has -changed- ... and a detection rate of 1/54**. The malware still phones home to
216.224.175.92 (SoftCom America Inc, US) which I recommend you -block-"
* http://blog.dynamoo.com/2016/01/malware-spam-your-device-is-on-its-way.html
** https://www.virustotal.com/en/file/89c73c42e8cd8d20aac5878c4585b9be2ce12447d6b201d3bd1407142dd60bbf/analysis/1453307125/
TCP connections
216.224.175.92
13.107.4.50
- http://myonlinesecurity.co.uk/invoice-credit-note-express-newspapers-s174900-word-doc-macro-malware/
20 Jan 2016 - "... an email that pretends to be an invoice/credit note from express newspapers with the subject of 'Invoice / Credit Note Express Newspapers (S174900)' pretending to come from georgina.kyriacoumilner@ express .co.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Invoice-Credit-Note-Express-Newspapers-S174900-1024x609.png
20 January 2016: S174900.DOC - Current Virus total detections 1/53*
Downloads Dridex from www .lassethoresen .com/98jh6d5/89hg56fd.exe and I am sure other versions of this attachment will download from all the other Dridex locations today** ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e0737d9405afe1f3b7158a82f2ff72086889693ad04d5cca2691b1b64b5cf7e1/analysis/1453306851/
** http://myonlinesecurity.co.uk/emailing-120205-letter-response-a3-2-2-plan4print-co-uk-word-doc-malware/
___
Fake 'Letter-response' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-emailing-120205-letter.html
20 Jan 2016 - "... this -fake- financial email isn't from Tim or Plan4Print (aka Excel Colour Print) at all, but is a simple -forgery- with a malicious attachment.
From Tim Speed [Tim@ plan4print .co.uk]
Date Wed, 20 Jan 2016 14:33:24 +0300
Subject Emailing: 120205 Letter-response A3 2-2
Hi
Please find estimate attached for Letter-response A3 2-2
Kind regards
Tim Speed
Estimator / Account Handler ..
Attached is a file 120205 Letter-response A3 2-2.doc of which I have seen just a single sample, with a VirusTotal result of 3/54*. The Malwr report** shows it downloading from:
www .lassethoresen .com/98jh6d5/89hg56fd.exe
This is the same malicious binary as used in this earlier attack***. The payload is the Dridex banking trojan."
* https://www.virustotal.com/en/file/35ce1bdeaf22eb9f85ae76e931395253973c682195b5a3fcabb1620af6335671/analysis/1453293437/
** https://malwr.com/analysis/ZWViMDQyZTk0M2I2NDM4MWFkOGUxYzc5Y2UyYjFiMjc/
198.173.254.216
216.224.175.92
8.253.44.158
*** http://blog.dynamoo.com/2016/01/malware-spam-your-device-is-on-its-way.html
- http://myonlinesecurity.co.uk/emailing-120205-letter-response-a3-2-2-plan4print-co-uk-word-doc-malware/
20 Jan 2016 - "... an email with the subject of 'Emailing: 120205 Letter-response A3 2-2' pretending to come from Tim Speed <Tim@plan4print .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/Emailing-120205-Letter-response-A3-2-2-1024x676.png
20 January 2016: 120205 Letter-response A3 2-2.doc - Current Virus total detections 3/54*
Downloads an -updated- Dridex version from today’s earlier ones from http ://www.helios .vn/98jh6d5/89hg56fd.exe (VirusTotal 1/54**) I am sure all the other same locations*** will also be used in different version of this attachment..."
* https://www.virustotal.com/en/file/108bdbc031bc05bf907f3c5387bf16052ed037220597107fe0a3e3e40070de5c/analysis/1453296447/
** https://www.virustotal.com/en/file/89c73c42e8cd8d20aac5878c4585b9be2ce12447d6b201d3bd1407142dd60bbf/analysis/1453296242/
TCP connections
216.224.175.92: https://www.virustotal.com/en/ip-address/216.224.175.92/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
*** http://myonlinesecurity.co.uk/your-compliment-ref-398864-rachael-love-aylesbury-vale-district-council-environmental-health-and-licensing-damaged-or-broken-office-doc-or-xls-attachment/
___
Fake 'Order Confirmation' SPAM - doc/xls attachment
- http://myonlinesecurity.co.uk/emailed-order-confirmation-946021-damaged-or-broken-office-doc-or-xls-attachment/
20 Jan 2016 - "The Dridex bots are back to having another bad day. Over the last few days they have sent numerous different malformed/damaged/broken malspams. Today, the first one is a damaged/malformed/broken one is an email with the subject of 'Emailed Order Confirmation – 94602:1' pretending to come from DANE THORNTON <dane@ direct-electrical .com> with a damaged attachment that is supposed to be a malicious word doc or XLS spreadsheet attachment... The damaged/broken attachment has a name something like Order_94602~1.doc . It would if fixed, download Dridex. The email looks like:
From: DANE THORNTON <dane@ direct-electrical .com>
Date: Wed 20/01/2016 08:55
Subject: Emailed Order Confirmation – 94602:1
DANE THORNTON
This email attachment contains what appears to be a genuine word doc or Excel XLS spreadsheet with either a macro script or an embedded OLE object that when run will infect you... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
- http://blog.dynamoo.com/2016/01/malware-spam-fail-emailed-order.html
20 Jan 2016 - "This -fake- financial spam is meant to have a malicious attachment.
From "DANE THORNTON" [dane@ direct-electrical .com]
Date Wed, 20 Jan 2016 16:31:21 +0800
Subject Emailed Order Confirmation - 94602:1
--
DANE THORNTON
Attached is a file Order_94602~1.doc which in all the samples I have seen has been attached incorrectly to the email, and it will either appear to be zero length or garbage. The payload is meant to be the Dridex banking trojan, but this is the latest of several incidents lately where the bad guys have screwed up..."
___
MSN - More Malware via Malvertising
- https://blog.malwarebytes.org/malvertising-2/2016/01/msn-home-page-drops-more-malware-via-malvertising/
Jan 19, 2015 - "Malvertisers are once again abusing ad technology platform AdSpirit and exposing visitors of the MSN homepage to malware. These attacks appeared to have been primarily focused on Germans users via an ad for Lidl, one of the Germany’s leading supermarkets. This is not the first time we have caught malvertising on MSN or via AdSpirit. Each time, we spot telltale signs of suspicious activity with advertiser domains freshly created a few days prior the attack or hiding behind the CloudFlare service.
Perhaps the only surprise here was to find -different- exploit kits than the usual Angler EK to carry out the execution to the malware payload. In two separate incidents, we observed the RIG and Neutrino exploit kits... While we did not collect the payload in these specific attacks, other similar captures of RIG during the same time frame show that -CryptoWall-ransomware- was downloaded onto vulnerable machines:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/German_Cryptowall.png
We immediately notified AdSpirit about those incidents which were confirmed and addressed promptly. AppNexus also deactivated the offending ad objects and will be doing a further review about these attacks. To prevent these malvertising infections please ensure that your computer is up-to-date and that you are running the right security tools to mitigate those attacks..."
___
Trojan for Linux takes screenshots
- https://news.drweb.com/show/?i=9790&c=5&lng=en&p=0
Jan 19, 2016 - "Malware for Linux becomes more and more diverse. Among them are spyware programs, ransomware, and Trojans designed to carry out DDoS attacks. Doctor Web security researchers examined yet another cybercriminals’ creation dubbed Linux.Ekoms.1. This Trojan can periodically take screenshots and download different files to a compromised machine. Once launched, Linux.Ekoms.1 checks whether one of subfolders in the home directory contains files with specified names. If it fails to find any, it randomly chooses a subfolder to save its own copy there. Then, the Trojan is launched from new location. If successful, the malicious program establishes connection to the server whose addresses are hard-coded in its body. All information transmitted between the server and Linux.Ekoms.1 is encrypted. Every 30 seconds the Trojan takes a screenshot and saves it to a temporal folder in the JPEG format. If the file is not saved, the Trojan tries to save it in the BMP format. The temporary folder is downloaded to the server in specified intervals..."
:fear::fear: :mad:
AplusWebMaster
2016-01-21, 14:19
FYI...
Fake Facebook emails deliver malware / phish ...
- http://net-security.org/malware_news.php?id=3191
21.01.2016 - "A new spam campaign is targeting Facebook users. It uses the same approach as the recent one aimed at WhatsApp users, and Comodo researchers* believe that the authors of both campaigns are likely the same. The -fake- emails are made to look like an official communication from the popular social network, and their goal is to make the victims believe they have received a voice message..."
* https://blog.comodo.com/comodo-news/facebook-now-the-subject-of-new-malware-attack/
Jan 21, 2016 - "... As part of a random -phishing- campaign, cybercriminals were sending -fake- emails representing the information as official WhatsApp content to spread malware when the attached “message” was clicked on. Now, researchers at the Threat Research Lab have identified a very similar phishing campaign targeted at businesses and consumers who use Facebook – most likely designed by the same cyber criminals who developed the WhatsApp malware. And just like the WhatsApps malware, the new Facebook malware tries to represent itself as an email from Facebook which states there is a new message for the recipient. The email address and sender’s name tries to brand itself as Facebook, but the sender’s email address is from different domains and not in any way related with the Facebook company... The malware in the email itself is in a .zip file, sent as an attachment. Inside the zip file there is an executable file. Upon executing the file (e.g. clicking on the attachment), the malware will automatically replicate itself into “C:\” directory and add itself into an auto-run in the computer’s registry, spreading the malware. Additionally, like the WhatsApp malware, the engineers have Comodo have also identified this new Facebook malware as a variant of the “Nivdort” malware** family... A screen grab of the -malicious- email has been captured below:
> https://blog.comodo.com/wp-content/uploads/Nivdort.png
** https://file-intelligence.comodo.com/windows-process-virus-malware/Nivdort?key5sk1=5e0287c575ed4a4dda5e1950581d3f0dbad90efd
___
Fake '201552 ebill' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-invoicesebillinvoicecom.html
21 Jan 2016 - "This -fake- financial email comes with a malicious attachment.
From invoices@ ebillinvoice .com
Date Thu, 21 Jan 2016 15:13:36 +0530
Subject 201552 ebill
Customer No : 8652
Email address : [redacted]
Attached file name : 8652_201552.DOC
Dear customer
Please find attached your invoice for 201552.
To manage your account online - please visit Velocity...
There are at least -three- different versions of the attachment 8652_201552.doc (VirusTotal results [1] [2] [3])
for which the Malwr reports [4] [5] [6] indicate downloads from the following locations:
phaleshop .com/8h75f56f/34qwj9kk.exe
bolmgren .com/8h75f56f/34qwj9kk.exe
return-gaming .de/8h75f56f/34qwj9kk.exe
montaj-klimat .ru/8h75f56f/34qwj9kk.exe [spotted here*]
This binary has an MD5 of f23c05c44949c6c8b05ab54fbd9cee40 and a detection rate of 2/54**. Those reports indicate that it phones home to.
216.224.175.92 (SoftCom America Inc., US)
A contact (thank you) also pointed out some other locations the malware phones home to
216.59.16.175 (Immedion LLC, US / Virtuaserver Informica Ltda, Brazil)
216.117.130.191 (Advanced Internet Technologies Inc., US)
202.69.40.173 (Gerrys Information Technology (pvt) Ltd, Pakistan)
The payload is the Dridex banking trojan, being sent by botnet 220.
Recommended blocklist:
216.224.175.92
216.59.16.175
216.117.130.191
202.69.40.173 "
1] https://www.virustotal.com/en/file/93c4d5b2dc751a509d67f8eac8ddf7ef5d02e41229d5eff092324acf073333ab/analysis/1453373816/
2] https://www.virustotal.com/en/file/eac69334d0dccf0423009a679ef25b27b32d13f7b11907f7386566f105a93a53/analysis/1453373886/
3] https://www.virustotal.com/en/file/9759e62f48643adf5a8d984e139a93341fdc793dd88a7ffded26b77bd036fc3d/analysis/1453373898/
4] https://malwr.com/analysis/MTQ2ZjM1MGVjMmMwNDAxMWEyMTYxY2ExNGEyMThlODk/
5] https://malwr.com/analysis/N2I4MDJlOGQxOWYyNDExY2EwNzY1ZjNlNDQ2OTlmZjE/
6] https://malwr.com/analysis/ZGVkZWYxMzY0OGY1NGJmNzljYjEzNGE2NDAwODY3OWU/
* http://blog.dynamoo.com/2016/01/malware-spam-adminreplacementkeyscouk.html
** https://www.virustotal.com/en/file/cb86b2e2069265b0c7a249ac3e96213757ae0eb399662dc306c98b9dd1e9334e/analysis/1453374873/
TCP connections
216.224.175.92: https://www.virustotal.com/en/ip-address/216.224.175.92/information/
- http://myonlinesecurity.co.uk/201552-ebill-ebillinvoice-com-velocitycardmanagement-com-word-doc-malware/
21 Jan 2016 - "An email with the subject of '201552 ebill' pretending to come from invoices@ ebillinvoice .com with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: invoices@ ebillinvoice .com
Date: Thu 21/01/2016 09:37
Subject: 201552 ebill
Customer No : 8652
Email address : rob@ securityandprivacy .co.uk
Attached file name : 8652_201552.DOC
Dear customer
Please find attached your invoice for 201552.
To manage your account online – please visit Velocity...
21 January 2016: 8652_201552.DOC - Current Virus total detections 4/54*
... this will download Dridex banking malware from [ return-gaming .de/8h75f56f/34qwj9kk.exe ] (VirusTotal 2/55**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9759e62f48643adf5a8d984e139a93341fdc793dd88a7ffded26b77bd036fc3d/analysis/1453370622/
** https://www.virustotal.com/en/file/6119c02161aa72496d6932fd6fdf4f8d8f49ec9936d1cb2efa377802c5ed273d/analysis/1453371930/
TCP connections
216.224.175.92: https://www.virustotal.com/en/ip-address/216.224.175.92/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
___
Fake 'Telephone Bill' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-your-telephone-bill.html
21 Jan 2016 - "This -fake- financial spam has a malicious attachment.
From "The Billing Team" [noreply@ callbilling .co.uk]
Date Thu, 21 Jan 2016 11:44:19 +0100
Subject Your Telephone Bill Invoices & Reports
Please see the attached Telephone Bill & Reports.
Please use the contact information found on the invoice if you wish to contact your
service provider.
This message was sent automatically...
I have only seen a single sample of this email, with an attachment Invoice_316103_Jul_2013.doc which has a detection rate of 2/53*. The Malwr report** for that document shows a download location of:
bolmgren .com/8h75f56f/34qwj9kk.exe
That is one of the locations found with this earlier spam run***, and the payload is the Dridex banking trojan."
* https://www.virustotal.com/en/file/b92bc482eaaab3b855e9b3fc79cb2579609f6badcc7aca6a1d990c91a69405fe/analysis/1453376703/
** https://malwr.com/analysis/MjYwZTRhYmQxMTQxNDJiYzhmODI1OGE0Y2JlZWY0Y2Q/
195.128.175.9
216.224.175.92
13.107.4.50
*** http://blog.dynamoo.com/2016/01/malware-spam-invoicesebillinvoicecom.html
- http://myonlinesecurity.co.uk/your-telephone-bill-invoices-reports-word-doc-or-excel-xls-spreadsheet-malware/
21 Jan 2016 - "An email with the subject of 'Your Telephone Bill Invoices & Reports' pretending to come from The Billing Team <noreply@ callbilling .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: The Billing Team <noreply@ callbilling .co.uk>
Date: Thu 21/01/2016 10:20
Subject: Your Telephone Bill Invoices & Reports
Please see the attached Telephone Bill & Reports.
Please use the contact information found on the invoice if you wish to contact your service provider.
This message was sent automatically...
21 January 2016: Invoice_316103_Jul_2013.doc - Current Virus total detections 2/54*
This will also download Dridex banking malware from
http ://return-gaming .de/8h75f56f/34qwj9kk.exe which is the -same- download site as today’s other concurrent malspam run**..."
* https://www.virustotal.com/en/file/1ae3b428d3634fd46e2fd8c1a4b66dfa02853ef95507a0b7cfcb5f9a929dd8d6/analysis/1453371806/
** http://myonlinesecurity.co.uk/201552-ebill-ebillinvoice-com-velocitycardmanagement-com-word-doc-malware/
___
Fake 'Replacement Keys' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-adminreplacementkeyscouk.html
21 Jan 2016 - "This spam has a malicious attachment. It does not come from admin@ replacementkeys .co.uk but is instead a simple -forgery- with a malicious attachment.
From Replacement Keys [admin@ replacementkeys .co.uk]
Date Thu, 21 Jan 2016 17:15:08 +0530
Subject =?utf-8?B?TmV3IE9yZGVyICMgMTAwMTE0MDAw?=
Order Received!
We will send you another email when it has been dispatched . If you have any questions about your order please reply to this email. Your order confirmation is below. Thank you for ordering from us.
Thank you again,
Replacement Keys
Attached is a file INVOICEPaid_100114000.xls of which I have only seen a single variant. The VirusTotal detection rate is 4/53* and the Malwr report** indicates a download location from:
montaj-klimat .ru/8h75f56f/34qwj9kk.exe
The binary dropped is identical to the one in this earlier spam run*** and it leads to the Dridex banking trojan."
* https://www.virustotal.com/en/file/ea6c955a619f18c3e9a6ad2c7ad2723ae237985451f55d1bb3b7ac6ce55b1523/analysis/1453377591/
** https://malwr.com/analysis/NGZlMDk1YmVjNDY1NGYzZGFlYzIxNmQ5NTU0NjcyZGY/
*** http://blog.dynamoo.com/2016/01/malware-spam-invoicesebillinvoicecom.html
- http://myonlinesecurity.co.uk/new-order-100114000-replacementkeys-co-uk-excel-xls-spreadsheet-malware/
21 Jan 2016 - "An email with the subject of 'New Order # 100114000' pretending to come from Replacement Keys <admin@ replacementkeys .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Replacement Keys <admin@ replacementkeys .co.uk>
Date: Thu 21/01/2016 12:21
Subject: New Order # 100114000
Order Received!
We will send you another email when it has been dispatched ...
21 January 2016: logmein_pro_receipt.xls - Current Virus total detections 4/52*
Downloads Dridex from http ://www .bridge-freunde-colonia .de/8h75f56f/34qwj9kk.exe (VirusTotal 1/49**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/92a25ace749d1e86a9a500f7c286b6d6fa0685fb7e671c991ed1a9e159efa076/analysis/1453379373/
** https://www.virustotal.com/en/file/ac424d8ef67dbb1ee98568f9a96376370ce0cf1f9d03403d928498a57c54abd9/analysis/1453382710/
___
Fake 'Healthcare' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-gompels-healthcare-ltd.html
21 Jan 2016 - "This -fake- financial spam does not come from Gompels Healthcare Ltd but is instead a simple -forgery- with a malicious attachment.
From: Gompels Healthcare ltd [salesledger@ gompels .co.uk]
Date: 21 January 2016 at 12:57
Subject: Gompels Healthcare Ltd Invoice
Hello
Please see attached pdf file for your invoice
Thank you for your business [/i]
The attachment is named fax00375039.doc and it comes in at least two different versions (VirusTotal [1] [2]) and the Malwr reports [3] [4] show download locations from:
return-gaming .de/8h75f56f/34qwj9kk.exe
phaleshop .com/8h75f56f/34qwj9kk.exe
That marks it out as Dridex 220, similar to this spam run*. However, the executable has -changed- from earlier and now has an MD5 of 95a1e02587182abfa66fdcf921ee476e and a zero detection rate at VirusTotal**. However, the malware still phones home to the same IP of 216.224.175.92 as before."
1] https://www.virustotal.com/en/file/3757522b79df43e1a0bcb4056581b7eddb3d41f54e39f85eada8c6feee63c4ed/analysis/1453381421/
2] https://www.virustotal.com/en/file/d46133a67aad6c11c20cf8848d202261db0382d4da21bd393439611e39d24d54/analysis/1453381734/
3] https://malwr.com/analysis/NGQ4NzYyNzMzMGNjNDkzNmJiMTJmMjAzNTg1ZDNjNjE/
82.165.218.65
216.224.175.92
8.254.249.78
4] https://malwr.com/analysis/OWZmYWQzOWNlNTE5NDBjMGI3NDEyN2EyZWU3M2VjNmU/
112.78.2.113
216.224.175.92
184.28.188.186
* http://blog.dynamoo.com/2016/01/malware-spam-invoicesebillinvoicecom.html
** https://www.virustotal.com/en/file/ac424d8ef67dbb1ee98568f9a96376370ce0cf1f9d03403d928498a57c54abd9/analysis/1453381954/
216.224.175.92: https://www.virustotal.com/en/ip-address/216.224.175.92/information/
phaleshop .com: 112.78.2.113: https://www.virustotal.com/en/ip-address/112.78.2.113/information/
- http://myonlinesecurity.co.uk/gompels-healthcare-ltd-invoice-gompels-healthcare-ltd-word-doc-malware/
21 Jan 2016 - "An email with the subject of 'Gompels Healthcare Ltd Invoice' pretending to come from Gompels Healthcare ltd <salesledger@ gompels .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Gompels Healthcare ltd <salesledger@gompels.co.uk>
Date: Thu 21/01/2016 13:12
Subject: Gompels Healthcare Ltd Invoice
Hello
Please see attached pdf file for your invoice
Thank you for your business
21 January 2016: fax00375039.DOC - Current Virus total detections 5/54*
Downloads Dridex banking malware from
http ://phaleshop .com/8h75f56f/34qwj9kk.exe which is the -same- Dridex payload as described HERE**..."
* https://www.virustotal.com/en/file/d46133a67aad6c11c20cf8848d202261db0382d4da21bd393439611e39d24d54/analysis/1453383052/
** http://myonlinesecurity.co.uk/new-order-100114000-replacementkeys-co-uk-excel-xls-spreadsheet-malware/
:fear::fear: :mad:
AplusWebMaster
2016-01-22, 12:45
FYI...
Fake 'scanner' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-message-from-konicaminolta.html
22 Jan 2016 - "At the moment there is a heavy spam run pushing the Dridex banking trojan, pretending to be from a multifunction device or scanner.
Subject: Message from KONICA_MINOLTA
Subject: Message from MFD
Subject: Message from scanner
The spam appears to come from within the victim's own domain, from one of the following email addresses:
MFD@ victimdomain .tld
scanner@ victimdomain .tld
KONICA_MINOLTA@ victimdomain .tld
This is just a simple forgery. It doesn't mean that you organisation has been compromised.. it really is a very simple trick. In all cases the attachment is named SKM_4050151222162800.doc, which appears to come in -three- versions... reports... indicate executable download locations at:
www .showtown-danceband .de/ghf56sgu/0976gg.exe
ausonia-feng-shui .de/ghf56sgu/0976gg.exe
gahal .cz/ghf56sgu/0976gg.exe
This binary has a detection rate of 1/54* and that VirusTotal report plus this Malwr report** show it phoning home to:
192.241.207.251 (Digital Ocean Inc., US)
I strongly recommend that you -block- traffic to that IP. The payload is the Dridex banking trojan, sent by botnet 220."
* https://www.virustotal.com/en/file/edfa4219e26ee78f69170a9d90bbe12fc5dc86e1f2671102735e06d89cdef9ba/analysis/1453454938/
TCP connections
192.241.207.251: https://www.virustotal.com/en/ip-address/192.241.207.251/information/
89.149.175.18: https://www.virustotal.com/en/ip-address/89.149.175.18/information/
** https://malwr.com/analysis/Y2NhNDhlMTcxNDQzNGJkMGE3OWI3ZmM5NzA0ODM2NmQ/
192.241.207.251: https://www.virustotal.com/en/ip-address/192.241.207.251/information/
8.254.207.46: https://www.virustotal.com/en/ip-address/8.254.207.46/information/
- http://myonlinesecurity.co.uk/message-from-konica_minolta-or-message-from-mfd-or-any-other-scanner-or-printer-word-doc-malware/
22 Jan 2016 - "An email with the subject of 'Message from KONICA_MINOLTA' (or Message from MFD or any other scanner or printer) pretending to come from scanner@ <your email domain> on behalf of MFD@ <victim domain> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: scanner@ malware-research .co.uk; on behalf of; MFD@ malware-research .co.uk
Date: Fri 22/01/2016 08:56
Subject: Message from KONICA_MINOLTA or Message from MFD or Message from Scanner
Body content: totally empty body
22 January 2016: SKM_4050151222162800.doc - Current Virus total detections 3/54*
Downloads Dridex banking malware from http ://ausonia-feng-shui .de/ghf56sgu/0976gg.exe
(VirusTotal **). Other download locations from different versions of this maldoc attachment are: www .showtown-danceband .de/ghf56sgu/0976gg.exe and gahal .cz/ghf56sgu/0976gg.exe
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d12b936880df87f58592c821f98ae102c9f3fb45238d1912c4261afeba2fd2fd/analysis/1453452819/
** https://www.virustotal.com/en/file/edfa4219e26ee78f69170a9d90bbe12fc5dc86e1f2671102735e06d89cdef9ba/analysis/1453453469/
TCP connections
192.241.207.251: https://www.virustotal.com/en/ip-address/192.241.207.251/information/
89.149.175.18: https://www.virustotal.com/en/ip-address/89.149.175.18/information/
___
Fake 'mathforum' SPAM - JS malware
- http://myonlinesecurity.co.uk/hi-mathforum-org-js-malware/
22 Jan 2016 - "An email with the subject of 'hi' coming from gshatford <gshatford@ mathforum .org> (probably -compromised- servers, that will be sending these out from multiple email addresses) with a zip attachment is another one from the current bot runs... The content of the email simply says:
DATE:1/22/2016 7:47:24 AM
22 January 2016: yu.zip: Extracts to: invoice_SCAN_1pMVj.js - Current Virus total detections 5/53*
[MALWR**] [WEPAWET***] which downloads 80.exe (virus total 2/55[4]) from a combination of these sites memyselveandi .com/80.exe | deempheal .com/80.exe - These have previously been teslacrypt/cryptowall or similar ransomware... it definitely is a password stealer and ransomware version [MALWR[5]].
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like an innocent file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/34bd545006f9ec629032b184bfa97f44e956dcd09058c93ceede8a9f8d5cc64c/analysis/1453449215/
** https://malwr.com/analysis/ZGFjNDBjMzFjNTIwNDgxMmFjNGQ4ZmY0MzViM2IwMDg/
51.255.10.132
*** https://wepawet.iseclab.org/view.php?hash=754b2079f0fc2a9daee028df83fd0932&type=js
4] https://www.virustotal.com/en/file/dbd5fac5a7b45f08e9343a62551bd4c7a540b5a404670100f7082362757a9211/analysis/1453449556/
TCP connections
144.76.253.225: https://www.virustotal.com/en/ip-address/144.76.253.225/information/
182.50.147.1: https://www.virustotal.com/en/ip-address/182.50.147.1/information/
5] https://malwr.com/analysis/NmM0MDMzMzRiMmMxNDQ3YWI3MzBiMDdhNjkyZjNjOTI/
144.76.253.225
182.50.147.1
185.24.99.98
176.106.190.60
94.23.247.172
104.28.5.189
69.73.182.201
___
Fake 'tracking info' SPAM - xls malware
- http://myonlinesecurity.co.uk/ukmail-988271023-tracking-information-excel-xls-spreadsheet-malware/
22 Jan 2016 - "An email with the subject of 'UKMail 988271023 tracking information' pretending to come from no-reply@ ukmail .com with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: no-reply@ ukmail .com
Date: Fri 22/01/2016 12:15
Subject: UKMail 988271023 tracking information
UKMail Info!
Your parcel has not been delivered to your address January 21, 2016, because nobody was at home.
Please view the information about your parcel, print it and go to the post office to receive your package.
Warranties
UKMail expressly disclaims all conditions, guarantees and warranties, express or implied, in respect of the Service.
Where the law prevents such exclusion and implies conditions and warranties into this contract,
where legally permissible the liability of UKMail for breach of such condition,
guarantee or warranty is limited at the option of UKMail to either supplying the Service again or paying the cost of having the service supplied again.
If you don’t receive a package within 30 working days UKMail will charge you for it’s keeping.
You can find any information about the procedure and conditions of parcel keeping in the nearest post office.
Best regards,
UKMail
22 January 2016: 988271023-PRCL.xls - Current Virus total detections 4/55*
This will download Dridex banking malware from
http ://www .stijnminne .be/ghf56sgu/0976gg.exe (VirusTotal 1/54**)... Dridex malware was seen in some examples of THIS earlier malspam run***, which was malspammed out in -several- waves throughout the morning. Note: Dridex updates frequently throughout the day..."
* https://www.virustotal.com/en/file/886adc192957bda32b375503c0d8b3c09f4b77a2609e4ef5952072c79c1ca7a0/analysis/1453464516/
** https://www.virustotal.com/en/file/edfa4219e26ee78f69170a9d90bbe12fc5dc86e1f2671102735e06d89cdef9ba/analysis/1453462957/
0976gg.exe
TCP connections
192.241.207.251: https://www.virustotal.com/en/ip-address/192.241.207.251/information/
89.149.175.18: https://www.virustotal.com/en/ip-address/89.149.175.18/information/
*** http://myonlinesecurity.co.uk/message-from-konica_minolta-or-message-from-mfd-or-any-other-scanner-or-printer-word-doc-malware/
- http://blog.dynamoo.com/2016/01/malware-spam-ukmail-988271023-tracking.html
22 Jan 2016 - "This -fake- delivery email is not from UKMail but is instead a simple -forgery- with a malicious attachment:
From: no-reply@ ukmail .com
Date: 22 January 2016 at 12:14
Subject: UKMail 988271023 tracking information
UKMail Info!
Your parcel has not been delivered to your address January 21, 2016, because nobody was at home.
Please view the information about your parcel, print it and go to the post office to receive your package...
If you don't receive a package within 30 working days UKMail will charge you for it's keeping.
You can find any information about the procedure and conditions of parcel keeping in the nearest post office.
Best regards,
UKMail
The attachment is named 988271023-PRCL.xls which appears to come in at least two variants (VirusTotal [1] [2]) which according to these Malwr reports [3] [4] downloads a malicious executable from:
www .stijnminne .be/ghf56sgu/0976gg.exe
raeva .com.ua/ghf56sgu/0976gg.exe
This binary has a detection rate of 4/54*. It is the -same- payload as found in this earlier spam run**."
1] https://www.virustotal.com/en/file/eae89bcb2c5349000441990e85c09b64d6dc0a9d4308140f640ef357f68b2876/analysis/1453467080/
2] https://www.virustotal.com/en/file/886adc192957bda32b375503c0d8b3c09f4b77a2609e4ef5952072c79c1ca7a0/analysis/1453467094/
3] https://malwr.com/analysis/N2JmNGEyMzE1NTNhNDc0ZGJmNDZlNjcxNjM4MDBlZDg/
91.234.32.117
192.241.207.251
13.107.4.50
4] https://malwr.com/analysis/ZjkyMGFhZDBmNThjNDBkY2IxZWVkMWFkN2Q5Nzc1Mjg/
195.130.132.84
192.241.207.251
184.25.56.42
* https://www.virustotal.com/en/file/edfa4219e26ee78f69170a9d90bbe12fc5dc86e1f2671102735e06d89cdef9ba/analysis/1453467328/
0976gg.exe
TCP connections
192.241.207.251: https://www.virustotal.com/en/ip-address/192.241.207.251/information/
89.149.175.18: https://www.virustotal.com/en/ip-address/89.149.175.18/information/
** http://blog.dynamoo.com/2016/01/malware-spam-message-from-konicaminolta.html
:fear::fear: :mad:
AplusWebMaster
2016-01-24, 14:26
FYI...
Fake 'E-mail-Account Update' SPAM – PHISH ...
- http://myonlinesecurity.co.uk/e-mail-account-update-phishing/
24 Jan 2016 - "A slightly different -phishing- email today, that pretends to be a notice from your email provider saying that you 'need to update your email'. All the ones I have seen are addressed to different names at different email domains...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/mail_update-1024x615.png
The links behind all the links go to http ://www .clavadelriverlodge .co.za/images/upgrade/index.php?email=name@ victimdomain .com, where they have set up rather a clever attempt to get your email log in details. They already have your email address and want the -password- to go along with it.
The site does a fairly good imitation of a Cpanel page with a processing bar that gradually increases to 100%. The name on the page is dynamically created based on the email address in the referral. The phishers have gone to quite a lot of trouble and effort with this one. Luckily Internet Explorer smart filter knows about it & warns you with a bright red Address bar in your browser. Unfortunately Chrome & Firefox haven’t caught up yet:
> http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/fake_cpanel_email_page-1024x599.png
... Watch for -any- site that invites you to enter ANY personal, log in or financial information... All of these emails use Social engineering tricks to persuade you to open the -attachments- or follow the -links- that come with the email..."
clavadelriverlodge .co.za: 192.185.174.108: https://www.virustotal.com/en/ip-address/192.185.174.108/information/
:fear::fear: :mad:
AplusWebMaster
2016-01-25, 12:57
FYI...
Fake 'Direct Debit' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/direct-debit-mandate-from-random-companies-word-doc-malware/
25 Jan 2016 - "... mass Dridex malspams. The first is an email with random subject of 'Direct Debit Mandate' from [random companies] pretending to come from random senders with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Ezekiel Holcomb <HolcombEzekiel7086@ acttv .in>
Date: Mon 25/01/2016 09:10
Subject: Direct Debit Mandate from Thames Water Authority
Good morning
Please attached Direct Debit Mandate from Thames Water Authority;
complete, sign and scan return at your earliest convenience.
Kind regards,
Ezekiel Holcomb
TEAM SUPPORT
Thames Water Authority ...
25 January 2016 : SharpC1889@acttv.in_4430446.doc - Current Virus total detections 3/52*
MALWR** shows it downloads Dridex from http ://109.234.35.80 /konfetka/roschen.php which gave me a file named mancity.exe (VirusTotal ***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/214bf2375880d6f73f0b8f5988737f536ad19c1d201a35bea8e8ce42f8bf86bb/analysis/1453712908/
** https://malwr.com/analysis/MDM5MGFkMmIwMzc4NDk3ZTkxYjM2ZDljYTIyMjUzMDM/
109.234.35.80
*** https://www.virustotal.com/en/file/d15d1bf6982959840298a4f11f1c1433a2a370140e9ff41dd8ed82a060e4b38d/analysis/1453713995/
109.234.35.80: https://www.virustotal.com/en/ip-address/109.234.35.80/information/
___
Fake 'Order PO' SPAM - malware
- http://myonlinesecurity.co.uk/order-po-10000731-malware/
25 Jan 2016 - "An email with the subject of Order PO # 10000731' pretending to come from Parkcom Co.ltd <simpark@ parkcom .co.kr> with a zip attachment is another one from the current bot runs... The email looks like:
From: Parkcom Co.ltd <simpark@ parkcom .co.kr>
Date: Mon 25/01/2016 03:39
Subject: Order PO # 10000731
Attachment: PO _ 10000731.zip
Body content:
Dear Customer,
Find attached our purchase order. Kindly quote us best price and send us proforma invoice asap, so that we can proceed with the necessary payment,We need this Order urgently. kindly confirm the PO and send PI asap.
Thank you.
Ms. Sim Park ...
Todays Date: PO _ 10000731.zip: Extracts to: PO # 10000731.exe - Current Virus total detections 9/54*
I don’t actually know what this one does. The detections are all generic detections. MALWR crashed.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3e2282111613396244b391c0e90bfe58015df75050c7b705af49b17cb66c757e/analysis/1453717414/
TCP connections
23.206.38.87: https://www.virustotal.com/en/ip-address/23.206.38.87/information/
:fear::fear: :mad:
AplusWebMaster
2016-01-26, 12:26
FYI...
Payment data security - at risk...
- http://net-security.org/secworld.php?id=19369
26 Jan 2016 - "With acceptance of mobile and other new forms of payments expected to double in the next two years, a new global study shows a critical need for organizations to improve their payment data security practices. This is according to a recent survey of more than 3,700 IT security practitioners from more than a dozen major industry sectors conducted by the Ponemon Institute for Gemalto*... 54% of those surveyed said their company had a security or data breach involving payment data, four times in past two years in average. This is not surprising given the security investments, practices and procedures highlighted by the surveyed respondents:
- 55% said they did -not- know where all their payment data is stored or located.
- Ownership for payment data security is -not- centralized with 28% of respondents saying responsibility is with the CIO, 26% saying it is with the business unit, 19% with the compliance department, 15% with the CISO, and 14% with other departments.
- 54% said that payment data security is -not- a top five security priority for their company with only one third (31%) feeling their company allocates enough resources to protecting payment data.
- 59% said their company -permits- third party access to payment data and of these only 34% utilize multi-factor authentication to secure access.
- Less than half of respondents (44%) said their companies use end-to-end encryption to protect payment data from the point of sale to when it is stored and/or sent to the financial institution.
- 74% said their companies are either -not- PCI DSS compliant or are only partially compliant.
... the study found that nearly three quarters (72%) of those surveyed believe these new payment methods are putting payment data at risk and 54% do not believe or are unsure their organization’s existing security protocols are capable of supporting these platforms..."
* http://blog.gemalto.com/blog/2016/01/26/dont-let-payment-data-security-undermine-the-business-benefits-of-mobile-payments/
26 Jan 2016
___
Fake 'Refund' SPAM - JS malware
- http://myonlinesecurity.co.uk/refund-for-the-purchase-kevin-cohen-js-malware/
26 Jan 2016 - "Another run of Nemucod downloaders today starting with an email with the subject of 'Refund for the Purchase' – Kevin Cohen [random names] pretending to come from random senders and random email addresses with a zip attachment is another one from the current bot runs... The email looks like:
From: Kevin Cohen <fonenzo@ teletu .it>
Date: Tue 26/01/2016 06:21
Subject: Refund for the Purchase – Kevin Cohen.
Attachment: Kevin Cohen.zip
We are sorry to tell you, however, the item you have purchased is not available at the moment. In the file enclosed you can see the details about the refund policy.
26 January 2016: Kevin Cohen.zip - Extracts to: Kevin Cohen.js - Current Virus total detections 6/55*
which WEPAWET** shows us downloads 3 files
http ://dertinyanl .com/img/script.php?tup1.jpg which is renamed to 3330263.exe (VirusTotal 4/54[3])
http ://dertinyanl .com/img/script.php?tup2.jpg which is renamed to 4441845.exe (VirusTotal 3/53[4])
http ://dertinyanl .com/img/script.php?tup3.jpg which is renamed to 5553619.exe (VirusTotal 3/54[5])
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like an innocent file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/daaf64d3d4e5dfbbf98a9fe2e53704849ab4cde7ffbee274263b73d3f893d849/analysis/1453800745/
** https://wepawet.iseclab.org/view.php?hash=c7b9235beadb05361939f16f6011c552&type=js
3] https://www.virustotal.com/en/file/19dc5f17df4541a92fed99faeca4a4abd61bb18c23b36a2f4dd5347aa8ef20af/analysis/1453801558/
4] https://www.virustotal.com/en/file/411a8556c44121b54597c15483251a16e983b8579ed33943b98204e8ea834dad/analysis/1453801571/
5] https://www.virustotal.com/en/file/5ff88f53f9f98c4b60a8de1f5260c67f27f7bda5d6268984b82adb3a003a3aaa/analysis/1453801579/
Nemucod malware spreads ransomware Teslacrypt:
- http://www.welivesecurity.com/2015/12/16/nemucod-malware-spreads-ransomware-teslacrypt-around-world/
___
Fake 'Bill' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/fwdbill-to-grant-morgan-word-doc-or-excel-xls-spreadsheet-malware/
26 Jan 2016 - "An email with the subject of 'Fwd: Bill to Grant Morgan' coming from random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Grant Morgan <rafael.kamal@ compume .com.eg>
Date: Tue 26/01/2016 05:25
Subject: Fwd:Bill to Grant Morgan.
Attachment: 20MEPRZ8WBE.doc
Body content:
Hello.
Please check the report attached. In order to avoid fine for delay you need to pay within 48 hours.
Best regards
Grant Morgan
-or-
Good morning.
Please see the invoice in attachment. In order to avoid penalty for delay you should pay in 24 hours.
Thanks
Barrett Watkins
26 January 2016: 20MEPRZ8WBE.doc - Current Virus total detections 2/54*
... Hybrid Analysis** eventually gave me 209743.exe (VirusTotal 3/45***) downloaded from
icenails .ro/imgwp.jpg?LJGKKxdZEHWYMi=38 .
>> http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/WP_image.png
The bad actors behind this campaign are using a new-macro-style which is long and even more complicated than previous ones... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/475a3c65e6db9e15d86b59f8faebf7f8a593fc3beb6afc6a6d53bfac1a5a7279/analysis/1453787886/
** https://www.hybrid-analysis.com/sample/475a3c65e6db9e15d86b59f8faebf7f8a593fc3beb6afc6a6d53bfac1a5a7279?environmentId=1
Contacted Hosts
188.214.17.162
110.138.108.142
*** https://www.virustotal.com/en/file/cb5a4b7b5bb1deacc27f1ae570b78b6aee9684cc5171c938fa22ec50185cbceb/analysis/1453812606/
icenails .ro: 188.214.17.162: https://www.virustotal.com/en/ip-address/188.214.17.162/information/
> https://www.virustotal.com/en/file/cb5a4b7b5bb1deacc27f1ae570b78b6aee9684cc5171c938fa22ec50185cbceb/analysis/
___
Fake 'Heating Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-alpha-heating-innovation.html
26 Jan 2016 - "This -fake- financial email is not from Alpha Heating Innovation but is instead a simple
-forgery- with a malicious attachment:
From Kurt Sexton
Date Tue, 26 Jan 2016 10:59:05 -0500
Subject =?UTF-8?B?UmVtaXR0YW5jZSBBZHZpY2UgNTk2M0U5?=
For the attention of Accounts Receivable,
We are attaching an up to date remittance advice detailing the latest payment on
your account.
Please contact us on the email address below if you would like your remittance sent
to a different email address, or have any queries regarding your remittance.
Kind regards,
Kurt Sexton
Best Regards,
Kurt Sexton
Credit Controller - Alpha Heating Innovation ...
The names of the sender and reference numbers will vary. I have only seen -two- different variants of the attachment, in the format remittance_advice5963E9.doc (VirusTotal [1] [2]) but there are probably more. Analysis is pending... It does seem to have some characterstics of a Dridex downloader."
1] https://www.virustotal.com/en/file/7c7876d03bbaec488bfc05fa0e1cfcfaf3b7e6bcf035538215ac7936db3d8e40/analysis/1453824210/
4/54 - remittance_adviceB177B0.doc
2] https://www.virustotal.com/en/file/7c640b233382a13857dc7b81c21097855ceb9c930d584c8424db7bb8512ec931/analysis/1453824233/
4/54 - remittance_advice5963E9.doc
Labels: DOC, Dridex, Malware, Spam, Viruses
- http://myonlinesecurity.co.uk/alpha-heating-innovation-remittance-advice-word-doc-malware/
26 Jan 2016 - "An email with the subject of 'Remittance Advice 17B6D1' (random numbers) pretending to come from random email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Leonardo Bryan <BryanLeonardo1689@ thedogofnashville .com>
Date: Tue 26/01/2016 14:57
Subject: Remittance Advice 17B6D1
Attachment: remittance_advice00AAD7.doc
For the attention of Accounts Receivable,
We are attaching an up to date remittance advice detailing the latest payment on your account.
Please contact us on the email address below if you would like your remittance sent to a different email address, or have any queries regarding your remittance.
Kind regards,
Leonardo Bryan
Best Regards,
Leonardo Bryan
Credit Controller – Alpha Heating Innovation...
26 January 2016: remittance_advice00AAD7.doc - Current Virus total detections 4/54*
Waiting for analysis. It is likely to be the Dridex banking malware... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/72009282af0abbf524a6a420bed8f603edaefdd40e0d6aa15ea96ab6598d90e1/analysis/1453825399/
___
TurboTax Phish
- https://security.intuit.com/alert.php?a=329
1/25/2016 - "People are receiving -fake- emails with the title containing their name. Below is a copy of the email people are receiving:
> https://security.intuit.com/images/TurboTaxPhish201252016.jpg
... Do -not- open the attachment in the email... attempts to fraudulently obtain sensitive information..."
- https://security.intuit.com/alert.php?a=328
1/25/2016 - " People are receiving -fake- emails with the title "Access to prior year returns is locked". Below is a copy of the email people are receiving:
> https://security.intuit.com/images/TurboTaxPhish101252016.jpg
... Do -not- open the attachment in the email... attempts to fraudulently obtain sensitive information..."
... more here:
>> https://security.intuit.com/security-alerts.php
:fear::fear: :mad:
AplusWebMaster
2016-01-27, 14:01
FYI...
Fake 'New Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-new-order-michelle-ludlow.html
27 Jan 2016 - "This -fake- financial spam does not come from DS Smith Plc, but is instead a simple forgery with a malicious attachment.
From Michelle Ludlow [Michelle.Ludlow@ dssmith .com]
Date Wed, 27 Jan 2016 17:27:22 +0800
Subject New Order
Hi
Please see attached for tomorrow.
Thanks
Michelle Ludlow
Customer Services Co-Ordinator - Packaging Services
Packaging Division ...
So far I have seen two different variants of the attachment doc4502094035.doc (VirusTotal [1] [2]) which according to these Malwr reports [3] [4] download a malicious executable from the following locations:
vinagps .net/54t4f4f/7u65j5hg.exe
trendcheckers .com/54t4f4f/7u65j5hg.exe
This binary has a detection rate of 5/53*. Those two Malwr reports and the VirusTotal report show the malware phoning home to:
119.160.223.115 (Loxley Wireless Co. Ltd., Thailand)
I strongly recommend that you -block- traffic to that IP. The payload is probably the Dridex banking trojan and this looks consistent with botnet 220 activity."
1] https://www.virustotal.com/en/file/6ecc8c79c0f1d4579ac9e68aeeb538199b835a8f27d51643b85a386daa5ff33c/analysis/1453887313/
2] https://www.virustotal.com/en/file/f4b65dc842ba7353e4b13211f5474d0841ef98152f1c9ab208681b25365d775e/analysis/1453887331/
3] https://malwr.com/analysis/Y2I4ZWFkZWZkNDFiNDNmZTgzN2U4ZDZhYjNiNGZjN2I/
4] https://malwr.com/analysis/MzY5MDlkZjM0YjJhNGNhOWFlYjUyN2I0M2U3MDM0MmY/
* https://www.virustotal.com/en/file/90c256f9523bdb3815d3291197583131ebf01b9731f8db76713f7b3e521b5fdc/analysis/1453887706/
TCP connections
119.160.223.115: https://www.virustotal.com/en/ip-address/119.160.223.115/information/
104.86.110.240: https://www.virustotal.com/en/ip-address/104.86.110.240/information/
- http://myonlinesecurity.co.uk/new-order-michelle-ludlow-d-s-smith-word-doc-or-excel-xls-spreadsheet-malware/
27 Jan 2016 - "An email with the subject of 'New Order' pretending to come from Michelle Ludlow <Michelle.Ludlow@ dssmith .com> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/michelle-ludlow-new-order-1024x650.png
27 January 2016: doc4502094035.doc - Current Virus total detections 5/53*
MALWR** - Downloads http ://vinagps .net/54t4f4f/7u65j5hg.exe
It is almost certain to be Dridex banking Trojan (VirusTotal 4/54***)
I am informed that an alternate download site is trendcheckers .com/54t4f4f/7u65j5hg.exe
[The Auto Analysers at payload security are under very-heavy-load this morning with hundreds of files queued and long delays. I assume the bad actors are deliberately flooding them to slow down analysis] ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f4b65dc842ba7353e4b13211f5474d0841ef98152f1c9ab208681b25365d775e/analysis/1453886419/
** https://malwr.com/analysis/Y2I4ZWFkZWZkNDFiNDNmZTgzN2U4ZDZhYjNiNGZjN2I/
112.213.95.154
119.160.223.115
13.107.4.50
*** https://www.virustotal.com/en/file/90c256f9523bdb3815d3291197583131ebf01b9731f8db76713f7b3e521b5fdc/analysis/1453886821/
TCP connections
119.160.223.115: https://www.virustotal.com/en/ip-address/119.160.223.115/information/
104.86.110.240: https://www.virustotal.com/en/ip-address/104.86.110.240/information/
___
Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-9210-dawn-salter-mrswebsolutions-word-doc-malware/
27 Jan 2016 - "An email with the subject of 'Invoice 9210' pretending to come from Dawn Salter <dawn@ mrswebsolutions .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/invoice-9210-dawn-salter-1024x802.png
27 January 2016: 9210.doc - Current Virus total detections 1/55*
This downloads Dridex banking Trojan from
http ://www .hartrijders .com/54t4f4f/7u65j5hg.exe (VirusTotal 1/55**)
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/ea62fe423a2f7f97bb93990bc42664b54e09af054fd167fa2e0fd781f265a333/analysis/1453901338/
** https://www.virustotal.com/en/file/aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d/analysis/1453902011/
- http://blog.dynamoo.com/2016/01/malware-spam-invoice-9210-dawn-salter.html
27 Jan 2016 - "... The attachment is named 9210.doc which I have seen come in -three- versions... The Malwr reports for those... shows executable download locations at:
www .cityofdavidchurch .org/54t4f4f/7u65j5hg.exe
www .hartrijders .com/54t4f4f/7u65j5hg.exe
grudeal .com/54t4f4f/7u65j5hg.exe
This binary has a detection rate of 1/53*... Hybrid Analysis of the binary shows that it phones home to:
119.160.223.115 (Loxley Wireless Co. Ltd., Thailand)
This is the -same- IP as seen in this earlier spam run**, I recommend you -block- it."
* https://www.virustotal.com/en/file/aaf789d10a3e643d1f808e2a5de084461b1f0625e88d4e800e75043b1b8d9f0d/analysis/1453903737/
** http://blog.dynamoo.com/2016/01/malware-spam-new-order-michelle-ludlow.html
___
Fake 'Enterprise Invoices' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-enterprise-invoices.html
27 Jan 2016 - "This -fake- financial spam does not come from Enterprise Security Distribution (South West) Limited but is instead a simple -forgery- with a malicious attachment.
From: Vicki Harvey
Date: 27 January 2016 at 15:30
Subject: Enterprise Invoices No.91786
Please find attached invoice/s from
Enterprise Security Distribution (South West) Limited
Unit 20, Avon Valley Business Park
St Annes Road
St Annes
Bristol
BS4 4EE
Vicki Harvey
Accountant ...
The name of the sender and references will vary. There seem to be -several- different versions of the attachment named in a format Canon-mf30102A13A@altel.kz_2615524.xls ... Analysis of the attachments is pending... attempted downloads from:
109.234.35.37 /californication/ninite.php
5.189.216.105 /californication/ninite.php
This binary has a -zero- detection rate at VirusTotal*. That VirusTotal report and this Malwr report** indicate network traffic to:
8.254.218.46 (Level 3, US)
I strongly recommend that you -block- traffic to that IP. This will be some variant of the Dridex banking trojan."
* https://www.virustotal.com/en/file/bd7334ca6a7c4fae4c49e6533e3aa139186368331e14a845a06e93d1b73a48f3/analysis/1453913182/
ninite.exe
** https://malwr.com/analysis/NjQwOTNhZjU3NDFhNDEyMzliMTQ4MzZkYzc0NGRkM2E/
109.234.35.37
103.224.83.130
8.254.249.78
- http://myonlinesecurity.co.uk/enterprise-invoices-no-84984-enterprise-security-distribution-south-west-limited-excel-xls-spreadsheet-malware/
27 Jan 2016 - "... garbled mishmash with an email with no subject coming from random senders with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... All the attachments start with the name of a scanner or multifunctional printer/scanner device, then have the -alleged- senders email domain and then random numbers so this one is called twist-scanA56CC@ fotosdeguarras .com_2782255.xls . The email looks like:
From: Maggie Nolan <NolanMaggie95043@ fotosdeguarras .com>
Date: Wed 27/01/2016 16:25
Subject: Enterprise Invoices No.84984 ( random numbers)
Attachment: twist-scanA56CC@ fotosdeguarras .com_2782255.xls
Please find attached invoice/s from
Enterprise Security Distribution (South West) Limited
Unit 20, Avon Valley Business Park
St Annes Road
St Annes
Bristol
BS4 4EE
Maggie Nolan
Accountant ...
27 January 2016: twist-scanA56CC@ fotosdeguarras .com_2782255.xls - Current Virus total detections 0/52*
MALWR** shows a download from http ://109.234.35.37 /californication/ninite.php which gave me FCGVJHads.exe
(VirusTotal 0/55***) the file looks wrong for Dridex, so I will be guided by antivirus responses as to what it actually is... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0fc743807ff0fcce578947faa3f29b24f5ad632bfc5b3af582d2ea2a270c8599/analysis/1453912101/
** https://malwr.com/analysis/NTMxMmU2MWMxN2JmNDRjMGI5MzMzMjAxYmNjODY0NmU/
109.234.35.37
103.224.83.130
13.107.4.50
*** https://www.virustotal.com/en/file/bd7334ca6a7c4fae4c49e6533e3aa139186368331e14a845a06e93d1b73a48f3/analysis/1453912539/
TCP connections
103.224.83.130: https://www.virustotal.com/en/ip-address/103.224.83.130/information/
8.254.218.46: https://www.virustotal.com/en/ip-address/8.254.218.46/information/
___
'WorldRemit Transaction' phish
- http://myonlinesecurity.co.uk/your-worldremit-account-alart-or-your-worldremit-transaction-phishing/
27 Jan 2016 - "A high proportion of phishing attempts involve PayPal, your Bank, Credit Card or another money transfer service. This one is a money transfer service that I have never previously heard of: 'WorldRemit'...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/worldremit_email2-1024x455.png
The Second one pretends to be a request to review your service on Trust Pilot:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/worldremit_email1-1024x550.png
-All- the links in -both- emails go to http ://www.simplyyankeecosmetics .com/wellsfargo.com/cgi-bin/direct.php which -redirects- to either http ://syscross .com/fb/inc/index.html or http ://www.cinit .com.mx/cli/httpswww .worldremit.comsend/LoginPage.htm
[I am sure that as the actual phish sites get blocked or taken down, these phishers will set up, yet another redirect from the first site]... Where you end up on a webpage looking like this, where some of the links are part of the phish, but some go to the genuine https ://www.worldremit .com/ web site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2016/01/world-remit-web-phish-1024x546.png
If you fill in the email-address and password you get -bounced- on to the genuine site..."
simplyyankeecosmetics .com: 192.185.78.193: https://www.virustotal.com/en/ip-address/192.185.78.193/information/
>> https://www.virustotal.com/en/url/67368193367df4caa67a65568a7b7239eaa5cb76a345b2a0a8b8ba04d2119560/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-01-28, 14:31
FYI...
Fake 'Purchase Order' SPAM - doc malware
- http://myonlinesecurity.co.uk/ikea-purchase-order-2001800526-word-doc-malware-dridex/
28 Jan 2016 - "An email with the subject of 'IKEA Purchase Order [2001800526]' with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: order@ ibxplatform .com
Date: Thu 28/01/2016 10:24
Subject: IKEA Purchase Order [2001800526]
Attachment: Purchase_Order_Number__2001800526.doc
This message contains a Purchase Order from IKEA. If you have any questions regarding this Purchase Order and its contents, we kindly ask you to contact your customer directly.
If this message is incomplete or not readable, feel free to refer to our contact details below.
Please do not reply to this message! ...
28 January 2016: Purchase_Order_Number__2001800526.doc - Current Virus total detections 2/54*
MALWR shows a download of Dridex Banking malware from
http ://astigarragakomusikaeskola .com/nuyff45d/87tf23w.exe or
http ://ponpes-alhijrah .sch.id/nuyff45d/87tf23w.exe (VirusTotal 5/54**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f92337d3097225f9c70dcc1d9064dee66a620f65c890139d4ac06efdc45e7e2a/analysis/1453980691/
** https://www.virustotal.com/en/file/9fb3128e962aa6368ae824bb176ffabf9f323520619b562eefc98a4ff82c8718/analysis/1453981023/
TCP connections
198.50.234.210
5.178.43.10: https://www.virustotal.com/en/ip-address/5.178.43.10/information/
119.160.223.115: https://www.virustotal.com/en/ip-address/119.160.223.115/information/
astigarragakomusikaeskola .com: 82.98.134.155: https://www.virustotal.com/en/ip-address/82.98.134.155/information/
ponpes-alhijrah .sch.id: 119.235.255.242: https://www.virustotal.com/en/ip-address/119.235.255.242/information/
___
Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-hayley-stoakes-96413-doc-word-doc-malware/
28 Jan 2016 - "An email with the subject of 'Invoice' pretending to come from Hayley Stoakes <hayley@ whirlowdale .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Hayley Stoakes <hayley@ whirlowdale .com>
Date: Thu 28/01/2016 11:44
Subject: Invoice
Attachment: 96413.DOC
Thank you for your order. Your Invoice – 96413 – is attached.
26 January 2016: 96413.DOC - Current Virus total detections 2/54*
.. which is exactly the -same- malware downloader as described in this earlier post** and downloads the -same- Dridex banking Trojan from the -same- locations
http ://astigarragakomusikaeskola .com/nuyff45d/87tf23w.exe or
http ://ponpes-alhijrah .sch.id/nuyff45d/87tf23w.exe ..."
* https://www.virustotal.com/en/file/f92337d3097225f9c70dcc1d9064dee66a620f65c890139d4ac06efdc45e7e2a/analysis/1453986418/
** http://myonlinesecurity.co.uk/ikea-purchase-order-2001800526-word-doc-malware-dridex/
___
Fake 'PAYMENT CONFIRMATION' SPAM - doc malware
- http://myonlinesecurity.co.uk/payment-confirmation-lesley-mawson-a-i-p-ltd-agrin-co-uk-word-doc-malware/
28 Jan 2016 - "An email with the subject of 'PAYMENT CONFIRMATION' pretending to come from Lesley Mawson <LMawson@ agrin .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Lesley Mawson <LMawson@ agrin .co.uk>
Date: Thu 28/01/2016 13:11
Subject: PAYMENT CONFIRMATION
For the attention of the accounts department.
Please find attached a copy of our payment to you.
Kind regards
Lesley
Lesley Mawson
A.I.P. Ltd
9 Wassage Way, Hampton Lovett Ind Estate, Droitwich. WR9 0NX
28 January 2016: PAYMENT VOUCHER.DOC - Current Virus total detections 2/54*
.. which is exactly the -same- malware downloader as described in this earlier post** and downloads an
-updated- Dridex banking Trojan from the -same- locations
http ://astigarragakomusikaeskola .com/nuyff45d/87tf23w.exe or
http ://ponpes-alhijrah .sch.id/nuyff45d/87tf23w.exe (VirusTotal 2/53***) which despite comments on VT shows none of the typical characteristics of common ransomware and looks much more like a Dridex banking Trojan..."
* https://www.virustotal.com/en/file/f92337d3097225f9c70dcc1d9064dee66a620f65c890139d4ac06efdc45e7e2a/analysis/1453986418/
** http://myonlinesecurity.co.uk/ikea-purchase-order-2001800526-word-doc-malware-dridex/
*** https://www.virustotal.com/en/file/df633e2734a0382ed32157f20b766040dfb9a1b32685d6b2cb6d36d3f080dc4a/analysis/1453986791/
___
iCloud Phish - used to activate Stolen iPhones
- https://blog.malwarebytes.org/phishing/2016/01/elaborate-icloud-phish-used-to-activate-stolen-iphones-2/
Jan 28, 2016 - "... Losing a device or getting it stolen can be disastrous, way beyond the monetary loss. Apple has a nifty feature which allows to remotely erase-and-lock your phone if you ever faced that problem and wanted to make sure your personal information would not fall into the wrong hands. At the same time, this renders the device -useless- for those not in possession of your ID and password:
> https://blog.malwarebytes.org/wp-content/uploads/2016/01/activate.png
'Find My iPhone Activation Lock'
> https://support.apple.com/en-ca/HT201365
This is an -inconvenience- for thieves who may want to resell those stolen phones on the black market, but crooks never lack imagination and seem to have found a way to circumvent this protection... a user claimed that -after- her iPhone was stolen, she proceeded to wipe-it and put it in 'Lost Mode', to prevent anyone from using it. Shortly after, she received a message letting her know the phone had been found -but- that she needed to go to a website and verify her Apple ID first. The site was an almost exact -replica- of Apple’s official iCloud.com and loaded fine in Safari (-no- security/phishing warning):
>> https://blog.malwarebytes.org/wp-content/uploads/2016/01/safari.png
... not many people would suspect this is a -fraudulent- website. Add to this the euphoria of knowing your precious phone was allegedly found, and proceeding to enter your Apple ID and password seems like a no brainer - Sadly, the website is a -fake- and the information entered in it is directly relayed to the crooks who stole your phone... There were several other domains residing on the same server (104.149.141.56):
find.apple-service .me
www .my-icloud .help
your.icloud-service .help
We have reported this phishing scam to Apple since Safari did -not- flag the website as -dangerous- at the time of writing... Users should be particularly careful of schemes that leverage the emotions involved with the theft or loss of their devices. Online crooks have no shame in abusing their victims twice to get what they want."
104.149.141.56: https://www.virustotal.com/en/ip-address/104.149.141.56/information/
___
Business Email Compromise - Fraud ...
- http://blog.trendmicro.com/trendlabs-security-intelligence/battling-business-email-compromise-fraud-how-do-you-start/
Jan 26, 2016 - "What will you do if an executive in your company gives you instructions to wire money for a business expense? On email? In a world where cybercriminals devise devious social engineering and computer intrusion schemes to fool employees into wiring money, enterprises run a very serious -risk- of getting -scammed- via email. This emerging global threat is known as the 'business email compromise (BEC)' and it has already victimized 8,179 companies in 79 countries between October 2013 and August 2015 alone*:
* https://www.ic3.gov/media/2015/150827-1.aspx#ref2
... Multiple warnings were issued by the FBI as to these types of emails in the past year alone. The FBI notes the targets to be companies working with foreign suppliers and/or those that regularly perform wire transfer payments. By February last year, the total number of reported victims had reached 2,126 and the money lost amounted to roughly US $215 million. Come August, the victim numbers have ballooned to 8,179, the money lost added to nearly US $800 million. How can you protect your company from becoming a part of this statistic?
- Know the Basics...
- Familiarize with Past Scams...
- Gear Up Against BEC Threats...
... install email security solutions to block known BEC-related malware before they come in..."
(More detail at the trendmicro URL above.).
:fear::fear: :mad:
AplusWebMaster
2016-01-29, 14:57
FYI...
Fake 'Despatch Note' SPAM - doc malware
- http://myonlinesecurity.co.uk/despatch-note-ffgdes34309-foyle-food-group-limited-word-doc-malware/
29 Jan 2016 - "An email with the subject of 'Despatch Note FFGDES34309' pretending to come from Foyle Food Group Limited <accounts@ foylefoodgroup .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Foyle Food Group Limited <accounts@ foylefoodgroup .com>
Date: Fri 29/01/2016 09:17
Subject: Despatch Note FFGDES34309
Attachment: FFGDES34309.doc
Please find attached Despatch Note FFGDES34309
29 January 2016: FFGDES34309.doc - Current Virus total detections 5/54*
Downloads Dridex banking malware from jjcoll .in/56gf/g545.exe (VirusTotal 2/54**)
Other download locations include http ://romana .fi/56gf/g545.exe and
http ://clickchiropractic .com/56gf/g545.exe
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0948b607da8e1dbfb5f235c9005d634afdf477a2ee9e8e344ccf445f41b195dc/analysis/1454062970/
** https://www.virustotal.com/en/file/ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f/analysis/1454062183/
jjcoll .in: 198.12.152.113: https://www.virustotal.com/en/ip-address/198.12.152.113/information/
romana .fi: 217.78.212.183: https://www.virustotal.com/en/ip-address/217.78.212.183/information/
clickchiropractic .com: 50.87.150.204: https://www.virustotal.com/en/ip-address/50.87.150.204/information/
- http://blog.dynamoo.com/2016/01/malware-spam-despatch-note-ffgdes34309.html
29 Jan 2016 - "This -fake- financial spam is not from Foyle Food Group Limited but is instead a simple -forgery- with a malicious attachment:
From Foyle Food Group Limited [accounts@ foylefoodgroup .com]
Date Fri, 29 Jan 2016 17:58:37 +0700
Subject Despatch Note FFGDES34309
Please find attached Despatch Note FFGDES34309
... The attachment is FFGDES34309.doc which comes in three different variants, downloading from:
jjcoll .in/56gf/g545.exe
romana .fi/56gf/g545.exe
clickchiropractic .com/56gf/g545.exe
This has... a detection rate of 6/49*. According to my contact, this phones home to:
85.143.166.200 (Pirix, Russia)
103.245.153.70 (OrionVM, Australia)
144.76.73.3 (Hetzner, Germany)
This drops the Dridex banking trojan. The behaviour is consistent with botnet 220."
Recommended blocklist:
85.143.166.200
103.245.153.70
144.76.73.3 "
* https://www.virustotal.com/en/file/ab8fc800b3974b0b41bf6a5d74bb6932239c27a1a95cd4c128af2057b6909a5f/analysis/
TCP connections
85.143.166.200: https://www.virustotal.com/en/ip-address/85.143.166.200/information/
8.254.218.30: https://www.virustotal.com/en/ip-address/8.254.218.30/information/
___
Fake 'Scanned image' SPAM - doc malware
- http://myonlinesecurity.co.uk/scanned-image-from-copiervictimdomain-tld-word-doc-malware/
29 Jan 2016 - "An email with the subject of 'Scanned image from copier@ victimdomain .tld' pretending to come from copier@ victimdomain .tld with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: copier@ victmdomain .tld
Date: Fri 29/01/2016 11:02
Subject: Scanned image from copier@ victimdomain .tld
Attachment: copier@ ...co.uk_20160129_084903.doc
Body content:
Reply to: copier@ ...co.uk <copier@ ...co.uk>
Device Name: COPIER
Device Model: MX-2310U
File Format: DOC (Medium)
Resolution: 200dpi x 200dpi
Attached file is scanned document in DOC format...
29 January 2016: copier@ ...co.uk_20160129_084903.doc - This is exactly the -same- malware which downloads the -same- Dridex banking malware from the -same- locations as described in this earlier post*..."
* http://myonlinesecurity.co.uk/despatch-note-ffgdes34309-foyle-food-group-limited-word-doc-malware/
___
Fake 'Resume' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/01/malware-spam-quick-question-resumertf.html
29 Jan 2016 - "This spam leads to malware:
From: Laurena Washabaugh [washabaugh .1946@ rambler .ru]
Date: 29 January 2016 at 10:10
Subject: Quick Question
Signed by: rambler .ru
What's going on?
I was visting your website on 1/29/2016 and I'm very interested.
I'm currently looking for work either full time or as a intern to get experience in the field.
Please review my CV and let me know what you think.
Best regards,
Laurena Washabaugh
The attachment is named Resume.rtf, but is it actually a DOCX file with a malicious macro... the document has a VirusTotal detection rate of 9/54*... but these automated analyses [1] [2] [3] show it phoning home to:
89.248.166.131 (Quasi Networks, Seychelles)
I recommend that you -block- traffic to that IP..."
* https://www.virustotal.com/en/file/8da85186a941010216264d11872461a43a71f2cfe50c68b698b181984c2e5555/analysis/1454068566/
1] https://malwr.com/analysis/ZDYyOTUzM2YyMjc3NDg3MWI0ZTFkYzkxZDEzNWM1Y2U/
2] https://www.hybrid-analysis.com/sample/8da85186a941010216264d11872461a43a71f2cfe50c68b698b181984c2e5555?environmentId=1
3] https://www.hybrid-analysis.com/sample/8da85186a941010216264d11872461a43a71f2cfe50c68b698b181984c2e5555?environmentId=4
89.248.166.131: https://www.virustotal.com/en/ip-address/89.248.166.131/information/
- http://myonlinesecurity.co.uk/quick-question-resume-word-doc-or-excel-xls-spreadsheet-malware/
29 Jan 2016 - "An email with the subject of 'Quick Question' pretending to attach a -resume- coming from random senders with a malicious word rtf attachment which is actually a word docx file is another one from the current bot runs... The email looks like:
From: Robbi Aguinaldo <aguinaldo.1993@ rambler .ru>
Date: Fri 29/01/2016 08:18
Subject: Quick Question
Attachment: Resume.rtf
Howdy
I was visting your website on 1/29/2016 and I’m very interested.
I’m currently looking for work either full time or as a intern to get experience in the field.
Please review my CV and let me know what you think.
In appreciation,
Robbi Aguinaldo
29 January 2016: Resume.rtf - Current Virus total detections 0/55*
* https://www.virustotal.com/en/file/0106fb75b71145360c2bdf9dd5c1e6c01ff413da6ec79f4fba4ef92d629cec3e/analysis/1449129718/
.. which downloads the following files:
http ://89.248.166.131/jer.jpg?810 (Currently unavailable)
> 89.248.166.131: https://www.virustotal.com/en/ip-address/89.248.166.131/information/
http ://91.224.161.116/clv002/f32.bin (VirusTotal 0/55**) which the malicious macro alters/decodes/creates several of the below files:
> cccyk7m15911_1.exe
- https://www.virustotal.com/en/file/aec036c47477bf4eb8c5fb2532c14382f342e326208a408491f41951edd2d775/analysis/1454087239/
> http ://192.227.181.211/foru.exe saved as: cigiquk79yycc7.exe
- https://www.virustotal.com/en/file/197825b1c0b4384ca664881b192ad7be03faf2d3ff9f022a69c5cd784a762329/analysis/1454087310/
>FASDA.exe
- https://www.virustotal.com/en/file/6ce5a0b0befcd940b358188569ad15f4a2c357f92e60d35d0c2264a0ce3a685c/analysis/1454087462/
> http ://89.248.166.131/1.exe saved as: m3q3c5s79uy5k95.exe
- https://www.virustotal.com/en/file/d3e2bcad9a23187034f5d1db158fea136501b61bf1d7298496bdcf2d484e2506/analysis/1454087618/
> MQERY.exe
- https://www.virustotal.com/en/file/5993cc7598d3e8ac17bbb57ed586d172ebe4672fcee3e88a07acd32f2fa3a101/analysis/1454087665/
... This email attachment contains what appears to be a genuine word doc or Excel XLS spreadsheet with either a macro script or an embedded OLE object that when run will infect you... DO NOT follow the advice they give to enable macros or enable editing to see the content... DO NOT click on it or try to open it..."
** https://www.virustotal.com/en/file/0106fb75b71145360c2bdf9dd5c1e6c01ff413da6ec79f4fba4ef92d629cec3e/analysis/1449129718/
rambler .ru: 81.19.93.6: https://www.virustotal.com/en/ip-address/81.19.93.6/information/
81.19.77.5: https://www.virustotal.com/en/ip-address/81.19.77.5/information/
81.19.77.6: https://www.virustotal.com/en/ip-address/81.19.77.6/information/
81.19.93.5: https://www.virustotal.com/en/ip-address/81.19.77.5/information/
> https://www.virustotal.com/en/url/33e5623214a2caa51f4954caec7475189377a9c8bc2447c55eeda624c23894bd/analysis/
0/66
___
HSBC internet banking services down after cyber attack
- http://www.reuters.com/article/us-hsbc-cyber-idUSKCN0V71BO
Jan 29, 2016 - "HSBC is working with law enforcement to catch those behind a cyber attack that forced its personal banking websites in the UK to shutdown, its second major service outage this month, the bank said on Friday. Europe's largest lender said it had "successfully defended" its systems against a distributed denial of service (DDoS) attack but it was experiencing fresh threats, impeding full restoration of its services... The outage began on Friday morning and online services were still down by 1630 GMT (11:30 a.m. ET). DDoS attacks are often used by cyber criminals trying to disrupt businesses and companies with significant online activities..."
___
GitHub Blog:
Update on 1/28 service outage:
- https://github.com/blog/2101-update-on-1-28-service-outage
Jan 29, 2016 - "On Thursday, January 28, 2016 at 00:23am UTC, we experienced a severe service outage that impacted GitHub.com... A brief power disruption at our primary data center caused a cascading failure that impacted several services critical to GitHub.com's operation. While we worked to recover service, GitHub.com was unavailable for two hours and six minutes. Service was fully restored at 02:29am UTC. Last night we completed the final procedure to fully restore our power infrastructure..."
:fear::fear: :mad:
AplusWebMaster
2016-02-01, 14:13
FYI...
Fake 'Order Processed' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-order-processed-noreply.html
1 Feb 2016 - "This -fake- financial spam does not come from Duration Windows but is instead a simple -forgery- with a malicious attachment:
From NoReply-Duration Windows [noreply@ duration .co.uk]
Date Mon, 01 Feb 2016 04:21:03 -0500
Subject Order Processed.
Dear Customer,
Please find details for your order attached as a PDF to this e-mail.
Regards,
Duration Windows
Sales Department ...
I have only seen a single sample of this spam with an attachment V9568HW.doc which has a detection rate of 5/54*... likely to be the Dridex banking trojan.
UPDATE: The Malwr analysis** shows that the document downloads a malicious executable from:
www .peopleond-clan .de/u56gf2d/k76j5hg.exe
This has a VirusTotal detection rate of 4/54*** and those reports plus this Hybrid Analysis[4] show it phoning home to:
185.24.92.236 (System Projects LLC, Russia)
I strongly recommend that you -block- traffic to that IP."
* https://www.virustotal.com/en/file/66ee53feafb8bd00d44cb5cb002fdf16298fa44d9925d25045ed8a61a2f9ff01/analysis/1454322319/
** https://malwr.com/analysis/ZGNhYjJhMDc2ZjQ1NGNjY2FjZWY4MDZlYjk0YzlhOWU/
*** https://www.virustotal.com/en/file/d08ff2a892410af0b7c130106ec95f6078f4eebdedc86c386f392c2271d12298/analysis/1454323739/
4] https://www.hybrid-analysis.com/sample/d08ff2a892410af0b7c130106ec95f6078f4eebdedc86c386f392c2271d12298?environmentId=4
- http://myonlinesecurity.co.uk/order-processed-duration-windows-word-doc-malware/
1 Feb 2016 - "An email with the subject of 'Order Processed' ... with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: NoReply-Duration Windows <noreply@ duration .co.uk>
Date: Mon 01/02/2016 10:16
Subject: Order Processed.
Attachment: V9568HW.doc
Dear Customer,
Please find details for your order attached as a PDF to this e-mail.
Regards, Duration Windows Sales Department ...
1 February 2016: V9568HW.doc - Current Virus total detections 4/55*
MALWR** shows downloads Dridex banking malware from
http ://iamnickrobinson .com/u56gf2d/k76j5hg.exe (VirusTotal 3/53***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/003837a453ab7dd0dda51804f4208b10009dc33a9a909e9689b82a1b993deea1/analysis/1454322062/
** https://malwr.com/analysis/ZmFkM2JiMTg0NWNjNGMzY2JkNjMzZGZlZDdhMzY3NmQ/
74.86.19.136: https://www.virustotal.com/en/ip-address/74.86.19.136/information/
185.24.92.236: https://www.virustotal.com/en/ip-address/185.24.92.236/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
*** https://www.virustotal.com/en/file/d08ff2a892410af0b7c130106ec95f6078f4eebdedc86c386f392c2271d12298/analysis/1454325006/
TCP connections
185.24.92.236: https://www.virustotal.com/en/ip-address/185.24.92.236/information/
2.22.22.113: https://www.virustotal.com/en/ip-address/2.22.22.113/information/
___
Fake 'Invoice INV19' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-invoice-123456-from.html
1 Feb 2016 - "This spam appears to originate from a -variety- of companies with -different- references. It comes with a malicious attachment.
From: Marisol Barrett [BarrettMarisol04015@ victimdomain .tld]
Date: 1 February 2016 at 08:39
Subject: Invoice 48014 from JKX OIL & GAS
Dear Customer,
Your invoice appears below. Please remit payment at your earliest convenience.
Thank you for your business - we appreciate it very much.
Sincerely,
Marisol Barrett ...
From: Oswaldo Browning [BrowningOswaldo507@ victimdomain .tld]
Date: 1 February 2016 at 09:38
Subject: Invoice 865272 from J P MORGAN PRIVATE EQUITY LTD
Dear Customer,
Your invoice appears below. Please remit payment at your earliest convenience.
Thank you for your business - we appreciate it very much.
Sincerely,
Oswaldo Browning
J P MORGAN PRIVATE EQUITY LTD ...
The attachment is in the format INV19 - 865272.doc (it always starts with "INV19" and then has the -fake- reference number). There are at least -three- different versions...
UPDATE 2: The Malwr analysis of three of the attachments [1] [2] [3] shows download locations of:
31.131.24.203/indiana/jones.php
31.41.45.23/indiana/jones.php
These IPs can be considered as -malicious- and belong to:
31.131.24.203 (PE Skurykhin Mukola Volodumurovuch, Ukraine)
31.41.45.23 (Relink LTD, Russia)
This drops a -malicious- binary with a detection rate of 2/53*. This phones home to:
185.24.92.229 (System Projects, LLC, Russia)
This spam appears to be the Dridex banking trojan (botnet 120 perhaps).
Recommended blocklist:
185.24.92.229
31.131.24.203
31.41.45.23 "
1] https://malwr.com/analysis/NDQyZDUwNTJhZTU1NDE2ZjliMDJkNTViOGNlMzQyMWE/
2] https://malwr.com/analysis/NzAwMmM2ZmE3NDgwNDZlMGFkMDY0ODM3MWU0OTI2YTk/
3] https://malwr.com/analysis/NTg1ZmNjNzI1ODkxNDljOGJjNWIwMTA1OWQ5YTA0OWE/
* https://www.virustotal.com/en/file/64a224eb58960a2919d7cef376e870640a94c673a47764396ea9d3c395bb8b31/analysis/#
- http://myonlinesecurity.co.uk/invoice-882596-from-adamas-finance-asia-ltd-pretending-to-come-from-your-own-email-domain-word-doc-malware-broken/
1 Feb 2016 - "An email with the subject of 'Invoice' (random number) from Random companies pretending to come from random names at your own email domain with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
1 February 2016: INV19 – 882596.doc - Current Virus total detections 2/54*
MALWR** shows a download from http ://31.41.45.23/indiana/jones.php
which gave me crypted120med.exe (VirusTotal 2/53***)..."
* https://www.virustotal.com/en/file/d6fafef771afba73baf8a13b15cfe70a58d848ed15fa9a189e66e27e8bd76bb2/analysis/1454319886/
** https://malwr.com/analysis/NTk2NmJiN2M0YWYzNDEwODk0MzFhMzM0Zjg1ZmM1NGU/
*** https://www.virustotal.com/en/file/64a224eb58960a2919d7cef376e870640a94c673a47764396ea9d3c395bb8b31/analysis/1454322842/
___
Fake 'Scanned image' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-scanned-image-from.html
1 Feb 2016 - "This -fake- document scan appears to originate from within the victim's own domain, but it doesn't. Instead this is a simple -forgery- with a malicious attachment.
From: copier@ victimdomain .tld
Date: 1 February 2016 at 12:11
Subject: Scanned image from copier@ victimdomain .tld
Reply to: copier@ victimdomain .tld [copier@ victimdomain .tld]
Device Name: COPIER
Device Model: MX-2310U
File Format: DOC (Medium)
Resolution: 200dpi x 200dpi
Attached file is scanned document in DOC format...
I have seen two different versions of the attached document, named in a format copier@ victimdomain .tld_20160129_084903.doc. The detection rate for both is 6/54 [1] [2] and the Malwr report* for one of them shows the macro downloading from:
dulichando .org/u56gf2d/k76j5hg.exe
This executable has a detection rate of 4/53** and the Hybrid Analysis reports*** that it phones home to:
185.24.92.236 (System Projects LLC, Russia)
I strongly recommend that you -block- traffic to that IP. The payload is Dridex, as seen here****."
1] https://www.virustotal.com/en/file/003837a453ab7dd0dda51804f4208b10009dc33a9a909e9689b82a1b993deea1/analysis/1454332258/
2] https://www.virustotal.com/en/file/a9eb20b8bbaf117bb82725139188676c1a89811570c6d71e97a2baa7edc83823/analysis/1454332268/
* https://malwr.com/analysis/M2RhNmU5OGI4Mjk5NDQyOWJkYTBjZmZiZTM0NDY3YjY/
** https://www.virustotal.com/en/file/ba64cea40ff6f97c638b7a162ef26f5de685868942d6203c2bbc3d71c17ea348/analysis/1454332659/
*** https://www.hybrid-analysis.com/sample/ba64cea40ff6f97c638b7a162ef26f5de685868942d6203c2bbc3d71c17ea348?environmentId=4
**** http://blog.dynamoo.com/2016/02/malware-spam-order-processed-noreply.html
:fear::fear: :mad:
AplusWebMaster
2016-02-02, 11:32
FYI...
Fake 'Order Dispatch' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/order-dispatch-aa608034-word-doc-or-excel-xls-spreadsheet-malware/
2 Feb 2016 - "An email with the subject of 'Order Dispatch: AA608034' (random order numbers) pretending to come from aalabels <customercare45660@ aalabels .com> (random customercare numbers) with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/AA-labels-Order-Dispatch-AA608034-1024x549.png
2 February 2016: invoice_AA608034.doc - Current Virus total detections 4/52*
Downloads Dridex Banking malware from
hebenstreit .us.com/5h4g/0oi545gfgf.exe (VirusTotal 3/51**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0902b54fd8eb2455beb7e69e92f59988de7337e9f2406a0e209209f8bd2347d8/analysis/
** https://www.virustotal.com/en/file/2f7210a1359cb31053e09c241a8b0d24cf5047ad118678a6f1ea5b17205a6c6a/analysis/1454402505/
TCP connections
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
90.84.59.9: https://www.virustotal.com/en/ip-address/90.84.59.9/information/
- http://blog.dynamoo.com/2016/02/malware-spam-order-dispatch-aa207241.html
2 Feb 2016 - "This -fake- financial spam is not from aalabels .com but is instead a simple -forgery- with a malicious attachment.
Screenshot: https://3.bp.blogspot.com/-WM975r0NVVw/VrB1YUEuNvI/AAAAAAAAHlk/NaWrHYjT6tU/s640/aalabels.png
The sender's email address and detail will vary from email to email, however they all follow the same format. Attached is a file with a name along the lines of invoice_AA123456.doc which comes in at least -three- different versions... Malwr reports... show the macro in the documents downloading from one of the folllowing locations:
timestyle .com.au/5h4g/0oi545gfgf.exe
hebenstreit .us.com/5h4g/0oi545gfgf.exe
fillingsystem .com/5h4g/0oi545gfgf.exe
This binary has a detection rate of 5/52*... Malwr reports show it phoning home to:
91.239.232.145 (Hostpro Ltd, Ukraine)
I would strongly recommend -blocking- traffic to that IP, or indeed you can probably block the entire 91.239.232.0/22 range will no ill effects."
* https://www.virustotal.com/en/file/2f7210a1359cb31053e09c241a8b0d24cf5047ad118678a6f1ea5b17205a6c6a/analysis/1454404870/
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
90.84.59.9: https://www.virustotal.com/en/ip-address/90.84.59.9/information/
___
Fake 'New order' SPAM - malware
- http://myonlinesecurity.co.uk/corcom-co-ltd-new-order-enquiry-206754-malware/
2 Feb 2016 - "An email with the subject of 'New order Enquiry 206754' pretending to come from Corcom Co ltd <corcom@ bnisyariah .co.id> with a zip attachment is another one from the current bot runs... The email looks like:
From: Corcom Co ltd <corcom@ bnisyariah .co.id>
Date: Tue 02/02/2016 03:13
Subject: New order Enquiry 206754
Attachment: Enquiry 206754.zip
Dear Customer,
Find attached our purchase order. Kindly quote us best price and send
us proforma invoice asap, so that we can proceed with the necessary
payment,We need this Order urgently. kindly confirm the PO and send PI
asap.
Thank you.
Ms. Sim Rabim
Jl. M.H. Thamrin 59 Jakarta 10350 ? Indonesia ...
2 February 2016: Enquiry 206754.zip: Extracts to: Enquiry 206754.exe - Current Virus total detections 14/52*
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will be hidden instead of showing it as the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/7a2e5795279ce21dbfc89b6b3b47623487de2d51585fdbca46d0a5dc00db5813/analysis/1454400171/
___
Fake 'PURCHASE' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-purchase-02022016-d1141.html
2 Feb 2016 - "This spam does not come from Flower Vision but is instead a simple -forgery- with a malicious attachment:
From: sales@ flowervision .co.uk
Date: 2 February 2016 at 08:28
Subject: PURCHASE 02/02/2016 D1141
FLOWERVISION
Internet Order Confirmation
Page
1/1 ...
Attached is a file SALES_D1141_02022016_164242.xls which I have seen just one version of, with a detection rate of 1/50*. This Hybrid Analysis** shows the macro in the spreadsheet downloading from:
www .torinocity .it/5h4g/0oi545gfgf.exe
This binary has a detection rate of 5/51***, and is the same payload as seen earlier****."
* https://www.virustotal.com/en/file/05684d7b50b96b05f80ad93a939441e9ec233787d408fd97de92e5294b4656cc/analysis/1454406875/
** https://www.hybrid-analysis.com/sample/05684d7b50b96b05f80ad93a939441e9ec233787d408fd97de92e5294b4656cc?environmentId=1
*** https://www.virustotal.com/en/file/2f7210a1359cb31053e09c241a8b0d24cf5047ad118678a6f1ea5b17205a6c6a/analysis/1454407813/
TCP connections
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
90.84.59.9: https://www.virustotal.com/en/ip-address/90.84.59.9/information/
**** http://blog.dynamoo.com/2016/02/malware-spam-order-dispatch-aa207241.html
- http://myonlinesecurity.co.uk/purchase-02022016-d1141-flowervision-co-uk-excel-xls-spreadsheet-malware-dridex/
2 Feb 2016 - "An email with the subject of 'PURCHASE 02/02/2016 D1141' pretending to come from sales@ flowervision .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/PURCHASE-02022016-D1141-1024x586.png
25 February 2015: SALES_D1141_02022016_164242.xls ...
Downloads Dridex from same locations as today’s earlier Malspam*. This one is
http ://www .fabian-enkenbach .de/5h4g/0oi545gfgf.exe (VirusTotal 5/51**)..."
* http://myonlinesecurity.co.uk/order-dispatch-aa608034-word-doc-or-excel-xls-spreadsheet-malware/
** https://www.virustotal.com/en/file/2f7210a1359cb31053e09c241a8b0d24cf5047ad118678a6f1ea5b17205a6c6a/analysis/1454407813/
TCP connections
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
90.84.59.9: https://www.virustotal.com/en/ip-address/90.84.59.9/information/
___
Fake 'RB0081 INV' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-rb0081-inv2372039-sales.html
2 Feb 2016 - "This -fake- financial spam does not come from Leathams but is instead a simple -forgery- with a malicious attachment.
From: Sales invoice [salesinvoice@ leathams .co.uk]
Reply-To: "no-reply@ leathams .co.uk" [no-reply@ leathams .co.uk]
Date: 2 February 2016 at 13:15
Subject: RB0081 INV2372039
Dear Sir/Madam,
Please find attached your sales invoice(s) for supplied goods. Please process for payment as soon as possible.
In the event that you have a query - please direct your query...
Attached is a malicious document Leathams Ltd_INV2372039.doc which comes in at least -two- different versions... The Malwr analysis for one of those samples shows a download from:
fillingsystem .com/5h4g/0oi545gfgf.exe
This is similar to a spam run earlier, but now the payload has changed to one with a detection rate of precisely zero*... The payload is the Dridex banking trojan.
UPDATE: Automated analysis [1] [2] shows the executable phoning home to:
91.239.232.145 (Hostpro Ltd, Ukraine)
I strongly recommend -blocking- traffic to that IP, or the whole /22 in which it resides."
* https://www.virustotal.com/en/file/f4001a9689c75dde20769e62157aef1e6eb92b1f66aca8870be48d927b07981e/analysis/1454419546/
0/53
1] https://malwr.com/analysis/Y2EwMjNkOGY2OGU2NGUyZGIzZTQzZGQyMzM5YWZhMTM/
2] https://www.hybrid-analysis.com/sample/f4001a9689c75dde20769e62157aef1e6eb92b1f66aca8870be48d927b07981e?environmentId=1
- http://myonlinesecurity.co.uk/rb0081-inv2372039-leathams-co-uk-word-doc-malware/
2 Feb 2016 - "An email with the subject of 'RB0081 INV2372039' pretending to come from Sales invoice <salesinvoice@ leathams .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Sales invoice <salesinvoice@ leathams .co.uk>
Date: Tue 02/02/2016 12:13
Subject: RB0081 INV2372039
Attachment: Leathams Ltd_INV2372039.doc
Dear Sir/Madam,
Please find attached your sales invoice(s) for supplied goods. Please process for payment as soon as possible.
In the event that you have a query – please direct your query...
2 February 2016: Leathams Ltd_INV2372039.doc - Current Virus total detections 4/54*
downloads Dridex banking malware from the same locations as today’s earlier malspams**. This example connects to http ://fillingsystem .com/5h4g/0oi545gfgf.exe which delivers an updated Dridex version to the earlier ones (VirusTotal 0/53***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0d86a3da5c6e173d6476010831bb360c96a52323a56910c6da1baca6b0755406/analysis/1454417962/
** http://myonlinesecurity.co.uk/order-dispatch-aa608034-word-doc-or-excel-xls-spreadsheet-malware/
*** https://www.virustotal.com/en/file/f4001a9689c75dde20769e62157aef1e6eb92b1f66aca8870be48d927b07981e/analysis/1454419046/
:fear::fear: :mad:
AplusWebMaster
2016-02-03, 12:54
FYI...
Turning Off Specific Files from Previewing in the Microsoft Outlook Reading Pane
- http://windowsitpro.com/outlook/turning-specific-files-previewing-microsoft-outlook-reading-pane
Block Certain File Types from Opening in Associated Office Applications
- http://windowsitpro.com/microsoft-office/block-certain-file-types-opening-associated-office-applications
>> http://myonlinesecurity.co.uk/malformed-infected-word-docs-embedded-macro-viruses/
3 Feb 2016
___
Security flaws discovered in smart toys and kids' watches
- http://net-security.org/secworld.php?id=19404
3 Feb 2016 - "Rapid7 researchers* have unearthed serious flaws in two 'Internet of Things' devices:
• The Fisher-Price Smart Toy, a "stuffed animal" type of toy that can interact with children and can be monitored via a mobile app and WiFi connectivity, and
• The hereO GPS Platform, a smart GPS toy watch that allows parents to track their children's physical location.
In both cases the problem was with the authentication process, i.e. in the platform's web service (API) calls. In the first instance, the API calls were not appropriately verified, so an attacker could have sent unauthorized requests and extract information such as customer details, children's profiles, and more... In the second instance, the flaw allowed attackers to gain access to the family's group by adding an account to it, which would allow them to access the family member's location, location history, etc. "We have once again been able to work with vendors to resolve serious security issues impacting their platforms and hope that vendors considering related products are able to take note of these findings so that the overall market can improve beyond just these particular instances," noted Mark Stanislav, manager of global services at Rapid7*... "
* https://community.rapid7.com/community/infosec/blog/2016/02/02/security-vulnerabilities-within-fisher-price-smart-toy-hereo-gps-platform
Feb 2, 2016
___
Fake 'Free Travel Lottery' SPAM - doc malware
- http://myonlinesecurity.co.uk/free-travel-lottery-drawing-viator-com-word-doc-malware/
3 Feb 2016 - "An email with the subject of 'Free Travel Lottery Drawing' pretending to come from VIATOR.COM <winners@ viator .com> with a malicious word doc attachment is another one from the current bot runs.. The email looks like:
From: VIATOR .COM <winners@ viator .com>
Date: Wed, 3 Feb 2016 16:14
Subject: Free Travel Lottery Drawing
Attachment: winner_81.doc
ATripAdvisor®Company
Unforgettable time in the place where summer never ends!
We held a lottery drawing among the customers of our travel agency Viator!
Free travel for 2 persons to a Paradise Island Koh-Samui, in Kingdom of Thailand for 10 days! Travel insurance included!
2,500,000 our customers took participation in the lottery. Only 250 winners!
To learn more about the tour and your Winner Bonus become familiar with the attached document...
3 February 2015: winner_81.doc - Current Virus total detections 1/54*
MALWR** shows downloads http ://finiki45toget .com/post/511plvk.exe (virustotal 2/52***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/023fae4281bc3b6e9f037d0c2318114f3d20aa1245ddbbe36b7bd9b454974fe4/analysis/1454514245/
** https://malwr.com/analysis/ZDgyZmI0ZTg4YTZlNDJjYWIzNzEzY2Y5NzZiNzc3ODg/
163.20.136.189: https://www.virustotal.com/en/ip-address/163.20.136.189/information/
>> https://www.virustotal.com/en/url/bceb4c37e7a2714dc50bb69529e12cb36136b728dc2bbcc31d688f6e7f6d588a/analysis/
*** https://www.virustotal.com/en/file/b794083293012b57b26aef905133a889d1cb825d3ae9210ee0645f67390cf5bd/analysis/1454512889/
___
Fake 'Invoice (SI-523)' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-gs-toilet-hire-invoice-si.html
3 Feb 2016 - "This -fake- financial spam does not come from GS Toilet Hire but is instead a simple -forgery- with a malicious attachment. In other words, if you open it.. [don't].
From: GS Toilet Hire [donotreply@ sageone .com]
Date: 3 February 2016 at 09:12
Subject: GS Toilet Hire - Invoice (SI-523) for £60.00, due on 28/02/2016
Good morning
Thank you for your business - we're pleased to attach your invoice in PDF. Please bear in mind that if we are in the area the price is reduced to £15+vat per visit.
Full details, including payment terms, are included.
If you have any questions, please don't hesitate to contact us.
Kind regards,
Linda Smith
Office, GS Toilet Hire ...
I have seen two samples of this, both with an attachment named Sales_Invoice_SI-523_GS Toilet Hire.pdf.zip which contains a malicious Javascript file with a name like invoice_id6395788111.js. The two samples that I have seen have low detection rates... containing some highly obfuscated scripts... which... downloads a binary from one of the following locations:
obstipatie..nu/43rf3dw/34frgegrg.exe
bjhaggerty..com/43rf3dw/34frgegrg.exe
(also www .ni-na27.wc.shopserve .jp/43rf3dw/34frgegrg.exe ...)
This type of download indicates that this is Dridex 220, it is unusual for it to be spammed out with a Javascript-in-ZIP format rather than a malicious Office macro... The binary... shows the malware phoning home to:
91.239.232.145 (Hostpro Ltd, Ukraine)
I strongly recommend that you -block- all traffic to that IP, and possibly the 91.239.232.0/22 block in which it resides.
UPDATE: The same spam is being sent out with a more traditional DOC attachment, Sales_Invoice_SI-523_GS Toilet Hire.doc which comes in at least two different variants (VirusTotal [1] [2]) which according to these Malwr reports [3] [4] downloads a binary from the following locations:
xinchunge .com/xinchunge.com/43rf3dw/34frgegrg.exe
taukband .com/43rf3dw/34frgegrg.exe
This is a different binary from before, with a detection rate of 4/53*. It still phones home to the same location."
1] https://www.virustotal.com/en/file/a29436ba6ba2d2efffa83a215395e99510e19cecdce14758a90bc38a816a91a5/analysis/1454494549/
2] https://www.virustotal.com/en/file/5f3c2fa3d7763e46ecc5d076a248806a47bf63285b20cb990f463a82c741bfca/analysis/1454494559/
3] https://malwr.com/analysis/YjBlMDMzZTExNjBiNGNhOTk4YjJkMWZhMTkwZmRlYzE/
98.143.159.150
91.239.232.145
13.107.4.50
4] https://malwr.com/analysis/YWZiMGE1MTc1NjRjNGZiY2ExZGFiMmQwMGQwZjczZDU/
192.186.239.3
91.239.232.145
184.25.56.44
* https://www.virustotal.com/en/file/993c03b02820be8d8128b85ad6423d06341deb964794d032bf867415888f3f67/analysis/
- http://myonlinesecurity.co.uk/gs-toilet-hire-invoice-si-523-for-60-00-due-on-28022016-js-malware-or-word-doc-leading-to-dridex/
3 Feb 2016 - "... an email with the subject of 'GS Toilet Hire – Invoice (SI-523) for £60.00, due on 28/02/2016' pretending to come from GS Toilet Hire <donotreply@ sageone .com> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/GS-Toilet-Hire-Invoice-SI-523-for-%C2%A360-1024x515.png
- or: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/GS-Toilet-Hire-Invoice-SI-523-for-%C2%A360_doc_version-1024x515.png
3 February 2016: Sales_Invoice_SI-523_GS Toilet Hire.pdf.zip - Extracts to: invoice_id2677432297.js
Current Virus total detections 2/54*. MALWR**
3 February 2016: Sales_Invoice_SI-523_GS Toilet Hire.doc - VirusTotal 3/52***
downloads what looks like -Dridex- from xinchunge .com/xinchunge.com/43rf3dw/34frgegrg.exe
(VirusTotal 4/53[4])
obstipatie .nu/43rf3dw/34frgegrg.exe
bjhaggerty .com/43rf3dw/34frgegrg.exe
taukband .com/43rf3dw/34frgegrg.exe
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/cf258b2d068af25fc552edb22c6ec268bf7f5bf99da1719e7591d12e0677085e/analysis/1454491705/
** https://malwr.com/analysis/ZGI5OWI1ZTAzMzQ4NGQyNmEzMmMwZmFiN2FjNjdiYjA/
46.17.1.250
*** https://www.virustotal.com/en/file/a29436ba6ba2d2efffa83a215395e99510e19cecdce14758a90bc38a816a91a5/analysis/1454492103/
4] https://www.virustotal.com/en/file/993c03b02820be8d8128b85ad6423d06341deb964794d032bf867415888f3f67/analysis/1454493882/
___
Fake 'Invoice MOJU' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-invoice-moju-0939-accounts.html
3 Feb 2016 - "This -fake- financial spam comes with a malicious attachment. It does not come from Moju Ltd but is instead a simple -forgery- with a malicious attachment:
From: Accounts [message-service@ post.xero .com]
Date: 3 February 2016 at 09:04
Subject: Invoice MOJU-0939
Hi,
Here's invoice MOJU-0939 for 47.52 GBP. For last weeks delivery.
The amount outstanding of 47.52 GBP is due on 25 Feb 2016.
If you have any questions, please let us know.
Thanks,
Moju Ltd
I have only seen one sample of this, with an attachment named Invoice MOJU-0939.zip containing a malicious script invoice_id4050638124.js that has detection rate of 2/53* and which according to this Malwr report** downloads a binary from:
www .ni-na27.wc.shopserve .jp/43rf3dw/34frgegrg.exe
This payload is the same as seen in this concurrent spam run***."
* https://www.virustotal.com/en/file/05301f501fc445a7e905486879d012d7459153cd7a2192a36d90cf42ab34b867/analysis/
** https://malwr.com/analysis/MDhlY2U2MWFmMGUzNDQ4NWExNzJjZjdlYmU4NWFhNDQ/
210.160.220.144
*** http://blog.dynamoo.com/2016/02/malware-spam-gs-toilet-hire-invoice-si.html
- http://myonlinesecurity.co.uk/invoice-moju-0939-moju-ltd-js-malware-dridex/
3 Feb 2016 - "An email with the subject of 'Invoice MOJU-0939' pretending to come from Accounts <message-service@ post.xero .com> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/Invoice-MOJU-0939-1024x497.png
3 February 2016: Invoice MOJU-0939.zip: Extracts to: invoice_id6174018044.js
Current Virus total detections 2/52*. MALWR** which downloads what looks like Dridex banking malware from http ://obstipatie .nu/43rf3dw/34frgegrg.exe (VirusTotal 3/54***)
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1d203eff26f57528fd53b24a65d53ce5cbacbf30adcd8863758fe76bef1518ab/analysis/1454489431/
** https://malwr.com/analysis/ZGI5OWI1ZTAzMzQ4NGQyNmEzMmMwZmFiN2FjNjdiYjA/
*** https://www.virustotal.com/en/file/e33a26dda02526a49bd297879611d68048de66b99f7455f1b5f40d11ed29f94e/analysis/1454490157/
TCP connections
91.239.232.145: https://www.virustotal.com/en/ip-address/91.239.232.145/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
___
Fake 'Attached Image' SPAM - xls malware
- http://myonlinesecurity.co.uk/attached-image-pretending-to-come-from-canon-at-your-own-email-domain-excel-xls-spreadsheet-malware/
3 Feb 2016 - "... another email with the subject of 'Attached Image' pretending to come from canon@ victimdomain .tld with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: canon@ victimdomain .tld
Date: Wed 03/02/2016 10:38
Subject: Attached Image
Attachment: 1690_001 .xls
Body content: Blank
3 February 2016: 1690_001.xls - Current Virus total detections 2/52*
.. same Dridex macro dropper, downloading the -same- Dridex banking malware that was described in this earlier post** from -same- locations. This one was from
best-drum-set .com/43rf3dw/34frgegrg.exe ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/bf9145cb659ac397165dff2602c22d7be95c89dd8710c449d1b0053ab3d70263/analysis/1454500546/
** http://myonlinesecurity.co.uk/gs-toilet-hire-invoice-si-523-for-60-00-due-on-28022016-js-malware-or-word-doc-leading-to-dridex/
- http://blog.dynamoo.com/2016/02/malware-spam-attached-image-from-canon.html
3 Feb 2016 - "This spam pretends to come from the victim's own domain, but it doesn't. Instead it is a simple -forgery- with a malicious attachment.
From: canon@ victimdomain .tld
Date: 3 February 2016 at 12:09
Subject: Attached Image
There is no body text. Attached is a file 1690_001.xls of which I have seen a single variant with a detection rate of 9/54*. The Hybrid Analysis** shows it downloading an executable from:
best-drum-set .com/43rf3dw/34frgegrg.exe
This has a detection rate of 6/51 and is the -same- binary as used in this other spam attack today***."
* https://www.virustotal.com/en/file/bf9145cb659ac397165dff2602c22d7be95c89dd8710c449d1b0053ab3d70263/analysis/1454501819/
** https://www.hybrid-analysis.com/sample/bf9145cb659ac397165dff2602c22d7be95c89dd8710c449d1b0053ab3d70263?environmentId=4
192.254.190.17
*** http://blog.dynamoo.com/2016/02/malware-spam-gs-toilet-hire-invoice-si.html
___
Tesco 'shop for free' – phish
- http://myonlinesecurity.co.uk/tesco-is-giving-you-a-chance-to-shop-for-free-phishing/
3 Feb 2016 - "An email saying 'Tesco is giving you a chance to shop for free' pretending to come from Tesco .com <info@ sets .com> is one of the latest phishing emails trying to -steal- your Tesco bank details... This one -only- wants your personal details, Tesco log-in details and your credit card and bank details... some of the screen shots are from this new phish, but others have been re-used from older versions that I have already blogged about, but are identical except for the site name in the URL bar. If you follow that link you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers1-1024x606.jpg
Then you get a page asking to verify your mobile phone number:
>> http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/tescobank_2-1024x689.png
After filling in that page you then get this one:
>>> http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/tescobank_3-1-1024x517.png
Then this comes up... Any 5 digit number entered in the box gets you to the next page:
>>>> http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/tescobank_4-1024x568.png
Then you get a page asking for password and Security number... After you fill in your Security number and password you get a page looking like this, where the phishers try to validate your details to make sure that you are entering “genuine” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format... eventually it auto -redirects- you to the genuine Tesco bank site... -All- of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
:fear::fear: :mad:
AplusWebMaster
2016-02-04, 13:26
FYI...
Fake 'January balance' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-januarybalance-alison.html
4 Feb 2016 - "This -fake- financial spam does not come from J. Thomson Colour Printers, but is instead a simple -forgery- with a malicious attachment:
From Alison Smith [ASmith056@ jtcp .co.uk]
Date Thu, 04 Feb 2016 10:52:21 +0300
Subject "January balance £785"
Hi,
Thank you for your recent payment of £672.
It appears the attached January invoice has been missed off of your payment. Could
you please advise when this will be paid or if there is a query with the invoice?
Regards
Alison Smith
Assistant Accountant ...
The poor company being spoofed has already been hit by this attack recently... The email address of the sender varies from message to message. Attached is a file IN161561-201601.js which comes in at least -five- different versions (VirusTotal 0/53[1]..). This is a highly obfuscated script... and automated analysis of the various scripts [6].. shows that the macro downloads from the following locations (there may be more):
ejanla .co/43543r34r/843tf.exe
cafecl .1pworks.com/43543r34r/843tf.exe
This binary has a detection rate of 2/52* and phones home to:
62.76.191.108 (Clodo-Cloud / IT-House, Russia)
Note that the whole 62.76.184.0/21 block is a haven for malware, but it does also have some legitimate Russian customers. You might want to consider blocking the entire range if your users don't need to visit Russian websites. The payload is the Dridex banking trojan, and although it is unusual to see a plain .js file spammed out like this, it is consistent with botnet 220."
1] https://www.virustotal.com/en/file/24a693e529d9a7d460d170ba27a9b0d026a804deb4a24cac5052537f4fffc53a/analysis/1454576263/
6] https://www.hybrid-analysis.com/sample/1a826a3eb109be5ede38773fdcc6d6386f3a4496f0bbd4cb7b68f8b6fa2ecb6d?environmentId=1
* https://www.virustotal.com/en/file/112874084b3b22a44ba7b0413d17a213957ce5fe9106059e03a8ebb56ba6cd71/analysis/1454577822/
TCP connections
62.76.191.108
13.107.4.50
- http://myonlinesecurity.co.uk/january-balance-785-j-thomson-colour-printers-js-malware/
4 Feb 2016 - "... once again spoofing Alison Smith of J Thomson Colour Printers with an email with the subject of 'January balance £785' pretending to come from Alison Smith <ASmith5AC@ jtcp .co.uk> with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/January-balance-%C2%A3785-1024x761.png
4 February 2016: IN161561-201601.js - Current Virus total detections 0/52*
MALWR** shows a download from http ://ejanla .co/43543r34r/843tf.exe which is highly likely to be Dridex banking malware. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1a826a3eb109be5ede38773fdcc6d6386f3a4496f0bbd4cb7b68f8b6fa2ecb6d/analysis/1454576306/
** https://malwr.com/analysis/YWY2YzczYmE5MGFlNDdkNmE1ZDc4MDdhNWE5OGEzN2Y/
23.229.207.163
62.76.191.108
13.107.4.50
___
Fake 'Swift Copy' SPAM - doc malware
- http://myonlinesecurity.co.uk/reswift-copy-word-doc-malware-cve-2014-1761-exploit/
4 Feb 2016 - "An email with the subject of 'Re: Swift Copy' pretending to come from Kim Raymonds <kimraymonds@ sssup .it> (probably random email addresses) with a malicious word doc attachment is another one from the current bot runs... This is using CVE-2014-1761 exploit* in unpatched versions of office and it doesn’t matter if you have macros turned off or not. If you are -not- patched, then you WILL be infected by this.
* https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1761 - 9.3 (HIGH)
You also need to read the bottom paragraph of THIS page** to use additional settings to protect yourself against this & similar exploits...
** http://myonlinesecurity.co.uk/malformed-infected-word-docs-embedded-macro-viruses/
The email looks like:
From: Kim Raymonds <kimraymonds@ sssup .it>
Date: Thu 04/02/2016 10:27
Subject: Re:Swift Copy
Attachment: Swift Copy.doc
Dear
My boss requested i should send the swift copy to you.
Pls see the attached.
Have a great day!
Thanks,
Kim Raymonds
Office Manager
4 February 2016 : Swift Copy.doc - Current Virus total detections 23/52*
MALWR** shows it downloads http ://andersonken479 .pserver .ru/doc.exe (VirusTotal 16/54***) which is some sort of banking Trojan and password stealer. One additional trick being played on you to infect you, is the downloaded doc.exe has an icon looking like a word doc, so if you accidentally open the original swift copy.doc, the doc.exe gets silently downloaded in background and is supposed to autorun..."
* https://www.virustotal.com/en/file/55c2cb9bc8795220ff2d59e2ec32aed9c7e3d49483f277d7de4ffbcfa529062b/analysis/1454405380/
** https://malwr.com/analysis/M2Q5NzBjYzRjNDYzNDYxOTkyYWNjNzlmMzBmYjg0MTU/
91.202.12.139: https://www.virustotal.com/en/ip-address/91.202.12.139/information/
>> https://www.virustotal.com/en/url/8da7d4389b9c6065f22ae7e580ebbd2bf12f9c704c41c0b22ec1cddc96e9d4c3/analysis/
*** https://www.virustotal.com/en/file/4a2cc3b3fae5d8de567249cb8f12cd8a78182cb4445446c790505ea66c2aed06/analysis/1454514020/
___
Fake 'Fuel Card E-bill' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-bp-fuel-card-e-bill.html
4 Feb 2016 - "This -fake- financial spam does not come from Fuel Card Services Ltd but is instead a simple
-forgery- with a malicious attachment:
From "Fuel Card Services" [adminbur@ fuelcardgroup .com]
Date Thu, 04 Feb 2016 04:29:24 -0700
Subject BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016 ...
Account: B216552
Please find your e-bill 0200442 for 31/01/2016 attached.
To manage you account online please click ...
If you would like to order more fuel cards please click ...
If you have any queries, please do not hesitate to contact us.
Regards
Cards Admin.
Fuel Card Services Ltd ...
I have only seen one sample with an attachment named ebill0200442.xls which contains this malicious macro... which is different to recent Dridex macros, and is similar to one first seen yesterday. According to this Malwr report it downloads an executable from:
www .trulygreen .net/43543r34r/843tf.exe
... also reported is as a download location is:
www .mraguas .com/43543r34r/843tf.exe
If you look at the details of the Malwr report, it seems that the the script does creates a LOT of files all over the place. The dropped executable has a detection rate of 4/52* and according to this Hybrid Analysis** shows that it phones home to:
62.76.191.108 (Clodo-Cloud / IT-House, Russia)
This is the same IP address as seen earlier, put the payload has now changed. Blocking that IP would be wise, and I would suggest that blocking 62.76.184.0/21 is probably worth considering too."
* https://www.virustotal.com/en/file/859614dd3d47190860bbcaca7f1998808f0c541dc5d17cc1a770a1ab4578bc6d/analysis/
** https://www.hybrid-analysis.com/sample/c88a7a66e074de305cf98e832b3f8e1e9d194ae1a66e8c8c5d4119d0765df048?environmentId=4
- http://myonlinesecurity.co.uk/bp-fuel-card-e-bill-0200442-for-account-b216552-31012016-word-doc-or-excel-xls-spreadsheet-malware/
4 Feb 2016 - "... an email with the subject of 'BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016' pretending to come from 'Fuel Card Services <adminbur@ fuelcardgroup .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Fuel Card Services <adminbur@ fuelcardgroup .com>
Date: Thu 04/02/2016 12:31
Subject: BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016
Attachment: ebill0200442.xls ...
Account: B216552
Please find your e-bill 0200442 for 31/01/2016 attached.
To manage you account online please click ...
If you would like to order more fuel cards please click ...
If you have any queries, please do not hesitate to contact us.
Regards
Cards Admin...
4 February 2016: ebill0200442.xls - Current Virus total detections 4/52*
This will download Dridex banking Trojans from
http ://www .mraguas .com/43543r34r/843tf.exe (VirusTotal 4/52**)
Other locations so far discovered include
http ://clothesmaxusa .com/43543r34r/843tf.exe
http ://cluster007.ovh .net/~lelodged/43543r34r/843tf.exe
http ://69.61.48.46 /43543r34r/843tf.exe
http ://www .trulygreen .net/43543r34r/843tf.exe
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9f00071ae7f799e1c4dd6f4b7b0f3a5ec65697c8ec72eda50d114cb056b40445/analysis/1454588668/
** https://www.virustotal.com/en/file/859614dd3d47190860bbcaca7f1998808f0c541dc5d17cc1a770a1ab4578bc6d/analysis/1454588381/
___
Fake Amazon Mail - Phish ...
- https://blog.malwarebytes.org/fraud-scam/2016/02/fake-amazon-mail-phishes-for-login-payment-information/
Feb 4, 2016 - "From the mailbox: a -fake- Amazon mail which attempts to persuade the lucky recipient that they have the chance to win £10 in return for completing a quick survey. The mail, titled “ΙD: 569369943” and claiming to be from “members support” / message@ notice-amazon(dot)com, reads as follows:
'As a valued customer we would like to present you with an opportunity to make a quick buck. We are offering £10 each to a selected number of customers in exchange for completing a quick survey relating to our service. Your opinions and thoughts are vital in order for us to provide the best possible service..'
> https://blog.malwarebytes.org/wp-content/uploads/2016/02/amznsignin0.jpg
... the link directed eager clickers from what looked to be a compromised home and gardens website (now offline) to:
amazon-update-account-awd547324897457(dot)tube-gif-converter(dot)com/Login(dot)php
... where the site asked for Amazon login credentials:
>> https://blog.malwarebytes.org/wp-content/uploads/2016/02/amznsignin1.jpg
After this, the next page requested full-payment-information including address, phone number, credit card details, sort code / bank-account-number and “security question” too. At time of writing, both the initial redirection site and the phishing page(s) are both down for the count. Of course, scammers will likely resurrect this fake Amazon £10 survey reward / swipe your banking information tactic elsewhere so it pays to have an idea what they’re up to at all times. At this point, we’d usually suggest looking out for the green padlock / verified identity advice typically given near the end of a “Don’t get phished” blog. However, HTTPS isn’t deployed across the entirety of Amazon – only the pages where it’s really needed, such as login / payment and so on. All the same, it’s good practice to check for a green padlock / identity information anytime you’re asked to login or submit potentially sensitive data. Follow these simple steps, and you’re probably going to be safe from this type of attack. As a final tip, be very wary around emails claiming you’ve been entered into surveys or competitions – and if you see well known brands sending you odd mails about “making a quick buck”, you may want to run the other way."
notice-amazon(dot)com: 172.99.89.200: https://www.virustotal.com/en/ip-address/172.99.89.200/information/
:fear::fear: :mad:
AplusWebMaster
2016-02-08, 15:06
FYI...
Fake 'Scanned file' SPAM – JS malware
- http://myonlinesecurity.co.uk/scanned-file-from-optivet-referrals-js-malware-dridex/
8 Feb 2016 - "An email with the subject of 'Scanned file from Optivet Referrals' pretending to come from Optivet Referrals <reception@ mail13.wdc04.mandrillapp .com> on behalf of Optivet Referrals <reception@ optivet .com> with a .JS attachment is another one from the current bot runs... The email looks like:
From: Optivet Referrals <reception@ mail13.wdc04.mandrillapp .com>; on behalf of; Optivet Referrals <reception@ optivet.com>
Date: Mon 08/02/2016 08:08
Subject: Scanned file from Optivet Referrals
Attachment: 4060395693402.tiff.js
Dear Sir/Madam
Please find attached a document from Optivet Referrals.
Yours faithfully
The Reception Team at Optivet.
Optivet Referrals Ltd. Company Reg. No. 06906314. Registered office: Calyx House, South Road, Taunton, Somerset. TA1 3DU
Optivet Referrals Ltd. may monitor email traffic data and also the content of email for the purposes of security and staff training.
This message is private and confidential. If you have received this message in error, please notify us and remove it from your system...
8 February 2016: 4060395693402.tiff.js - Current Virus total detections 1/54*
MALWR** shows it downloads Dridex banking Trojan from http ://zuhr-kreativ .com/98876hg5/45gt454h
(VirusTotal 0/55***) which is downloaded as a text file and the javascript file renames it to pVSgp3Qo.scr (or other random named scr file) and automatically runs it (virustotal 3/54[4]). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like an image file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/689a5011e9aaf95f6b5ae27407c3a56fe91bad81facc9a6ec16b014c8311b073/analysis/1454922441/
** https://malwr.com/analysis/YjkyNTBhZDE4M2JlNDcwYjk3ZDhkM2JkNTlkYThjMTE/
50.87.89.243
188.40.224.73
184.28.188.112
*** https://www.virustotal.com/en/file/3aa3d5354969ba596f2d799e95f79efd57ec2e04670ad5d31f4250ccda5b0c9c/analysis/1454923278/
4] https://www.virustotal.com/en/file/9661fc6e668aa24dbf3b08c7508463a301fb524302a99a34e0f3a78a070629db/analysis/1454923099/
TCP connections
188.40.224.73: https://www.virustotal.com/en/ip-address/188.40.224.73/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
___
Fake 'Invoices' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-accounts-documentation.html
8 Feb 2016 - "This -fake- financial spam does not come from Crosswater Holdings, but it is instead a simple -forgery- with a malicious attachment:
From: CreditControl@ crosswater .co.uk
Date: 8 February 2016 at 10:34
Subject: Accounts Documentation - Invoices
Please find attached the invoice(s) raised on your account today. If you have more than one invoice they will all be in the single attachment above.
If you have any queries please do not hesitate to contact the Credit Controller who deals with your account...
Attached is a malicious script ~13190.js which comes in at least two different variants (VirusTotal [1] [2]). According to automated analysis [3]... these scripts download from:
hydroxylapatites7.meximas .com/98876hg5/45gt454h
80.109.240.71 /~l.pennings/98876hg5/45gt454h
This drops an executable with a detection rate of 3/53[4] which appears to phone home** to:
188.40.224.73 (NoTag, Germany)
I strongly recommend that you -block- traffic to that IP address. The payload is likely to be the Dridex banking trojan."
1] https://www.virustotal.com/en/file/91ba631924098a3c18b3f4b5d74da67de5ebe2f07ee462e2cbc1264b52956725/analysis/1454938464/
2] https://www.virustotal.com/en/file/26239974381d815ff49649511b39fddddfdd5e891b0640cbf09ec272079fe351/analysis/1454938475/
3] https://malwr.com/analysis/ZWJhYzY1Yjc4NTI3NDgwMmI5NzVmYmJlYzhmOGQ4ODA/
31.170.165.165
31.170.160.60
* https://www.virustotal.com/en/file/dd6c0c628e124462a843cd1308e25937636df4e4dc48e0d0a19e3b1455f57033/analysis/1454938652/
** https://www.hybrid-analysis.com/sample/26239974381d815ff49649511b39fddddfdd5e891b0640cbf09ec272079fe351?environmentId=4
80.109.240.71: https://www.virustotal.com/en/ip-address/80.109.240.71/information/
188.40.224.73: https://www.virustotal.com/en/ip-address/188.40.224.73/information/
___
Fake 'Scanned Referral' SPAM - JS malware
- http://myonlinesecurity.co.uk/scanned-file-from-optivet-referrals-js-malware-dridex/
8 Feb 2016 - "An email with the subject of 'Scanned file from Optivet Referrals' pretending to come from Optivet Referrals <reception@ mail13.wdc04.mandrillapp .com>; on behalf of Optivet Referrals <reception@ optivet .com> with a .JS attachment is another one from the current bot runs... The email looks like:
From: Optivet Referrals <reception@ mail13.wdc04.mandrillapp .com>; on behalf of; Optivet Referrals <reception@ optivet .com>
Date: Mon 08/02/2016 08:08
Subject: Scanned file from Optivet Referrals
Attachment: 4060395693402.tiff.js
Dear Sir/Madam
Please find attached a document from Optivet Referrals.
Yours faithfully
The Reception Team at Optivet...
8 February 2016: 4060395693402.tiff.js - Current Virus total detections 1/54*
MALWR** shows it downloads Dridex banking Trojan from http ://zuhr-kreativ .com/98876hg5/45gt454h
(VirusTotal 0/55***) which downloaded is downloaded as a text file and the javascript file -renames- it to pVSgp3Qo.scr (or other random named scr file) and automatically runs it (virustotal 3/54[4]). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like an image file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/689a5011e9aaf95f6b5ae27407c3a56fe91bad81facc9a6ec16b014c8311b073/analysis/1454922441/
** https://malwr.com/analysis/YjkyNTBhZDE4M2JlNDcwYjk3ZDhkM2JkNTlkYThjMTE/
50.87.89.243
188.40.224.73
184.28.188.112
*** https://www.virustotal.com/en/file/3aa3d5354969ba596f2d799e95f79efd57ec2e04670ad5d31f4250ccda5b0c9c/analysis/1454923278/
4] https://www.virustotal.com/en/file/9661fc6e668aa24dbf3b08c7508463a301fb524302a99a34e0f3a78a070629db/analysis/1454923099/
:fear::fear: :mad:
AplusWebMaster
2016-02-09, 13:31
FYI...
Fake -blank subject- SPAM - malicious attachment
- http://myonlinesecurity.co.uk/empty-subject-from-accounts_do_not_replyaldridgesecurity-co-uk-word-doc-malware-dridex/
Feb 9, 2016 - "... an email with no subject pretending to come from accounts_do_not_reply@ aldridgesecurity .co.uk with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: accounts_do_not_reply@ aldridgesecurity .co.uk
Date: Tue 09/02/2016 08:07
Subject: NONE
Attachment: document2016-02-09-103153.doc
Body content:
Accounts
9 February 2016: document2016-02-09-103153.doc - Current Virus total detections 5/54*
Downloads Dridex banking malware from http ://promo.clickencer .com/4wde34f/4gevfdg (VirusTotal 0/54**) which is saved/downloaded as a text file and converted to label8.exe (VirusTotal 0/54***) by the macro and then autorun - MALWR[4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e35b35f6dbb5e010560853fd7d68de209d9cf5837c16e6e7aec83f409ea4b1bb/analysis/1455008860/
** https://www.virustotal.com/en/file/24f5b5e3a8543680aef45c482730309487603d19ddcc82a59f16db373df0033c/analysis/1455010031/
*** https://www.virustotal.com/en/file/24f5b5e3a8543680aef45c482730309487603d19ddcc82a59f16db373df0033c/analysis/1455010031/
4] https://malwr.com/analysis/NmFjMTM0ZTk1ODViNDNhZGIwOWM3MDkwMmI4NWQ5NTg/
66.7.195.81
50.56.184.194
184.25.56.42
- http://blog.dynamoo.com/2016/02/malware-spam-accounts.html
Feb 9, 2016 - "This rather terse spam does not come from Aldridge Security but it is instead a simple forgery with a malicious attachment. There is no subject.
From [accounts_do_not_reply@ aldridgesecurity .co.uk]
Date Tue, 09 Feb 2016 10:31:14 +0200
Subject
Accounts
I have only seen a single sample with an attachment document2016-02-09-103153.doc which has a VirusTotal detection rate of 5/54*. Automated analysis [1] [2] shows that it downloads a malicious executable from:
promo.clickencer .com/4wde34f/4gevfdg
This has a detection rate of 5/54**. Those analyses indicates that the malware phones home to:
50.56.184.194 (Rackspace, US)
I strongly recommend that you -block- traffic to that IP. The payload is the Dridex banking trojan."
* https://www.virustotal.com/en/file/e35b35f6dbb5e010560853fd7d68de209d9cf5837c16e6e7aec83f409ea4b1bb/analysis/1455011714/
1] https://malwr.com/analysis/NmFjMTM0ZTk1ODViNDNhZGIwOWM3MDkwMmI4NWQ5NTg/
2] https://www.hybrid-analysis.com/sample/e35b35f6dbb5e010560853fd7d68de209d9cf5837c16e6e7aec83f409ea4b1bb?environmentId=4
** https://www.virustotal.com/en/file/e35b35f6dbb5e010560853fd7d68de209d9cf5837c16e6e7aec83f409ea4b1bb/analysis/1455011714/
___
Fake 'statement' SPAM - doc malware jpg
- http://myonlinesecurity.co.uk/fwnibh-donec-est-llc-statement-word-doc-malware-extracted-from-a-jpg/
9 Feb 2016 - "An email with the subject of 'Fw:Nibh Donec Est LLC. statement' pretending to come from random senders at random email addresses with a malicious word doc attachment is another one from the current bot runs... The company in the subject matches the company in the body. The subjects vary but are all related to statements. Some subjects include:
Fw:Nibh Donec Est LLC. statement
Fwd:Quis Massa Mauris PC. statement
Re:Tellus Aenean LLP – statement
Aliquet Lobortis LLC – statement
The email looks like:
From: Brittany Hood <gerados@gerados .info>
Date: Tue 09/02/2016 06:06
Subject: Fw:Nibh Donec Est LLC. statement
Attachment: 62YDP.doc
Please find attached a statement
Best regards
Nibh Donec Est LLC
Brittany Hood
9 February 2016: 62YDP.doc - Current Virus total detections 2/54*
MALWR** shows a download from http ://inroadsdevelopment .us/ht.jpg?RZ9lqw4jFWvx=35 which delivers ht.jpg (VirusTotal 9/53***) which is decoded by a combination of the -macro- in the word doc and a dropped/extracted VBS file 12047.vbs (VirusTotal 1/51[4]) to give you 1204745.exe (VirusTotal 5/54[5])...
inroadsdevelopment .us: 192.185.16.61: https://www.virustotal.com/en/ip-address/192.185.16.61/information/
>> https://www.virustotal.com/en/url/688e1a0b11d59234fd79d012d9e4d9d462c714a4f3329f89826ad7931339c1cd/analysis/
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8c22f397ef5d5a5ed2af265c60b600dcf5cd7eb43ea07eddfe4649ea09855d62/analysis/1454998395/
** https://malwr.com/analysis/NDY5MDQxYjM4NTI0NGRlNmEzNjE1ODMwN2IwNjUzNzY/
*** https://www.virustotal.com/en/file/793d7b2e4d53f414e04fff589e8baf29d9a4c4b6c46601dd1f92085d7cabb274/analysis/1454998178/
4] https://www.virustotal.com/en/file/a7f7abf2dc0968b8a9b7530d20669b51bca0474f893c7c504f8bcfe39bce05af/analysis/1454999501/
5] https://www.virustotal.com/en/file/70153b8f5bb5729dfde1dd0dc559070c8c8470bb1b913e55e8b12f66c38fdaa6/analysis/1454999510/
:fear::fear: :mad:
AplusWebMaster
2016-02-10, 12:10
FYI...
Fake 'SERVICE SHEET' SPAM - doc malware
- http://myonlinesecurity.co.uk/emailing-mx62edo-10-02-2016-documentsdmb-ltd-co-uk-word-doc-malware/
10 Feb 2016 - "An email with the subject of 'Emailing: MX62EDO 10.02.2016' pretending to come from documents@ dmb-ltd .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: documents@ dmb-ltd .co.uk
Date: Wed 10/02/2016 08:18
Subject: Emailing: MX62EDO 10.02.2016
Attachment: MX62EDO 10.02.2016.doc
Your message is ready to be sent with the following file or link
attachments:
MX62EDO 10.02.2016 SERVICE SHEET
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled...
10 February 2016: MX62EDO 10.02.2016.doc - Current Virus total detections 5/54*
MALWR** shows us a download of Dridex banking malware from
http ://g-t-c .co.uk/09u8h76f/65fg67n (VirusTotal 0/54***) Which is once again as seen in previous runs this last week, downloaded as a text file and -renamed- by the macro and saved to \%temp%\label8.exe where it is autorun (VirusTotal 4/54[4])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5734b9959c23539052add8410d7d63d0ce506eb343cd83684fe51c707d11c9f9/analysis/1455095855/
** https://malwr.com/analysis/NTNlNTdkODBiNjhlNDMxZGFhNzRmYWM5ZWIwMmM2NGU/
185.11.240.14
87.229.86.20
13.107.4.50
*** https://www.virustotal.com/en/file/02ac743a22d159f99d3e7c82b71666c62e6df65695c956ba2346b7827736b766/analysis/1455096865/
4] https://www.virustotal.com/en/file/05fd425f1dd24de360666f2c4be195275464769fa8ea7830691aab63ad481824/analysis/1455097168/
TCP connections
87.229.86.20: https://www.virustotal.com/en/ip-address/87.229.86.20/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
- http://blog.dynamoo.com/2016/02/malware-spam-emailing-mx62edo-10022016.html
10 Feb 2016
"... Recommended blocklist:
87.229.86.20
50.56.184.194
144.76.73.3 "
___
Fake 'New Doc 115' SPAM - doc malware
- http://myonlinesecurity.co.uk/new-doc-115-sent-from-yahoo-mail-on-android-word-doc-malware/
10 Feb 2016 - "... an email with the subject of 'New Doc 115' pretending to come from admin <ali73_20081475@ yahoo .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: admin <ali73_20081475@ yahoo .co.uk>
Date: Wed 10/02/2016 11:02
Subject: New Doc 115
Attachment: New Doc 115.doc
Sent from Yahoo Mail on Android
10 February 2016: New Doc 115.doc - Current Virus total detections 5/54*
.. -same malware- and -same- download locations as today’s earlier malspam run** ..."
* https://www.virustotal.com/en/file/f738fde83e6a8e7874f88477d66caf0b8ad4cda4505074ef9036078c4da7f187/analysis/1455101427/
** http://myonlinesecurity.co.uk/emailing-mx62edo-10-02-2016-documentsdmb-ltd-co-uk-word-doc-malware/
___
Fake 'Message' SPAM - xls malware
- http://myonlinesecurity.co.uk/message-from-kmbt_c224-pretending-to-come-from-copier-your-own-email-domain-excel-xls-spreadsheet-malware/
10 Feb 2016 - "... an email with the subject of 'Message from KMBT_C224' pretending to come from copier @ your own company or email domain with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: copier@ victimdomain .tld
Date: Wed 10/02/2016 12:20
Subject: Message from KMBT_C224
Attachment: SKMBT_C22416020417390.xls
Body content: Empty
10 February 2016: SKMBT_C22416020417390.xls - Current Virus total detections 5/54*
MALWR** shows what should be a download of Dridex banking malware from
http ://toptut .ru/09u8h76f/65fg67n - however when I tried, I got a '404 not found'.
NOTE: there -will- be other download locations in different versions of this... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/8dad402f6a03c025f9a1ed7638c5b47bbe35faeacf754147565217112ecb2883/analysis/1455110388/
** https://malwr.com/analysis/YjQ5N2QzMDNkMWEzNGNlZDkwNTY0NWJkMDAyNTRlMDc/
85.10.201.19
toptut .ru: 85.10.201.19: https://www.virustotal.com/en/ip-address/85.10.201.19/information/
___
Fake 'DHL' SPAM - Teslacrypt
- http://myonlinesecurity.co.uk/dhl-delivernow-notification-card-on-lost-shipment-third-notification-js-malware-teslacrypt/
10 Feb 2016 - "An email with the subject of 'DHL DeliverNow Notification Card on lost shipment (Third Notification)' pretending to come from DHL DeliverNow Network <zkfwgyh@ grafeia-teleton-kyriakidis .gr> (probably random email addresses with sender spoofed as DHL) with a zip attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/DHL-DeliverNow-Notification-Card-on-lost-shipment-Third-Notification--1024x769.png
25 February 2016: DHL_Notification_card.zip: Extracts to: file.zip which extracts to invoice_m7BNUn.js
Current Virus total detections 3/55*. MALWR** shows a download of what looks like Teslacrypt from either http ://fromjamaicaqq .com/26.exe or http ://greetingsfromitaff .com/26.exe (VirusTotal 4/55***).
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/0aafde900bfa67816f7a954075a0a341b32e23db12d5877616a56cb4f6b0219a/analysis/1455124017/
** https://malwr.com/analysis/NjY1MWFhMGY5OTIyNDBjNGJjOWJmNjdhZTg5N2E2OGQ/
173.82.74.197
192.3.186.222
*** https://www.virustotal.com/en/file/52683ed00ec62e01f3c1d188b44d34bc86b290546cf8a724e8283cf9480df101/analysis/1455124442/
:fear::fear: :mad:
AplusWebMaster
2016-02-11, 13:08
FYI...
Fake 'Unpaid Invoice' SPAM - JS malware
- http://myonlinesecurity.co.uk/int242343-unpaid-invoice-your-services-may-be-suspended-wavenetuk-com-js-malware/
11 Feb 2016 - "An email with the subject of 'INT242343 Unpaid Invoice – Your Services May Be Suspended' pretending to come from payments <payments@ wavenetuk .com> with a zip attachment is another one from the current bot runs... The email looks like:
From: payments <payments@ wavenetuk .com>
Date: Thu 11/02/2016 08:38
Subject: INT242343 Unpaid Invoice – Your Services May Be Suspended
Attachment: OutstandingStatement201602111650.js
PLEASE NOTE: THIS IS A NO REPLY EMAIL ACCOUNT
Dear Customer Please find attached to this email your statement You can view the invoices listed on our e-billing site at www .netbills .co.uk If you have any queries regarding use of the e-billing site or this statement please call us on 08444 12 7777.
Accounts Department Wavenet Group Incorporating – Titan Technology, Centralcom and S1 Network Services Tel 08444127777 ...
11 February 2016: OutstandingStatement201602111650.js - Current Virus total detections 0/54*
MALWR** shows a download of Dridex banking malware from
http ://aforbescompany .com/09u8h76f/65fg67n which once again is a text file that the javascript saves to & renames to %Temp%\sREKjVas.scr or another random named file (VirusTotal 2/55***)
Other download locations so far discovered include: http ://gp-training .net/09u8h76f/65fg67n ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/809277f860ab29213ed1cf83f58b932d9adcf50793561e7e64a12f4840830828/analysis/1455183429/
** https://malwr.com/analysis/YzQxYzFjZGFjZmVmNDMxYjk0OWU0ODUxMmJmODY2MWQ/
69.89.31.158
87.229.86.20
184.25.56.44
*** https://www.virustotal.com/en/file/b8ba96af6e32459a21124edec979854df205e8ac27b05eba2d16d53526ec8ccb/analysis/1455183938/
TCP connections
87.229.86.20: https://www.virustotal.com/en/ip-address/87.229.86.20/information/
88.221.14.11: https://www.virustotal.com/en/ip-address/88.221.14.11/information/
- http://blog.dynamoo.com/2016/02/malware-spam-int242343-unpaid-invoice.html
11 Feb 2016 - "This spam does not come from Wavenet Group but is instead a simple -forgery- with a malicious attachment:
From payments [payments@ wavenetuk .com]
Date Thu, 11 Feb 2016 15:14:59 +0530
Subject INT242343 Unpaid Invoice - Your Services May Be Suspended
PLEASE NOTE: THIS IS A NO REPLY EMAIL ACCOUNT
Dear Customer
Please find attached to this email your statement
You can view the invoices listed on our e-billing site at www .netbills .co.uk
If you have any queries regarding use of the e-billing site or this statement please
call us on 08444 12 7777.
Accounts Department
Wavenet Group
Incorporating - Titan Technology, Centralcom and S1 Network Services
Tel 08444127777 ...
I have only seen a single sample of this with an attachment OutstandingStatement201602111650.js which has a VirusTotal detection rate of 0/53*. The Malwr analysis shows that this script downloads an executable from:
gp-training .net/09u8h76f/65fg67n
There are probably a few other download locations. This binary has a detection rate of 2/54**. The Malwr report also indicates that it phones home to:
87.229.86.20 (ZNET Telekom Zrt, Hungary)
I strongly recommend that you -block- traffic to that IP. The payload is the Dridex banking trojan."
* https://www.virustotal.com/en/file/4efb1453bc4d1c9df0267c881b5959663f0abe338239a101678bf7c255fc7f08/analysis/1455185997/
** https://www.virustotal.com/en/file/b8ba96af6e32459a21124edec979854df205e8ac27b05eba2d16d53526ec8ccb/analysis/1455186992/
TCP connections
87.229.86.20: https://www.virustotal.com/en/ip-address/87.229.86.20/information/
88.221.14.11: https://www.virustotal.com/en/ip-address/88.221.14.11/information/
___
Fake 'Confirmation' SPAM - doc malware
- http://myonlinesecurity.co.uk/confirmation-saleswriteonltd-co-uk-word-doc-malware/
11 Feb 2016 - "An email with the subject of 'Confirmation' pretending to come from sales@ writeonltd .co.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/Confirmation-writeonltd-1024x775.png
11 February 2016: Sales_Order_Confirmation__Priced_SORD00137058.doc - Current Virus total detections 5/55*
MALWR** is once again showing an attempted download from
http ://maraf0n.vv .si/09u8h76f/65fg67n which is giving a 404 not found and diverts to Russian hosting company home page... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/bfaac0049544614235e4572a0adb4d40580ab0bb3693fba7dc009be7dcacad10/analysis/1455188335/
** https://malwr.com/analysis/NmY4NGE1MjUzNjUxNDRhZmE2ZjgwMmUxY2EzODVlMzE/
31.170.164.132: https://www.virustotal.com/en/ip-address/31.170.164.132/information/
31.170.160.60: https://www.virustotal.com/en/ip-address/31.170.160.60/information/
___
Fake 'Office Direct' SPAM - doc malware
- http://myonlinesecurity.co.uk/uk-office-direct-ac-od04450155-word-doc-malware/
11 Feb 2016 - "An email with the subject of 'UK Office Direct A/C OD04450155' pretending to come from office@ ukofficedirect .co.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/UK-Office-Direct-AC-OD04450155-1024x767.png
11 February 2016: Invoice_INV8000288979.doc - Current Virus total detections 5/54*
MALWR** shows an attempted download from http ://maraf0n.vv .si/09u8h76f/65fg67n but like all the others this morning is giving a 404 and redirects to Russian hosting company home page... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/7fe9c59d80d98ac42d926b854b58331e1f9dfdbae52cc98171c27d1ed237f2f6/analysis/1455187463/
** https://malwr.com/analysis/YWE2NzU5YWY2NmVjNDRiYzg2OGQ3Y2ExMDM3MmUzZGE/
31.170.164.132: https://www.virustotal.com/en/ip-address/31.170.164.132/information/
31.170.160.60: https://www.virustotal.com/en/ip-address/31.170.160.60/information/
___
Fake 'Scan' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-scan-from-km1650-please.html
11 Feb 2016 - "This -fake- document -scan- leads to malware. It appears to originate from within the victim's own domain, but it is just a simple forgery.
From: scanner@ victimdomain .tld
Date: 11 February 2016 at 10:24
Subject: Scan from KM1650
Please find attached your recent scan
Attached is a file =SCAN7318_000.DOC which seems to come in several different varieties (sample VirusTotal results [1]..). The Malwr reports [4].. indicate the the macro in the document downloads a malicious executable from:
maraf0n.vv .si/09u8h76f/65fg67n
www .sum-electronics .co.jp/09u8h76f/65fg67n
The dropped executable has a detection rate of 2/54*. As with this earlier spam run** it phones home to:
87.229.86.20 (ZNET Telekom Zrt, Hungary)
-Block- traffic to that IP. The payload is the Dridex banking trojan."
1] https://www.virustotal.com/en/file/d34deafa0970de2db8cf6f7cbaa37bab10cd3d144c4d6d46905988565deea231/analysis/1455191710/
4] https://malwr.com/analysis/MGQzODg3ZTNhYjlmNDZhNzhiMzk0YzAzZDg0YWIxMWY/
* https://www.virustotal.com/en/file/b8ba96af6e32459a21124edec979854df205e8ac27b05eba2d16d53526ec8ccb/analysis/1455192649/
TCP connections
87.229.86.20: https://www.virustotal.com/en/ip-address/87.229.86.20/information/
>> https://www.virustotal.com/en/url/00541ad9a0c76f9d2b3b8ae56b192ec7b3b241508435f78696c44a00b3f923cb/analysis/
88.221.14.11: https://www.virustotal.com/en/ip-address/88.221.14.11/information/
** http://blog.dynamoo.com/2016/02/malware-spam-int242343-unpaid-invoice.html
___
Fake 'Sage Pay Invoice' SPAM - xls malware
- http://myonlinesecurity.co.uk/your-sage-pay-invoice-inv00318132-excel-xls-spreadsheet-malware/
11 Feb 2016 - "An email with the subject of 'Your Sage Pay Invoice INV00318132' pretending to come from Sagepay EU <accounts@ sagepay .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Sagepay EU <accounts@ sagepay .com>
Date: Thu 11/02/2016 13:01
Subject: Your Sage Pay Invoice INV00318132
Attachment: INV00318132_V0072048_12312014.xls
Please find attached your invoice.
We are making improvements to our billing systems to help serve you better and because of that the attached invoice will look different from your previous ones. You should have already received an email that outlined the changes, however if you have any questions please contact ...
11 February 2016: INV00318132_V0072048_12312014.xls - Current Virus total detections 4/54*
MALWR** shows a download of Dridex banking malware from
http ://www .phraseculte .fr/09u8h76f/65fg67n (VirusTotal 3/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/af0cd39c11396a43ec0d9cb6454ebdf74c60262acf8de8d2a8fb16ef47181907/analysis/1455199262/
** https://malwr.com/analysis/MTllNjllNmFlYzJjNDhkODgzY2JhY2MyNjE0ODA2ZmY/
46.21.207.156
84.38.67.231
13.107.4.50
*** https://www.virustotal.com/en/file/f0f317116470f500a30e47fc3b4300e05609afa96d03f9ac311abf6dc29be9b2/analysis/1455198516/
TCP connections
84.38.67.231: https://www.virustotal.com/en/ip-address/84.38.67.231/information/
>> https://www.virustotal.com/en/url/8a87fcab29a44243e0eef224b8bd2ebdaa2b8cbd01268f4836b6c1a51aaaf65b/analysis/
104.86.111.136: https://www.virustotal.com/en/ip-address/104.86.111.136/information/
- http://blog.dynamoo.com/2016/02/malware-spam-your-sage-pay-invoice.html
11 Feb 2016 - "... a simple -forgery- with a malicious attachment... Attached is a file INV00318132_V0072048_12312014.xls which appears to come in a wide variety of different versions (at least -11-). The VirusTotal detection rate for a subset of these is 6/54[1]... Only a single Malwr report* seemed to work, indicating the macro downloading from:
www .phraseculte .fr/09u8h76f/65fg67n
This dropped executable has a detection rate of 3/54**. The Malwr report shows it phoning home to:
84.38.67.231 (ispOne business GmbH, Germany)
I strongly recommend that you -block- traffic to that IP. The payload is the Dridex banking trojan."
1] https://www.virustotal.com/en/file/c704c0faf3f24e7ad89407c9500ac67090ba7480936e5bb9f874542d921023ee/analysis/
* https://malwr.com/analysis/MTllNjllNmFlYzJjNDhkODgzY2JhY2MyNjE0ODA2ZmY/
46.21.207.156
84.38.67.231
13.107.4.50
** https://www.virustotal.com/en/file/f0f317116470f500a30e47fc3b4300e05609afa96d03f9ac311abf6dc29be9b2/analysis/1455203414/
TCP connections
84.38.67.231: https://www.virustotal.com/en/ip-address/84.38.67.231/information/
>> https://www.virustotal.com/en/url/8a87fcab29a44243e0eef224b8bd2ebdaa2b8cbd01268f4836b6c1a51aaaf65b/analysis/
104.86.111.136: https://www.virustotal.com/en/ip-address/104.86.111.136/information/
___
We might use your 'IoT stuff' to spy on you ...
- https://nakedsecurity.sophos.com/2016/02/11/we-might-use-your-iot-stuff-to-spy-on-you-says-top-spook-james-clapper/
Feb 11, 2016 - "... think that it could be 'Big Brother' doing the eyeballing, be it through your internet-connected fridge, your toothbrush, or your TV... the Internet of Things, or IoT: that collection of connected gadgets that have plenty of 'neat-o!' factor but which, all too often, are pockmarked with security holes:
> https://nakedsecurity.sophos.com/2015/10/26/the-internet-of-things-stop-the-things-i-want-to-get-off/
... IoT refers to a whole class of day-to-day 'things' that are now being offered with built-in network connectivity. These everyday objects can directly hook into the internet, all on their own, rather than needing to first be plugged into a computer connected to the internet. The emergence of the IoT has been accompanied by a torrent of stories about security researchers and malicious hackers breaking into all manner of objects... We’ve seen issues with connected kettles, TVs, lightbulbs, thermostats, refrigerators and baby monitors that have all been designed without adherence to the information security principle of least privilege:
> https://en.wikipedia.org/wiki/Principle_of_least_privilege
But one person’s security hole is another person’s opportunity. To intelligence agencies, IoT devices could illuminate an environment that they claim is 'going dark' due to new forms of encryption being used in consumer products and services... Wired* quoted remarks he made at a summit for In-Q-Tel, the CIA’s venture capital firm:
'Transformational' is an overused word, but I do believe it properly applies to these technologies, particularly to their effect on clandestine tradecraft' ..."
* http://www.wired.com/2012/03/petraeus-tv-remote/
___
Malware Found in 3rd Party App Stores
- http://blog.trendmicro.com/trendlabs-security-intelligence/user-beware-rooting-malware-found-in-3rd-party-app-stores/
Feb 10, 2016 - "... Because some users have concerns with the app giant Google Play, they choose to download apps from third-party stores. For instance, there are no region locks for apps in some third-party app stores. Some developers of paid apps even partner with third-party app stores with purchase capability to give those who download from the partnered store considerable discounts. Third-party app stores can also be the preferred store due to its popularity in a specific region. Android users have to keep in mind that installing apps from these third-party app stores requires users to allow the installation from 'unknown sources'. Malicious apps have a history of popping up from these third party websites, a reason why it is often recommended that Android users -must- stick to Google Play. Because of Google’s security measures, we believe it is the safest platform for downloading apps. It is worth noting, however, that third-party app stores are implementing means to tighten their security. Malicious apps were recently seen making the rounds in some third-party app stores. They spoof popular apps, increasing the chances of getting selected and downloaded. These include popular mobile games, mobile security apps, camera apps, music streaming apps, and so on. They even share the exact same package and certification with their Google Play counterpart... However, the malware only downloads and installs other apps -without- the user’s knowledge. These secretly downloaded apps will then present themselves as ads luring users to downloading other apps from time to time. It can also be used to collect user data and forward them to the attacker. Based on the data from our Trend Micro Mobile App Reputation Service, there are -1,163- malicious APKs detected as ANDROIDOS_ LIBSKIN.A. In addition, between January 29 and February 1, malicious apps detected as this malware have been downloaded in -169- countries and can be found in -four- third party app stores, namely Aptoide, Mobogenie, mobile9, and 9apps. We have already contacted these stores and informed them about these threats, but as of this writing, we have yet to receive any confirmation from their end...
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/02/Infection-counts-by-malicious-apps-01.png
... The popups lure users into clicking-unwanted-apps. Clicking-on-the-ads may not necessarily lead the user to the respective app or site. Other than that, ANDROIDOS_ LIBSKIN.A can also collect users’ data and send them back to a remote malicious user. This includes data about the user’s phone, subscription IDs, device ID, language, network type, apps running, network name, and so on... we do warn users to approach downloading apps with caution. One option that users may do to avoid downloading fake apps is to download the app from the developer’s website. They may also check the -reputation- of the store before downloading anything..."
:fear::fear: :mad:
AplusWebMaster
2016-02-12, 14:03
FYI...
Fake 'DVSA' SPAM - malcious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-dvsa-receipt.html
12 Feb 2016 - "This spam email does not come from a UK government agency, but is instead a simple -forgery- with a malcious attachment. Note that the sender's email address seems to vary slightly, but all are spoofed to come from vosa.gsi .gov.uk.
From FPO.CC.15@ vosa.gsi .gov.uk
Date Fri, 12 Feb 2016 12:47:20 +0300
Subject DVSA RECEIPT
Good afternoon
Please find attached your receipt, sent as requested.
Kind regards
(See attached file)
Fixed Penalty Office
Driver and Vehicle Standards Agency ...
Attached is a file Fixed Penalty Receipt.docm which comes in at least -ten- different variants... I captured two samples with detection rate of about 3/54 [1] [2] and the Malwr reports for those [3] [4] indicate the macro in the document downloads a malicious executable from:
raysoft .de/09u8h76f/65fg67n
xenianet .org/09u8h76f/65fg67n
steinleitner-online.net/09u8h76f/65fg67n [reported here (5)]
This dropped file has a detection rate of 5/54* ... This Hybrid Analysis report** indicates subsequent traffic to:
192.100.170.19 (Universidad Tecnologica de la Mixteca, Mexico)
87.229.86.20 (ZNET Telekom Zrt, Hungary)
84.38.67.231 (ispOne business GmbH, Germany)
The payload is the Dridex banking trojan.
Recommended blocklist:
192.100.170.19
87.229.86.20
84.38.67.231 "
1] https://www.virustotal.com/en/file/530874814a36ce7eb97f8f20fdcfa8a9b88611357fc8a331b9043ef15673da10/analysis/1455274179/
2] https://www.virustotal.com/en/file/dd4c565d0a8bf23145c23853b5f8a3390ae989e42fb6294af45ca275e145e51d/analysis/1455275696/
3] https://malwr.com/analysis/YzMzNTQ1MTc4MTlkNDUyMTlmYTU0ODI2MTUyM2E5MjQ/
4] https://malwr.com/analysis/OGFjN2VlZjRmYTMyNGJiMjgzZTFjYjRiMTQyODdhMzA/
5] https://www.virustotal.com/en/file/f45bbdbc4a84e05689dcb32f3b32690cc7403e66aca9299f175be1ac8c0af8fa/analysis/1455274504/
* https://www.virustotal.com/en/file/f45bbdbc4a84e05689dcb32f3b32690cc7403e66aca9299f175be1ac8c0af8fa/analysis/1455274504/
** https://www.hybrid-analysis.com/sample/530874814a36ce7eb97f8f20fdcfa8a9b88611357fc8a331b9043ef15673da10?environmentId=4
___
Fake 'Fuelcard' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/your-latest-invoice-from-the-fuelcard-company-uk-ltd-word-doc-or-excel-xls-spreadsheet-malware-2/
12 Feb 2016 - "An email with the subject of 'Your latest invoice' from The Fuelcard Company UK Ltd pretending to come from customerservice@ fuelcards .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: customerservice@ fuelcards .co.uk
Date: Fri 12/02/2016 10:16
Subject: Your latest invoice from The Fuelcard Company UK Ltd
Attachment: invoice.xls
Please find your latest invoice attached.
If you have any queries please do not hesitate to contact our Customer Service Team at customerservice@fuelcards.co.uk
Regards
The Fuelcard Compa
The Fuelcard Company UK Ltd ...
12 February 2016: invoice.xls - Current Virus total detections 5/53*
MALWR** shows a download of what is almost certainly Dridex Banking Trojan from
http ://web82 .snake.kundenserver42 .de/09u8h76f/65fg67n (VirusTotal 5/53***)
Other download locations include: http ://raysoft .de/09u8h76f/65fg67n
http ://steinleitner-online .net/09u8h76f/65fg67n
http ://www .xenianet .org/09u8h76f/65fg67n
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/516dbdd2be201453fa1eedb09737af6b726fb9185bb57220c765d40dcb403577/analysis/1455275820/
** https://malwr.com/analysis/ZDRiNDVlODAzNmI1NDE3ZWJiZmFlZWUxZGJjNTA2OTQ/
195.93.200.140
192.100.170.19
13.107.4.50
*** https://www.virustotal.com/en/file/f45bbdbc4a84e05689dcb32f3b32690cc7403e66aca9299f175be1ac8c0af8fa/analysis/1455276505/
TCP connections
192.100.170.19
13.107.4.50
87.229.86.20
- http://blog.dynamoo.com/2016/02/malware-spam-your-latest-invoice-from.html
12 Feb 2016 - "... Hybrid Analysis* shows that this particular sample downloads from:
legismar .com/09u8h76f/65fg67n
This is the -same- executable as found in this earlier spam run**."
* https://www.hybrid-analysis.com/sample/1ad88d1cc5adc55f4680a59602076db54adf5a2c6c1de7cea6ec74104d784918?environmentId=4
** http://blog.dynamoo.com/2016/02/malware-spam-dvsa-receipt.html
:fear::fear: :mad:
AplusWebMaster
2016-02-15, 14:24
FYI...
Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-we-070216-kelly-pegg-word-doc-malware/
15 Feb 2016 - "An email with the subject of 'Invoice (w/e 070216)' pretending to come from Kelly Pegg <kpegg@ responserecruitment .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Kelly Pegg <kpegg@ responserecruitment .co.uk>
Date: SKM_C3350160212101601 .docm
Subject: Invoice (w/e 070216)
Attachment: SKM_C3350160212101601 .docm
Good Afternoon
Please find attached invoice and timesheet.
Kind Regards
Kelly
15 February 2016: SKM_C3350160212101601.docm - Current Virus total detections 7/54*
MALWR** shows a download of Dridex banking Trojan from
http ://216.158.82.149 /09u8h76f/65fg67n (VirusTotal 4/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e118ec1bb2b2291be05b806409161f098db1295e7a346c51714109143fda07d8/analysis/1455537274/
** https://malwr.com/analysis/ZTViNjYyMWI1MzM2NDNjZDk3OTM1Nzk2OTlkYmIyMWU/
216.158.82.149: https://www.virustotal.com/en/ip-address/216.158.82.149/information/
>> https://www.virustotal.com/en/url/b3258d1381601715e29e46f24b32926f05b2b345d99b4b1889578596414aa391/analysis/
5.45.180.46
13.107.4.50
*** https://www.virustotal.com/en/file/cb3f2b1a9bf2484bcc035944843ad214fd7fde854c99df0f7a5cc9369c89433c/analysis/1455536293/
TCP connections
5.45.180.46
13.107.4.50
- http://blog.dynamoo.com/2016/02/malware-spam-invoice-we-070216-kelly.html
15 Feb 2016 - "... Attached is a file SKM_C3350160212101601.docm which comes in -several- different variants. The macro in the document attempts to download a malicious executable from:
216.158.82.149 /09u8h76f/65fg67n
sstv.go .ro/09u8h76f/65fg67n
www .profildigital .de/09u8h76f/65fg67n
This dropped a malicious executable with a detection rate of 6/54* which according to these automated analysis tools [1] [2] calls home to:
5.45.180.46 (B & K Verwaltungs GmbH, Germany)
I strongly recommend that you -block- traffic to that address. The payload is the Dridex banking trojan."
* https://www.virustotal.com/en/file/cb3f2b1a9bf2484bcc035944843ad214fd7fde854c99df0f7a5cc9369c89433c/analysis/
TCP connections
5.45.180.46: https://www.virustotal.com/en/ip-address/5.45.180.46/information/
>> https://www.virustotal.com/en/url/56f72b339937c51eb0a0e22657dce7652e1636bfffb0dfcff5166e4dedb385ee/analysis/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
1] https://malwr.com/analysis/ZWEyODc4YTljYzgwNDgwZWFkZmM3ZTEyNDBjODRiNmI/
5.45.180.46
184.25.56.44
2] https://www.hybrid-analysis.com/sample/cb3f2b1a9bf2484bcc035944843ad214fd7fde854c99df0f7a5cc9369c89433c?environmentId=4
___
Fake 'Overdue Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-overdue-invoice-012345.html
15 Feb 2016 - "This malicious spam appears to come from many different senders and companies. It has a malicious attachment:
From: Brandi Riley [BrandiRiley21849@ horrod .com]
Date: 15 February 2016 at 12:20
Subject: Overdue Invoice 089737 - COMS PLC
Dear Customer,
The payment is overdue. Your invoice appears below. Please remit payment at your earliest convenience.
Thank you for your business - we appreciate it very much.
Sincerely,
Brandi Riley
COMS PLC
Attached is a file in the format INVOICE-UK865916 2015 NOV.doc which comes in several different versions (VirusTotal results [1] [2] [3]). The Hybrid Analysis* shows an attempted download from:
node1.beckerdrapkin .com/fiscal/auditreport.php
This is hosted on an IP that you can assume to be malicious:
193.32.68.40 (Veraton Projects, BZ / DE)
The dropped executable (detection rate 4/54**) then phones home to:
194.58.92.2 (Reg.Ru Hosting, Russia)
202.158.123.130 (Cyberindo Aditama, Indonesia)
185.24.92.229 (System Projects LLC, Russia)
The payload is the Dridex banking trojan.
Recommended blocklist:
193.32.68.40
194.58.92.2
202.158.123.130
185.24.92.229 "
1] https://www.virustotal.com/en/file/d3fc94aad326dae103c05d871aee3246e14084d6ef9a6e89b05fa196f567f74b/analysis/1455541445/
2] https://www.virustotal.com/en/file/cea4ceee14cad0949fbcc633124b405bebc4bcfc5a64b3c15fcb59dbd724febf/analysis/1455541455/
3] https://www.virustotal.com/en/file/6385d5a08a9a9790635740a6459c308c6a7c9ed7302b3da47c6c132999b8e6b1/analysis/
* https://www.hybrid-analysis.com/sample/6385d5a08a9a9790635740a6459c308c6a7c9ed7302b3da47c6c132999b8e6b1?environmentId=4
** https://www.virustotal.com/en/file/fb96628a54bf2ed5c9eddeb30843013a7b6c301b66790eed0a1e199e4a6b3122/analysis/1455542606/
TCP connections
202.158.123.130: https://www.virustotal.com/en/ip-address/202.158.123.130/information/
81.52.160.146: https://www.virustotal.com/en/ip-address/81.52.160.146/information/
185.24.92.229: https://www.virustotal.com/en/ip-address/185.24.92.229/information/
>> https://www.virustotal.com/en/url/65074341a64d05e8d7812bdcc8b91956d6f7b0f36f803b4dedd0e18344af02fa/analysis/
___
Dyre Trojan - gone dark...
- https://securityintelligence.com/dyre-straights-group-behind-the-dyre-trojan-busted-in-moscow/
Feb 9, 2016 - "... Reuters reports* that a police raid took place in November 2015 in a downtown Moscow high-rise. The operation reportedly took place inside the offices of a film distribution and production company called 25th Floor, which is, ironically, in the midst of producing a movie called 'Botnet', loosely based on a 2010 cybercrime case... IBM X-Force researchers indicate that Dyre, which has been a constantly evolving threat, fell silent in November 2015. According to IBM Trusteer, malware infection rates dropped sharply in mid-November, with new user infections appearing in the single digits per day at most. Beyond the drop in new infections, which signified the halt of spam/exploit kit campaigns, Dyre’s configuration-update-servers and its real-time-webinjection-server were -both- disconnected from the Internet as the malware ceased generating attempted fraudulent transactions. A week later, in late November, Dyre’s redirection attack servers also went dark:
> https://static.securityintelligence.com/uploads/2016/02/Fig1_Attacks_Flatten.png
It has been close to three months now since Dyre went silent. This in and of itself could have been a pause taken by its operators, an occurrence that happens from time to time; in September 2015, Dridex, too, went silent for almost a month. But cybercrime gangs like Dyre do not typically stay out of the game for three whole months unless they are in trouble. And trouble is apparently what befell the Dyre crew in Moscow last November. Dyre is considered one of the most advanced banking Trojans active in the wild today. Beyond the technical level of its attacks, Dyre is prolific in different parts of the globe and has made its mark as the most active Trojan family in 2015, according to IBM Trusteer data:
> https://static.securityintelligence.com/uploads/2016/02/Fig2_Top_Bankers.png
If the gang operating Dyre has indeed been apprehended in Russia, the event will go down as one of the most significant cybercrime busts in history. More than its magnitude in terms of the fraud losses that will be spared, it will be one of the most noteworthy operations carried out against cybercrime on Russian soil by Russian authorities... Dyre’s absence will also give a bigger market share to other malware like Dridex, for example, which, according to IBM X-Force researchers, has been enhancing its attack methods to match Dyre’s and focusing on high-value business and corporate accounts in the U.K. and the U.S., which closely resembles Dyre’s path through the year before the raid..."
* http://www.reuters.com/article/us-cybercrime-russia-dyre-exclusive-idUSKCN0VE2QS
:fear::fear: :mad:
AplusWebMaster
2016-02-16, 13:48
FYI...
Fake 'Remittance Advice' SPAM - doc malware
- http://myonlinesecurity.co.uk/remittance-advice-tue-16-feb-2016-165529-0800-fmisoldham-gov-uk-word-doc-malware/
16 Feb 2016 - "An email with the subject of 'Remittance Advice : Tue, 16 Feb 2016 16:55:29 +0800' pretending to come from fmis@ oldham .gov.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: fmis@ oldham .gov.uk
Date: Tue 16/02/2016 08:55
Subject: Remittance Advice : Tue, 16 Feb 2016 16:55:29 +0800
Attachment: 201602_4_2218.docm
Confidentiality: This email and its contents and any attachments are intended
only for the above named. As the email may contain confidential or legally privileged information,
if you are not, or suspect that you are not, the above named or the person responsible
for delivery of the message to the above named, please delete or destroy the
email and any attachments immediately.
Security and Viruses: This note confirms that this email message has been
swept for the presence of computer viruses...
16 February 2016: 201602_4_2218.docm - Current Virus total detections 5/54*
MALWR** shows a download of Dridex banking Trojan from
http ://lepeigneur .power-heberg .com/09u8h76f/65fg67n (VirusTotal 4/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d25cc001fa1edd25a1cc12c949e1e5b29107eca6fedaa6f17a2920f9745ef7e3/analysis/1455613213/
** https://malwr.com/analysis/YmNhZDRhMDljOGE4NGNiYzk1Njg1M2IyMzJhNDFhNDA/
91.238.72.69
151.248.117.140
184.25.56.42
*** https://www.virustotal.com/en/file/c99b48a55f8ae132c14aac8d19de47df52440f541b62cc411c1073a3d5c72b86/analysis/1455613578/
TCP connections
151.248.117.140: https://www.virustotal.com/en/ip-address/151.248.117.140/information/
>> https://www.virustotal.com/en/url/f257d7fd585251c2c483ed8968ac11753c6bbc3c43f3d436dad76a139332767c/analysis/
104.86.111.136: https://www.virustotal.com/en/ip-address/104.86.111.136/information/
- http://blog.dynamoo.com/2016/02/malware-spam-fmisoldhamgovuk-remittance.html
16 Feb 2016 - "... This spam is related to this one*. Automated analysis of the samples [1]... plus some private sources indicate download locations for this and other related campaigns today at:
labelleflowers .co.uk/09u8h76f/65fg67n
lepeigneur.power-heberg .com/09u8h76f/65fg67n
yurtdisiegitim .tv/09u8h76f/65fg67n
hg9.free .fr/09u8h76f/65fg67n
jtonimages.perso.sfr .fr/09u8h76f/65fg67n
test.blago .md/09u8h76f/65fg67n
This file has a detection rate of 3/54**. According to those reports, it phones home to:
151.248.117.140 (Reg.ru, Russia)
87.229.86.20 (Znet Telekom, Hungary)
50.56.184.194 (Rackspace, US)
Recommended blocklist:
151.248.117.140
87.229.86.20
50.56.184.194 "
* http://blog.dynamoo.com/2016/02/malware-spam-receipt-accounts.html
1] https://malwr.com/analysis/YmNiY2Q5N2QxMDdhNDEyZDg5NmQxNmNjODZlYmU0NTA/
91.238.72.69
** https://www.virustotal.com/en/file/f36075c5c49f1514bbb1e16e2003f7297fd916bed8f1412405c4a0118820f64b/analysis/1455625563/
___
Fake 'receipt' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/receipt-accounts-word-doc-or-excel-xls-spreadsheet-malware/
16 Feb 2016 - "An email with the subject of 'receipt' pretending to come from Accounts <accounts@ aacarpetsandfurniture .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Accounts <accounts@ aacarpetsandfurniture .co.uk>
Date: Tue 16/02/2016 08:22
Subject: receipt
Attachment: CCE06102015_00000.docm
Please find attached receipt
Kind Regards
Christine ...
16 February 2016: CCE06102015_00000.docm - Current Virus total detections 5/54*
.. it will be downloading Dridex probably from -same- locations as today’s other versions (.. waiting for analysis and will update later)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/2e87bf40fc2dfe7888a925ecad8a417fae8b6e6025c2e0afee287cf61757d73a/analysis/1455615125/
- http://blog.dynamoo.com/2016/02/malware-spam-receipt-accounts.html
16 Feb 2016 - "This -fake- financial spam does not come from AA Carpets and Furniture, but is instead a simple -forgery- with a malicious attachment:
From "Accounts" [accounts@ aacarpetsandfurniture .co.uk]
Date Tue, 16 Feb 2016 02:15:52 -0700
Subject receipt
Please find attached receipt
Kind Regards
Christine ...
Attached is a file CCE06102015_00000.docm of which I have only seen a single sample, with a detection rate of 5/54*. Analysis is pending, however this would appear to be the Dridex banking trojan."
* https://www.virustotal.com/en/file/952e0ea8225a1d04d878dcb92c52e3e832d9c19eca26e78cf7050a007904244c/analysis/1455618478/
___
Fake 'Invoice-J' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-attn-invoice-j-06593788.html
16 Feb 2016 - "This -fake- financial spam does not come from Apache Corporation but instead is a simple -forgery- with a malicious attachment.
From: June Rojas [RojasJune95@ myfairpoint .net]
Date: 16 February 2016 at 09:34
Subject: ATTN: Invoice J-06593788
Dear nhardy,
Please see the attached invoice (Microsoft Word Document) and remit payment according to the terms listed at the bottom of the invoice.
Let us know if you have any questions.
We greatly appreciate your business!
June Rojas ...
Other versions of this spam may come from other corporations. In the single sample I have seen there is an attached file invoice_J-06593788.doc ... This Dridex run exhibits a change in behaviour from previous ones. I acquired three samples of the spam run and ran the Hybrid Analysis report on them [1]... and it shows that the macro dowloads from one of the following locations:
www .southlife .church/34gf5y/r34f3345g.exe
www .iglobali .com/34gf5y/r34f3345g.exe
www .jesusdenazaret .com.ve/34gf5y/r34f3345g.exe ...
Each one phones home to a -different- location, the ones I have identified are:
109.234.38.35 (McHost.ru, Russia)
86.104.134.144 (One Telecom SRL, Moldova)
195.64.154.14 (Ukrainian Internet Names Center, Ukraine)
That last sample phones home to:
91.195.12.185 (PE Astakhov Pavel Viktorovich, Ukraine)
... according to this Hybrid Analysis*.
Recommended blocklist:
109.234.38.0/24
86.104.134.128/25
195.64.154.14
91.195.12.185 "
1] https://www.hybrid-analysis.com/sample/abdbc74907d7670a65b5a4cc8c08da751cc837a11d1abb43e3ddaa932bdbf60c?environmentId=4
* https://www.hybrid-analysis.com/sample/488947790c6aba7dff05c5f1c9ce1d24b3f9e5a0677f1695bbd6ae2bd9d48236?environmentId=4
:fear::fear: :mad:
AplusWebMaster
2016-02-17, 13:36
FYI...
Fake 'random invoices' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/random-invoices-word-doc-or-excel-xls-spreadsheet-malware/
17 Feb 2017 - "... 2 concurrent runs of malspam this morning both with similar email subjects about -invoices- pretending to come from random companies with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The 1st email looks like:
From: Daniel Barnett <tmdana@ bezeqint .net>
Date: Wed 17/02/2016 05:50
Subject: Fw:Vel Faucibus Institute Last Invoice
Attachment: AKDYH0NQ.doc (versions vary in size between 230kb and 245kb)
Hi
Please review the invoice in attachment. To eliminate penalty you need to pay within 48 hours.
Best regards
Daniel Barnett
Vel Faucibus Institute
The 2nd email where the attachment name matches the subject looks like:
From: Rosie Shannon <ShannonRosie30676@ association-freudienne .be>
Date: Wed 17/02/2016 06:56
Subject: Invoice 2016-71041044 ( random numbers)
Attachment: SCAN_INVOICE_2016_71041044.doc ( 46kb)
Hi rob,
Here’s invoice 2016-71041044 for 93,79 USD for last weeks delivery.
The amount outstanding of 400,72 USD is due on 23 Feb 2016.
If you have any questions, please let us know.
Thanks,
Rosie Shannon ...
17 February 2016: AKDYH0NQ.doc - Current Virus total detections 2/55*. Waiting for analysis.
17 February 2016: SCAN_INVOICE_2016_71041044.doc - Current Virus total detections 2/54**
No conclusive result from MALWR... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6485ca4304590e95a585299aebde2f45ae4bd59953931380843c0d65716cc272/analysis/1455698505/
** https://www.virustotal.com/en/file/beadddd6c901209cec2fda0abd49d5c1e91bb56d4ca19ab168b48b37d6ed7d54/analysis/1455695702/
___
Fake 'Updated Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-fwdaccumsan-neque-llc.html
17 Feb 2017 - "This malware spam may come from several different companies, but I have only a single sample. It is notable for the -mis-spelling- of "Macros" as "Macroses" in the document.
From: Fletcher Oliver [angel@ jiahuan .com.tw]
Date: 17 February 2016 at 06:23
Subject: Fwd:Accumsan Neque LLC Updated Invoice
Good morning
Please check the bill in attachment. In order to avoid fine you have to pay in 12 hours.
Best regards
Fletcher Oliver
Accumsan Neque LLC
Attached is a document Q7FX9ZH.doc with the distinctive text: Attention! To view this document, please turn on the Edit mode and Macroses!
> https://2.bp.blogspot.com/-DoSFYG0qREE/VsRAWXBt9_I/AAAAAAAAHoE/TJTp22VxEwU/s400/macroses.png
Needless to say, enabling Edit mode and Macroses is a Very-Bad-Idea. The VirusTotal detection rate for this file is just 2/54*. Hybrid Analysis [1] [2] shows that the macro first downloads from:
www .design-i-do .com/mgs.jpg?OOUxs4smZLQtUBK=54
This looks to be an unremarkable JPEG file..
> https://2.bp.blogspot.com/-vubE5GhCXUg/VsRCIZsM3FI/AAAAAAAAHoQ/fk6jZoLUsKQ/s1600/mgs.jpg
(Note that I have munged the JPEG slightly to stop virus scanners triggering). As far as I can tell, the JPEG actually contains data that is decrypted by the macro (a technique called steganography). A malicious VBS is created... and a malicious EXE file is dropped with a VirusTotal result of 7/54**.
Automated analysis of the dropped binary [3] [4] shows that it phones home to:
216.59.16.25 (Immedion LLC, US / VirtuaServer Informica Ltda, Brazil)
I strongly recommend that you -block- traffic to that IP. Payload is uncertain, but possibly the Dridex banking trojan."
* https://www.virustotal.com/en/file/1499e4c2e5d525de5a0d8c012ec843d244e3ed99e7b3b438e3a86afee606bc17/analysis/1455699463/
1] https://www.hybrid-analysis.com/sample/1499e4c2e5d525de5a0d8c012ec843d244e3ed99e7b3b438e3a86afee606bc17?environmentId=1
2] https://www.hybrid-analysis.com/sample/1499e4c2e5d525de5a0d8c012ec843d244e3ed99e7b3b438e3a86afee606bc17?environmentId=4
** https://www.virustotal.com/en/file/1a7f3fe337fffb769bf32e8559bb53fe7cc0d846a27c3af454435d7f415ab6f7/analysis/1455701128/
TCP connections
216.59.16.25
72.247.177.174
3] https://www.hybrid-analysis.com/sample/1a7f3fe337fffb769bf32e8559bb53fe7cc0d846a27c3af454435d7f415ab6f7?environmentId=1
4] https://malwr.com/analysis/ZjE0MjJhZWJjYzU3NDY5MDllYTk0NmQ4NTZjM2QwNTI/
216.59.16.25
8.254.249.78
___
Fake bilingual SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/02/malware-spam-rechnung-2016-11365.html
17 Feb 2016 - "This -bilingual- spam does not come from mpsmobile but is instead a simple -forgery- with a malicious attachment.
... (English version)
Dear Ladies and Gentlemen,
please find attached document 'Rechnung 2016-11365' im DOC-Format. To view and print these forms, you need the DOC Reader, which can be downloaded on the Internet free of charge.
Best regards
mpsmobile GmbH...
In the sample I saw, the attachment was named 19875_Rechnung_2016-11365_20160215.docm and has a VirusTotal detection rate of 5/54*. According to this Malwr report** the binary attempts to download the Locky ransomware (seemingly a product of those behind the Dridex banking trojan). It attempts to download a binary from:
feestineendoos .nl/system/logs/7623dh3f.exe?.7055475
This dropped file has a detection rate of 3/53***. Analysis of the file is pending, but overall this has been made more complicated because the Locky installer calls out to a number of domains, many of which actually appear to have been sinkholed. Machines infected with Locky will display a message similar to this:
> https://4.bp.blogspot.com/-8Mkzv8eXCh0/VsR47t7S--I/AAAAAAAAHog/WcR1Vuza6ts/s640/_Locky_recover_instructions.png
Unfortunately, the only known way to recover from this is to -restore- files from offline -backup- once the infection has been removed from the PC.
UPDATE: Another version plopped into my inbox, VT 7/54[4] and according to this Malwr report[5], it downloads from:
nadeenk .sa/system/logs/7623dh3f.exe?.7055475
This variant POSTs to a server at:
46.4.239.76 (Myidealhost .com / Hetzner, Germany)
It is likely that the C2 server (identified in the previous report) is:
85.25.149.246 (PlusServer AG, Germany)
Recommended blocklist:
85.25.149.246
46.4.239.76 "
* https://www.virustotal.com/en/file/8b72bf6b7d268dc6fbf089814dbd0168a6b107930ba29afef6136f1c34c7b016/analysis/1455715572/
** https://malwr.com/analysis/NzAwNmQwNWMyOTI3NDYxM2FjZWJhYTZlOWY0NDg1M2Q/
Hosts
195.20.11.76: https://www.virustotal.com/en/ip-address/195.20.11.76/information/
195.22.28.197: https://www.virustotal.com/en/ip-address/195.22.28.197/information/
195.22.28.222: https://www.virustotal.com/en/ip-address/195.22.28.222/information/
104.238.173.18: https://www.virustotal.com/en/ip-address/104.238.173.18/information/
69.195.129.70: https://www.virustotal.com/en/ip-address/69.195.129.70/information/
85.25.149.246: https://www.virustotal.com/en/ip-address/85.25.149.246/information/
*** https://www.virustotal.com/en/file/02b00f7615e1fd9091d947dad00dfe60528d9015b694374df2b5525ea6dd1301/analysis/1455716319/
4] https://www.virustotal.com/en/file/705ff4f0b13a3a5bd74d01a4b8fe50a5ee26d10451c23dfbc0a19f78fb4ab2c0/analysis/1455717484/
5] https://malwr.com/analysis/NTMxZWM2MDQyYzllNDA4NTlmZjY3YzU0MDEzMzgyMjM/
Hosts
185.79.250.2: https://www.virustotal.com/en/ip-address/185.79.250.2/information/
46.4.239.76: https://www.virustotal.com/en/ip-address/46.4.239.76/information/
85.25.149.246: https://www.virustotal.com/en/ip-address/85.25.149.246/information/
>> https://www.virustotal.com/en/file/02b00f7615e1fd9091d947dad00dfe60528d9015b694374df2b5525ea6dd1301/analysis/
46.4.239.76: https://www.virustotal.com/en/ip-address/46.4.239.76/information/
>> https://www.virustotal.com/en/url/8a4a7287784f37507098cc064b805570e127b71056d1a6fefce92bd6a924d20c/analysis/
___
Fake 'tracking documents' SPAM - Locky Ransomware
- http://myonlinesecurity.co.uk/tracking-documents-cmsharpscan-word-doc-malware-locky-ransomware/
17 Feb 2016 - "An email with the subject of 'tracking documents' pretending to come from cmsharpscan3175@ gmail .com <cmsharpscan6395@ gmail .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: cmsharpscan3175@ gmail .com <cmsharpscan6395@ gmail .com>
Date: Wed 17/02/2016 12:39
Subject: tracking documents
Attachment: cmsharpscan@ gmail .com_20160217_132046.docm
Reply to: cmsharpscan@ gmail .com <cmsharpscan@ gmail .com>
Device Name: Not Set
Device Model: MX-2640N
Location: Not Set
File Format: DOC (Medium)
Resolution: 200dpi x 200dpi
Attached file is scanned image in DOC format.
25 February 2016: cmsharpscan@ gmail .com_20160217_132046.docm - Current Virus total detections 5/54*
MALWR** shows us connections to several sites where Locky ransomware is delivered and info sent back . http ://olvikt.freedomain.thehost .com.ua/admin/js/7623dh3f.exe (VirusTotal 2/54***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3c2752ac5202d92d8e5a6bfbdddeaacf32dacf1e3a711e059f43a296090afe6c/analysis/1455716522/
** https://malwr.com/analysis/NDgwZGEwZWJlODQyNDYxOTgxYzMyYjM2MjIyYzIxNGU/
176.114.0.200: https://www.virustotal.com/en/ip-address/176.114.0.200/information/
69.195.129.70: https://www.virustotal.com/en/ip-address/69.195.129.70/information/
85.25.149.246: https://www.virustotal.com/en/ip-address/85.25.149.246/information/
*** https://www.virustotal.com/en/file/02b00f7615e1fd9091d947dad00dfe60528d9015b694374df2b5525ea6dd1301/analysis/1455717353/
TCP connections
195.22.28.196: https://www.virustotal.com/en/ip-address/195.22.28.196/information/
195.22.28.222: https://www.virustotal.com/en/ip-address/195.22.28.222/information/
195.22.28.198: https://www.virustotal.com/en/ip-address/195.22.28.198/information/
185.26.105.244: https://www.virustotal.com/en/ip-address/185.26.105.244/information/
69.195.129.70: https://www.virustotal.com/en/ip-address/69.195.129.70/information/
85.25.149.246: https://www.virustotal.com/en/ip-address/85.25.149.246/information/
- http://blog.dynamoo.com/2016/02/malware-spam-tracking-documents.html
17 Feb 2016 - "This -fake- document scan spam has a malicious attachment:
From: cmsharpscan3589@ gmail .com
Date: 17 February 2016 at 14:32
Subject: tracking documents
Reply to: cmsharpscan@ gmail .com [cmsharpscan@ gmail .com]
Device Name: Not Set
Device Model: MX-2640N
Location: Not Set
File Format: DOC (Medium)
Resolution: 200dpi x 200dpi
Attached file is scanned image in DOC format.
I have only seen a single sample of this with an attachment cmsharpscan@ gmail .com_20160217_132046.docm which has a VirusTotal detection rate of 7/54*. According the the Malwr analysis** of the document, the payload is the Locky ransomware and is -identical- to the earlier attach described here***."
* https://www.virustotal.com/en/file/98eb602a448482d840da9db2458af64b9e4214e7d5c4ba3bd93999d7c9af1cf3/analysis/1455720732/
** https://malwr.com/analysis/MWJlNWEzZTgxOTJjNDEyNzhhOWY2ZmNiZDBiNDcyYmM/
Hosts
185.79.250.2: https://www.virustotal.com/en/ip-address/185.79.250.2/information/
195.22.28.197: https://www.virustotal.com/en/ip-address/195.22.28.197/information/
195.22.28.222: https://www.virustotal.com/en/ip-address/195.22.28.222/information/
195.22.28.198: https://www.virustotal.com/en/ip-address/195.22.28.198/information/
104.238.173.18: https://www.virustotal.com/en/ip-address/104.238.173.18/information/
69.195.129.70: https://www.virustotal.com/en/ip-address/69.195.129.70/information/
85.25.149.246: https://www.virustotal.com/en/ip-address/85.25.149.246/information/
*** http://blog.dynamoo.com/2016/02/malware-spam-rechnung-2016-11365.html
___
Dridex botnet - now also spreading ransomware
- https://www.helpnetsecurity.com/2016/02/17/dridex-botnet-alive-and-well-now-also-spreading-ransomware/
Feb 17, 2016 - "... the botnet is segregated into a number of subnets, each likely operated by a different team of attackers, and they continue to mount campaigns that will swell the number of infected machines and to exploit the stolen banking information:
> https://www.helpnetsecurity.com/images/posts/subnet-dridex.jpg
... its likely that, barring a comprehensive takedown, the group(s) behind the botnet will continue to pose a threat throughout 2016... one of the subnets – 220 – seems to have temporarily switched to sending out spam email delivering the Bartallex downloader, which then downloads the Locky crypto ransomware. Palo Alto Networks researchers* suspect “there is a link between the Dridex botnet affiliate 220 and Locky due to similar styles of distribution, overlapping filenames, and an absence of campaigns from this particularly aggressive affiliate coinciding with the initial emergence of Locky.” Spamming campaigns aimed at delivering the Dridex banking Trojan are many and massive – many -millions- of emails are sent out per day... The criminals mainly target English-speaking regions. Dridex is capable of stealing banking details of customers of nearly -300- financial institutions in wealthy countries, mostly the US, European and several Asia-Pacific countries."
* http://researchcenter.paloaltonetworks.com/2016/02/locky-new-ransomware-mimics-dridex-style-distribution/
Feb 16, 2016 - "... We observed approximately 446,000 sessions for this threat, over half of which targeted the United States (54%). For comparison, the next most impacted countries, Canada and Australia, only accounted for another nine percent combined:
> http://researchcenter.paloaltonetworks.com/wp-content/uploads/2016/02/locky3-500x374.png
Industry analysis for targeting reveals expected indiscriminant distribution within impacted countries; however, Higher Education, Wholesale and Retail, and Manufacturing make up over a third of observed targeting... Defending against ransomware first requires a focus on the basics of a strong security posture: security awareness and the hardening and patching of systems... To further reduce associated risks, layered preventive controls are a must..."
___
WordPress Compromise Campaign - Nuclear EK to Angler EK
- https://blog.malwarebytes.org/exploits-2/2016/02/wordpress-compromise-campaign-from-nuclear-ek-to-angler-ek/
Feb 17, 2016 - "A couple of weeks ago we blogged about an attack against WordPress-sites initially discovered by Denis Sinegubko over at Sucuri. The campaign is still going on but quickly evolved, as reported by DeepEnd Research*, with a change in its URL pattern from “/admedia/” to “/megaadvertize/”. According to our honeypot data, this change happened around Feb. 4th and has been active as ever since. Besides some pattern changes in the URL, the redirection mechanism is different from the initial campaign as well as its payload. Indeed the Admedia campaign was pushing the Nuclear exploit kit whereas this one is delivering Angler... Compromised WordPress sites are injected with a malicious blurb which is appended to -all- JavaScript files. The blurb is obfuscated -twice- before it can be human readable and reveal that its purpose is to silently load an external-malicious-URL. This URL, which bears the “MegaAdvertize” trademark, performs a fingerprint of the visitor’s machine before proceeding any further. Only people running the Internet-Explorer-browser and using a screen resolution -greater- than 800×600 (honeypot evasion) are the intended target... The payload dropped in this particular instance is TeslaCrypt. We tested this attack without Anti-Exploit to allow the malware to be downloaded... We will continue to monitor this malware campaign as we expect it to evolve again..."
* http://www.deependresearch.org/2016/02/jan-feb-2016-domains-associated-with.html
___
HP Enterprise identifies top risks for businesses
- http://www.securitynewsdesk.com/hewlett-packard-enterprise-identifies-top-risks-for-businesses-today/
Feb 17, 2016
> http://www.theinquirer.net/inquirer/news/2447488/hpe-microsoft-is-the-biggest-risk-to-enterprise-security
Feb 17, 2016
:fear::fear: :mad:
AplusWebMaster
2016-02-18, 12:41
FYI...
Fake 'Invoice' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/02/malware-spam-copy-of-invoice-20161802.html
18 Feb 2016 - "This -fake- financial spam spoofs different senders and different companies, with a different reference number in each.
From: Devon Vincent
Date: 18 February 2016 at 08:14
Subject: Copy of Invoice 20161802-99813731
Dear [redacted],
Please find attached Invoice 20161802-99813731 for your attention.
For Pricing or other general enquiries please contact your local Sales Team.
Yours Faithfully,
Devon Vincent
Tenet Healthcare Corporation ...
=================
From: Elvia Saunders
Date: 18 February 2016 at 09:19
Subject: Copy of Invoice 20161802-48538491
Dear [redacted],
Please find attached Invoice 20161802-48538491 for your attention.
For Pricing or other general enquiries please contact your local Sales Team.
Yours Faithfully,
Elvia Saunders
The PNC Financial Services Group, Inc. ...
I have seen two variants of the document (VirusTotal [1] [2]). Analysis of the documents is pending, however it is likely to be the Dridex banking trojan.
UPDATE 1: There is a second variant of the spam with essentially the same (undefined) payload:
From: Heather Ewing
Date: 18 February 2016 at 08:41
Subject: Invoice
Dear Sir/Madam,
I trust this email finds you well,
Please see attached file regarding clients recent bill. Should you need further assistances lease feel free to email us.
Best Regards,
Heather Ewing
The Bank of New York Mellon Corporation ...
In this case the attachment was named Invoice51633050.doc - automated analysis is inconclusive. An examination of the XML attachment... indicates that it may be malformed.
UPDATE 2: A contact (thank you) analysed one of the samples and found that the document downloaded an executable from:
killerjeff.free .fr/2/2.exe
According to this Malwr report* this is the Locky ransomware, and it phones home to:
95.181.171.58 (QWARTA LLC, Russia)
69.195.129.70 (Joes Data Center, US)
I suspect that the second one may be a sinkhole, but there should be no problem if you block:
95.181.171.58
69.195.129.70
UPDATE 5: ... Malwr reports on all the available samples... various versions of Locky seem to call back to:
95.181.171.58 (QWARTA LLC, Russia)
31.41.47.37 (Relink Ltd, Russia)
185.14.30.97 (ITL, Ukraine / Serverius, Netherlands)
69.195.129.70 (Joes Datacenter, US)
I have omitted what appear to be obvious sinkholes.
Recommended blocklist:
95.181.171.58
31.41.47.37
185.14.30.97
69.195.129.70 "
1] https://www.virustotal.com/en/file/667b319db6edaef7e2890ca59f8d294363d11188021903e678a19df51af780c0/analysis/1455787094/
2] https://www.virustotal.com/en/file/cac86b1071d44ecac2c1169c0f6ad278a55c66b16a22c68efe295bece31a00f1/analysis/1455787228/
* https://malwr.com/analysis/MGYxNTQ3ZTE1NmZmNDBmNGI2Mjc4NDljZmZlNWVjMDI/
Hosts
69.195.129.70
95.181.171.58
- http://myonlinesecurity.co.uk/mtc-hof-mtc-gmbh-per-e-mail-senden-rechnung-54-110090-xls-excel-xls-spreadsheet-malware/
18 Feb 2016 - "A German language email with the subject of 'Per E-Mail senden: Rechnung-54-110090.xls (random numbers)' pretending to come from MTC Hof – MTC GmbH <mtc-hof@ mtc-handy .de> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: MTC Hof – MTC GmbH <mtc-hof@mtc-handy.de>
Date:
Subject: Per E-Mail senden: Rechnung-54-110090.xls
Attachment: Rechnung-54-110090.xls
Body content: Totally blank
18 February 2016: Rechnung-54-110090.xls - Current Virus total detections 7/55*
So far automatic analysis in inconclusive... the -same- that Dynamoo describes** about today’s slightly earlier run of random invoice malspam..."
* https://www.virustotal.com/en/file/5b3b3a8d027da7ca9f0a36479f38f05ff427cbb7fb35695b7845a7703e7467b2/analysis/1455790340/
** http://blog.dynamoo.com/2016/02/malware-spam-copy-of-invoice-20161802.html
___
Fake 'Payment' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/02/malware-spam-payment-laurence-cottle.html
18 Feb 2016 - "This very widespread spam run comes with a malicious attachment which drops the Locky ransomware. Note that the email address has a random number appended to it:
From: Laurence Cottle [lcottle60@ gmail .com]
Date: 18 February 2016 at 13:35
Subject: Payment
Hi
Any chance of getting this invoice paid, please?
Many thanks
Laurence
Attached is a file unnamed document.docm which comes in several different versions. Third-party analysis (thank you!) reveals that there are download locations at:
acilkiyafetgulertekstil .com/system/logs/7647gd7b43f43.exe
alkofuror .com/system/engine/7647gd7b43f43.exe
merichome .com/system/logs/7647gd7b43f43.exe
organichorsesupplements .co.uk/system/logs/7647gd7b43f43.exe
shop.zoomyoo .com/image/templates/7647gd7b43f43.exe
tutikutyu .hu/system/logs/7647gd7b43f43.exe
vipkalyan .com.ua/system/logs/7647gd7b43f43.exe
This dropped a malicious binary with a detection rate of 3/55*, since updated to one with a detection rate of 4/55**... The malware phones home to:
195.154.241.208 /main.php
46.4.239.76 /main.php
94.242.57.45 /main.php
kqlxtqptsmys .in/main.php
cgavqeodnop .it/main.php
pvwinlrmwvccuo .eu/main.php
dltvwp .it/main.php
uxvvm .us/main.php
wblejsfob .pw/main.php
Out of those, the most supect IPs are:
195.154.241.208 (Iliad / Online S.A.S., FR)
46.4.239.76 (myidealhost.com / Hetzner, DE)
94.242.57.45 (Vstoike.com / Fishnet Communications, RU)
69.195.129.70 (Joes Datacenter LLC, US)
Recommended blocklist:
195.154.241.208
46.4.239.76
94.242.57.45
69.195.129.70 "
* https://www.virustotal.com/en/file/56fc23c1eb3c4ea5f9f7911d8bfa0af6df762eb6e22d002ddad562568606acc0/analysis/
** https://www.virustotal.com/en/file/30587ec7becbff5e55f6effdd22075568d80eb4a06ce3104502d4d76004e16f3/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-02-19, 12:26
FYI...
Released today - Good read:
Banking Botnets: The Battle Continues
- https://www.secureworks.com/research/banking-botnets-the-battle-continues
19 Feb 2016
___
Fake 'Invoice FEB' SPAM - Locky ransomware
- http://myonlinesecurity.co.uk/invoice-feb-51829253-word-doc-or-excel-xls-spreadsheet-malware/
19 Feb 2016 - "An email with the subject of 'Invoice FEB-51829253 (random numbers)' pretending to come from random names and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Tracy Osborn <OsbornTracy63422@ thehottomato .com>
Date: Fri 19/02/2016 12:05
Subject: Invoice FEB-51829253
Attachment: invoice_feb-79754078.doc
Good morning,
Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice.
If you have any questions please let us know.
Thank you!
Tracy Osborn
Accounting Specialist
19 February 2016: invoice_feb-79754078.doc - Current Virus total detections 3/56*
MALWR** shows a download from http ://www .proteusnet .it/6/6.exe (VirusTotal 8/55***) which is Locky ransomware created and distributed by the Dridex gangs... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/ace1c5ad205e88b0a2ab27a0ce8bb1c5cae1261c84a9bac6ded019d90172cc05/analysis/1455888998/
** https://malwr.com/analysis/MzM5MmUxMGNmOGFjNDRjMDljNGYxOTk2ZjdlNzEwZGQ/
Hosts
217.72.102.113
85.25.138.187
*** https://www.virustotal.com/en/file/0a809215d4845bdc11b87b07a6c2a6acfc6ad837f6ce56abbde4cf7e03efc684/analysis/1455889149/
- http://blog.dynamoo.com/2016/02/malware-spam-invoice-feb-23456789-from.html
19 Feb 2016 - "This -fake- financial spam comes from random senders, the attachment is malicious and drops the Locky ransomware:
From: Kenya Becker
Date: 19 February 2016 at 11:59
Subject: Invoice FEB-92031923
Good morning,
Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice.
If you have any questions please let us know.
Thank you!
Kenya Becker
Accounting Specialist ...
Attached is a file with a semirandom name similar to invoice_feb-92031923.doc (Sample VirusTotal report 2/55*) which contains an XML (file)... Malwr analysis of these samples [1] [2] shows it downloading a malicious executable from:
ratgeber-beziehung .de/5/5.exe
www .proteusnet .it/6/6.exe
If recent patterns are followed, there will be several different download locations with -different- versions of the file at each.. The binaries has a detection rate of 7/55** and 6/54***... Malwr reports [3]... indicate that it phones home to:
85.25.138.187 (PlusServer AG, Germany)
31.41.47.3 (Relink Ltd, Russia)
Other samples are being analysed, but in the meantime I recommend that you -block- traffic to:
85.25.138.187
31.41.47.3 ...
UPDATE 1: Some additional download locations from these Malwr reports [3]...:
ecoledecorroy .be/1/1.exe
animar .net.pl/3/3.exe
luigicalabrese .it/7/7.exe ...
UPDATE 2: Two other locations are revealed in these Malwr reports [4] [5]:
http ://lasmak .pl/2/2.exe
http ://suicast .de/4/4.exe "
* https://www.virustotal.com/en/file/c5bb15dce6954e3634afd4eb63e8d1646f80d83f26408afe3ecff88108d1962c/analysis/1455887101/
1] https://malwr.com/analysis/YTcyNmZmNjFlYzQ0NGNhZDllNDFjMDc3ZWQ1MzVlZjQ/
Hosts
217.72.102.113
31.41.47.37
2] https://malwr.com/analysis/YTEwMGI3ZGRmZWQyNDMwYzhmNGQyYTdhZTM4NjFkMmI/
Hosts
109.237.140.6
85.25.138.187
** https://www.virustotal.com/en/file/0a809215d4845bdc11b87b07a6c2a6acfc6ad837f6ce56abbde4cf7e03efc684/analysis/1455887497/
*** https://www.virustotal.com/en/file/214c0232e8543c80c7c6010319524231beab9d8689b8295f7e13296de886c15c/analysis/1455888443/
3] https://malwr.com/analysis/YjY4MDBjNmExMDdhNGI1Zjg3YWZjNDYzYzk3MWRmZDE/
Hosts
46.252.153.77
85.25.138.187
4] https://malwr.com/analysis/Nzk5ODdmZWE5YzJhNGYzMGE3OTUyYjg3OWFjM2E5MGE/
Hosts
212.69.64.100
31.41.47.37
5] https://malwr.com/analysis/YmEyYzM1YWJkNmIxNDY2ZWE5YjVkNmJhYzZmNjY4NGU/
Hosts
46.30.212.56
85.25.138.187
___
Fake 'Unpaid Invoice' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/02/malware-spam-unpaid-invoice-350-credit.html
19 Feb 2016 - "This -fake- financial spam does not come from Thistle Removals but is instead a simple -forgery- with a malicious attachment.
From credit control [invoices@ thistleremovals .co.uk]
Date Fri, 19 Feb 2016 17:52:49 +0200
Subject Unpaid Invoice #350
Message text
Please see attached letter and a copy of the original invoice.
Attached is a file with a semi-random-name, e.g. RG026052317614-SIG.zip which contains a malicious script. This script then downloads an executable from the -same- locations as found here*, dropping a malicious executable with a detection rate of 10/55** (changed from earlier today). Third party analysis (thank you) indicates that this then phones home to the following locations:
91.121.97.170 /main.php (OVH, France)
46.4.239.76 /main.php (Dmitry Melnik, Ukraine / Myidealhost.com aka Hetzner, Germany)
31.184.233.106 /main.php (Virty.io, Russia)
The payload is the Locky ransomware.
Recommended blocklist:
91.121.97.170
46.4.239.64/27
31.184.233.106 "
* http://blog.dynamoo.com/2016/02/malware-spam-rechnung-nr-2016131.html
** https://www.virustotal.com/en/file/e5ca0128b99310bbfd7e19e6cd2dada690c1eb40118449aac9644163015115fd/analysis/
___
Fake 'Rechnung Nr. 2016_131' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/02/malware-spam-rechnung-nr-2016131.html
19 Feb 2016 - "This German language spam does not comes from LFW Ludwigsluster but is instead a simple -forgery- with a malicious attachment. The sender's email address is somewhat randomised, as is the name of the attachment.
From: fueldner1A0@ lfw-ludwigslust .de
Date: 19 February 2016 at 09:10
Subject: Rechnung Nr. 2016_131
Sehr geehrte Damen und Herren,
bitte korrigieren Sie auch bei der Rechnung im Anhang den Adressaten:
LFW Ludwigsluster Fleisch- und Wurstspezialitäten
GmbH & Co.KG
Vielen Dank!
Mit freundlichen Grüßen
Anke Füldner ...
Attached is a file with a format similar to RG460634280127-SIG.zip which contains a malicious javascript in the format RG6459762168-SIG.js or similar. At the moment, I have seen two samples, both with -zero- detection rates at VirusTotal [1] [2]. Malwr analysis* of one of the samples shows that a binary is downloaded from:
mondero .ru/system/logs/56y4g45gh45h
Other samples probably have different download locations. This executable has a detection rate of 7/53** and it appears to drop another executable with a relatively high detection rate of 26/55***. Both the VirusTotal and Malwr reports indicate that this is the Locky ransomware from the people who usually push Dridex.
The malware phones home to:
46.4.239.76 (Dmitry Melnik, Ukraine / Myidealhost.com aka Hetzner, Germany)
But in fact the entire 46.4.239.64/27 range looks pretty bad and I recommend that you -block- it...
UPDATE: An additional analysis from a trusted source (thank you). Download locations are:
mondero .ru/system/logs/56y4g45gh45h
tcpos .com .vn/system/logs/56y4g45gh45h
www .bag-online .com/system/logs/56y4g45gh45h
The malware phones home to:
46.4.239.76 /main.php
94.242.57.45 /main.php
wblejsfob .pw/main.php
kqlxtqptsmys .in/main.php
cgavqeodnop .it/main.php
pvwinlrmwvccuo .eu/main.php
dltvwp .it/main.php
uxvvm .us/main.php
The active C2s (some may be sinkholes) appear to be:
46.4.239.76 (Dmitry Melnik, Ukraine / Myidealhost.com aka Hetzner, Germany)
94.242.57.45 (vstoike.com / Fishnet Communications, Russia)
185.46.11.239 (Agava Ltd, Russia)
69.195.129.70 (Joes Datacenter, US)
Analysis those C2 locations give a recommended blocklist of:
46.4.239.64/27
94.242.57.45
185.46.11.239
69.195.129.70 "
1] https://www.virustotal.com/en/file/91487c8867b88b426cf18a625f3b2f0fbe42b930cc8b8c5422a5f7a6cf42a50f/analysis/1455877852/
2] https://www.virustotal.com/en/file/1c5aad58ac1e379aa0e07bba049ca40c377301bf0e1c414e1245d8c65ac0d761/analysis/1455877999/
* https://malwr.com/analysis/M2VjNDQ0YzQxMWY3NDdmMzkxNTM1NDkyMzdlZGU5ZDI/
** https://www.virustotal.com/en/file/7b23fee16740c54dffe9bedae6b37f18072331051012e54747675f4e8c5dea75/analysis/1455878753/
*** https://www.virustotal.com/en/file/2cbf3ac4f304fa711e23d6a8a762451b7b06550d56b7bd688d4c6d1bee9984db/analysis/1455878570/
> http://myonlinesecurity.co.uk/rechnung-nr-2016_131-lfw-ludwigslust-de-js-malware/
19 Feb 2016
"... Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/Rechnung-Nr-2016_131-1024x775.png
... it is likely to be either Dridex banking malware or the new Locky ransomware which uses the Dridex delivery network. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
___
Fake 'Our new Order' SPAM - PDF malware
- http://myonlinesecurity.co.uk/our-new-order-fake-pdf-malware/
19 Feb 2016 - "An email with the subject of 'Our new Order' pretending to come from Benalin CO LTD <jkt-genmbox@ benline .co.id> with an executable file that is named to look like a PDF file attachment is another one from the current bot runs... The email looks like:
From: Benalin CO LTD <jkt-genmbox@benline .co.id>
Date: Fri 19/02/2016 09:30
Subject: Our new Order
Attachment: PO_160136_pdf
Dear Customer,
Find attached our purchase order. Kindly quote us best price and send us proforma invoice asap, so that we can proceed with the necessary payment,We need this Order urgently. kindly confirm the PO and send PI asap.
thank you.
Graha Paramita Building 12th Floor
Jalan Denpasar Raya Blok D-2
Kav.8, Kuningan
Jakarta 12940, Indonesia ...
25 February 2016: PO_160136_pdf - Current Virus total detections 7/55* . MALWR**
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3a825900f92441a950353686a5e448052b8d83f037af1beb391d0331ce244f67/analysis/1455874178/
** https://malwr.com/analysis/YWFkNGU0NDE5NGNjNGJlNTllNjNmNWNjMTI2NTY2OTE/
___
Phishy Accountant... doesn’t Add Up
- https://blog.malwarebytes.org/phishing/2016/02/the-phishy-accountant-something-doesnt-add-up/
Feb 19, 2016 - "We’ve recently come across a -phish- aimed at people working in / related to accounting firms, sent from a -compromised- accountant’s email address leading to a -fake- Google Docs page. The email reads as follows:
> https://blog.malwarebytes.org/wp-content/uploads/2016/02/accountantspam1.jpg
'Subject Important - For your review
Hello, I've shared some files with you on Google Drive.
Please, click on the E-Document to download the file.
Best regards
The -bogus- link would take potential victims to:
espaciovitalhn(dot)com/cpa/
> https://blog.malwarebytes.org/wp-content/uploads/2016/02/accountantspam2.jpg
The site reads as follows:
'To view shared files and folders
You are required to sign in with your email address to access shared files and folders'
The -fake- login page casts a wide net, offering up login fields for Gmail, Yahoo Mail, Hotmail, AOL and “other”. You’ll notice the “CPA” in the URL – this would be related to Certified Public Accountants. Given the potentially sensitive data accountants have access to on a daily basis, angling for their logins could result in a nice-little-haul for the scammers. Anybody dealing with finance tends to be a hot target for -fake- mails containing Ransomware files*, but it’s worth remembering the more straightforward scams are still out there ready to strike. As always, some basic security precautions pay dividends here – note the -lack- of HTTPs on the above screenshot, which is (almost always) a sign that the site is a phish. You should always-be-highly-suspicious of -any- email you didn’t request directing you to a login page – that (plus the -missing- green padlock) certainly hits high on the “Back away slowly” meter..."
* http://blog.dynamoo.com/2016/02/malware-spam-invoice-feb-23456789-from.html
espaciovitalhn(dot)com: 72.167.131.7: https://www.virustotal.com/en/ip-address/72.167.131.7/information/
>> https://www.virustotal.com/en/url/af08e5e3bd50c65f504dc2bdfb57c6cb17515097f0b3812fdf466b8df674bbee/analysis/
___
Surge in IRS E-mail Schemes - 2016 Tax Season - Tax Industry Also Targeted
- https://www.irs.gov/uac/Newsroom/Consumers-Warned-of-New-Surge-in-IRS-Email-Schemes-during-2016-Tax-Season-Tax-Industry-Also-Targeted
Feb. 18, 2016 - "The Internal Revenue Service renewed a consumer alert for e-mail schemes after seeing an approximate 400 percent surge in phishing and malware incidents so far this tax season. The -emails- are designed to trick taxpayers into thinking these are official communications from the IRS or others in the tax industry, including tax software companies. The phishing schemes can ask taxpayers about a wide range of topics. E-mails can seek information related to refunds, filing status, confirming personal information, ordering transcripts and verifying PIN information. Variations of these -scams- can be seen via text messages, and the communications are being reported in every section of the country... This tax season the IRS has observed fraudsters more frequently asking for personal tax information, which could be used to help file -false- tax returns... The IRS has seen an increase in reported phishing and malware schemes, including:
• There were 1,026 incidents reported in January, up from 254 from a year earlier.
• The trend continued in February, nearly doubling the reported number of incidents compared to a year ago. In all, 363 incidents were reported from Feb. 1-16, compared to the 201 incidents reported for the entire month of February 2015.
• This year's 1,389 incidents have already topped the 2014 yearly total of 1,361, and they are halfway to matching the 2015 total of 2,748.
... tax professionals are also reporting phishing scams that are seeking their online credentials to IRS services, for example the IRS Tax Professional PTIN System. Tax professionals are also reporting that many of their clients are seeing the e-mail schemes... It is important to keep in mind the IRS generally does -not- initiate contact with taxpayers by email to request personal or financial information. This includes any type of electronic communication, such as text messages and social media channels..."
(More detail at the IRS URL above.)
:fear::fear: :mad:
AplusWebMaster
2016-02-22, 15:34
FYI...
Fake 'Rechnung Nr. 88971' SPAM - malicious doc attachment
- http://myonlinesecurity.co.uk/rechnung-nr-88971-vom-15-02-2016-pretending-to-come-from-your-own-email-domain-word-doc-malware/
22 Feb 2016 - "... an email written in German language pretending to be from an ADVANCED COURIER with the subject of 'Rechnung Nr. 88971 vom 15.02.2016' pretending to come from Volker Maier <MaierVolker8742@ malware-research .co.uk> (I think it is probably a random name at your own email domain) with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Volker Maier <MaierVolker8742@ malware-research .co.uk>
Date:
Subject: Rechnung Nr. 88971 vom 15.02.2016
Attachment: Rechnung88971_3974069.doc
Sehr geehrte Damen und Herren,
in der Anlage erhalten Sie unsere Rechnung 88971 vom 15.02.2016 im MS-Office Word Format. Diese Reifen sind per DPD an Sie unterwegs.
Bitte drucken Sie diesen Beleg für Ihre weitere Verwendung und für Ihre Unterlagen aus.
Bitte beachten ! Dieser Beleg ist das Orginalexemplar !
Mit freundlichen Grüßen
Volker Maier
ADVANCED COURIER
22 February 2016: Rechnung88971_3974069.doc - Current Virus total detections 1/56*
MALWR** shows a download from http ://main.americaafricatradeshowandconference .com/feel/good.php which gave me loader.med.120.exe (VirusTotal 34/56***) which looks like a typical Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b59dcb16a6f6f46bc91925965d07026c8d5b6c34a57cb5ca92fe4fd68378832a/analysis/1456146779/
** https://malwr.com/analysis/NjA5OTk1NzIzOTczNDliZTk2YTcxZDYwNmJlNjEyMjU/
Hosts
37.46.133.164
192.100.170.12
13.107.4.50
*** https://www.virustotal.com/en/file/828a5e7199ca401a15fcc21ab541691b1cbaf6660421e315fee9d3ed38a5ad3b/analysis/1456146232/
___
Fake 'BoA Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/bank-of-america-invoice-attached-word-doc-malware/
22 Feb 2016 - "An email appearing to be a Bank of America Invoice or statement with the subject of 'Invoice Attached' coming from admin@ mastershell .ru with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: admin@ mastershell .ru
Date: Tue 23/02/2016 08:20 ( received at 16.30 gmt)
Subject: Invoice Attached
Attachment: invoice_321112.doc
Good morning,
Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice. If you have any questions please let us know.
Thank you!
Mr. Jakes Jordaan J.D. Accounting Specialist| Bank of America, The Jordaan Law Firm, PLLC
Banking products are provided by Bank of America, N.A. and affiliated banks, Members FDIC and wholly owned subsidiaries of Bank of America Corporation.
Investment and insurance products ...
22 February 2016: invoice_321112.doc - Current Virus total detections 3/51*
MALWR** shows a download from http ://amoretanointrodano31 .com/posts/amr507.exe (virustotal 4/56***) Which is being indentified as Nymaim ransomware... Dridex/Locky -does- update at frequent intervals during the day, so you might get a different version of this nasty Ransomware or banking, password stealer Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e5c5385b79743ced00adebc0daae5fa619cf3836417bc2b0379f98a24f81c4bb/analysis/1456155179/
** https://malwr.com/analysis/MWU5ZTU3M2MwZTQxNGEzOTkyYTc0YzRhZmY4ZTRhOGU/
Hosts
96.251.21.189: https://www.virustotal.com/en/ip-address/96.251.21.189/information/
>> https://www.virustotal.com/en/url/b1fd9bed9e9952e865367bb9f179a7b80bc0505c6d5de6a275d2bebc85681c6d/analysis/
*** https://www.virustotal.com/en/file/33bc14e756b6c1e2fcb4cbc7707772371444272af440108422d9b1e0aa327032/analysis/1456158904/
___
Locky: Clearly Bad Behavior
- https://labsblog.f-secure.com/2016/02/22/locky-clearly-bad-behavior/
2016.02.22 - "... Locky’s most common infection vector has been via e-mail. A word document attachment is sent out claiming to be an invoice. When opened, the document appears scrambled and prompts the recipient to enable macros in order to view, and -if- they do so, an executable (ladybi.exe) gets dropped and starts encrypting data files using 128-bit AES encryption..."
:fear::fear: :mad:
AplusWebMaster
2016-02-24, 12:26
FYI...
Fake 'VAT Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/british-gas-vat-invoice-quote-ref-es0142570-word-doc-malware/
24 Feb 2016 - "An email appearing to be a British Gas vat invoice with the subject of 'VAT Invoice – Quote Ref: ES0142570' pretending to come from CardiffC&MFinance <CardiffC&MFinance@ centrica .com> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/02/VAT-Invoice-Quote-Ref-ES0142570-1024x546.png
24 February 2016: archive-0910001923884.docm - Current Virus total detections 3/56*
Payload Security** shows it downloads skropotov .ru/system/logs/87h754.exe (VirusTotal 5/55***). This almost certainly will be either Dridex banking Trojan or Locky Ransomware which is distributed via the Dridex botnet and gangs... Other download locations discovered include:
school62 .dp .ua/new_year/balls/87h754.exe
designis .com .ua/admin/images/87h754.exe
armo .sk/system/logs/87h754.exe
eyesquare .tn/system/logs/87h754.exe
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a501e5b0e03cbbcec63e26525a7aa2230f6a785c648f16eb09d5ed28b4fb88c3/analysis/1456307598/
** https://www.reverse.it/sample/a501e5b0e03cbbcec63e26525a7aa2230f6a785c648f16eb09d5ed28b4fb88c3?environmentId=4
Host Address
78.108.80.77
80.86.91.232
62.109.133.248
176.53.0.103
*** https://www.virustotal.com/en/file/7c355f5044291eef6d39fa7b93dff6f8497d92d2072cc3813cf5313e0c6f570b/analysis/1456308031/
TCP connections
80.86.91.232: https://www.virustotal.com/en/ip-address/80.86.91.232/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
- http://blog.dynamoo.com/2016/02/malware-spam-vat-invoice-quote-ref.html
24 Feb 2016 - "This -fake- financial spam is not from British Gas/Centrica but is instead a simple -forgery- with a malicious attachment.
From: CardiffC&MFinance [CardiffC&MFinance@ centrica .com]
Date: 24 February 2016 at 09:09
Subject: VAT Invoice - Quote Ref: ES0142570
Good Afternoon,
Please find attached a copy of the VAT invoice as requested.
Regards
Tracy Whitehouse
Finance Team
British Gas Business ...
... there is an attached file named archive-0910001923884.docm which has a VirusTotal detection rate of 3/55*. Analysis of this document is pending, but it is likely to drop either the Dridex banking trojan or Locky ransomware."
* https://www.virustotal.com/en/file/b6b5c9d6909c68ba5cfd4e62434b415998cd9609ce3b753ddd0ab4250778c21c/analysis/1456309444/
UPDATE 1: The Hybrid Analysis[1] of the document plus the VirusTotal scan of the dropped EXE look like Dridex. The download location for that document was:
skropotov .ru/system/logs/87h754.exe
C2 to block:
80.86.91.232 (PlusServer, Germany)..."
1] https://www.hybrid-analysis.com/sample/b6b5c9d6909c68ba5cfd4e62434b415998cd9609ce3b753ddd0ab4250778c21c?environmentId=4
skropotov .ru: 78.108.80.77: https://www.virustotal.com/en/ip-address/78.108.80.77/information/
>> https://www.virustotal.com/en/url/39f6902fb18958c21dfe782ee7c096ef165246d7220257355909476642da5abc/analysis/
80.86.91.232: https://www.virustotal.com/en/ip-address/80.86.91.232/information/
___
Fake 'Ikea order' SPAM - doc malware
- http://myonlinesecurity.co.uk/ikea-thank-you-for-your-order-word-doc-malware-2/
24 Feb 2016 - "An email that appears to be an Ikea order with the subject of 'Thank you for your order!' pretending to come from DoNotReply@ ikea .com with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... Many of these are coming in corrupt with the attachment embedded inside the email body as a base 64 attachment. Some mail servers will automatically fix them, but others will deliver them as non working... The email looks like:
From: DoNotReply@ ikea .com
Date: Wed 24/02/2016 10:50
Subject: Thank you for your order!
Attachment: IKEA receipt 656390.docm
IKEA UNITED KINGDOM
Order acknowledgement:
To print, right click and select print or use keys Ctrl and P.
Thank you for ordering with IKEA Shop Online. Your order is now being processed. Please check your order and contact us as soon as possible if any details are incorrect. IKEA Customer Relations, Kingston Park, Fletton, Peterborough, PE2 9ET. Tel: 0203 645 0015
Total cost: £122.60
Delivery date: 24-02-2016
Delivery method: Parcelforce
We will confirm your delivery date by text,email or telephone within 72 hrs.
Order/Invoice number: 607656390
Order time: 8:31am GMT
Order/Invoice date: 24-02-2016 ...
24 February 2016: IKEA receipt 656390.docm - Current Virus total detections 3/56*
I am waiting for analysis. This will almost certainly turn out to download either Dridex banking Trojan or Locky Ransomware... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/39aaa514c0557775af9ddec5d18eb7aaab426f921ba86ce10f061a05fcf970d1/analysis/1456311298/
- http://blog.dynamoo.com/2016/02/malware-spam-fail-thank-you-for-your.html
24 Feb 2016 - "This fake financial spam is not from IKEA, but it instead a simple forgery. I can only assume that it is meant to have a malicious attachment, but due to a formatting error it may not be visible.
From: DoNotReply@ ikea .com
Date: 24 February 2016 at 09:56
Subject: Thank you for your order!
IKEA
IKEA UNITED KINGDOM
Order acknowledgement:
To print, right click and select print or use keys Ctrl and P.
Thank you for ordering with IKEA Shop Online. Your order is now being processed. Please check your order and contact us as soon as possible if any details are incorrect. IKEA Customer Relations, Kingston Park, Fletton, Peterborough, PE2 9ET. Tel: 0203 645 0015
Total cost: £122.60
Delivery date: 24-02-2016
Delivery method: Parcelforce
We will confirm your delivery date by text,email or telephone within 72 hrs.
Order/Invoice number: 607656390
Order time: 8:31am GMT
Order/Invoice date: 24-02-2016 ...
The intention here is either to drop the Dridex banking trojan or Locky ransomware. If you see an attachment, do -not- open it... UPDATE: Third-party analysis confirms that the attachments are broken and will not work in many mail clients. However, if they did the payload would be identical to this*."
* http://blog.dynamoo.com/2016/02/malware-spam-vat-invoice-quote-ref.html
___
Fake 'Order Conf' SPAM - doc malware
- http://myonlinesecurity.co.uk/order-conf-3360069-designersguild-com-word-doc-malware/
24 Feb 2016 - "... an email with the subject of 'Order Conf. 3360069' pretending to come from Abigail Jones <ajones@ designersguild .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Abigail Jones <ajones@ designersguild .com>
Date: Wed 24/02/2016 11:09
Subject: Order Conf. 3360069
Attachment: Order Conf__3360069_22_02_2016.docm
Please see attached
24 February 2016: Order Conf__3360069_22_02_2016.docm - Current Virus total detections 3/55*
Waiting for analysis but this is almost certain to download either Dridex Banking Trojan or Locky Ransomware for the -same- locations in today’s earlier Malspam runs** with Word docs***... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0fef0d83f4d0e102390684e0230bf6d539a158f8dba84fa0f7e80f31b3f3f542/analysis/1456312210/
** http://myonlinesecurity.co.uk/british-gas-vat-invoice-quote-ref-es0142570-word-doc-malware/
*** http://myonlinesecurity.co.uk/ikea-thank-you-for-your-order-word-doc-malware-2/
___
Evil network: 184.154.28.72/29 ...
- http://blog.dynamoo.com/2016/02/evil-network-184154287229-marko-cipovic.html
24 Feb 2016 - "liveadexchanger .com is an advertising network with a questionable reputation* currently hosted on a Google IP of 146.148.46.20. The WHOIS details are -anonymous-, never a good sign for an ad network. Seemingly running ads on the scummiest websites, liveadexchanger .com does things like trying to install fake-Flash-updates on visitors computers, as can be seen from this URLquery report**... you might find the screenshot missing because of the complex URL, so here it is..
> https://3.bp.blogspot.com/-uOJGa-oJfBk/Vs3L-jZPTaI/AAAAAAAAHqo/d6d921ThQcg/s640/fake-flash-2.jpg
That landing page is on alwaysnewsoft.traffic-portal .net (part of an extraordinarily nasty network at 184.154.28.72/29) which then forwards unsuspecting visitors to a -fake- download at intva31.peripheraltest .info which you will not be surprised to learn is hosted at the adware-pusher's favourite host of Amazon AWS. Of the 567 sites that have been hosted in this /29 (not all are there now), 378 of them are tagged-as-malicious in some way by Google (67%) and 157 (28%) are also tagged by SURBL as being malicious in some way. Overall then, 74% are marked as malicious by either Google or SURBL, which typically means that they just haven't caught up yet with the other bad domains... I would recommend the following blocklist:
liveadexchanger .com
184.154.28.72/29 "
(More detail at the dynamoo URL above.)
* https://www.google.com/transparencyreport/safebrowsing/diagnostic/index.html#url=liveadexchanger.com
** https://urlquery.net/report.php?id=1456327368298
___
Fake 'Scanned image' SPAM - JS malware
- http://myonlinesecurity.co.uk/scanned-image-from-southlands1234-at-your-own-email-domain-js-malware/
24 Feb 2016 - "An email with the subject of 'Scanned image' pretending to come from admin <southlands3452@ victim domain .tld> with a zip attachment is another one from the current bot runs... The email looks like:
From: admin <southlands3452@ victim domain .tld>
Date: Wed 24/02/2016 15:43
Subject: Scanned image
Attachment:
Image data in PDF format has been attached to this email.
24 February 2016: 24-02-2016-00190459.zip: Extracts to: PD7755363543.js - Current Virus total detections 0/56*
which downloads Locky ransomware from same locations in this earlier post**. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/9d7168155da8bf83d95e715623163caf5791593d874c56189377e0d3fac5cdf3/analysis/1456327535/
** http://myonlinesecurity.co.uk/neues-fax-von-034205-998306-js-malware
"...demo2.master-pro .biz/plugins/ratings/87h754 which is a text file that is saved as kEGQvyeDi.exe
(virustotal ***)
*** https://www.virustotal.com/en/file/3dc979164206c86823cab9684e662f84528d40a92027f48d31970c3d8f9f5114/analysis/1456322392/
demo2.master-pro .biz: 81.177.140.123: https://www.virustotal.com/en/ip-address/81.177.140.123/information/
>> https://www.virustotal.com/en/url/4e733c63c850c425881b46e80eb3fe242d048bcf1f14992e7347ecbbb5e5ad49/analysis/
- http://blog.dynamoo.com/2016/02/malware-spam-scanned-image-image-data.html
24 Feb 2016 - "This -fake- document scan has a malicious attachment. It appears to come from within the victim's own domain, but this is a malicious forgery.
From: admin [southlands71@ victimdomain .tld]
Date: 24 February 2016 at 15:25
Subject: Scanned image
Image data in PDF format has been attached to this email.
... As this Hybrid Analysis shows*, the payload is the Locky ransomware. The dropped binary has a detection rate of just 2/55**.
Those reports show the malware phoning home to:
5.34.183.136 (ITL, Ukraine)
I strongly recommend that you -block- traffic to that IP."
* https://www.hybrid-analysis.com/sample/f927efd7cd2da3a052d857632f78ccf04b673e2774f6ce9a075e654dfd77d940?environmentId=1
** https://www.virustotal.com/en/file/f927efd7cd2da3a052d857632f78ccf04b673e2774f6ce9a075e654dfd77d940/analysis/1456331864/
TCP connections
5.34.183.136: https://www.virustotal.com/en/ip-address/5.34.183.136/information/
>> https://www.virustotal.com/en/url/78c177c1f400d960d3e1db17a89fb317443db176fc23e92b6b5370578a5426ac/analysis/
___
More Fake 'random invoice's SPAM - Dridex or Locky ransomware
- http://myonlinesecurity.co.uk/more-random-invoice-from-word-doc-leading-to-dridex-or-locky-ransomware/
24 Feb 2016 - "... flooded again this afternoon with emails about invoices and remittance advices pretending to come from random companies and random email addresses with a malicious word doc attachment... (more) from the current bot runs... There are -3- distinct email templates spreading. All mention the name of the alleged sender in the body. The 1st email that mentions a randomly chosen well known company in the body looks like:
From: Patty Reese <ReesePatty0497@une .net.co>
Date: Wed 24/02/2016 16:59
Subject: February Invoice #079732
Attachment: INV00849 – 079732.doc
Hello ,
Please review the attached copy of your Electronic document.
A paper copy of this document is being mailed, but this email is being sent in addition for your convenience.
Thank you for your business,
Patty Reese
Wahl Canada Inc...
24 February 2016: INV00849 – 079732.doc - Current Virus total detections 1/53[1]
Downloads svrapp02.smoothiewarehouse .info/fecha/esberando.php which gave me scrooge.exe (VirusTotal 3/56[2])
24 February 2016: Invoice_ref-39513520.doc - Current Virus total detections 1/56[3]
downloads Locky ransomware from s536335847.mialojamiento .es/4/4.exe (VirusTotal 4/56[4])
24 February 2016: remittance_advice6BEFBC.doc - Current Virus total detections 1/55[5]
downloads Locky ransomware from svrapp02.cubicgrains .com/fecha/esberando.php (VirusTotal 3/56[6])..
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
1] https://www.virustotal.com/en/file/236688e54448a17673453b4174ad450b6685e429cddac8b9bf8b1b8ac804d744/analysis/
2] https://www.virustotal.com/en/file/3076cd1dea4db0043c86cae6861221ffa30aaa46684234629e739f1f75fd9558/analysis/1456334642/
TCP connections
31.41.47.37: https://www.virustotal.com/en/ip-address/31.41.47.37/information/
3] https://www.virustotal.com/en/file/3caf5188e753f09c45dd7f2070d78261b64271cedc3b49f9ad19a98cf39da86f/analysis/1456333034/
4] https://www.virustotal.com/en/file/5a772f09670e545aafd69b9a9ddfab8bfb878daa07397aea18512a3bffbeefbf/analysis/1456334033/
TCP connections
51.254.19.227: https://www.virustotal.com/en/ip-address/51.254.19.227/information/
5] https://www.virustotal.com/en/file/a6113b5e350d4734a38907f7b7f95668869591d4d3a32105242220be80f6f577/analysis/1456334810/
6] https://www.virustotal.com/en/file/3076cd1dea4db0043c86cae6861221ffa30aaa46684234629e739f1f75fd9558/analysis/1456334642/
TCP connections
31.41.47.37: https://www.virustotal.com/en/ip-address/31.41.47.37/information/
:fear::fear: :mad:
AplusWebMaster
2016-02-25, 12:57
FYI...
Fake 'Doc attached' SPAM - xls malware
- http://myonlinesecurity.co.uk/document-no-1076196-pretending-to-come-from-accounts-at-your-own-domain-excel-xls-spreadsheet-malware/
25 Feb 2016 - "An email with the subject of 'Document No 1076196' pretending to come from Accounts at your own domain with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Accounts <accounts@ victim domain .tld>
Date:
Subject: Document No 1076196
Attachment: Document No 1076196.xls
Thanks for using electronic billing
Please find your document attached
Regards
Accounts
25 February 2016: Document No 1076196.xls - Current Virus total detections 5/56*
Hybrid analysis** shows it downloads demo2.master-pro .biz/images/flags/76ghby6f45.exe.
It is almost certain that this is either Dridex banking Trojan or Locky ransomware. Locky is distributed via the Dridex botnet... Other download locations discovered so far include:
http ://mysite.dp .ua/adminka/jqvmap/76ghby6f45.exe and:
sepadugroup .com .my/system/logs/76ghby6f45.exe ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/739a083bd5e81ab6a89dd0ce9bc391057ee487a33f025cb4985f65f18bf503f6/analysis/1456394222/
** https://www.hybrid-analysis.com/sample/739a083bd5e81ab6a89dd0ce9bc391057ee487a33f025cb4985f65f18bf503f6?environmentId=4
Host Address
81.177.140.123: https://www.virustotal.com/en/ip-address/81.177.140.123/information/
>> https://www.virustotal.com/en/url/8c848308f65cfaf9d27310b648a8d8876143a27e721f6e9fb573f68e4e114278/analysis/
91.236.4.234: https://www.virustotal.com/en/ip-address/91.236.4.234/information/
___
Fake 'FW: INVOICE' SPAM - doc malware
- http://myonlinesecurity.co.uk/fw-invoice-1442049-maddi-cross-at-your-own-email-domain-word-doc-malware/
25 Feb 2016 - "An email with the subject of 'FW: INVOICE- 1442049 ( random numbers)' pretending to come from Maddi Cross <maddi.cross@ your own email domain> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Maddi Cross <maddi.cross@ victim domain . tld>
Date: Thu 25/02/2016 10:17
Subject: FW: INVOICE- 1442049
Attachment: INVOICE-6154119.docm
With Kind Regards,
Maddi Cross
Customer Service Team Leader ...
25 February 2016: INVOICE-6154119.docm - Current Virus total detections 6/56*
Downloads sepadugroup .com.my/system/logs/76ghby6f45.exe (VirusTotal 2/56**). It is almost certain to download either Dridex banking Trojan or Locky Ransomware, which are both using the -same- distribution network... Other download locations with same file names so far discovered include:
http ://mysite.dp .ua/adminka/jqvmap/76ghby6f45.exe ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f6a7a472e4cc307a866c3872d8ad5f6219b1e25ce9a6aa6d4184d63a16e61842/analysis/1456396242/
** https://www.virustotal.com/en/file/ad182f7550b3eb996c9ae1d8640e71060db875f554d9ddd91f1cd2828b3cb9c4/analysis/1456396563/
sepadugroup .com.my: 167.114.103.208: https://www.virustotal.com/en/ip-address/167.114.103.208/information/
>> https://www.virustotal.com/en/url/1ff3055075dea2577debca7c1fde274c06c1e48039281b599e33d17fbf3c0c5a/analysis/
mysite.dp .ua: 176.114.0.200: https://www.virustotal.com/en/ip-address/176.114.0.200/information/
>> https://www.virustotal.com/en/url/9e285b05f804a78f2e2cece4d23fc4a57736a0b6f4b7597dda977f89f2f33f18/analysis/
___
Fake 'Attached Image' SPAM - doc malware
- http://myonlinesecurity.co.uk/attached-image-pretending-to-come-from-scanner-at-your-own-email-domain-word-macro-malware-dridex-or-locky-ransomware/
25 Feb 2016 - "... an email with the subject of 'Attached Image' pretending to come from scanner@ your own email domain with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: scanner@ Victim domain. tld
Date: Thu 25/02/2016 11:00
Subject: Attached Image
Attachment: 2156_001.docm
Body content: is totally blank
25 February 2016: 2156_001.docm - Current Virus total detections 6/56*
Waiting for analysis. It is almost certain to download either Dridex banking Trojan or Locky Ransomware from the -same-locations- described in today’s earlier posts [1] [2], which are both using the -same- distribution network, file names and methods of infection... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/23fe2473f663446eb95d4ead3160479fb78e1950db56a8234790e6d159120e74/analysis/1456398208/
1] http://myonlinesecurity.co.uk/fw-invoice-1442049-maddi-cross-at-your-own-email-domain-word-doc-malware/
2] http://myonlinesecurity.co.uk/document-no-1076196-pretending-to-come-from-accounts-at-your-own-domain-excel-xls-spreadsheet-malware/
___
Fake 'BACS' SPAM - doc malware
- http://myonlinesecurity.co.uk/bacs-remittance-advice-250216-threadneedle-property-investments-ltd-word-doc-malware/
25 Feb 2016 - "An email with the subject of 'BACS Remittance Advice (25/02/16)' pretending to come from random names and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Annette Rojas <RojasAnnette913@ fiber .net .id>
Date: Thu 25/02/2016 14:02
Subject: BACS Remittance Advice (25/02/16)
Attachment: BACS_remittance_advice_0339266.doc
Please find attached your remittance advice.
If you do have any queries regarding this remittance advice, please contact:
Threadneedle (Supplier Reference beginning TP) ...
25 February 2016: BACS_remittance_advice_0339266.doc - Current Virus total detections 2/56*
Hybrid analysis** shows it downloads serveur.wininstall .co/colombian/cocaina.php - which gave me crypted120med.exe (virustotal 1/55***). This will be either Dridex or Locky Ransomware... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/c087c849c0ef4a25cd1172e7447a0aa71d661b13695fb83074069b11f055fc5b/analysis/1456407906/
** https://www.reverse.it/sample/c087c849c0ef4a25cd1172e7447a0aa71d661b13695fb83074069b11f055fc5b?environmentId=4
Host Address
91.223.88.209
>> https://www.virustotal.com/en/url/d091262e3ab6e0f1a901d2219b306e9d49dbb1be925ba36bcd23cfa10a37431c/analysis/
81.93.151.248
188.40.224.76
*** https://www.virustotal.com/en/file/8942b01c55654fd905a00c0b024fddb34b26eab7906b4d40ecc879ee90291d24/analysis/1456409978/
TCP connections
188.40.224.76: https://www.virustotal.com/en/ip-address/188.40.224.76/information/
104.86.110.240: https://www.virustotal.com/en/ip-address/104.86.110.240/information/
___
Fake 'Scanned Invoice' SPAM - doc/xls malware
- http://myonlinesecurity.co.uk/scanned-invoice-word-doc-malware/
25 Feb 2016 - "An email with the subject of 'Scanned Invoice' pretending to come from random names and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... It looks like these criminal gangs are distributing Dridex in the mornings this week and switch to Locky ransomware in the afternoons... The email looks like:
From:Katheryn Garner <GarnerKatheryn5049@ beyondbackyards .com>
Date: Thu 25/02/2016 16:14
Subject: Scanned Invoice
Attachment:
Dear erek ,
Scanned Invoice in Microsoft Word format has been attached to this email.
Thank you!
Katheryn Garner
Sales Manager
25 February 2016: SCAN_Invoice_erek.doc - Current Virus total detections 2/56*
.. downloads insittu .com/2/2.exe which is Locky ransomware (virustotal 3/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/27d3bae08be6a26a77d83cedd4982c4e4772907cae10640c3058f918583ce1d9/analysis/1456416843/
** https://www.virustotal.com/en/file/8331fe97e06f88b81d680cd13ba3ba572e7384a631abcbfc317d1ed18a7f76e0/analysis/1456417770/
TCP connections
51.254.19.227: https://www.virustotal.com/en/ip-address/51.254.19.227/information/
insittu .com: 192.185.147.147: https://www.virustotal.com/en/ip-address/192.185.147.147/information/
>> https://www.virustotal.com/en/url/30137d5a03631b01311d503aa32714616bfa4eb6cd08072d35773f9ddcdaee8f/analysis/
___
Magnitude EK - Malvertising ...
- https://blog.malwarebytes.org/malvertising-2/2016/02/magnitude-ek-malvertising-deja-vu/
Feb 24, 2016 - "... witnessed an increase in the number of malvertising incidents involving the Magnitude exploit kit. The last time we blogged about this was in mid November 2015 and we attributed the event to the fact that Magnitude EK had just integrated a newer Flash exploit (CVE-2015-7645). We fast-forward a few months and see that things haven’t changed one bit:
Same ad network (Propeller Ads Media)
Newer Flash exploit (CVE-2015-8651)
CryptoWall
We see the use of “redirectors” which obfuscate the URL to Magnitude... While reviewing this attack, we also spotted a similar malvertising attack via another ad network (AdsTerra)... We reported both campaigns to the respective ad networks.
- IOCs: Ad networks:
terraclicks[.]com: 198.134.112.232: https://www.virustotal.com/en/ip-address/198.134.112.232/information/
>> https://www.virustotal.com/en/url/d864f1f72811869bb5029c704987d1672dc54cd1792232415ebc93fb573f73c9/analysis/
onclickads[.]net:
78.140.191.90: https://www.virustotal.com/en/ip-address/78.140.191.90/information/
78.140.191.110: https://www.virustotal.com/en/ip-address/78.140.191.110/information/
88.85.82.172: https://www.virustotal.com/en/ip-address/88.85.82.172/information/
78.140.191.80: https://www.virustotal.com/en/ip-address/78.140.191.80/information/
78.140.191.69: https://www.virustotal.com/en/ip-address/78.140.191.69/information/
78.140.191.109: https://www.virustotal.com/en/ip-address/78.140.191.109/information/
88.85.82.171: https://www.virustotal.com/en/ip-address/88.85.82.171/information/
206.54.165.192: https://www.virustotal.com/en/ip-address/206.54.165.192/information/
78.140.191.89: https://www.virustotal.com/en/ip-address/78.140.191.89/information/
206.54.165.193: https://www.virustotal.com/en/ip-address/206.54.165.193/information/
78.140.191.70: https://www.virustotal.com/en/ip-address/78.140.191.70/information/
- Redirectors:
discount-shop[.]org: 'A temporary error occurred during the lookup...'
freewellgames[.]biz: 185.49.69.88: https://www.virustotal.com/en/ip-address/185.49.69.88/information/
>> https://www.virustotal.com/en/url/700e4428372a1f96de2ef0343adf6cf4828148fad1aeee3b24eef13198c39bc7/analysis/
onlinewellgame[.]com: 'A temporary error occurred during the lookup...'
mov-3s[.]com: 'A temporary error occurred during the lookup...'
Payload (CryptoWall): e5c3fa1f1b22af46bf213ed449f74d40 "
:fear::fear: :mad:
AplusWebMaster
2016-02-26, 12:47
FYI...
Fake 'Invoice/Credit Note' SPAM - doc malware
- http://myonlinesecurity.co.uk/corporate-direct-europe-ltd-invoicecredit-note-attached-corpteluk-com-word-doc-malware/
26 Feb 2016 - "An email with the subject of 'Corporate Direct (Europe) Ltd Invoice/Credit Note Attached' pretending to come from Sharron Blevins <Blevins.Sharron04@ corpteluk .com> (These are actually random names at corpteluk .com) with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Sharron Blevins <Blevins.Sharron04@ corpteluk .com>
Date: Fri 26/02/2016 08:42
Subject: Corporate Direct (Europe) Ltd Invoice/Credit Note Attached
Attachment: UK_2871159073.doc
DO NOT DELETE
Dear Sir or Madam
Please find your invoice attached.
If you have any queries regarding your account please do not hesitate to contact us.
Thank you for your business.
Corporate Telecommunications Accounts.
Joanna Monks
Credit Control ...
26 February 2016: UK_2871159073.doc - Current Virus total detections 4/56*
MALWR** shows us a download of Dridex banking Trojan from
http ://5.149.248.225 /britishairaways/takeoff.php which gave me 120.exe (VirusTotal 1/55***)...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/db79a42481c42144420dab692194f351e370d33b28b84654bf80cdd67c79c429/analysis/1456479676/
** https://malwr.com/analysis/NWQ3NzQ2NjgyZmQ3NGNmYjk4NjE2NDRmMDM4YTIyY2Q/
5.149.248.225: https://www.virustotal.com/en/ip-address/5.149.248.225/information/
81.93.151.248
184.25.56.42
*** https://www.virustotal.com/en/file/991fb926b1447a363faf74f3c24644601cead5eb4e39efd2a26abaafd25c8da8/analysis/1456480745/
TCP connections
81.93.151.248: https://www.virustotal.com/en/ip-address/81.93.151.248/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
___
Fake 'Active Discount' SPAM - doc malware
- http://myonlinesecurity.co.uk/active-discount-transaction-601260921050291-lloyds-bank-plc-word-doc-malware/
26 Feb 2016 - "An email with the subject of 'Active Discount Transaction – 60126092105029/1' pretending to come from Lloyds Bank plc <supplier.finance@ lloydsbanking .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Lloyds Bank plc <supplier.finance@ lloydsbanking .com>
Date: Fri 26/02/2016 09:28
Subject: Active Discount Transaction – 60126092105029/1
Attachment: 60126092105029_1.docm
This message is to inform that the following event happened or action is required in the Lloyds Bank plc system
Event/Action Description : Active Discount Transaction – 60126092105029/1
Date : Feb 26, 2016
Number of Invoices : 5
Total Amount : 595.78
Discount Amount : 592.88 ...
26 February 2016: 60126092105029_1.docm - Current Virus total detections 4/55*
MALWR** shows a download of what looks like Dridex banking Trojan from
http ://autoshara .com.ua/system/logs/76tg654viun76b which is a text file that is renamed/saved as a .exe and autorun (VirusTotal ***). The Comments in Virus total show other download locations as
http ://www .westport .in/vqmod/xml/76tg654viun76b
http ://glavmedmag .ru/system/logs/76tg654viun76b ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1d0c8c98e7d3f081a6cd22c46bc2b90f7999676b6a2a2210a9ad3882ad099357/analysis/1456482256/
** https://malwr.com/analysis/NTg2ZjVhNjk0MjYxNDFiOTgxODZjMGE0MzVhMjJmZTY/
193.169.189.202
91.236.4.234
23.216.10.177
*** https://www.virustotal.com/en/file/157162cf6ecfe9e0f584bf3d1249544437d6fc9810375cea549b0d8d310f6dae/analysis/1456481804/
TCP connections
203.162.141.13: https://www.virustotal.com/en/ip-address/203.162.141.13/information/
23.63.98.17: https://www.virustotal.com/en/ip-address/23.63.98.17/information/
___
Fake 'Your Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-your-order-has-been.html
26 Feb 2016 - "This spam does -not- come from Harrison Products but is instead a simple -forgery- with a malicious attachment:
From warehouse | Harrison [warehouse@ harrisonproducts .net]
Date Fri, 26 Feb 2016 18:07:04 +0500
Subject Your Order has been despatched from Harrison
Dear Customer
Thank you for your valued Order, your Despatch Confirmation is attached
If there are any queries relating to this delivery please contact our Customer Service
Team on 01451 830083 or email sales@ harrisonproducts .net
Kind Regards
The Harrison Products Team ...
I have seen only one sample of this with an attachment named Order ref. 16173.xls which has a VirusTotal detection rate of 6/55*. This Malwr report** plus this Hybrid Analysis*** for that sample shows a binary being downloaded from:
thetoyshop .by/system/logs/76tg654viun76b
There are probably other download locations too. This dropped file has a detection rate of 3/52[4]. Those two reports indicate that this is the Dridex banking trojan. It phones home to:
203.162.141.13 (VietNam Data Communication Company, Vietnam)
I strongly recommend that you -block- traffic to that IP."
* https://www.virustotal.com/en/file/979663e368974c6ca3608398e24312442b979be4bdc3402570c3c93da006aceb/analysis/1456493060/
** https://malwr.com/analysis/NjBmMGE4ZjBkOTA4NDI0YWE0NmY0NDUzMzI3MWM3ZGU/
*** https://www.hybrid-analysis.com/sample/979663e368974c6ca3608398e24312442b979be4bdc3402570c3c93da006aceb?environmentId=4
4] https://www.virustotal.com/en/file/157162cf6ecfe9e0f584bf3d1249544437d6fc9810375cea549b0d8d310f6dae/analysis/1456493451/
:fear::fear: :mad:
AplusWebMaster
2016-02-29, 17:47
FYI...
Facebook Video SPAM... and 'Leaked' iPhone
- https://blog.malwarebytes.org/phishing/2016/02/facebook-video-spam-teases-adult-videos-and-leaked-iphone/
Feb 29, 2016 - "Spam posts on Facebook are nothing new. Since videos continue to be a staple form of entertainment — a whopping 8-billion views-per-day according to last year’s numbers — within the social network ecosystem, video spam has become a particular nuisance. From -shock- videos of supposed bears tearing people apart to celebrity deaths to mermaids, one can almost say they have seen it all. However, it is -uncommon- nowadays to find video spam that is sexually graphic in nature... :
> https://blog.malwarebytes.org/wp-content/uploads/2016/02/fb-comment.png
The above was posted as a reply to an innocent update made by a family member of the poster. We’re fairly certain that s/he didn’t knowingly post it themselves, too, because clicking the Facebook App page link below the video preview photo -redirects- one to a page that -claims- to be one of Facebook’s:
fb-moviews[DOT]com, as seen:
> https://blog.malwarebytes.org/wp-content/uploads/2016/02/videoshotindie.png
... Whether one provides their info to the page or not, clicking “Masuk” (or “Enter” in English) allows the affected user’s account to do two things: (1) it shares the original poster’s video link and (2) it replies to posts with the video link including some -garbled- text and URL. At the same time, fb-moviews -redirects- users to a site where users won’t be seeing any videos... specifically presented with the page (screenshot below) about a leak of a rumored new iPhone smartphone, which has been making rounds in big news outlets today:
> https://blog.malwarebytes.org/wp-content/uploads/2016/02/iphone365.png
... We have said this before... again: Be careful what-you-click..."
fb-moviews[DOT]com: 104.18.51.45: https://www.virustotal.com/en/ip-address/104.18.51.45/information/
104.18.50.45: https://www.virustotal.com/en/ip-address/104.18.50.45/information/
___
Fake 'Invoice' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-invoice-1605105215-dear.html
29 Feb 2016 - "This fake financial email (sent to "Dear costumer") has a malicious attachment.
From: Velma hodson
Date: 29 February 2016 at 16:49
Subject: Invoice #16051052/15
Dear costumer,
You are receiving this informational letter because of the fact that you have a debt totaling $157,54 due to late payment of invoices dating March ‘15.
In attachment you will find a reconciliation of the past 12 months (year 2015).
Please study the file and contact us immediately to learn what steps you should take to avoid the accrual of penalties.
I have only seen a single sample with an attachment named Invoice_ref-16051052.zip which in turn contains a malicious script invoice_kOUEsX.js ... The script has a VirusTotal detection rate of 2/55* and these automated analysis tools [1] [2] show that it attempts to download a binary from the following locations:
ohiyoungbuyff .com/69.exe?1
helloyungmenqq .com/69.exe?1
The domain names have a similar theme, indicating that the -servers- are malicious. It might be worth blocking:
91.196.50.241 (EuroNet, Poland)
50.3.16.250 (Eonix, US)
This Malwr report** shows that the dropped payload is ransomware, calling home to the following domains:
biocarbon .com.ec
imagescroll .com
I recommend that you -block- traffic to those domains plus the two IPs, giving a recommended blocklist of:
91.196.50.241
50.3.16.250
biocarbon .com.ec
imagescroll .com
music.mbsaeger .com
stacon .eu "
* https://www.virustotal.com/en/file/89a01955add061ddc735bc3bac47bcec14c6da6aaaf13f78cd62a108f09b3a0b/analysis/1456771424/
1] https://malwr.com/analysis/ZmY1M2EyYWEyZTY2NDY4MGIwZTI5MjIwZjQ0MDNlYWU/
2] https://www.hybrid-analysis.com/sample/89a01955add061ddc735bc3bac47bcec14c6da6aaaf13f78cd62a108f09b3a0b?environmentId=4
** https://malwr.com/analysis/NzllYzhhM2JkYmEzNGFjOWE2YTk0ZDVhNjkyNWUyMGY/
Hosts
192.185.39.66
62.210.141.228
76.125.213.205
188.116.9.2
___
Fake 'Scanned image' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/02/malware-spam-scanned-image-image-data_29.html
29 Feb 2016 - "This -fake- document scan has a malicious attachment:
From: admin [ands21@ victimdomain .tld]
Date: 29 February 2016 at 19:05
Subject: Scanned image
Image data in PDF format has been attached to this email.
The email appears to originate from within the victim's own domain. Attached is a randomly-named file with a format similar to 2016022936833473.zip containing a malicious script with a name somewhat like SCAN000469497.js I have seen three different versions of the attached scripts with detection rates of around 1/55 [1]... The Malwr reports for those [4] [5] [6] show download locations at:
www .notebooktable .ru/system/logs/7ygvtyvb7niim.exe
svetluchok .com.ua/admin/images/7ygvtyvb7niim.exe [404]
mansolution .in.th/system/logs/7ygvtyvb7niim.exe
This appears to be Locky ransomware with a detection rate of just 3/55*. Those Malwr reports also indicate C&C servers at:
51.254.19.227 (Dmitrii Podelko, Russia / OVH, France)
185.14.29.188 (ITL aka UA Servers, Ukraine)
Note that one of the download locations is 404ing. There may be other download locations that I am not aware of, however I recommend that you block-all-traffic to:
51.254.19.227
185.14.29.188 "
1] https://www.virustotal.com/en/file/aac4c6c4001ac1e3990c83642353925a3385627f6a402b64d1b5271d563d457b/analysis/1456774937/
4] https://malwr.com/analysis/MGFjOTJlYjM5NDAzNDFmN2IzNmFiOGU0NjgwOTYyNTY/
195.208.1.116
185.14.29.188
5] https://malwr.com/analysis/MTBkYjlhYTRjN2Q0NDlmM2JjOTk1MGQxYmExZTZlY2E/
176.114.0.200
6] https://malwr.com/analysis/YTJlYjA5YmMxNWZkNGI2ZWI3N2ZhNTI5OTFhZTdiYTU/
103.233.192.226
51.254.19.227
* https://www.virustotal.com/en/file/b39e77e64af49d04b685b4777ebf5ef7263faba0a21480a7e7e7ebcc0cc2ef0e/analysis/
TCP connections
51.254.19.227: https://www.virustotal.com/en/ip-address/51.254.19.227/information/
___
Snapchat hit by phishing scam
- http://blog.snapchat.com/post/140194434840/an-apology-to-our-employees
Feb 28, 2016 - "... Last Friday, Snapchat’s payroll department was targeted by an isolated email phishing scam in which a scammer impersonated our Chief Executive Officer and asked for employee payroll information. Unfortunately, the phishing email wasn’t recognized for what it was –a scam– and payroll information about some current and former employees was disclosed externally. To be perfectly clear though: None of our internal systems were breached, and no user information was accessed... Within four hours of this incident, we confirmed that the phishing attack was an isolated incident and reported it to the FBI. We began sorting through which employees–current and past– may have been affected. And we have since contacted the affected employees and have offered them two years of free identity-theft insurance and monitoring. When something like this happens, all you can do is own up to your mistake, take care of the people affected, and learn from what went wrong. To make good on that last point, we will redouble our already rigorous training programs around privacy and security in the coming weeks. Our hope is that we never have to write a blog post like this again..."
:fear::fear: :mad:
AplusWebMaster
2016-03-01, 13:48
FYI...
Fake 'March Invoice' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/03/malware-spam-march-invoice-balkan-dream.html
1 Mar 2016 - "This -fake- financial spam can't make up its mind which month it is for.
From: Caitlin Velez
Date: 1 March 2016 at 11:50
Subject: March Invoice
Hi,
Attached is the November invoice.
Thanks!
Caitlin Velez
Customer Service
Balkan Dream Properties ...
So far I have seen just one sample of this, so it is possible that other companies are being spoofed as well. Attached is a file INV09BEE9.zip which in turn contains a malicious script statistics_60165140386.js. This has a detection rate of precisely zero*. This Malwr report** shows that it is the Locky ransomware, download a binary from:
intuit.bitdefenderdistributor .info/intrabmw/get.php
This is hosted on a bad webserver at..
93.95.100.141 (Mediasoft ekspert, Russia)
..and it then phones home to..
5.34.183.195 (ITL / UA Servers, Ukraine)
There are probably other download locations. My contacts tell me that these are C2 servers for an earlier German-language campaign, it is possible they are being used here. Block 'em anyway..
31.184.197.119 (Petersburg Internet Network ltd., Russia)
51.254.19.227 (Dmitrii Podelko, Russia / OVH, France)
91.219.29.55 (FLP Kochenov Aleksej Vladislavovich, Ukraine)
Recommeded blocklist:
5.34.183.195
31.184.197.119
51.254.19.227
91.219.29.55
93.95.100.141 "
* https://www.virustotal.com/en/file/0ef3e9aef915319e4a2b9408bc1d65c04921a5cafa4b22d7318aaf5c930ba5fc/analysis/1456833407/
** https://malwr.com/analysis/MDlhNDk3YjBiY2ExNDJkMGFmMTdmY2ZhZGQxZDg4N2I/
- http://myonlinesecurity.co.uk/march-invoice-js-malware-locky-ransomware/
1 Mar 2016 - "... an email with the subject of 'March Invoice' pretending to come from random names, companies and email addresses with a zip attachment is another one from the current bot runs... The email looks like:
From: Grace Buckley <BuckleyGrace41@ jackvalan .com>
Date: Tue 01/03/2016 11:51
Subject: March Invoice
Attachment: INVBEAC8E.zip
Hi,
Attached is the November invoice.
Thanks!
Grace Buckley
Customer Service
MONTANARO UK SMALLER COS INVESTM TR ...
1 March 2016: INVBEAC8E.zip: Extracts to: statistics_60165140386.js - Current Virus total detections 0/56*
MALWR** shows it downloads http ://intuit.bitdefenderdistributor .info/intrabmw/get.php which gave me
lohi.exe (VirusTotal 5/54***). This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/0ef3e9aef915319e4a2b9408bc1d65c04921a5cafa4b22d7318aaf5c930ba5fc/analysis/1456833183/
** https://malwr.com/analysis/MDlhNDk3YjBiY2ExNDJkMGFmMTdmY2ZhZGQxZDg4N2I/
93.95.100.141
5.34.183.195
*** https://www.virustotal.com/en/file/f8892b86dc8276633a660801d73e0d3a3d8b1dc2cedbfa54ee8b8af3efc1e75f/analysis/1456832632/
TCP connections
185.14.29.188: https://www.virustotal.com/en/ip-address/185.14.29.188/information/
___
Fake 'Your Order' SPAM - Locky ransomware
- http://myonlinesecurity.co.uk/delay-with-your-order-200c189b-invoice-37811753-sales-manager-js-malware-locky-ransomware/
1 Mar 2016 - "An email with the subject of 'Delay with Your Order #200C189B, Invoice #37811753' [random numbered] pretending to come from Random names, companies and email addresses with a zip attachment is another one from the current bot runs... The email looks like:
From: Joel Barron <BarronJoel28@ softranstech .com>
Date: Tue 01/03/2016 11:30
Subject: Delay with Your Order #200C189B, Invoice #37811753
Attachment: order_copy_200C189B.zip
Dear Valued Customer,
It is very unpleasant to hear about the delay with your order #200C189B, but be sure that our department will do its best to resolve the problem. It usually takes around 7 business days to deliver a package of this size to your region.
The local post office should contact your as soon as they will receive the parcel. Be sure that your purchase will be delivered in time and we also guarantee that you will be satisfied with our services.
Thank you for your business with our company.
Joel Barron
Sales Manager
1 March 2016: order_copy_200C189B.zip: Extracts to: readme_692768919.js - Current Virus total detections 0/56*
MALWR** shows what looks like a download of Locky Ransomware from
http ://sitemar.ro/5/92buyv5 ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/16ecd86dd0b615488e42322abc8202301989ca25ab2381b5340d351894080a84/analysis/1456831819/
** https://malwr.com/analysis/YzUzMWY2NmFjNjU2NDg4NTgwNzhkNDUzZjg0ZmY1ZmU/
Hosts
89.38.241.66
185.14.29.188
- http://blog.dynamoo.com/2016/03/malware-spam-dear-valuedcustomer-it-is.html
1 Mar 2016 - "This strangely worded spam leads to the Locky ransomware:
From =cU3RlZmFuaWUgU3VsbGl2YW4=?= [SullivanStefanie68750@numericable .fr]
Date Tue, 01 Mar 2016 13:40:48 +0200
Subject =?UTF-8?B?RGVsYXkgd2l0aCBZb3VyIE9yZGVyICM3QjZCN0UwOCwgSW52b2ljZSAjMzI1ODMzNDY=?=
Dear ValuedCustomer,
It is very unpleasant to hear about the delay with your order #7B6B7E08, but be sure
thatour department will do its best to resolve the problem.It usually takes around7
business days to deliver a package of this size to your region.
The local post office should contact your as soon as they will receive theparcel.Be
sure that your purchase will be delivered in time and we alsoguarantee that you will
be satisfied with our services.
Thank you for your business with our company.
Stefanie Sullivan
Sales Manager
All the samples I have seen have slightly -mangled- headers. The sender name varies. Attacked is a ZIP file named in a similar format to order_copy_7B6B7E08.zip which contains a malicious script named something like:
important_181031694.js
warning_659701636.js
statistics_466026824.js
I have seen -six- different samples so far with zero detection rates [1]... and which according to these analysis [7]... attempt to download a Locky binary from:
sitemar .ro/5/92buyv5
pacificgiftcards .com/3/67t54cetvy
maisespanhol .com.br/1/8y7h8bv6f
Those binaries phone home to:
5.34.183.195/main.php
31.184.197.119/main.php
Those C&C servers are the same as I mentioned in this spam run* and I suggest you -block- traffic to:
5.34.183.195
31.184.197.119
51.254.19.227
91.219.29.55 "
1] https://www.virustotal.com/en/file/aae5b326f9dd70519b5797e49c15f3fec683dfe363e7230d79f2488863b96de8/analysis/
7] https://malwr.com/analysis/OWM1MmU0MmIzMGQwNDk0MTljOWY0NGVjZmNlNTM4NWY/
* http://blog.dynamoo.com/2016/03/malware-spam-march-invoice-balkan-dream.html
___
Fake 'MX62EDO' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-emailing-mx62edo-01032016.html
1 Mar 2016 - "This -fake- document scan has a malicious attachment. It appears to come from within the victim's own domain.
From: documents@ victimdomain .tld
Date: 1 March 2016 at 13:43
Subject: Emailing: MX62EDO 01.03.2016
Your message is ready to be sent with the following file or link
attachments:
MX62EDO 01.03.2016 SERVICE SHEET
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
This email has been checked for viruses by Avast antivirus software...
I have seen two samples so far, with an attachment that has a similar name to MX62EDO20160301538482.zip which contains a malicious randomly-named script (e.g. PK5293425659.js). Detection rates on the scripts are fairly low [1] [2]. According to these Malwr reports [3] [4] the payload is the Locky ransomware. These two samples download malicious binaries from:
tianshilive .ru/vqmod/xml/87yhb54cdfy.exe
ubermensch .altervista.org/system/logs/87yhb54cdfy.exe
In turn, these attempt to phone home to:
31.184.197.119 /main.php
5.34.183.195 /main.php
These are the -same- C&C servers as seen here*."
1] https://www.virustotal.com/en/file/4ce15aac5814a03c1930763da0ee6b59d256dfc832bd5b22e220f008af7b9efa/analysis/
2] https://www.virustotal.com/en/file/0650fee9c91acaa475ccd9c9620e3c58e94acdbf12075885193d10e32b54516d/analysis/1456840115/
3] https://malwr.com/analysis/MDExMGY0OTJjOTZjNDBiZTkyMDk1ZmUxNTAwMWE1NWI/
Hosts
5.101.152.42
31.184.197.119
4] https://malwr.com/analysis/Yzk3OTI3NDBmZjI3NDJjNzhmZDkxMDFmMWU2NTQ2ZjI/
Hosts
176.9.24.196
5.34.183.195
* http://blog.dynamoo.com/2016/03/malware-spam-dear-valuedcustomer-it-is.html
___
Tesco Bank - 'Interest Rate And Tax' Phish
- http://myonlinesecurity.co.uk/tesco-bank-interest-rate-and-tax-phishing/
1 Mar 2016 - "There are a few major common subjects in a phishing attempt. Lots of them are either PayPal or your Bank or Credit Card.. This one from Tesco is no exception... The link in this case goes to:
http ://grupomathile .com.br/hhaa/hhaa.html which -redirects- to:
http ://agapechurchindia .org/jss/tesco/tesco/Log.htm
This particular phishing campaign starts with an email with-a-link:
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Tesco_tax-1024x511.png
If you fill in the user name you get sent on to a series of pages asking for more information:
> http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/tesco_bank_Tax1-1024x558.png
... which is a typical phishing page that looks very similar to a genuine Tesco Bank page, if you don’t look carefully at the URL in the browser address bar..."
:fear::fear: :mad:
AplusWebMaster
2016-03-02, 13:22
FYI...
Fake 'Invoices' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-zyl-invoice-outstanding.html
2 Mar 2016 - "These randomly-generated financial spam emails come with a malicious attachment:
From: Buckminster U. Petty
Date: 2 March 2016 at 07:55
Subject: Outstanding Invoice
Please check the receipt attached to this message. The Transaction will be posted on your account within 48 hours.
----------
From: Astra B. Fuller
Date: 2 March 2016 at 08:08
Subject: Fwd: ZYL Invoice
Please find the payment details attached to this message. The Transfer should appear on your account in 2 days.
----------
From: Audrey U. Oneil
Date: 2 March 2016 at 07:34
Subject: Re: Sales Invoice
Please review the invoice attached to this message. The Transfer should appear on your bank in 48 hours.
Attached is a randomly-named file with an -RTF- extension which is actually a -DOCX- file in disguise. I have seen three different attachments with detection rates of 1/55 [1] [2] [3] and the Malwr reports for those [4] [5] [6] show the macro contained within downloading from the following locations:
thevillagelounge .nl/e.jpg?LnRiNLIoPC3=55
creeko .com/d.jpg?GIk1nRWM0r27m5Ss=50
creeko .com/d.jpg?GIk1nRWM0r27m5Ss=8
The VirusTotal results for the two unique binaries dropped are 3/55 [7] [8] but automated analysis.. is inconclusive. It looks rather like -ransomware- but I cannot confirm this."
1] https://www.virustotal.com/en/file/71f621100f547b7137b08d62e0eb7646745189cfe5034cce45b8110565fb8b81/analysis/1456908576/
2] https://www.virustotal.com/en/file/5b15929697e68da6321478e52728e108500d96a21c965be33f1cb7943b12f078/analysis/1456908593/
3] https://www.virustotal.com/en/file/e339a6c63de1f3ee0416026801f98cfbb2575b27bb378402b39d2f9cde325b6c/analysis/1456908601/
4] https://malwr.com/analysis/ODdkNDBmYzJkMGFhNGZjMDlmNDc3MzA2NjU4OGQ4YjA/
Hosts
172.231.69.95
209.242.233.7: https://www.virustotal.com/en/ip-address/209.242.233.7/information/
5] https://malwr.com/analysis/ZWZhZDRhNDEwNWM2NGY0MWEwYjFhM2M3MmRjYTFmOGY/
Hosts
172.231.69.95
209.242.233.7: https://www.virustotal.com/en/ip-address/209.242.233.7/information/
6] https://malwr.com/analysis/OWVkMTU4ZTk0ZTlhNDhlZTliNmNlN2Y1NTQ2MzAyM2E/
Hosts
172.231.69.95
178.251.196.62: https://www.virustotal.com/en/ip-address/178.251.196.62/information/
7] https://www.virustotal.com/en/file/e70a7a0c5185414ef9a02cf96cd509c6578fefc5908c332052b071592f3d5092/analysis/1456909038/
8] https://www.virustotal.com/en/file/d6cdfc7f631e7e6ba85fdf3242ee4fc1c4b47153b8e72857c00b9353009af965/analysis/1456909051/
creeko .com: 209.242.233.7: https://www.virustotal.com/en/ip-address/209.242.233.7/information/
thevillagelounge .nl: 178.251.196.62: https://www.virustotal.com/en/ip-address/178.251.196.62/information/
___
Fake 'Package' SPAM – JS malware/ransomware
- http://myonlinesecurity.co.uk/package-16049177-js-malware-leading-to-ransomware/
2 Mar 2016 - "An email with the subject of 'Package # 16049177' [random numbered] that matches the attachment and the number in the body of the email, pretending to come from random email addresses, names and companies with a zip attachment is another one from the current bot runs... The email looks like:
From: Alyson cockcroft <cockcroftAlyson2993@ arc-performance .com> ( random senders)
Date: Wed 02/03/2016 10:14
Subject: Package # 16049177
Attachment: Invoice_ref-16049177.zip
Dear Client,
Your replacement package was shipped 5 days ago and is now being transferred to your local post office.
The package identification number is # 16049177 , please double-check the information on it in the file attached below.
We are grateful for your purchase from our shop and are very sorry for the inconvenience.
2 March 2016: Invoice_ref-16049177.zip: Extracts to: invoice_scan_EdcJqY.js - Current Virus total detections 5/56*
MALWR** shows a download of what looks like Teslacrypt rather than Locky ransomware based on the file names and locations from either http ://ohelloweuqq .com/69.exe or http ://soclosebutyetqq .com/69.exe
(VirusTotal 4/56***).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/da2f51faa857a4c484266a940396dc9b951f1484ef303e3199414163d1b08521/analysis/1456913677/
** https://malwr.com/analysis/ZTcwMTE0M2E3N2YwNGVjODk4MDQzMzA1YTEwNzQ5M2I/
104.232.35.31: https://www.virustotal.com/en/ip-address/104.232.35.31/information/
91.196.50.241: https://www.virustotal.com/en/ip-address/91.196.50.241/information/
*** https://www.virustotal.com/en/file/017377da0e81801b5bb3692fe37b23e9d83a1b75d580caf4a19847c1fcb3b451/analysis/1456916592/
TCP connections
194.228.3.204: https://www.virustotal.com/en/ip-address/194.228.3.204/information/
___
Fake 'Invoice Copy' SPAM - doc macro/ransomware
- http://myonlinesecurity.co.uk/invoice-copy-word-doc-macro-malware-leading-to-locky-ransomware/
2 Mar 2016 - "An email with the subject of 'Invoice Copy' pretending to come from random senders with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Jerrod Parker <ParkerJerrod02870@ kabel-deutschland .de>
Date: Wed 02/03/2016 10:15
Subject: Invoice Copy
Attachment: scan_559376.doc
Dear Customer,
Please make sure you send payment for your parcel to avoid any inconvenience. Open the attached file to review the confirmation listing.
Thank you for your business – we appreciate it very much.
Sincerely,
Jerrod Parker
Account Manager
-Or:
Dear User,
Your order will be shipped shortly, we apologize for the troubles. Please, review the invoice in the attached file.
Thank you for your business – we appreciate it very much.
Sincerely,
Johnnie Newman
Project Manager
2 March 2016: scan_559376.doc - Current Virus total detections 6/55*
MALWR shows a download from http ://cabanasestina .ro/num/5buybbtyu8 ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/4aeafd474d91ea380f238e9ab00281de7ab3f93459671b88e0d6e93de8cd9dc1/analysis/1456917614/
cabanasestina .ro: 188.213.205.89: https://www.virustotal.com/en/ip-address/188.213.205.89/information/
>> https://www.virustotal.com/en/url/73e8c83ce26fbb6ad8e8ba17f65ae3e913a73b86a6a2e05ccf03fa71ab8a6cb4/analysis/
___
Fake 'remittance advice' SPAM - JS malware/ransomware
- http://myonlinesecurity.co.uk/remittance-advice-for-the-payment-made-on-the-19th-feb-2015-from-hillsong-church-london-js-malware-leading-to-ransomware/
2 Mar 2016 - "An email pretending to be a remittance advice for the payment made on the 19th Feb 2015 from Hillsong Church London with a random subject of 'MEARS GROUP March Invoice #17577' [random numbered] and random company names pretending to come from random senders with a zip attachment is another one from the current bot runs... The name of the alleged sender matches the name in the email body... The email looks like:
From: Osvaldo West <West.Osvaldo736@ ttml .co.in>
Date: Wed 02/03/2016 12:16
Subject: MEARS GROUP March Invoice #17577
Attachment: Hillchurch-C7EA2.zip or Hillsong-914FCE.xls
Hi there,
Please find the remittance advice for the payment made on the 19th Feb 2015 from Hillsong Church London.
Please let me know if there are any queries.
Kind regards,
Osvaldo West ...
2 March 2016: Hillchurch-C7EA2.zip: Extracts to: TR914740032016.js Current Virus total detections 3/56*
MALWR** shows a download from http ://doaemdpmekd.securalive .eu/8fjvimkel1/c987ah8j9ei1.php (VirusTotal 2/55***)
which gave me readme.exe ...
2 March 2016 : Hillsong-914FCE.xls - Current Virus total detections 2/55[4]
which is being detected as a Dridex downloader. -Both- Locky Ransomware and Dridex banking Trojans use the -same- download mechanisms and until you actually see the payload, it is impossible to tell whether it is Dridex or Locky.. MALWR shows a download from http ://oimedoaeklmrf.giftcardnanny .ca/nu2o3mk4/c987ah8j9ei1.php which gave me likeaboss.exe (VirusTotal 2/56[5]).. this is the -same- malware file as the js version so is more likely to actually be Dridex rather than Locky... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2591c5812542eb401134b320e2c7d0c40e625ad9cbf2bed174072de2c57b4e1a/analysis/1456921684/
** https://malwr.com/analysis/YTUzYWZiYjZmMTQwNDM2MDk1MzMwMjA3NWU1ZTJlZjc/
Hosts
193.201.227.90: https://www.virustotal.com/en/ip-address/193.201.227.90/information/
24.172.94.181
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
*** https://www.virustotal.com/en/file/d47383641d5ca56299d498a4c6f3dcec94bd98e1b28a11d7780c615f8b2634cf/analysis/1456922055/
TCP connections
24.172.94.181
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
4] https://www.virustotal.com/en/file/b4e648eb6431aaae6210a2df5790d62c7167f416f6d1b1fcfaabe737b866e388/analysis/1456922090/
5] https://www.virustotal.com/en/file/d47383641d5ca56299d498a4c6f3dcec94bd98e1b28a11d7780c615f8b2634cf/analysis/1456922631/
TCP connections
24.172.94.181
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
doaemdpmekd.securalive .eu: 193.201.227.90: https://www.virustotal.com/en/ip-address/193.201.227.90/information/
oimedoaeklmrf.giftcardnanny .ca: 193.201.227.90
- http://blog.dynamoo.com/2016/03/malware-spam-spoofing-hillsong-church.html
2 Mar 2016 - "... the body text is from a church..
Hi there,
Please find the remittance advice for the payment made on the 19th Feb 2015 from
Hillsong Church London...
... all these locations are on the same server (and are the same binary), hosted on:
193.201.227.90 (PE Tetyana Mysyk, Ukraine)
According to VirusTotal*, there are a few -hijacked- GoDaddy subdomains on that IP. This method is a little unusual for this type of attack... this Hybrid Analysis** show the malware phoning home to:
24.172.94.181 (Time Warner Cable, US)
It isn't entirely clear what the payload is, but it is probably Dridex or possibly some form of ransomware.
Recommended blocklist:
193.201.227.90
24.172.94.181 "
* https://www.virustotal.com/en/ip-address/193.201.227.90/information/
** https://www.hybrid-analysis.com/sample/d47383641d5ca56299d498a4c6f3dcec94bd98e1b28a11d7780c615f8b2634cf?environmentId=4
___
Fake 'March Invoice' SPAM - xls malware
- http://myonlinesecurity.co.uk/le-mark-self-adhesive-ltd-please-find-attached-a-copy-of-our-bank-details-random-company-march-invoices-excel-xls-spreadsheet-malware/
2 Mar 2016 - "An email with the subject of 'ENABLES IT GROUP PLC March Invoice #39903' (random company names and invoice numbers) pretending to come from random names with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Ina Wolfe <Wolfe.Ina680@ intex .in>
Date:
Subject: ENABLES IT GROUP PLC March Invoice #39903
Attachment: Hillsong-838834.xls
Afternoon,
Please find attached a copy of our bank details.
If we can be of further assistance then please do not hesitate to contact me
Many thanks,
Ina Wolfe
Credit Controller
Le Mark Self-Adhesive Ltd. ...
2 March 2016: Hillsong-838834.xls - When renamed to zip & extracted you get SCAN7420032016.js (VirusTotal 3/56*)
MALWR shows a download from http ://aoieofnv.lotnine .com/8fjvimkel1/c987ah8j9ei1.php which is the -same- malware as described in THIS post**... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/4fbe4802c82fae8af5cb15cc23e5ce041908fe8e5af86f421af57cd923502d88/analysis/1456931124/
** http://myonlinesecurity.co.uk/remittance-advice-for-the-payment-made-on-the-19th-feb-2015-from-hillsong-church-london-js-malware-leading-to-ransomware/
aoieofnv.lotnine .com: 193.201.227.90: https://www.virustotal.com/en/ip-address/193.201.227.90/information/
___
Fake 'Invoice Scan/copy' SPAM - doc macro malware
- http://myonlinesecurity.co.uk/payment-confirmation-invoice-scan-invoice-copy-word-doc-macro-malware/
2 Mar 2016 - "An email with the subject of 'Payment Confirmation / Invoice Scan / Invoice copy' pretending to come from random email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Gavin Gaines <GainesGavin739@ iconpln .net.id>
Date: Wed 02/03/2016 14:07
Subject: Payment Confirmation / Invoice Scan / Invoice copy
Attachment: scan_174761.doc
Dear Customer,
Please review the attached copy of your Electronic document.
Thank you for your business – we appreciate it very much.
Sincerely,
Gavin Gaines
Account Manager
-Or:
Dear Member,
The mistake made will be compensated promptly, please do not worry. Please
take a look at the file attached as it contains all the information.
Thank you for your business – we appreciate it very much.
Sincerely,
Marisol Lara
Account Manager
2 March 2016: scan_174761.doc - Current Virus total detections 6/56*
MALWR isn’t showing any download on this one but that might be due to analysis protection more than anything else... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/faa52faa168c8a9fe5323a1e332b0f89485823390381e1307a53fe77bfd43c79/analysis/1456927470/
___
Fake 'Whitehouse paperwork' SPAM - JS malware / Locky ransomware
- http://myonlinesecurity.co.uk/whitehouse-paperwork-aficio-mp-c2500-js-malware-leading-to-locky-ransomware/
2 Mar 2016 - "An email with the subject of 'Whitehouse paperwork' pretending to come from 'Admin' at your own email domain with a zip attachment is another one from the current bot runs... The email looks like:
From: admin <admin@ victimdomain .tld>
Date: Wed 02/03/2016 14:48
Subject: Whitehouse paperwork
Attachment: 201603021282046970.zip
This E-mail was sent from “RNPDD9C46” (Aficio MP C2500).
Scan Date: Wed, 02 Mar 2016 19:18:02 +0430
2 March 2016: 201603021282046970.zip: Extracts to:OR5121206096.js - Current Virus total detections 6/56*
MALWR shows a download from http ://cocowashi .com/system/logs/76tr5rguinml.exe (VirusTotal 4/56**) which is locky ransomware... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/18633031ff02789ed90b782a3b27611e0383b4da87b458b35fc48ef4ba097804/analysis/1456933931/
** https://www.virustotal.com/en/file/e057da59e05bfa7df698451ab3278bbbedf968d0ab3e64e6e8713c963dbabf8e/analysis/1456934341/
TCP connections
109.237.111.168: https://www.virustotal.com/en/ip-address/109.237.111.168/information/
cocowashi .com: 50.118.112.2: https://www.virustotal.com/en/ip-address/50.118.112.2/information/
>> https://www.virustotal.com/en/url/530d2959585508b3a3d829cdee1cd4242bfca6ca44e2fb731614eed84ec3d99b/analysis/
___
Fake 'Order reference' SPAM - JS malware/Teslacrypt
- http://myonlinesecurity.co.uk/order-reference-58087317-js-malware-leads-to-teslacrypt/
2 Mar 2016 = "An email with the subject of 'Order reference # 58087317' [random numbered] pretending to come from random email addresses, companies and names with a zip attachment is another one from the current bot runs... The email looks like:
From: Felecia niven <nivenFelecia41@ neukoelln-arcaden .de>
Date: Wed 02/03/2016 17:09
Subject: Order reference # 58087317
Attachment: Invoice_ref-58087317.zip
Dear Customer,
We apologize for the troubles with your parcel # 58087317 and can assure you that this mistake will not be happening again.
Please, check the information on this case in the attachment.
Taking in consideration the problem on your order we also included info on your bonus of $483,35 , which you may use during your next order.
2 March 2016: Invoice_ref-58087317.zip: Extracts to: invoice_copy_wvpthP.js - Current Virus total detections 9/56*
MALWR** shows a download from http ://soclosebutyetqq .com/80.exe or http ://ohelloweuqq .com/80.exe
(VirusTotal 4/56***) Which is almost certainly Teslacrypt ransomware.. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a safe file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e60ce71349fefc45c7f91ad9506b1c6279b6c9847f8d3fce9d64b98526f062cc/analysis/1456942781/
** https://malwr.com/analysis/Y2UwMDRlNDJlNzY3NDI4YWE2OWE5ZWJiMDI4NmY2YzE/
Hosts
104.232.35.31: https://www.virustotal.com/en/ip-address/104.232.35.31/information/
>> https://www.virustotal.com/en/url/f23bb0a22c4dc77be8dfbfa1f4603ffd09913194b9174a360a7ef3080100b20f/analysis/
173.82.74.197: https://www.virustotal.com/en/ip-address/173.82.74.197/information/
*** https://www.virustotal.com/en/file/6764e405a8ce9d2ac804aafce630e74e795e9d0eac416f6c58f45a1f606e9113/analysis/1456942277/
TCP connections
194.228.3.204: https://www.virustotal.com/en/ip-address/194.228.3.204/information/
soclosebutyetqq .com: 173.82.74.197: https://www.virustotal.com/en/ip-address/173.82.74.197/information/
91.196.50.241: https://www.virustotal.com/en/ip-address/91.196.50.241/information/
>> https://www.virustotal.com/en/url/9745d19f717589948f3ece0277b9aa02d791fcc04c46ec9e5957f6c1c04a2241/analysis/
ohelloweuqq .com: 104.232.35.31: https://www.virustotal.com/en/ip-address/104.232.35.31/information/
50.3.16.250: https://www.virustotal.com/en/ip-address/50.3.16.250/information/
>> https://www.virustotal.com/en/url/2598c8bc4ec04cd7f0bea0a4487f88ec10df0de061d4f746ad2d810ca052e9b7/analysis/
___
Fake 'Visa benefits, rewards' leads to TeslaCrypt ransomware
- http://www.symantec.com/connect/fr/blogs/spam-offering-fake-visa-benefits-rewards-leads-teslacrypt-ransomware
01 Mar 2016 - "... recently observed a -spam-campaign- offering -fake- Visa rewards and benefits as -bait- to deliver -ransomware- to recipients’ computers. The email in this particular campaign purports to come from 'Visa Total Rewards' and provides details about the benefits of using Visa credit cards. Attached to the email is an archive file which poses as a -whitepaper- containing more information about the supposed rewards and benefits offered by the program. If the recipient opens the attachment, they will see only an obfuscated JavaScript file (detected as JS.Downloader):
> http://www.symantec.com/connect/sites/default/files/users/user-2598031/figure1-email.png
If the recipient is fooled into opening the JavaScript file, the script downloads a -variant- of the TeslaCrypt ransomware (detected as Trojan.Cryptolocker.N) from the specified URL and runs it. A few minutes later, a message is displayed stating that all of the user’s files have been encrypted and payment in Bitcoin is required to decrypt the files:
> http://www.symantec.com/connect/sites/default/files/users/user-2598031/figure-2-tesla.png
The ransomware provides more information to victims on a personalized home page and demands a payment of US$500 (or 1.2 bitcoins) within 160 hours of infection in order to unlock the encrypted files. If the transaction is not made within the specified time frame, the price doubles to $1,000. This page provides a contact form that offers assistance in case of payment issues or any other problems the victims may run into. There is also an opportunity to decrypt a single file for no fee to prove that the files can be properly decrypted:
> http://www.symantec.com/connect/sites/default/files/users/user-2598031/figure3-pay.png
The vast majority of the spam is being distributed to English-speaking countries, with the UK (40 percent) and the US (36 percent) most targeted. Other regions around the globe are affected as well:
> http://www.symantec.com/connect/sites/default/files/users/user-2598031/figure4-pie-chart_0.png
... Tips on protecting yourself from ransomware:
•Regularly back up any files stored on your computer. If your computer does become infected with ransomware, your files can be restored once the malware has been removed.
•Always keep your security software up to date to protect yourself against any new variants of malware.
•Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by attackers.
•Delete any suspicious-looking emails you receive, especially if they contain links or attachments..."
:fear::fear: :mad:
AplusWebMaster
2016-03-03, 13:23
FYI...
Fake 'FreePDF' SPAM - doc malware
- http://myonlinesecurity.co.uk/freepdf-1922110915192-doc-worrall-antony-cmco-eu-word-doc-macro-malware/
3 Mar 2016 - "An email with the subject of 'FreePDF: 1922110915192.doc' pretending to come from Worrall, Antony <Ant.Worrall@ cmco .eu> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/cmco_eu-1024x556.png
3 March 2016: 1922110915192.docm - Current Virus total detections 3/56*
MALWR** shows a download from http ://corsian .com/system/logs/98yh87b564f.exe which looks like Dridex banking Trojan from the MALWR quick overview, but might be some sort of ransomware (VirusTotal 4/55***)...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6f605f1f80511bd502caaaae19b032e00af92dc16bf2077502aff386e198a48a/analysis/1457001459/
** https://malwr.com/analysis/NWExZmZkMTNjZGFjNDcwZDk2MjhlNTYzNzY4MDViNTA/
Hosts
173.0.136.57
188.40.224.78
8.254.249.78
*** https://www.virustotal.com/en/file/6ef050c59205b81f706b0aecfcbb8e8f8a43e42c7a1d5698b59f09256256ce97/analysis/1457001741/
TCP connections
188.40.224.78: https://www.virustotal.com/en/ip-address/188.40.224.78/information/
8.253.82.30: https://www.virustotal.com/en/ip-address/8.253.82.30/information/
- http://blog.dynamoo.com/2016/03/malware-spam-freepdf-1922110025984doc.html
3 Mar 2015 - "This -fake- financial spam has a malicious attachment.
From "Worrall, Antony" [Ant.Worrall@ cmco .eu]
Date Thu, 03 Mar 2016 14:25:14 +0430
Subject FreePDF: 1922110025984.doc
Atached is a randomly-named file that matches the reference in the subject. The payload appears to be the Dridex banking trojan, as seen in this earlier spam run*."
* http://blog.dynamoo.com/2016/03/malware-spam-receipt-order-no-173535.html
___
Fake 'Receipt' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-receipt-order-no-173535.html
3 Mar 2015 - "This spam does not come from KM Media Group but it is instead a simple -forgery- with a malicious attachment:
From Sally Webb [swebb@thekmgroup .co.uk]
Date Thu, 03 Mar 2016 10:58:07 +0100
Subject Receipt - Order No 173535
regards,
Sally
*Sally Webb*
Recruitment Media Sales Executive
KM Media Group
DDI : 01622 794500 ...
Attached is a file Receipt - Order No 173535.docm which comes in several different versions with detection rates around 3/55*. Analysis from another source (thank you) gives download locations... The initial payload has a detection rate of 4/55** which has now been -updated- with a -new- payload with a similar detection rate. My source says that this is Dridex botnet 220 (not Locky) with C&C servers at:
188.40.224.78 (Hetzner / NoTaG Community, Germany)
78.108.93.186 (Majordomo LLC, Russia)
87.106.8.177 (1&1, Germany)
91.236.4.234 (FHU Climax Rafal Kraj, Poland)
Recommended blocklist:
188.40.224.78
78.108.93.186
87.106.8.177
91.236.4.234 "
* https://www.virustotal.com/en/file/12d2db77d8409089b8ea581e6ad39605ef172dcb617ae2f746a2fca03ff6c76f/analysis/
** https://www.virustotal.com/en/file/6ef050c59205b81f706b0aecfcbb8e8f8a43e42c7a1d5698b59f09256256ce97/analysis/
TCP connections
188.40.224.78
8.253.82.30
___
Fake 'Order Delay' SPAM - JS malware leading to Teslacrypt
- http://myonlinesecurity.co.uk/order-delay-package-ref-91063856-3000-e-grand-ave-js-malware-leading-to-teslacrypt/
2 Mar 2016 - "An email with the subject of 'Order Delay – Package Ref. 91063856' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs... The email looks like:
From: Ernestine simister <simisterErnestine49836@ mail.vistony .com>
Date: Thu 03/03/2016 16:52
Subject: Order Delay – Package Ref. 91063856
Attachment: Invoice_ref-91063856.zip
Respected Customer,
The delay of your parcel ref. # 91063856 cannot be controlled due to the unstable weather conditions in our region.
We are doing everything we can to arrange the best shipping time for your package.
Please check the information on your purchase in the attached file. There your will also find the info on the new delivery time.
Sincerely,
Sales Department Manager ...
3 March 2016: Invoice_ref-91063856.zip: Extracts to: invoice_SCAN_WxapPe.js Current Virus total detections 3/56*
MALWR** shows a download from http ://isthereanybodyqq .com/69.exe?1 or
http ://ujajajgogoff .com/69.exe?1 (currently down) which is Teslacrypt ransomware (VirusTotal 4/54***)
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6ca46ead126d3bf1fe7419b16da59d1d3ac4684d4c27d1a0f88e6511723c2a9c/analysis/1457023881/
** https://malwr.com/analysis/MjU2YWMwYjc4YzFiNDE1YTg5YzVkZjZhMGNjZjA5Yjk/
Hosts
50.3.16.250
173.82.74.197
173.201.145.1
108.167.143.8
50.62.66.1
*** https://www.virustotal.com/en/file/d7a54e392cc051e8fae6d26431351d405fe9836e9467bde07187a8586e0e4fbb/analysis/1457024955/
isthereanybodyqq .com: 173.82.74.197: https://www.virustotal.com/en/ip-address/173.82.74.197/information/
>> https://www.virustotal.com/en/url/a4652410d305ac2608fd1412f8803e96c39d2bd24d62a773f9867c251345849f/analysis/
91.196.50.241
78.135.108.94
ujajajgogoff .com: 204.44.84.21: https://www.virustotal.com/en/ip-address/204.44.84.21/information/
162.211.67.244
___
Fake 'Hyperama' SPAM - JS malware leads to Locky ransomware
- http://myonlinesecurity.co.uk/8912179-99-tracey-ward-hyperama-js-malware-leads-to-locky-ransomware/
3 Mar 2016 - "An email with a random numbered subject pretending to come from Administrator <tward9232@ hyperama .com> (random numbers afterward) with a zip attachment is another one from the current bot runs... The email looks like:
From: Administrator <tward9232@ hyperama .com>
Date: Mon 18/01/2016 15:26
Subject: 8912179-99
Attachment: doc0022386.zip
Tracey Ward
Purchase Ledger
Hyperama ...
3 March 2016: Edoc0022386.zip: Extracts to: DOC7797628157.js - Current Virus total detections 23/56*
MALWR** shows a download of Locky ransomware from http ://anro.kiev .ua/vqmod/vqcache/4trf3g45.exe
.. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://malwr.com/analysis/ZDNiNmMyODQ5ZWM5NGJjOWIwYTY5NDlhMDVmMGVmOGE/
Hosts
77.87.194.146: https://www.virustotal.com/en/ip-address/77.87.194.146/information/
>> https://www.virustotal.com/en/url/400906e2f7360aa4586ba41346b71f992324becd9df084010bcc7d3acabe6d01/analysis/
192.121.16.196: https://www.virustotal.com/en/ip-address/192.121.16.196/information/
anro.kiev .ua: 77.87.194.146
___
Phishing surges, file-sharing takes lead as most targeted industry of Q1
- http://www.hotforsecurity.com/blog/phishing-surges-file-sharing-takes-lead-as-most-targeted-industry-of-q1-13472.html
Mar 03, 2016 - "Phishing through file-sharing services has soared in the past three months, making cloud-based file distribution services the most targeted sector of the first quarter of the year, Bitdefender found. Globally, file-sharing is being used to spread phishing scams more than the retail and payment industries, the traditional favorites of hackers. Almost one-in-five-malicious-URLs uses a file-sharing service to deliver malicious payloads to users, recent Bitdefender data shows.
Top 10 Most Targeted Industry Sectors for Internet Phishing
> http://www.hotforsecurity.com/wp-content/uploads/2016/03/chart1-768x380.jpg
What the technique lacks in innovation is compensated for by the ease of use and popularity of consumer-grade sharing services. In the past year, Dropbox reached 400 million users who stored 35 billion Microsoft Office files, while Google Drive had 190 million in 2014. As importantly, file-sharing and cloud storage services lack security features to filter harmful content. This helps attackers hide their malware-infected files without a trace... The typical infection flow goes like this: the user receives a genuine-looking email that advises users to click-on-an-embedded-link to view an attached document. The link -redirects- the user to a phishing page hosted on the provider’s domain. The page asks for the user’s credentials, then captures and sends the data to cyber-criminals over SSL. SSL certificates ensure data on a website is submitted in a secure manner, but they do -not- guarantee the site itself is safe. Thus, hackers are taking advantage, buying cheap SSL certificates and using them on phishing websites to appear legitimate... Scammers are usually after more than just cloud storage credentials; the malicious URLs can trick users into downloading file-encrypting ransomware, for instance. And the hazard has become significantly more serious as new ransomware iterations can seize control over files stored on cloud services..."
:fear::fear: :mad:
AplusWebMaster
2016-03-04, 13:14
FYI...
Fake 'Closing bill' SPAM - xls malware leading to Dridex
- http://myonlinesecurity.co.uk/closing-bill-affinity-water-excel-xls-spreadsheet-macro-malware-leading-to-dridex/
4 Mar 2016 - "An email with the subject of 'Closing bill' pretending to come from MyBill <mybill.central@ affinitywater .co.uk> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/closing-bill-affinity-water-1024x755.png
4 March 2016: 54138887_51656_18836.xls - Current Virus total detections 5/56*
MALWR shows a download from http ://17.rent-shops .ru/system/logs/vbry73f34f.exe (VirusTotal 5/56**)
which looks like Dridex banking Trojan. All the XLS attachments are random names/numbers and all created on the fly. So far I have seen -15- or so all with individual file hashes which doesn’t make it easy.
Other download locations so far discovered include
http ://2.casino-engine .ru/games/megajack/vbry73f34f.exe | http ://prettymom.ru/system/logs/vbry73f34f.exe |
http ://shop-bedep .com/system/logs/vbry73f34f.exe | desean .com.sg/system/logs/vbry73f34f.exe ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/0b8a342bb42a278b58ac4951fb369a526745f482b06901c50d7537721f41d3d3/analysis/1457083098/
** https://www.virustotal.com/en/file/cf987d6d99a9c71985f3dac97841860937725cb723b0742e8101090cc1ef097d/analysis/1457082565/
- http://blog.dynamoo.com/2016/03/malware-spam-closing-bill-mybill.html
4 Mar 2016 - "... Some additional download locations and C&C servers to block, from another source (thank you!)
jean-daniel .com.ua/system/logs/vbry73f34f.exe
namkeendelights .com/system/logs/vbry73f34f.exe
Overall, some of these download locations look like good candidates for blocking, especially:
81.177.140.123 (Avguro Technologies Ltd, Russia)
210.245.90.206 (FPT Telecom Company, Vietnam)
89.184.72.57 (Internet Invest Ltd., Ukraine)
These additional C&C servers have been seen before:
78.108.93.186 (Majordomo LLC, Russia)
87.106.8.177 (1&1, Germany)
91.236.4.234 (FHU Climax Rafal Kraj, Poland)
Recommended blocklist:
188.165.215.180
78.108.93.186
87.106.8.177
91.236.4.234
81.177.140.123
210.245.90.206
89.184.72.57 "
___
Fake 'Remittance' SPAM - malicious .rtf attachment
- http://myonlinesecurity.co.uk/remittance-rtf-word-doc-macro-malware/
4 Mar 2016 - "An email with the subject of 'Remittance' coming from random email addresses, companies and names with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Bridgette – WITAN PACIFIC INVESTMENT TRUST <Cunningham.Bridgette3@ leonduniec .com>
Date: Fri 04/03/2016 10:30
Subject: Remittance
Attachment: rem.advice-3798605447.rtf
Dear Sir/Madam,
Hope you are well. I am writing you to let you know that full amount specified in the contract has been paid into your bank account on the 1st of March at 14 through BACS payment system and should reach the destination (beneficiary’s) account within 3 working days.
To see full payment details please refer to the remittance advice note attached to the letter.
Any queries? Please reply back with your questions and you will receive a prompt and qualitative response as soon as possible. Please do not hesitate to write us.
Bridgette Cunningham ...
4 March 2016: rem.advice-3798605447.rtf - Current Virus total detections 2/56*
MALWR is unable to detect any HTTP connection or download any malware, that is probably due to an anti-analysis protection in the word doc RTF. It will almost certainly turn out to download Dridex banking trojan, Locky or another similar ransomware..
Update: Dynamoo[1] has posted some locations for the downloads which appear to be Dridex banking Trojan..
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b825111331373dc6fd44bac4f5b09fffcf7017fa0d5611ec2f841cfc94095ad1/analysis/1457091062/
1] http://blog.dynamoo.com/2016/03/malware-spam-remittance-from-random.html
4 Mar 2016 - "This fake financial spam appears to come from random companies. The body text is similar in all cases.
Sample 1: From: Ignacio - Floris of London
Date: 4 March 2016 at 09:42
Subject: Remittance
Dear Sir/Madam,
I hope you are well. I am writing you to let you know that total amount qualified in the contract has been sent to your bank account on the 3rd of March at 14 through BACS payment system and should reach the destination (beneficiary's) account within 3 working days.
To see full payment details please refer to the remittance advice note attached to the letter
Any queries? Please reply back with your questions and you will receive a prompt and qualitative response as soon as possible. Please do not hesitate to write us.
Ignacio Knox
Accounts Payable
... This is the -same- IP as seen here* which Sophos identified as being Dridex.
Recommended blocklist:
31.131.24.76
24.172.94.181 "
* https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Dridex-QQ/detailed-analysis.aspx
___
The Rules Of Spam ...
- http://bruce.pennypacker.org/2005/02/28/the-rules-of-spam/
"... Rule #1: Spammers lie...
... Rule #2: If a spammer seems to be telling the truth, see Rule #1..."
ref via: http://blog.dynamoo.com/
___
New Macro Malware - Uses Forms to Store its Code
- http://blog.trendmicro.com/trendlabs-security-intelligence/macro-malware-strides-new-direction-uses-forms-store-code/
Mar 3, 2016 - "The resurgence and continued prevalence of macro malware could be linked to several factors, one of which is their ability to -bypass- traditional antimalware solutions and sandboxing technologies. Another factor is the continuous enhancements in their routines: just recently, we observe that the macro malware related to DRIDEX and the latest crypto-ransomware variant, Locky ransomware, used Form object in macros to obfuscate the malicious code. With this improvement, it could further aid cybercriminals or attackers to -hide- any malicious activity they perform in their target network or system... Locky ransomware, which is reported to be responsible for compromising the network and encrypting the records of Hollywood Presbyterian Medical Center last February 2016, is the first instance of ransomware that capitalized on malicious macros to infiltrate systems. Typically, ransomware is distributed via compromised websites or spam emails. However, this -variant- deviated and replicated this behavior (use of macros) commonly seen in DRIDEX. Based on our Smart Protection Network data, the top countries by Locky ransomware are Germany, Japan, and the United States:
Top countries affected by Locky ransomware for the past 3 months
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/03/Countries_affected_by_locky-1024x596.png
DRIDEX, a prevalent online banking malware has its own macro downloader. When we’re conducting our analysis, we found out that most of our DRIDEX detections pertain to its macro downloader and -not- the actual TSPY_DRIDEX. This could suggest that this threat is -still- rampant as ever despite the takedown of some of its command-and-control (C&C) servers last year.
Countermeasures... awareness of such threats and their behavior is one of the initial steps in order to combat their risks. It’s also important to -not-enable-macros- from email attachments as this can add another layer of protection to prevent the download of malicious files on the system. For enterprises or organizations, it may be best to block email messages with attachments from suspicious sources."
(More detail at the trendmicro URL at the top of this post.)
:fear::fear: :mad:
AplusWebMaster
2016-03-05, 16:32
FYI...
Fake 'Customer Invoice' SPAM - JS malware Teslacrypt
- http://myonlinesecurity.co.uk/dear-valued-customer-invoice-ref-00278908-random-sales-manager-js-malware-leads-to-teslacrypt/
5 March 2016 - "An email with the subject of Invoice, Ref. 00278908' [random numbered] pretending to come from random email addresses and names with a zip attachment is another one from the current bot runs...
The email looks like:
From: Derrick bolton <boltonDerrick32@ kgorman .ca>
Date: Sat 05/03/2016 07:38
Subject: Invoice, Ref. 00278908
Attachment: Invoice_ref-00278908.zip
Dear Valued Customer,
We are very grateful for your purchase. The specified sum of $679,48 was paid and now your order is being processed by our company.
Delivery information and the invoice can be found in the attached file.
Thank you!
Derrick bolton
Sales Manager ...
5 March 2016 : Invoice_ref-00278908.zip: Extracts to: invoice_ZAwuzp.js (I have seen -4- different zip files by # all extracting to -different- js files) VirusTotal detections [1] [2] [3] [4] all of which according to MALWR [a].. contact http ://ujajajgogoff .com/80.exe?1 where they actually download a file called 69... This site was distributing Teslacrypt ransomware earlier in the week, so this is likely to be the same. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://www.virustotal.com/en/file/60431417ea013c74bc6730abdc2e82a74a43b869c277a4ac4c2431d218de693a/analysis/1457036665/
a] https://malwr.com/analysis/MmQwNmNmNGQ1MzI4NGU4Yzg3NTE4YmM0ZWJhYTM2MDA/
74.117.183.252
>> https://www.virustotal.com/en/url/31da6aba9763b013f1c72e931c67bf602fa03dd88a596a3d1eee27cd42fb138c/analysis/
- https://isc.sans.edu/diary.html?storyid=20801
Last Updated: 2016-03-05 - "We have seen in the last two weeks a massive amount of websites hosting a variant of angler exploit kit that infects computers downloading and activating a variant of teslacrypt... Please keep in mind some countermeasures to avoid infection by Angler EK or ransomware:
• Implements strong antispam, antimalware and antiphishing procedures.
• Keep operating systems patched against known vulnerabilities.
• Install patches from vendors as soon as they are distributed, after performing a full test procedure for each patch.
• Train your users to be careful when opening attachments.
• Configure antimalware software to automatically scan all email and instant-message attachments.
• Configure email programs to do not automatically open attachments or automatically render graphics.
• Ensure that the preview pane of your e-mail reader is turned off.
• Use a browser plug-in like noscript to block the execution of scripts and iframes."
___
iCloud PHISH
- http://myonlinesecurity.co.uk/i215061438-apple-icloud-phishing/
5 March 2016 - " 'i215061438' pretending to come from Online-iApple <replyonline@ online .apple .org> is one of the latest -phish- attempts to steal your Apple/iCloud account. This one only wants your 'iCloud/Apple email address log in and password...
Hello [REDACTED]
You received one new message!
SignIn and View
Where we can provide information access and correction, we will do so for free, except where it would require a disproportionate effort. We aim to maintain our services in a manner that protects information from accidental or malicious destruction. Because of this, after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.
Thank you,
The iApple Team
... It is quite easy to mistake-the-URL for a genuine apple site because you are instinctively drawn to the http ://icloudapple .com at the -start- of the URL, where you should be looking at the last-part before the first - otrack .net .. That clearly is -not- an Apple or iCloud site. If did click the link you would see a webpage looking like this where any email address and password gives you a message saying: 'Your Apple ID or password was incorrect. Forgot password?' .. which is the link to the genuine Apple forgot password site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/icloud_phishing-1024x549.png
The links behind the unsubscribe and 'Click here to view our privacy policy' lead you to the Romanian Security Team forum. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
otrack .net: 192.185.195.163 >> https://www.virustotal.com/en/url/d28ae4bb4f4e8aa6b03bac12924b89ba47c1de62921df4a9c301a2dd8442cd26/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-03-06, 14:05
FYI...
HMRC Tax Refund/iCloud PHISH
- http://myonlinesecurity.co.uk/apple-icloud-your-id-was-used-to-sign-in-leads-to-hmrc-phishing-attempt/
6 Mar 2016 - "A right mishmash of an email with this HMRC tax phishing attempt. The bots sending these are very confused this morning. The email subject says 'Tax Refund New Message Alert!' but the body is all about an iCloud log in... The email looks like:
From: HM & Customs <1Message@ HMRC .gov.uk>
Date: Sun 06/03/2016 04:50
Subject: Tax Refund New Message Alert!
Attachment: none
Your ID was used to sign in to App Store via a web browser.
Date and Time: March 04, 2016, 14:03 PM PDT
If you have not signed in to iCloud recently and believe someone may have accessed your account, you should verify your identity and change your password. Sign in to HMRC online Services
Hm & Customs respects your privacy.
The link behind the 'Sign in to' leads to http ://chefom .com/hmrc .gov.uk/8a9e617ee9a73ddf31d5b21bd3ef46ba/index.php which is known by Internet Explorer Smart filter as well as Chrome and Firefox phishing filters and blocked. There no doubt will be other sites using the same email template that aren’t yet blocked. If you are unwise enough to follow-the-links and have anti-phishing or smart filter turned off, then you see a typical HMRC phishing page which looks very similar to a HMRC genuine page:
> http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/cheform_dot_com_HMRC_phish.png "
chefom .com: 192.186.242.105: https://www.virustotal.com/en/ip-address/192.186.242.105/information/
>> https://www.virustotal.com/en/url/f699771921e3b48ac17f0d26da6cd709a720d00a9a7c286f8c243aa58b8361b2/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-03-07, 14:06
Fake 'Order Confirmation', 'Appear in Court', 'DHL invoice', 'payment proof' SPAM, WordPress plugin backdoor, Payroll and Human Resources - PHISH
FYI...
Fake 'Order Confirmation' SPAM - ransomware
- http://blog.dynamoo.com/2016/03/malware-spam-order-confirmation-payment.html
7 Mar 2016 - "This -fake- financial spam comes from various senders with different references, amounts and slightly different addresses. There is a malicious attachment which appears to be ransomware.
From: Ellen thorp
Date: 7 March 2016 at 07:08
Subject: Order Confirmation - Payment Successful, Ref. 81096454
Dear Client,
Thank you for your transaction of $477,84. The shipping time varies from 3 to 5 business days, however we will do our best so you can receive your order as soon as possible.
We will send all the information regarding this case to your local post office. They will contact the phone number you provided when the package arrives.
Double check please the document enclosed to this email.
Thank you for your order and we hope to see you again as our customer.
Respectfully,
Ellen thorp
Chief Accountant ...
Attached is a randomly-named ZIP file in the format Invoice_ref-81096454.zip which contains a further malicious script file beginning with invoice_, invoice_copy or invoice_SCAN. Detection rates for these vary [1]... These Hybrid Analysis reports on three of the samples [2].. show the script download a malicious binary from:
blablaworldqq .com/80.exe?1
hellomydearqq .com/69.exe?1
hellomydearqq .com/80.exe?1
At the moment, those domains don't seem to be resolving, but if you replace the domains with the IP addresses then it will work. The sites are hosted on the following servers:
51.254.226.223 (OVH, France)
173.82.74.197 (Multacom Corporation, US)
The 69.exe and 80.exe files are actually different, both have a detection rate of 4/54 [3]... Analysis of these files [4]... indicates behaviour consistent with ransomware, and these binaries attempt to phone home...
Recommended blocklist:
51.254.226.223
173.82.74.197
conspec .us
tmfilms .net
iqinternal .com
goktugyeli .com
saludaonline .com "
1] https://www.virustotal.com/en/file/4290b85920a4079103047aa2ac58968f44672a05dc81a79225c3c66ad93d2faa/analysis/1457338902/
2] https://www.hybrid-analysis.com/sample/499bd460fc780e77aeca83840c540e82c91fd67a4f263b5518c24c80c0508356?environmentId=4
3] https://www.virustotal.com/en/file/4290b85920a4079103047aa2ac58968f44672a05dc81a79225c3c66ad93d2faa/analysis/1457338902/
4] https://malwr.com/analysis/N2YyNWRiYTQ5YjVhNGU1YmJmY2E3ZGU5MmJlODc4OTQ/
- http://myonlinesecurity.co.uk/order-confirmation-payment-successful-ref-67703560-js-malware-leads-to-teslacrypt-ransomware/
7 Mar 2016 - "An email with the subject of 'Order Confirmation – Payment Successful, Ref. 67703560" [random numbered] pretending to come from random email addresses, companies and names with a zip attachment is another one from the current bot runs... The name of the alleged sender matches the name of the Chief Accountant. The ref number in subject matches the attachment number. The email looks like:
From: Amie yonk <yonkAmie092@ bumperscuffshrewsbury .co.uk>
Date: Mon 07/03/2016 05:56
Subject: Order Confirmation – Payment Successful, Ref. 67703560 (random numbers)
Attachment: Invoice_ref-67703560.zip
Dear Client,
Thank you for your transaction of $727,71. The shipping time varies from 3 to 5 business days, however we will do our best so you can receive your order as soon as possible.
We will send all the information regarding this case to your local post office. They will contact the phone number you provided when the package arrives.
Double check please the document enclosed to this email.
Thank you for your order and we hope to see you again as our customer.
Respectfully,
Amie yonk
Chief Accountant ...
7 March 2016: Invoice_ref-67703560.zip: Extracts to: invoice_zVVGbu.js - Current Virus total detections 2/56*
MALWR** shows a download from http ://hellomydearqq .com/69.exe?1 so that tells us that this is Teslacrypt ransomware (VirusTotal 2/56***).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/37a677fdcce40f91edb181636432aaa8bc0326f3725a76ac83c3a7a6b6228fd7/analysis/1457330191/
** https://malwr.com/analysis/ZDZkZGRjMDA1NWUzNDJlYjkwNDNmMjU2ZjI1MDg4MzM/
Hosts
173.82.74.197
50.62.245.1
*** https://www.virustotal.com/en/file/9d167b5f3289a34d384c5fa3013c39380484c7e935da5e5b99f92bce71c5a8f0/analysis/1457333744/
___
Fake 'Notice to Appear in Court' SPAM - JS malware leads to Kovter and ransomware
- http://myonlinesecurity.co.uk/notice-to-appear-in-court-no-replymailout-pl-js-malware-leads-to-kovter-and-ransomware/
7 Mar 2016 - "An email with the subject of 'Notice to Appear in Court' coming from no-reply@ mailout .pl with a zip attachment is another one from the current bot runs... The email looks like:
From: no-reply@ mailout .pl
Date: Mon 07/03/2016 10:19
Subject: Notice to Appear in Court
Attachment: Notice_to_Appear_00736595.zip
Notice to Appear,
You have to appear in the Court on the March 15.
You are kindly asked to prepare and bring the documents relating to the case to Court on the specified date.
Note: The case may be heard by the judge in your absence if you do not come.
The copy of Court Notice is attached to this email.
Sincerely,
Adam Middleton,
Court Secretary.
7 March 2016: Notice_to_Appear_00736595.zip: Extracts to: Notice_to_Appear_00736595.doc.js - Current Virus total detections 15/56*
.. MALWR** shows a download of -3- files from http ://mehulic-art .com which are known as Kovter, and other ransomware files. VirusTotal [1] [2] [3].. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/57e84469fbfc2a366de2bd239b1f0ac08d2b2fd2e2b477663a8b17f616f1e336/analysis/1457346335/
** https://malwr.com/analysis/Y2Q4ZWYwNGNmYWU3NGQzNmExZjQ3ZjBjYmUwMWZhNjg/
Hosts
185.58.74.132
1] https://www.virustotal.com/en/file/daf4d96a121c9e4935082d4e0264088ff352f14d868f8720d8fa7e4f99c82f05/analysis/1457304422/
2] https://www.virustotal.com/en/file/d175e345d69b382208cf71688fe64aa1e7a839eedf04bc9ed76df73028b5a9d8/analysis/1457346993/
3] https://www.virustotal.com/en/file/587aceb305a39722d5ff4180659295ddb999f6207fa94c332c0dfcf2959b04a2/analysis/1457285169/
___
Fake 'DHL invoice' SPAM - JS malware leads to Locky Ransomware
- http://myonlinesecurity.co.uk/your-latest-dhl-invoice-hsc4387902-js-malware-leads-to-locky-ransomware/
7 Mar 2016 - "An email with the subject of 'Your latest DHL invoice: HSC4387902' [random numbered] pretending to come from e-billing@ dhl .com with a zip attachment is another one from the current bot runs which downloads Locky ransomware...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Your-latest-DHL-invoice-HSC4387902-1024x551.png
7 March 2016: HSC4387902.zip: Extracts to: MNB3492495814.js - Current Virus total detections 1/54*
.. MALWR** shows a download of the -same- Locky ransomware version as mentioned in THIS post*** from http ://shapes .com.pk/system/logs/87tg7v645c.exe
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/030ee48af26860c940dfd224868a71d81cce45b53dc2de4ef121e998eb1a65e6/analysis/1457349592/
** https://malwr.com/analysis/YmY0ZGQ1MGQ3OTEyNGIyNzkxZGMxMzJiMjFiOGFlYmE/
Hosts
50.87.248.127
*** http://myonlinesecurity.co.uk/payment-proof-sunbeverages-js-malware-leads-to-locky-ransomware/
___
Fake 'payment proof' SPAM - JS malware leads to Locky Ransomware
- http://myonlinesecurity.co.uk/payment-proof-sunbeverages-js-malware-leads-to-locky-ransomware/
7 Mar 2016 - "An email with the subject of 'payment proof' pretending to come from SunBeverages <Info@ sunbeverages .eu> with a zip attachment is another one from the current bot runs... The email looks like:
From: SunBeverages <Info@ sunbeverages .eu>
Date: Mon 07/03/2016 09:42
Subject: payment proof
Attachment: 169990489_0492729.zip (random numbers)
Please see attached proof of payment...
5 March 2016: 169990489_0492729.zip: Extracts to: SPL6767845811.js - Current Virus total detections 1/57*
.. MALWR** shows a download of Locky ransomware from http ://aqarhits .com/system/logs/87tg7v645c.exe
(VirusTotal 4/56***).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c3d99d1c88f60209357d70b713ae688d88f8453aaa60d25d62e84f7fe03971e7/analysis/1457347704/
** https://malwr.com/analysis/MTliZTkyNzExODQxNGJkYTk2MDdhMGE4MmU0ZTc4NGM/
Hosts
162.210.102.210
46.108.39.18
*** https://www.virustotal.com/en/file/35db7ec6d9d3fe8b5e33ac9352befdd7abab2566c611f4b427b669194db1605a/analysis/1457348069/
TCP connections
212.47.223.19: https://www.virustotal.com/en/ip-address/212.47.223.19/information/
___
Fake 'E-Service Invoice' SPAM - leads to malware
- http://blog.dynamoo.com/2016/03/malware-spam-e-service-europe-ltd.html
7 Mar 2016 - "This -fake- financial spam leads to malware:
From Andrew Williams [andrew.williams@ eurocoin .co.uk]
Date Mon, 07 Mar 2016 17:37:49 +0530
Subject E-Service (Europe) Ltd Invoice No: 10013405
Dear Customer,
Please find your invoice attached from E-Service (Europe) Ltd. We kindly ask you
to make payment for all transactions on or before their due date.
Please contact E-Service (Europe) if you have any issues or queries preventing your
prompt payment ...
Attached is a ZIP file named Invoice 10013405.zip which contains one of a wide range of randomly-named scripts. A trusted third party analysis (thank you!) shows that there are download locations.. The dropped binary has a detection rate of 5/56* and the Malwr report** clearly shows this is the Locky ransomware. My contact reports that the malware phones home to:
192.121.16.196 (EDIS, Netherlands)
46.108.39.18 (EDIS, Romania)
212.47.223.19 (Web Hosting Solutions OY, Estonia)
109.237.111.168 (Krek Ltd, Russia)
185.92.220.35 (Choopa LLC, Netherlands)
89.108.85.163 (Agava Ltd, Russia)
192.71.213.69 (EDIS, Spain)
Recommended blocklist:
192.121.16.196
46.108.39.18
212.47.223.19
109.237.111.168
185.92.220.35
89.108.85.163
192.71.213.69 "
- http://myonlinesecurity.co.uk/e-service-europe-ltd-invoice-no-10013405-js-malware-leads-to-locky-ransomware/
7 Mar 2016 - "An email with the subject of 'E-Service (Europe) Ltd Invoice No: 10013405' [random numbered] pretending to come from Andrew Williams <andrew.williams@ eurocoin .co.uk> with a zip attachment is another one from the current bot runs which downloads LOCKY RANSOMWARE.. The email looks like:
From: Andrew Williams <andrew.williams@ eurocoin .co.uk>
Date: Mon 07/03/2016 11:39
Subject: E-Service (Europe) Ltd Invoice No: 10013405 ( random numbers)
Attachment: Invoice 10013405.zip
Dear Customer,
Please find your invoice attached from E-Service (Europe) Ltd. We kindly ask you to make payment for all transactions on or before their due date...
7 March 2016: Invoice 10013405.zip: Extracts to: YOJ5879833117.js - Current Virus total detections 2/54*
.. MALWR** shows a download of Locky ransomware from http ://kiddyshop.kiev .ua/image/data/87tg7v645c.exe (VirusTotal 5/54***) Which is slightly different to today’s earlier versions. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/599cc2ec3c64c942daec6eae4b0e9a07430aa049d167730e4db7c04106184c79/analysis/1457354372/
** https://malwr.com/analysis/OTVkYTBkZTM1MDUzNDA0NWJhZTQ2Y2QzMzNjMmU5ZWU/
Hosts
176.114.0.200
185.92.220.35
*** https://www.virustotal.com/en/file/dbf6e09c1ee66ae22b9ede51e931e8da444b0b7eefc7817a9f220d8077ee2d44/analysis/1457355960/
TCP connections
192.121.16.196: https://www.virustotal.com/en/ip-address/192.121.16.196/information/
___
WordPress plugin opens backdoor, steals user credentials
- https://www.helpnetsecurity.com/2016/03/07/popular-wordpress-plugin-opens-backdoor-steals-user-credentials/
Mar 7, 2016 - "If you are one of the 10,000+ users of the 'Custom Content Type Manager (CCTM)' WordPress plugin, consider your site to be compromised and proceed to clean your installation up, Sucuri Security researchers have warned. After finding “a very suspicious auto-update.php file inside wp-content/plugins/custom-content-type-manager/ during the cleanup on an -infected- WP site, the researchers have begun digging, and discovered that:
• The file in question is a backdoor that can download additional files from a third-party domain, and save them in the plugin directory
• The CCTM plugin has been available for download from the official WP Plugin Directory for around three years, but hasn’t been updated in the last 10 months. But, some two weeks ago, a new developer (“wooranker”) started -adding- “small tweeks by new owner” and “bug fixes”... Users who want to keep using the plugin are advised revert to using version 0.9.8.6. and to -disable- automatic plugin updates."
> https://blog.sucuri.net/2016/03/when-wordpress-plugin-goes-bad.html
Updated Mar 7, 2016
(More detail at both URLs above.)
___
Payroll and Human Resources - PHISH
- https://www.helpnetsecurity.com/2016/03/07/phishers-tricking-payroll-pros-sharing-employee-data/
Mar 7, 2016 - "... 'Because a W-2 form provides the employee’s name, Social Security number, address, and earnings information for the year with how much had been deducted for taxes, etc. – as well as the employer’s name and address – it provides everything criminals need to engage in tax refund fraud', Dissent, the privacy advocate running the Office of Inadequate Security blog*, explains. 'It used to be that in February and March, we’d see a number of reports-of-breaches involving employees’ W-2 tax statements that were due to printing or mailing errors. This year, we’re seeing reports of W-2 data-theft -via- phishing'. The blogger has been flagging reports of various companies being successfully targeted with this type of attack: Actifio, AmeriPride, Evening Post Industries, GCI, Main Line Health, and the latest, Seagate. Snapchat was hit earlier this month. And there are likely many more... instead of going directly after the money, the attackers are after information that can be used for stealing money. The fake emails almost always seem to be coming from the firm’s -CEO- asking the payroll -or- HR employee to send the employees’ W-2 forms, in PDF form, 'for review'... we can expect a continuing, steady stream of these emails hitting all types of companies. It remains on them to educate their staff so they don’t fall for it."
* http://www.databreaches.net/mounting-phishing-reports-predict-new-tax-refund-fraud-victims-in-2016/
Mar 7, 2016
:fear::fear: :mad:
AplusWebMaster
2016-03-08, 13:25
FYI...
Fake 'Pay_Advice_Vendor' SPAM - JS malware leads to Dridex
- http://myonlinesecurity.co.uk/pay_advice_vendor_0000300320_1000_for_03-03-2016-yorkshire-water-js-malware-leads-to-dridex/
8 Mar 2016 - "An email with the subject of PayPay_Advice_Vendor_0000300320_1000_for_03.03.2016' pretending to come from Accounts Payable <vendoramendments@ yorkshirewater .co.uk> with a zip attachment is another one from the current bot runs which downloads Dridex banking Trojan... The email looks like:
From: Accounts Payable <vendoramendments@ yorkshirewater .co.uk>
Date: Tue 08/03/2016 08:25
Subject: Pay_Advice_Vendor_0000300320_1000_for_03.03.2016
Attachment: Pay_Advice_Vendor_0000300320_1000_for_03.03.2016.PDF.ZIP
Spotted a leak?
If you spot a leak please report it immediately. Call us ...
Get a free water saving pack
Don’t forget to request your free water and energy saving pack, it could save you money on your utility bills and help you conserve water..
8 March 2016: Pay_Advice_Vendor_0000300320_1000_for_03.03.2016.PDF.ZIP: Extracts to: LQO1169369605.js
Current Virus total detections 4/56*.. MALWR shows a download of what looks like Dridex banking Trojan from http ://reclamus .com/9uj8n76b5.exe (VirusTotal 2/56**). Other download locations so far discovered include
lhs-mhs .org/9uj8n76b5.exe | jatukarm-30 .com/9uj8n76b5.exe | stopmeagency.free .fr/9uj8n76b5.exe ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3a046da63c6c20947f075fb3c92dfc43a5436627818c7bd6d3a41cd973146550/analysis/1457426128/
** https://www.virustotal.com/en/file/b82bfc5ea12e352d0063ef813fa832196130ec880b22c9e8d0233023d8b587a0/analysis/1457426412/
TCP connections
38.64.199.3: https://www.virustotal.com/en/ip-address/38.64.199.3/information/
8.253.82.126: https://www.virustotal.com/en/ip-address/8.253.82.126/information/
- http://blog.dynamoo.com/2016/03/malware-spam-payadvicevendor00003003201.html
8 Mar 2016 - "This -fake- financial spam does not come from Yorkshire Water but is instead a simple -forgery- with a malicious attachment.
From Accounts Payable [vendoramendments@ yorkshirewater .co.uk]
Date Tue, 08 Mar 2016 10:32:52 +0200
Subject Pay_Advice_Vendor_0000300320_1000_for_03.03.2016
Spotted a leak?
If you spot a leak please report it immediately. Call us...
Get a free water saving pack
Don't forget to request your free water and energy saving pack, it could save you
money on your utility bills and help you conserve water...
I have only seen a single sample with an attachment named Pay_Advice_Vendor_0000300320_1000_for_03.03.2016.PDF.ZIP which contains a randomly-named malicious script with a detection rate of 3/54*. According to the Malwr report** and Hybrid Analysis*** on this sample, it downloads a malicious binary from:
lhs-mhs .org/9uj8n76b5.exe
This binary has a detection rate of 2/54[4] and all those reports indicate that it phones home to:
38.64.199.3 (PSINet, Canada)
I recommend that you -block- traffic to that IP. The Malwr report on the dropped binary is inconclusive, but it looks like the Dridex banking trojan."
* https://www.virustotal.com/en/file/5d9570cbd42ae8aa409b17bf46ac7ea0fef054793f2b42ce49fed94ede01347c/analysis/1457426440/
** https://malwr.com/analysis/MjU1N2JkMWE5NDZkNDAwZmIwNmIxNzJkMjlkOGZlOTk/
Hosts
208.131.141.2
38.64.199.3
184.25.56.34
*** https://www.hybrid-analysis.com/sample/5d9570cbd42ae8aa409b17bf46ac7ea0fef054793f2b42ce49fed94ede01347c?environmentId=4
4] https://www.virustotal.com/en/file/b82bfc5ea12e352d0063ef813fa832196130ec880b22c9e8d0233023d8b587a0/analysis/1457426850/
TCP connections
38.64.199.3: https://www.virustotal.com/en/ip-address/38.64.199.3/information/
8.253.82.126: https://www.virustotal.com/en/ip-address/8.253.82.126/information/
___
Fake 'Emailing' SPAM - JS attachment leads to Dridex
- http://myonlinesecurity.co.uk/emailing-20121005154449756-gary-atkinson-garrardwindows-co-uk-js-malware-leads-to-dridex/
8 Mar 2016 - "An email with the subject of 'Emailing: 20121005154449756' pretending to come from Gary Atkinson <Gary@ garrardwindows .co.uk> with a zip attachment is another one from the current bot runs which downloads Dridex banking Trojan... The email looks like:
From: Gary Atkinson <Gary@ garrardwindows .co.uk>
Date: Tue 08/03/2016 09:00
Subject: Emailing: 20121005154449756
Attachment:
Please find attached document as requested.
8 March 2016:20121005154449756.zip: Extracts to: UIP3776229406.js - Current Virus total detections 3/56*
MALWR** shows a download of Dridex banking Trojan from http ://lhs-mhs .org/9uj8n76b5.exe
(VirusTotal ***) which is the same binary as THIS post[4]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/303e3bf35c441cfa02abe8c794074a1c4680ae46113c011aef8c6b839d73dce8/analysis/1457427965/
** https://malwr.com/analysis/MGZjZDhiNjY2ZGQ4NDE3OThhZmIxYTJlNDVkOWEyNzE/
Hosts
208.131.141.2
38.64.199.3
8.254.249.78
*** https://www.virustotal.com/en/file/b82bfc5ea12e352d0063ef813fa832196130ec880b22c9e8d0233023d8b587a0/analysis/1457427628/
TCP connections
38.64.199.3: https://www.virustotal.com/en/ip-address/38.64.199.3/information/
8.253.82.126: https://www.virustotal.com/en/ip-address/8.253.82.126/information/
4] http://myonlinesecurity.co.uk/pay_advice_vendor_0000300320_1000_for_03-03-2016-yorkshire-water-js-malware-leads-to-dridex/
- http://blog.dynamoo.com/2016/03/malware-spam-emailing-20121005154449756.html
8 Mar 2016 - "This spam does -not- come from Garrard Windows but is instead a simple -forgery- with a malicious attachment:
From Gary Atkinson [Gary@ garrardwindows .co.uk]
Date Tue, 08 Mar 2016 12:09:33 +0300
Subject Emailing: 20121005154449756
Please find attached document as requested.
Attached is a file 20121005154449756.zip which contains a randomly-named script. I have seen two samples so far (VirusTotal results [1]..). The Malwr reports [3].. show the script downloads from the following locations:
jatukarm-30 .com/9uj8n76b5.exe
stopmeagency .free.fr/9uj8n76b5.exe
The downloaded binary appears to be Dridex and is the -same- as found in this spam run*."
1] https://www.virustotal.com/en/file/ef0af5076113949794f5122d01691d1d1c4f44c060755073c3b22afbc331ee92/analysis/1457429537/
2] https://malwr.com/analysis/Y2ZiZTA2ZWJiMjAzNDdkYjkyMTFiZDhlYzdmYWIyYWI/
Hosts
203.146.251.198
38.64.199.3
23.216.11.120
* http://blog.dynamoo.com/2016/03/malware-spam-payadvicevendor00003003201.html
___
Fake 'Order' SPAM - doc malware leads to Dridex
- http://myonlinesecurity.co.uk/order-1307605-acknowledgement-rick-adriobooles-co-uk-word-doc-macro-malware-leads-to-dridex/
8 Mar 2015 - "An email with the subject of 'Order 1307605 (Acknowledgement)' pretending to come from rick.adrio@ booles .co.uk with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: rick.adrio@ booles .co.uk
Date: Tue 08/03/2016 09:31
Subject: Order 1307605 (Acknowledgement)
Attachment: pm51A.docm
Please find document attached ...
8 March 2016: pm51A.docm Current Virus total detections 5/55*
MALWR** shows a download of Dridex banking Trojan from http ://kyudentyumi .web .fc2 .com/9uj8n76b5.exe
... which is the -same- Dridex Trojan version as described in today’s earlier posts where they are using .JS files inside zips to distribute the malware... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d054beac6d0380eab23a0f9db5097bbc6c913e8836f3b0debdb1c2f89a551c8f/analysis/1457430327/
** https://malwr.com/analysis/NjZkZjFmMjBmNzU0NDY3Mjg5N2YyNTVkOGE3OTZhOTM/
Hosts
208.71.106.45
38.64.199.3
23.216.11.120
- http://blog.dynamoo.com/2016/03/malware-spam-order-1307605.html
8 Mar 2015 - "This fake financial spam has a malicious attachment:
From rick.adrio@ booles .co.uk
Date Tue, 08 Mar 2016 15:58:07 +0530
Subject Order 1307605 (Acknowledgement)
Please find document attached ...
Attached is a file pm51A.docm which I have seen two versions of (VirusTotal results [1] [2]). According to these Malwr reports [3] [4] and various other sources the macro in the document downloads from:
stopmeagency .free.fr/9uj8n76b5.exe
reclamus .com/9uj8n76b5.exe
lhs-mhs .org/9uj8n76b5.exe
izzy-cars .nl/9uj8n76b5.exe
kyudentyumi.wekyudentyumi .web.fc2 .com/9uj8n76b5.exe
The dropped binary has -changed- from earlier and has a detection rate of 2/55*, it phones home to the -same- IP address as seen in this campaign**. It appears to be the Dridex banking trojan."
1] https://www.virustotal.com/en/file/1ca42296d1fbc2e5c2789351754e4c5e3ea0ab592e7777305bd4c60ed4c22c79/analysis/1457433767/
2] https://www.virustotal.com/en/file/09515dd0cd0c29bb473e8358f2ee90f113fe56e451e9a9a15902198a87260da8/analysis/1457433778/
3] https://malwr.com/analysis/MWM1ZmRlYjIxZjlkNGU5OWEwNDk1NjA5YTlmMzFiYmQ/
Hosts
46.235.47.134
38.64.199.3
13.107.4.50
4] https://malwr.com/analysis/NmIyYzAxMzZiY2FhNDY1M2JmOWZjMDg2ODFhZGY1MmE/
Hosts
208.131.141.2
38.64.199.3
13.107.4.50
* https://www.virustotal.com/en/file/a75866eab2c75bc476f83f36bceeaea4c89a627ea0e6dcbd1024a3cd7b7a5874/analysis/
TCP connections
38.64.199.3: https://www.virustotal.com/en/ip-address/38.64.199.3/information/
131.253.33.50: https://www.virustotal.com/en/ip-address/131.253.33.50/information/
** http://blog.dynamoo.com/2016/03/malware-spam-payadvicevendor00003003201.html
___
Fake 'FeDex-service' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-samson-floyd-agent-fedex.html
8 Mar 2016 - "This -fake- FedEx spam has a malicious attachment:
From: FeDex-service
Date: 8 March 2016 at 11:40
Subject: Samson Floyd agent Fedex
Dear [redacted],
We attempted to deliver your item on March 07th, 2016, 11:40 AM.
The delivery attempt failed because the address was business closed or
nobody could sign for it. To pick up the parcel,please, print the receipt
that is attached to this email and visit Fedex office indicated in the
invoice. If the package is not picked up within 48 hours, it will be returned
to the shipper.
Label: US45928402845 ...
Attached is a RAR archive file in this case named US45928460284.rar containing in turn a malicious script US45928460284.js ... This attempts to download an executable from:
www .fotoleonia .it/files/sample.exe
This has a VirusTotal detection rate of 4/54*. The Malwr report** shows a subsequent download from:
www .claudiocalaprice .com/modules/fedex/pad.exe
This has similar detections*** to the first binary. That Malwr report also indicates the binary POSTing data to:
pdf.repack .bike/new_and/state.php
This is hosted on:
151.80.76.200 (Kitdos, US / OVH, France)
I would suggest that the -entire- 151.80.76.200/29 range is questionable and should be -blocked-. None of the automated tools I ran... gave any insight as to what the malware does, but it is clearly something malicious."
* https://www.virustotal.com/en/file/edd70ab9372d8c5c31419802f7baa77d8839aab3bbcbac78c806a7c143ebbef9/analysis/1457437544/
** https://malwr.com/analysis/Yjk4NWM3Yzc0OGQ3NGNlODkwYTFjNDZhMGMxMDQyNzU/
Hosts
78.83.32.3
172.217.3.35
172.217.0.67
62.149.142.172
129.70.132.34
8.8.4.4
23.100.122.175
151.80.76.200
62.149.142.151
*** https://www.virustotal.com/en/file/bb8373499ee9fe4e4f25302defb315c43d7129781cf68703d70ca6d1385c61f9/analysis/1457438147/
___
Fake 'Compensation' SPAM - JS malware leads to Locky Ransomware
- http://myonlinesecurity.co.uk/compensation-reference-number-242852-js-malware-leads-to-locky-ransomware/
8 Mar 2016 - "An email with the subject of 'Compensation – Reference Number #242852' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... The email looks like:
From: Lily Adams <AdamsLily33@ haleandheartymovers .com>
Date: Tue 08/03/2016 12:00
Subject: Compensation – Reference Number #242852
Attachment: SCAN_00_242852.zip
Dear Customer,
The mistake made will be compensated promptly, please do not worry.
Please take a look at the file attached (scanned document) as it contains all the information.
Sincerely,
Lily Adams
Sales Manager ...
8 March 2016: SCAN_00_242852.zip: Extracts to -2- different .JS files: accent.670345320.js
Current Virus total detections 1/56* and email.141350705.js (VirusTotal 1/56**).. MALWR [1][2] shows both download of Locky ransomware from http ://lahmar.choukri.perso.neuf .fr/78hg4wg (VirusTotal ***).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15096c9e17b65ce30c710796f7f3a05927d9e75a857b14caada64dd5dde02c51/analysis/1457438201/
** https://www.virustotal.com/en/file/0b33f8a9b0edb278f1d1367b8e5197b0a879ac1ca7f7e343044fd19022428e15/analysis/1457438200/
1] https://malwr.com/analysis/OTdhZjg3ZTAzNGUxNDJjYzhiNGE1ZGM1MGFlNWM0NzE/
Hosts
86.65.123.70
37.235.53.18
2] https://malwr.com/analysis/NWFjMmE1ZDVmOTU1NDQ3Y2FlNjkyZjgzMzI2ODkyMjI/
Hosts
86.65.123.70
89.108.85.163
*** https://www.virustotal.com/en/file/0778db31d7e3259a65affc28ca1a317c67105a3fa75250b7370a5dfa70585c0c/analysis/1457439479/
TCP connections
89.108.85.163: https://www.virustotal.com/en/ip-address/89.108.85.163/information/
149.154.157.14: https://www.virustotal.com/en/ip-address/149.154.157.14/information/
- http://blog.dynamoo.com/2016/03/malware-spam-compensation-reference.html
8 Mar 2016 - "This -fake- financial spam comes with a malicious attachment:
From: Orval Burgess
Date: 8 March 2016 at 11:10
Subject: Compensation - Reference Number #368380
Dear Customer,
The mistake made will be compensated promptly, please do not worry.
Please take a look at the file attached (scanned document) as it contains all the information.
Sincerely,
Orval Burgess
Account Manager
Attached is a file named in a similar format to SCAN_00_368380.zip which contains -TWO- malicious scripts named in a format similar to email.864036956.js (VirusTotal results [1]..) and automated analysis tools [5].. [9].. show binary download locations at:
ministerepuissancejesus .com/o097jhg4g5
ozono. org.es/k7j6h5gf
Those same reports indicate the malware attempts to phone home to the following IPs:
89.108.85.163 (Agava Ltd, Russia)
151.236.14.51 (EDIS, Netherlands)
149.154.157.14 (EDIS, Italy)
37.235.53.18 (EDIS, Spain)
192.121.16.196 (EDIS, Sweden)
Those automated reports all indicate that this is the Locky ransomware.
Recommended blocklist:
89.108.85.163
151.236.14.51
149.154.157.14
37.235.53.18
192.121.16.196 "
(More detail at the dynamoo URL above.)
1] https://www.virustotal.com/en/file/7da7829bcfbfdf3628a6b97f529fb74c6273be941fe02c72279afd96be5e0616/analysis/
5] https://malwr.com/analysis/Y2JkOGM2ZTEyYTI1NGY5MTgyYjZkNDdhNWFiYmVmOWQ/
9] https://www.hybrid-analysis.com/sample/7da7829bcfbfdf3628a6b97f529fb74c6273be941fe02c72279afd96be5e0616?environmentId=4
email.297456567.js
email.931921928.js
email.374106319.js
email.864036956.js
___
Fake 'Invoice #' SPAM - JS malware leads to ransomware
- http://myonlinesecurity.co.uk/fw-invoice-733745-2016-03-js-malware-leads-to-ransomware/
8 Mar 2016 - "An email with the subject of 'FW: Invoice #733745-2016-03' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads a Locky Ransomware version... The email looks like:
From: Agnes Vaughan <VaughanAgnes08980@ speedy .com.ar>
Date: Tue 08/03/2016 15:12
Subject: FW: Invoice #733745-2016-03
Attachment:
Dear ellie,
Please see attached (scanned document) file for your invoice.
Thank you for your business
Agnes Vaughan
Account Manager
8 March 2016: SCAN_2016_03_733745.zip: Extracts to: -2- slightly different sized .JS files
accent.216401762.js (VT*) and accent.599656717.js (VT**)
.. MALWR [1] [2] both show a download from http ://het-havenhuis .nl/099oj6hg (VirusTotal 15/57***)
... the second MALWR report clearly shows Locky.. Chrome & Firefox but -not- Internet Explorer -block- this site with big red warnings of malware... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d6c8781cd8eeb5efc0727d6c236b9dd4658ec6328b3d31a83b8d87d19f417517/analysis/1457449790/
** https://www.virustotal.com/en/file/4ae3daf17c4e0e43b1c32bf5737638e1c8b40920d691af72b1ef5ef4b3e8c341/analysis/1457449826/
1] https://malwr.com/analysis/YTUyNTRlYjI5ODZiNDdjZjhhMjljZmRkYWM5ZjIwN2M/
Hosts
83.137.194.70
212.47.223.19
192.121.16.196
89.108.85.163
2] https://malwr.com/analysis/YWU4ZTZmNGEwNTMxNDI5MGJiYWY2M2ZlZTFiYmI5NTY/
Hosts
83.137.194.70
212.47.223.19
151.236.14.51
*** https://www.virustotal.com/en/file/ddf646e2527f4f1a8cd8904e85ca92a569a1f4d8cbdfb318746c50426df8540b/analysis/1457450528/
TCP connections
37.235.53.18: https://www.virustotal.com/en/ip-address/37.235.53.18/information/
:fear::fear: :mad:
AplusWebMaster
2016-03-09, 14:55
FYI...
Fake 'Invoice#' SPAM - JS malware leads to Teslacrypt
- http://myonlinesecurity.co.uk/invoice-96187656-for-your-order-js-malware-leads-to-teslacrypt-ransomware/
9 Mar 2016 - "An email with the subject of 'Invoice #96187656 for your Order' [random numbered] pretending to come from Finance Information (random email addresses) with a zip attachment is another one from the current bot runs which downloads Teslacrypt ransomware... The email looks like:
From: Finance Information <root@ free-dreams .nl>
Date: Wed 09/03/2016 07:23
Subject: Invoice #96187656 for your Order
Attachment: invoice_SCAN_yzGbVV.zip
Good day, dear client!
We have recently shipped your parcel at you region post office.
You can find the file bill of your shipment in the attachment. Make sure to check.
Take care.
Order/Invoice number:
96187656
Order/Invoice date:
09.03.2016
Accounts Department
Wavenet Group
Incorporating – Titan Technology, Centralcom and S1 Network Services ...
9 March 2016: invoice_SCAN_yzGbVV.zip: Extracts to: invoice_SCAN_yzGbVV.js - Current Virus total detections 8/57*
MALWR** shows a download of Teslacrypt from http ://howareyouqq .com/25.exe?1 (VirusTotal ***)
NOTE: this also tries to download http ://google .com/25.exe?1 which does not exist and I can only assume that the bad actors have made a mistake in their coding and were probably trying to use the well known open redirect security hole in Google search and other google products... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6ce1d9f79db932be4792b90d2023733647f0a2db73a98c0147724dc174d6e8ce/analysis/1457508873/
** https://malwr.com/analysis/NmU4NjllZmE2Y2Q3NDlkZWJiOTNkYmE3MTBlYWZmYzU/
Hosts
185.118.142.154
216.58.219.14
*** https://www.virustotal.com/en/file/2e59eb3f0a7546e6082f83d9c98c8d9260cee22167353ed18171baf5af9d1e75/analysis/1457503315/
TCP connections
50.87.28.241: https://www.virustotal.com/en/ip-address/50.87.28.241/information/
>> https://www.virustotal.com/en/url/423e4055452e08f74d242938deb29e1c6411fac1184372626cdaa165ff62f038/analysis/
___
Fake 'DOC' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-doc-z21193008-idris.html
9 Mar 2016 - "This terse spam has a malicious attachment. There is -no- body text.
From: Idris Mohammed [idrismohammed25@ gmail .com]
Date: 9 March 2016 at 09:55
Subject: DOC-Z21193008
Attached is a file img-DOC-Z21193008.docm which I have seen two versions of (VirusTotal results [1] [2]). Automated analysis [3] [4].. shows the macro in these two documents downloading from:
gpcarshop .com.br/system/logs/07yhnt7r64.exe
karnavalnye .com/system/logs/07yhnt7r64.exe
There are no doubt several -other- download locations. This binary has a detection rate of 3/56*. The various reports indicate that it phones home to a server at:
64.76.19.251 (Impsat, Argentina)
I strongly recommend that you -block- traffic to that IP. Payload is likely to be the Dridex banking trojan."
1] https://www.virustotal.com/en/file/7a0aca9b057c1c47ba0f8590b801279ef7c0d072db6d55461ac17950c2c71c14/analysis/1457517657/
2] https://www.virustotal.com/en/file/e0d94d7d43a4ea9d243a0876c5db0d3c25095fff80b968642ec4aa1b18a1980a/analysis/1457517660/
3] https://malwr.com/analysis/MmEwMTc4NTlhZjRmNDkwNjhiNmYzZTEzNmQ0NjVhMDk/
4] https://malwr.com/analysis/Y2Y4ZTQzOTUxZmE0NDRjNmI4YmVmMjgyZTExN2U4ODE/
* https://www.virustotal.com/en/file/297ed5f69a0342925670d4479750714430bf5c7752ac37542c4c626080644695/analysis/1457518357/
TCP connections
64.76.19.251
8.253.82.126
- http://myonlinesecurity.co.uk/doc-z21193008-idris-mohammed-word-doc-malware-leads-to-dridex/
9 Mar 2016 - "An email with the subject of 'DOC-Z21193008' pretending to come from Idris Mohammed <idrismohammed29@ gmail .com> (random numbers after idrismohammed) with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Idris Mohammed <idrismohammed29@ gmail .com>
Date: Wed 09/03/2016 09:54
Subject: DOC-Z21193008
Attachment: img-DOC-Z21193008.docm
Body content: completely blank
9 March 2016: img-DOC-Z21193008.docm - Current Virus total detections 4/56*
.. MALWR shows a download of Dridex banking Trojan from
http ://karnavalnye .com/system/logs/07yhnt7r64.exe (VirusTotal 3/56**)...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/98a6fdbb6a888fe1431316cac228db76d9fc926d52aee734e67e59d3a7fe89e9/analysis/1457518626/
** https://www.virustotal.com/en/file/297ed5f69a0342925670d4479750714430bf5c7752ac37542c4c626080644695/analysis/1457518357/
TCP connections
64.76.19.251
8.253.82.126
___
Fake 'Voice msg' SPAM - JS malware leads to Dridex
- http://myonlinesecurity.co.uk/voice-message-attached-from-44163311902-name-unavailable-inclarity-voicemail-js-malware-leads-to-dridex/
9 Mar 2016 - "An email with the subject of 'Voice Message Attached from +44163311902' – name unavailable [random numbered] pretending to come from voicemail <voicemail@ inclarity .net> with a zip attachment is another one from the current bot runs which downloads Dridex banking malware... The email looks like:
From: voicemail <voicemail@ inclarity .net>
Date:
Subject: Voice Message Attached from +44163311902 – name unavailable
Attachment: 44163311902_20160309_91981473.wav.zip
Time: Wed, 09 Mar 2016 14:51:02 +0530
Click attachment to listen to Voice Message
9 March 2016: 44163311902_20160309_91981473.wav.zip: Extracts to: WED2970789413.js - Current Virustotal detections 3/56*
.. MALWR** shows a download of Dridex banking Trojan from http ://variant13 .ru/system/logs/07yhnt7r64.exe which is the -same- Dridex binary from THIS post***.. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/cc42cc04e527473d4b0e5c163e9f8c9c980342483533b6d97faf2df23c6890bd/analysis/1457519130/
** https://malwr.com/analysis/NDQ4MDRkNjI3ZTM3NDBmNGI1MmMyN2QyMDA3NWUyMjk/
Hosts
37.140.192.62
64.76.19.251
13.107.4.50
*** http://myonlinesecurity.co.uk/doc-z21193008-idris-mohammed-word-doc-malware-leads-to-dridex/
___
Fake 'Invoice 2016' SPAM - JS malware leads to Locky Ransomware
- http://myonlinesecurity.co.uk/fw-invoice-2016-m184605-js-malware-leads-to-locky-ransomware/
9 Mar 2016 - "An email saying 'Please find attached 2 invoices for processing' with the subject of 'FW: Invoice 2016-M#184605 [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... The email looks like:
From: Ann Guerrero <GuerreroAnn36420@ ono .com>
Date: Wed 09/03/2016 10:38
Subject: FW: Invoice 2016-M#184605
Attachment: Payment_2016_March_184605.zip
Dear vbygry,
Please find attached 2 invoices for processing.
Yours sincerely,
Ann Guerrero
Account Manager ...
5 March 2016: Payment_2016_March_184605.zip: Extracts to -2- different files:
problem.974210026.js [VT*] see_it.001832901.js [VT**]:
.. MALWR [1] [2] -both- show a download of Locky Ransomware from
http ://planetarchery .com.au/system/logs/q32r45g54 (VirusTotal 5/57***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6f4fdbc64434722c33627569ae8c2054d8fea3e9ae77179ef3a6f45edd9b31ff/analysis/1457523481/
** https://www.virustotal.com/en/file/d6534032a64876fdd8923cb9b8a42b41bb781a76b0a9a7ce72f55ebd7aa96940/analysis/1457523485/
1] https://malwr.com/analysis/OGE4YjllMWFkZDllNDY3YWJlYzVjOGQ4OTVhYjExZWY/
Hosts
103.240.88.28
149.154.157.14
2] https://malwr.com/analysis/OTc5ZDBmMWY2ZTkyNDRlZDkzOGQ3OTIxZDVkYzViNzE/
Hosts
103.240.88.28
91.195.12.131
*** https://www.virustotal.com/en/file/afcdc1d52ecf6ba2a17156928339e9742f367d4b6f7f015ab4dd915daa9f616d/analysis/1457524130/
TCP connections
149.154.157.14: https://www.virustotal.com/en/ip-address/149.154.157.14/information/
- http://blog.dynamoo.com/2016/03/malware-spam-please-find-attached-2.html
9 Mar 2016 - "These -fake- financial spam emails come from random sources with different names and reference numbers:
From: Melisa Keller
Date: 9 March 2016 at 12:08
Subject: FW: Invoice 2016-M#111812
Dear server,
Please find attached 2 invoices for processing.
Yours sincerely,
Melisa Keller
Financial Manager ...
Attached is a file with a name similar to Payment_2016_March_111812.zip which contains -two- scripts, which in the samples I have seen all start with "see_it" or "problem". These malicious scripts all have low detection rates... there may be other download locations. The Malwr reports indicate that the malware phones home to:
78.40.108.39 (PS Internet Company LLC, Kazakhstan)
149.154.157.14 (EDIS, Italy)
The payload is the Locky ransomware.
UPDATE: I received the following information from another source (thank you)...
Additional C2s:
91.195.12.131 (PE Astakhov Pavel Viktorovich, Ukraine)
151.236.14.51 (EDIS, Netherlands)
37.235.53.18 (EDIS, Spain)
Recommended blocklist:
78.40.108.39
149.154.157.14
91.195.12.131
151.236.14.51
37.235.53.18 "
___
Fake 'from Admin' SPAM - JS malware leads to ransomware
- http://myonlinesecurity.co.uk/random-named-doc-pretending-to-come-from-admin-at-your-own-domain-js-malware-leads-to-ransomware/
9 Mar 2016 - "An email with the subject of 'DOC-AA25400B' [random numbered] pretending to come from -admin- <adm323@ victim_domain .tld> the numbers after adm are random Your-own-email-domain with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... The email looks like:
From: admin <adm323@ victim_domain .tld>
Date: Wed 09/03/2016 12:05
Subject: DOC-AA25400B
Attachment: DOC-AA25400B.zip
Totally -blank- body content
9 March 2016: DOC-AA25400B.zip: Extracts to: JGK9027615101.js - Current Virus total detections 5/57*
.. MALWR** shows a download of Locky Ransomware from
http ://thietbianninhngocphuoc .com/system/logs/98yhb764d.exe (VirusTotal ***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6bab3df582babeda6cc90f45d1e447bc70e8e6d0b08b746faeb96371f8513d80/analysis/1457528965/
** https://malwr.com/analysis/ZWI1NzJlMjYyZTA1NGUwZDlhOGFhYzU0MmRkYzlhNmI/
Hosts
123.30.187.116: https://www.virustotal.com/en/ip-address/123.30.187.116/information/
>> https://www.virustotal.com/en/url/5b5c883e6f2341db488f5ad88393ff0eacc8d9d8921e9d7f29dd882f60ebf15c/analysis/
78.40.108.39
*** https://www.virustotal.com/en/file/f9b90afd91dc9941feb75929741b558f8a5f9f71a9c616efdbf57ef414013745/analysis/1457528686/
TCP connections
78.40.108.39: https://www.virustotal.com/en/ip-address/78.40.108.39/information/
___
AMEX 'PSK' PHISH
- http://myonlinesecurity.co.uk/american-express-account-alert-personal-safe-key-psk-phishing/
9 Mar 2016 - "... a mass run of phishing emails -spoofing- American Express saying 'Please create your Personal Security Key'. There are -3- sites so far discovered that attempt to perform this phishing attack
http ://americanexpressnew2016 .com/login
http ://americanexpressglobal .com/login
http ://axpoglobalverify .com/login
Currently all 3 sites fail to resolve from a UK IP address. They were all registered -yesterday- 8 March 2016 via Todaynic .com using Chinese details which I assume are false. The name servers associated with the domains are DNS1.NEWSITEDNS2 .RU and DNS2.NEWSITEDNS2 .RU
Edit: after a bit of digging around, it appears that the NEWSITEDNS2 .RU has previously been used for Amex and other bank phishing attacks. It is suggested that you -block- their IP numbers to prevent further and future problems:
155.94.169.106 VirusTotal*
104.168.62.233 VirusTotal**
50.2.26.16 VirusTotal***
148.163.173.227
192.210.203.49
Either the DNS has not propagated yet worldwide or the DNS service has pulled the domains. My gut feeling is that the bots have sent the emails too early before the sites were live. The date & time on the emails say Wed 30/09/2015 13:32. I received about -50- copies of these between 03.20 and 03.30 UTC. Be aware and watch out for when these do go live, probably later today...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Amex_PSK_Phishing-1024x558.png "
* https://www.virustotal.com/en/ip-address/155.94.169.106/information/
** https://www.virustotal.com/en/ip-address/104.168.62.233/information/
*** https://www.virustotal.com/en/ip-address/50.2.26.16/information/
___
Some Tips for Preventing Ransomware
- https://isc.sans.edu/diary.html?storyid=20821
Last Updated: 2016-03-09 - "... 'get asked a lot by clients is "how can I prepare/prevent an infection?"
'Prepare' is a good word in this case, it encompasses both prevention and setting up processes for dealing with the infection that will inevitably happen in spite of those preventative processes. Plus it's the first step in the Preparation / Identification / Containment / Eradication / Restore Service / Lessons Learned Incident Handling process (see SANS SEC 504*..)
* https://www.sans.org/course/hacker-techniques-exploits-incident-handling
... best advice is - look at how the infection happens, and make this as difficult as possible for the attacker, the same as you would try to prevent any malware. Most malware these days outsources the delivery mechanism - so Cryptowall is typically delivered by an exploit "kit". These days, that typically means the Angler, Rig, or maybe Nuclear exploit kits (Angler being the most prevalent at the moment). These kits aren't magic, they generally try to exploit -old- versions of Java, Flash, Silverlight or take advantage of -missing- Windows updates... When patches come out, the authors of these kits reverse-the-patches and bolt the exploits into their kit..."
(More detail at the isc-diary URL at the top of this post.)
:fear::fear: :mad:
AplusWebMaster
2016-03-10, 13:15
FYI...
Fake 'random invoice' SPAM - doc macro leads to unknown malware
- http://myonlinesecurity.co.uk/random-invoice-or-bill-word-doc-macro-leads-to-unknown-malware/
10 Mar 2016 - "An email with random invoice or bill subjects coming from random names and emails addresses with a malicious word doc attachment is another one from the current bot runs... A high proportion of these are -not- getting caught by the spam or content filters because they pass SPF & DKIM authentication checks. These have a load of different subjects that include:
Re: Important Notice About Created Invoice
Urgent Notification About New Bill
Re: Last Notice About Paid Bill
Fwd: Important Message About Unpaid Invoice
Fwd: Urgent Notice About Paid Bill
Last Notification About Created Bill
Fw: Last Message About Last Bill
Fwd: Urgent Message About New Invoice
Re: Urgent Message About Created Invoice
Fw: Last Notification About Unpaid Invoice
The email looks like:
From: Reece Solis <acc@ hai-van .com>
Date: Thu 10/03/2016 04:58
Subject: Re: Important Notice About Created Invoice
Attachment: 4KEEY46Y.doc
Pls review the report attached.
Reece Solis
-or-
check the invoice attached.
Stuart Sweet
-or
see the report in attachment.
Odysseus Mcmillan
10 March 2016: 4KEEY46Y.doc - Current Virus total detections: [1] [2]..
.. MALWR [3] [4] shows downloads from http ://hoosierpattern .com/a1.jpg?Df1iQh0PABlsu=38 which is a jpg that contains embedded malware that is extracted via the macro & a dropped vbs file to give 339.exe (VirusTotal 4/57*)...
Update: I am reliably informed that this is Dridex banking Trojan and an alternative download location is http ://darrallmacqueen .com/b2.jpg?JzKE5CmWJZnG=
... The jpg it downloads looks like this (screenshot to avoid risks):
> http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/hoosier.png
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
1] https://www.virustotal.com/en/file/5bd8638a06ec935e2bde270e9f2d488bc882f66ffcff5806307bef5ef8d38a14/analysis/1457590567/
2] https://www.virustotal.com/en/file/4d6747e9abf1ec5ffb8ce23ad14b20c866e50874844ca6424fb616033f6e7360/analysis/1457586170/
3] https://malwr.com/analysis/YTRjY2M1ZmE2NGRlNGRjNmEyYmFhNTZkNzc0YjAzMDY/
Hosts
172.231.69.95
216.194.172.222: https://www.virustotal.com/en/ip-address/216.194.172.222/information/
>> https://www.virustotal.com/en/url/edc9b5d9868b116f2be71cb73de607ab530380461f36efd723f9a7bda89343b9/analysis/
4] https://malwr.com/analysis/MTAxMzFhYzBlYjZjNDNkOTk0MTljYTAxMjdkYmZkOGE/
Hosts
172.231.69.95
216.194.172.222
* https://www.virustotal.com/en/file/93747b21f333370277fefb4322a051df2e16673e9d766f2fe4fb1c05c491f5a0/analysis/1457591438/
5] https://www.reverse.it/sample/93747b21f333370277fefb4322a051df2e16673e9d766f2fe4fb1c05c491f5a0?environmentId=1
6] https://www.reverse.it/sample/93747b21f333370277fefb4322a051df2e16673e9d766f2fe4fb1c05c491f5a0?environmentId=4
- http://blog.dynamoo.com/2016/03/malware-spam-final-notice-about-unpaid.html
10 Mar 2016 - "... examples can be seen here*...
* http://myonlinesecurity.co.uk/random-invoice-or-bill-word-doc-macro-leads-to-unknown-malware/
... the only mitigating step I can think of is to -block- traffic to darrallmacqueen .com which should stop the files downloading."
darrallmacqueen .com: 185.9.51.4: https://www.virustotal.com/en/ip-address/185.9.51.4/information/
hoosierpattern .com: 216.194.172.222: https://www.virustotal.com/en/ip-address/216.194.172.222/information/
>> https://www.virustotal.com/en/url/edc9b5d9868b116f2be71cb73de607ab530380461f36efd723f9a7bda89343b9/analysis/
___
Fake 'Attached File' SPAM - JS malware leads to Locky Ransomware
- http://myonlinesecurity.co.uk/attached-file-doc-document-pretending-to-come-from-scanner-printer-at-your-own-domain-js-malware-leads-to-dridex/
10 Mar 2016 - "An email with the subject of 'Attached File / Attached Doc / Attached Document' pretending to come from a scanner or printer at your own domain with a zip attachment is another one from the current bot runs which downloads what looks like Dridex banking Trojan - EDIT: it is LOCKY ransomware not Dridex... The attachment name is created from the recipients email address and 2 sets of random numbers. So far I have seen these sent from:
epson@ victimdomain .tld
canon@ victimdomain .tld
xerox@ victimdomain .tld
copier@ victimdomain .tld
scanner @victimdomain .tld
The email looks like:
From: epson@ victim domain .tld
Date: Thu 10/03/2016 07:11
Subject: Attached File / Attached Doc / Attached Document
Attachment: xerox.994@ thespykiller .co.uk_385010_151064713.zip
Body content: totally -empty- blank body
10 March 2016: xerox.994@thespykiller.co.uk_385010_151064713.zip: Extracts to: IIE1525816908.js
Current Virus total detections 5/57*
.. MALWR** shows a download of what looks like Dridex banking Trojan from http ://buyfuntees .com/system/logs/7t6f65g.exe (VirusTotal 5/56***) Update: it is Locky ransomware not Dridex. Dynamo’s blog[4] has these additional download locations:
behrozan .ir/system/logs/7t6f65g.exe
fashion-boutique .com.ua/system/logs/7t6f65g.exe
fortyseven .com.ar/system/logs/7t6f65g.exe (VirusTotal 1/56[5])
iwear .md/system/logs/7t6f65g.exe
lady-idol.6te .net/system/logs/7t6f65g.exe
ncrweb .in/system/logs/7t6f65g.exe
xn--b1afonddk2l .xn--p1ai/system/logs/7t6f65g.exe ..."
* https://www.virustotal.com/en/file/517badfe98cc0a9731a4db90ab82f2462d7fd5ee2bd40c39e65779e201265f24/analysis/1457597941/
** https://malwr.com/analysis/OWE0MTIyMGMwOGYwNDgyZjljMWY3MGFkMzA2MzIwMzk/
Hosts
67.225.233.214
91.219.30.254
*** https://www.virustotal.com/en/file/848dc045746167f58cbed9fd9e7b95d82e8ee1f9c0ff31cba34f19af25a5b4d9/analysis/1457598134/
TCP connections
91.234.33.149: https://www.virustotal.com/en/ip-address/91.234.33.149/information/
4] http://blog.dynamoo.com/2016/03/malware-spam-attached-file.html
10 Mar 2016 - "This spam has a malicious attachment. It appears to come from within the sender's own-domain. There is no-body-text.
From: canon@ victimdomain .tld
Date: 10 March 2016 at 09:02
Subject: Attached File
... Sender is canon or copier or epson or scanner or xerox at the victim's domain.
Recommended blocklist:
31.184.196.78
78.40.108.39
91.219.30.254
91.234.33.149 "
5] https://www.virustotal.com/en/file/647389f47e2ed7bea0de9589ab01779a6272ded4793968bee3133bdc2f9c19b0/analysis/1457604744/
TCP connections
31.184.196.78: https://www.virustotal.com/en/ip-address/31.184.196.78/information/
___
Fake 'Unpaid Issue' SPAM - JS malware leads to Teslacrypt
- http://myonlinesecurity.co.uk/greenland-consulting-unpaid-issue-no-14599-js-malware-leads-to-teslacrypt/
10 Mar 2016 - "An email with the subject of 'GreenLand Consulting Unpaid Issue No. 14599' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads teslacrypt... The email looks like:
From: Goldie dawson <dawsonGoldie888@ lamelba .fr>
Date: Thu 10/03/2016 13:28
Subject: GreenLand Consulting Unpaid Issue No. 14599
Attachment: Invoice_ref-99527554.zip
Dear Client!
For the third time we are reminding you about your unpaid debt.
You used to ask for our advisory services in July 2015, the receipt issued to you was recognized in our database with No. 14599. But it has never been paid off.
We enclose the detailed bill for your recollection and sincerely hope that you will act nobly and responsibly.
Otherwise we will have to start a legal action against you.
Respectfully,
Goldie dawson
Chief Accountant ...
10 March 2016: Invoice_ref-99527554.zip: Extracts to: invoice_copy_AczFAX.js - Current Virus total detections 3/57*
.. MALWR** shows a download of Teslacrypt from http ://hellomississmithqq .com/69.exe?1 (VirusTotal ***)
.. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3deee72a9f440ed317724a4df3e09bbf06a82128e13686c5f6db1f3807cfe2db/analysis/1457616298/
** https://malwr.com/analysis/ZDAyODliNDJkYmJlNGNlNGEzZGI1YzMxYjM5ZGU5YjQ/
Hosts
185.118.142.154
149.154.157.14
91.195.12.131
151.236.14.51
37.235.53.18
78.40.108.39
*** https://www.virustotal.com/en/file/1d64db20e038ba848f2720138122bf08e98cd647da33d2d448ae2586596c9ef6/analysis/1457617418/
- http://blog.dynamoo.com/2016/03/malware-spam-greenland-consulting.html
10 Mar 2016 - "This -fake- financial spam comes with a malicious attachment:
From: Jennie bowles
Date: 10 March 2016 at 12:27
Subject: GreenLand Consulting – Unpaid Issue No. 58833
Dear Client!
For the third time we are reminding you about your unpaid debt.
You used to ask for our advisory services in July 2015, the receipt issued to you was recognized in our database with No. 58833. But it has never been paid off.
We enclose the detailed bill for your recollection and sincerely hope that you will act nobly and responsibly.
Otherwise we will have to start a legal action against you.
Respectfully,
Jennie bowles
Chief Accountant ...
... scripts attempt to download a malicious binary... Recommended blocklist:
142.25.97.48
185.118.142.154
78.135.108.94
74.117.183.252
91.243.75.135
91.195.12.131
149.154.157.14
151.236.14.51
37.235.53.18
78.40.108.39
178.162.214.146 "
:fear::fear::mad:
AplusWebMaster
2016-03-11, 14:28
FYI...
Fake 'Amazon order' SPAM - JS malware leads to Locky Ransomware
- http://myonlinesecurity.co.uk/your-amazon-order-204-217966-773659-js-malware-leads-to-locky-ransomware/
11 Mar 2016 - "An email with the subject of 'Your Amazon order #204-217966-773659' [random numbered] pretending to come from AMAZON.COM <no-reply@ Amazon .com> with a zip attachment is another one from the current bot runs which downloads Locky ransomware...
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Your-Amazon-order-204-217966-773659-1024x656.png
11 March 2016: ORD204-217966-773659.zip: Extracts to: ZGQ8748487803.js - Current Virus total detections 6/57*
.. MALWR** shows a download of Locky ransomware from http ://onsancompany .com/system/logs/uy78hn654e.exe
(VirusTotal 5/57***). Other download locations so far discovered for Locky today include:
solucionesdubai .com.ve/system/logs/uy78hn654e.exe
ghayatv .com/system/logs/uy78hn654e.exe
dolcevita-ykt .ru/system/logs/uy78hn654e.exe
mercadohiper .com.br/system/logs/uy78hn654e.exe
chinhuanoithat .com/system/logs/uy78hn654e.exe
http ://nhinh .com/system/logs/uy78hn654e.exe
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d3c967a9196a3f4c13ce5375980f9494ed4d8e7c85d3be4e0209e978bf0e2117/analysis/1457692698/
** https://malwr.com/analysis/MGZhZjA4YjRkMWEzNDdhMThmZjExMzU3OWVlZTZjNDg/
Hosts
103.18.4.151
31.184.196.78
91.219.30.254
*** https://www.virustotal.com/en/file/9b4b37cbb9845b093867675fb898330a8bd7ed087d587cba8cd21064c9a6e526/analysis/1457691942/
TCP connections
31.184.196.75: https://www.virustotal.com/en/ip-address/31.184.196.75/information/
- http://blog.dynamoo.com/2016/03/malware-spam-your-amazon-order-137.html
11 Mar 2016 - "This fake Amazon spam comes with a malicious attachment:
From: AMAZON.COM [Mailer-daemon@ amazon .com]
Date: 11 March 2016 at 09:09
Subject: Your Amazon order #137-89653734-2688148
Hello,
Thank you for your order. We'll let you know once your item(s) have dispatched.You can check the status of your order or make changes to it by visiting Your Orders on Amazon.com.
Order Details
Order #137-89653734-2688148 Placed on March 11, 2016
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon.
Amazon .com
Reference numbers vary from email to email. Attached is a file with a name similar to ORD137-89653734-2688148.zip which contains a malicious script... Recommended blocklist:
31.184.196.75
91.219.30.254
78.40.108.39
31.184.196.78
91.234.32.192 "
___
Fake 'Scanned image' SPAM - leads to malware
- http://blog.dynamoo.com/2016/03/malware-spam-scanned-image-image-data.html
11 Mar 2016 - "This -fake- document scan leads to malware. It appears to come from within the victim's own domain, but this is a trivial forgery.
From: admin [lands375@ victimdomain .tld]
Date: 11 March 2016 at 09:02
Subject: Scanned image
Image data in PDF format has been attached to this email.
Attached is a document named in a similar format to 11-03-2016-6440705503.zip which contains a randomly-named malicious script. So far I have seen -three- versions of this script (VirusTotal results [1] [2] [3]) which according to the Malwr reports [4].. download a malicious binary from:
ghayatv .com/system/logs/uy78hn654e.exe
This is Locky ransomware, the -same- as dropped in this other spam run* - that post also contains a list of C2s to block."
* http://blog.dynamoo.com/2016/03/malware-spam-your-amazon-order-137.html
1] https://www.virustotal.com/en/file/cdbb3cd559059b4bd037391bd2517037bf92e9d7d4d76db6c6c0e135bcdb7f20/analysis/1457690743/
2] https://www.virustotal.com/en/file/14e916995f49da6571d65b676f9fd306b32b79c78201c41a9399b8566af5c931/analysis/
3] https://www.virustotal.com/en/file/2131fc21a3b275f63d6afcc22618cf8a1ba8a98f445e5427c3a657e6f2fa9651/analysis/1457691017/
4] https://malwr.com/analysis/YWVkNzRlZDRjZWRlNDJjNjk3MDM0ZWM3ZjcyYWUzM2E/
___
Fake 'Payment' SPAM - leads to Locky ransomware
- http://myonlinesecurity.co.uk/fw-payment-16-03-280729-we-have-received-this-documents-from-your-bank-please-review-attached-documents-js-malware-leads-to-locky-ransomware/
11 Mar 2016 - "An email with the subject of 'Pay for driving on toll road, invoice #00212297' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware.. The email looks like:
From: Inez Harding <HardingInez04459@ jazztel .es>
Date: Fri 11/03/2016 08:15
Subject: FW: Payment 16-03-#280729
Attachment: payment_doc_280729.zip
Dear voicemail,
We have received this documents from your bank, please review attached documents.
Yours sincerely,
Inez Harding
Account Manager
5 March 2016: payment_doc_280729.zip: Extracts to 2 files:
Post_Tracking_Label_id00-371904814#.js [VT*] [VT**]. MALWR [1] [2] shows -both- download Locky Ransomware from http ://50.28.211.199 /hdd0/89o8i76u5y4 (VirusTotal 5/56***). I am informed[3] that there are several other download locations, all of which appear to be offering a slightly -different- Locky ransomware download... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e9cc4b71f8c075c9d9ec2a9eb9a418956cc4fd688f4e01cb9c4a75116c3c1d30/analysis/1457687806/
** https://www.virustotal.com/en/file/81f228f22240177369a6c542bf165948235af224335269544feafcc960531032/analysis/1457687807/
1] https://malwr.com/analysis/YjkxNjNkNDNmM2E3NDNlZjk0MzZiMjcxZGYwZTM0YjE/
Hosts
50.28.211.199
31.184.196.78
91.234.32.192
2] https://malwr.com/analysis/MjgzYjZlZjEyZDg0NDc5OWJjZDM3MzQ4NTljYmRkZjE/
Hosts
50.28.211.199
91.234.33.149
31.184.196.78
31.184.196.75
*** https://www.virustotal.com/en/file/891c9e5f09c94e1dd4ca1eed54c828a9c0f84c9ccfdede6856fa507d684a1293/analysis/1457689671/
TCP connections
91.219.30.254: https://www.virustotal.com/en/ip-address/91.219.30.254/information/
3] http://blog.dynamoo.com/2016/03/malware-spam-fw-payment-16-03-507586-we.html
11 Mar 2016 - "These spam messages come from various senders with different references and attachment names.
From: Thanh Sears
Date: 11 March 2016 at 10:29
Subject: FW: Payment 16-03-#507586
Dear [redacted],
We have received this documents from your bank, please review attached documents.
Yours sincerely,
Thanh Sears
Financial Manager
Attached is a ZIP file named in the format payment_doc_507586.zip, containing a randomly named script... The dropped binaries are actually different [1] [2] and both look like Locky ransomware. The C2s to -block- are the same as found in this earlier Locky run*..."
1] https://www.virustotal.com/en/file/16c31b7a89edba26fa5b4fb2f97ea34bf8346d82a9cae4f09bac4b7877bb7836/analysis/1457693183/
2] https://www.virustotal.com/en/file/0f7294f2aa1d5faa054c51e4d6405b5f4ffdbbd1c5f97db5c47c556ec2236585/analysis/1457693194/
* http://blog.dynamoo.com/2016/03/malware-spam-your-amazon-order-137.html
___
Massive Volume of Ransomware Downloaders being Spammed
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Massive-Volume-of-Ransomware-Downloaders-being-Spammed/
March 9, 2016 - "We are currently seeing extraordinarily huge volumes of JavaScript attachments being spammed out, which, if clicked on by users, lead to the download of a ransomware. Ransomware encrypts data on a hard drive, and then demands payment from the victim for the key to decrypt the data. Our Spam Research Database saw around 4 million malware spams in the last -seven- days, and the malware category as a whole accounted for 18% of total spam arriving at our spam traps... your last line of defense against ransomware infection is always having an up to date and good backup process."
:fear::fear: :mad:
AplusWebMaster
2016-03-12, 16:13
FYI...
Fake 'Urgent Notice' SPAM - JS malware leads to Teslacrypt
- http://myonlinesecurity.co.uk/urgent-notice-96954696-js-malware-leads-to-teslacrypt-ransomware/
Last revised 12 March 2016 - "An email with the subject of 'Urgent Notice # 96954696' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads teslacrypt or locky ransomware...
Update 12 March 2016: Unusual for a Saturday.. they are going after the domestic/consumer market instead of office/Enterprise/companies. Another big malspam run of this email today with malicious js attachments (VirusTotal 12/57*). (MALWR**) with a connection to and download of http ://joecockerhereqq .com/80.exe?1 (VirusTotal 5/57***). This definitely looks like Teslacrypt...
WARNING: following the MALWR links will give a browser warning in ALL browsers. Their SSL certificate has -expired- yesterday 11 March 2016. In this case -ONLY- it is safe to ignore the warning and visit the site until they install the updated certificate.. The email looks like:
From: Lacy eaton <eatonLacy97994@ listenary .com>
Date: Fri 11/03/2016 20:42
Subject: Urgent Notice # 96954696
Attachment: statistic_96954696.zip
Dear Customer!
According to our data you owe our company a sum of $877,13. There are records saying that you have ordered goods in a total amount of $ 877,13 in the third quarter of 2015.
Invoice has been paid only partially. The unpaid invoice #96954696 is enclosed below for your revision.
We are writing to you, hoping for understanding and in anticipation of the early repayment of debt.
Please check out the file and do not hesitate to pay off the debt.
Otherwise we will have to start a legal action against you.
Regards,
Lacy eaton ...
11March 2016: statistic_96954696.zip: Extracts to: details_jEpMnR.js - Current Virus total detections [4] .. MALWR[5] shows a download of teslacrypt or locky from http ://joecockerhereqq .com/69.exe?1 or http ://joecockerhereff .com/69.exe?1 (VirusTotal [6]) Payload Security Hybrid analysis [7]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/107e56bd92a22da0229b61ad7f4486f7ff6fa2c7c2cffea41ed12dee17422fe3/analysis/1457728759/
** https://malwr.com/analysis/ZWM4ZTU4NDZhOTY3NGE0ZWEyMmZiZDJhN2U0MTMzYTU/
Hosts
54.212.162.6
203.124.115.1
166.62.4.223
*** https://www.virustotal.com/en/file/adecbb9a2bba9dd646b2e45ece68769d240ae1b71d2240fdce5aebe87763e1d4/analysis/1457772426/
TCP connections
203.124.115.1: https://www.virustotal.com/en/ip-address/203.124.115.1/information/
166.62.4.223: https://www.virustotal.com/en/ip-address/166.62.4.223/information/
4] https://www.virustotal.com/en/file/b79f0e6db4e772070013a234942ebfaf79d71073e179c769baf324709719f062/analysis/1457728932/
5] https://malwr.com/analysis/ZjFmNTYyYmYxZjZiNDkzZjk3ZjFiNmM0NGNmZWZlNWE/
Hosts
212.119.87.77
204.44.102.164
6] https://www.virustotal.com/en/file/bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a/analysis/1457731360/
TCP connections
91.219.30.254: https://www.virustotal.com/en/ip-address/91.219.30.254/information/
7] https://www.hybrid-analysis.com/sample/bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a?environmentId=1
91.234.32.192: https://www.virustotal.com/en/ip-address/91.234.32.192/information/
>> https://www.virustotal.com/en/url/7332aac2b6e4f581defda7a58a2df24f5e032c1d8a6e242f9448f0e6c34fd9c6/analysis/
- http://blog.dynamoo.com/2016/03/malware-spam-urgent-notice-78815053.html
12 Mar 2016 - "This spam comes from random senders, and has random references, dollar amounts and attachment names:
From: Donnie emily
Date: 12 March 2016 at 14:01
Subject: Urgent Notice # 78815053
Dear Customer!
According to our data you owe our company a sum of $452,49. There are records saying that you have ordered goods in a total amount of $ 452,49 in the third quarter of 2015.
Invoice has been paid only partially. The unpaid invoice #78815053 is enclosed below for your revision.
We are writing to you, hoping for understanding and in anticipation of the early repayment of debt.
Please check out the file and do not hesitate to pay off the debt.
Otherwise we will have to start a legal action against you.
Regards,
Donnie emily ...
Attached is a randomly-named ZIP files, in the sample I have seen... plus a random string of characters. I have seen -six- versions of this script... This is Teslacrypt ransomware, although it is possible that some variants of this message may drop Locky. Both these binaries are slightly different... malicious domains are also on the same servers... there are a vast number of malicious IPs and servers in this cluster...
Recommended blocklist:
192.210.144.130
54.212.162.6
212.119.87.77
78.135.108.94
31.184.196.78
91.234.32.192
multibrandphone .com
sappmtraining .com
shirongfeng .cn
vtechshop .net "
___
Malvertising Magnitude ...
- https://labsblog.f-secure.com/2016/03/07/ad-serving-platform-used-by-pua-also-delivers-magnitude-exploit-kit/
Mar 7, 2016 - "... we noticed yet another malvertising campaign... pushing users towards Magnitude exploit kit:
> https://newsfromthelab.files.wordpress.com/2016/03/magnitude_graph_20160304.png?w=752&h=367
... we found with one of the ad platforms, click2.danarimedia .com, is that, it is also being used by some distribution of Conduit Toolbars, which is considered 'potentially unwanted' as they usually come bundled with free software and -forces- changes to browser settings... The -redirection- from our upstream from the -same- ad platform to Magnitude EK... we should not underestimate the power of Potentially Unwanted Applications (PUA). Because even if a program started as potentially unwanted, it doesn’t mean that attackers could not take advantage of it in delivering other threats to the user’s machine. It is very possible that users could get redirected to exploits kits and eventually end up with a malware infection, which is for this particular exploit kit, is a CryptoWall ransomware:
> https://newsfromthelab.files.wordpress.com/2016/03/cryptowall.png?w=799&h=600 "
... -ongoing- today.
click2.danarimedia .com: 199.212.255.138: https://www.virustotal.com/en/ip-address/199.212.255.138/information/
199.212.255.137
199.212.255.136
199.212.255.140
199.212.255.139
:fear::fear: :mad:
AplusWebMaster
2016-03-14, 13:30
FYI...
Fake 'Blocked Transaction' SPAM - leads to Teslacrypt
- http://blog.dynamoo.com/2016/03/malware-spam-blocked-transaction-case.html
14 Mar 2016 - "This -fake- financial transaction has a malicious attachment:
From: Judy brittain
Date: 14 March 2016 at 08:12
Subject: Blocked Transaction. Case No 19706002
The Automated Clearing House transaction (ID: 19706002), recently initiated from your online banking account, was rejected by the other financial institution.
Canceled ACH transaction
ACH file Case ID: 09293
Transaction Amount: 607,89 USD
Sender e-mail: brittainJudy056@ panick .com.ar
Reason of Termination: See attached statement
The sender's name, references and dollar amounts vary from message to messages. The attachment names are randomly-generated (the format seems the same as this*) containing either one-or-four malicious scripts. According to this analysis** the scripts download from:
ohelloguyzzqq .com/85.exe?1
Although the infection mechanism seems the same as this spam run*, the MD5 of the dropped executable is now 57759F7901EBA73040597D4BA57D511A with a detection rate of 2/55***. This is Teslacrypt ransomware, and I recommend that you block traffic to the IP addresses listed here*."
* http://blog.dynamoo.com/2016/03/malware-spam-debt-85533-customer-case.html
** https://www.hybrid-analysis.com/sample/5a784509c0825d35bc98c8a99a3f9f76833a7fe7ccb9e52176d602dc5691b656?environmentId=1
*** https://www.virustotal.com/en/file/284eccc63a9ada094dd4ccddb77f6045b81d3e2ba1a4dd6fea9bb7e349e3f5a1/analysis/1457945732/
___
Fake 'Credit details' SPAM - leads to Teslacrypt
- http://blog.dynamoo.com/2016/03/malware-spam-credit-details-id-87320357.html
14 Mar 2016 - "So many -Teslacrypt- campaigns, so little time...
From: Ladonna feather
Date: 14 March 2016 at 14:50
Subject: Credit details ID: 87320357
Your credit card has been billed for $785,97. For the details about this transaction, please see the ID: 87320357-87320357 transaction report attached.
NOTE: This is the automatically generated message. Please, do not reply.
... names, references and attachment names vary.. malicious scripts in the attachment...
This is Teslacrypt ransomware...
Recommended blocklist:
54.212.162.6: https://www.virustotal.com/en/ip-address/54.212.162.6/information/
212.119.87.77: https://www.virustotal.com/en/ip-address/212.119.87.77/information/
78.135.108.94: https://www.virustotal.com/en/ip-address/78.135.108.94/information/
washitallawayff .com: 31.128.86.113
176.8.242.205
94.143.247.194
174.118.252.36
46.185.13.41
92.52.181.125
93.123.236.46
213.111.147.60
37.1.3.115
77.122.205.79
___
Fake 'IMG from Admin' SPAM - JS malware leads to locky or Dridex
- https://myonlinesecurity.co.uk/emailing-img_18977-pretending-to-come-from-admin-at-your-own-email-domain-js-malware-leads-to-locky-or-dridex/
14 Mar 2016 - "An email with the subject of 'Emailing: IMG_18977' [random numbered] pretending to come from admin-at-your-own-email-domain with a zip attachment is another one from the current bot runs which downloads what looks like either Locky ransomware or Dridex banking Trojan... The email looks like:
From: admin admin@ victim domain .tld
Date: Mon 14/03/2016 12:14
Subject: Emailing: IMG_18977
Attachment: IMG_18977.zip
Your message is ready to be sent with the following file or link attachments:
IMG_18977
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.
Please consider the environment before printing this email.
E-mail messages may contain viruses, worms, or other malicious code. By reading the message and opening any attachments, the recipient accepts full responsibility for taking protective action against such code. Henry Schein is not liable for any loss or damage arising from this message...
14 March 2016: IMG_18977.zip: Extracts to: ICG8994683408.js - Current Virus total detections 4/56*
... unable to get any analysis from automatic analysers, both MALWR and Hybrid analysis are down at the moment... Manual analysis of the javascript file shows it connects to
http ://lampusorotmurah .com/system/logs/78tgh76.exe (VirusTotal 3/57**) which is inclusive but is likely to be either Dridex banking Trojan or Locky ransomware... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a5b4c2a6e28480804cc80dad72f73fe4cdeb13e28f9fef0a3abf84748386194b/analysis/1457961662/
** https://www.virustotal.com/en/file/2c379a21876e829c1eeed773990eabe617d8a605b67a03b953e87dfd2c116852/analysis/1457962014/
lampusorotmurah .com: 72.34.33.170: https://www.virustotal.com/en/ip-address/72.34.33.170/information/
>> https://www.virustotal.com/en/url/9a7d8e42f0188363e83fae97a8505e90cf6ad9f964d34969138dca50348d52f8/analysis/
___
Fake 'blank email' SPAM - JS malware downloads kovter boaxxe and ransomware
- https://myonlinesecurity.co.uk/blank-email-from-supporthvp-online-com-js-malware-downloads-kovter-boaxxe-and-ransomware/
14 Mar 2016 - "An email addressed to 'abuse' at your-email-domain with -no- subject coming from Support <support@ hvp-online .com> with a zip attachment is another one from the current bot runs... The email looks like:
From: Support <support@ hvp-online .com>
Date: Mon 14/03/2016 08:51
Subject: blank
Attachment: 0000783426.zip
Body content: Totally empty
14 March 2016: 0000783426.zip: Extracts to: 0000783426.doc.js - Current Virus total detections 13/57*
.. ReverseIt** and Wepawet*** shows a download of -3- files from a combination of these locations which will be Boaxxe, Kovter and some sort of ransomware:
nueva.alite .eu
arbasal .com
app.ulled .com
norbert.thecua.perso .sfr.fr
diarga.fall.perso.neuf .fr
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/cfe18a654bf79771b1c0ea9d8be06d712ab70e7db9f7aea5a2776fed5f35ef31/analysis/1457947548/
** https://www.reverse.it/sample/cfe18a654bf79771b1c0ea9d8be06d712ab70e7db9f7aea5a2776fed5f35ef31?environmentId=4
Host Address
91.142.215.21
87.106.240.27
217.111.217.243
86.65.123.70
173.201.146.128
*** https://wepawet.iseclab.org/view.php?hash=232cf82b5aa52ac7b003ea52918e9511&type=js
___
Fake 'Traffic Violation' SPAM - leads to Teslacrypt
- http://blog.dynamoo.com/2016/03/malware-spam-traffic-report-id-62699928.html
14 Mar 2016 - "This -fake- legal email has a malicious attachment:
From: Myrna baker
Date: 14 March 2016 at 15:58
Subject: Traffic report ID: 62699928
Dear Citizen,
We are contacting you on behalf of a local Traffic Violation Bureau.
Our cameras have detected that the driver of the vehicle associated with your personal number on March 10th, 2016 has committed a violation of the rules with a code: 49757
Unfortunately, we will have no other option rather than passing this case to the local police authorities.
Please, see the report with the documents proofs attached for more information on this case.
Details in the email vary from message to message. The payload is Teslacrypt ransomware, as seen in this earlier spam run*."
* http://blog.dynamoo.com/2016/03/malware-spam-credit-details-id-87320357.html
- https://myonlinesecurity.co.uk/traffic-report-id-02271147-js-malware-leads-to-ransomware/
14 March 2016: post_scan_02271147.zip: Extracts to: accent_nUIboL.js - Current Virus total detections 4/56* reverseIT** shows a download of what is probably Teslacrypt from
giveitallhereqq .com/69.exe?1 (VirusTotal 4/56***)
* https://www.virustotal.com/en/file/43469d0595ece605a6efe419749101e3f1b4f2717ea012b859628a64385dc68b/analysis/1457965942/
** https://www.hybrid-analysis.com/sample/43469d0595ece605a6efe419749101e3f1b4f2717ea012b859628a64385dc68b?environmentId=1
Host Address
54.212.162.6: https://www.virustotal.com/en/ip-address/54.212.162.6/information/
>> https://www.virustotal.com/en/url/7485d51c9a55222c297e4cd5cc4efdd23860c5f2ff954186b217ba479f85f869/analysis/
*** https://www.virustotal.com/en/file/bb6bedfbd5843a4301087766cf1a8c3e08ad31dfd4b5043a2b7a098ecef9d635/analysis/1457974614/
TCP connections
198.1.95.93: https://www.virustotal.com/en/ip-address/198.1.95.93/information/
___
Fake 'Debt#' SPAM - JS malware leads to Teslacrypt
- https://myonlinesecurity.co.uk/debt-80574-customer-case-nr-693-js-malware-leads-to-teslacrypt/
13 Mar 2016 - "An email with the subject of 'Debt #80574, Customer Case Nr.: 693' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads what looks like Teslacrypt... The email looks like:
From: Tanya best <bestTanya09673@ bezeqint .net>
Date: Sun 13/03/2016 16:14
Subject: Debt #80574 , Customer Case Nr.: 693
Attachment: money_44821787.zip
Body content:
Dear Customer,
Despite our constant reminders, we would like to note that the mentioned debt #80574 for $500,74 is still overdue for payment.
We would appreciate your cooperation on this case and ask you to make the payment as soon as possible.
Unless the full payment is received by April 1st, 2016 this case will be transferred to the debt collection agency, will seriously damage your credit rating.
Please, find the attachment enclosed to the letter below.
We hope on your understanding.
Kind regards,
Finance Department
Tanya best ...
13 March 2016: money_44821787.zip: Extracts to: -4- different named but identical js files by #
Current Virus total detections 1/57*. SecureIT** shows a download of what appears to be Teslacrypt from
ohelloguyqq .com/70.exe (VirusTotal 4/57***)
JS files from zip I got were Post_Parcel_Label_id00-611695718#.js
Post_Shipment_Label_id00-436290447#.js
Post_Tracking_Label_id00-503290854#.js
Post_Tracking_Label_id00-993809340#.js
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/9caaf855821894dec91c8dfccad2d7e1905c3e855ef487b4cad35d682cd23499/analysis/1457889197/
** https://www.reverse.it/sample/9caaf855821894dec91c8dfccad2d7e1905c3e855ef487b4cad35d682cd23499?environmentId=4
78.135.108.94: https://www.virustotal.com/en/ip-address/78.135.108.94/information/
*** https://www.virustotal.com/en/file/1eaf55b3e26cd3f48ce9228789162486a674a9c8f53d640d61db7bc6bce39e20/analysis/1457890122/
- http://blog.dynamoo.com/2016/03/malware-spam-debt-85533-customer-case.html
13 Mar 2016 - "The details in these spam messages vary, with different reference numbers, sender names and dollar amounts. They all have malicious attachments...
From: Lamar drury
Date: 13 March 2016 at 18:43
Subject: Debt #85533 , Customer Case Nr.: 878
Dear Customer,
Despite our constant reminders, we would like to note that the mentioned debt #85533 for $826,87 is still overdue for payment.
We would appreciate your cooperation on this case and ask you to make the payment as soon as possible.
Unless the full payment is received by April 1st, 2016 this case will be transferred to the debt collection agency, will seriously damage your credit rating.
Please, find the attachment enclosed to the letter below.
We hope on your understanding.
Kind regards,
Finance Department
Lamar drury ...
Attached is a ZIP file... plus a random number. Inside are one-to-four malicious .js scripts... There are at least -22- unique scripts... These appear [1] [2] to download a malicious binary from one of the following locations:
ohelloguyff .com/70.exe
ohelloguyzzqq .com/85.exe?1
Of these, only the 85.exe download is working for me at the moment which is Teslacrypt ransomware. This has a detection rate of just 1/56*... Recommended blocklist:
185.35.108.109
204.44.102.164
54.212.162.6
192.210.144.130
212.119.87.77
78.135.108.94 "
1] https://www.hybrid-analysis.com/sample/2b02397adb87a4032dec2368caf2b281dd9fc92960b27432ee22b655fcd86408?environmentId=4
2] https://www.hybrid-analysis.com/sample/d4d7733fa92e2e7f1668d6d089805987567d6ddd38afef18afc9e759d52105d9?environmentId=1
* https://www.virustotal.com/en/file/3fd55641b506c24d8f584be7491d069c64e8cbacc23dae989803573e22788938/analysis/1457899296/
___
Apple Store Support Ticket #35652467 – Apple PHISH
- https://myonlinesecurity.co.uk/apple-store-support-ticket-35652467-apple-phish-fail/
14 Mar 2016 - "An email pretending to come from 'App Store Billing #7221' <apple.id3627@ applemarketingpro .com> is one of the latest -phish- attempts to -steal- your Apple and bank/credit card details...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Apple_store_refund_email-1024x625.png
The link in the email -if- you did copy & paste the link into a browser window -redirects- to another dyndns link where you would see a webpage looking like this where they want a lot of details and have gone to a lot of effort to validate the forms and stop obvious fake information being put in:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Apple_store_refund-1024x557.png
The links behind the 'unsubscribe' and 'Click-here-to-view-our-privacy-policy' lead you to the Romanian Security Team forum. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
applemarketingpro .com: 174.35.126.195: https://www.virustotal.com/en/ip-address/174.35.126.195/information/
:fear::fear: :mad:
AplusWebMaster
2016-03-15, 13:12
FYI...
Malvertising Campaign... Leads to Angler Exploit Kit/BEDEP
- http://blog.trendmicro.com/trendlabs-security-intelligence/malvertising-campaign-in-us-leads-to-angler-exploit-kitbedep/
Updated Mar 15, 2016 - "A malvertising campaign related to the Angler Exploit Kit is currently targeting users in the United States and may have affected tens of thousands of users in the last 24 hours alone. Based on our monitoring, the malicious ads were delivered by a compromised-ad-network in various highly-visited mainstream websites–including news, entertainment, and political commentary sites. As of this writing, while the more popular portals appear to be no longer carrying the bad ad, the malvertising campaign is still ongoing and thus continues to put users at risk of downloading malware into their systems... Users and organizations are advised to make sure that keep their applications and systems up-to-date with the latest security patches; Angler Exploit Kit is known to exploit vulnerabilities in Adobe Flash and Microsoft Silverlight, among others..."
(More detail at the trendmicro URL above.)
- https://blog.malwarebytes.org/malvertising-2/2016/03/large-angler-malvertising-campaign-hits-top-publishers/
Mar 15, 2016 - "... on the weekend we witnessed a huge spike in malicious activity emanating out of two suspicious domains. Not only were there a lot of events, but they also included some very high profile publishers, which is something we haven’t seen in a while:
Publisher Traffic (monthly)[1]
msn .com 1.3B
nytimes .com 313.1M
bbc .com 290.6M
aol .com 218.6M
my.xfinity .com 102.8M
nfl .com 60.7M
realtor .com 51.1M
theweathernetwork .com 43M
thehill .com 31.4M
newsweek .com 9.9M
1] Numbers pulled from SimilarWeb .com
... Rogue domains:
Domain Name: TRACKMYTRAFFIC .BIZ: 104.28.18.116: https://www.virustotal.com/en/ip-address/104.28.18.116/information/
104.28.19.116: https://www.virustotal.com/en/ip-address/104.28.19.116/information/
>> https://www.virustotal.com/en/url/7d404618cc8df96ea4dd21de751f7bd78970ee7b0b7c4a86239fc7e746035230/analysis/
Domain Name: TALK915 .PW: 104.27.191.84: https://www.virustotal.com/en/ip-address/104.27.191.84/information/
104.27.190.84: https://www.virustotal.com/en/ip-address/104.27.190.84/information/
>> https://www.virustotal.com/en/url/467e7ecc0128ef6478b86a34a5cd01c4aacfd200b1370a9545960f8f20030128/analysis/
... On Sunday, when the attack really expanded, the Angler exploit kit was then used... Angler EK has gone through several changes lately, in its URI patterns but also in the landing page itself. It is also the only one to use a recently patched Silverlight vulnerability*... the actual malware payload in each of these attacks, chances are quite high that it would be one of the several strains of ransomware currently out there..."
* http://malware.dontneedcoffee.com/2016/02/cve-2016-0034.html
(More detail at the malwarebytes URL above.)
___
Fake 'Insufficient Funds' SPAM - JS malware leads to Teslacrypt
- https://myonlinesecurity.co.uk/insufficient-funds-transaction-id12719734-js-malware-leads-to-teslacrypt/
15 Mar 2016 -"... an email with the subject of 'Insufficient Funds Transaction ID:12719734' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Teslacrypt... The email looks like:
From: Random names & email addresses
Date: Tue 15/03/2016 06:29
Subject: Insufficient Funds Transaction ID:12719734
Attachment: money_12719734.zip
Dear Valued Customer,
Your transaction 12719734 dated on 13/03/2016 4:24 PM was declined due to insufficient funds on your account.
For more details please refer to the report enclosed.
Thank you!
15 March 2016: money_12719734.zip: Extracts to: details_sESWjv.js
| access_21202865.zip: Extracts to: details_AdbdeE.js - Current Virus total detections [1] [2]:
.. MALWR [3] [4] shows a download of what looks like Teslacrypt from
http ://giveitalltheresqq .com/80.exe?1 or http ://giveitalltheresqq .com/69.exe?1 VirusTotal [5] ...
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://www.virustotal.com/en/file/98d6ae63b0869b25ee052756e293991f19c940410fa734494f962dfe60060ec4/analysis/1458027607/
2] https://www.virustotal.com/en/file/98d6ae63b0869b25ee052756e293991f19c940410fa734494f962dfe60060ec4/analysis/1458027607/
3] https://malwr.com/analysis/NGRlNTQzZjFmZTU0NDVkMzhkZjNiZWMzNGEyNDA0YTQ/
Hosts
54.175.175.52: https://www.virustotal.com/en/ip-address/54.175.175.52/information/
>> https://www.virustotal.com/en/url/ba9543e4b3188aec845d76e987db44b1373bda31bf0774691d7a3367d07b9ca7/analysis/
>> https://www.virustotal.com/en/url/52f6f8a25e720a6b0cdd8bfb2de481d91d35d795a821bd8a7f615a8450513f7e/analysis/
107.180.50.183: https://www.virustotal.com/en/ip-address/107.180.50.183/information/
4] https://www.virustotal.com/en/file/e6996ecfa47bd3ff69225675dc903bdb419bc83557a15dd3937dabb58b915fda/analysis/1458027237/
5] https://www.virustotal.com/en/file/e6996ecfa47bd3ff69225675dc903bdb419bc83557a15dd3937dabb58b915fda/analysis/1458027237/
___
Fake 'my photo' SPAM - fake jpg malware
- https://myonlinesecurity.co.uk/photomy-photoimagepic-sent-from-my-iphone-fake-jpg-malware/
15 Mar 2016 - "... An email with the subject of 'photo,my photo,image,pic' pretending to come from lyle.house@ hotmail .co.uk (probably random addresses) with a zip attachment is another one from the current bot runs... The email looks like:
From: lyle.house@ hotmail .co.uk
Date: Tue 15/03/2016 10:52
Subject: photo,my photo,image,pic
Attachment: IMG_0024415_02-2016 JPG.zip
photo Sent from my iPhone
The link behind photo goes to https ://www.dropbox .com/s/5eaj5qwy9yz3xmo/IMG_0024415_02-2016%20JPG.zip?dl=0 where a zip file is downloaded. I am unable to find an abuse report for dropbox to alert them...
15 March 2016: IMG_0024415_02-2016 JPG.zip: Extracts to: IMG_0024415_02-2016 JPG,jpeg.exe
Current Virus total detections 4/57* MALWR** - The detections are inconclusive...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper jpg ( image) file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4030b3b7393c61f25ebf225dc619f6bd4000f94d62a0c42c7b83e7460e0ed010/analysis/1458039815/
TCP connections
87.117.242.31: https://www.virustotal.com/en/ip-address/87.117.242.31/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
** https://malwr.com/analysis/NTkyMzc3YTQzNGJiNGIwZWIzNmI5NTY5NTU0NTdiYmI/
Hosts
87.117.242.31
13.107.4.50
___
Fake 'Document Enclosed' SPAM - fake PDF malware
- https://myonlinesecurity.co.uk/document-enclosed-fake-pdf-malware/
15 Mar 2016 - "... An email with the subject of 'Document Enclosed' pretending to come from Ka2521@ hotmail .co.uk with a zip attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/document_-enclosed-1024x426.png
15 March 2016: INV.P10119.03.2016.XML.zip: Extracts to: INV.P10119.03.2016.XML.PDF,.exe
Current Virus total detections 4/57* which is the -same- malware as described in this other Malspam run**.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4030b3b7393c61f25ebf225dc619f6bd4000f94d62a0c42c7b83e7460e0ed010/analysis/1458039815/
TCP connections
87.117.242.31
13.107.4.50
** https://myonlinesecurity.co.uk/photomy-photoimagepic-sent-from-my-iphone-fake-jpg-malware/
___
Fake 'Itinerary' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/itinerary-13b0b450e-no-replyclicktravel-com-js-malware-leads-to-locky-ransomware/
15 Mar 2016 - "An email with the subject of 'Itinerary #13B0B450E' [random numbered] pretending to come from no-reply@ clicktravel .com with a zip attachment is another one from the current bot runs which downloads Locky ransomware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Itinerary-13B0B450E-1024x382.png
15 March 2016: Hotel-Fax-V004X3R8_4983252052512314320.zip: Extracts to: USH3121122904.js
Current Virus total detections 5/57* - MALWR** shows a download of Locky ransomware from
http ://flaxxup .com/87yg756f5.exe (VirusTotal 3/56***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a3fc171477530913d3f2914c37c67f56b20bc06be7609e09b86949b95a50e017/analysis/1458040913/
** https://malwr.com/analysis/YzcxMGYyMzRjNWYyNDE1OTg3MGE1ZDg4Y2I4ODcyMzA/
Hosts
98.131.204.1: https://www.virustotal.com/en/ip-address/98.131.204.1/information/
51.254.181.122: https://www.virustotal.com/en/ip-address/51.254.181.122/information/
*** https://www.virustotal.com/en/file/07bed9baa42996bded75dacf5c2611ba5d3a3f19b8588ea734530f74c2586087/analysis/1458039440/
TCP connections
37.139.27.52: https://www.virustotal.com/en/ip-address/37.139.27.52/information/
149.202.109.205: https://www.virustotal.com/en/ip-address/149.202.109.205/information/
___
Dropbox spreading malware via spoofed emails about orders – fake PDF malware
- https://myonlinesecurity.co.uk/dropbox-spreading-malware-via-spoofed-emails-about-orders-fake-pdf-malware/
16 Mar 2016 - "... from these earlier malspam runs [1] [2] we now have a series of emails with the basic subject of 'orders' pretending to come from different companies with a -link- to Dropbox to download a zip attachment... another one from the current bot runs... The email looks like:
From: admin@ t-mobile .de
Date: Tue 15/03/2016 13:02
Subject: Fwd: INVOICE – Your Order from Sports
Attachment: 9937700846-001.PDF.zip
Order Details
Order Number: 31860 Date Ordered: Tuesday 15 March, 2016 Order In Progress If you have any questions or queries regarding your order please contact us
Some of the subjects and alleged senders seen so far include:
'Fwd: INVOICE – Your Order from Sports' pretending to come from admin@ t-mobile .de
'order 15/03/2016' pretending to come from benelle@ bt .com
'Fwd: INVOICE – Your Order' pretending to come from wdcabs1@ gmail .com
All -three- of these emails have the -same- body content and the -same- link-to-Dropbox to download the malware https ://www.dropbox .com/s/gckssj2hhyrfo2u/9937700846-001.PDF.zip?dl=0
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/dropbox-malware-1024x541.png
There are no abuse links or method of reporting malware, only to report DCMA and copyright infringements, by the tiny flag in bottom left corner...
15 March 2016: 9937700846-001.PDF.zip : Extracts to: 9937700846-001.PDF.exe
.. Current Virus total detections 5/56* which is exactly the -same- malware as described in the earlier malspam runs**... These are spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://myonlinesecurity.co.uk/document-enclosed-fake-pdf-malware/
2] https://myonlinesecurity.co.uk/photomy-photoimagepic-sent-from-my-iphone-fake-jpg-malware/
* https://www.virustotal.com/en/file/4030b3b7393c61f25ebf225dc619f6bd4000f94d62a0c42c7b83e7460e0ed010/analysis/1458046592/
TCP connections
87.117.242.31: https://www.virustotal.com/en/ip-address/87.117.242.31/information/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
** https://myonlinesecurity.co.uk/photomy-photoimagepic-sent-from-my-iphone-fake-jpg-malware/
___
Documents with malicious macros deliver fileless malware to financial-transaction systems
- http://www.csoonline.com/article/3043571/security/documents-with-malicious-macros-deliver-fileless-malware-to-financial-transaction-systems.html
Mar 14, 2016 - "Spammed Word documents with malicious macros have become a popular method of infecting computers over the past few months. Attackers are now taking it one step further by using such documents to deliver fileless malware that gets loaded directly in the computer's memory. Security researchers from Palo Alto Networks analyzed a recent attack campaign that pushed spam emails with malicious Word documents to business email addresses from the U.S., Canada and Europe... 'Due to the target-specific details contained within the spam emails and the use of memory-resident malware, this particular campaign should be treated as a high threat', the Palo Alto researchers said in a blog post*..."
* http://researchcenter.paloaltonetworks.com/2016/03/powersniff-malware-used-in-macro-based-attacks/
Mar 11, 2016 - "... users should ensure that macros are -not- enabled by default and should be wary of opening -any- macros in files received from untrusted sources..."
:fear::fear: :mad:
AplusWebMaster
2016-03-16, 13:38
FYI...
Malvertising Attacks Targeting The UK
- https://blog.malwarebytes.org/malvertising-2/2016/03/a-look-into-malvertising-attacks-targeting-the-uk/
Mar 16, 2016 - "We recently stumbled upon a -malvertising- incident on a large British newspaper site which we decided to investigate in greater details. As with many attacks we have found lately, the line between legitimate advertisers and rogue ones is getting finer and finer. Indeed, in many cases ad networks simply cannot tell them apart without actual proof of malicious activity... Malvertising Flow:
dailymail .co.uk
adclick.g.doubleclick .net
track.bridge .systems (Russian RTB?)
cdn.exeterquads .com (Fake ad server)
geraeuschvollste.ciderstore .co.uk (Angler EK landing)
At first sight, exterquads .com looks like a legitimate business (which it is) located in the UK. However, the subdomain (the ‘cdn‘ preceding the main domain) was registered via criminals who managed to steal the registrant’s credentials in order to create a rogue URL that points to their own server. This is called 'domain shadowing'*.
Legitimate domain:
Hostname: exeterquads .com
IP address: 5.196.39.216
Running on: Microsoft-IIS/8.5
Rogue (shadowed) sub-domain:
Hostname: cdn.exeterquads .com
IP address: 5.63.145.76: https://www.virustotal.com/en/ip-address/5.63.145.76/information/
Running on: nginx/1.0.15
The crooks also -stole- the graphics from this legitimate business to create an ad banner which looks rather convincing but is meant to be a -decoy- for the real motivation behind this attack. Indeed, alongside the banner, an innocuous 1×1 pixel image is served (supposedly for tracking purposes). This is where 'fingerprinting' happens. The -rogue- code hiding in the image can be decoded to reveal a nefarious intent to identify real victims and eliminate those running security tools, the latter being of no interest to the criminals:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/flow.png
The final part of this rogue code is to launch the exploit kit URL, which for all these campaigns has been Angler EK. Because this campaign was aimed at people living in the UK, we searched for additional rogue advertisers abusing other businesses. We found quite a handful of them that have been used in recent attacks... one way to determine whether an advertiser is legit is by checking the domain info and seeing if there are any discrepancies between the main domain and sub-domain. Also, many of those rogue-subdomains use free-SSL-certificates, while the core domain doesn’t... The UK malvertising campaign is of a rather large size, just after the US one. We have also spotted specific campaigns targeting Canadians, Australians and the French with a similar modus operandi. The amount of work spent -forging- legitimate brands and advertising under such disguise is really astonishing. We managed to get in touch with one company whose brand had been abused and they clearly were none the wiser when asked whether they were aware of this ad banner residing on a sub-domain. However, they managed to find out the source of the problem once they talked with their hosting provider... This kind of attack is a reminder of just how many different ways a website can-be-compromised or leveraged to fulfill certain goals. It also shows how difficult it can be for ad networks to -vet- new customers and weed out malicious ones."
* https://www.proofpoint.com/us/threat-insight/post/The-Shadow-Knows
___
Cyber criminals snap up expired domains to serve malicious ads
- http://www.reuters.com/article/us-website-malware-idUSKCN0WI2DZ
Mar 16, 2016 - "Expired domain names are becoming the latest route for cyber criminals to find their way into the computers of unsuspecting users. Cyber criminals launched a malicious advertising campaign this week targeting visitors of popular news and entertainment websites after gaining ownership of an expired web domain of an advertising company. Users visiting the websites of the New York Times, Newsweek, BBC and AOL, among others, may have installed malware on their computers if they clicked on the malicious ads. Bresntsmedia .com, the website used by -hacks- to serve up malware, expired on Jan. 1 and was registered again on March 6 by a different buyer, security researchers at Trustwave SpiderLabs wrote in a blog*. Buying the domain of a small but legitimate ad company provided the criminals with high quality traffic from popular web sites that publish their ads directly, or as affiliates of other ad networks, the researchers said... The researchers also found two more expired "media"-related domains - envangmedia .com and markets.shangjiamedia .com - used by the same cyber criminals. The people behind the campaign may be on keeping a watch for expired domains with the word "media" in them, they said."
* https://www.trustwave.com/Resources/SpiderLabs-Blog/Angler-Takes-Malvertising-to-New-Heights/
envangmedia .com: 136.243.149.196: https://www.virustotal.com/en/ip-address/136.243.149.196/information/
>> https://www.virustotal.com/en/url/5aa98eb2cc2386f429c46f23dbecf2b5d88063f73021e40b308b5c89c87e221a/analysis/
markets.shangjiamedia .com: 136.243.149.201: https://www.virustotal.com/en/ip-address/136.243.149.201/information/
>> https://www.virustotal.com/en/url/be966d2b1f3cd8b6af18c4881f79d203cd6fb8a031936cb514d3af73c375b055/analysis/
___
Fake 'Your order' SPAM - doc malware delivers Dridex
- https://myonlinesecurity.co.uk/your-order-summary-from-365-electrical-order-number-93602-word-doc-macro-malware/
16 Mar 2016 - "An email saying 'Thank you for shopping with 365 Electrical' with the subject of 'Your order summary from 365 Electrical. Order number: 93602' (random numbers) coming from random names and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: random names and email addresses
Date: Wed 16/03/2016 10:29
Subject: Your order summary from 365 Electrical. Order number: 93602
Attachment: Sales Order Document for Emailing_140603632941_1752380.doc
Dear customer,
Thank you for shopping with 365 Electrical. This is to acknowledge that we’ve received your order (see attached document). Please note that acceptance of your order takes place when the goods are loaded onto one of our vehicles for delivery to you.
Your order number is 93602.
Please read the following important information:
Damaged Goods: Must be reported within 48 hours of delivery date with photographic evidence. Do not install any damaged or unwanted items. This counts as acceptance of goods and the item is then non-returnable and non-refundable.
Delivery Timeslots: You must ensure that you can be available all day on your chosen day of delivery; if you find you cannot keep to the delivery date you must notify us before 12 noon one working day before...
Thank you,
365 Electrical
16 March 2016: Sales Order Document for Emailing_140603632941_1752380.doc - Current Virus total detections 1/57*
.. MALWR** shows a download from http ://api.holycrossservices .com/dri/donate.php which gave me
crypted120med.exe (VirusTotal 4/56***). This looks like Dridex banking Trojan.. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f99659087cf8a35a5b20d206347a6e976db297a1db89df30ad47eac4fb93e807/analysis/1458123902/
** https://malwr.com/analysis/NDIwOGNmNzA3YWFlNDZmMzljZWEyODE2ZWQyMGY2YTM/
Hosts
176.103.56.36
188.93.239.28
184.27.46.153
*** https://www.virustotal.com/en/file/7f362fff9badd2e8c2ba41d60c401e14a2ec2070f06c343048bc94c9e803d0e9/analysis/1458124624/
TCP connections
188.93.239.28: https://www.virustotal.com/en/ip-address/188.93.239.28/information/
88.221.14.11: https://www.virustotal.com/en/ip-address/88.221.14.11/information/
___
Fake 'Unpaid Invoice' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/unpaid-invoice-word-doc-macro-malware/
16 Mar 2016 - "An email with the subject of 'Unpaid Invoice' pretending to come from Dave.Maule@ tiscali .co.uk ( probably random) with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Dave.Maule@ tiscali .co.uk
Date: Wed 16/03/2016 11:08
Subject: Unpaid Invoice
Attachment: original invoice feb2016.doc
I noticed that your invoice is overdue by 25 days and wanted to reach out to make sure that you received our original invoice and my reminder email on 02/16.
You can pay us by CC, direct deposit or with a check.
If you have any questions, please let us know and we’d be happy to respond.
Warm Regards,
A Cooper
16 March 2016: original invoice feb2016.doc - Current Virus total detections 23/57*
.. Waiting for analysis. This is highly likely to download either Dridex banking Trojan or Locky ransomware... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5e8e8a974344917d3e2dd7a72a2f13a573f7368f4a69935b4fef1091f9c79fb0/analysis/1458127451/
___
Fake 'Document1' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/document1-pretending-to-come-from-your-own-email-address-js-malware-leads-to-locky-ransomware/
16 Mar 2016 - "A -blank/empty- email with the subject of 'Document1' pretending to come from your own email address and sent to your own email address with a zip attachment is another one from the current bot runs which downloads Locky ransomware... The email looks like:
From: your own email address
Date: Wed 16/03/2016 11:58
Subject: Document1
Attachment: Document1.zip
Body content: totally -blank-
16 March 2016: Document1.zip: Extracts to: CDF6840557603.js - Current Virus total detections 5/57*
.. MALWR** shows a download of Locky ransomware from
http ://winjoytechnologies .com/v4v5g45hg.exe (VirusTotal 1/56***) which is a -different- Locky binary from this earlier malspam run[1]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/94c3dfc6c2b3f417750fd200f161e6cad341e193c36f71fc53e0d657750764a7/analysis/1458129749/
** https://malwr.com/analysis/NmRlMGE2ZTVhY2FiNDFiZDkzYzdhZjhiZGNmYzRjMTQ/
Hosts
192.185.37.228: https://www.virustotal.com/en/ip-address/192.185.37.228/information/
91.195.12.187: https://www.virustotal.com/en/ip-address/91.195.12.187/information/
*** https://www.virustotal.com/en/file/35bcfe6758ef68dad38cc7df598fe6df4fa7feb5cc4c72940b61a1e06ba01157/analysis/1458129716/
TCP connections
91.195.12.187
1] https://myonlinesecurity.co.uk/bestellung-69376-david-favella123buhlergroup-com-js-malware-leads-to-dridex-or-locky/
___
Fake 'Bestellung' SPAM - JS malware leads to ransomware
- https://myonlinesecurity.co.uk/bestellung-69376-david-favella123buhlergroup-com-js-malware-leads-to-dridex-or-locky/
16 Mar - "An email written partly in English -and- partly in German supposedly from Buhler group with the subject of 'Bestellung 69376' [random numbered] pretending to come from david.favella654@ buhlergroup .com (-random- numbers after david.favella) with a zip attachment is another one from the current bot runs... Update: I am reliably informed this is Locky ransomware not Dridex... The email looks like:
From: david.favella654@ buhlergroup .com
Date: Wed 16/03/2016 10:03
Subject:Bestellung 69376
Attachment: Bestellung Bestellung 69376.zip
Sehr geehrte Damen und Herren,
anbei erhalten Sie unsere Bestellung. Diese ist maschinell erstellt und ist daher ohne Unterschrift gültig.
Dear ladies and gentlemen,
enclosed you receive our order. This order has been created automatically and is valid without signature.
Mit freundlichen Grüßen / Best regards ...
16 March 2016: Bestellung Bestellung 69376.zip: Extracts to: BOY8641744807.js
Current Virus total detections 6/57*.. MALWR** shows a download of Locky ransomware from
http ://vital4age .eu/v4v5g45hg.exe (VirusTotal 0/57***).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3199076934cc4d5c7267311d2932b9dfb149b9f0ad4cf20eed98a6b8ce10e459/analysis/1458127067/
** https://malwr.com/analysis/ODQzZTFhN2RkMDRkNDA5NzkyYWZiYTY0ZTFiMjhjMGM/
Hosts
85.13.152.231: https://www.virustotal.com/en/ip-address/85.13.152.231/information/
>> https://www.virustotal.com/en/url/d6766b6422d2796a6a651681e8cd5b91502ba209a4a045806596e6526785f427/analysis/
*** https://www.virustotal.com/en/file/ecb922926c3ab4841e31dff625c065770acede1a32811303a5c640022b6fd6cb/analysis/1458127276/
TCP connections
149.202.109.205: https://www.virustotal.com/en/ip-address/149.202.109.205/information/
91.195.12.187: https://www.virustotal.com/en/ip-address/91.195.12.187/information/
___
Fake 'Order status updated' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/re-mineral-financial-investments-ltd-order-number-8978568235215-status-updated-to-order-processing-word-doc-macro-malware/
16 Mar 2016 - "An email with the subject of 'RE: MINERAL & FINANCIAL INVESTMENTS LTD – Order Number 89785/682352/15 status updated to order processing' pretending to come from random names and email addresses with a malicious word doc attachment is another one from the current bot runs... This mass malspam run has a subject that looks like 'RE: [random company name] – Order Number [random number] status updated to order processing'. The attachment names are based on the company name in the subject and include:
CML MICROSYSTEMS – Order NUM. 09725_866338_23.doc
MINERAL & FINANCIAL INVESTMENTS LTD – Order NUM. 57691_396874_45.doc
MXC CAPITAL PLC – Order NUM. 80048_534442_26.doc
ROSSETI JSC – Order NUM. 39475_569330_86.doc
Some subjects include:
RE: MINERAL & FINANCIAL INVESTMENTS LTD – Order Number 89785/682352/15 status updated to order processing
RE: CML MICROSYSTEMS – Order Number 09725/866338/23 status updated to order processing
RE: ROSSETI JSC – Order Number 39475/569330/86 status updated to order processing
RE: MXC CAPITAL PLC – Order Number 80048/534442/26 status updated to order processing
One example email looks like:
From: Horton.Elena9@ incrcc .org
Date: Wed 16/03/2016 13:34
Subject: RE: MINERAL & FINANCIAL INVESTMENTS LTD – Order Number 89785/682352/15 status updated to order processing
Attachment: MINERAL & FINANCIAL INVESTMENTS LTD – Order NUM. 57691_396874_45.doc
Dear customer,
First of all thank you for purchasing with us.
We want to let you know that your order 89785/682352/15 status has been updated to ORDER PROCESSING
If you have any questions about your order, send an email to sales@fromdomain qouting your order number 89785/682352/15 or simply reply to this message.
Your unique reference: Your order number listed above.
MINERAL & FINANCIAL INVESTMENTS LTD
You can download and view a copy of your invoice from the attached document...
16 March 2016: MINERAL & FINANCIAL INVESTMENTS LTD – Order NUM. 57691_396874_45.doc
.. Current Virus total detections 1/57*..
Update: a resubmission to MALWR** got a download from http ://api.kairoshealthcare .org/dri/donate.php
which gave freshmeat.exe (VirusTotal 4/56***) which appears to ebb an -updated- Dridex binary although also using the same download locations from this earlier Malspam run[4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1eb49aaf29411598096e293a23c6852ea4a273022f56868a944b270ecccfd41f/analysis/1458134954/
** https://malwr.com/analysis/NDA2M2RhNzlkZjZhNDkzMzhkYjljNTJkN2ZmYzUzNGU/
Hosts
213.159.214.241: https://www.virustotal.com/en/ip-address/213.159.214.241/information/
188.93.239.28
13.107.4.50
*** https://www.virustotal.com/en/file/b100e104a22f9670164d73679f7d4b6e5de055bf961bc4c1e9c28d2580d3f753/analysis/1458137759/
TCP connections
188.93.239.28: https://www.virustotal.com/en/ip-address/188.93.239.28/information/
>> https://www.virustotal.com/en/url/c56df54c0d68a5b3da8062f76bb421db4dd5a5d801f871ca4ccae216adcb5c4b/analysis/
13.107.4.50: https://www.virustotal.com/en/ip-address/13.107.4.50/information/
4] https://myonlinesecurity.co.uk/your-order-summary-from-365-electrical-order-number-93602-word-doc-macro-malware/
:fear::fear: :mad:
AplusWebMaster
2016-03-17, 12:48
FYI...
Fake 'Interparcel Documents' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-interparcel-documents.html
17 Mar 2016 - "This spam email does not come from Interparcel but is instead a simple forgery with a malicious attachment:
From: Interparcel [bounce@ interparcel .com]
Date: 17 March 2016 at 08:51
Subject: Interparcel Documents
Your Interparcel collection has been booked and your documents are ready.
There is a document attached to this email called Shipping Labels (620486055838).doc.
Please open and print this attachment and cut out the waybill images. They must be attached to your parcels before the driver arrives.
Thank you for booking with Interparcel.
Attached is a randomly-named document that matches the reference in the email (e.g. Shipping Labels (620486055838).doc) of which I have seen two variants (VirusTotal results [1] [2]). These two Malwr reports [3] [4] show Dridex-like download locations at:
gooddrink .com.tr/wp-content/plugins/hello123/56h4g3b5yh.exe
ziguinchor.caravanedesdixmots .com/wp-content/plugins/hello123/56h4g3b5yh.exe
The detection rate for the binary is 5/57*. This DeepViz report** on the binary shows network connections to:
195.169.147.26 (Culturegrid.nl, Netherlands)
64.76.19.251 (Level 3, US / Impsat, Argentina)
91.236.4.234 (FHU Climax Rafal Kraj, Poland)
188.40.224.78 (Hetzner / NoTaG Community, Germany)
As mentioned before, these characteristics look like the Dridex banking trojan.
Recommended blocklist:
195.169.147.26
64.76.19.251
91.236.4.234
188.40.224.78 "
1] https://www.virustotal.com/en/file/d331c0698cb110347973441dab50d19853b755e1cf6096311077cde2074b5cfa/analysis/1458205307/
2] https://www.virustotal.com/en/file/0f368342ddf043210dcae012c06532c494873dcf283f26ae4f7f3e48290f2c4a/analysis/1458205319/
3] https://malwr.com/analysis/Yjk4MWRiOWM0YzU1NGQyNGI4MzMzNDBhYTAzNDdlZTM/
Hosts
185.85.191.251
4] https://malwr.com/analysis/ZDljMjUwMTVmMTA2NGFmNTg4ZTE0NjllNjU1MzM1NzY/
Hosts
62.210.16.61
* https://www.virustotal.com/en/file/756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748/analysis/1458206236/
** https://sandbox.deepviz.com/report/hash/912a16dfeb25668f0e6ee5d6ec6746d8/
- https://myonlinesecurity.co.uk/interparcel-documents-word-doc-macro-malware-leads-to-dridex/
17 Mar 2016 - "An email with the subject of 'Interparcel Documents' pretending to come from Interparcel <bounce@ interparcel .com> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Interparcel <bounce@ interparcel .com>
Date: none
Subject: Interparcel Documents
Attachment: Shipping Labels (642079569307).doc
Your Interparcel collection has been booked and your documents are ready.
There is a document attached to this email called Shipping Labels (642079569307).doc.
Please open and print this attachment and cut out the waybill images. They must be attached to your parcels before the driver arrives.
Thank you for booking with Interparcel.
17 March 2016: Shipping Labels (642079569307).doc - Current Virus total detections 8/57*
.. MALWR** shows a download from http ://www.corecircle .it/wp-content/plugins/hello123/56h4g3b5yh.exe (VirusTotal ***) This is likely to be the Dridex banking Trojan. Hybrid Analysis[4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/204d013482d09516910f666b0cc73a39f07c0e9c42c636f0177481606c3bf0a0/analysis/1458204597/
** https://malwr.com/analysis/ZjBiOWMxZDQ4NzM4NDAzNDlkODc4YjVhNTYzNDg4NGE/
Hosts
62.149.142.224
*** https://www.virustotal.com/en/file/756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748/analysis/1458205050/
4] https://www.hybrid-analysis.com/sample/756c4cb7f88e0dd37f460037b9e43a59a1677234a5f491b26195a8950629d748?environmentId=4
Host Addresses
195.169.147.26
64.76.19.251
___
Fake 'Remittance Adivce' SPAM - doc malware leads to Dridex
- https://myonlinesecurity.co.uk/remittance-adivce-word-doc-macro-malware-leads-to-dridex/
17 Mar 2016 - "An email with the subject of' Remittance Adivce' pretending to come from random names and email addresses with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... Note the -misspelling- in the subject 'Remittance Adivce' instead of 'Remittance Advice' which should be enough to raise warning flags. One of the emails looks like:
From: Gill.Wilmer07@ urbanmountainhomes .com
Date: Thu 17/03/2016 09:16
Subject: Remittance Adivce
Attachment: remitadv_ana.doc
Please find attached a remittance advice for payment made yo you today.
Please contact the accounts team on 020 7523 2565 or via reply email for any queries regarding this payment.
Kind Regards
Wilmer Gill
17 March 2016: remitadv_ana.doc - Current Virus total detections 1/57*
.. MALWR** shows a download from http ://bakery.woodwardcounseling .com/michigan/map.php which gave me crypted120med.exe (virustotal 3/56***) MALWR[4] which looks like Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d1ff5e1ab7d903634c6eb01c9f36c25e959b13ab03547a60713b5f635bad9d91/analysis/1458206097/
** https://malwr.com/analysis/M2U5MDVjMzJmMzJkNDBjODkxY2E0MzA3NGM5YjUwY2M/
Hosts
217.12.199.94
188.93.239.28
*** https://www.virustotal.com/en/file/994346405c3709deb6c7379e7d2748c78e210a056d9a4d7020108d16c6f2db06/analysis/1458204974/
TCP connections
38.64.199.33
104.86.111.136
4] https://malwr.com/analysis/Yjg0NDU3MzRhZjQyNDcwMjgyOGNlY2E1ZWQyMzJlMjA/
Hosts
188.93.239.28
- http://blog.dynamoo.com/2016/03/malware-spam-remittance-adivce-from.html
17 Mar 2016 - "This fake financial spam has a malicious attachment and poor spelling in the subject field.
From: Booth.Garth19@ idsbangladesh .net.bd
Date: 17 March 2016 at 09:17
Subject: Remittance Adivce
Please find attached a remittance advice for payment made yo you today.
Please contact the accounts team on 020 2286 7847 or via reply email for any queries regarding this payment.
Kind Regards
Garth Booth
... Recommended blocklist:
217.12.199.94
38.64.199.33
188.93.239.28
85.17.155.148 "
___
Fake 'Documentxx' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/03/malware-spam-documentxx-apparently.html
17 Mar 2016 - "This spam appears to come from-the-victim, but this is just a simple forgery (explained here*). Attached is a ZIP file beginning "Document" followed by a one or two digit random number, which matches the subject. There is -no- body text. Here is an example:
From: victim@ domain .tld
To: victim@ domain .tld
Date: 17 March 2016 at 10:37
Subject: Document32
* http://blog.dynamoo.com/2011/09/why-am-i-sending-myself-spam.html
Inside is a randomly-named script (samples VirusTotal reports [1] [2]..). These Malwr reports [8] [9].. indicate that the -script- attempts to download a binary from the following locations:
escortbayan.xelionphonesystem .com/wp-content/plugins/hello123/89h8btyfde445.exe
fmfgrzebel .pl/wp-content/plugins/hello123/89h8btyfde445.exe
superiorelectricmotors .com/wp-content/plugins/hello123/89h8btyfde445.exe
sabriduman .com/wp-content/plugins/hello123/89h8btyfde445.exe
bezerraeassociados .com.br/wp-content/plugins/hello123/89h8btyfde445.exe
The dropped binary has a detection rate of just 2/57**. Those reports and these other automated analyses [14] [15].. show network traffic to:
78.40.108.39 (PS Internet Company LLC, Kazakhstan)
46.148.20.46 (Infium UAB, Ukraine)
188.127.231.116 (SmartApe, Russia)
195.64.154.114 (Ukrainian Internet Names Center, Ukraine)
This is Locky ransomware.
Recommended blocklist:
78.40.108.39
46.148.20.46
188.127.231.116
195.64.154.114 "
1] https://www.virustotal.com/en/file/3161a2b57cd1f6200de4ccd0d7aca74b824edfb244fd582e3e8494a9c7a8a7ee/analysis/1458212406/
2] https://www.virustotal.com/en/file/91caea90221c9f46fe9a8194d57361ce37bd8b422cfcdbe128f25bc48510b965/analysis/1458212403/
8] https://malwr.com/analysis/YWE1ZTY1NGY2N2YyNGZmYWIxNjIzZTg3MTBkODYzNTE/
9] https://malwr.com/analysis/Zjg1NmY3YTBjY2QxNGQwZTlhNzAzMWE4YWQyMmQwNGU/
** https://www.virustotal.com/en/file/ba816df6f7d1db48e508322349c9838b6c4ed0d871027a81fa3830a51937d544/analysis/1458213349/
14] https://malwr.com/analysis/OWVjNzBlNmNlMGQ4NDZjNWJkM2U0MTdiNTczMDNjZDE/
15] https://www.hybrid-analysis.com/sample/ba816df6f7d1db48e508322349c9838b6c4ed0d871027a81fa3830a51937d544?environmentId=4
___
Fake 'PDFPart2.pdf' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/pdfpart2-pdf-sent-from-my-samsung-galaxy-note-4-powered-by-three-js-malware-leads-to-locky-ransomware/
17 Mar 2016 - "An email with the subject of 'PDFPart2.pdf' pretending to come from Administrator admin@ your-own-email domain with a zip attachment is another one from the current bot runs which downloads Locky ransomware... The -broken- email looks like:
From: Administrator admin@ your own email domain
Date: Thu 17/03/2016 12:34
Subject: PDFPart2.pdf
Attachment: PDFPart2.zip
—-_com.android.email_2732400748040
Content-Type: multipart/alternative; boundary=”–_com.android.email_2732400748040″
—-_com.android.email_2732400748040 ...
.. When it is fixed...
From: Administrator admin@ your own email domain
Date: Thu 17/03/2016 12:34
Subject: PDFPart2.pdf
Attachment: PDFPart2.zip
Sent from my Samsung Galaxy Note 4 – powered by Three
17 March 2016: PDFPart2.zip: Extracts to: MNS2053291109.js - Current Virus total detections 6/57*
.. MALWR** shows a download of Locky ransomware from
http ://www.tuttiesauriti .org/wp-content/plugins/hello123/89h8btyfde445.exe (VirusTotal 5/56***) which although the same file name as today’s earlier locky malspam run is a -different- binary.. A second version CHR5185491610.js (VirusTotal [4]).. MALWR shows a download of the -same- Locky ransomware from
http ://cepteknik .org/wp-content/plugins/hello123/89h8btyfde445.exe ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/095a40960d139b3ab1a9553d3308a364f4a987fed9859bd6f0b76d6f914068da/analysis/1458220341/
** https://malwr.com/analysis/ODEwMTZiNGMwOTZkNDg1Mjk0OTc0NWYxYWVhNThhY2E/
Hosts
62.149.140.49: https://www.virustotal.com/en/ip-address/62.149.140.49/information/
78.40.108.39
*** https://www.virustotal.com/en/file/ddb80a24da8bec08eeac77e0a7ea13e48805a302290555d4bcb5d86d9080b13c/analysis/1458220984/
TCP connections
78.40.108.39: https://www.virustotal.com/en/ip-address/78.40.108.39/information/
>> https://www.virustotal.com/en/url/901c8eaba78121d397d9a3b007720ff8b0803eb301ad38d16ebb4f8823f0a495/analysis/
4] https://www.virustotal.com/en/file/a73bb6bcf9ca27c514cdcb5c64fd31e8c5c02e17f87643d110e21f2827f23330/analysis/1458221038/
- http://blog.dynamoo.com/2016/03/malware-spam-pdfpart2pdf-sent-from-my.html
17 Mar 2016 - "This spam run has a malicious attachment. It appears to come from within the user's own domain.
From: Administrator [admin@ victimdomain .tld]
Date: 17 March 2016 at 12:54
Subject: PDFPart2.pdf
Sent from my Samsung Galaxy Note 4 - powered by Three
Sent from my Samsung Galaxy Note 4 - powered by Three
All the attachments that I saw were corrupt, but it appears to be trying to download a -script- that installs Locky ransomware..."
___
Fake 'Invoice' SPAM - RTF malware leads to Dridex
- https://myonlinesecurity.co.uk/invoice-doinv32142-from-tip-top-delivery-word-rtf-malware-leads-to-dridex/
17 Mar 2016 - "An email with the subject of 'Invoice DOINV32142' from Tip Top Delivery (random characters) pretending to come from random email addresses with a malicious word doc RTF attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/tiptop-delivery-invoice-1024x783.png
17 March 2016: Invoice_DOINV32142_from_tip_top_delivery.rtf - Current Virus total detections 3/57*
.. MALWR** shows a download of what looks like Dridex banking Trojan from
http ://parts.woodwardcounselinginc .com/michigan/map.php which gave me twitt_us.exe (VirusTotal 3/57***).
It looks like a continuation of this earlier Dridex malspam[1] with similar sites... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e5ccec9d24b4d518de6c6722c1c72b6b23b3bb4ddddfc03a2b9a5630702e59c0/analysis/1458235091/
** https://malwr.com/analysis/YjdhMzA5NjMzYzJlNDM1N2JmYzFjMWIyNWIwYTgzN2M/
Hosts
176.107.177.85
188.93.239.28
8.254.249.62
*** https://www.virustotal.com/en/file/d5cd3c4c3f9b79533805b3485e53d7f5773ca61a608e3dfca51057d64da7716c/analysis/1458235750/
TCP connections
188.93.239.28
104.86.111.136
1] https://myonlinesecurity.co.uk/remittance-adivce-word-doc-macro-malware-leads-to-dridex/
:fear::fear: :mad:
AplusWebMaster
2016-03-18, 12:50
FYI...
Teslacrypt SPAM: 'Unpaid Issue…'
- https://blog.malwarebytes.org/intelligence/2016/03/teslacrypt-spam-campaign-unpaid-issue/
Mar 18, 2016 - "We have all seen the current upsurge in Ransomware attacks. It has been covered on an international scale, with new variants appearing at a very fast pace, some target Windows, some target Macs and some have cross platform capabilities... The email seen below is an example how the orchestrated attack is carried out (thanks to Conrad Longmore* for the email example):
From: Jennie bowles
Date: 10 March 2016 at 12:27
Subject: GreenLand Consulting – Unpaid Issue No. 58833
Dear Client! For the third time we are reminding you about your unpaid debt. You used to ask for our advisory services in July 2015, the receipt issued to you was recognized in our database with No. 58833. But it has never been paid off. We enclose the detailed bill for your recollection and sincerely hope that you will act nobly and responsibly. Otherwise we will have to start a legal action against you.
Respectfully,
Jennie bowles
Chief Accountant
707 Monroe St FL 58833 928-429-4994
The emails usually contain a ZIP file which contains a malicious script/downloader. Upon running this specific malicious script/downloader I was greeted by Teslacrypt ransomware (69.exe) from:
hellomississmithqq[.]com /
IP: 54.212.162.6: https://www.virustotal.com/en/ip-address/54.212.162.6/information/
>> https://www.virustotal.com/en/url/598b1b8526192507549f4ae5079a2a34b921cd58c294b8f3b67fa0db41f2a41e/analysis/
... below are some of the associated domains / IPs identified from the above sample. This Teslacrypt ransomware campaign has recently morphed into a hybrid Teslacrypt/Locky ransomware campaign. The aforementioned domain hellomississmithqq[.]com was seen serving up both Teslacrypt and Locky Ransomware on 10 March 2016).
Identified command and control:
multibrandphone[.]com
vtechshop[.]net
sappmtraining[.]com
shirongfeng[.]cn
controlfreaknetworks[.]com
tele-channel[.]com
Associated IP addresses with hellomississmithqq[.]com:
46.108.108.182
54.212.162.6
78.135.108.94
134.19.180.8
202.120.42.190
216.150.77.21
142.25.97.48
202.120.42.190
... Ransomware is not going away, on the contrary it is becoming more and more prevalent with new variants coming out at a fast pace and targeting multiple platforms. It is recommended that users are using anti-malware protection, especially one that has a website protection option..."
* http://blog.dynamoo.com/
___
Evil networks to block 2016-03-18
- http://blog.dynamoo.com/2016/03/evil-networks-to-block-2016-03-18.html
18 Mar 2016 - "A follow-up to this list* posted a few days ago. These networks are primarily distributing Angler and in my opinion you should -block- their entire ranges to be on the safe side...
85.204.74.0/24
89.45.67.0/24
89.108.83.0/24
148.251.249.96/28
184.154.89.128/29
184.154.135.120/29
185.30.98.0/23
185.117.73.0/24
185.141.25.0/24
194.1.237.0/24
212.22.85.0/24
217.12.210.128/25 "
* http://blog.dynamoo.com/2016/03/evil-networks-to-block-2016-03-07.html
___
Fake 'Proof of Delivery' SPAM - doc macro malware leads to Dridex
- https://myonlinesecurity.co.uk/ukmail-customer-services-proof-of-delivery-report-160316-170316-word-doc-macro-malware-leads-to-dridex/
18 Mar 2016 - "An email with the subject of 'Proof of Delivery Report: 16/03/16-17/03/16' pretending to come from UKMail Customer Services <list_reportservices@ ukmail .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Proof-of-Delivery-Report160316-17031-1024x763.png
18 March 2016: poddel-pdf-2016031802464600.docm - Current Virus total detections 9/57*
.. MALWR** shows a download from http ://felipemachado .com/wp-content/plugins/hello123/r34t4g33.exe
(VirusTotal 9/57***) which looks like Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/c6010c95639995351d85790709dbc3ab59d87192d2627ea71e345552b6cf4c5f/analysis/1458295346/
** https://malwr.com/analysis/NWVkYjY1OGMxNDExNGM5ZWJmODQxYWQ4YzJjMWNiNzc/
Hosts
93.104.215.155
64.147.192.68
184.25.56.51
*** https://www.virustotal.com/en/file/c6010c95639995351d85790709dbc3ab59d87192d2627ea71e345552b6cf4c5f/analysis/1458295346/
- http://blog.dynamoo.com/2016/03/malware-spam-proof-of-delivery-report.html
18 Mar 2016 - "This spam does not come from UKMail but is instead a simple -forgery- with a malicious attachment:
From: UKMail Customer Services [list_reportservices@ ukmail.com]
Date: 18 March 2016 at 02:46
Subject: Proof of Delivery Report: 16/03/16-17/03/16
Dear Customer,
Please find attached your requested Proof of Delivery (POD) Download Report
ATTACHED FILE: POD DOWNLOAD ...
At the time of writing I have seen just a single sample with an attachment named poddel-pdf-2016031802464600.docm ...
Recommended blocklist:
64.147.192.68
64.76.19.251
91.236.4.234
188.40.224.78 "
___
Fake 'Attached Image' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/blank-email-saying-attached-image-pretending-to-come-from-a-scanner-or-copier-at-your-own-domain-js-malware-leads-to-locky-ransomware/
18 Mar 2016 - "A -blank- email with the subject of 'Attached Image' pretending to come from a scanner, copier or multi-functional device at your-own-domain with a random numbered zip attachment is another one from the current bot runs which downloads Locky ransomware... The email looks like:
From: scanner or copier at your-own-email domain
Date: Fri 18/03/2016 10:24
Subject: Attached Image pretending to come from a scanner or copier at your own domain
Attachment: 9369_001.zip (all random numbers)
Body content: totally blank
5 March 2016: 9369_001.zip : Extracts to: AGK4044783108.js - Current Virus total detections 2/57*
.. MALWR** shows a download of Locky ransomware from
http ://naairah .com/wp-content/plugins/hello123/j7u7h54h5.exe (VirusTotal 2/55***)
.. MALWR[4] and from http ://robyrogers .com.au/wp-content/plugins/hello123/8888ytc6r.exe (VirusTotal 4/57[5])... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5c8ff09a62328ae495ce50a5be1a5c6eb6779eb972caacc55919146028a66c13/analysis/1458300821/
** https://www.virustotal.com/en/file/5c8ff09a62328ae495ce50a5be1a5c6eb6779eb972caacc55919146028a66c13/analysis/1458300821/
Hosts
149.202.201.228
46.148.20.46
27.131.66.9
195.154.126.159
*** https://www.virustotal.com/en/file/ece07a5ff2050fd86d2517b30e509902eafa0060ed8d43a5eef116d5ec176bf9/analysis/1458301083/
TCP connections
46.148.20.46
4] https://malwr.com/analysis/NGY4ZjQxYTFjMjI2NGM0YTk4OGU1ZmY0MWQ5NjkzMzg/
Hosts
185.82.216.143
5] https://www.virustotal.com/en/file/29ed382b01f72c856186104bf78744112ede037f5474f9b1296076efab0ee2ec/analysis/1458301375/
___
Fake 'FedEx' SPAM - JS malware leads to ransomware
- https://myonlinesecurity.co.uk/fedex-problems-with-item-delivery-n-00196222-shawn-maddox-js-malware-leads-to-ransomware/
18 Mar 2016 - "An email with the subject of 'FedEx_00196222.zip' pretending to come from mogotoys@ server.robo-apps .com; on behalf of; FedEx 2Day <shawn.maddox@ mogotoys .com> with a zip attachment is another one from the current bot runs which downloads ransomware... The email looks like:
From: mogotoys@ server.robo-apps .com; on behalf of; FedEx 2Day <shawn.maddox@ mogotoys .com>
Date: Fri 18/03/2016 02:49
Subject: Problems with item delivery, n.00196222
Attachment: FedEx_00196222.zip
Dear Customer,
Your parcel has arrived at March 15. Courier was unable to deliver the parcel to you.
Shipment Label is attached to email.
Yours sincerely,
Shawn Maddox,
Sr. Station Agent.
18 March 2016: FedEx_00196222.zip: Extracts to: FedEx_00196222.doc.js - Current Virus total detections 12/57*
.. Wepawet** shows downloads from a combination of of these -5- locations:
evakuator-lska .com.ua | rpexpress .qc.ca | omergoksel .com | web.benzol .net.pl | cspfc.immo .perso.sf
.. Hybrid analysis*** shows the download location to be
evakuator-lska .com.ua where it gave -2- files VirusTotal [1][2] which look like Kovter and Boaxxe...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/f3a52a4b6383c909730a523e0ec5101f3cf25fc5bfe66755731bbff7b80f90d8/analysis/1458279168/
** https://wepawet.iseclab.org/view.php?hash=529964ebc9bf02f0f2138fd28eef4046&type=js
*** https://www.reverse.it/sample/f3a52a4b6383c909730a523e0ec5101f3cf25fc5bfe66755731bbff7b80f90d8?environmentId=1
Contacted Hosts
78.109.16.100
28.59.23.77
47.206.106.113
145.24.135.107
178.33.69.66
87.118.110.192
189.60.150.37
28.29.231.118
DNS Requests
evakuator-lska .com.ua: 78.109.16.100: https://www.virustotal.com/en/ip-address/78.109.16.100/information/
>> https://www.virustotal.com/en/url/066db91db3444b5384f5c5ff27350f24223e436f5309b855a70fc15df7364c5c/analysis/
find-dentalimplants .com: 173.201.146.128: https://www.virustotal.com/en/ip-address/173.201.146.128/information/
>> https://www.virustotal.com/en/url/90536eadc9eb9cffdb6f583f0951a06a6410bf5d5208871f49ccb3b65b976076/analysis/
1] https://www.virustotal.com/en/file/1a7912f6193e2782c9bb45543c1bc7deb8b4304aec9e50d8537d09384d0df341/analysis/1458249226/
2] https://www.virustotal.com/en/file/e44230b390d23cf334d55f940dc739eeabe42c5c8e623fb2dc1339299da4534c/analysis/1458282807/
:fear::fear: :mad:
AplusWebMaster
2016-03-21, 18:02
FYI...
Fake 'Fax transmission' SPAM - malicious script attachment
- http://blog.dynamoo.com/2016/03/malware-spam-fx-service-fax.html
21 Mar 2016 - "This -fake- fax spam appears to come from within the victim's own domain, but it doesn't. Instead is is just a simple -forgery- with a malicious attachment.
From: FX Service [emailsend@ w.e191.victimdomain .tld]
Date: 21 March 2016 at 14:32
Subject: Fax transmission: -7172277033-1974602246-2016032111285-47417.tiff
Please find attached to this email a facsimile transmission we
have just received on your behalf
(Do not reply to this email as any reply will not be read by
a real person)
Details will vary from message to message. Attached s a ZIP file with a name that broadly matches the one referred to in the subject (e.g. F-7172277033-1974602246-2016032111285-47417.zip) which contains any one of a wide-number-of-malicious-scripts (some example VirusTotal results [1] [2]..). Malwr analysis of those samples [6] [7].. shows binary download locations at:
http ://modaeli .com/89h766b.exe
http ://spormixariza .com/89h766b.exe
http ://sebastiansanni .org/wp-content/plugins/hello123/89h766b.exe
http ://cideac .mx/wp-content/plugins/hello123/89h766b.exe
There are probably other download locations too. The dropped binary has a VirusTotal detection rate of just 2/56*. This Malwr report** of the payload indicates that it is Locky ransomware.
All of those sources plus this Deepviz report*** show network traffic to the following IPs:
195.64.154.126 (Ukrainian Internet Names Center, Ukraine)
92.63.87.106 (MWTV, Latvia)
84.19.170.244 (Keyweb AG, Germany / 300GB.ru, Russia)
217.12.199.90 (ITL Company, Ukraine) ...
Recommended blocklist:
195.64.154.126
92.63.87.106
84.19.170.244
217.12.199.90 "
1] https://www.virustotal.com/en/file/df33b0c4cad6b885046622f3efe46e5c1b353bfa1c72bb44a88297d756d9f7a3/analysis/
2] https://www.virustotal.com/en/file/38e4a2c740998609339205155e44aa6986d7f38eedd1729c0966aded4c283fc1/analysis/
6] https://malwr.com/analysis/NDA4MTliNGJmMDE2NDQ1YmJlOGY0NWVkOTE4YjdiYWY/
7] https://malwr.com/analysis/MTRhYmQwYzY0NDFmNDI4YjlmNmE3NWFjYzNmYzg3NmU/
* https://www.virustotal.com/en/file/4ef58904172d664a9cdc944db93c6db2f3e0db84bcf78a4e01458d3ae7e3d918/analysis/1458575289/
** https://malwr.com/analysis/MGU5NDIxNDQ1MzU5NGRlYmJjYTI2M2I5NTJiYjg4MGY/
*** https://sandbox.deepviz.com/report/hash/808a8eac400c6abf49d352ae1d944c2a/
___
Fake 'Your account ID... has been suspended' SPAM - JS malware leads to Teslacrypt
- https://myonlinesecurity.co.uk/your-account-id98938-has-been-suspended-js-malware-leads-to-teslacrypt/
21 Mar 2016 - "An email with the subject of 'Your account ID:98938 has been suspended' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads teslacrypt... The email looks like:
From: random email addresses
Date: Beatriz gepp <geppBeatriz957@ jjdior .com>
Subject: Your account ID:98938 has been suspended.
Attachment: warning_letter_34692556.zip
Your bank account associated with the ID:98938 has been suspended because of the unusual activity connected to this account and a failure of the account holder to pay the taxes on a due date.
Your debt: - 394,42 USD
For more details and the information on how to unlock your account please refer to the document attached.
21 March 2016: warning_letter_34692556.zip: Extracts to: letter_I22vNL.js - Current Virus total detections 15/56*
.. MALWR** shows a download of teslacrypt from http ://grandmahereqq .com/80.exe?1 (VirusTotal ***)
Note: this also tries to download http ://google .com/80.exe?1 which does-not-exist... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1da338caa2b8dd1313b8bd8feb8cec4c2e724bd747c84b93af8745ad7440c49f/analysis/1458579387/
** https://malwr.com/analysis/Njc2NGU2ZjI4ZTljNDUxMWFkZDE4MGJmYzlkZjVmNGQ/
Hosts
54.212.162.6
216.58.192.14
*** https://www.virustotal.com/en/file/644c54329771fa735a34390e72532e0262ce9f0ca6e18ccefd4d141aa4d5995b/analysis/1458581354/
___
Hacked Canadian Hospital Website serves Ransomware
- https://blog.malwarebytes.org/security-threat/2016/03/canadian-hospital-serves-ransomware-via-hacked-website/
Mar 21, 2016 - "... Norfolk General Hospital, based in Ontario, became a teaching facility for McMaster University’s Faculty of Health Sciences in 2009. The web portal is powered by the Joomla CMS, running version 2.5.6 (latest version is 3.4.8) according to a manifest file present on their server. Several vulnerabilities exist for this outdated installation, which could explain why the site has been hacked. Our honeypots visited the hospital page and got infected with ransomware via the Angler exploit kit. A closer look at the packet capture revealed that malicious-code leading to the exploit kit was -injected- directly into the site’s source code itself. Like many site hacks, this injection is conditional and will appear only -once- for a particular IP address. For instance, the site administrator who often visits the page will only see a clean version of it, while first timers will get served the exploit and malware:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/Flow.png
The particular strain of ransomware dropped here is -TeslaCrypt- which demands $500 to recover your personal files it has encrypted. That payment doubles after a week... We contacted the Norfolk hospital and eventually were able to speak with their IT staff. We shared the information we had (screenshots, network packet capture) and told them about the ransomware payload we collected when we reproduced the attack in our lab. We were told that they were working on upgrading their version of Joomla with their hosting provider..."
Norfolk General Hospital - Ontario: ngh.on .ca: 205.150.58.124:
>> https://www.virustotal.com/en/url/ef0798b1ad11c6fa529f1f9f6fbaacfd17c7c1a020edb87e68f4c4e44db43773/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-03-22, 12:19
FYI...
Fake 'Credit Note' SPAM - JS malware leads to ransomware
- https://myonlinesecurity.co.uk/credit-note-from-random-companies-js-malware-leads-to-ransomware/
22 Mar 2016 - "An email with the subject of 'Credit Note CN-73290' from On Semiconductor Corp for [redacted] (0312) pretending to come from Accounts <message-service@ post.xero .com> with a zip attachment is another one from the current bot runs which downloads ransomware... These don’t look like either Locky or Teslacrypt ransomware so it appears that another gang of bad actors are using the same email templates as the 2 prolific malspammers to spread their version of ransomware. One example of the email looks like:
From: Accounts <message-service@ post.xero .com>
Date: Tue, 22 Mar 2016 04:38:32
Subject: Credit Note CN-73290 from On Semiconductor Corp for [victim company ] (0312)
Attachment: Credit Note CN-73290.zip
Hi Kris,
Attached is your credit note CN-73290 for 52611.30 AUD.
This has been allocated against invoice number
If you have any questions, please let us know.
Thanks,
McKesson Corporation ...
22 March 2016: Credit Note CN-73290.zip: Extracts to: Credit Note CN-64451.js
.. Current Virus total detections 2/56*. MALWR** shows a download of some sort of ransomware from
http ://www .frontlinecarloans .com.au/public/js/bin.exe (VirusTotal 6/56***) (Hybrid Analysis [1]) (MALWR [2])
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/7ec465743ea1b3ff72ae5f4c11654883ad99730743120ce486f33587f692b14e/analysis/1458611843/
** https://malwr.com/analysis/NDVkNDQyYmM2YmYwNDEwOWI1NzIxNzhjNzI3OWEyY2E/
Hosts
103.4.18.250: https://www.virustotal.com/en/ip-address/103.4.18.250/information/
>> https://www.virustotal.com/en/url/f851faace39b700949dd829519f358bac18528da87f0ae2e4a72d6989bf2af2b/analysis/
104.27.151.145
23.99.222.162
*** https://www.virustotal.com/en/file/69d315265d03e9cc6411ced6b68bed6daf595418c86bc80d6cce1b915830c959/analysis/1458626108/
TCP connections
104.27.151.145
1] https://www.hybrid-analysis.com/sample/69d315265d03e9cc6411ced6b68bed6daf595418c86bc80d6cce1b915830c959?environmentId=4
Contacted Hosts
104.27.150.145
2] https://malwr.com/analysis/NTQ1ZmJkMzVmY2QzNDUzYTk3NzQ1OGUwMDBlMmMwYzk/
Hosts
104.27.150.145
23.101.187.68
104.27.151.145
___
Fake 'Blank 2' SPAM - word macro malware leads to Dridex
- https://myonlinesecurity.co.uk/blank-2-steve-gale-word-macro-malware-leads-to-dridex/
22 Mar 2016 - "An email with a completely blank / empty body with the subject of 'Blank 2' pretending to come from Steve Gale <steve1gales@ gmail .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Steve Gale <steve1gales@ gmail .com>
Date: Tue 22/03/2016 09:19
Subject: Blank 2
Attachment: Blank 2.docm
Body content: completely empty
22 March 2016: Blank 2.docm - Current Virus total detections 6/56*
.. MALWR** shows a download from http ://www .lightningstars .in/system/logs/87h76hghuhi.exe (VirusTotal 5/56***)
which is inconclusive but looks like Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/40a55d9969b43a18aaf2e653e7d88e0286af7fea95570c266941fa83247adc64/analysis/1458638302/
** https://malwr.com/analysis/YWZlZDM3ZmExN2JlNDcwNzhhZDIyZTNmZjFmMmVjOTM/
Hosts
162.144.73.194: https://www.virustotal.com/en/ip-address/162.144.73.194/information/
>> https://www.virustotal.com/en/url/03709dae5652e6bdd1f6296fdc636966251ab238a53543485987a1105e47f32f/analysis/
*** https://www.virustotal.com/en/file/c785c7a73c1e005d0b2ca888fa9579f871985aebde5480a8049b4376927491d6/analysis/1458637560/
___
Fake 'Statement' SPAM - JS malware leads to Locky Ransomware
- https://myonlinesecurity.co.uk/random-statements-from-random-senders-js-malware-leads-to-locky-ransomware/
22 Mar 2016 - "An email with the subject of 'FW: Statement S#327763' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... One example of the emails looks like:
From: Luis Wagner <WagnerLuis4446@ newthoughtcenterofhawaii .com>
Date: Tue 22/03/2016 09:03
Subject: FW: Statement S#327763
Dear ans,
Please find attached the statement (S#327763) that matches back to your invoices.
Can you please sign and return.
Best regards,
Luis Wagner
Business Development Director
22 March 2016: statement_ans_327763.zip: Extracts to -3- .JS files - 2 are identical & 1 different
.. Current Virus total detections [1] [2]: MALWR* shows -both- download Locky Ransomware from
http ://alexsolenni .it/pol4dsf (VirusTotal 3/57**). This zip file contains -3- js files and an -unknown- file that when examined is actually empty... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://www.virustotal.com/en/file/6ba0d16bdedcd954f777630ce73945ea1e89498ebce2fc3e7d748fda19fef605/analysis/1458641040/
2] https://www.virustotal.com/en/file/3566b189e8bf2d822328a6d66b1a862f8146417d96ebd907809669f831c14155/analysis/1458641075/
* https://malwr.com/analysis/NmUyYTBhMjAwM2EyNGRhZWE3MDM5OGJmNGIzODA0ODI/
Hosts
178.237.15.128: https://www.virustotal.com/en/ip-address/178.237.15.128/information/
92.63.87.106: https://www.virustotal.com/en/ip-address/92.63.87.106/information/
** https://www.virustotal.com/en/file/13c4466d1bdd2b93a955f7ea27e5ccd11f080b300401d50dd3f354549d0fc0c0/analysis/1458641975/
TCP connections
92.63.87.106
___
Fake 'HP' SPAM - RTF macro malware leads to Dridex
- https://myonlinesecurity.co.uk/hewlett-packard-enterprises-random-company-names-urgent-document-word-rtf-macro-malware-leads-to-dridex/
22 Mar 2016 - "An email that appears to come from HP (Hewlett Packard Enterprises) with the subject of 'Urgent: F400572 HARGREAVES LANSDOWN PLC/ HPE' coming from random names and email addresses with a malicious word doc RTF attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Urgent-F400572-HARGREAVES-LANSDOWN-PLC-HPE-1024x906.png
5 March 2016: fillout_DAINV13955_derek.rtf - Current Virus total detections 1/57*
.. MALWR** shows a download from http ://connect.act-sat-bootcamp .com/dana/home.php
which gave me hpe.jpg (which is -renamed- .exe file and not any sort of image file) (VirusTotal 3/57***)
Detections are inconclusive but likely to be Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/942b90b28f1a20050d0deb377f8c79e5f7be6a7517b5756ce9ee9e71da48a7fc/analysis/1458642936/
** https://malwr.com/analysis/MjNhNTQyNGUxMWRmNGZiYTg5N2JhMjNjMTI2MjdhM2U/
Hosts
91.240.86.234: https://www.virustotal.com/en/ip-address/91.240.86.234/information/
>> https://www.virustotal.com/en/url/da57d9760e31e804ad9cc7d5766e8edc7eb642194f2566c6249221496e5b1072/analysis/
*** https://www.virustotal.com/en/file/f292ae344f5392875f3016297551b905253fab604b530516e65b118292f48832/analysis/1458642865/
___
Fake 'bodily injury' SPAM - JS malware leads to ransomware
- https://myonlinesecurity.co.uk/you-are-being-accused-with-bodily-injury-case-02172723-js-malware-leads-to-ransomware/
22 Mar 2016 - "An email with the subject of 'You are being accused with bodily injury (Case: 02172723)' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads what looks like Teslacrypt ransomware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/You-are-being-accused-with-bodily-injury-Case-02172723-1024x447.png
5 March 2016: post_scan_02172723.zip: Extracts to: post_pgfEUf.js - Current Virus total detections 5/57*
.. MALWR** shows a download of what looks like Teslacrypt but might just be Locky from
http ://isityouereqq .com/80.exe?1(VirusTotal 5/57***) -Both- Locky and Teslacrypt have used the -same- servers and -same- file names over the last few weeks... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/913311e5d65f4ad93266143f251b09d174717f1e61367716b37c132e1d9a1d50/analysis/1458652839/
** https://malwr.com/analysis/NmRjODg3ODhkOTMzNGFkZmE0YzYzNzU1OTgxZjQwOGM/
Hosts
185.118.142.154: https://www.virustotal.com/en/ip-address/185.118.142.154/information/
*** https://www.virustotal.com/en/file/cdd779919597d6ad20cd8111118c2c152772a3e803505294b3a25f2254f67740/analysis/1458654208/
___
'Re-activate your Online Banking' – NatWest PHISH
- https://myonlinesecurity.co.uk/re-activate-your-online-banking-natwest-bank-phishing/
22 Mar 2016 - "There are a few major common subjects in a phishing-attempt. Lots of them are either PayPal or your Bank or Credit Card, with a message saying some thing like:
Urgent: Your card has been stopped !
There have been unauthorised or suspicious attempts to log in to your account, please verify
Your account has exceeded its limit and needs to be verified
Your account will be suspended !
You have received a secure message from < your bank>
We are unable to verify your account information
Update Personal Information
Urgent Account Review Notification
We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
Confirmation of Order
Re-activate your Online Banking
The original email looks like this:
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Re-activate-your-Online-Banking-1024x554.png
... the site the link goes to http ://linkage .org.uk//new_website/online/personal-natwest/Log-in.php
where a pop up asks you to download what appears to be the genuine Trusteer rapport security software:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/nat_west_phishing_popup-1024x547.png
... if you close then pop up & then fill in the email address and password [DON'T] you get a typical phishing page that looks very similar to a genuine Nat west bank page, if you don’t look carefully at the URL in the browser address bar... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or click-the-link in the email..."
linkage .org.uk: 37.61.235.162: https://www.virustotal.com/en/ip-address/37.61.235.162/information/
>> https://www.virustotal.com/en/url/03ded3410388e5f66c1d2e5cff768f6b7fc41866bed9395f1c930e8725e96afb/analysis/
___
“Copyright Violation” > Facebook Phish
- https://blog.malwarebytes.org/phishing/2016/03/copyright-violation-facebook-phish/
Mar 22, 2016 - "... we’ve spotted a phishing-scam using them as a launchpad for data theft. The name of the game is worrying the potential victim into clicking-on-the-supplied-link, with a curious mix of copyright violations and account verification. Here’s an example:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/fbcopyscam1.png
As you may have guessed, Facebook doesn’t issue copyright notices then direct you to apps pages. The 'Apps page' on offer here is a 'Get Verified' effort, complete with request for name, email/phone, password, profile link and 'comments':
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/fbcopyscam2.jpg
We reported the page to Facebook, and it is now offline:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/fbcopyscam3.jpg
'Verify your account' -scams- are fairly old, but throwing tall tales of copyright issues into the mix for that extra sheen of panic isn’t quite as common. Always do your best to keep your logins safe and, if in doubt, go to the site owners directly..
–never- enter your credentials into a -link- sent your way in -random- Facebook messages."
:fear::fear: :mad:
AplusWebMaster
2016-03-23, 14:47
FYI...
Fake 'electronic invoice' SPAM - rtf macro malware
- https://myonlinesecurity.co.uk/your-latest-electronic-invoice-from-d-e-web-works-word-doc-rtf-macro-malware/
23 Mar 2016 - "Following on from this malspam run yesterday* is today’s similar run with emails with the same subjects pretending to be 'your latest electronic invoice from D.E. Web Works' with a malicious word doc RTF attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt...
* https://myonlinesecurity.co.uk/urgent-f184255-safestore-hldgs-plc-hpe-stran-technologies-word-doc-macro-malware-leads-to-dridex/
One of the emails looks like:
From: Brandie Everett <Everett.Brandie19@ business.telecomitalia .it> (random senders)
Date: Wed 23/03/2016 10:34
Subject: Urgent: F137648 MFI Group/ HPE
Attachment: inv_839922034.rtf
MFI Group
Invoice Due:03/31/2016 IJINV71859 Amount Due: $898.68
Dear Customer: Here is your latest electronic invoice from D.E. Web Works. If your invoice is not attached as a PDF, you can change your preference in the ?Invoice Summary? section at the bottom of this email. If you wish for your invoices to go to someone different in your organization, just reply to this email and let us know. For your convenience, mail your payment to the address listed on the invoice. Please note that if we have you set up for automatic billing to your credit card or ACH, you will still receive this email, but the balance due will reflect a zero balance. If it does not reflect a zero balance, please contact us immediately. If you have questions about the invoice you have received, please feel free to reply to this email or call us... Electronic invoicing is just one more way that D.E. Web Works is doing its part to give back to the environment. For more information about our environmental initiative,contact us Thank you for helping us be Part of the Solution. We sincerely appreciate your business. MFI Group ...
23 March 2016: inv_839922034.rtf - Current Virus total detections 2/57*
.. MALWR** shows a download from http ://wrkstn09.peoriaseniorband .com/dana/home.php which gave me runwithme.exe. The analysis is inconclusive. (VirusTotal 4/56***) but is highly likely to be Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/e983a5d4c96bad161966a28a18e623826cb4dae4a8527d6ba395a45466ad575b/analysis/1458736152/
** https://malwr.com/analysis/NzhmM2Q2NWZjYTZjNGEyZmEwMDRjYjA3NTg5MTE2NTI/
Hosts
109.237.108.25: https://www.virustotal.com/en/ip-address/109.237.108.25/information/
>> https://www.virustotal.com/en/url/2ae96bf7b84c82847c76c221316c257e71627470ff1a214e51dcd1663377ab77/analysis/
*** https://www.virustotal.com/en/file/5b4ac76e9452523a4111ee532f94c6e74b51baf573b5d7f952bf6274a483a818/analysis/1458736404/
___
Fake 'Back Office: Invoice' SPAM - rtf macro malware
- https://myonlinesecurity.co.uk/the-back-office-invoice-mjinv78470-word-doc-rtf-macro-malware/
23 Mar 2016 - "An email with the subject of 'The Back Office : Invoice (MJINV78470)' pretending to come from random senders with a malicious word doc RTF attachment is another one from the current bot runs... The alleged sender’s name matches the name in the body of the email. The invoice number is random but matches the attachment name & number. One of the emails looks like:
From: Vincenzo Mann <Mann.Vincenzo42@ vyas .com>
Date: Wed 23/03/2016 12:22
Subject: The Back Office : Invoice ( MJINV78470 )
Attachment: backoffice_MJINV78470.rtf
03/23/2016
Please see the attached PDF File for account MJINV78470 in the amount of $
583.44. This Invoice MJINV78470 is due on 03/23/2016.
To view and/or print e-bills, you will need Microsoft Office Word installed on your computer.
If you have any questions or need further assistance, please send a reply.
Please include your name, address, and user name in your message.
Please do not reply to this message.
Thank you.
Vincenzo Mann
The Back Office
23 March 2016: backoffice_MJINV78470.rtf - Current Virus total detections 2/57*
.. MALWR** shows it downloads http ://wrkstn09.satbootcampaz .com/dana/home.php which delivered
runwithme.exe (VirusTotal 4/56***). This is the same downloaded malware as described HERE[1]... looks like a password stealer and Banking Trojan. It might be Dridex or might be Vawtrk[2]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d689c0db014d25539e9a80a9ce03ceafb13851e02d097a539453df6e15452767/analysis/1458739404/
** https://malwr.com/analysis/YjQwZDkyNDBmMjc4NGFjNDgzMjY2MjIwMWVjMmY1NTY/
Hosts
109.237.108.25: https://www.virustotal.com/en/ip-address/109.237.108.25/information/
>> https://www.virustotal.com/en/url/d773b7be2904e4b9e9822c278edc605fca05c281f9a2151af760d7f2c30e670d/analysis/
*** https://www.virustotal.com/en/url/d773b7be2904e4b9e9822c278edc605fca05c281f9a2151af760d7f2c30e670d/analysis/
1] https://myonlinesecurity.co.uk/your-latest-electronic-invoice-from-d-e-web-works-word-doc-rtf-macro-malware/
2] https://blogs.mcafee.com/mcafee-labs/w97m-downloader-serving-vawtrak/
:fear::fear: :mad:
AplusWebMaster
2016-03-24, 13:05
FYI...
Fake 'Your order' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-your-order-has-been.html
24 Mar 2016 - "This -fake- financial spam does -not- come from Axminster Tools & Machinery, but is instead a simple -forgery- with a malicious attachment:
From: customer.service@ axminster .co.uk
Date: 24 March 2016 at 10:11
Subject: Your order has been despatched
Dear Customer
The attached document provides details of items that have been packed and are ready for despatch.
Please use your tracking number (contained within the attached document) to monitor the progress of your shipment.
Customer Services ...
Attached is a file LN4244786.docm which comes in at least two different versions (VirusTotal results [1] [2]). Automated analysis is inconclusive.. however a manual analysis of the macros contained within.. show download locations at:
skandastech .com/76f45e5drfg7.exe
ekakkshar .com/76f45e5drfg7.exe
This binary has a detection rate of 6/56* and the Deepviz Analysis** and Hybrid Analysis*** show network traffic to:
71.46.208.93 (Bright House Networks, US)
64.76.19.251 (Level 3 Communications US, 64.76.19.251 / Impsat, Argentina)
91.236.4.234 (FHU Climax Rafal Kraj, Poland)
64.147.192.68 (Dataconstructs, US)
41.38.18.230 (TE Data, Egypt)
93.104.211.103 (Contabo, Germany)
159.8.57.10 (Kordsa Global Endustriyel Iplik, Turkey / SoftLayer Technologies, Netherlands)
82.144.200.154 (Kyivski Telekomunikatsiyni Merezhi LLC, Ukraine)
5.9.43.177 (Hetzner, Germany)
212.126.59.41 (LetsHost, Ireland)
It is not clear what the payload is here, but it is likely to be the Dridex banking trojan or possibly ransomware.
Recommended blocklist:
71.46.208.93
64.76.19.251
91.236.4.234
64.147.192.68
41.38.18.230
93.104.211.103
159.8.57.10
82.144.200.154
5.9.43.177
212.126.59.41 "
1] https://www.virustotal.com/en/file/81e779f07e4542adb67aca6403b909d887e48d80b1621eb031ef8593f0bc0f8b/analysis/
2] https://www.virustotal.com/en/file/34081b5dfce7debcaf802315fc1b7c306d908a479f7005db1c35bc19eebc2cb3/analysis/
* https://www.virustotal.com/en/file/9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813/analysis/1458816089/
** https://sandbox.deepviz.com/report/hash/54bdf65b31b894f10395a3781bd5c2f1/
*** https://www.hybrid-analysis.com/sample/9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813?environmentId=4
- https://myonlinesecurity.co.uk/axminster-tools-machinery-your-order-has-been-despatched-word-macro-malware/
24 Mar 2016 - "An email with the subject of 'Your order has been despatched' pretending to come from customer.service@axminster .co.uk with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: customer.service@ axminster .co.uk
Date: Thu 24/03/2016 08:43
Subject: Your order has been despatched
Attachment: LN4244786.docm
Dear Customer
The attached document* provides details of items that have been packed and are ready for despatch.
Please use your tracking number (contained within the attached document) to monitor the progress of your shipment.
Customer Services ...
24 March 2016: LN4244786.docm - Current Virus total detections 6/57*
.. Update: I have been reliably informed[1] that there are -several- versions of this macro word doc that will download Dridex from skandastech .com/76f45e5drfg7.exe -or- ekakkshar .com/76f45e5drfg7.exe
(VirusTotal 6/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/81e779f07e4542adb67aca6403b909d887e48d80b1621eb031ef8593f0bc0f8b/analysis/1458808762/
** https://www.virustotal.com/en/file/9570e8ec36c966432922969f8a948c5b55126e787d51ddb03f7ae71c40079813/analysis/1458814484/
1] https://twitter.com/ConradLongmore/status/712952076117155840
___
Fake 'Payment Receipt' SPAM - leads to Locky ransomeware
- http://blog.dynamoo.com/2016/03/malware-spam-fw-payment-receipt-from.html
24 Mar 2016 - "This -fake- financial spam comes from random recipients, for example:
From: Marta Wood
Date: 24 March 2016 at 10:10
Subject: FW: Payment Receipt
Dear [redacted],
Thank you for your payment. It is important that you print this receipt and record the receipt number as proof of your payment.
You may be asked to provide your receipt details should you have an enquiry regarding this payment.
Regards,
Marta Wood
Technical Manager - General Insurance
Attached is a ZIP file that incorporates the recipients name plus a word such as 'payment, details or receipt' plus a random number. This achive contains a randomly-named script (starting with "PM") and ending with .js.js plus which appear to be a set of hidden .BIN files which may well be junk. VirusTotal detection rates for the scripts are fairly low (examples [1] [2]..). Automated analysis [7] [8].. shows binary download locations at:
stie.pbsoedirman .com/msh4uys
projectpass .org/o3isua
natstoilet .com/l2ps0sa [404]
yourhappyjourney .com/asl2sd [404]
Two of locations are 404ing, the two that work serve up a different binary each. There are probably many more download locations and more binaries... The VirusTotal results for the binaries [19] [20] indicate that this is ransomware, specifically it is Locky. Automated analyses [21] [22].. show it phoning home to:
195.123.209.123 (ITL, Latvia)
107.181.187.228 (Total Server Solutions, US)
217.12.218.158 (ITL, Netherlands)
46.8.44.39 (PE Dunaeivskyi Denys Leonidovich, Ukraine)
... Recommended blocklist:
195.123.209.123
107.181.187.228
217.12.218.158
46.8.44.39 "
1] https://www.virustotal.com/en/file/82e3d21095510ae2eeb4dce35b2f2440a6cd4c8ca8165b1cf5ce6f03aa7535ca/analysis/
2] https://www.virustotal.com/en/file/41e89a0cd4aa3c72f81ad39a4f30189ed66bd3bc9a00641ee8a1b7cdca55d183/analysis/1458819009/
7] https://malwr.com/analysis/ODg1YzdiMWM5ZmYzNDBhYTgzM2M1MDZhNTEzYmI0ZTE/
8] https://malwr.com/analysis/NDg0ODM1YmM0ZmFiNDg0OWI2NGE0YTgzZjc0NWFiYjk/
19] https://www.virustotal.com/en/file/0ed54dea56d4258e56ccf9bd8dcca13c561ad94c994835a603c10638b3c083d9/analysis/1458819857/
20] https://www.virustotal.com/en/file/bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336/analysis/1458819870/
21] https://sandbox.deepviz.com/report/hash/f5d668c551cecb12f6404214fb0c8251/
22] https://sandbox.deepviz.com/report/hash/ae5bffeb730c4488419067322c7906b0/
___
Fake 'Attached docs' SPAM - JS malware
- https://myonlinesecurity.co.uk/attached-documents-afifa-shohab-js-malware/
24 Mar 2016 - "An empty-blank-email with the subject of 'Attached document(s)' pretending to come from Afifa Shohab <afifashohab4650@ gmail .com> with a zip attachment is another one from the current bot runs... The email looks like:
From: Afifa Shohab <afifashohab4650@ gmail .com> [random numbers after the afifashohab]
Date: Thu 24/03/2016 12:58
Subject: Attached document(s)
Attachment: mygov_0239769.zip
Body content: empty
Some of these emails are coming in as working emails and displayed properly with a working attachment, others are misconfigured and corrupt... Screenshot:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Attached-documents-1024x710.png
24 March 2016: mygov_0239769.zip: Extracts to: UQF2157341011.js - Current Virus total detections 3/56*
... from http ://tijuanametropolitana .com/3476grb4f434r.exe (VirusTotal 4/56**) which is the -same- malware as described HERE[3]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/f8d1d70c79b1a41715093e1096082e07a00d394b77c559ab278e8f7435ee6809/analysis/1458826227/
** https://www.virustotal.com/en/file/e0f73a587a83d293457f000ea4680576c889038634e5ca5a882f521002ab6506/analysis/1458825187/
TCP connections
46.8.44.39: https://www.virustotal.com/en/ip-address/46.8.44.39/information/
>> https://www.virustotal.com/en/url/d3d87b354d6e92a7e8da42d3b8488aca7aa8ac7c764c864b7ef584652109fc5d/analysis/
3] https://myonlinesecurity.co.uk/monica-schiavone-fattura-n-6284053f-del-23032016-js-malware/
24 March 2016: FT6284053.zip: Extracts to: XUY9156182001.js - Current Virus total detections 3/57*
.. download from http ://akalbatu .com/3476grb4f434r.exe (VirusTotal 3/57**) ... likely to be either Dridex or Locky ransomware..."
* https://www.virustotal.com/en/file/b4e96cd890a8be0aa2a9f1185f02a83958234266782932c497b0b849f128105d/analysis/1458822000/
** https://www.virustotal.com/en/file/e0f73a587a83d293457f000ea4680576c889038634e5ca5a882f521002ab6506/analysis/1458822302/
TCP connections
46.8.44.39: https://www.virustotal.com/en/ip-address/46.8.44.39/information/
>> https://www.virustotal.com/en/url/d3d87b354d6e92a7e8da42d3b8488aca7aa8ac7c764c864b7ef584652109fc5d/analysis/
___
Fake 'Sixt Invoice' SPAM - word macro malware
- https://myonlinesecurity.co.uk/sixt-invoice-0252056792-from-24-03-2016-word-macro-malware
24 Mar 2016 - "An email with the subject of 'Sixt Invoice: 0252056792' from 24.03.2016 (random numbers) pretending to come from random, names, companies and email addresses with a malicious word doc attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Sixt-Invoice-0252056792-from-24032016-1024x780.png
24 March 2016: Sixt_receipt_49200616.doc - Current Virus total detections 2/56*
.. downloads from http ://web-intra.fhc-inc .org/live/essentials.php which gave me
65a7fwgybid.xls (VirusTotal 5/56**) which is actually an .exe file -not- an XLS excel spreadsheet -despite- the file name & icon... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a77391be525fbb07bf36f38a8c82bb34f2c641b01f9e9f4cac209725078d6dbd/analysis/1458833067/
** https://www.virustotal.com/en/file/a0b483f09b4b0d63fc285a884e7b4b64e057345aaff41ce726ba9067c67eb276/analysis/1458832875/
> https://www.hybrid-analysis.com/sample/49e78fedd58dc44feda7a6b02d833011e51a2a7633fa673fe80ef4b0ad483e7e?environmentId=4
Sixt_receipt_15768471.doc
Contacted Hosts
92.63.100.7: https://www.virustotal.com/en/ip-address/92.63.100.7/information/
>> https://www.virustotal.com/en/url/255559e89a5ca094043d37df6562a46b68f7fdd2c97e9b6d3718bcdf70eac558/analysis/
38.64.199.113: https://www.virustotal.com/en/ip-address/38.64.199.113/information/
>> https://www.virustotal.com/en/url/f2f38bdc125673cb530d1c3aeb0ab974dc2f27f9ca9be0e421db1cdfaaaf2a17/analysis/
79.124.67.226: https://www.virustotal.com/en/ip-address/79.124.67.226/information/
>> https://www.virustotal.com/en/url/c1f94f368f78cdce83e48a155e842137650fc37e5d1f5f7b9b40ca415dcc1e3c/analysis/
222.255.121.202: https://www.virustotal.com/en/ip-address/222.255.121.202/information/
>> https://www.virustotal.com/en/url/428dc7720846073700c9293755ecc85aaf1bdaa09d653d89a7ed761b94377124/analysis/
47.88.191.14: https://www.virustotal.com/en/ip-address/47.88.191.14/information/
>> https://www.virustotal.com/en/url/ffa23ab9439970c813c9a3862a5c38a2d21bbeaa843d0edf867e9fb8f26f7417/analysis/
197.96.139.253: https://www.virustotal.com/en/ip-address/197.96.139.253/information/
>> https://www.virustotal.com/en/url/790ee863b6cefcf1ae0438fd64e2c3d73dcc78186d88dd5e18e42cc763867c24/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-03-25, 17:23
FYI...
Fake 'Invoice Copy' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/fw-invoice-copy-pretending-to-come-from-a-random-or-unknown-name-at-your-own-email-address-js-malware-leads-to-locky-ransomware/
25 Mar 2016 - "Although it is Good Friday... the Locky ransomware campaign continues unabated with an email with the subject of 'FW: Invoice Copy' pretending to come from a random or unknown name at your own email address with a zip attachment is another one from the current bot runs which downloads Locky ransomware...One of the emails looks like:
From: Stacie Tucker <fax@ [redacted] .co.uk> [Your own email address]
Date: Fri 25/03/2016 09:03
Subject: FW: Invoice Copy
Attachment: copy-fax_323571.zip
Dear fax,
Please review the attached copy of your Invoice (number: IN323571) for an amount of $4031.15.
Thank you for your business.
Stacie Tucker
Director, Digital Communications
25 March 2016: copy-fax_323571.zip: Extracts to: PMTac2edf.js.js Current Virus total detections 1/58*
.. MALWR** shows a download of Locky ransomware from
http ://holidaysinkeralam .com/ke4uad (VirusTotal 6/58***). Other download locations so far discovered include:
http ://goldenlifewomen .com/o3isvs (VT[1])
http ://fssblangenlois .ac.at/k3idv (VT[2])
http ://warrendotwarren .url.ph/ldpeo3s (VT[3])
... more detailed breakdown, including the multitude of hosts and differing file #’s delivering today’s malware can be found HERE[4] courtesy of Techelplist. This zip file contains 2 js files and 3 dat files that when examined is actually -empty- ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/984496a1d3bba88423f1abdb3d4c2c34fa27d73f14340d34f3254d0304651fdc/analysis/1458900076/
** https://malwr.com/analysis/ZTJkMDAwZGM1MWU1NDdkMDhlZTEyYzk4NzgwNGM2MmQ/
Hosts
184.168.47.225
93.170.104.127
*** https://www.virustotal.com/en/file/7aa76139ea1e38ad8d7ae0ed84d55a4160798e65f43cea82c59985de3ef2959e/analysis/1458901000/
TCP connections
89.108.84.132
1] https://www.virustotal.com/en/file/b543789b00c268fec6fa4211384fd986cac592850802e10fb4bd2dd370e6b1b7/analysis/1458910253/
TCP connections
185.117.72.94
2] https://www.virustotal.com/en/file/d1af156066b824bba171807c8a0b790f6b7185104ee8281449e70d73c441d61e/analysis/1458910585/
TCP connections
89.108.84.132
3] https://www.virustotal.com/en/file/827e72f800252eb3917d4284a4e4741fcf77bc93b79f5bba8e296c777901a0d6/analysis/1458911035/
TCP connections
185.117.72.94
4] https://otx.alienvault.com/pulse/56f53ab04637f23a0c0f414d/
:fear::fear: :mad:
AplusWebMaster
2016-03-28, 12:22
FYI...
Fake 'Overdue Incoices' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/fw-overdue-incoices-js-malware-leads-to-locky-ransomware/
28 Mar 2016 - "... mispelled subject of 'FW: Overdue Incoices' pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Boyce Day <DayBoyce99@ armadev .com>
Date: Mon 28/03/2016 09:09
Subject: FW: Overdue Incoices
Attachment: sexy123_copy_489051.zip
Dear sexy123,
Please find attached copy updated statement as your account has 3 overdue incoices.
Is there any reasons why they haven’t yet been paid?
Best Wishes,
Boyce Day
Vice President Finance
28 March 2016: sexy123_copy_489051.zip: Extracts to: SCN734815.txt.js - Current Virus total detections 2/58*
.. MALWR** and Hybrid Analysis[3] show a download of Locky ransomware from
http ://www.suansawanresort .com/n7eua (VirusTotal 6/58[4])
Other download locations so far discovered include
http ://bbwsa .com/m7rysa
http ://dukeplasticslab .com/j47akfa
http ://foothillsofhemet .com/k4sifs
http ://www.stopeugenicsnow .eu/m8dhs
http ://blackmountaintipis .com/mxn3aad
This zip file contains 3 js files and 3 unknown files that when examined is actually empty (full of 0 byte padding, actually a mix of 0 & 1)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4ede8c3525fdef2dc3e438f98b3a3b84c7eb5d54c9da6c99e7cd3dcc4f0c7ac7/analysis/1459152409/
** https://malwr.com/analysis/OTkxYzNjYjkzNTE2NDc3Nzk2MmYxNjcyZGJiYmJmOTY/
Hosts
192.254.235.178
84.19.170.249: https://www.virustotal.com/en/ip-address/84.19.170.249/information/
>> https://www.virustotal.com/en/url/014eea084d6b8fde914c7f08d3653f8e37a3f4b62ffb9737b4a86586430fcd59/analysis/
3] https://www.reverse.it/sample/4ede8c3525fdef2dc3e438f98b3a3b84c7eb5d54c9da6c99e7cd3dcc4f0c7ac7?environmentId=4
Contacted Hosts
192.254.235.178
92.63.87.134: https://www.virustotal.com/en/ip-address/92.63.87.134/information/
>> https://www.virustotal.com/en/url/aaba87e8e760452b4f41d28a39d2c8a97367453700246561d06932971020cae1/analysis/
4] https://www.virustotal.com/en/file/4740ce61f6233e4e5b0e98e1a2ecdedf0959513377a24aaefb9fab696f15dc98/analysis/1459152904/
TCP connections
78.46.170.79
___
Fake 'FW:' attached invoice SPAM - JS leads to Locky Ransomware
- https://myonlinesecurity.co.uk/please-see-the-attached-invoice-and-remit-payment-js-malware
28 Mar 2016 - "... an email with the subject of 'FW:' pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads... Locky Ransomware... The email looks like:
From: Random senders
Date: Mon 28/03/2016 09:47
Subject: FW:
Attachment: copy_ellie_734294.zip
Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice.
If you have any questions please let us know.
5 March 2016: copy_ellie_734294.zip: Extracts to a folder named 'warning' which contains -2- files both appearing to have -same- content although different file # ticket_613588769.js VT 0/57[1] and
125_ticket_942667766.lib VT 0/57[2]. MALWR[3] shows a download from
http ://twocircles .in/HwgIY9 .exe (VirusTotal 5/58[4]) which is inconclusive in detections but MALWR[5] shows contacts of innocent files from Microsoft Update. Hybrid analysis[6] definitely shows Locky Ransomware...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://www.virustotal.com/en/file/9a7b55bc36578804cc6515109c711f3e5b5e481ee03857064abd536ade8155c5/analysis/1459155351/
2] https://www.virustotal.com/en/file/42de90a60b552419f248d4c4d7ef16be128349667af141b7be2f530d1718d4cf/analysis/1459155491/
3] https://malwr.com/analysis/OWMxMWZmNTMxZGU0NDM5MWJiZGM0ZjIxZWRiMWFhNDg/
4] https://www.virustotal.com/en/file/04dfa6fccc1be871aaee0ae3e2ad0aee7e249a7d29b991f7fcaeedfe9bf53f66/analysis/1459155069/
5] https://malwr.com/analysis/MDg4NmQ1M2ZlOTU4NDE2Zjk2MDUyYmEzMjMwY2ZjYjc/
Hosts
184.25.56.84
6] https://www.hybrid-analysis.com/sample/9a7b55bc36578804cc6515109c711f3e5b5e481ee03857064abd536ade8155c5?environmentId=4
Contacted Hosts
66.160.196.39: https://www.virustotal.com/en/ip-address/66.160.196.39/information/
>> https://www.virustotal.com/en/url/693929aa527b7f2e2f48521a699808e83bcb6759f4807eadc04c89fa2beb153c/analysis/
83.217.8.127
___
Fake 'Document(1).pdf' SPAM - JS malware leads to ransomware
- https://myonlinesecurity.co.uk/document-1-pdf-pretending-to-come-from-netadmin-nadiam1payour-email-domain-js-malware-leads-to-ransomware/
28 Mar 2016 - "An email that tries to make you think it is coming from your own email domain/company with the subject of 'Document(1).pdf' pretending to come from netadmin <nadiam1pa@ your email domain .tld> with a zip attachment is another one from the current bot runs which downloads some sort of ransomware... The email looks like:
From: netadmin <nadiam1pa@ your email domain .tld>
Date: Document (1).pdf
Subject: Document (1).pdf
Attachment: Document (1).zip
Document (1).pdf
28 March 2016: Document (1).zip: Extracts to: FDV4328982511.js - Current Virus total detections 7/57*
.. MALWR** shows a download of this ransomware file from
http ://store.brugomug .co.uk/765f46vb.exe (VirusTotal 3/58***) MALWR[4]...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/b081ff9bf38887b6d66547736d05dae0998e156fc4b0e6ec6408dc68ab811252/analysis/1459173075/
** https://malwr.com/analysis/ODEzODQwZDhhNmZjNDUyMjgzOWE5ZDY4NzIxNjg0YzA/
Hosts
50.56.106.21
84.19.170.249: https://www.virustotal.com/en/ip-address/84.19.170.249/information/
>> https://www.virustotal.com/en/url/15cccf9c710bc622eca932534485df85fb55d7fe060ad183840af230b27d2673/analysis/
*** https://www.virustotal.com/en/file/697ce53503dc8f28b6f9603563181f33d7ef840e8993313d15d5dc4914bfdb31/analysis/1459171814/
TCP connections
91.200.14.73
4] https://malwr.com/analysis/Y2FmMTY2NjhlMWJhNDQxMjg1YzFiZGI3YTJhNzk5NDE/
Hosts
91.200.14.73: https://www.virustotal.com/en/ip-address/91.200.14.73/information/
>> https://www.virustotal.com/en/url/261e41803a4d3d573dac5dcd1bd45b216385cb557e36ca8e05b78dd7b43adf21/analysis/
store.brugomug .co.uk: 50.56.106.21: https://www.virustotal.com/en/ip-address/50.56.106.21/information/
>> https://www.virustotal.com/en/url/4ab770fd6b4af7e3b7a1f91d93d5fc7473b1bad220640c9f97ca5b0d8df4778e/analysis/
___
Fake 'invoice' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/random-company-invoice-word-doc-macro-malware/
28 Mar 2016 - "An email with the subject of [random company name] 'invoice' – [recipient domain] pretending to come from random senders with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... One of the emails looks like:
From: Random senders
Date: Mon 28/03/2016 16:04
Subject: CERAMIC FUEL CELLS Invoice ...
Attachment: Invoice Number 1460847 – Issue Date 02166113.rtf
Sent from my iPad
Begin forwarded message:
Thank you for choosing CERAMIC FUEL CELLS! We hope you enjoy our new invoice format. In our effort to be more environmentally friendly, our new invoice saves paper yet provides all of the same information in a more condensed format. Please let us know if you have any questions or concerns.
28 March 2016: Invoice Number 1460847 – Issue Date 02166113.rtf - Current Virus total detections 4/57*
.. MALWR shows a download from
http ://store.clarksvillevw .com/smartphones/iphonese.php which gave me 122.wav which is -NOT- a wav file despite appearing to be able to be played in windows explorer - but is a renamed .exe file
(VirusTotal 3/58**). This will probably turn out to be either Dridex or Locky ransomware, but analysis is pending...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6bbc8bf6f849ee7aed9ce9f9ea46c3e458d53a997d44c5b258abb3e61dd373a8/analysis/1459177325/
** https://www.virustotal.com/en/file/12ff8aa8f9319b87a70835670c97205be8ed81e859c78a0b5e37b724a9c52554/analysis/1459177386/
store.clarksvillevw .com: 185.118.166.167: https://www.virustotal.com/en/ip-address/185.118.166.167/information/
>> https://www.virustotal.com/en/url/f2a69acf2e6a0549a611fb3f0cdf61559eb159ecf47f2945d3b721415600987c/analysis/
___
Fake 'TERREDOC' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-envoi-dun-message-9758w.html
28 Mar 2016 - "This French-language -spam- comes with a malicious attachment:
From: Christine Faure [c.faure@ technicoflor .fr]
Date: 28 March 2016 at 16:54
Subject: Envoi d’un message : 9758W-TERREDOC-RS62937-15000
Votre message est prêt à être envoyé avec les fichiers ou liens joints suivants :
9758W-TERREDOC-RS62937-15000
Message de sécurité
To save you putting it into 'Google Translate', the body text reads:
'Your message is ready to be sent with the following file or link attached'...
Attached is a file 9758W-TERREDOC-RS62937-15000.zip which comes in at least -eight- different versions each containing a -different- malicious-script (VirusTotal results [1] [2]... The Malwr reports for those samples [9] [10]... show a malicious binary downloaded from:
store.brugomug.co.uk/765f46vb.exe
ggbongs .com/765f46vb.exe
dragonex .com/765f46vb.exe
homedesire .co.uk/765f46vb.exe
scorpena .com/765f46vb.exe
pockettypewriter .co.uk/765f46vb.exe
enduro .si/pdf/765f46vb.exe
185.130.7.22 /files/qFBC5Y.exe
Note that the last file is not like the others. There may be other download locations. The "765f46vb" binary has a detection rate of 4/57* and according to all those previous reports... the malware phones home to:
83.217.8.127 (Park-web Ltd, Russia)
84.19.170.249 (300GB.ru, Russia / Keyweb, Germany)
185.117.72.94 (Host Sailor, Netherlands)
91.200.14.73 (SKS-Lugan, Ukraine)
92.63.87.134 (MWTV, Latvia)
176.31.47.100 (OVH, Germany / Unihost, SC)
All of those look like pretty shady neigbourhoods, although I haven't examined them closely at this point. The payload is the Locky ransomware. The other binary appears to be -another- version of Locky which appears to phone home to the -same- servers.
Recommended blocklist:
83.217.8.127
84.19.170.249
185.117.72.94
91.200.14.73
92.63.87.134
176.31.47.100 "
1] https://www.virustotal.com/en/file/658a5f31c3128ad46d73372b5e78880277eef0d3f0002f77b90dc44882fa0b48/analysis/
2] https://www.virustotal.com/en/file/6b551ecaa317a976a2ab5a7470bc6afe19a6e7a55ffb66f45e00ca4e590d24c8/analysis/1459182332/
9] https://malwr.com/analysis/NjFiZGRjNzIyMmFiNDg0NGFmNTcyYjE2NjAxYjQ1NTY/
Hosts
77.234.131.73
109.235.139.64
185.130.7.22
10] https://malwr.com/analysis/YmE5ZmU2ZTZiZTgyNGY4YWFiNWVkYmM2ZmE1NmI1MjI/
Hosts
50.56.106.21
83.217.8.127
* https://www.virustotal.com/en/file/697ce53503dc8f28b6f9603563181f33d7ef840e8993313d15d5dc4914bfdb31/analysis/
TCP connections
91.200.14.73
:fear::fear: :mad:
AplusWebMaster
2016-03-29, 13:48
FYI...
Fake 'Credit Card Declined' SPAM - JS malware
- https://myonlinesecurity.co.uk/credit-card-has-been-declined-9764-js-malware/
29 Mar 2016 - "An email with the subject of 'Credit Card Has Been Declined *9764' [random numbered] pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads what looks like it is supposed to be locky ransomware... The email looks like:
From: Shirley brackenbury <brackenburyShirley12280@ covertech .com.br>
Date: Tue 29/03/2016 10:03
Subject: Credit Card Has Been Declined *9764
Attachment: copy_ellie_631312.zip
Your credit card has been declined, cancellation notice is enclosed down below.
29 March 2016: copy_ellie_631312.zip: Extracts to: info_614949608.js and a copy named 290_info_571294222.lib
Current Virus total detections 0/58*. MALWR** shows an attempted download from
http ://teknosolar .com/CLVrSc.exe which is currently giving a 404 not found...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c3f84c85f42cefe29e914bd042c79d5aaaaba191da1b87310cb3038f35e4a1b6/analysis/1459242165/
** https://malwr.com/analysis/MzM3M2FlMWRmN2M3NGU4Zjg2MzczYzRkZGZkYzgwNzM/
Hosts
185.18.196.201: https://www.virustotal.com/en/ip-address/185.18.196.201/information/
>> https://www.virustotal.com/en/url/7abcdf6419b7abd10b56f5b9fd54ec381781d46a714495e65a7a623910737dba/analysis/
___
Fake 'Payment' SPAM – doc macro malware
- https://myonlinesecurity.co.uk/emerson-sherman-payment-word-doc-macro-malware/
29 Mar 2016 - "An email with the subject of [random name] 'payment/invoice/report/message/Transaction' pretending to come from the same random name but a totally different email address with a random numbered malicious word doc attachment is another one from the current bot runs... One of the emails looks like:
From: Emerson Sherman <accounts@ rapicutcarbides .com>
Date: Tue 29/03/2016 05:10
Subject: Emerson Sherman. Payment
Attachment: 14385.doc
Good day
I hope you had a good weekend.
Please find the payment confirmation enclosed with this email. The Transfer should appear on your bank within 1 day.
Thanks
Emerson Sherman
29 March 2016: 14385.doc - Current Virus total detections 8/58[1] 7/57[2]
.. Payload Security* shows a download from http ://www .setabayloan .com/sg1.jpg?YSbs= which gave 585816.exe
(VirusTotal 9/57**) and is definitely Dridex banking Trojan. This Dridex affiliate uses jpg images on a website that the macro decodes and extracts the .exe file. That way a victim only sees the genuine image in their temp folders or briefly displayed...
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/setabayloan.png
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
1] https://www.virustotal.com/en/file/f95a39d2044a1822457c12d35feb0b4236821b5cea50477cbffda7d9f08f135f/analysis/1459229375/
2] https://www.virustotal.com/en/file/ef3ce8ec9346fa3e54f7094a89883150192e744dc48f172fb032317a157fd1c5/analysis/1459226242/
* https://www.reverse.it/sample/ef3ce8ec9346fa3e54f7094a89883150192e744dc48f172fb032317a157fd1c5?environmentId=4
Contacted Hosts
129.121.192.16: https://www.virustotal.com/en/ip-address/129.121.192.16/information/
>> https://www.virustotal.com/en/url/2d68023c99cfcbc22a083533949fc5fd30ca6ea230ae2d4c71f8a215ce8765d7/analysis/
87.117.242.13
** https://virustotal.com/en/file/07b6bc43f3625aff27b3d0849e02817032c3d24a2a302365bfabf55f2db58d7e/analysis/
___
Fake 'New Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/03/malware-spam-re-new-order-p2016280375.html
29 Mar 2016 - "This -fake- financial spam comes with a malicious attachment:
From: Rose Lu [salesdeinnovative@ technologist .com]
Date: 29 March 2016 at 02:30
Subject: Re: New Order P2016280375
Good Day,
Please find enclosed our new order P2016280375 for your kind attention and prompt execution.
I look forward to receiving your order acknowledgement in due course.
Best regards
Rose Lu
Office Manager
Suzhou Eagle Electric Vehicle Manufacturing Co., Ltd.
Add: No.99, Yin Xin Road, Guo Xiang Town, Suzhou, China ...
Attached is a file New Order P201628037.docx which I have seen a single variant of, with a VirusTotal detection rate of 8/58*. The Malwr report** is inconclusive, but does appear to to show an OLE embedded object within the Word document. There are some interesting strings near the beginning of the object..
Crypted.exe
C:\Users\user\Desktop\Crypted.exe
C:\Users\user\AppData\Local\Temp\Crypted.exe
So, this looks like ransomware. Some inexpert fiddling with the contents of the OLE file yields an executable, and automated reports [1] [2] [3] show network traffic to the domain marchborn .no-ip .biz hosted on: 105.112.39.114 (Airtel, Nigeria)
I strongly recommend that you -block- traffic to that IP. In fact, the entire very large 105.112.0.0/12 is very sparsely populated and contains a small handful of legitimate Nigerian domains plus a load of Dynamic DNS domains (I've recommended blocking those before***) so you might want to consider -blocking- those too."
* https://www.virustotal.com/en/file/6af0091bbdcf58d5dd5c92326d3d2248a9c7c7eeaef1b8ac6b9b126cdb02ece1/analysis/
** https://malwr.com/analysis/ZjEwNzIzMmRlYjdmNDA0NmI5ZmRhNTYyMzE1MTYzZTk/
1] https://malwr.com/analysis/NTM5OTY3ZThmZDE0NDgyNzk5NTk2MDgzODViNmE5ZGY/
Hosts
105.112.39.114
2] https://www.hybrid-analysis.com/sample/c1acef584237338ab563b2fbfb2ab17c679f4c2186e8ac443271cffff9647749?environmentId=1
Contacted Hosts
105.112.39.114
3] https://sandbox.deepviz.com/report/hash/126a5f535909881c668ab956bb66e3c0/
*** http://blog.dynamoo.com/2013/11/dynamic-dns-sites-you-might-want-to.html
___
Fake 'Sent from my iPhone' SPAM - leads to Locky ransomware
- http://blog.dynamoo.com/2016/03/malware-spam-cce2903201600034-sent-from.html
29 Mar 2016 - "... These spam emails look like the victim is sending them to themselves (but they aren't*). Reference numbers vary a little between emails, but the basic pattern is:
From: victim
To: victim
Date: 29 March 2016 at 17:50
Subject: CCE29032016_00034
Sent from my iPhone
Attached is a RAR archive with a name that matches the subject (e.g. CCE29032016_00034.rar) and this contains a malicious .js file that leads to Locky ransomware. My contact tells me that the download locations in the scripts are:
3r .com .ua/ty43ff333.exe
canadattparts .com/ty43ff333.exe
chilloutplanet .com/ty43ff333.exe
gazoccaz .com/ty43ff333.exe
hindleys .com/ty43ff333.exe
jeweldiva .com/ty43ff333.exe
kandyprive .com/ty43ff333.exe
labonacarn .com/ty43ff333.exe
silvec .com/ty43ff333.exe
tbde .com .vn/ty43ff333.exe
zecapesca .com/ty43ff333.exe
This payload has a detection rate of 4/56**. The malware calls back to:
84.19.170.249 (Keyweb, Germany / 300GB.ru, Russia)
5.135.76.18 (OVH, France / Bondhost, Montenegro)
109.234.35.128 (McHost, Russia)
McHost is almost purely a black-hat ISP in my opinion and should be blocked-on-sight.
Recommended blocklist:
84.19.170.249
5.135.76.18
109.234.35.0/24 "
* http://blog.dynamoo.com/2011/09/why-am-i-sending-myself-spam.html
** https://www.virustotal.com/en/file/6390fe21523e9371923a9d2e00dc156087a57a4139fe714fd642cc0d17176760/analysis/
TCP connections
84.19.170.249: https://www.virustotal.com/en/ip-address/84.19.170.249/information/
>> https://www.virustotal.com/en/url/014eea084d6b8fde914c7f08d3653f8e37a3f4b62ffb9737b4a86586430fcd59/analysis/
5.135.76.18: https://www.virustotal.com/en/ip-address/5.135.76.18/information/
>> https://www.virustotal.com/en/url/ab8e6fa8521a4c54228b36afbe2f16a682bb344e3bced0954b92a6efe41b5e43/analysis/
109.234.35.128: https://www.virustotal.com/en/ip-address/109.234.35.128/information/
>> https://www.virustotal.com/en/url/aeff6aaddbf9f3837d06de737083e61231d67f6f929d2fcca09e18998f2fc893/analysis/
___
Locky ransomware downloads -hijacked- by vigilante - delivering Eicar test file...
- https://myonlinesecurity.co.uk/locky-ransomware-downloads-hijacked-by-vigilante-and-delivering-eicar-test-file-instead/
29 Mar 2016 - "Another set of -empty/blank- emails that pretend to come from your own email address. This particular bunch have multiple subjects but all starting with 'CCE29032016' and attachments that also start with 'CCE29032016'. Some of the subjects and attachments I have seen include:
CCE29032016_00095.jpg
CCE29032016_00065.docx
CCE29032016_00067.tiff
CCE29032016_00050.pdf
CCE29032016_00002.gif
These are obviously designed to make you think they are coming from a printer, scanner or Multi-functional device on your network. They are -not- image or word files despite the extensions and icons saying they are:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/fake-files.png
These attachments are -not- what they appear to be and are actually renamed zip files with the icons of the files they pretend to be, containing a js file. These files download what is -supposed- to be Locky ransomware from several locations. The ones I have discovered so far include:
http ://chilloutplanet .com/ty43ff333.exe
tbde. com .vn/ty43ff333.exe
canadattparts .com/ty43ff333.exe
... add to the twist all the files that I have seen are -not- Locky ransomware but instead all of these already compromised sites have been discovered by what we think is a “white hat” hacker vigilante who has replaced the locky files with a “safe” file that contains the words 'STUPID LOCKY' then a load of symbols that I won’t post here and EICAR-STANDARD-ANTIVIRUS-TEST-FILE. This would or should be flagged by EVERY antivirus in existence as the Eicar test file (and for that reason I will not post it even in plain text, because many antiviruses would immediately block access to this site). See screenshot:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/stupid-locky.png
It looks like most 'victims' will have been lucky this time, although I am sure there will be some sites in this malspam run that didn’t get discovered by the vigilante and -continue- to infect victims... -Never- attempt to open a zip directly from your email, that is a guaranteed way to get infected. The best way is to just -delete- the unexpected zip and not risk any infection."
chilloutplanet .com: 109.71.69.138: https://www.virustotal.com/en/ip-address/109.71.69.138/information/
tbde. com .vn: 162.243.4.79: https://www.virustotal.com/en/ip-address/162.243.4.79/information/
canadattparts .com: 104.131.133.51: https://www.virustotal.com/en/ip-address/104.131.133.51/information/
>> https://www.virustotal.com/en/url/53b496d9f44dcb8968e1ebbb644285c7b3548272524e9f92074266a8b0b00c4d/analysis/
___
'Petya' ransomware encrypts files, disks, locks users out of computers
- https://www.helpnetsecurity.com/2016/03/29/petya-ransomware-locks-computers/
March 29, 2016 - "A -new- type of ransomware does not only encrypt the victims’ files, but also their disk’s Master File Table (MFT), and it replaces the boot drive’s existing Master Boot Record (MBR) with a malicious loader. It makes the entire computer -unusable- until the ransom is paid or until the victims decide to cut their losses, repair the MBR themselves, and reinstall Windows. The ransomware is called Petya, and is currently being delivered via spear-phishing campaigns aimed at German companies’ HR departments. The -fake- emails are made to look like they are coming from a legitimate job seeker, and instruct the recipient to download the sender’s CV from a Dropbox account. If the recipient falls for the trick, downloads the file, fails to notice that it’s an executable and runs it, the computer will crash because Petya overwrites the MBR of the entire hard drive. The computer will then show the infamous “Blue Screen of Death,” and reboot. The next thing the victim sees is a -fake- CHKDSK notice:
> https://www.helpnetsecurity.com/images/posts/fake-chkdsk.jpg
GData researchers have examples* of the spear-phishing emails, and a video of Petya in action. Trend Micro researchers confirmed** that the ransomware encrypts both part of the disk and victims’ files. They have also notified Dropbox of the fact that their service is being used to propagate the malware, and the company has removed the malicious file along with other links that stored the same file. The malware doesn’t allow the user to restart the computer in Safe Mode. According to Bleeping Computer’s Lawrence Abrams, there is currently no way to restore the files without paying the ransom, nor to decrypt the MFT. Users can repair the MBR and reinstall Windows, but all their files will be lost..."
* https://blog.gdatasoftware.com/2016/03/28213-ransomware-petya-encrypts-hard-drives
** http://blog.trendmicro.com/trendlabs-security-intelligence/petya-crypto-ransomware-overwrites-mbr-lock-users-computers/
Video 0:51 > http://arstechnica.com/security/2016/03/new-ransomware-installs-in-boot-record-encrypts-hard-disk/
:fear::fear: :mad:
AplusWebMaster
2016-03-30, 11:41
FYI...
- https://atlas.arbor.net/briefs/index#-318909613
"... At the present, Locky developers are completely reliant upon some level of user interaction. Educating your workforce on potential threats and the overall threat vectors is still the best way to inhibit threats like Locky."
Fake 'Additional Info' SPAM - leads to ransomware
- http://blog.dynamoo.com/2016/03/malware-spam-additional-information.html
30 Mar 2016 - "This spam has a malicious attachment, leading to ransomware.
From: Joe holdman [holdmanJoe08@ seosomerset .co.uk]
Date: 30 March 2016 at 08:55
Subject: RE: Additional Information Needed #869420
We kindly ask you to provide us additional information regarding your case.
Please find the form attached down below.
The reference number varies in the subject. The attachment is a ZIP file containing elements of the recipients email address and words like "copy" or "invoices" plus a random number. These unzip into a folder called "letter" to give a .js file beginning with "letter_" and a .wrn file which also appears to be a script but which won't run by default. An analysis of three scripts [1] [2] [3] shows binary downloads from:
cainabela .com/zFWvTM.exe
downloadroot .com/vU4VAZ.exe
folk.garnet-soft .com/jDFXfL.exe
This binary has a detection rate of 6/56*. Automated analysis [4] [5] shows network traffic to:
93.170.131.108 (Krek Ltd, Russia)
5.135.76.18 (OVH, France / Bondhost, Montenegro)
82.146.37.200 (TheFirst-RU, Russia)
These characteristics are consistent with Locky ransomware.
Recommended blocklist:
93.170.131.108: https://www.virustotal.com/en/ip-address/93.170.131.108/information/
>> https://www.virustotal.com/en/url/cda32b2001aacb10527b2d758453d5145fb16132bf914034cce9da36dfa9c486/analysis/
5.135.76.18: https://www.virustotal.com/en/ip-address/5.135.76.18/information/
>> https://www.virustotal.com/en/url/7d22cc46cb5e0eee8a0596146f450b0b9b8e049a8d1605f590871bba6b2227df/analysis/
82.146.37.200: https://www.virustotal.com/en/ip-address/82.146.37.200/information/
>> https://www.virustotal.com/en/url/6a0d69b6fd2046eec75fe33d02062d7a4d5b05dd3ca0f00d6f6c06acf91cbbd2/analysis/
"
1] https://www.virustotal.com/en/file/b555805e561b19c0bb3fbcbabf3632e19d124e4e0ebd09df373b96ed9ef12a62/analysis/1459325489/
2] https://www.virustotal.com/en/file/378ee2c274adfa64ba3468f934ad8d261180932a6d00ac2e4a5087e19628a0d2/analysis/1459325501/
3] https://www.virustotal.com/en/file/81db1f29972812dcca419bc502545916be5ba1b49e3b33a075149f823bb2ab85/analysis/1459325510/
* https://www.virustotal.com/en/file/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9/analysis/1459325587/
4] https://www.hybrid-analysis.com/sample/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9?environmentId=4
5] https://sandbox.deepviz.com/report/hash/df0198d5368df1cd600292fcc77cd45e/
___
Fake 'scanner, prtr' SPAM - leads to Locky ransomware
- https://myonlinesecurity.co.uk/more-emails-that-pretend-to-come-from-a-scanner-printer-or-multifunctional-device-at-your-own-email-domain-js-malware-leads-to-locky-ransomware/
20 Mar 2016 - "... another series of emails that pretend to be coming from a scanner, printer or multifunctional device at your own email domain with a zip attachment is another one from the current bot runs... In exactly the same way as one of yesterday’s malspam runs* the subjects pretend to be emailing an image or document file:
* https://myonlinesecurity.co.uk/locky-ransomware-downloads-hijacked-by-vigilante-and-delivering-eicar-test-file-instead/
Some of the subjects seen today include:
Emailing: FILE-57146596.tiff
Emailing: docment-6419593.tiff
Emailing: sheet 462244150.JPEG
Emailing: DOC-109.JPEG
Emailing: file_29.TIFF
Emailing: list-51210168.docx ...
One of the emails looks like:
From: CANON <CANON@ your-own-email-domain >
Date: Wed 30/03/2016 12:41
Subject: Emailing: FILE-57146596.tiff
Attachment:FILE-57146596.tiff.zip
Your message is ready to be sent with the following file or link attachments:
FILE-57146596.tiff
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled...
30 March 2016: FILE-57146596.tiff.zip: Extracts to: 414-7888138-1994311.js - Current Virus total detections 5/56*
downloads Locky ransomware from
http ://tmecvn .com/45t3443r3 (VirusTotal 9/56**). Other download locations... include:
http ://bezuhova .ru/45t3443r3
http ://thespinneyuk .com/45t3443r3
http ://tishaclothing .co.za/45t3443r3
http ://formalizar .com.br/45t3443r3
http ://tde.tne .cl/45t3443r3
http ://journal.egostile .net/45t3443r3
http ://cheapairticketindia .net/45t3443r3
http ://creditfinancebank .ru/45t3443r3 and I am sure loads of others will appear during the day... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/dad961b03046718cd307f99c21666c022730f9c9e5c02ebea5df4f92c90fdbae/analysis/1459336685/
** https://www.virustotal.com/en/file/bc7c45b5a05f3f0deea162578e45d5fb64c9aa72a81395083509c0f78b6ae1de/analysis/1459341039/
TCP connections
5.135.76.18: https://www.virustotal.com/en/ip-address/5.135.76.18/information/
>> https://www.virustotal.com/en/url/7d22cc46cb5e0eee8a0596146f450b0b9b8e049a8d1605f590871bba6b2227df/analysis/
___
Fake -Multiple- Subjects/senders/content SPAM - download Locky ransomware
- https://myonlinesecurity.co.uk/multiple-email-subjects-delivering-locky-ransomware/
30 Mar 2016 - "... a whole series of -different- email -subjects- and body-content coming from random-senders downloading Locky ransomware from multiple-places...
Some of the subjects include:
FW:Expenses Report # 109681 – 03/2016
payment confirmation
Additional Costs
recent bill
RE: Additional Information Needed #075573
The bodies of these emails have -varied- content like these:
We kindly ask you to provide us additional information regarding your case.
Please find the form attached down below.
-Or-
Dear xerox.774,
Please see attached file regarding clients recent bill. Should you need further assistances lease feel free to email me.
Best regards
Cleo Morris
Chief Executive Officer
... These -all- download Locky ransomware from -various- sites, some of which include:
http ://drirenaeris .com.au/b7eir (VirusTotal 3/56*)
http ://fabiocaminero .com/2L5pGE.exe (VirusTotal 7/56**)
http ://cssrd.org.lb/VPNQ4Z.exe (VirusTotal 7/56***) ...
These are -more- of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d8495d5496a916ffd636cc781e4cd57ff42f89acd572dbc2c0eb709e219264e9/analysis/1459341652/
TCP connections
51.254.240.45: https://www.virustotal.com/en/ip-address/51.254.240.45/information/
>> https://www.virustotal.com/en/url/e495d736a8ffdd002d350289f41ac97992060209f289cd6d4d1a8d9beb02e2bd/analysis/
** https://www.virustotal.com/en/file/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9/analysis/1459343160/
*** https://www.virustotal.com/en/file/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9/analysis/1459343160/
- http://blog.dynamoo.com/2016/03/malware-spam-additional-costs-leads-to.html
30 Mar 2016 - "... -another- malicious spam run... drops Locky ransomware. Again... phones home to the -same- IPs reported here[1]."
1] http://blog.dynamoo.com/2016/03/malware-spam-additional-information.html
___
Fake 'scanned document' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/scanned-document-tara-savill-charisma-bathrooms-limited-word-doc-macro-malware/
29 Mar 2016 - "An email with the subject of 'scanned document' pretending to come from Tara Savill <tara@ charismabathrooms .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/Tara-Savill-Scanned-Document-1024x642.png
29 March 2016: CCF26062014_00002.docm - Current Virus total detections 7/57*
.. MALWR** shows a download of Dridex banking malware from
http ://1901.magflags .de/media/5478hj.exe
Other sites: some of which were also in THIS earlier run*** ... include:
http ://youngstownliquidation .com/5478hj.exe
http ://balikmalzemelerim .com/5478hj.exe
http ://me-shop .net/5478hj.exe
http ://stremyanki .kz/5478hj.exe
http ://mojomojito .com/5478hj.exe
http ://baldwinsun .com/media/5478hj.exe ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/267bde7dbcea5197bd617123ddeb54a49d70d99dce7272da02ed686245136f3f/analysis/1459249209/
** https://malwr.com/analysis/OWI5NTZhYWU1YmVmNGE4MDlhZTRmMmUzZmEzZmIxMTQ/
Hosts
144.76.126.6: https://www.virustotal.com/en/ip-address/144.76.126.6/information/
>> https://www.virustotal.com/en/url/73c9a2dba418bc875df7f8daa58fdabedccf5390cf810ed651a6fb9ab9262087/analysis/
*** https://myonlinesecurity.co.uk/europower-invoices-word-doc-macro-malware/
:fear::fear: :mad:
AplusWebMaster
2016-03-31, 13:52
FYI...
Fake 'Print' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/an-email-saying-print-from-random-gmail-addresses-js-malware-leads-to-locky-ransomware/
31 Mar 2016 - "A series of emails with the basic subject of 'print' pretending to come from random names with a number at Gmail .com with a zip attachment is another one from the current bot runs which downloads Locky ransomware... Some of the subjects I have seen so far include:
print please
hi prnt
print
hello print
One of the emails looks like:
From: admin <andrew03@ gmail .com>
Date: Mon 04/01/2016 13:31
Subject: print please
Attachment: New Text Document (3).rar
–40719049546ef6119a6e83c9e005
Content-Type: text/plain; charset=UTF-8
–40719049546ef6119a6e83c9e005
Content-Type: text/html; charset=UTF-8
<div dir=”ltr”><br></div>
–40719049546ef6119a6e83c9e005–
–bf5dda1905937f96d0871d6d3006
Content-Type: application/octet-stream; name=”New Text Document (3).rar ...
31 March 2016: New Text Document(3).rar: Extracts to: New Text Document(95).js - Current Virus total detections 4/57*
.. MALWR** didn’t show any download but a manual analysis of the JS file gave me Locky Ransomware from
http ://bianca .com .tr/87h78rf33g (VirusTotal 4/57***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c73a4cc06c245a6f68a5988a75bc32223a36734b665960c7ca8e1b493a71bd87/analysis/1459419468/
** https://malwr.com/analysis/MGFiN2I0OWZiYzcwNDM5ZGE4MWY1MjZjYTI5ZjJiY2M/
*** https://www.virustotal.com/en/file/6ca8b9e7e62f595c6c2f211f25f37dd221ac2149735c373fa4ccb08aa9856008/analysis/1459419544/
TCP connections
88.198.119.177: https://www.virustotal.com/en/ip-address/88.198.119.177/information/
___
Fake 'FaxEmail' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/faxemail-fax-from-random-number-js-malware-leads-to-locky-ransomware/
31 Mar 2016 - "An email with the subject of 'FaxEmail Fax from 0632136978' (random number) pretending to come from random number @ f2em .com with a zip attachment is another one from the current bot runs which downloads Locky ransomware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/FaxEmail-Fax-from-0632136978-1024x585.png
31 March 2016: 783836325-7101s-452012.zip: Extracts to: 21255715-6613c-370201.js
Current Virus total detections 4/56*. MALWR** shows a download of Locky Ransomware from
http ://mentaldevelopment .ir/87h78rf33g (VirusTotal 3/57***)
Other download locations so far discovered include:
http ://meimeiwang .com.cn/87h78rf33g
remontobuvidoma .ru/87h78rf33g (giving a '404 not found')
anop .ir/87h78rf33g
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/b50e56ca4885b8116c14f44a6a74656b6dae4f05b7fe50de984f8446a52a9a77/analysis/1459428459/
** https://malwr.com/analysis/ODNmYTM1MDFhNjgxNGI4Mzg4MjBmZTJmZjNiZjkzODE/
Hosts
185.8.173.39
81.177.181.164
*** https://www.virustotal.com/en/file/7274fd83fd0cae635271678ae6abee1b6cb42333e1d03a64324b521a198433df/analysis/1459428606/
TCP connections
88.198.119.177
___
Fake 'Photos' SPAM - JS malware delivers Locky ransomware
- https://myonlinesecurity.co.uk/photos-nadia-maria-ochoa-js-malware-delivers-locky-ransomware/
31 Mar 2016 - "A blank/empty email with the subject of 'Photos' pretending to come from Nadia María Ochoa <nadia_m_ochoa018@ yahoo .es> (random numbers after nadia_m_ochoa) with a zip attachment is another one from the current bot runs... The email looks like:
From: Nadia María Ochoa <nadia_m_ochoa018@ yahoo .es>
Date: Thu 31/03/2016 14:32
Subject: Photos
Attachment: Photos.zip
Body content: Totally Blank
31 March 2016: Photos.zip: Extracts to: 84628561-8282f-490006.js - Current Virus total detections 4/57*
.. downloads Locky ransomware from
site.ipark .tur.br/87h78rf33g (VirusTotal 3/57**). Others sites discovered include
http ://mrsweeter .ru/87h78rf33g which is currently giving a '404' although was used earlier today for delivering Locky. It is almost certain that all the sites in THIS*** post which are delivering the same Locky ransomware file will also be used in a -differing- version of this email... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/f3c5a5c033ed9dd9e38e42b803ff8b5b8818cf3355a9f417093070f22b9ce783/analysis/1459431093/
** https://www.virustotal.com/en/file/7274fd83fd0cae635271678ae6abee1b6cb42333e1d03a64324b521a198433df/analysis/1459428606/
TCP connections
88.198.119.177: https://www.virustotal.com/en/ip-address/88.198.119.177/information/
>> https://www.virustotal.com/en/url/722a8fee7f8bb2198264097fbb821eee4d334bad6e781a7ae6a3adbba5a21a7d/analysis/
*** https://myonlinesecurity.co.uk/faxemail-fax-from-random-number-js-malware-leads-to-locky-ransomware/
:fear::fear: :mad:
AplusWebMaster
2016-04-01, 14:00
FYI...
Fake 'REFUND DEPOSIT' SPAM - fake PDF malware
- https://myonlinesecurity.co.uk/your-refund-deposit-copy-lloyds-bank-fake-pdf-malware/
Updated: 1 Apr 2016 - "An email with the subject of 'YOUR REFUND DEPOSIT COPY' pretending to come from Lloyds Bank <refund@ lloydsbank .co.uk> with a zip attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/03/YOUR-REFUND-DEPOSIT-COPY.png
31 March 2016: Attach.zip: Extracts to: Deposit Slip.exe - Current Virus total detections 8/57*
.. MALWR** | Payload Security***
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/8749707f944c0c6c4f75bb707a06a1ecc7c9d9de3db6d13229eda8511c996454/analysis/1459447576/
** https://malwr.com/analysis/YzJhMjI3MzY0MmI5NGRjZmJmMzJjNDFjYzg5ZWQ2NzI/
*** https://www.reverse.it/sample/8749707f944c0c6c4f75bb707a06a1ecc7c9d9de3db6d13229eda8511c996454?environmentId=4
Contacted Hosts
5.254.112.27
___
Fake 'photos' 'selfie' SPAM - JS malware
- https://myonlinesecurity.co.uk/images-photos-selfie-pretending-to-come-from-random-names-and-numbers-at-yahoo-es-js-malware/
1 Apr 2016 - "... numerous emails with the subject of 'images', 'photos' or 'selfie' pretending to come from random names and numbers at yahoo .es with a zip attachment is another one from the current bot runs which downloads what looks like Locky ransomware... some of these with no extension for the attachment... One of the email looks like:
From: Maite STEPHENS <GALEANA965@ yahoo .es>
Date: Fri, 01 Apr 2016 10:35:17 +0100
Subject: images
Attachment: Photos(80).zip
Body content: Empty/blank body
1 April 2016: Photos(80).zip: Extracts to: IMG0000024405.js - Current Virus total detections 3/56*
.. downloads what looks like Locky ransomware from
http ://rhcequestrian .com/89uyg65fyguy (VirusTotal 5/57**)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c4b30dd19246791d57ac6b0b2650991ebd95c11f22c77c2443a8cdeaaee129e7/analysis/1459503374/
** https://www.virustotal.com/en/file/c7d9b7e3cc672d0bb588d247b5860527d8e48eb0ae642ab4454ff12cb921d8e3/analysis/1459503652/
TCP connections
88.198.119.177: https://www.virustotal.com/en/ip-address/88.198.119.177/information/
>> https://www.virustotal.com/en/url/722a8fee7f8bb2198264097fbb821eee4d334bad6e781a7ae6a3adbba5a21a7d/analysis/
___
Fake 'Votre demande' SPAM - JS malware leads to Locky ransomware
- https://myonlinesecurity.co.uk/votre-demande-4906548-js-malware-leads-to-locky-ransomware/
1 Apr 2016 - "... an email written in French with the subject of 'Votre demande – 4906548' [random numbered] pretending to come from Darlene Walden <Darlene.Walden@ gouv .fr> with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... The email looks like:
From: Darlene Walden <Darlene.Walden@ gouv .fr>
Date: Fri 01/04/2016 09:11
Subject: Votre demande – 4906548
Attachment: Cas_4906548.zip
Monsieur / Madame,
Nous avons bien recu votre mail nous demandant de ne pas donner suite a votre demande
d’assurance du 01/04/2016 referencee en marge.
De ce fait, nous procedons a l’annulation de cette derniere a sa date d’effet et vous
precisons que vous ne pourriez vous prevaloir d’aucune garantie.
Pour plus de details s’il vous plait verifier fichier joint (Cas_4906548)
Nous vous remercions de bien vouloir en prendre note...
Translates to:
Sir / Madam,
We have received your mail asking us not to follow your request
Insurance 04/01/2016 referenced margin.
Therefore, we proceed to the cancellation of the latter has its effective date and you
Note that you could avail you of any warranty.
For more details please check attachment (Cas_4906548)
Thank you kindly take note...
1 April 2016: Cas_4906548.zip: Extracts to: Cas_2466628.js - Current Virus total detections 3/57*
.. Payload Security** shows a download of Locky Ransomware from
tag2change .com/images/old/note.exe (VirusTotal 2/56***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ea0d4bcc9363472454e9df3da6eecfb2e32822483fa364571252e552136594f9/analysis/1459501792/
** https://www.reverse.it/sample/ea0d4bcc9363472454e9df3da6eecfb2e32822483fa364571252e552136594f9?environmentId=4
Contacted Hosts
108.175.14.122: https://www.virustotal.com/en/ip-address/108.175.14.122/information/
>> https://www.virustotal.com/en/url/dc9945fa2e02e2e7a0d7252f32b6ed7c0888788af95a426568f459277859e550/analysis/
*** https://www.virustotal.com/en/file/2ec110f7ff63a23ae6a7e00b0c9953507d3817ff2d925c7e6e998fb9b49d9f80/analysis/1459502285/
___
Fake 'boss scams' meet AI robocallers - dangerous escalation of Fraud
- http://blog.dynamoo.com/2016/04/fake-boss-scams-meet-ai-robocallers-in.html
1 Apr 2016 - "Many of us will be familiar with the 'fake boss' scam. You're sitting at your desk when your CEO suddenly calls and asks you to transfer a large stack of currency to some shady-bank-account for a business transaction you are not allowed to talk about. This type of -fraud- is simple and can often pay out big bucks, but it is also labour intensive. Research has to be done on companies and -convincing- calls have to be made to unsuspecting-minions. Not only does this all take some time, but the more people involved in the scam then the more ways you have to split the booty.. and the greater the change of getting caught.
Now, the notorious Russian gang dubbed 'Den Duraka' by researchers have been discovered using a cunning new technique which makes this type of attack even more dangerous. Instead of relying on human beings to make the phone calls, they have now enrolled an AI-powered robocalling system called which promises to be a game-changer. Sporting the clumsy Russian acronym 'LOZHNYY', this is deeply integrated into LinkedIn, Facebook, Twitter and other social networks, with feeds into business directories using -hacked- credentials. Once it has found a CEO to impersonate, it scours the web for video and audio clips to get an idea of accents and mannerisms, and then it starts to research company filings and financial data. All of this is then combined with a wide range of pre-prepared scripts and some basic question-and-answer scenarios to make a deadly weapon in the hands of the scammers. Some of the conversational AI features are rudimentary, and LOZHNYY sometimes resorts to buzzword-laden nonsense when out of its depth. Victims report that they were -not- suspicious as this seemed consistent with the behaviour of their CEOs. Cybersecurity experts are struggling with ways to counter this new threat. At the moment their best advice is to completely -ignore- any communications from your CEO and indeed any C-level executive..."
___
Petya Ransomware - Malwarebytes analysis
- https://blog.malwarebytes.org/threat-analysis/2016/04/petya-ransomware/
April 1, 2016 - "Petya is different from the other popular ransomware these days. Instead of encrypting files one by one, it denies access to the full system by attacking low-level structures on the disk. This ransomware’s authors have not only created their own boot loader but also a tiny kernel, which is 32 sectors long. Petya’s dropper writes the malicious code at the beginning of the disk. The affected system’s master boot record (MBR) is overwritten by the custom boot loader that loads a tiny malicious kernel. Then, this kernel proceeds with further encryption. Petya’s ransom note states that it encrypts the full disk, but this is not true. Instead, it encrypts the master file table (MFT) so that the file system is -not- readable.
PREVENTION TIP: Petya is most dangerous in the Stage 2 of the infection, that starts when system is being rebooted after the BSOD caused by the dropper. In order to prevent your computer from going automatically to this stage, turn off automatic restart after a system failure (see how to do it):
> https://support.microsoft.com/en-us/kb/307973
If you detect Petya in Stage 1, your data still can be recovered. More information about it you can find here:
> https://hshrzd.wordpress.com/2016/03/31/petya-key-decoder/
... Behavioral analysis: This ransomware is delivered via scam emails themed as a job application. E-mail comes with a Dropbox link, where the malicious ZIP is hosted. This initial ZIP contains two elements:
- a -photo- of a young man, purporting to be an applicant (in fact it is a publicly-available-stock image)
- an -executable- pretending to be a CV in a self-extracting archive or in PDF (in fact it is a malicious dropper in the form of a 32bit PE file):
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/petya_exe-1.png
In order to execute its -harmful- features, it needs to run with Administrator privileges. However, it doesn’t even try to deploy any user account control (UAC) bypass technique. It relies fully on social engineering. When we try to run it, UAC pops up this alert:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/uac_popup.png
After deploying the application, the system crashes. When it restarts, we see the following screen, which is an -imitation- of a CHKDSK scan:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/1.png
In -reality- the malicious kernel is already encrypting. When it finishes, the affected user encounters this blinking screen with an ASCII art:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/2.png
Pressing a key leads to the main screen with the ransom note and all information necessary to reach the Web panel and proceed with the payment:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/3.png
... We noted that the website for the victim is well prepared and very informative. The menu offers several language versions, but so far only English works:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/page_main-768x707.png
It also provides a step-by-step process on how affected users can recover their data:
> https://blog.malwarebytes.org/wp-content/uploads/2016/03/guide-768x707.png
... We expect that cybercriminals release as little information about themselves as possible. But in this case, the authors and/or distributors are very open, sharing the team name—”Janus Cybercrime Solutions”—and the project release date—12th December 2015...
Conclusion: In terms of architecture, Petya is very advanced and atypical. Good quality FUD, well obfuscated dropper – and the heart of the ransomware – a little kernel – depicts that authors are highly skilled. However, the chosen low-level architecture enforced some limitations, i.e.: small size of code and inability to use API calls. It makes cryptography difficult. That’s why the key was generated by the higher layer – the windows executable. This solution works well, but introduces a weakness that allowed to restore the key (if we manage to -catch- Petya at -Stage1- -before- the key is erased)..."
(More detail at the malwarebytes URL at the top of this post.)
___
Ransomware and Recent Variants
- https://www.us-cert.gov/ncas/alerts/TA16-091A
March 31, 2016
___
- https://www.virusbulletin.com/blog/2015/05/you-are-your-own-threat-model/
"... Preventing macro malware from infecting your machine is really simple: -don't- enable macros, no matter how much a document urges you to do so..."
:fear::fear: :mad:
AplusWebMaster
2016-04-04, 14:35
FYI...
Fake 'VeriFone' SPAM - JS malware
- https://myonlinesecurity.co.uk/verifone-services-uk-and-ireland-ltd-invoice-js-malware/
4 Apr 2016 - "An email with the subject of 'VeriFone Services UK and Ireland Ltd' pretending to come from donotreply_invoices@ verifone .com with a zip attachment is another one from the current bot runs which downloads some sort of malware... The email looks like:
From: donotreply_invoices@ verifone .com
Date: Mon 04/04/2016 10:29
Subject: VeriFone Services UK and Ireland Ltd
Attachment: VeriFone_20160404095713.zip
Please see attached Invoice(s).
Thanks and Regards,
VeriFone Services UK and Ireland Ltd
Confidentiality Note: This email message contains information that is confidential. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution or copying of this message is prohibited. If you have received this message or attachment in error, please notify us immediately by email and delete the original...
4 April 2016:VeriFone_20160404095713.zip: Extracts to: VeriFone_20160404092434.js
Current Virustotal detections 3/57*. MALWR** shows a download from
http ://tag2change .com/images/old/note.exe (VirusTotal 4/57***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/57eef8758b01d2a20a33ff4aba1c63a35268c3eda0071bb9f846c5503d40e9aa/analysis/1459766150/
** https://malwr.com/analysis/YTliMjcxYTI5NTdjNDc3MjgxMDg1NDc3MTA5NTMyYjI/
Hosts
108.175.14.122: https://www.virustotal.com/en/ip-address/108.175.14.122/information/
>> https://www.virustotal.com/en/url/dc9945fa2e02e2e7a0d7252f32b6ed7c0888788af95a426568f459277859e550/analysis/
*** https://www.virustotal.com/en/file/d4ac8e8affae46c90bc354e882d450aaf2aba438defc75f6ac49cc3092592892/analysis/1459766714/
___
Fake 'Refund' SPAM - JS malware leads to Teslacrypt ransomware
- https://myonlinesecurity.co.uk/refund-for-random-number-random-amount-js-malware-leads-to-teslacrypt-ransomware/
4 Apr 2016 - "An email with the subject of 'Refund for #18613 – $2,179,44' [random number, random amount] pretending to come from random names, companies and email addresses with a zip attachment is another one from the current bot runs which downloads Teslacrypt ransomware... One of the emails looks like:
From: Pongky Morrill <MorrillPongky34@ bitsport .ru>
Date: Mon 04/04/2016 12:20
Subject: Refund for #18613 – $2,179,44
Attachment: copy_nz_930864.zip
Your refund request has been processed.
Please, find the confirmation attached to this e-mail.
4 April 2016: copy_nz_930864.zip: Extracts to: letter_EWxago.js - Current Virus total detections 6/57*
.. MALWR** shows a download of a -new- version of Teslacrypt ransomware from
http ://greetingseuropasqq .com/80.exe?1 (VirusTotal 7/57***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c41ac1bb77a5885129487c97c6274351cb178b83b6dfaa3d3261b6e83d1ab784/analysis/1459768523/
** https://malwr.com/analysis/ZTdmNzIwNDdjYzJhNDE1NmEyMDM4ZGQ4ZTZmZjU1YTU/
Hosts
54.212.162.6
217.70.180.150
107.180.43.132
107.180.4.122
76.162.168.113
192.186.220.8
71.18.247.59
*** https://www.virustotal.com/en/file/d8ee200589d8e7d72878ea79bcfc9d18ee52569c046df74fa0dfe7e33d9ec422/analysis/1459772578/
TCP connections
217.70.180.150
107.180.43.132
___
Fake 'photos' SPAM - from your own email address delivering Locky ransomware
- https://myonlinesecurity.co.uk/photos-pretending-to-come-from-your-own-email-address-supposed-to-be-malware-but-empty-zips/
4 Apr 2016 - "An email with the subject of 'Photos' [random number between 1 and 4] pretending to come from your own email address with a zip attachment is -supposed- to be another one from the current bot runs which downloads Dridex, Locky or some other malware but is malformed-and-misconfigured so the attached zip is -empty- ... They use email addresses and subjects that will entice a user to read the email and open the attachment...
Update: Some working copies now trickling through containing -nemucod- downloaders delivering Locky ransomware. The email looks like:
From: Your email address
Date: Mon 04/04/2016 10:48
Subject: Photos 3
Attachment: 20160404_074897_resized.zip
Envoyé de mon Galaxy S6 edge+ Orange
Update: Managed to get a 'working' copy...
4 April 2016: 20160404_409472_resized.zip: Extracts to: 20160401_833019_resized.js
Current Virus total detections 2/57*.. downloads what looks like Locky ransomware from
http ://taytantalya .com/54eftygub (VirusTotal 2/56**)
Some other locations seen include:
hatgiongrangdong .com/54eftygub and
amid-s .com.ua/54eftygub
http ://2ws .club/54eftygub
http ://asensor .com.sg/54eftygub
http ://freya58 .ru/54eftygub
http ://lindecoration .com/54eftygub
http ://lxtrading .com.sg/54eftygub
http ://sargentojoe .com.br/54eftygub
http ://stylekoko .com/54eftygub
http ://waxmod .com/54eftygub ...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2c3d033145299f1bbe46ac1796dd5fc03f13c1aab4de56c79ade0c7d87384911/analysis/1459764701/
** https://www.virustotal.com/en/file/796964f756a68baf67d2e235bc257d792222a0cc1fb5f925c1f44c6435a8319a/analysis/1459763558/
TCP connections
91.209.77.86: https://www.virustotal.com/en/ip-address/91.209.77.86/information/
>> https://www.virustotal.com/en/url/e41aa8cd5d7d28e77e745455867094ecb26dca3245ca3ad587134abaf3e7d291/analysis/
___
Fake 'Your Booking' SPAM - JS malware leads to Teslacrypt
- https://myonlinesecurity.co.uk/changes-in-your-booking-booking-nr46081-js-malware-leads-to-teslacrypt-ransomware/
4 Apr 2016 - "An email with the subject of 'Changes in Your Booking (Booking Nr:46081)' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Teslacrypt... The email looks like:
From: Trudey Daniel <DanielTrudey588@ eskweb .net>
Date: Mon 04/04/2016 14:40
Subject: Changes in Your Booking (Booking Nr:46081)
Attachment: aqq_copy_830379.zip
There has been some important change in your booking (Booking Nr:46081). Please review the confirmation below.
4 April 2016: aqq_copy_830379.zip: Extracts to: doc_xXsKNB.js - Current Virus total detections 5/57*
.. Downloads Teslacrypt from the same locations as This earlier post**... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e5f8fdd75dca35790a7dad467c34ec6f473f40bc83620b1430e34b179c9e44b2/analysis/1459777068/
** https://myonlinesecurity.co.uk/refund-for-random-number-random-amount-js-malware-leads-to-teslacrypt-ransomware/
___
Fake 'Your parcel' SPAM - JS malware
- https://myonlinesecurity.co.uk/your-parcel-898322-status-arrived-otis-ryan-js-malware/
4 Apr 2016 - "An email with the subject of 'Your parcel #898322, Status: Arrived Otis Ryan' [random numbered] pretending to come from Otis Ryan <cobranza@ moldecor .com> with a zip attachment is another one from the current bot runs which downloads some sort of malware... The email looks like:
From: Otis Ryan <cobranza@ moldecor .com>
Date:
Subject: Your parcel #898322, Status: Arrived Otis Ryan
Attachment: Otis Ryan.zip
Valued Customer, Otis Ryan
The check of 255.00$ for the parcel #617473 was received by our company and now has the Status: Paid.
Our people has already shipped the purchase.
Please, Be sure to write us back if you already received the order, as it should have been delivered on February 3, 2016.
If you have any questions, you can check the details order enclosed to this e-mail, or call our department and we will offer you the other options.
4 April 2016: Otis Ryan.zip: Extracts to: Otis Ryan.js - Current Virus total detections 3/57*
.. MALWR** doesn’t show any downloads but Payload security[1] shows a download of some malware from
yuilouters .com/img/sc.php?m=c2FuZHJhQG9uZWtuaWdodC5jby51aw%3D%3D&f=img.jpg (VirusTotal 4/56***). MALWR[2] - This isn’t a JPG (image file) but a -renamed- .exe file -despite- the icon showing it to be a jpg... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3da03a8061dba42fccba720dd3b7fa9d3a52f333fd0501e6c108dcab6a1c1d65/analysis/1459789450/
** https://malwr.com/analysis/OTUyMWQ0YTllZGU0NDRhNWIyMWE0Y2ZmYzhkZDZiNTc/
1] https://www.reverse.it/sample/3da03a8061dba42fccba720dd3b7fa9d3a52f333fd0501e6c108dcab6a1c1d65?environmentId=4
Host Address
130.255.129.102: https://www.virustotal.com/en/ip-address/130.255.129.102/information/
*** https://www.virustotal.com/en/file/6adecfaec434b41ecce9911f00b48e4e8ae6e3e8b9081d59e1b46480e9f7dbfc/analysis/1459790694/
2] https://malwr.com/analysis/ZjRjMjg3MjljNTdiNGMyMTg3NGM5ZDcwYjdlNGFjZGQ/
yuilouters .com: 193.33.197.174
176.105.171.196
46.98.193.150
176.124.235.127
176.103.235.5
178.217.162.239
5.1.14.100
79.113.106.239
86.126.0.128
176.36.70.114
:fear::fear: :mad:
AplusWebMaster
2016-04-05, 12:31
FYI...
Fake 'Receipt' SPAM - xls macro malware
- https://myonlinesecurity.co.uk/receipt-xencourier-co-uk-excel-xls-spreadsheet-macro-malware/
5 Apr 2016 - "An email with the subject of 'Receipt' pretending to come from Mike <mike@ xencourier .co.uk> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Mike <mike@ xencourier .co.uk>
Date: Tue 05/04/2016 10:10
Subject: Receipt
Attachment: scan0001.xls
Hi
Here is your credit card receipt attached. VAT invoice to follw in due course.
Best regards
Mike ...
5 April 2016: scan0001.xls - Current Virus total detections 4/57*
.. REVERSEIT** and MALWR*** show a download from
http ://unifire .in/43tgw - MALWR[4] VirusTotal 3/56[5]. I am unsure whether this is Dridex or Locky ransomware, judging by the auto analysis, I am guessing on Dridex with an anti-analysis component... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/5e6cedcba8875945a7f94e9df96fa80455ee02b716d662ba9dc87a14e2286cb6/analysis/1459847342/
** https://www.reverse.it/sample/5e6cedcba8875945a7f94e9df96fa80455ee02b716d662ba9dc87a14e2286cb6?environmentId=4
Contacted Hosts
184.154.132.107
195.169.147.78
*** https://malwr.com/analysis/YmFhZDA4ODcxY2YzNGY0ZGIwZTI0MzU5Y2IyNDVjZDY/
Hosts
184.154.132.107: https://www.virustotal.com/en/ip-address/184.154.132.107/information/
>> https://www.virustotal.com/en/url/24f69c4e5a3b55800748a37fe5956249facbc9f02405e7986bf141979d3423d3/analysis/
4] https://malwr.com/analysis/MzE4MTc4YmJjYzYwNGE2YjgwMDFjYTIxNWYyYmIwZmY/
5] https://www.virustotal.com/en/file/82bdee90f39138f43c9696cb21acba7c7b8f40a429fb8deea01b22cf21dcdd02/analysis/1459847771/
___
Fake 'Your Balance' SPAM - leads to Teslacrypt
- https://myonlinesecurity.co.uk/actual-status-on-your-balance-49166-js-malware-leads-to-teslacrypt-ransomware/
5 Apr 2016 - "An email with the subject of 'Actual Status on Your Balance 49166' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Teslacrypt ransomware... The email looks like:
From: Random senders
Date: Tue 05/04/2016 13:05
Subject: Actual Status on Your Balance 49166
Attachment: zi_invoices_764173.zip
Please find attached your actual statement for the period of 02/2016 to 03/2016.
5 April 2016: zi_invoices_764173.zip: Extracts to: check_WuKGkn.js - Current Virus total detections 23/56*
.. downloads Teslacrypt ransomware from
http ://marvellrulesqq .com/70.exe?1 (VirusTotal 5/56**)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://www.virustotal.com/en/file/ff5926f47c07542be71d4c425273c57292b4905c36edd76a193b5fd4c1af3ca5/analysis/1459859633/
TCP connections
23.229.239.227
marvellrulesqq .com: 185.118.142.154: https://www.virustotal.com/en/ip-address/185.118.142.154/information/
>> https://www.virustotal.com/en/url/881632c49b1f8a187f737eba411ec9a23b17284ca97b5b28e8814b511b593956/analysis/
54.212.162.6: https://www.virustotal.com/en/ip-address/54.212.162.6/information/
>> https://www.virustotal.com/en/url/9f0b9b297faee3ea32484a5af7f5aa0579e4d5cffe87cf109d5ffe3d041bd5de/analysis/
104.161.60.151: https://www.virustotal.com/en/ip-address/104.161.60.151/information/
___
Fake 'Bank' SPAM - doc malware
- https://myonlinesecurity.co.uk/pfi-05-04-16-union-national-bank-egypt-word-doc-malware/
5 Apr 2016 - "This email that appears to be from Union National Bank-Egypt with the subject of 'PFI -05.04.16' pretending to come from CEO Finexx Group <sales@ salesbabu .com> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/ghada-abdou-1024x597.png
5 April 2016 : Invvoice.docx - Current Virus total detections 8/56*
.. MALWR** - This -malicious- word doc has an -embedded- .exe file that gets extracted and decoded when you click-on-the-icon inside the word doc to deliver MICROSOFT.exe (VirusTotal 7/55***). This was passed on to me by another analyst... When I extracted the malware from the word doc I got THIS (VT 7/57[4]) differently detected malware... See screenshot (below):
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/Invvoice_docx-1024x532.png
These embedded OLE objects will extract from ANY office program that can read & display word docs, as far as I am aware this also includes open office, libre office and all the other non-Microsoft programs. If you do follow their advice and click-on-the-object... it is game-over and you-are-compromised... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d7a5e6293b468a4fda68ded4f985bb1596cb11db5d49c0fbe7eea9d8363986a6/analysis/1459854693/
** https://malwr.com/analysis/OGFiODhjNGE4Yzk3NGViMWE4YmRiNzljMGUxMWFhNzk/
*** https://www.virustotal.com/en/file/a7818df97ca14c0b378da8ed92ef3fcc46b6f98905466c64aeca2aa0194f2f1c/analysis/1459854644/
TCP connections
93.184.220.29
104.86.111.136
4] https://www.virustotal.com/en/file/3b7eb043afee7459a971c06d235c68a493fce68cf70887b8491b0735817978e1/analysis/1459861778/
___
Fake 'Invoice - e-pay' SPAM - JS malware leads to Dridex
- https://myonlinesecurity.co.uk/invoice-912409-uk-e-pay-email-server-js-malware-leads-to-dridex/
5 Apr 2015 - "An email with the subject of 'Invoice: 912409' pretending to come from UK e-pay Email Server (epay UK) <DO.NOT.REPLY.TO@ uk.epayworldwide .com> with a zip attachment is another one from the current bot runs which downloads Dridex banking Trojan... The email looks like:
From: UK e-pay Email Server (epay UK) <DO.NOT.REPLY.TO@ uk.epayworldwide .com>
Date: Tue 05/04/2016 12:24
Subject: Invoice: 912409
Attachment: PeriodSummarybyTerminal.zip
Account: 912409
5 April 2016: PeriodSummarybyTerminal.zip: Extracts to: KFVL-902246613812.js - Current Virus total detections 6/57*
.. Downloads Dridex banking Trojan from
http ://mekongtrails .com/4543t43 (VirusTotal 5/56**) Which appears to be the -same- version and also using the -same- file names and the -same- other download locations as THIS earlier malspam run***... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ad68bdd23b4f8810311f5bb2a597b4a43a6a218c56ef0d6c89f96650d2443ce9/analysis/1459859137/
** https://www.virustotal.com/en/file/82bdee90f39138f43c9696cb21acba7c7b8f40a429fb8deea01b22cf21dcdd02/analysis/1459858301/
*** https://myonlinesecurity.co.uk/receipt-xencourier-co-uk-excel-xls-spreadsheet-macro-malware/
mekongtrails .com: 173.236.74.11: https://www.virustotal.com/en/ip-address/173.236.74.11/information/
>> https://www.virustotal.com/en/url/145d0fe7bf5c36c7809f1a49eab4c7771238bd92274d6f5d2ec45e5b7b2ab5f6/analysis/
___
Fake 'Unpaid Bill' SPAM - JS malware leads to Teslacrypt
- https://myonlinesecurity.co.uk/unpaid-bill-for-car-repair-service-7650-js-malware-leads-to-teslacrypt/
5 Apr 2016 - "An email with the subject of 'Unpaid Bill for Car Repair Service 7650' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads teslacrypt... The email looks like:
From: Random
Date: Tue 05/04/2016 16:33
Subject: Unpaid Bill for Car Repair Service 7650
Attachment: copy_xerox.device5_868199.zip
We kindly ask you to review our unpaid bill again and send us the payment in order to avoid additional costs.
5 April 2016: copy_xerox.device5_868199.zip: Extracts to: finance_NJTugN.js - Current Virus total detections 7/57*
.. MALWR** and payload security*** shows a download of Teslacrypt from
marvellrulesqq .com/70.exe?1 (VirusTotal 4/56[4]) or
http ://marvellrulesqq .com/80.exe?1 (VirusTotal 4/57[5]). Although both files are the same size they have different sha1# ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4d2217a700bd471386f0c19475e802759192ee6c7aa10c12d9385ee4b4d56e33/analysis/1459871414/
** https://malwr.com/analysis/YjNkMDg3MTRiZDBhNDQwNmFhZjdkZTZiYjFiMGYyNGY/
Hosts
104.161.60.151
23.229.239.227
194.228.3.204
*** https://www.hybrid-analysis.com/sample/4d2217a700bd471386f0c19475e802759192ee6c7aa10c12d9385ee4b4d56e33?environmentId=4
Contacted Hosts
54.212.162.6
23.229.239.227
194.228.3.204
4] https://www.virustotal.com/en/file/7c5b3bfc59de383763e68819465b80f8c2aed3f47ef01dae2380e0e5ef06bdc4/analysis/1459872787/
TCP connections
23.229.239.227
194.228.3.204
107.180.26.75
192.185.151.39
5] https://www.virustotal.com/en/file/84336e2b2072db969ba437172afe7f6c5a05c7b88eb41cefe56174c44978d05f/analysis/1459873099/
TCP connections
23.229.239.227
194.228.3.204
marvellrulesqq .com: 185.118.142.154: https://www.virustotal.com/en/ip-address/185.118.142.154/information/
>> https://www.virustotal.com/en/url/ff7a11fe6c711827e98f3f902437b4a292733ac2484c34976e21d176e1ce2817/analysis/
54.212.162.6: https://www.virustotal.com/en/ip-address/54.212.162.6/information/
>> https://www.virustotal.com/en/url/9f0b9b297faee3ea32484a5af7f5aa0579e4d5cffe87cf109d5ffe3d041bd5de/analysis/
104.161.60.151: https://www.virustotal.com/en/ip-address/104.161.60.151/information/
:fear::fear: :mad:
AplusWebMaster
2016-04-06, 15:14
FYI...
Fake 'Voicemail' SPAM - JS malware
- https://myonlinesecurity.co.uk/soho66-new-voicemail-message-from-07792084437-js-malware/
4 Apr 2016 - "An email with the subject of 'New Voicemail Message From 07792084437' [random numbers] pretending to come from Soho66 <noreply@ soho66 .co.uk> with a zip attachment is another one from the current bot runs which downloads some sort of malware... The email looks like:
From: Soho66 <noreply@ soho66 .co.uk>
Date:
Subject: New Voicemail Message From 07792084437
Attachment: MSG0000060895.WAV.RAR
Hi,
You have been left a 0:19 long message (number 11) in mailbox 1006 from 07792060895, on Wed, 06 Apr 2016 06:13:47 -0400
The voicemail message has been attached to this email as a wave file – which you can play on most computers.
Our Regards
The Soho66 Customer Team
Please do not reply to this message. This is an automated message which comes from an unattended mailbox...
6 April 2016: MSG0000060895.WAV.RAR: Extracts to: MSG00004481919.WAV.js - Current Virus total detections 5/57*
.. MALWR** shows a download from http ://mapstor .org/1278u0 (VirusTotal 1/57***). MALWR[4]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/bd2b0030e7ce085e6a8645fcdb08f6dc230a17861b101dd62b2f5c0a64b8c438/analysis/1459938427/
** https://malwr.com/analysis/ZjM2YjA4OWQwM2NhNGM4ZTk5MmY1NzlhMDU4NTBmMDk/
Hosts
104.27.167.24: https://www.virustotal.com/en/ip-address/104.27.167.24/information/
>> https://www.virustotal.com/en/url/c44a76485afd627fb824df69de0371b1b0226ec290e1bcf1d3adad1b180b40e7/analysis/
*** https://www.virustotal.com/en/file/f02dbad4c51137aecd90b190ff560049ae657bacaae5d00031055d5a0d377a3e/analysis/1459939012/
4] https://malwr.com/analysis/NTU2YjIzYWY2ZWYxNDlhYTk2Yjc1ZmVkOWQ0YWJhZmI/
___
Fake 'Invoicing' SPAM - JS malware
- https://myonlinesecurity.co.uk/liberty-wines-invoicing-js-malware/
6 Apr 2016 - "An email with no subject pretending to come from Liberty Wines, Invoicing <invoicing@ libertywines .co.uk> with a zip attachment is another one from the current bot runs which downloads an unknown malware probably either Locky ransomware or Dridex banking Trojan... The email looks like:
From: , Invoicing <invoicing@ libertywines .co.uk>
Date: Wed 06/04/2016 11:50
Subject: [blank/empty]
Attachment: Sales-Invoice LWIN0136332.rar
Dear Customer,
Please find attached your invoice, number: LWIN0136332.
Kind regards,
Liberty Wines
6 April 2016: Sales-Invoice LWIN0136332.rar: Extracts to: MSG00008141521.WAV.js - Current Virus total detections 5/57*
.. MALWR** shows a download from http ://vnnsports .com/1278u0 which although a different # is the -same- malware as described in THIS earlier post***... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/255e3e7dd6d539124e28d2f070e0644be632aa054a3f9f6e33f2201480ffed41/analysis/1459939899/
** https://malwr.com/analysis/MTc4YTRhMWRlYTAxNGI2ZmE3ZDM3MDRiNTczNGIxMGY/
Hosts
184.154.132.107: https://www.virustotal.com/en/ip-address/184.154.132.107/information/
>> https://www.virustotal.com/en/url/e5bb04f8a9d61700547ee23946db8d2ded58b47e1709b752bc842f1e08059b1b/analysis/
*** https://myonlinesecurity.co.uk/soho66-new-voicemail-message-from-07792084437-js-malware/
___
Fake 'Document(1)' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/document1-pretending-to-come-from-your-own-email-address-word-doc-macro-malware/
6 Apr 2016 - "A blank/empty email with the subject of 'Document(1)' pretending to come from your own email address with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: your email address
Date: Wed 06/04/2016 14:15
Subject: Document(1)
Attachment: Document(1).doc
Body content: Totally empty/Blank
6 April 2016: Document(1).doc - Current Virus total detections 10/56*
.. MALWR shows a download of Dridex banking Trojan from
http ://jabez .jp/1278u0 (VirusTotal 12/57**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f5e9e3e9b5ad311fa3a3ad15da46023964bc6e9885d655274936d506cedd21d8/analysis/1459948652/
** https://www.virustotal.com/en/file/e4c4e5337fa14ac8eb38376ec069173481f186692586edba805406fa756544d9/analysis/1459961706/
TCP connections
109.235.139.64
jabez .jp: 120.136.14.15: https://www.virustotal.com/en/ip-address/120.136.14.15/information/
___
Fake 'Remittance Details' SPAM - rtf macro malware delivers Dridex
- https://myonlinesecurity.co.uk/remittance-details-usd-7956-88-your-web-address-word-doc-rtf-macro-malware-delivers-dridex/
6 Apr 2016 - "An email with the subject of 'Remittance Details (USD 7956.88) – your-web-address' pretending to come from random senders with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... One of the emails looks like:
From: random senders
Date: Wed 06/04/2016 16:04
Subject: Remittance Details (USD 7956.88) – securityandprivacy.co.uk
Attachment: Invoice Number 0297376 – Issue Date 02165639.rtf
Dear All
Please find attached your banking details and do note the difference from the one we have We are to proceed with the payment of USD 7956.88 so please do verify attached bank details to avoid making payment to the wrong person as it is our custom. Please reply if you have any questions. Thanks Beryl Frye NAMIBIAN RESOURCES...
6 April 2016: Invoice Number 0297376 – Issue Date 02165639.rtf - Current Virus total detections 4/56*
.. MALWR** shows a download of Dridex banking Trojan from
http ://shop.bleutree .biz/tablets/galaxytab3.php which gave me crypted122med.exe (VirusTotal 5/56***)...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/fcbd26961a36d80b6b67477d7b02d462a9f46fc246087de4435af479d5ffaa80/analysis/1459960107/
** https://malwr.com/analysis/Nzk4YWE5NTlmZDc4NDQzZGI5NjJhNjYzMWRmNDg5NmY/
Hosts
85.143.209.13: https://www.virustotal.com/en/ip-address/85.143.209.13/information/
>> https://www.virustotal.com/en/url/6dde1fa724c21f1dc3ca613c8125f42e773b0316455cd9abde881bc4c81a9d13/analysis/
*** https://www.virustotal.com/en/file/95d0b2aa35b0c609d4e072409c47b763c7b73eed090edc8e33ad906a91e91d16/analysis/1459960596/
shop.bleutree .biz: 85.143.209.13
___
Fake 'Security Update' SPAM - BT phish
- https://myonlinesecurity.co.uk/attention-security-update-bt-phishing/
6 Apr 2016 - "'Attention! Security Update' pretending to come from BT is one of the latest -phish- attempts to steal your BT details and your Bank, credit card and personal details... This one wants your personal details, BT log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details as well...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/BT_phishing-email-1024x781.png
... When (IF) you fill in your user name and password you are sent to a page where the phishers try to validate your details to make sure that you are entering “genuine” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
:fear::fear: :mad:
AplusWebMaster
2016-04-07, 14:08
FYI...
Fake 'invoice' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/latest-invoice-sales-invoice-purchase-invoice-word-doc-macro-malware/
7 Apr 2016 - "A -series- of emails with the basic subject of 'invoice' pretending to come from random names with a malicious word doc attachment is another one from the current bot runs... Some of the subjects seen include:
Uta Mclaughlin: Latest Invoice
Meghan Mckay, Sales Invoice
Fwd:Camille Glover. Purchase Invoice
The email looks like:
From: Uta Mclaughlin <nickbockholdt@ gmx .de> / Meghan Mckay <ramykhalifa@ emerge-studio .com> /
Camille Glover <david@ deliciousworldcorp .com>
Date: Thu 07/04/2016 04:51
Subject: Uta Mclaughlin: Latest Invoice
Attachment: 4872113603.doc
Please review the document enclosed with this message.
Kind regards
Meghan Mckay
7 April 2016: 4872113603.doc - Current Virus total detections 3/57*
.. Payload Security** shows a download from creditprimo .com/h1.jpg?BbZJpyfbopM=12
which gives this image (VirusTotal 2/57***). The macro extracts the malware from the image to give
12120.exe (VirusTotal 2/57[4]). MALWR[5]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/1ce91001e3117f0e769243efe86d49a444b8e106075358a96e846175ae2cec53/analysis/1460006738/
** https://www.hybrid-analysis.com/sample/1ce91001e3117f0e769243efe86d49a444b8e106075358a96e846175ae2cec53?environmentId=4
Contacted Hosts
138.128.125.153
*** https://www.virustotal.com/en/file/928565a2de371efd40b79d929e0c16dbdfd7fee2b878fe68a7edfc1d99a7ad76/analysis/1460008049/
4] https://www.virustotal.com/en/file/5d2fe54ee78b4d17e43a4ada87a546782b2b002b79ecf162cd5165e603e7ee36/analysis/1460007688/
5] https://malwr.com/analysis/ODljMmY2NGM3ZjVmNDMyOWI5NTc3ZThjNWFhMDk3Mzc/
___
Fake 'Your Latest Documents' SPAM - doc macro malware leads to Locky Ransomware
- https://myonlinesecurity.co.uk/your-latest-documents-from-angel-springs-ltd-sta054c-word-doc-macro-malware-leads-to-locky-ransomware/
7 Apr 2016 - "An email with the subject of 'Your Latest Documents' from Angel Springs Ltd [STA054C] pretending to come from ebilling@ angelsprings .com with a malicious word doc attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/Your-Latest-Documents-from-Angel-Springs-Ltd-STA054C-848x1024.png
7 April 2016: G-A0288010040780590521.pdf / G-A0288010040780590521.docm - Current Virus total detections 9/56*
.. MALWR** shows a download from http ://360webhosts .com/0uh634 (VirusTotal 13/56***) which is the -same- malware as described HERE[4] which is actually a downloader that downloads from 185.103.252.148/files/o35jkR.exe which is Locky Ransomware (VirusTotal 2/56[5])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/98ff083be97e095de628a3e9358049e1f4582aa5c3af70b29585ce0fe46fb5c3/analysis/1460028627/
** https://malwr.com/analysis/YmNjNDgwZmE2ODJjNDhkNWE1MjFhOGIzNGQ0NzYyZGQ/
Hosts
202.87.31.185: https://www.virustotal.com/en/ip-address/202.87.31.185/information/
>> https://www.virustotal.com/en/url/1aa1e8c256982a00475b96f2497cabe083b2dc2dbf811cc15eb39835a797c663/analysis/
109.235.139.64
*** https://www.virustotal.com/en/file/f6c463bbe4f5da7b0ce38e6b76cd1d687964bc787b63bb7a2338d36ef6c3a360/analysis/1460027909/
TCP connections
109.235.139.64
4] https://myonlinesecurity.co.uk/dossier-n-46612-cabinet-bettan-word-doc-macro-malware/
5] https://www.virustotal.com/en/file/f0d820a68b63defc4ea7ea8b99d022eef2382109c58266606da79ab34e457dfd/analysis/1460026504/
185.103.252.148: https://www.virustotal.com/en/ip-address/185.103.252.148/information/
>> https://www.virustotal.com/en/url/3fc61ecbb837d2c27c39b6725b0c545a11d0af2320750bab10b1e69bbadd971a/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-04-09, 19:26
FYI...
Researchers shut down SPAM botnet - 4,000 Linux machines
- http://arstechnica.com/security/2016/04/researchers-help-shut-down-spam-botnet-that-enslaved-4000-linux-machines/
Apr 9, 2016 - "A botnet that enslaved about 4,000-Linux-computers and caused them to blast the Internet with spam for more-than-a-year has finally been shut down. Known as -Mumblehard- the botnet was the product of highly skilled developers. It used a custom "packer" to conceal the Perl-based source code that made it run, a backdoor that gave attackers persistent access, and a mail daemon that was able to send large volumes of spam. Command servers that coordinated the compromised machines' operations could also send messages to Spamhaus requesting the -delisting- of -any- Mumblehard-based IP addresses... In the months following Eset's* discovery of Mumblehard in late 2014, company researchers worked with Estonian law enforcement and an industry partner to shut down the botnet. In February of this year, the group took control of the Internet address belonging to the command server, making it possible for researchers to "sinkhole" the botnet. Rather than connecting to the attackers' control server, the infected machines connected to benign machines operated by the takedown participants. By analyzing the incoming traffic, they estimated that about 4,000 computers were infected. Researchers still don't know how Mumblehard was able to initially take hold of its victims... The number of machines reporting to the sinkholed server has been slowly dropping as compromised systems are disinfected."
* http://www.welivesecurity.com/2016/04/07/mumblehard-takedown-ends-army-of-linux-servers-from-spamming/
> http://www.welivesecurity.com/wp-content/uploads/2016/04/2-sinkhole_stats_1.png
Stats from Mumblehard sinkhole
> http://www.welivesecurity.com/wp-content/uploads/2016/04/8-sinkhole_stats_2.png
Statistics from our new sinkhole
:fear::fear: :mad:
AplusWebMaster
2016-04-11, 14:26
FYI...
Ransomware: Past, Present, and Future
- https://blogs.cisco.com/security/talos/ransomware-past-present-and-future
Apr 11. 2016 - "... The problem we face is that every single business that -pays- to recover their files, is directly funding the development of the next generation of ransomware. As a result of this we’re seeing ransomware evolve at an alarming rate... Ransomware as we know it today has a sort of ‘spray and pray’ mentality; they hit as many individual targets as they can as quickly as possible. Typically, payloads are delivered via exploit kits or mass phishing campaigns. Recently a number of scattered ransomware campaigns deliberately targeting enterprise networks, have come to light. We believe that this is a harbinger of what’s to come — a portent for the future of ransomware. Traditionally, malware was never terribly concerned with the destruction of data or denial of access to its contents; With few notable exceptions, data loss was mostly a side-effect of malware campaigns. Most actors were concerned with sustained access to data or the resources a system provided to meet their objectives. Ransomware is a change to this paradigm from subversion of systems to outright extortion; actors are now denying access to data, and demanding money to restore access to that data..."
> http://blog.talosintel.com/2016/04/ransomware.html#more
___
Fake 'DTC Workshop' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/emailing-m_20150401_0729_ay56emf-__xlrae55cf0l324298-dtc-workshop-word-doc-macro-malware/
11 Apr 2016 - "An email with the subject of 'Emailing: M_20150401_0729_AY56EMF __XLRAE55CF0L324298' pretending to come from DTC Workshop <workshop@ digitaltachocentre .co.uk> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: DTC Workshop <workshop@ digitaltachocentre .co.uk>
Date: Mon 11/04/2016 10:16
Subject: Emailing: M_20150401_0729_AY56EMF __XLRAE55CF0L324298
Attachment: M_20150401_0729_AY56EMF __XLRAE55CF0L324298.DOCM
Your message is ready to be sent with the following file or link
attachments:
M_20150401_0729_AY56EMF __XLRAE55CF0L324298
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
11 April 2016: M_20150401_0729_AY56EMF __XLRAE55CF0L324298.DOCM Current Virus total detections 8/57*
.. MALWR** and Payload Security*** show a download from http ://oootels .ru/87t5gh (VirusTotal 5/56[/4])
which looks like Dridex banking Trojan but might be a rockloader Locky ransomware downloader
.. MALWR[5] analysis is inconclusive... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/d342dbc706192a2e5a2d1fe080067397350bfab6105f35c2be77fd9528f1c047/analysis/1460366222/
** https://malwr.com/analysis/MmExZDQwYTVmNjJkNGRlNjk3ZjdhZWFhYTQxZjJmOWU/
Hosts
90.156.201.101
*** https://www.hybrid-analysis.com/sample/d342dbc706192a2e5a2d1fe080067397350bfab6105f35c2be77fd9528f1c047?environmentId=4
Contacted Hosts
90.156.201.59
194.116.73.71
4] https://www.virustotal.com/en/file/08d7e812170eeffb43c75171cbe8724c190593afa7eb2bf03305934cf35d7994/analysis/1460365587/
5] https://malwr.com/analysis/MDZjMjdhYjY5MWE2NGY4Yjk5ZjBhOGFmYzVmOGEyZTU/
oootels .ru: 90.156.201.25
90.156.201.101
90.156.201.59: https://www.virustotal.com/en/ip-address/90.156.201.59/information/
>> https://www.virustotal.com/en/url/7a543993d2e8c1dcbe6f9d8a798c18227724d83ea710b35fa6ed3889b29b3667/analysis/
90.156.201.67: https://www.virustotal.com/en/ip-address/90.156.201.67/information/
>> https://www.virustotal.com/en/url/86b5fa09e04901f76ed2de570cab1797345bf17bc0a171cf2f648e055bbe26f7/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-04-12, 14:57
FYI...
PlusSized problem with Angler EK
- http://blog.dynamoo.com/2016/04/plusserver-has-plussized-problem-with.html
12 Apr 2015 - "PlusServer GmbH is a legitimate German hosting company. But unfortunately, the bad guys keep hosting Angler EK sites in their IP ranges over and over again. So far I have seen many /24 blocks which have effectively been burned by out-of-control Angler (and other EK) infections. There are many individual IPs too, but below I list some of the worst blocks (links go to Pastebin).
85.25.102.0/24
85.25.107.0/24
85.25.160.0/24
85.93.93.0/24
188.138.17.0/24
188.138.70.0/24
188.138.71.0/24
188.138.75.0/24
188.138.102.0/24
188.138.105.0/24
188.138.125.0/24
217.172.189.0/24
217.172.190.0/24
Blocking these ranges will block some legitimate sites, but if Angler is causing you a problem then I would lean towards blocking those ranges and accepting the chance of some minor or moderate collateral damage. There are other bad ranges here for other hosts too. In addition, some Angler activity has been observed in the following ranges but is not yet widespread (I will update if I see more activity):
62.75.167.0/24
85.25.41.0/24
85.25.43.0/24
85.25.74.0/24
85.25.79.0/24
85.25.106.0/24
85.25.207.0/24
85.25.218.0/24
85.25.237.0/24
188.138.33.0/24
188.138.41.0/24
188.138.57.0/24
188.138.68.0/24
188.138.69.0/24
188.138.102.0/24
PlusServer (or more likely one or more of their resellers) appear to be responsible for a large number of active Angler EK IPs (at a guesstimate, about a quarter). The problem is that some of these ranges are so badly infected (e.g. there are around 48 past and present bad IPs in 188.138.105.0/24) that the only safe option is to block traffic to those network ranges. With black hat hosts such as Qhoster or Host Sailor and to some extent Agava you can block the entire network ranges and not block anything of value at all. In using PlusServer, the bad guys can hide their evil sites among legitimate sites where administration might fear to block something accidentally. My personal opinion is that admins need to be bold and block anyway.. it should usually be possible to block individual sites where needed."
(Links w/more info on each range available at the dynamoo URL above.)
___
Evil networks to block...
- http://blog.dynamoo.com/2016/04/evil-networks-to-block-2016-04-11.html
Apr 11, 2016 23:07 - "... it has been a while since my last list of bad networks you might want to block. Hopefully in the next couple of days I will have another list outlining some bad problems with PlusServer IP ranges, in the mean time here are a load of network blocks with a high concentration of Angler EK and other nastiness. (The links go to my Pastebin with more details).
31.148.99.0/24
51.255.61.48/30
51.255.96.56/30
51.255.143.80/30
65.49.8.64/26
83.217.11.0/24
85.93.93.0/24
85.143.209.0/24
91.221.36.0/24
92.83.104.0/21
93.115.38.0/24
94.242.206.0/24
131.72.136.0/24
178.57.217.0/24
185.46.9.0/24
185.46.10.0/24
185.49.68.0/24
185.75.46.0/23
185.104.8.0/22
194.1.238.0/24
204.155.31.0/24
(Links w/more info on each range available at the dynamoo URL above.)
:fear::fear: :mad:
AplusWebMaster
2016-04-13, 15:42
FYI...
Fake 'Business Card' SPAM - JS malware leads to Dridex
- https://myonlinesecurity.co.uk/business-card-tracey-gittens-js-malware/
13 Apr 2016 - "An empty/blank email with the subject of 'Business Card' pretending to come from Tracey Gittens <traceygittens@ hotmail .com> with a zip attachment is another one from the current bot runs which downloads Dridex banking Trojan... The email looks like:
From: Tracey Gittens <traceygittens@ hotmail .com>
Date: Wed 13/04/2016 11:52
Subject: Business Card
Attachment: IMG_1670.ZIP
Body content: Completely blank/empty
13 April 2016: IMG_1670.ZIP: Extracts to: IMG_0505.js - Current Virus total detections 3/57*
.. MALWR** shows a download of Dridex Banking Trojan from
http ://beatingbingo .com/dat12223 (VirusTotal 8/57***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/8e4d129bc4632904eba399a256012534185b1ef8ccd642b2686e8df9e002d9df/analysis/1460548644/
** https://malwr.com/analysis/YzYyM2ViMTYxMzQxNGU3OWJmNzJiYTRmZDlhZjQ4M2M/
Hosts
139.162.3.176: https://www.virustotal.com/en/ip-address/139.162.3.176/information/
>> https://www.virustotal.com/en/url/0e90d1a27cc7a40cc6dcac694b8a6e22acff30dcda75dfc3aa3e77b70108c4fd/analysis/
*** https://www.virustotal.com/en/file/acfa87a161deb4928c0d74737ea62fa27dff57c399383faccadd0c619ba45246/analysis/1460546538/
___
Fake 'Past Due' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/04/malware-spam-past-due-04-13-2016.html
13 Apr 2016 - "This -fake- financial email comes with a malicious attachment:
From: Tran
Reply-To: Tran, Reuben - ADVANCED ONCOTHERAPY PLC [TranReuben1322@ telecom .kz]
Date: 13 April 2016 at 16:24
Subject: Past Due 04 13 2016 - ADVANCED ONCOTHERAPY PLC
Good morning,
Please advise status on these
If shipped, please send invoice & tracking ...
I have only seen a single copy of this, it is likely that the company name will vary from email to email. The attachment due #46691848.doc has a VirusTotal detection rate of 5/56*. According to this Malwr report** it downloads a file from:
mgmt.speraelectric .info/flows/login.php
Right at the moment this is just a copy of the Windows Calculator and is harmless, but the payload could be switched later to something more malicious, probably Locky ransomware or the Dridex banking trojan."
* https://www.virustotal.com/en/file/c50be42ff7b40c8f32efdbab1c36263af65a22f265d2fe3170110a47d903a124/analysis/1460561602/#46691848.doc
** https://malwr.com/analysis/ZmM0ZThlZjg2M2I3NDRlZmI1YmVlNzY3NzdhZjY1ZTg/
Hosts
85.93.146.3: https://www.virustotal.com/en/ip-address/85.93.146.3/information/
>> https://www.virustotal.com/en/url/657b9fdee11240b9cf91855b1572a9c623e626c17bbb98b832516962e9c8a820/analysis/
___
Fake 'Prompt response required' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/04/malware-spam-prompt-response-required.html
13 Apr 2016 - "This -fake- financial spam has a malicious attachment:
From: Hillary Odonnell [Hillary.OdonnellF@ eprose .fr]
Date: 13 April 2016 at 18:40
Subject: Prompt response required! Past due inv. #FPQ479660
Hello,
I am showing that invoice FPQ479660 is past due. Can you tell me when this invoice is scheduled for payment?
Thank you,
Jake Gill
Accounts Receivable Department
Diploma plc ...
The person it is "From", the reference number and the company name vary from spam to spam. All the samples I have seen have the name "Jake Gill" in the body text. Attached is a semi-random RTF document (for example, DOC02973338131560.rtf). There seem to be several different versions of the attachment, I checked four samples... and VirusTotal detection rates seem to be in the region of 7/57*. The Malwr reports for those samples are inconclusive... (as are the Hybrid Analyses...) but do show a failed lookup attempt for the domain onlineaccess.bleutree .us (actually hosted on 212.76.140.230 - MnogoByte, Russia). The payload appears to be Dridex. We can see a reference to that server at URLquery** which shows an attempted malicious download. It also appears in this Hybrid Analysis report***. At the moment however, the server appears to be not responding, but it appears that for that sample the-malware-communicated with:
195.169.147.88 (Culturegrid.nl, Netherlands)
178.33.167.120 (OVH, Spain)
210.70.242.41 (TANET, Taiwan)
210.245.92.63 (FPT Telecom Company, Vietnam)
These are all good IPs to block. According to DNSDB... other domains have all been hosted on the 212.76.140.230 address...You can bet that they are all malicious too.
Recommended blocklist:
212.76.140.230
195.169.147.88
178.33.167.120
210.70.242.41
210.245.92.63 "
* https://www.virustotal.com/en/file/0883544cf28895789521e33706c9d2e3ddc9696d8b36cea2be65c344baa2c5e3/analysis/
** https://urlquery.net/report.php?id=1460476851963
*** https://www.hybrid-analysis.com/sample/6b17dc713ca28c1df380a3e65e3cfef4eaa803337ab747abd23c1d36fe29d515?environmentId=1
:fear::fear: :mad:
AplusWebMaster
2016-04-14, 14:46
FYI...
Fake 'Act' SPAM - unknown ransomware
- https://myonlinesecurity.co.uk/act-unknown-ransomware/
14 Apr 2016 - "An email with the subject of 'Act' pretending to come from Nikolai Volkov <Volkov@ info .com> with a RAR attachment is another one from the current bot runs...
Update: I am informed that this is part of an “affiliate” ransomware scheme that is generally detected by Antiviruses as a generic detection of viruscoder xxxxx / filecoder xxxx, however each version is completely different and the decoder/decrypter is based on the affiliate and the infected computer’s ID strings and it is virtually impossible to decode /decrypt the infected /encrypted files. We do not know of any guaranteed tools that work. Although some generic decrypter tools from antivirus companies like Kaspersky, Bitdefender etc. might work on some versions by using a brute force approach. That would depend though on the degree of encryption that the “affiliate” put on the encryption method...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/act_email-1024x388.png
14 April 2016: act.rar: Extracts to: act.exe - Current Virus total detections 7/56*
.. MALWR**. When the malware is run on a test system, it puts a ransomware message on the desktop.
See screenshot:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/act_ransomware.jpg
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/85ad1270a7ef2637cdf56f9deeab2a7bb88488be1b19babe7e6372e57a0d7b6d/analysis/1460582417/
** https://malwr.com/analysis/ZGYxZjRjMDg0MjQxNDRjZmFmNDY0YmM2M2ZhNzQ5YmM/
Hosts
192.99.14.211: https://www.virustotal.com/en/ip-address/192.99.14.211/information/
85.25.194.97: https://www.virustotal.com/en/ip-address/85.25.194.97/information/
:fear::fear: :mad:
AplusWebMaster
2016-04-18, 17:18
FYI...
Fake 'Quote Price' SPAM - leads to malware
- http://blog.dynamoo.com/2016/04/malware-spam-please-do-confirm-quote.html
18 Apr 2016 - "This -fake- financial spam leads to malware:
From: khlee@ ahnchem .com sales
To:
Date: Mon, 18 Apr 2016 13:46:21 +0100
Subject: Re: Quote Price
Dear Sir
FYI,
Please do confirm the Quote Price and get back to me as soon as possible.
Regards
Sales Department
Attached is a fie with an unusual extension, ORDER LIST.ace which is actually a compressed archive (basically a modified ZIP file). It contains an -executable- ORDER LIST.exe which has a VirusTotal detection rate of 15/56*. That same VirusTotal report indicates traffic to:
booksam .tk/pony/gate.php
This is hosted on:
46.4.100.109 (Hetzner, Germany)
That IP address might be worth blocking. The Hybrid Analysis** indicates that this steals FTP and perhaps other passwords. This is a Pony loader which will probably try to download additional malware, but it is not clear what that it might be."
* https://www.virustotal.com/en/file/77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b/analysis/1460986926/
TCP connections
46.4.100.109: https://www.virustotal.com/en/ip-address/46.4.100.109/information/
>> https://www.virustotal.com/en/url/5b7a381f2094ebefd23b5a968a08f949ebbc90b2e280d45c349bb2ab9b2605e2/analysis/
** https://www.hybrid-analysis.com/sample/77ebbad7ff7979c1859064cafbdfa58d6401c969205c132f6fe0236a7ef7870b?environmentId=1
___
AdsTerra Malvertising
- https://blog.malwarebytes.org/threat-analysis/exploits-threat-analysis/2016/04/magnitude-ek-activity-at-its-highest-via-adsterra-malvertising/
Apr 18, 2016 - "The Magnitude EK has been on the forefront of most of the malvertising-driven attacks we have seen in the past few weeks. In fact, the intense activity it is generating is overshadowing other exploit kits and distribution methods such as compromised websites... The direct reason for this flood of Magnitude EK activity is the use of ad networks that are responsible for malvertising on a large scale. By far, the majority of incidents have come from AdsTerra (AKA TerraClicks) which we have contacted but have not heard back from... In the past two weeks, we have documented over -400- unique malvertising incidents coming out of AdsTerra. These malicious advertisements were displayed on a variety of adult sites and torrent portals and the ultimate payload was the Cerber ransomware. Those that do not get redirected to the Magnitude EK are likely to run into the infamous tech support scams... we have decided to blacklist the terraclicks[.]com domain which will effectively block any ad coming out of AdsTerra and prevent infections and scams."
terraclicks[.]com: 198.134.112.232: https://www.virustotal.com/en/ip-address/198.134.112.232/information/
>> https://www.virustotal.com/en/url/469776e7dcac1f1bd025a6f7fc81517f157426b6954a435a5455ee9b9c450942/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-04-19, 20:19
FYI...
Fake 'Angel Springs' SPAM - JS malware leads to Teslacrypt
- https://myonlinesecurity.co.uk/your-latest-documents-from-angel-springs-ltd-88665a9d-js-malware-leads-to-teslacrypt/
19 Apr 2016 - "An email with the subject of 'Your Latest Documents from Angel Springs Ltd [88665A9D]' [random numbered] pretending to come from random senders with a zip attachment is another one from the current bot runs... The email looks like:
From: Random senders
Date: Tue 19/04/2016 12:09
Subject: Your Latest Documents from Angel Springs Ltd [88665A9D]
Attachment: INF_88665A9D.zip
Dear Customer,
Please find attached your latest document (s). You may have noticed that we have changed the way you receive your new attached documents from Angel Springs. Following feedback from our customers we’ve invested in upgrading our billing systems to make things a little easier for you.
Here’s a few ways we’ve made it easier for you:
Your new documents are now attached to your email. You don’t have to follow a link now to get to your documents.
Our customer portal has been upgraded to give you a clearer, simpler view of your documents and any outstanding invoices.
You can simply and easily raise any queries you may have through the customer portal.
Please note: you may wish to save your documents on initial viewing. However, after your first viewing you will be able to access copy documents by simply clicking the link.
If you would like to discuss or have any queries in relation to any of the documents then please do not hesitate to contact us on 0845 230 9555 and we will be more than happy to assist you. Please do not reply to this email.
To see Angel Springs latest special offer that will save you money and help support Make a Wish, please click on the attached document
With Kind Regards,
Angel Springs Ltd
19 April 2016: INF_88665A9D.zip: Extracts to: E-ZPass_00212297.doc.js - Current Virus total detections 7/57*
.. MALWR** shows a download of Teslacrypt ransomware from
http ://thereissomegoodqq .com/21.exe?1 ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/eb68957639d390facbadf1b6b86b73f86da11ef38c65f3649b3b73fe5b2775a2/analysis/1461082807/
** https://malwr.com/analysis/NTUzZjc1YmNiYTNjNGNkNWE2YmJjMzUyYzIxM2JmZDI/
Hosts
54.212.162.6: https://www.virustotal.com/en/ip-address/54.212.162.6/information/
>> https://www.virustotal.com/en/url/420a2625060e8f78dc45c1c84d322b833bc0b19c18b393f29b9b51f1a80dbe5b/analysis/
185.12.108.138: https://www.virustotal.com/en/ip-address/185.12.108.138/information/
176.57.209.25: https://www.virustotal.com/en/ip-address/176.57.209.25/information/
81.177.140.186: https://www.virustotal.com/en/ip-address/81.177.140.186/information/
___
Fake 'Latest order' SPAM - JS malware leads to Dridex
- https://myonlinesecurity.co.uk/fw-latest-order-delivery-details-random-company-js-malware-leads-to-dridex/
19 Apr 2016 - "An email with the subject of 'Pay for driving on toll road, invoice #00212297' [random numbered] pretending to come from random senders with a zip attachment is another one from the current bot runs... All of these have random names as senders that matches the name in the body of the email. All the companies mentioned are totally random. The email looks like:
From: Kitty E Hampton <Kitty.Hampton3D@ vipnet .ci>
Date: Tue 19/04/2016 18:22
Subject: FW: Latest order delivery details
Attachment: shipping_inf8594263.zip
Dear customer,
We are happy to inform you that your recent order with Yazino has been scheduled for delivery
If you did not make an order with us or have any queries do not hesitate to contact us.
Do not forget to include delivery reference number from attachment in your request.
Thanks and have a good day
Truly yours,
Kitty Hampton ...
19 April 2016: shipping_inf8594263.zip: Extracts to: signed_30340JKINV2016.js - Current Virus total detections 0/57*
.. MALWR** shows a download of Dridex from
http ://ameritrade.healdsburgdistricthospital .net/vincent/carter.php which gives krebs is gay.exe (VirusTotal 5/56***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/553c4624184c014ab1af060ecbca380a5550efd2cde5a74c697593792549b337/analysis/1461088509/
** https://malwr.com/analysis/Zjk3YWIzY2M2ZjFlNDY0MmE2MWVhOTc4MjdjNjQyODc/
Hosts
212.109.223.112: https://www.virustotal.com/en/ip-address/212.109.223.112/information/
ameritrade.healdsburgdistricthospital .net: 212.109.223.112
*** https://www.virustotal.com/en/file/605e46977c462e8319ae8b6351156a6d3fd0abb3d9bf3e2a8c6440c40e472731/analysis/1461086145/
___
Fake 'Facture' SPAM - JS malware Locky downloader
- http://blog.dynamoo.com/2016/04/malware-spam-facture-1985-corrigee.html
19 Apr 2016 - "This French-language spam leads to malware:
From: Louis - Buvasport [louis64@ buvasport .com]
Date: 19 April 2016 at 13:29
Subject: Facture : 1985 corrigée
Cher Client,
Veuillez trouver en pièce-jointe, la facture de vos achats. SANS FRAIS DE TRANSPORT
Votre marchandise est partie et vous devriez la recevoir dans les prochains jours.
Si vous avez des questions, n'hésitez pas à nous contacter.
Cordialement,
BUVA SPORTS
Attached is a file 093887283-19.04.2016.zip which contains a semi-randomly named script (e.g. 741194709-18.04.2016.PDF.js) with VirusTotal detection rates of 6/56 [1] [2]. According to these Malwr reports [3] [4] the script downloads a file from one of the following locations:
pushdkim .com/267h67c5e
pay.360degreeinfo .com/267h67c5e
There are probably other scripts with different download locations, the binary has a detection rate of 10/55*.The Hybrid Analysis report** shows that this executable attempts to download another executable from:
buhjolk .at/files/Yd6aGF.exe
At the moment that location is 404ing and the main payload fails.. This is probably attempting to drop Locky ransomware. The loader also attempts to interact with some servers belonging to BMG, possibly to generate false data for anyone doing network analysis. To be on the safe side, it might be worth blocking:
93.79.82.215 (Telesweet, Ukraine) "
1] https://www.virustotal.com/en/file/d6b6db16b875de660ad80cdc54cd9f67c16782175b07ec29c2642bccdc3dd685/analysis/1461072147/
2] https://www.virustotal.com/en/file/85d033f68e4baf73577b01f0bed67612c161e3ba51b4b1edc9e5c3822d99a9f9/analysis/1461072158/
3] https://malwr.com/analysis/Njk3ZDQ0ZjgyNjMxNGMwY2IzZGUyMTQ4MmI3ZDgzOTM/
Hosts
96.47.237.49
109.235.139.64
4] https://malwr.com/analysis/ZGNlODVhNGE1ZTVkNDFkZmEwNjA0MmNkZGZiNmMyYWY/
192.185.106.45
109.235.139.64
* https://www.virustotal.com/en/file/cc0c0b726462aa27cafce808cb65ec19f53ed1601ec7b3a16ed0fd0c4047eb92/analysis/1461072738/
TCP connections
109.235.139.64
91.218.89.197
** https://www.hybrid-analysis.com/sample/cc0c0b726462aa27cafce808cb65ec19f53ed1601ec7b3a16ed0fd0c4047eb92?environmentId=1
Contacted Hosts
109.235.139.64
93.79.82.215
buhjolk .at: 176.103.235.5
77.244.33.44
178.150.75.230
94.181.162.84
78.30.248.37
37.1.128.96
78.154.190.87
176.104.31.120
178.218.66.120
5.248.25.177
:fear::fear: :mad:
AplusWebMaster
2016-04-20, 13:40
FYI...
Fake 'Document' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/04/malware-spam-accounts-at-beerhouse-self.html
20 Apr 2016 - "This -fake- financial spam does not come from Beerhouse Self Drive but is instead a simple forgery with a malicious attachment:
From: Accounts at Beerhouse Self Drive [accounts3965@ beerhouse .co.uk]
Date: 20 April 2016 at 11:01
Subject: Document No™2958719
Thanks for using electronic billing
Please find your document attached
Regards
Beerhouse Self Drive
In the only sample I have seen so far, there is an attachment Document No 992958719.doc which has a VirusTotal detection rate of 7/56*. The Malwr report** for that document shows that it downloads a binary from:
bi.pushthetraffic .com/87ty8hbvcr44
There are probably many other download locations. This dropped file has a detection rate of 6/56***. The DeepViz report[4] and Hybrid Analysis[5] between then identify what is likely to be Dridex, phoning home to the following servers:
193.90.12.221 (MultiNet AS, Norway)
212.126.59.41 (Letshost / Digiweb, Ireland)
93.104.211.103 (Contabo GmbH, Germany)
155.133.82.82 (FUFO Studio Agata Grabowska, Poland)
212.50.14.39 (Computers Equipnemt, Bulgaria)
91.194.251.204 (TOV Dream Line Holding, Ukraine)
194.116.73.71 (Topix, Italy)
64.76.19.251 (Impsat, Argentina)
Recommended blocklist:
193.90.12.221
212.126.59.41
93.104.211.103
155.133.82.82
212.50.14.39
91.194.251.204
194.116.73.71
64.76.19.251 "
* https://www.virustotal.com/en/file/239778878e29a96215e6387f92d755574ac53b557ebb152e8ca08052d6a46449/analysis/1461148270/
** https://malwr.com/analysis/ZGU4MzQ2YzYwMjIxNDMxZTg5YTAzZDYxYTY1OTNkM2M/
Hosts
103.233.195.10
*** https://www.virustotal.com/en/file/9e84e79fdec7101e4f6758d82a30dfff3434534c739bca024d67b029a788f29f/analysis/1461148465/
4] https://sandbox.deepviz.com/report/hash/dc55a1928174d3d9341b928bd2055c29/
5] https://www.hybrid-analysis.com/sample/9e84e79fdec7101e4f6758d82a30dfff3434534c739bca024d67b029a788f29f?environmentId=1
- https://myonlinesecurity.co.uk/document-not2152550-beerhouse-self-drive-word-doc-macro-malware-leads-to-dridex/
20 Apr 2016 - "An email with the subject of 'Document Not2152550' (random numbers) pretending to come from Accounts at Beerhouse Self Drive <accounts80ba@ beerhouse .co.uk> with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Accounts at Beerhouse Self Drive <accounts80ba@ beerhousei.co.uk>
Date: Wed 20/04/2016 11:00
Subject: Document Not2152550
Thanks for using electronic billing
Please find your document attached
Regards
Beerhouse Self Drive
20 April 2016: Document No 742152550.doc - Current Virus total detections 6/57*
.. MALWR** shows a download of Dridex Banking Trojan from
http ://rightbrainstechnology .co.in/87ty8hbvcr44 (VirusTotal 6/57***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/88520824e486a1e2f3b9ce4317a99b52f8fba344dd560c87262b86caa91a715e/analysis/1461146416/
** https://malwr.com/analysis/NDkzOGM5YzM3OWQ5NDUzMTg3YzIzOGZmZjQ1NTY4NWI/
Hosts
143.95.38.5
*** https://www.virustotal.com/en/file/9e84e79fdec7101e4f6758d82a30dfff3434534c739bca024d67b029a788f29f/analysis/1461147163/
___
Fake 'WhatsApp' SPAM - leads to malware
- https://myonlinesecurity.co.uk/whatsapp-you-just-missed-a-voice-notice-fake-pdf-malware/
20 Apr 2016 - "An email with the subject of 'You just missed a voice notice!' pretending to come with WhatsApp zip attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/You-just-missed-a-voice-notice-1024x507.png
20 April 2016: daquan36.zip: Extracts to: ulysses.exe - Current Virus total detections 19/57*
.. MALWR** ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b43ec474bb1388a10f9cacb4c4218526512e648d638da60b671110d07c215a49/analysis/1461130799/
TCP connections
2.50.143.246: https://www.virustotal.com/en/ip-address/2.50.143.246/information/
** https://malwr.com/analysis/ZmRjODVmNGNlYzZjNDZkYzliZjI3NzAzZTEwZDEwOTY/
Hosts
89.120.101.64: https://www.virustotal.com/en/ip-address/89.120.101.64/information/
___
Fake 'XL Copy Invoice' SPAM - xls macro malware leads to Dridex
- https://myonlinesecurity.co.uk/xl-copy-invoice-997063-xljoinery-co-uk-claire-runagall-excel-xls-spreadsheet-macro-malware-leads-to-dridex/
20 Apr 2016 - "An email with the subject of 'XL Copy Invoice – 997063' pretending to come from Claire Runagall <ClaireR@ xljoinery .co.uk> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Claire Runagall <ClaireR@ xljoinery .co.uk>
Date: Wed 20/04/2016 12:08
Subject: XL Copy Invoice – 997063
Attachment: 997063_Copy.xls
Hi ,
Please find attached copy invoice as requested
Kid regards
Claire Runagall
Finance Assistant
XL Joinery Limited ...
20 April 2016: 997063_Copy.xls - Current Virus total detections 4/56*
.. MALWR** shows a download of Dridex banking Trojan from
http ://dnssd-el-edcollege .org/87ty8hbvcr44 (VirusTotal 8/56***). Although this has the same file -names- as today’s earlier malspam run[4] delivering Dridex, it is a -different- file... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/3d6b13f783fc64f2d8c5049c7b9d9513b4721ca80f4e8e2d69bf4bdaf5765e7c/analysis/1461163278/
** https://malwr.com/analysis/YzVlMWFmZjM1OTgxNDRlZDkzZmYxZTIwYmY1Zjc5YWE/
Hosts
143.95.38.5: https://www.virustotal.com/en/ip-address/143.95.38.5/information/
*** https://www.virustotal.com/en/file/f03f6490c922f2068109f43398ef9ec7dea5e4eaee30a8b844a595a6adda518f/analysis/1461161570/
4] https://myonlinesecurity.co.uk/document-not2152550-beerhouse-self-drive-word-doc-macro-malware-leads-to-dridex/
___
'Upgrade to New Outlook WebApp' - Phish
- https://myonlinesecurity.co.uk/upgrade-to-new-outlook-webapp-2-1-phishing/
19 Apr 2016 - "... phishing attempts against Microsoft Outlook Web Access (Microsoft Outlook Web App (formerly known as Outlook on the Web or Outlook Web Access) is a browser-based email client. Outlook Web App lets you access your Microsoft Exchange Server mailbox from almost any web browser.) These sort of phishing attempts are much harder to protect against, because the OWA web address will not be a Microsoft website or any common site name but is normally a subdomain or part of your own company web domain. To make it harder, many companies do have numerous different email domains, so email messages might come from any of the company domains... One of the many subjects in this sort of phishing attempt is 'Upgrade to New Outlook WebApp 2.1' or something very similar. This one wants only wants your email log in details...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/outlook_web_app-1024x708.png
If you are unwise enough to follow the link http ://www.uprmbih .ba/owa/1/2/index.htm you see a webpage looking like:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/uprmbih-1024x561.png
... a very good imitation of a genuine Microsoft Office 365 / Outlook Web Access log on page. If you do fill in the details you get sent on to the -Genuine- Office 365 log in page:
- https://login.microsoftonline.com/
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
:fear::fear: :mad:
AplusWebMaster
2016-04-21, 14:28
FYI...
Fake 'INVOICE' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/04/malware-spam-balanceukinvoicex002380112.html
21 Apr 2016 - "This -fake- financial spam does not come from BalanceUK Limited but is instead a simple forgery with a malicious attachment:
From: adminservices@ grouphomesafe .com
Date: 21 April 2016 at 10:33
Subject: "BalanceUK_INVOICE_X002380_1127878"
Thank you for placing your order with BalanceUK Ltd
Please find attached your document.
BalanceUK Limited,
30-32 Martock Business Park,
Great Western Road,
Martock,
Somerset,
TA12 6HB ...
Attached is a ZIP file with a name that matches the reference in the subject field (e.g. BalanceUK_X271897_1127878.zip). Although I have seen a few samples with different names, they are all the same attachment. Inside that ZIP file is another ZIP file named 4812610-20.04.2016.zip and in there is a malicious script named 4812610-20.04.2016.js with a VirusTotal detection rate of 6/56*. This malicious script... downloads an executable from:
dd.ub .ac.id/9uhg5vd3
There are usually different download locations, but so far I have only seen the one. This has a detection rate of 5/56**. The Hybrid Analysis*** of the dropped binary shows network traffic to:
193.90.12.221 (MultiNet AS, Norway)
200.159.128.144 (Novanet da Barra Ass e Inf LTDA, Brazil)
The payload is not clear, but is probably the Dridex banking trojan.
Recommeded blocklist:
193.90.12.221
200.159.128.144 "
* https://www.virustotal.com/en/file/f147a9e7f9868005b0b633ca73d446972d3516b2fc6f799219c9daafd29d2f0a/analysis/1461231512/
** https://www.virustotal.com/en/file/fc25709c4e05dbfbcc6ae0cf8a7c06e80156ae05179203021838259aeda9801a/analysis/1461232207/
*** https://www.hybrid-analysis.com/sample/fc25709c4e05dbfbcc6ae0cf8a7c06e80156ae05179203021838259aeda9801a?environmentId=1
- https://myonlinesecurity.co.uk/balanceuk_invoice_x714368_0134185-js-malware/
21 Apr 2016 - "An email with the subject of “BalanceUK_INVOICE_X714368_0134185” [random numbered] pretending to come from adminservices@ grouphomesafe .com with a zip attachment is another one from the current bot runs... The email looks like:
From: adminservices@ grouphomesafe .com
Date: Thu 21/04/2016 10:25
Subject: “BalanceUK_INVOICE_X714368_0134185”
Attachment: BalanceUK_X864886_0134185.zip
Thank you for placing your order with BalanceUK Ltd
Please find attached your document.
BalanceUK Limited,
30-32 Martock Business Park,
Great Western Road,
Martock,
Somerset,
TA12 6HB ...
21 April 2016: BalanceUK_X864886_0134185.zip: Extracts to: 3930404-19.04.2016.zip which extracts to 3930404-19.04.2016.js - Current Virus total detections 6/57*
.. MALWR** doesn’t shows any downloads but it is likely that something is preventing that. It is likely to be either a Dridex, Locky or Teslacrypt downloader... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/074dba97a2b942c97e11d5ba21a6635876e21f94ee1b0e423f16c9141b49cd5a/analysis/1461230893/
** https://malwr.com/analysis/OWY1MTc4YTQyMjM1NDdhMjk0N2MwNjc4OTJkOTM3MGM/
___
Fake 'Purchase Order' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/04/malware-spam-dispatched-purchase-order.html
21 Apr 2016 - "This -fake- financial spam does not come from Covance but is instead a simple -forgery- with a malicious attachment:
From: FSPRD@ covance .com
Reply-To: donotreply@ covance .com
Date: 21 April 2016 at 12:03
Subject: Dispatched Purchase Order
Purchase Order, 11300 / 0006432242, has been Dispatched. Please detach and print the attached Purchase Order.
***Please do not respond to this e-mail as the mailbox is not monitored...
Attached is a file with a name matching the reference in the email, e.g. 0006432242.tgz which is a compressed archive file, containing in turn -another- archive file with a name like 5611205-19.04.2016.tar and that archive is a malicious script named in an almost identical format the the TAR file (e.g. 5611205-19.04.2016.js). This script has a typical detection rate of 8/56*. So far I have seen two versions of this script, downloading from:
mountainworldtreks .com/9uhg5vd3
secondary36.obec .go.th/9uhg5vd3
The downloaded binary is the -same- in both cases. This Hybrid Analysis** and DeepViz Analysis*** indicate network traffic to:
193.90.12.221 (MultiNet AS, Norway)
194.116.73.71 (Topix, Italy)
64.76.19.251 (Impsat, Argentina)
200.159.128.144 (Novanet da Barra Ass e Inf LTDA, Brazil)
The payload appears to be the Dridex banking trojan.
Recommended blocklist:
193.90.12.221
194.116.73.71
64.76.19.251
200.159.128.144 "
* https://www.virustotal.com/en/file/e4e1a7208ba70e276aed872e1ff58b4e90765e82fac6969f2e55bd0d5f3525d7/analysis/1461239783/
** https://www.hybrid-analysis.com/sample/94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb?environmentId=1
*** https://sandbox.deepviz.com/report/hash/8503d0f6bfa7f6b14a2525f4fa41ddfc/
___
Fake 'Latest order' SPAM - JS malware
- http://blog.dynamoo.com/2016/04/malware-spam-fw-latest-order-delivery.html
21 Apr 2016 - "This fake financial spam leads to malware:
From: Milan Bell [Milan.Bell5@ viuz-en-sallaz .fr]
Date: 21 April 2016 at 17:45
Subject: FW: Latest order delivery details
Good morning!
Hope you are good.
Yesterday and the day before my colleague (Glover Hector) sent you a request regarding the invoice INV_6325-2016-victimdomain .tld past due.
I kindly ask you to give us a reply finally. We're getting no answers from you. Please stop ignoring invoice requests.
Many thanks and good luck
Milan Bell
DORIC NIMROD AIR ONE LTD ...
The rather rude pitch here is a canny bit of social engineering, aimed to make you open-the-link -without- clicking. I have only seen one sample of this at present and I guess that the details vary from email to email. In this case the attachment was called pastdue_tovictimdomain.tld340231.zip containing a malicious script pastdue60121342016.js. This script has a VirusTotal detection rate of just 1/56*. The Malwr report and Hybrid Analysis** for this show it downloading a malicious binary from:
trendmicro.healdsburgdistricthospital .com/RIB/assets.php
Cheekily the URL references a well-known security company. The domain it is using is a -hijacked- GoDaddy domain, and the download location is actually hosted at:
176.103.56.30 (PE Ivanov Vitaliy Sergeevich / Xserver.ua, Ukraine)
You can bet that this is a malicious server and I recommend -blocking- it. This script downloads a binary named alarm.exe which has a detection rate of 4/56***. The Hybrid Analysis[4] for this sample shows network connections to:
103.245.153.154 (OrionVM, Australia)
176.9.113.214 (Hetzner, Germany)
210.245.92.63 (PT Telecom Company, Vietnam)
23.249.1.171 (Datacate , US)
It is not clear what the payload is, but there are indications it is the Dridex banking trojan.
Recommended blocklist:
176.103.56.30
103.245.153.154
176.9.113.214
210.245.92.63
23.249.1.171 "
* https://www.virustotal.com/en/file/9d5c9a2b120bf757751a5203ce0b02e1579dbc29102cfdce8a15351ac4751531/analysis/1461257525/
** https://www.hybrid-analysis.com/sample/9d5c9a2b120bf757751a5203ce0b02e1579dbc29102cfdce8a15351ac4751531?environmentId=1
*** https://www.virustotal.com/en/file/dba5d3b96a6065660250d36d8eb56744a2b88f71bbd6fcced15394cb7efd0ea2/analysis/1461257815/
4] https://www.hybrid-analysis.com/sample/dba5d3b96a6065660250d36d8eb56744a2b88f71bbd6fcced15394cb7efd0ea2?environmentId=1
___
Earthquake Disaster Email SCAMS
- https://www.us-cert.gov/ncas/current-activity/2016/04/20/FTC-Releases-Alert-Earthquake-Disaster-Email-Scams
April 20, 2016 - "The Federal Trade Commission (FTC) has released an alert on email -scams- that cite the recent earthquakes in Ecuador and Japan. The -scam-emails- may contain links-or-attachments that direct users to phishing or malware-infected websites. Donation requests from -fraudulent- charitable organizations commonly appear after major natural disasters. US-CERT encourages users to take the following measures to protect themselves:
> Review the FTC alert* and their information on Charity Scams**.
> Do not follow unsolicited web links or attachments in email messages.
> Keep antivirus and other computer software up-to-date..."
* https://www.consumer.ftc.gov/blog/how-help-earthquake-victims-ecuador-and-japan-0
April 20, 2016
** https://www.consumer.ftc.gov/features/feature-0011-charity-scams
:fear::fear: :mad:
AplusWebMaster
2016-04-22, 14:11
FYI...
Fake 'Amazon' SPAM - leads to malware
- http://blog.dynamoo.com/2016/04/malware-spam-your-amazoncouk-order-has.html
22 Apr 2016 - "This -fake- Amazon email leads to malware. On some mail clients there may be no body text:
From: auto-shipping@ amazon .co.uk Amazon .co.uk
To:
Date: Fri, 22 Apr 2016 10:50:56 +0100
Subject: Your Amazon.co.uk order has dispatched (#525-2814418-9619799)
Dear Customer,
Greetings from Amazon .co.uk,
We are writing to let you know that the following item has been sent using Royal Mail...
Your order #525-2814418-9619799 (received April 22, 2016)...
Attached is a file with a name that matches the randomly-generated order (in this case, ORDER-525-2814418-9619799.docm). According to analysis by a couple of other trusted parties, the various versions of the malicious document download a binary from:
www .smileybins .com.au/0u8ggf5f5
kpmanish .com/0u8ggf5f5
neoventtechnologies .com/0u8ggf5f5
itronsecurity .com/0u8ggf5f5
bnacoffees .com/0u8ggf5f5
ambikaonline .com/0u8ggf5f5
usacarsimportsac .com/0u8ggf5f5
giftsandbaskets .co.th/0u8ggf5f5
This dropped -executable- has a detection rate of 6/56*. The Hybrid Analysis** and DeepViz Analysis*** plus some data sourced from other parties (thank you) indicates that the malware calls back to the following IPs:
186.250.48.10 (Redfox Telecomunicações Ltda., Brazil)
193.90.12.221 (MultiNet AS, Norway)
194.116.73.71 (Topix, Italy)
200.159.128.144 (Novanet da Barra Ass e Inf LTDA, Brazil)
The payload here appears to be the Dridex banking trojan.
Recommended blocklist:
186.250.48.10
193.90.12.221
194.116.73.71
200.159.128.144 "
* https://www.virustotal.com/en/file/1d5a3ea559e518cd5a5f02899df8bd6682ab9372b7adb5760fcc18e3bddd76b7/analysis/1461324262/
** https://www.hybrid-analysis.com/sample/1d5a3ea559e518cd5a5f02899df8bd6682ab9372b7adb5760fcc18e3bddd76b7?environmentId=1
*** https://sandbox.deepviz.com/report/hash/cf39567a7da322c8eafd02583f1ac809/
___
Fake 'Workers Comp' SPAM - JS malware
- https://myonlinesecurity.co.uk/general-liability-workers-compensation-insurance-pacificpathins-com-js-malware/
22 Apr 2016 - "An email that appears to come from pacificpathins .com /Pacific Pathways insurance brokers with the subject of 'General Liability & Workers Compensation Insurance' pretending to come from Random names and email addresses with a zip attachment is another one from the current bot runs which downloads some unknown malware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/General-Liability-Workers-Compensation-Insurance-1024x640.png
21 April 2016: PPI QUOTE REQUEST_955015.zip: Extracts to: wrk_insur29uk22442016.js
Current Virus total detections 2/57*.. MALWR** shows a download that is very offensively named from
http ://inter.whyscc .com/gimme/some/loads_nigga.php which gave me favicon.ico which of course is -not- an icon file but a renamed.exe (VirusTotal 4/56***)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/817ba7f0cdd7ef79ff5939ea259c96e471146b805795255dbaf5c874647f58f7/analysis/1461327441/
** https://malwr.com/analysis/YjVlYWU3MWExMDhlNGEzMGFmMGZkMjRmN2Y0YWUzNmM/
Hosts
193.201.227.59: https://www.virustotal.com/en/ip-address/193.201.227.59/information/
*** https://www.virustotal.com/en/file/d80ba433f3a946c0af042d8bd02c88203b598d1ba83f5163618203131d4a300d/analysis/1461331736/
inter.whyscc .com: 193.201.227.59
___
Fake 'Your Order Ref' SPAM - doc malware
- https://myonlinesecurity.co.uk/thank-you-for-your-order-ref-58380529-talkmobile-word-doc-malware/
22 Apr 2016 - "An email with the subject of 'Thank You For Your Order Ref 58380529' pretending to come from talkmobile <do_not_reply@ talkmobile .co.uk> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/Thank-You-For-Your-Order-Ref-58380529-1024x314.png
If you do open the word doc, this is where they invite you to double-click-the-image to see the invoice.
That would -infect- you with whatever malware this malicious doc contains:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/invoice-talkmobile-1024x214.png
21 April 2016: Invoice.docx - Current Virus total detections 3/57*
.. An analyst managed to extract it for me and we got INVOIC~1.EXE which I think is supposed to be called Invoice_14_04_16_65216.exe (VirusTotal 2/55**) MALWR[4] which shows a dropped/extracted js file Rechnung_14_04_16_65216.js (VirusTotal 1/57***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/fff90d831e498c051a0f37a97b124ca74c8050903cf37582684f5d57744778be/analysis/1461335298/
** https://www.virustotal.com/en/file/469e612365c68c4fa1600191510c9b81d4f2d835335284216391cafd6115c26d/analysis/1461338217/
*** https://www.virustotal.com/en/file/9c7fb124c7774d81a195c3764703799e056ece09628efc92a8b65e5202c8085a/analysis/1461338547/
4] https://malwr.com/analysis/MjU2OGY1NmZhMjE5NDhiYmIyZjAwNTE2MzhlMzkyNzg/
___
Nuclear EK cashes in on demand from cryptoransomware rings
- http://arstechnica.com/security/2016/04/going-nuclear-how-a-malware-as-a-service-turns-exploits-into-cash/
Apr 22, 2016 - "Security researchers at Cisco Talos* and Check Point** have published reports detailing the inner workings of Nuclear, an "exploit kit" Web service that deployed malware onto victims' computers through malicious websites. While a significant percentage of Nuclear's infrastructure has been recently disrupted, the exploit kit is still operating — and looks to be a major contributor to the current crypto-ransomware epidemic... Much of Talos' data on Nuclear comes from tracking down the source of its traffic — a cluster of "10 to 15" IP addresses that were responsible for "practically all" of the exploit infrastructure. Those addresses were being hosted by a single cloud hosting provider—DigitalOcean. The hosting company's security team confirmed the findings to Talos and took down the servers — sharing what was on them with security researchers... At the same time, Check Point researchers had gained access to the paid malware delivery service's customer control panel... the vast majority of the traffic that hit Nuclear's exploit pages were redirected there by malicious advertisements — one Spanish-language ad for webcams pushed over 25,000 distinct visiting IP addresses to Nuclear in just one day, Talos found. Just one server analyzed by Talos "showed approximately 60,000 unique IP's [per day] connecting to this particular server," Biasni wrote. "This amount of activity far exceeds what we were expecting based on previous data analysis." Surprised at how so much traffic could get through websites without being noticed, Talos found the Spanish sex webcam ad was hosted on a single porn site — and accounted for nearly half the traffic to that server's landing pages. The elimination of the DigitalOcean infrastructure may change some of the tactics of Nuclear's operator, but the exploit kit is probably not going away. Cisco has added Snort intrusion detection rules to help try to catch Nuclear exploit attacks, and Check Point has added detection for Nuclear exploit landing pages and the exploits themselves."
* http://blog.talosintel.com/2016/04/nuclear-exposed.html
** http://blog.checkpoint.com/2016/04/20/inside-nuclears-core-analyzing-the-nuclear-exploit-kit-infrastructure/
:fear::fear: :mad:
AplusWebMaster
2016-04-25, 14:13
FYI...
FAREIT strain abuses PowerShell
- http://blog.trendmicro.com/trendlabs-security-intelligence/new-fareit-strain-delivered-abusing-powershell/
Apr 25, 2016 - "... Last March 2016, we noted that PowerWare crypto-ransomware* also abused PowerShell. Recently, we spotted a new attack where PowerShell was abused to deliver a FAREIT variant... users can either receive a spam mail with a document that has malicious .PDF file or a Word document file with malicious macro codes:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/04/FAREIT1.jpg
... When (IF) users run the PDF, it will execute the PowerShell to perform its malicious routine. Based on our analysis, when users open the PDF file, the -malicious- PDF will utilize OpenAction to execute its malicious code. TSPY_FAREIT is downloaded on the systems, stealing a plethora of information such as stored information (usernames, passwords) in certain browsers, stored email credentials, and bitcoin-related details, among others. If the recipients get emails with documents containing malicious-macros, enabling the macro feature will result to the execution of the malware on the system as well... Both PDF and macros are also used in some organizations and enterprises, thus employees who received such FAREIT-related spam emails won’t suspect anything malicious... Users are advised to be wary in opening emails even if these came from seemingly known sources. Installing security software on the system that can detect these spammed messages and malicious files can secure users from possible information theft..."
* http://blog.trendmicro.com/trendlabs-security-intelligence/tax-day-extortion-powerware-crypto-ransomware-targets-tax-files/
___
Fake 'PDF' SPAM - malicious attachment
- https://myonlinesecurity.co.uk/ihre-mobilfunk-rechnung-vom-25042016-im-anhang-als-pdf-fake-pdf-malware/
25 Apr 2016 - "A German language email pretending to be a Vodafone invoice or bill with the subject of 'Ihre Mobilfunk – Rechnung vom 25\04\2016 im Anhang als PDF' pretending to come from VodafoneOnline_Rechnung@ vodafone .com with a zip attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/Ihre-Mobilfunk-Rechnung-vom-25042016-im-Anhang-als-PDF-1024x626.png
25 April 2016: Ihre Rechnung vom 25.04.2016 als pdf_.zip: Extracts to: Ihre Rechnung vom 25.04.2016 als pdf_.PDF.exe - Current Virus total detections 5/56* | Payload Security**
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ee08cab85880924be331b3f750d0d8e23ad43f4a53cd11cd28b1f93bdbce6424/analysis/1461569966/
** https://www.reverse.it/sample/ee08cab85880924be331b3f750d0d8e23ad43f4a53cd11cd28b1f93bdbce6424?environmentId=4
___
Evil networks to block 2016-04-25
- http://blog.dynamoo.com/2016/04/evil-networks-to-block-2016-04-25.html
25 Apr 2016 - "Following on from this post* and previous ones in that series, here is a new set of IP ranges where the Angler EK seems to be clustering. In addition, I updated the list of PlusServer ranges** where Angler is becoming a critical problem too.
5.39.47.0/27
31.25.241.0/24
46.183.220.128/25
51.254.69.64/26
85.14.253.128/25
91.227.18.96/27
95.46.98.0/24
95.215.108.0/24
131.72.139.0/24
185.45.193.0/24
185.49.69.0/24
192.52.167.0/24
193.9.28.0/24
209.126.120.0/24
209.126.122.0/24
209.126.123.0/24
212.76.140.0/24 "
* http://blog.dynamoo.com/2016/04/evil-networks-to-block-2016-04-11.html
** http://blog.dynamoo.com/2016/04/plusserver-has-plussized-problem-with.html
___
New Downloader for Locky
- https://www.fireeye.com/blog/threat-research/2016/04/new_downloader_forl.html
Apr 22, 2016 - "... Conclusion: The actors behind the Locky ransomware are actively seeking new ways to successfully install their malware on victim computers. That may be one of the reasons this new downloader is used and being introduced to the -current- distribution framework. This downloader can be a new platform for installing other malware (“Pay-per-Install”)...
URLs:
mrsweeter .ru/87h78rf33g: 5.101.152.66
185.130.7.22 /files/sBpFSa.exe
185.130.7.22 /files/WRwe3X.exe
slater.chat .ru/gvtg77996: 195.161.119.85
hundeschulegoerg .de/gvtg77996: 212.40.179.111
buhjolk .at/files/dIseJh.exe
buhjolk .at/files/aY5TFn.exe: 91.210.111.82
46.173.174.124
176.117.68.154
93.89.216.141
37.57.186.76
134.249.10.204
109.161.105.218
5.105.23.25
176.210.28.55
46.98.79.204 "
(More detail at the fireeye URL above.)
:fear::fear: :mad:
AplusWebMaster
2016-04-26, 15:53
FYI...
Fake 'Missing payments' SPAM - leads to malware
- http://blog.dynamoo.com/2016/04/malware-spam-missing-payments-for.html
26 Apr 2016 - "This -fake- financial spam leads to malware:
From: Jeffry Rogers [Jeffry.RogersA5@ thibaultlegal .com]
Date: 26 April 2016 at 12:58
Subject: Missing payments for invoices inside
Hi there!
Hope you are good.
Hope you are good. We're missing payments on our statements for the invoices included in this email. Please let us know, when the payments will be initiated.
BTW, trying to get reply from you for a long time. This is not junk, do not ignore it please.
Kind Regards
Jeffry Rogers
Henderson Group ...
I have only seen a single sample of this, it is likely that the company names and sender will vary. Attached is a file missing_quickbooks982.zip which contains a malicious obfuscated javascript 91610_facture_2016.js which attempts to download a component from:
web.spartanburgcommunitycollege .com/gimme/some/loads_nigga.php
This drops a file pretending to be favicon.ico which is actually an -executable- with a detection rate of 3/56*. This Hybrid Analysis** and this DeepViz report*** indicate network traffic to:
103.245.153.154 (OrionVM Retail Pty Ltd, Australia)
176.9.113.214 (Hetzner, Germany)
210.245.92.63 (FPT Telecom Company, Vietnam)
213.192.1.171 (EASY Net, Czech Republic)
The payload isn't exactly clear, but it looks like Dridex rather than Locky. Almost certainly one of the two.
Recommended blocklist:
103.245.153.154
176.9.113.214
210.245.92.63
213.192.1.171 "
* https://www.virustotal.com/en/file/0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183/analysis/
** https://www.hybrid-analysis.com/sample/0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183?environmentId=4
*** https://sandbox.deepviz.com/report/hash/5046b7858f5983db564ece8ba36c281b/
___
Fake 'You account' SPAM - malware tech support SCAM
- https://myonlinesecurity.co.uk/you-account-have-a-problem-malware-tech-support-scam/
26 Apr 2016 - "An email with the subject of 'You account have a problem' pretending to come from No answer@ your email domain addressed to victim@ your email domain tries to get you to download a load of crapware -or- sends you to a tech support -scam- site that locks your browser, pretends you are infected and continually screeches at you to ring the number on the pop up to help. These are -not- coming from your email server...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/You-account-have-a-problem-1024x468.png
If you are unwise enough to follow-the-link, you first go to
http ://multidekor-illumination .com/wp-content/themes/inovado/framework/plugins/ which -redirects- you to various pages, which either try to persuade you to download a load of crapware masquerading as either a flash player update -or- a Java update -or- display a bright red fake Microsoft alert page at
777secureyoursystem .com/1/ with pop ups saying you are infected, with an audio in background...
26 April 2016: adobe_flash_setup-26105491.exe -or- java_runtime_enviroment_setup-26106084.exe
Current Virus total detections 11/57*
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e2e5ee53c656adc177d5478ae64a92bd4f76d66647612e54ff34dc9ed2b7d421/analysis/1461681165/
multidekor-illumination .com: 52.29.158.152: https://www.virustotal.com/en/ip-address/52.29.158.152/information/
>> https://www.virustotal.com/en/url/1c99104ed9a805a9d060b2a349eac9344c588c7406dde6a9a7bd9a1686a19580/analysis/
777secureyoursystem .com: 166.62.6.52: https://www.virustotal.com/en/ip-address/166.62.6.52/information/
>> https://www.virustotal.com/en/url/4c92da5b16df93e2f401ed43240f65d1e566afc0e616ecd24a3205ca15e22004/analysis/
___
Malvertising on Pirate Bay drops Ransomware
- https://blog.malwarebytes.org/threat-analysis/exploits-threat-analysis/2016/04/malvertising-on-the-pirate-bay-drops-ransomware/
Apr 26, 2016 - "Popular torrent site The Pirate Bay was serving ransomware via a malvertising attack this week-end. The fraudulent advertiser was using a ‘pop-under’ to silently -redirect- users to the Magnitude exploit kit and infect them with the Cerber ransomware. This is part of the same Magnitude EK malvertising campaigns we have documented previously* on this blog. The ad network changes, but the modus operandi remains the same:
> https://blog.malwarebytes.org/wp-content/uploads/2016/04/Flow-1.png
Malvertising:
Fraudulent domain:
traffic.adxprts .com/?placement=[redacted]&redirect
delivery.adxprts .com/delivery.php?url=http%3A%2F%2Ftrafficholder.com%2Fin%2Fpop.php%3Fpenthubcom
Ad network:
trafficholder .com/in/pop.php?penthubcom
Magnitude EK Gates:
gamesheep .me: A temporary error occurred during the lookup...
veronagames .me: 185.130.226.107: https://www.virustotal.com/en/ip-address/185.130.226.107/information/
>> https://www.virustotal.com/en/url/dfd53e174ab0450ff55ea3243bfcd15740b85f7e0959ab2607dd2a1bd5d34143/analysis/
... RiskIQ** also spotted the same advertiser pushing -fake- software. That domain has now been obliterated by CloudFlare."
* https://blog.malwarebytes.org/cybercrime/2016/04/magnitude-ek-activity-at-its-highest-via-adsterra-malvertising/
** https://sf.riskiq.net/bl/156607452/4c2f5273d52ae5fb?_sg=v4W%2B%2F%2Fg2W2mC%2FeDy07cn7g%3D%3D
:fear::fear: :mad:
AplusWebMaster
2016-04-27, 12:35
FYI...
Fake 'clients recent bill' SPAM - JS malware
- https://myonlinesecurity.co.uk/please-see-attached-file-regarding-clients-recent-bill-js-malware/
27 Apr 2016 - "An email pretending to say 'Please see attached file regarding clients recent bill'... pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads what looks like Dridex banking malware... One of the emails looks like:
From: Isabella Allison <AllisonIsabella408@ webmail.kirpicik .com>
Date: Wed 27/04/2016 10:11
Subject: FW:
Attachment: gzi-bill_7B07A7.rar
Dear gzi,
Please see attached file regarding clients recent bill.
Should you need further assistances lease feel free to email us.
Best Regards,
Yours sincerely,
Isabella Allison
Executive Director Finance & Information Systems
-Or-
Dear rob,
Please see attached file regarding clients recent bill.
Should you need further assistances lease feel free to email us.
Best Regards,
Yours sincerely,
Harriett Santiago
CEO
27 April 2016: gzi-bill_7B07A7.rar: Extracts to: 0a1f583.js - Current Virus total detections 2/57*
.. Payload security** doesn’t show any download but a manual analysis shows a download of what is probably Dridex banking Trojan from
http ://adamauto .nl/gdh46ss (VirusTotal 7/57***). There is also a file with a single character name of approx. 145kb inside the zip file that just contains padding and no real content:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/b-1024x317.png
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3955dd43b43d3102df7f1c0b0297f606e9b9014b182d2878e86c141a4ee97dda/analysis/1461748399/
** https://www.reverse.it/sample/3955dd43b43d3102df7f1c0b0297f606e9b9014b182d2878e86c141a4ee97dda?environmentId=4
*** https://www.virustotal.com/en/file/cc0a060830e130e7f4d077df78cb44508f58bbf09d1c0a0ee863f3a7aef433b1/analysis/1461750602/
TCP connections
139.59.166.196: https://www.virustotal.com/en/ip-address/139.59.166.196/information/
adamauto .nl: 5.61.252.121: https://www.virustotal.com/en/ip-address/5.61.252.121/information/
___
Fake 'latest price list' SPAM - js malware Dridex
- https://myonlinesecurity.co.uk/our-latest-price-list-is-attached-js-malware-dridex/
27 Apr 2016 - "An email pretending to say 'Thank you Our latest price list is attached. For additional information, please contact your local ITT office' with the subject of 'Price list' pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads what looks like Dridex banking malware... One of the emails looks like:
From: Rosanne Frost <FrostRosanne34713@ ttnet .com.tr>
Date: Wed 27/04/2016 10:11
Subject: Price list
Attachment: 97258_rob_F68A02.rar
Thank you. Our latest price list is attached. For additional information, please contact your local ITT office.
27 April 2016: 97258_rob_F68A02.rar: Extracts to: e456b94.js Current Virus total detections 2/57*
.. a manual analysis shows a download of what is probably Dridex banking Trojan from
http ://onlinecrockpotrecipes .com/k2tspa (VirusTotal 6/57**) Which although a different file # is probably the
-same- Dridex banking trojan as today’s other similar malspam run[3]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/41ce784ba36edda2519f65a40366aac50468f87580eb738c01e17644e498948b/analysis/1461751559/
** https://www.virustotal.com/en/file/39769147a6b85004cfe5a9060fc8e7ceade04b15d611932ad6aceab3641999cb/analysis/1461752457/
TCP connections
107.170.20.33: https://www.virustotal.com/en/ip-address/107.170.20.33/information/
3] https://myonlinesecurity.co.uk/please-see-attached-file-regarding-clients-recent-bill-js-malware/
onlinecrockpotrecipes .com: 192.232.212.44: https://www.virustotal.com/en/ip-address/192.232.212.44/information/
- http://blog.dynamoo.com/2016/04/malware-spam-thank-you-our-latest-price.html
27 Apr 2016 - "This -fake- financial spam leads to malware:
From: Andrew Boyd [BoydAndrew46@ infraredequipamentos .com.br]
Date: 27 April 2016 at 12:23
Subject: Price list
Thank you. Our 'latest price list' is attached. For additional information, please contact your local ITT office.
The sender's name varies, the subject and body text appear to be the same. Attached is a RAR archive that combines some elements of the recipient's email address in it, e.g. CAA30_info_D241AE.rar. Thanks to analysis from a trusted source (thank you!) it appears that there are several -scripts- downloading a binary from one of the following locations:
aaacollectionsjewelry .com/ur8fgs
adamauto .nl/gdh46ss
directenergy .tv/l2isd
games-k. ru/n8eis
jurang .tk/n2ysk
lbbc .pt/n8wisd
l-dsk .com/k3isfa
mavrinscorporation .ru/hd7fs
myehelpers .com/j3ykf
onlinecrockpotrecipes .com/k2tspa
pediatriayvacunas .com/q0wps
soccerinsider .net/mys3ks
warcraft-lich-king .ru/i4ospd
This downloads Locky ransomware. The executable then phones home to the following servers:
176.114.3.173 (FOP Sedinkin Olexandr Valeriyovuch / thehost.ua, Ukraine)
139.59.166.196 (Digital Ocean, Singapore)
107.170.20.33 (Digital Ocean, US)
146.185.155.126 (Digital Ocean, Netherlands)
Recommended blocklist:
176.114.3.173
139.59.166.196
107.170.20.33
146.185.155.126 "
___
Fake 'transfer cancelled' SPAM - JS malware
- https://myonlinesecurity.co.uk/the-transfer-from-your-online-banking-account-was-cancelled-js-malware-attempt/
27 Apr 2016 - "An email saying 'The transfer, recently initiated from your online banking account, was cancelled' with random characters/numbers as the subject coming from random names and email addresses with a link-in-the-email is another one from the current bot runs... They have now uploaded the actual malware files to the compromised servers which deliver the full working Invoice_Details.js which when run will download files like:
http ://charlottealeman .com/e.exe: 213.186.33.17: https://www.virustotal.com/en/ip-address/213.186.33.17/information/
>> https://www.virustotal.com/en/url/0a2b389c9431c4e7c70df740476411547e71bfa2941ae887473c66a322935423/analysis/
http ://fcpekernanec .com/e.exe: 213.186.33.17
http ://setup-media .com/e.exe: 46.30.212.100: https://www.virustotal.com/en/ip-address/46.30.212.100/information/
>> https://www.virustotal.com/en/url/8c812769494ca4a2b92f980289ec84126d2ec7dbea84c91dbb0fbe9107157e99/analysis/
http ://sharedharvest .org/e.exe: 75.126.26.226: https://www.virustotal.com/en/ip-address/75.126.26.226/information/
>> https://www.virustotal.com/en/url/78626d4c7f3989a0fa91b763b28d9d313d8b154af381a6d96b4b9aa2d29ff3f8/analysis/
http ://sofec .net/e.exe: 217.16.2.18: https://www.virustotal.com/en/ip-address/217.16.2.18/information/
>> https://www.virustotal.com/en/url/1d922c14fef4996691f030e169a54ffc09acdd1452fc214f3b09ff463d7c9668/analysis/
http ://vandaco .net/e.exe: 107.180.3.113: https://www.virustotal.com/en/ip-address/107.180.3.113/information/
>> https://www.virustotal.com/en/url/72721cfe81fedf0e3d9f97f8cb0af0061bde243ef33920d9883d9f81cb5037b2/analysis/
(VirusTotal 4/56*) which is Dridex banking Trojan.
The email looks like:
From: Alfonso Diaz <roberto@ deman .com.br>
Date: Wed 27/04/2016 11:53
Subject: 7707_860-m_p
Attachment: none
The transfer, recently initiated from your online banking account, was cancelled.
Aborted transfer
Transfer Case ID FL5I56IJ6K9P
Amount 3087.19 USD
Order Date 13.41 Tue, Apr 26 2016
Rejection Reason View details
Please click the link given at the top to see more details about your order
... 'Think -before- you click'..."
* https://www.virustotal.com/en/file/ff0db8973b316f2e5c60caaf0ddbc01f8df27ca66e6289e1f9a9e8027f75f71a/analysis/1461740787/
___
Fake 'Message' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/04/malware-spam-message-from-rnp0bb8a7.html
27 AQpr 2016 - "This Spanish-language spam leads to malware:
From: CLAUDIA MARTINEZ [contab_admiva2@ forrosideal .com]
Date: 27 April 2016 at 16:22
Subject: Message from "RNP0BB8A7"
Este e-mail ha sido enviado desde "RNP0BB8A7" (Aficio MP 171).
Datos escaneo: 27.04.2016 00:31:10 (+0000)
Preguntas a: soporte@ victimdomain .tld
Attached is a randomly-named ZIP file (e.g. 053324_00238.zip) which contains a malicious script (e.g. 0061007_009443.js). The samples I have seen download a binary from:
mebdco .com/8759j3f434
amwal .qa/8759j3f434
ecmacao .com/8759j3f434
lifeiscalling-sports .com/8759j3f434
This drops a version of what appears to be Locky ransomware with a detection rate of zero*. I know from another source, that these additional download locations were being used for an English-language spam run this afternoon:
absxpintranet .in/8759j3f434
amismaglaj .com.ba/8759j3f434
caegpa .com/8759j3f434
codeaweb .net/8759j3f434
coorgcalling .com/8759j3f434
gedvendo .com/8759j3f434
gedvendo .com.pe/8759j3f434
mc2academy .com/8759j3f434
teyseerlab .com/8759j3f434
www .adgroup .ae/8759j3f434
www .rumbafalcon .com/8759j3f434
DeepViz report shows the malware phoning home to:
107.170.20.33 (Digital Ocean, US)
139.59.166.196 (Digital Ocean, Singapore)
146.185.155.126 (Digital Ocean, Netherlands)
There's a triple whammy for Digital Ocean!...
Recommended blocklist:
107.170.20.33
139.59.166.196
146.185.155.126 "
* https://www.virustotal.com/en/file/d2954337252fb727b01a7e2a8e4c4b451cb00c9abe6dec34b8b143d845a00111/analysis/
0/55
___
Fake 'Invoice' SPAM - JS malware
- https://myonlinesecurity.co.uk/invoice-44738447-1912-4024-80-js-malware/
27 Apr 2016 - "An email with the subject of 'Invoice 44738447 19/12 £4024.80' [random numbered] pretending to come from random senders with a zip attachment is another one from the current bot runs... The email looks like:
From: Lela Hines <HinesLela95@ plus .pl>
Date: Wed 27/04/2016 17:31
Subject: Invoice 44738447 19/12 £4024.80
Attachment: invoice44738447.doc
Hi,
I had a lovely break and now I’m back to work.
Many thanks for the payments made. There is just one invoice that has not been paid and does not seem to have a query against it either.
Its invoice 44738447 19/04 $5,712.37 P/O CQCJB 15391
Can you have a look at it for me please?
Thank-you !
Kind regards
Lela Hines
Credit Control
Finance Department
CounterPath Corporation ...
27 April 2016: invoice44738447.doc which is actually a zip file that Extracts to:
2016 Sales Invoice 700422016.pdf.js - Current Virus total detections 7/56*
.. Payload security** shows a download of Dridex banking Trojan from
api.spartanburg-community-college .net/follow-us/on/twitter.php which gives DridexBOT.twitter (VirusTotal 5/56***)...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a22e36c6c8b023171206284474d2d6fa2d9987c1338fe6f825ad7568a6800147/analysis/1461774742/
7/56
** https://www.hybrid-analysis.com/sample/beed7e81e7ced8541045e83d9ea0298a494acf9855ea568e21aff721bc0d1a41?environmentId=4
Contacted Hosts
109.234.35.185: https://www.virustotal.com/en/ip-address/109.234.35.185/information/
>> https://www.virustotal.com/en/url/d26949c79283912d463a854cf2f5c45e96b3003d933bed1f56fc1b8c6b0ae967/analysis/
*** https://www.virustotal.com/en/file/8e534817ebe5caf359211610a55f157f653967107a9d8e26b24ce81c610f2935/analysis/1461777828/
5/56
:fear::fear: :mad:
AplusWebMaster
2016-04-28, 12:07
FYI...
Fake 'FW: Invoice' SPAM - JS malware
- https://myonlinesecurity.co.uk/fw-invoice-js-malware/
28 Apr 2016 - "Another set of emails with the subject of 'FW: Invoice' pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads some sort of malware... One of the emails looks like:
From: Autumn Gilbert <GilbertAutumn041@ foxyfolk.worldonline .co.uk>
Date: Thu 28/04/2016 10:08
Subject: FW: Invoice
Attachment: no-reply_invoice_59C05D.zip
Please find attached invoice #312148
Have a nice day
Autumn Gilbert
Business Development Director ...
28 April 2016: no-reply_invoice_59C05D.zip: Extracts to: 63e0f3bc.js - Current Virus total detections 1/57*
.. Payload security[3] download... appears to be Locky ransomware from the Payload security screenshots... A manual analysis shows a download from
http ://banketcentr .ru/v8usja (VirusTotal 5/57**)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/b6528e93e9dc8f0c8e2e86060c1d7e0ff59089fbef0a68d4e7176b89d7546f79/analysis/1461834603/
** https://www.virustotal.com/en/file/e325dcb905b3adaaf5e33ef15a0c488f948dd90eb8577714c97482a3b7ad74bb/analysis/1461835068/
3] https://www.reverse.it/sample/b6528e93e9dc8f0c8e2e86060c1d7e0ff59089fbef0a68d4e7176b89d7546f79?environmentId=4
Contacted Hosts
81.177.6.123
51.254.240.60
banketcentr .ru: 81.177.6.123: https://www.virustotal.com/en/ip-address/81.177.6.123/information/
>> https://www.virustotal.com/en/url/84c4b5e7d1d4e30ca7e0338a0f2f0c36fdbeb82c06422786caeb72c867d0334b/analysis/
- http://blog.dynamoo.com/2016/04/malware-spam-fw-invoice-from-multiple.html
28 Apr 2016 - "This -fake- financial spam comes from randomly-generated senders, for example:
From: Britt Alvarez [AlvarezBritt29994@ jornalaguaverde .com.br]
Date: 28 April 2016 at 11:40
Subject: FW: Invoice
Please find attached invoice #342012
Have a nice day
Attached is a ZIP file containing elements of the recipient's email address. In turn, this contains a malicious script that downloads a binary from one of many locations. The ones I have seen are:
http ://rabitaforex .com/pw3ksl
http ://tribalsnedkeren .dk/n4jca
http ://banketcentr .ru/v8usja
http ://3dphoto-rotate .ru/h4ydjs
http ://switchright .com/2yshda
http ://cafe-vintage68 .ru/asad2fl
http ://minisupergame .ru/a9osfg
The payload looks like Locky ransomware. The DeepViz report* shows it phoning home to:
83.217.26.168 (Firstbyte, Russia)
31.41.44.246 (Relink, Russia)
91.219.31.18 (FLP Kochenov Aleksej Vladislavovich / uadomen.com, Ukraine)
51.254.240.60 (Relink, Russia / OVH, France)
91.234.32.19 (FOP Sedinkin Olexandr Valeriyovuch / thehost.ua. Ukraine)
These two Hybrid Analysis reports [1] [2] show Locky more clearly.
Recommended blocklist:
83.217.26.168
31.41.44.246
91.219.31.18
51.254.240.60
91.234.32.19 "
* https://sandbox.deepviz.com/report/hash/9e42d821b29c46ad458d62adb8cbc9ad/
1] https://www.hybrid-analysis.com/sample/bb92aa32cab438bb1233f6875366a144eeaa4a7395f9b6e759ebefd0d0b8ab01?environmentId=1
2] https://www.hybrid-analysis.com/sample/bb92aa32cab438bb1233f6875366a144eeaa4a7395f9b6e759ebefd0d0b8ab01?environmentId=4
___
Fake 'Scan436' SPAM - leads to Locky ransomware
- http://blog.dynamoo.com/2016/04/minimalist-spam-leads-to-locky.html
28 Apr 2016 - "There is currently a very minimalist spam run leading to Locky ransomware, for example:
From: victim@ victimdomain .tld
To: victim@ victimdomain .tld
Date: 28 April 2016 at 11:21
Subject: Scan436
The spam appears to come from the victim's own email address. There is no body text, but attached is a ZIP file with a name matching the subject, e.g.:
file238.zip
file164.zip
file84.zip
Document4.zip
Doc457.zip
Scan1.zip
Doc5.zip
file394.zip
Scan436.zip
Inside is a semi-randomly named script that downloads malware. Download locations I have seen so far are:
nailahafeez.goldendream .info/8778h4g
kfourytrading .com/8778h4g
kasliknursery .com/8778h4g
allied .link/8778h4g
xtrategiamx .com/8778h4g
The downloaded executable is Locky ransomware and has a VirusTotal detection rate of 2/56*. This Hybrid Analysis** shows Locky quite clearly, and this DeepViz report*** shows it phoning home to:
51.254.240.60 (Relink LLC, Russia / OVH, France)
31.41.44.246 (Relink LLC, Russia)
83.217.26.168 (Firstbyte, Russia)
Recommended blocklist:
31.41.44.246
51.254.240.60
83.217.26.168 "
* https://www.virustotal.com/en/file/6d98f81e1a1cfa8c688c3f979e44a88bbbbbd50897b0a7f8fa77f94873ea18ec/analysis/1461840396/
** https://www.hybrid-analysis.com/sample/6d98f81e1a1cfa8c688c3f979e44a88bbbbbd50897b0a7f8fa77f94873ea18ec?environmentId=4
*** https://sandbox.deepviz.com/report/hash/628d9f2ba204f99e638a91494be3648e/
- https://myonlinesecurity.co.uk/blank-emails-with-varying-subjects-like-scan10-document0-doc9-file337-all-random-numbered-pretending-to-come-from-your-own-email-address-js-malware-downloads-locky/
29 Apr 2016 - "... another set of -blank- emails with varying subjects like Scan10, Document0, Doc9, file337 [all random numbered] pretending to come from your own email address with a zip attachment is another one from the current bot runs which downloads rockloader which in turn downloads Locky ransomware... I have only seen 2 variant names of the js files inside these zips. 001371310.js and SCAN007960203.js, but there probably are numerous others. (I have received over -100- copies...). The zip name matches the subject which so far has been one of these 4 variants: Scan, Document, Doc, or File, all with random numbers between 0 and 999 appended. One of the emails looks like:
From: ans@ thespykiller .co.uk
To: ans@ thespykiller .co.uk
Date: Thu 28/04/2016 10:34
Subject: Document0
Attachment: Document0.zip
Body content: Totally Blank/Empty
28 April 2016: Document0.zip : Extracts to: 001371310.js - Current Virus total detections 4/57*
.. Payload security** file337.zip: Extracts to: SCAN007960203.js - Current Virus total detections 4/57***
.. Payload security[4] shows a download from
http ://nailahafeez.goldendream .info/8778h4g which is Rockloader (VirusTotal 0/46[5]) probably eventually downloading Locky Ransomware. Download sites so far discovered include:
http ://allieddiesel .com/8778h4g
http ://citycollection .com.tr/8778h4g
http ://xtrategiamx .com/8778h4g
http ://nailahafeez.goldendream .info/8778h4g
honafelastin .com/8778h4g ...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/2deb044e6862a15fdcdca66fea0a65b9f47c15be8787a6afc8afe5fe2668ea98/analysis/1461836295/
** https://www.reverse.it/sample/2deb044e6862a15fdcdca66fea0a65b9f47c15be8787a6afc8afe5fe2668ea98?environmentId=4
Contacted Hosts
207.58.129.29
109.235.139.64
94.41.119.143
31.41.44.246
*** https://www.virustotal.com/en/file/86a237e2d115ffadb1ea4130bc500d3157034bd3f4eb9425a9a1d3cbe447214b/analysis/1461836412/
4] https://www.reverse.it/sample/86a237e2d115ffadb1ea4130bc500d3157034bd3f4eb9425a9a1d3cbe447214b?environmentId=4
Contacted Hosts
88.202.227.70
109.235.139.64
77.122.120.173
83.217.26.168
5] https://www.virustotal.com/en/file/6beefe2e6afd6ab23d0139fb9b62f46ce8586fe8f743ce660aa416ac44af79e2/analysis/1461837500/
___
Fake 'Unpaid Fine' SPAM - JS malware
- https://myonlinesecurity.co.uk/unpaid-fine-case-no-743379-js-malware/
28 April 2016 - "An email with the subject of 'Unpaid Fine – Case No.743379' [random numbered] pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads some malware... One of the emails looks like:
From: Erick Macalister <MacalisterErick998@ cost2build .co.za>
Date: Thu 28/04/2016 13:26
Subject: Unpaid Fine – Case No.743379
Attachment: unity_unity8_invoices_743379.zip
You have received a fine on March 20th, 2016 for the amount of $397,31 and despite our constant reminders it hasnt been paid yet.Please, review the enclosed document as soon as possible.
28 April 2016: unity_unity8_invoices_743379.zip: Extracts to: details.jse - Current Virus total detections 3/57*
.. Payload security** shows an attempted download from
substance-europe .com/OtgUIH.exe which currently seems to be unavailable. I am looking for other download sites, that will probably deliver either Locky ransomware or Dridex banking Trojan...
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4687c7001edc9c8e0e335be70781d35d044657dc726ea7e63fb23222083c3fcb/analysis/1461848553/
** https://www.reverse.it/sample/4687c7001edc9c8e0e335be70781d35d044657dc726ea7e63fb23222083c3fcb?environmentId=4
Contacted Hosts
173.247.250.242: https://www.virustotal.com/en/ip-address/173.247.250.242/information/
___
Fake 'IMPORTANT' SPAM - JS malware
- https://myonlinesecurity.co.uk/emails-with-multiple-subjects-including-amount-overdue-important-and-latest-invoice-important-js-malware/
28 Apr 2016 - "... emails with -multiple- subjects including 'Amount overdue ' and 'Latest invoice [IMPORTANT]' pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads some malware... A very high proportion of the emails are misconfigured and come in broken with the attachment embedded in the body of the email. A lot however come in as fully -working- emails although they have part of the body content attached as a txt file and as a html file. These have multiple subjects including:
Amount overdue [IMPORTANT]
Latest invoice [IMPORTANT]
Payment overdue notification [Urgent]
Amount overdue notification [Urgent]
Unpaid invoice notification Sonic Foundry, Inc.
Invoice overdue [IMPORTANT]
Recent invoice unpaid [Urgent] ...
Amount overdue from Chicago Rivet & Machine Co.
Recent invoice [IMPORTANT]
Final letter before commencing legal action [Urgent]
One of the working emails looks like:
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/04/latest-invoice-1024x702.png
28 April 2016: Latest invoice51958.zip Extracts to: 2016INV-APR23521.pdf.js - Current Virus total detections 23/56*
.. Payload Security** finally caught up with their backlog of submissions... [i]this is Dridex from
http ://24.dailyeq .com/i-wanna/more/followers.php -or-
http ://int.ayuda-integral .net/i-wanna/more/followers.php delivering tw33t.me (VirusTotal 6/56***)
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://www.hybrid-analysis.com/sample/f012c178668d2bf7eb0729e84ee86796b2a36908e5744897c72a0c2fb8c4c1af?environmentId=4
Contacted Hosts
212.109.193.218: https://www.virustotal.com/en/ip-address/212.109.193.218/information/
*** https://www.virustotal.com/en/file/00a4846b80c996aed97ed9a0f7313f4a3cf356cb7b596dc45dee9aebcf657b67/analysis/
24.dailyeq .com: 212.109.193.218
int.ayuda-integral .net: 212.109.193.218
:fear::fear: :mad:
AplusWebMaster
2016-04-29, 13:16
FYI...
Fake 'Attached Doc' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/04/malware-spam-attached-doc-attached.html
29 Apr 2016 - "This -fake- document scan email appears to come from within the victim's own domain, but it doesn't. Instead it is a simple -forgery- with a malicious attachment. Example subjects include:
Attached Doc
Attached Image
Attached Document
Attached File
Example senders:
epson@ victimdomain .tld
scanner@ victimdomain .tld
xerox@ victimdomain .tld
There is no body text. Attached is a ZIP file with the recipients email address forming part of the name plus a couple of random numbers. These ZIP files contain a variety of -malicious- scripts, the ones that I have seen download a binary from:
emcartaz .net.br/08j78h65e
kizilirmakdeltasi .net/08j78h65e
easytravelvault .com/08j78h65e
64.207.144.148 /08j78h65e
cdn.cs2.pushthetraffic .com/08j78h65e
The VirusTotal detection rate for the dropped binary is 3/55*. That VirusTotal report and this Hybrid Analysis** show subsequent traffic to:
giotuipo .at/api/
giotuipo .at/files/dDjk3e.exe
giotuipo .at/files/VTXhFO.exe
The payload is Locky ransomware. This is hosted on what appears to be a bad server at:
134.249.238.140 (Kyivstar GSM, Ukraine)
Kyivstar is a GSM network, something hosted on this IP is usually a sure sign of a botnet. A lookup of the giotuipo .at domain shows that it is multihomed on many IPs:
109.194.247.26 (ER-Telecom Holding, Russia)
95.189.128.70 (Sibirtelecom, Russia)
79.119.196.161 (RCS & RDS Business, Romania)
5.248.229.186 (Lanet Network Ltd, Ukraine)
188.230.17.38 (Airbites, Ukraine)
134.249.238.140 (Kyivstar, Ukraine)
5.58.29.200 (Lanet Network Ltd, Ukraine)
212.3.103.225 (Apex, Ukraine)
93.95.187.243 (Triolan, Ukraine)
178.151.243.153 (Triolan, Ukraine)
These IPs are likely to be highly dynamic, so blocking them may or may not work. If you want to try, here is a recommended blocklist:
109.194.247.26
95.189.128.70
79.119.196.161
5.248.229.186
188.230.17.38
134.249.238.140
5.58.29.200
212.3.103.225
93.95.187.243
178.151.243.153 "
* https://www.virustotal.com/en/file/c4e2415dae5d4153d9a400ffb692c519d79889e62319ec08c5d03ba5f8f0300d/analysis/1461917718/
** https://www.hybrid-analysis.com/sample/c4e2415dae5d4153d9a400ffb692c519d79889e62319ec08c5d03ba5f8f0300d?environmentId=4
- https://myonlinesecurity.co.uk/another-set-of-emails-pretending-to-come-from-scanner-copier-epson-canon-hp-your-own-domain-js-malware-delivering-locky/
29 Apr 2016 - "... another set of emails with -blank- empty bodies pretending to come from scanner@, copier@, epson@, canon@, hp@ and any other copier/printer/scanner/MFD at your-own-domain with one of these subjects 'Attached Doc / Attached File / Attached Image / Attached Document' with a zip attachment is another one trying to download Locky ransomware and other malware files... your email domain is -not- sending these emails. You have -not- been hacked. One of the emails looks like:
From: epson@ thespykiller .co.uk
Date: Fri 29/04/2016 09:15
Subject: Attached Document
Attachment: submit@ thespykiller .co.uk_62693_220554.zip
Body content: Totally blank/empty
29 April 2016: submit@ thespykiller .co.uk_62693_220554.zip : Extracts to: 85006886_575150306.js
Current Virus total detections 4/57*. Payload Security** shows a download of -3- files from
giotuipo .at/files/VTXhFO.exe (VirusTotal 1/56***) and giotuipo .at/files/dDjk3e.exe (VirusTotal 1/56[4]) and
limaoagencia .com.br/08j78h65e (VirusTotal 1/56[5]). Payload Security[6] which is definitely rockloader which normally downloads Locky ransomware. The first 2 files although appear to be .exe files are actually encrypted data that the rockloader uses to perform various tasks. The payload security report indicates that these might be necurs / fareit/ pony related...This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/04dcee462643429068c18d2febba3503fe222254a3594e3eb443523e8d7ec103/analysis/1461917777/
** https://www.reverse.it/sample/cad0d8ca4d84d42d9917740c31f0ea68f28e441d9cf8b15c9bf18a0a2d955e62?environmentId=4
*** https://www.virustotal.com/en/file/3f02e1f8888a54b9bb4460bb552b6f23e6bf42b559aad0fdfd28f6aa91c17aee/analysis/1461918182/
4] https://www.virustotal.com/en/file/52de031e30faf152497f192dc5eadc0aa03a7fb9c283b8c85e4b354312cc0acd/analysis/1461918177/
5] https://www.virustotal.com/en/file/52de031e30faf152497f192dc5eadc0aa03a7fb9c283b8c85e4b354312cc0acd/analysis/1461918177/
6] https://www.reverse.it/sample/c4e2415dae5d4153d9a400ffb692c519d79889e62319ec08c5d03ba5f8f0300d?environmentId=4
Contacted Hosts
109.235.139.64
134.249.238.140
51.254.240.60
185.130.7.22
___
Fake 'Unpaid Invoice' SPAM - Locky ransomware
- http://blog.dynamoo.com/2016/04/malware-spam-second-reminder-unpaid.html
29 Apr 2016 - "This -fake- financial spam leads to malware:
From: Janis Faulkner [FaulknerJanis8359@ ono .com]
Date: 29 April 2016 at 11:13
Subject: Second Reminder - Unpaid Invoice
We wrote to you recently reminding you of the outstanding amount of $8212.88 for Invoice number #304667, but it appears to remain unpaid.
For details please check invoice attached to this mail
Regards,
Janis Faulkner
Chief Executive Officer - Food Packaging Company
Attached is a ZIP file with a name similar to unpaid_invoice551.zip which contains a randomly-named script. Oddly, most of the script appears to be text copy-and-pasted from the Avira website:
> https://4.bp.blogspot.com/-aSblAORl_so/VyM5EmxJwZI/AAAAAAAAH10/7MSJMCUmpyUumYkNb5gUzTCQnopeXCBoACLcB/s1600/avira-blurb.png
The scripts I have seen download slightly different binaries from the following locations:
cafeaparis .eu/f7yhsad
amatic .in/hdy3ss
zona-sezona .com.ua/hj1lsp
avcilarinpazari .com/u7udssd
VirusTotal detection rates are in the range of 8/56 to 10/56 [1] [2].... In addition to those reports, various automated analyses [5] [6]... show that this is Locky ransomware phoning home to:
91.234.32.19 (FOP Sedinkin Olexandr Valeriyovuch / thehost.ua, Ukraine)
83.217.8.155 (Park-web Ltd, Russia)
31.41.44.246 (Relink Ltd, Russia)
89.108.84.155 (Agava Ltd, Russia)
51.254.240.60 (Relink, Russia / OVH, France)
I -strongly- recommend that you block traffic to:
91.234.32.19
83.217.8.155
31.41.44.246
89.108.84.155
51.254.240.60 "
1] https://www.virustotal.com/en/file/21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792/analysis/
2] https://www.virustotal.com/en/file/cb21d46a3addd09f4fe553e7e9e5c7a5e141a9309c2cc7ca6ce1c61583dc6b8a/analysis/1461925401/
5] https://www.hybrid-analysis.com/sample/21f1e2615a5359c88b6df2115afe16819f4adb2be125b0a73244b86ba4d59792?environmentId=1
6] https://sandbox.deepviz.com/report/hash/8271093e0e78574428bbddda6f34a980/
- https://myonlinesecurity.co.uk/second-reminder-unpaid-invoice-should-be-js-malware-but-instead-is-a-joe-job-against-avira-antivirus/
29 Apr 2016 - "... An email with the subject of 'Second Reminder – Unpaid Invoice' pretending to come from the usual random senders with a zip attachment...
NOTE: although all copies I have seen so far of this particular email has only had the innocent Avira details, it is highly possible that some files will contain a genuine malware. Do-not-open the JS file... You will be infected.
Update: Dynamoo* has seen some copies that do also contain the malware payload - I have also now received a couple with javascript hidden amongst the mass of repeated-Avira-blurb that will deliver Locky ransomware... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* http://blog.dynamoo.com/2016/04/malware-spam-second-reminder-unpaid.html
29 Apr 2016
___
Fake 'hi prnt' SPAM - JS malware delivers Locky
- https://myonlinesecurity.co.uk/hi-prnt-pretending-to-come-from-your-own-email-address-js-malware-delivers-locky/
29 Apr 2016 - "Another -blank- email with the subject of 'hi prnt' with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: your-own-email-address
Date:
Subject: hi prnt
Attachment: 1708279_830428394.zip
Body content: Completely empty/blank
28 April 2016: 1708279_830428394.zip : Extracts to: 24614230_356663117.js - Current Virus total detections 3/57*
.. Manual analysis shows a download of Locky Ransomware from
gridandgreen .co.th/08j78h65e (VirusTotal **)... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/76ae1ef69f2976c9865737007d0103b2a5e3939f3dc8c25376b53bd54f0b7d19/analysis/1461947772/
** https://www.virustotal.com/en/file/e2a35986cf91358e34f14114123aba2774ee78e9d0885d165895f8d83ec54003/analysis/1461946616/
gridandgreen .co.th: 119.59.120.4: https://www.virustotal.com/en/ip-address/119.59.120.4/information/
>> https://www.virustotal.com/en/url/c637b966c95e3cf01d738dcf06ec28d537035c672f418b3b846b71faf97090b9/analysis/
___
New release of PCI DSS v3.2 is available
- https://isc.sans.edu/diary.html?storyid=21003
2016-04-29 - "A new version of the standard was released today, version 3.2. There are a number of changes that will affect those that need to comply with the standard, especially for service providers. For service providers struggling to move customers away from SSL and weak TLS there is some good news. The deadline for this requirement has been moved to June 30 2018. Service providers will however be required to have a secure environment (i.e. accepting TLS v1.2 or v1.1) by June 30 2016 (yes two months). This shouldn't be to onerous as most service providers will already have this in place. There are a few new requirements in the standard. The majority of these only apply to service providers and relate to ensuring that processes are followed throughout the year rather than a once a year effort. They are 'best practice' until 1 February 2018, after which they -must- be in place. A number of these are also quarterly requirements. They include:
• 3.5.1 – Maintain a documented description of the cryptographic architecture.
• 11.3.4.1 – If segmentation is used, confirm PCI DSS scope by performing penetration testing on segmentation controls at least every six months and after any changes to segmentation controls/methods.
• 12.4 – Executive management shall establish responsibility for the protection of cardholder data and a PCI DSS compliance program.
• 12.11 – Perform reviews at least quarterly to confirm personnel are following security policies and operational procedures.
The other big change affecting everyone relates to multi factor authentication for administration of the Cardholder Data Environment (CDE). Currently this requirement is only needed when remote access is used to access the CDE. This requirement has now been extended to include ALL administrative access of the CDE. This means that you will need to roll out some form of multi factor authentication for all administrative access to the environment. Other changes in the standard are generally clarifications..."
___
Locky Ransomware Spreads via Flash and Windows Kernel Exploits
- http://blog.trendmicro.com/trendlabs-security-intelligence/locky-ransomware-spreads-flash-windows-kernel-exploits/
Apr 28, 2016 - "In early April of this year a zero-day exploit (designated as CVE-2016-1019) was found in Adobe Flash Player. This particular flaw was soon used by the Magnitude Exploit Kit, which led to an Adobe out-of-cycle patch*. This flaw was being used to lead to drive-by download attacks with Locky ransomware as the payload... We recently saw a new -variant- of this attack that added an unusual twist. On top of the Flash exploit, an old escalation of privileges exploit in Windows (CVE-2015-1701) was used to bypass sandbox technologies... The network traffic was consistent with the use of a CVE-2016-1019 exploit. Meanwhile, the downloader used an unusual kernel exploit. It connected to a command-and-control (C&C) server located at 202[.]102[.]110[.]204:80 and installed the Locky ransomware. To do this, it would use several kernel-level system mechanisms: work items, system threads, and asynchronous procedure calls (APC). These do-not-require any files to be created, and allow the malware to be installed onto the system -without- detection. The downloader also hides its malicious behavior at runtime and compromises svchost.exe, the system process used by Windows to host various services. It also checks the version of Windows in use and the date when the vulnerable file (win32k.sys) was modified before attempting the exploit; this may be done to reduce the risk of detection. The exploit may have been used to avoid detection, particularly those using sandboxing technology. In addition, the cloaking behavior based on this kernel exploit adds complexity and makes analysis and sandbox detection more difficult. A code branch found during analysis suggests different kernel exploits may be used for later versions of Windows... We strongly advise users to update their systems with the latest version of Adobe Flash Player*. Keeping software up-to-date is another means of securing your system against exploit attacks. It is also best to always back up your data and avoid paying any ransom as this -doesn’t- guarantee that you will retrieve your files back..."
* https://helpx.adobe.com/content/help/en/security/products/flash-player/apsb16-10.html
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1019
Last revised: 04/11/2016 - "... as exploited in the wild in April 2016"
Impact Subscore: 10.0
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1701
Last revised: 04/01/2016 - "... as exploited in the wild in April 2015"
Impact Subscore: 10.0
202.102.110.204: https://www.virustotal.com/en/ip-address/202.102.110.204/information/
>> https://www.virustotal.com/en/url/7284214951054fb56cd38740e7fdd585cf5e27845a13036e3bf697d560a82dc2/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-05-02, 17:32
FYI...
Fake 'Chrome update for Android'
- https://isc.sans.edu/diary.html?storyid=21007
2016-05-02 - "... numerous reports of a -fake- update for Chrome for Android. A fake update for Android is not in itself very unusual or interesting, but this particular bit of malware is somewhat more insidious than most.
The update, titled "Update_chrome.apk" requests administrative access to the device and then takes a page out of Zeus and other credential stealing malware and captures banking and personal information. When the user makes a purchase in the Google Play store the malware uses a very realistic looking payment page that captures a screenshot of any credit card information entered and sends it to Russia. The malware -prevents- its removal. At this point the only way to remove the malware is by returning the device to factory defaults, causing all user data to be lost. More information on this malware can be found over at the zScaler website*.
This reiterates the usual methodology for software management on these devices. Always get your updates from reputable sources such as Google Play, and if you do need to install updates from a third party developer you need to validate the update before installation."
* https://www.zscaler.com/blogs/research/android-infostealer-posing-fake-google-chrome-update
April 28, 2016
___
Fake 'online order' SPAM - Malspam
- https://myonlinesecurity.co.uk/your-online-order-was-successfully-submitted-thank-you-malspam/
2 May 2016 - "A series of emails coming from random senders and email addresses pretending to be an order from some random company is either trying to download malware via-the-link, is a phishing email or is just pure spam. All the links are to different web addresses, with a very high proportion looking like hacked/compromised WordPress sites. All the ones I have received have a message saying 'content cannot be displayed in a frame'. The url that the frame tries to use is http ://207.244.95.41 /facebookapi/ which -redirects- to name of hacked site/order_details.html which for me, based in UK, just sends me to the genuine ATT .com site in USA with a log in page... Just delete the email and do-not-follow the links to be safe.
Update: I am being told that these are using the Angler-exploit-kit to take over the computer. If you have the required vulnerable-versions of Adobe flash, Java, Adobe reader, Silverlight or any other vulnerable-browser-plugin.
One of the emails looks like:
From: Random names and email addresses
Date: Mon 02/05/2016 18:10
Subject: Your online order was successfully submitted. Thank you!
Attachment: None
Thank you for your recent order with Hyatt Hotels Corporation. We were happy to serve your needs.
Please visit our site to view the order details.
We look forward to seeing you at Hyatt Hotels Corporation again soon.
Another body read:
Thank you for your recent order with Eldorado Gold Corporation. We were happy to serve your needs.
Please visit our site to view the order details.
We look forward to seeing you at Eldorado Gold Corporation again soon.
Screenshot of one of the websites:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/att-1024x218.png
207.244.95.41: https://www.virustotal.com/en/ip-address/207.244.95.41/information/
>> https://www.virustotal.com/en/url/4ade2e19d596c7efcc5f27116a32af347171bd6adc3f748e7cc190bae9fbe728/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-05-03, 12:13
FYI...
Fake 'Third Reminder' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/05/malware-spam-third-reminder-outstanding.html
3 May 2016 - "This -fake- financial spam has a malicious attachment. It comes from random senders. Last week a -fake- 'Second Reminder' spam was sent out.
From: Ernestine Perkins
Date: 3 May 2016 at 08:54
Subject: Third Reminder - Outstanding Account
Dear Client,
We have recently sent you a number of letters to remind you that the balance of $9308.48 was overdue.
For details please check document attached to this mail
We ask again that if you have any queries or are not able to make full payment immediately, please contact us.
Regards,
Ernestine Perkins
Franchise - Sales Manager / Director - Business Co
Attached is a ZIP file which in the samples I have seen begins with Scan_ or Document_ each one of which contains four identical copies of the same script, e.g.:
48524088_48524088 - copy (2).js
48524088_48524088 - copy (3).js
48524088_48524088 - copy (4).js
48524088_48524088 - copy.js
48524088_48524088.js
Typical detection rates for the scripts seem to be about 3/56*. The samples I have seen download a malicious binary from one of the following locations (there are probably more):
digigoweb .in/k3lxe
rfacine .com.br/z0odld
boontur .com/b2hskde
These binaries are all slightly different, with detection rates of 4 to 6 out of 56 [1] [2]... Various automated analyses [4] [5]... show that this is Locky ransomware, and it phones home to:
31.184.197.126 (Petersburg Internet Network, Russia)
78.47.110.82 (Hetzner, Germany)
91.226.93.113 (Sobis, Russia)
91.219.29.64 (FLP Kochenov Aleksej Vladislavovich / uadomen.com, Ukraine)
Recommended blocklist:
31.184.197.126
78.47.110.82
91.226.93.113
91.219.29.64 "
* https://www.virustotal.com/en/file/e98d8cacdc6bc40f27b17fa91efe26f2d063d64fecb149884fd8b3c26d338ead/analysis/1462262631/
1] https://www.virustotal.com/en/file/cbffcf639d8e7824f545c81f5615060a391996e9d731db14e64f1f5fda050ec7/analysis/1462262799/
2] https://www.virustotal.com/en/file/033727b78211403a839ab1c9967fea5032a52d794062ca6e4fe30edc5c70ec4c/analysis/1462263548/
4] https://malwr.com/analysis/NGVkMjJjYzc1NjhkNDJmNWJlYzRiNGJlMzZmZDcxYzI/
5] https://malwr.com/analysis/OTliYTczZGQwYjBlNDg2MmEzZWFmM2FkNDgwN2RlNTM/
- https://myonlinesecurity.co.uk/third-reminder-outstanding-account-js-malware-stupid-locky-vigilante-strikes-again/
3 May 2016: Scan_E1F.zip: Extracts to: 34405282_34405282.js and -4- identical copies of the same file.
Current Virus total detections 3/57*. MALWR** shows a download of.. Locky ransomware from
http ://dreamsmarketing .in/v67jsw ...
* https://www.virustotal.com/en/file/347bc52bda6b4fa2a0d436c4cdbb4384b2b0af1e4644260d4c772c2cc8e1f8f2/analysis/1462266377/
** https://malwr.com/analysis/YWYzMjAwMDg1NzBhNDNjN2JjM2NkYjk0YzQ3NWUwZDE/
Hosts
199.189.253.226: https://www.virustotal.com/en/ip-address/199.189.253.226/information/
>> https://www.virustotal.com/en/url/06146b15f634e1c12aa63622fef3f218a2becf44a510ec89c435ad389955dba3/analysis/
dreamsmarketing .in: 199.189.253.226
___
Fake 'e-invoice' SPAM - doc macro malware downloads Dridex
- https://myonlinesecurity.co.uk/your-latest-e-invoice-from-tnt-7072492051_3470848-word-doc-macro-malware-downloads-dridex/
3 May 2016 - "An email with the subject of 'Your latest e-invoice from TNT 7072492051_3470848' (random numbers) pretending to come from eInvoicing <groupadmine3767379DONOTREPLY@ tnt .com> (random numbers after the groupadmine) with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: eInvoicing <groupadmine3767379DONOTREPLY@ tnt .com> (random numbers after the groupadmine)
Date: Tue 03/05/2016 10:49
Subject: Your latest e-invoice from TNT 7072492051_3470848
Attachment: 2986010236_1941512.docm
PLEASE DO NOT RESPOND – Emails to this address are not monitored or responded to.
Please find enclosed your latest invoice ...
3 May 2016: 2986010236_1941512.docm - Current Virus total detections 3/56*
.. MALWR shows a download of Dridex banking Trojan from
http ://le-journal-du-cun .info/09u8h676rc (VirusTotal 6/56**)
Additional download locations include:
http ://zalatajkiado .hu/09u8h676rc
http ://bezpiecznie.w8w .pl/09u8h676rc
http ://gepto-automates .com/09u8h676rc
http ://color-druck-ftp .net/09u8h676rc
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/09431bc5149299d62b9964c51fda58fe8783d16d41b13a34de9dfe03ad2696fd/analysis/1462266856/
** https://www.virustotal.com/en/file/a9a458aecf0828b8195500d7df442318fc5745ddfb37d19012243f40a5edf252/analysis/1462269627/
le-journal-du-cun .info: 217.76.132.57: https://www.virustotal.com/en/ip-address/217.76.132.57/information/
>> https://www.virustotal.com/en/url/0ad1d1902c83b53b2a3f9251d3b212e46d7181d46236cb53635c3185ea3d79bc/analysis/
zalatajkiado .hu: 88.151.103.221: https://www.virustotal.com/en/ip-address/88.151.103.221/information/
>> https://www.virustotal.com/en/url/025a1dfc69609e42df59b229df7fba6c0359f776442654f4ff55df757bccdeb3/analysis/
bezpiecznie.w8w .pl: 193.203.99.112: https://www.virustotal.com/en/ip-address/193.203.99.112/information/
>> https://www.virustotal.com/en/url/733778211c12c7c1550d59b65960ea00af0145ff7c273650daedacd78626bb3c/analysis/
gepto-automates .com: 217.76.132.26: https://www.virustotal.com/en/ip-address/217.76.132.26/information/
>> https://www.virustotal.com/en/url/eae56499ff7d32ce733854bb20b1da1b4eb7c1f8f82de142bd3df7608d1f3cdf/analysis/
color-druck-ftp .net: 46.30.212.10: https://www.virustotal.com/en/ip-address/46.30.212.10/information/
>> https://www.virustotal.com/en/url/c7fbf84be72f481e226129ea8a9c3ac1be7dc2d74b5dbbb89d535eb7791c4b23/analysis/
___
Fake 'You Are Fired' SPAM - JS malware downloads Locky
- https://myonlinesecurity.co.uk/you-are-fired-24534f3-js-malware-downloads-locky/
3 May 2016 - "... an email with the subject of 'You Are Fired 24534F3' [random characters] pretending to come from random names and email addresses with a zip attachment.. when/IF you open the .JS file inside it downloads Locky ransomware... it hasn’t come from your employer, but... some recipients will panic and blindly open the file and get all their files encrypted by Locky Ransomware. One of the emails looks like:
From: Dotty Rios <RiosDotty7658@ meliajogja .com>
Date: Tue 03/05/2016 12:38
Subject: You Are Fired 24534F3
Attachment: bolujou_data_54115.zip
We regret to inform you, yet we no longer need require your services.
Attached you can find additional information and the payout roll for the last month.
3 May 2016: bolujou_data_54115.zip: Extracts to: trans3470.js - Current Virus total detections 1/57*
.. Payload Security** MALWR*** shows a download from
http ://tumarketingdiario .com/cE7ZM5.exe (VirusTotal 5/57[4]) MALWR[5].. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/afb2ceb7313e1de501dc75d3a7875ed73972bac2898109ad74c3a9b54d980601/analysis/1462275481/
** https://www.hybrid-analysis.com/sample/afb2ceb7313e1de501dc75d3a7875ed73972bac2898109ad74c3a9b54d980601?environmentId=4
Contacted Hosts
65.60.47.53
91.226.93.113
*** https://malwr.com/analysis/MTM2NDAwZDIxZjM4NDNkMzkyNTJlYzRhN2VkZjc5MjI/
Hosts
65.60.47.53
4] https://www.virustotal.com/en/file/4edf8e374a2a924ff8ef4f69520d8b6d849cf140f8a1f9d940c637c3e9a59bbd/analysis/1462275722/
5] https://malwr.com/analysis/NjRiYTdhMTFlYThjNDYwMDkxNzU5YzVkMjNlOTdmNTQ/
- http://blog.dynamoo.com/2016/05/malware-spam-you-are-fired-leads-to.html
3 May 2016 - "This spam email comes with a malicious attachment.
From: Elfrida Wymer [WymerElfrida9172@ recordshred .com]
Date: 3 May 2016 at 12:40
Subject: You Are Fired BBF904D
We regret to inform you, yet we no longer need require your services.
Attached you can find additional information and the payout roll for the last month.
It's a bit of a self-fulfilling prophecy. If you are daft enough to download the ZIP file, and extract and run the script then perhaps you WILL get fired. According to this Malwr report*, the twice-obfuscated-script in the sample I saw downloads a binary from:
niagara .vn.ua/5wpSRm.exe
This Hybrid Analysis** indicates that this is Locky ransomware. The DeepViz report*** shows network traffic to:
31.184.197.126 (Petersburg Internet Network, Russia)
91.226.93.113 (Sobis, Russia)
91.219.29.64 (FLP Kochenov Aleksej Vladislavovich / uadomen.com, Ukraine)
This is a subset of the IPs found in this earlier spam run[4], I recommend you block-the-lot."
* https://malwr.com/analysis/ODc0ZWY5NWVjMmVmNDA2NGFkNzdlZDYxNzlkMzU5NWM/
Hosts
185.68.16.6: https://www.virustotal.com/en/ip-address/185.68.16.6/information/
** https://www.hybrid-analysis.com/sample/4edf8e374a2a924ff8ef4f69520d8b6d849cf140f8a1f9d940c637c3e9a59bbd?environmentId=4
Contacted Hosts
31.184.197.126
*** https://sandbox.deepviz.com/report/hash/c366a0f6a4f9b2157df9657b42fcb4e6/
4] http://blog.dynamoo.com/2016/05/malware-spam-third-reminder-outstanding.html
niagara .vn.ua: 185.68.16.6
___
Fake 'New Job Offer' SPAM - JS malware delivers Locky
- https://myonlinesecurity.co.uk/new-job-offer-js-malware/
3 May 2016 - "... a new job paying somewhere between $300 and $1000 per day depending on which email you receive. The email has a subject of 'New Job Offer [random amounts and characters]' pretending to come from random email addresses with a zip attachment which -if- you run the .js file inside it will download Locky ransomware... One of the emails looks like:
From: Taisha Bodily <BodilyTaisha42@ firsttimelogistics .com.br>
Date: Tue 03/05/2016 13:02
Subject: New Job Offer ($499,65/day – 2C9FFF5)
Attachment: derek_copy_956559.zip
No skills are required, perfect for housewives, students and young men. Salary: $5,000/month, offer code:2C9FFF5.
Check out the information leaflet attached to this e-mail.
3 May 2016: derek_copy_956559.zip: Extracts to: show2719.js - Current Virus total detections 4/57*
.. MALWR shows a download of Locky ransomware from
http ://conchaespina .es/SGnTkN.exe (VirusTotal 5/56**).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/1785c0911567faaddca1d29a4e009b75fa23ea58ebea7656c2e34e62a20e208c/analysis/1462277136/
** https://www.virustotal.com/en/file/4edf8e374a2a924ff8ef4f69520d8b6d849cf140f8a1f9d940c637c3e9a59bbd/analysis/1462276640/
conchaespina .es: 212.227.247.202: https://www.virustotal.com/en/ip-address/212.227.247.202/information/
___
Fake 'Amazon' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/your-amazon-co-uk-order-has-dispatched-js-malware-delivering-locky/
3 May 2016 - "... an email with the subject of 'Your Amazon .co.uk order has dispatched (#758-8060509-6716957)' [random numbered] pretending to come from Amazon .com <auto-shipping@ amazon .com>. This is delivering the -same- Locky Ransomware version as described in this earlier post:
> https://myonlinesecurity.co.uk/help-with-bill-id38185149-80304188-js-malware/
One of the emails looks like:
From: Amazon .com <auto-shipping@ amazon .com>
Date: blank
Subject: Your Amazon .co.uk order has dispatched (#758-8060509-6716957)
Attachment: ORDER-758-8060509-6716957.zip
Body content: Totally blank
Other download sites in this malspam run delivering Locky include:
http ://14daystresscure .com/89yg7g87byi - 192.185.64.62
http ://apteka24.strefa .pl/89yg7g87byi - 217.74.66.167
http ://bara.ovh .org/89yg7g87byi - 46.105.198.1
http ://discountghd .org/89yg7g87byi - 210.1.60.27
http ://ikiartimatbaa .com/89yg7g87byi - 94.73.150.20
http ://istvest .com/89yg7g87byi - 79.98.29.30
http ://kroppo.za .pl/89yg7g87byi - 193.203.99.115
http ://metin2dlz.hi2 .ro/89yg7g87byi - 89.42.39.75
http ://paraisofuneraria .com.br/89yg7g87byi - 177.12.164.96
http ://physiob .de/89yg7g87byi - 81.169.145.163
http ://virusremovals .org/89yg7g87byi - 173.254.28.156
These sites have been used to deliver different several-versions-of-Locky at differing times today... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
___
Fake 'Invoice' SPAM - leads to Angler EK
- https://myonlinesecurity.co.uk/invoice-80005-from-verisign-inc-malspam-leading-to-angler-exploit-kit/
3 May 2016 - "An email with the subject of 'Invoice 80005 from VeriSign, Inc.' pretending to come from VeriSign with-a-link is another one from the current bot runs which tries to infect your computer via the Angler exploit kit on the remote site... link in the -iframe- is to
http ://207.244.95.42 /twitterapi/ .. Yesterday it was to
http ://207.244.95.41 /twitterapi/ ..
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/verisign-1024x661.png
The -link- behind 'view invoice' takes you to various compromised sites all with an -iframe- to the Angler exploit kit... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
207.244.95.42: https://www.virustotal.com/en/ip-address/207.244.95.42/information/
207.244.95.41: https://www.virustotal.com/en/ip-address/207.244.95.41/information/
>> https://www.virustotal.com/en/url/4ade2e19d596c7efcc5f27116a32af347171bd6adc3f748e7cc190bae9fbe728/analysis/
___
Fake 'CamScanner' SPAM - JS malware delivering Locky
- https://myonlinesecurity.co.uk/scanned-by-camscanner-new-doc-pretending-to-come-from-your-own-email-address-js-malware-delivering-locky-ransomware/
2 May 2016 - "... an email with the subject of 'New Doc 134 Page 3 (random doc number, random page number)' pretending to come from 'CamScanner' <your-own-email-address>... delivers exactly the -same- Locky ransomware versions form the same download locations as described in these [1] [2] earlier posts...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Scanned-by-CamScanner-1024x355.png
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://myonlinesecurity.co.uk/new-job-offer-js-malware/
2] https://myonlinesecurity.co.uk/you-are-fired-24534f3-js-malware-downloads-locky/
___
Fake 'Service Fee' SPAM - JS malware leads to Locky
- https://myonlinesecurity.co.uk/internet-service-fee-235424id-js-malware-leads-to-locky/
3 May 2016 - "... an email saying you need to pay $99 for the 'requested local repairs on your street' with the subject of 'Internet Service Fee (235424ID) [random characters]' pretending to come from random email addresses... this is downloading the -same- Locky ransomware version as described in these earlier posts [1] [2]... One of the emails looks like:
From: Emmeline Speak <SpeakEmmeline282@ sriinc .org>
Date: Tue 03/05/2016 15:19
Subject: Internet Service Fee (235424ID)
Attachment: caution_addy-C3F7893_235424.zip
Our company has made requested local repairs on your street. You are obligated to pay a fee of $99.00.
More information in the document enclosed.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://myonlinesecurity.co.uk/new-job-offer-js-malware/
2] https://myonlinesecurity.co.uk/you-are-fired-24534f3-js-malware-downloads-locky/
:fear::fear: :mad:
AplusWebMaster
2016-05-04, 14:00
FYI...
Fake 'info' SPAM - JS malware downloads Locky
- https://myonlinesecurity.co.uk/blank-email-saying-info-js-malware-downloads-locky/
4 May 2016 - "A -blank- email with the subject of 'info' pretending to come from asisianu@ pauleycreative .co.uk with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: asisianu@ pauleycreative .co.uk
Date: Wed 04/05/2016 14:20
Subject: info
Attachment: info.zip
Body content: Totally blank/empty
4 May 2016: info.zip: Extracts to: document_copy.js - Current Virus total detections 5/57*
.. MALWR** shows a download of Locky ransomware from
http ://tasox .eu/v/log.php?f=403 (VirusTotal 5/57***). I was unable to get any malware myself direct from the website. The downloaded malware came from MALWR.
Update: It looks like this is actually part of the recent Angler kit malspam campaign, where the gate link is malspammed out. Then it -redirects- via an -iframe- to another site then bounces on the Angler site, where it downloads Locky or whichever other Malware/Trojan/Ransomware it wants to infect you or compromise you with... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/7e07f780e3322e9956ca9616221b56dfc2e0e96e8a1f6097da7a1db50799ea84/analysis/1462350988/
** https://malwr.com/analysis/NzM5Y2MyMzI0M2VkNGQ1YmEyZGExOGM4YWVmODEyMGU/
Hosts
212.47.208.164: https://www.virustotal.com/en/ip-address/212.47.208.164/information/
>> https://www.virustotal.com/en/url/1639e2228035c09d9d8494e6c652a97ed603c29ac4da939c74fe4463404afe12/analysis/
138.201.95.72: https://www.virustotal.com/en/ip-address/138.201.95.72/information/
*** https://www.virustotal.com/en/file/e1d2beb9b62dce436d3777cca8ea84bff68c7f23e4387a3ea6205748cd9d48ca/analysis/1462351541/
TCP connections
31.184.197.126: https://www.virustotal.com/en/ip-address/31.184.197.126/information/
___
Fake 'scan10001' SPAM - JS malware delivers Locky
- https://myonlinesecurity.co.uk/emailing-scan10001-js-malware-delivers-locky-b/
4 May 2016 - "An email with the subject of 'Emailing: scan10001' pretending to come from Ahmed Al-Zamil <ahmed.al-zamil@ torathuna .com> with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Ahmed Al-Zamil <ahmed.al-zamil@ torathuna .com>
Date: Wed 04/05/2016 12:16
Subject: Emailing: scan10001
Attachment: scan10001.rar
Your message is ready to be sent with the following file or link
attachments:
scan10001
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
4 May 2016: scan10001.rar: Extracts to: 2016-80506_2016052.js - Current Virus total detections 23/56*
... downloads Locky ransomware from
kochgruppe-franken .de/09u87tgy (VirusTotal 3/56**) which is exactly the -same- Locky version as described in THIS earlier post[1], so they will be using the same download locations in both campaigns... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://www.virustotal.com/en/file/084549a8a6984169921f66becc5966776047b5f55ebe153a5acb0ec6f3ef72c3/analysis/1462360492/
1] https://myonlinesecurity.co.uk/mpsmobile-rechnung-2016-13861-word-doc-macro-malware/
kochgruppe-franken .de: 81.169.145.160: https://www.virustotal.com/en/ip-address/81.169.145.160/information/
>> https://www.virustotal.com/en/url/9a39a41df30745dbf83b57ca51c84dca28149e477383e0406521b63aa192388d/analysis/
___
Fake 'transaction history' SPAM - JS malware downloads Locky
- https://myonlinesecurity.co.uk/your-balance-and-recent-transaction-history-is-attached-to-this-mail-please-verify-it-js-malware/
4 May 2016 - "An email with the subject of 'RE: ' pretending to come from random names & email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware... has a massive 525kb js file inside the zip. The zip actually contains 3 identical copies of the same file... One of the emails looks like:
From: Zackary Ramsey <RamseyZackary1901@ anno1911 .nl>
Date:Wed 04/05/2016 16:21
Subject: Re:
Attachment: transactions_632.zip
Hi, beavers
Your balance and recent transaction history is attached to this mail. Please verify it
Regards,
Zackary Ramsey
4 May 2016: transactions_632.zip: Extracts to: 51434_51434.js - Current Virus total detections 1/56*
.. MALWR** shows a download of Locky ransomware from
http ://richmondsofa .com/v6yhsa (VirusTotal 5/56***).. The basic rule is NEVER open any attachment to an email, unless you are expecting it...:
* https://www.virustotal.com/en/file/b29d58b73a0f05f202216ae3f5392b56d7d40ab49a67e4839d00ef051c2f7194/analysis/1462376280/
** https://malwr.com/analysis/MzM1Mjc5N2E4YjZhNGZmYmEzZDUwNzE3Zjc1ZDU1Yjg/
Hosts
46.30.212.96: https://www.virustotal.com/en/ip-address/46.30.212.96/information/
>> https://www.virustotal.com/en/url/0c97e12618b2ec2094195f1f10bf7e2c33fcf6fbbb2226880861a3b7020d3183/analysis/
185.22.67.108: https://www.virustotal.com/en/ip-address/185.22.67.108/information/
*** https://www.virustotal.com/en/file/c01faedd7bb4dbe340567ab9c7fd437a154f0543a1d0d48f4578cb192afd9861/analysis/1462376825/
TCP connections
185.22.67.108
___
CBS-affiliated TV Stations expose Visitors to Angler EK / Malvertising
- https://blog.malwarebytes.org/threat-analysis/2016/05/cbs-affiliated-television-stations-expose-visitors-to-angler-exploit-kit/
May 4, 2016 = "A rogue advertiser managed to subvert the Taggify self-serve ad platform to push the Angler exploit kit to unsuspecting visitors of two CBS affiliated TV stations. One in St. Louis called KMOV, and the other WBTV, is located in Charlotte, North Carolina. This malvertising attack leveraged a familiar technique of -hijacking- GoDaddy accounts to create various subdomains pointing to malicious servers. These are used to host the ad content (JavaScript, image, etc.) but also to hide malicious code and alternate between clean and infected adverts depending on multiple factors (time of day, user agent, IP blacklist, etc). While the main malvertising domain was actually parked (its name was registered but there is no relevant content) the subdomain is happily hosting an ad banner:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/domain_subdomain.png
Web crawlers and scanners will be served the ‘normal’ ad banner, genuine users will be handed an extraneous iframe, -redirecting- to the infamous Angler exploit kit:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/Flow.png
Attack flow:
Publisher: kmov .com
Ad platform: data.rtbfy .com/rtb2?{redacted}
Rogue advertiser: som.barkisdesign .com/creatives/tag.js?cp=309505341&domain=kmov .com
Angler EK: parkwateavereverende .fredricholmgren .se/sinuously/0679/31/74/283325.html?utm_source=kmov .com
The Angler exploit kit has been known to actively push its own version of ransomware, dubbed CryptXXX as well as other types of malware via the Bedep Trojan. The best line of defense against malvertising and ransomware attacks remains a combination of safe practices (regular updates, backups) and layered protection (Anti-Malware, Anti-Exploit). We have informed the ad platform, publisher and GoDaddy about this attack which was still ongoing at the time of posting.
IOCs:
som .barkisdesign .com
199.255.137.197: https://www.virustotal.com/en/ip-address/199.255.137.197/information/
parkwateavereverende .fredricholmgren .se: 46.30.212.217:
- https://www.virustotal.com/en/ip-address/46.30.212.217/information/
>> https://www.virustotal.com/en/url/ed960f8f2bc9b832d02a58802a1e756217cd8f18480a7b3bf1aea750a4f03d5a/analysis/
___
Big data breaches found at major Email services
- http://www.reuters.com/article/us-cyber-passwords-idUSKCN0XV1I6
May 4, 2016 - "Hundreds-of-millions of -hacked- usernames and passwords for email accounts and other websites are being traded in Russia's criminal underworld, a security expert told Reuters. The discovery of 272.3 million stolen accounts included a majority of users of Mail.ru (MAILRq.L), Russia's most popular email service, and smaller fractions of Google (GOOGL.O), Yahoo (YHOO.O) and Microsoft (MSFT.O) email users, said Alex Holden, founder and chief information security officer of Hold Security*. It is one of the biggest stashes of stolen credentials to be uncovered since cyber attacks hit major U.S. banks and retailers two years ago.
Holden was previously instrumental in uncovering some of the world's biggest known data breaches, affecting tens of millions of users at Adobe Systems (ADBE.O), JPMorgan (JPM.N) and Target (TGT.N) and exposing them to subsequent cyber crimes. The latest discovery came after Hold Security researchers found a young Russian hacker bragging in an online forum that he had collected and was ready to give away a far larger number of stolen credentials that ended up totaling 1.17 billion records. After eliminating duplicates, Holden said, the cache contained nearly 57 million Mail.ru accounts - a big chunk of the 64 million monthly active email users Mail.ru said it had at the end of last year. It also included tens of millions of credentials for the world's three big email providers, Gmail, Microsoft and Yahoo, plus hundreds of thousands of accounts at German and Chinese email providers..."
* http://holdsecurity.com/news/the_collector_breach/
> http://arstechnica.com/security/2016/05/the-massive-password-breach-that-wasnt-google-says-data-is-98-bogus/
May 6, 2016
:fear::fear: :mad:
AplusWebMaster
2016-05-05, 13:30
FYI...
• https://blogs.msdn.com/themes/blogs/generic/post.aspx?WeblogApp=alexhomer&y=2011&m=02&d=06&WeblogPostName=blocking-malware-domains-in-isa-2006&GroupKeys=
“… be aware that malware that connects using an IP address instead of a domain name will -not- be blocked when you use just domain name lists…”
Fake 'Statement' SPAM - leads to Dridex
- http://blog.dynamoo.com/2016/05/malware-spam-please-see-attached.html
5 May 2016 - "This -fake- financial spam leads to malware. Details change slightly from email to email:
From: Administrator [adminHb@ victimdomain .tld]
Date: 5 May 2016 at 11:29
Subject: Statement 6BBC0E
Please See Attached
Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ...
This email has been checked for viruses by Avast antivirus software...
It must be safe.. scanned by both Symantec and Avast! Well, of course that's just BS and the attached DOC file leads to malware, specifically the -same- payload as seen in this slightly earlier spam run*."
* http://blog.dynamoo.com/2016/05/malware-spam-docucentre-iv-scan-data.html
5 May 2016 - "This -fake- document scan appears to come from within the victim's own domain (but this is just a simple forgery) and has a malicious attachment:
From: DocuCentre-IV [DocuCentre1230@ victimdomain .tld]
Date: 5 May 2016 at 10:27
Subject: Scan Data
Number of Images: 1
Attachment File Type: PDF ...
Details vary slightly from message to message. Attached is a DOC file (not a PDF) starting with PIC, DOC or IMG in the samples I have seen plus a random number. Typical VirusTotal detection rates are 6/56 [1].. [6]. Various automated analyses of these documents [7].. [17] show a binary being downloaded from the following locations:
fm1.ntlweb .org/87hcnrewe
iconigram .com/87hcnrewe
www .sammelarmband .de/87hcnrewe
hospice.psy .free.fr/87hcnrewe
This dropped file has a detection rate of 5/46*. This Hybrid Analysis** and this DeepViz report*** show subsequent network traffic to:
192.241.252.152 (Digital Ocean, US)
195.169.147.26 (Culturegrid.nl, Netherlands)
70.164.127.132 (Southland Technology, US)
The characteristics of the payload suggest this is the Dridex banking trojan.
Recommended blocklist:
192.241.252.152
195.169.147.26
70.164.127.132 "
1] https://www.virustotal.com/en/file/af69220c029de7fa6f180f98c176263d24d187d1be7321e866b9d96e5c314fab/analysis/
6] https://www.virustotal.com/en/file/96149581f796b642c9477b87d3eeba05930feb253e2b2692bc6b25f6a69dc46b/analysis/
7] https://malwr.com/analysis/MzZiZDQzZTExMmQ1NDE5ZGFiZDEwODRlY2FjNzYwZjM/
17] https://www.hybrid-analysis.com/sample/96afb0f23199547d47801eacb9ce4562b87fbb2a68e5a2a2f0aa271d4e336ae0?environmentId=4
* https://www.virustotal.com/en/file/84997e293dd1707b95c5ade8cc241742dd697f04f8f592545f8d140c801b6b3e/analysis/1462442350/
** https://www.hybrid-analysis.com/sample/84997e293dd1707b95c5ade8cc241742dd697f04f8f592545f8d140c801b6b3e?environmentId=1
*** https://sandbox.deepviz.com/report/hash/803358c128aae4faed24e194d6388e68/
- https://myonlinesecurity.co.uk/scan-data-docucentrexxxyour-email-address-word-doc-macro-malware/
5 May 2016 - "An email with the subject of 'Scan Data' pretending to come from DocuCentre-IV <DocuCentre071@ your- email-address > with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: DocuCentre-IV <DocuCentre071@ your-email-address >
Date: Thu 05/05/2016 10:26
Subject: Scan Data
Attachment: SCAN000209053.doc
Number of Images: 1
Attachment File Type: PDF
Or version 2 (administrator version):
Please See Attached
Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ...
This email has been checked for viruses by Avast antivirus software...
5 May 2016: SCAN000209053.doc - Current Virus total detections 5/56*
.. MALWR** shows a download from
http ://www.sammelarmband .de/87hcnrewe (VirusTotal ***).. MALWR (on that) is inconclusive but looks like either Locky ransomware or Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/2a368412dc312c01ed3cb3251727c55231871a6a5fa94b6f0ad6da58f977ba0f/analysis/1462440302/
** https://malwr.com/analysis/NDMxYTVlNWMyNjFjNGJmNTkxMDk2NWFmOTgwMWE1ZTI/
Hosts
81.169.145.92: https://www.virustotal.com/en/ip-address/81.169.145.92/information/
>> https://www.virustotal.com/en/url/a27534b5b2a4727da7727b1365b28d4fa00c322da9faf7de0c244f5d71f0fc85/analysis/
sammelarmband .de: 81.169.145.92
*** https://www.virustotal.com/en/file/84997e293dd1707b95c5ade8cc241742dd697f04f8f592545f8d140c801b6b3e/analysis/
___
Fake 'Certificate UPDATE' SPAM - JS malware
- https://myonlinesecurity.co.uk/certificate-update-pretending-to-come-from-incoming-fax-at-your-own-email-address-js-malware/
5 May 2016 - "An email pretending to be a notification that you need to update your webmail certificate with the subject of 'Certificate UPDATE' pretending to come from 'Incoming Fax <Incoming.Fax@ your-own-email-domain > with a zip attachment is another one from the current bot runs... The attachment name matches the certificate number in the body of the email...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Certificate-UPDATE-1024x613.png
5 May 2016: Certificate_9298-4437-QBXB-3356-CUBF-3728.zip: Extracts to: Certificate.js
Current Virus total detections 4/54*: MALWR** shows a download from
http ://www .valvedistributors .com.au/wp-content/uploads/2016/04/certificateA79EF99W89Q7.exe (VirusTotal 3/55***)
.. MALWR... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/57daff233f60af8f0da7a445a8f321565be7f6cad853815ffa52d666bcff0176/analysis/1462443505/
** https://malwr.com/analysis/ZDM3NTJiZjFiMGRiNDI2ZDg4MDEzNWUyMzJlM2U4NDY/
Hosts
104.28.27.13: https://www.virustotal.com/en/ip-address/104.28.27.13/information/
>> https://www.virustotal.com/en/url/e08f73f2d5ea2cab45704d7b244f18e12474f2766429da33794b2d305fc55852/analysis/
*** https://www.virustotal.com/en/file/3fe5711dd287b171184adf6dce1384e43410e4f8bbfcc4eb38997a75b6c68d7f/analysis/1462446273/
4] https://malwr.com/analysis/OTNiOTM2OWQ4YTIyNDhlOWFiYTI4ZTI3ZDY2MzE0Nzk/
___
Fake 'Refund Unsuccessful' SPAM - JS malware
- https://myonlinesecurity.co.uk/refund-unsuccessful-your-order-has-been-cancelled-however-we-are-not-able-to-proceed-with-the-refund-js-malware/
5 May 2016 - "An email with the subject of 'Refund Unsuccessful C1CE' [random characters] pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads some malware... One of the emails looks like:
From: Adriane Casson <CassonAdriane21541@ bob-bike .com>
Date: Thu 05/05/2016 13:37
Subject: Refund Unsuccessful C1CE
Attachment: copy_gr_695715.zip
Your order has been cancelled, however, we are not able to proceed with the refund of $140,47.
All the information on your case C1CE is listed in the document below.
5 May 2016: copy_gr_695715.zip: Extracts to: doc_QZOImnHYub.js - Current Virus total detections 1/55*
.. MALWR** shows a download from
http ://jtapecustom .com/adm.exe (VirusTotal 4/56***)... possibly Dridex, but might be Locky... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/67bf070189f59ed0147223bd4a1677a6453a5a3dabd27bf7961d7f0b882795dd/analysis/1462452122/
** https://malwr.com/analysis/MzMzZGMyMjA2NmVlNDkxMjgwYmI5ZWRmODkxY2ZkM2E/
Hosts
162.13.162.105: https://www.virustotal.com/en/ip-address/162.13.162.105/information/
>> https://www.virustotal.com/en/url/b563541afbfbf88d4a4f2311c9537f3b502a1369cc5b83615ded02cc71f9b1da/analysis/
*** https://www.virustotal.com/en/file/4e9695ab9202b0ec3b0f9369d655921629608daf52615d293eec4c71ead4b4c6/analysis/1462452536/
___
Fake 'Ticket' SPAM - JS malware delivers Locky
- https://myonlinesecurity.co.uk/blank-email-saying-ticket-js-malware-delivers-locky/
5 May 2016 - "... a -blank- email with the subject of 'Ticket' pretending to come from random names @ gmail .com with a zip attachment is another one from the current bot runs which downloads Locky ransomware... they have just spoofed the @Gmail address... One of the emails looks like:
From: Justine walker <Everette6879@ gmail .com>
Date: Thu 05/05/2016 17:18
Subject: Ticket
Attachment: TICKET-T007054882478807.zip
Body content: totally -blank-
5 May 2016: TICKET-T007054882478807.zip: Extracts to: VA4309497433399300.js - Current Virus total detections 1/55*
A manual analysis shows a download of Locky from
lovesanimals .com/09y8hb7v6y7g (VirusTotal 2/55**) MALWR[3] | Payload Security
Other download sites found so far include:
buntrocks .com/09y8hb7v6y7g - 64.22.106.154
www .semann .de/09y8hb7v6y7g - 81.169.145.77
http ://svitpokrivli .com/09y8hb7v6y7g - 91.203.144.46
http ://drdianateachertraining .com/09y8hb7v6y7g - 74.220.207.114
advocacyhealthcare .com/09y8hb7v6y7g - 162.144.5.3
barebooger .com/09y8hb7v6y7g - 162.210.102.65
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5f398696b58fdc68f4466c281bbe078e1706c4f152466e27483c21a42505fea1/analysis/1462465832/
** https://www.virustotal.com/en/file/8ff22deb3d6bf93dff8c39e3494ade7241c4c5bc8b03e77ffc7685d8490248ee/analysis/1462464264/
3] https://malwr.com/analysis/ZjAxOWQ0YTlhMzIwNGQ3YWEyZjNlZjJiYjk4MzE5Njc/
4] https://www.hybrid-analysis.com/sample/8ff22deb3d6bf93dff8c39e3494ade7241c4c5bc8b03e77ffc7685d8490248ee?environmentId=4
Contacted Hosts
138.201.95.72: https://www.virustotal.com/en/ip-address/138.201.95.72/information/
>> https://www.virustotal.com/en/url/ee88f803cc9b61f5f2dab0e527bc11ead1a4bb5c79436a8353e5fbdc22ab0b7d/analysis/
___
Fake 'Your ID card has been found' SPAM - doc macro malware
- https://myonlinesecurity.co.uk/your-id-card-has-been-found-word-doc-macro-malware/
5 May 2016 - "An email with the subject of 'Your ID card has been found' pretending to come from random email addresses with a malicious word doc RTF attachment is another one from the current bot runs... The attachment name is created by prepending the recipients name (the first part before the @ in the email address to _copy/ details/scan_random numbers .rtf). The email looks like:
From: Alois.Lorenz7@ ozsu .com.tr
Date: Thu 05/05/2016 18:15
Subject: Your ID card has been found
Attachment: amy.hewitt_copy_792752.rtf
Hello, we have found your ID card on April 29th, 2016.
Please review the scanned version let us know if it’s yours.
5 May 2016: amy.hewitt_copy_792752.rtf - Current Virus total detections 3/56*
.. MALWR shows a download from
http ://911.sos-empleados .net/newera/walkthisland/greenland.php which gave me sashagrey.jpg (-not- a jpg but a renamed .exe) (VirusTotal 4/56**).. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/fc8585ce4d7bc895465b00aa8289fc3b40a91c56deeb5bcaecab3b346518b4bd/analysis/1462468652/
** https://www.virustotal.com/en/file/7153c10d319efa069f866593bd52b3741b71edfcc2d29e6b92742a4a9e20018d/analysis/1462469305/
911.sos-empleados .net: 31.131.22.156: https://www.virustotal.com/en/ip-address/31.131.22.156/information/
>> https://www.virustotal.com/en/url/dffbd138507e1e87d85c238952662ef79f970c7da021791b16ede1e5c96e6bc3/analysis/
___
Fake 'Someone Might Be Using Your Account' SPAM - doc macro malware leads to Dridex
- https://myonlinesecurity.co.uk/someone-might-be-using-your-account-word-doc-macro-malware-leads-to-dridex/
5 May 2016 - "An email with the subject of 'Someone Might Be Using Your Account 022FCF' [random characters] pretending to come from random names and email addresses with a malicious word doc rtf -or- a zip file attachment is another one from the current bot runs... The email looks like:
From: Jenna Lynn <LynnJenna657@ etoz .com.my>
Date:
Subject: Someone Might Be Using Your Account 022FCF
Attachment: [either word rtf doc like fininfo_38955.rtf -or- zip file like derek_account_39115.zip]
Your account was access on April 12, 2016 at 09:07 PM from Barcelona, Spain.
Please, confirm the details and check the security report enclosed.
5 May 2016: fininfo_38955.rtf - Current Virus total detections 3/56*
.. MALWR** shows a download from
http ://911.sos-empleados .net/newera/walkthisland/greenland.php which is the same as THIS post[1]
5 May 2016: derek_account_39115.zip extracts to: details_G1xAIwQEscaW4ULy.js
Current Virus total detections 1/56***. MALWR**** shows a download from
http ://jtapecustom .com/adm.exe Which is the -same- malware as THIS post[2].."
* https://www.virustotal.com/en/file/6e115cafccf3d9e5ee24fcb75721c046aab6b1073ac639549fa82a343be16a13/analysis/1462472152/
** https://malwr.com/analysis/YWVkNDZjODQ1MzdhNDU2Nzg4NjBkZTEyNmZiMDAxYTU/
Hosts
31.131.22.156
*** https://www.virustotal.com/en/file/72bf06d24b2e0bd8edab0bcf82f249de9a088eb82eeb742ae5c8b8ce8779fe7f/analysis/1462472608/
**** https://malwr.com/analysis/MjM2ODYxYmU3MTU2NDE2Mzg2NzU5NTNmNmFlOGNhYjM/
Hosts
162.13.162.105
1] https://myonlinesecurity.co.uk/your-id-card-has-been-found-word-doc-macro-malware/
2] https://myonlinesecurity.co.uk/refund-unsuccessful-your-order-has-been-cancelled-however-we-are-not-able-to-proceed-with-the-refund-js-malware/
___
Fake 'online order' SPAM - doc rtf macro malware
- https://myonlinesecurity.co.uk/thank-you-your-online-order-was-placed-successfully-word-doc-rtf-macro-malware/
4 May 2016 - "An email with the subject of 'Thank you! Your online order was placed successfully' pretending to come from random names and email addresses with a malicious word RTF doc attachment is another one from the current bot runs... The email looks like:
From: Hickman.Fuchs82@ vsepaketi .ru
Date: Wed 04/05/2016 19:48
Subject: Thank you! Your online order was placed successfully
Attachment: rechn_comerz(052016)_5964.rtf
Thank you for shopping with Sumitomo Mitsui Financial Group Inc
Your order status was changed to [PROCESSING]. You can view order details in the document attached
We’ll send you email once the goods will be passed to delivery notifying the status change to [DISPATCHED]
If you have any queries do not hesitate to contact us via email or telephone.
Kind Regards,
Hickman Fuchs
Sumitomo Mitsui Financial Group Inc ...
4 May 2016: rechn_comerz(052016)_5964.rtf - Current Virus total detections 2/56*
.. MALWR** shows a download from
http ://sin.grupo-integral .co/lexisnexis/search/bgreport.php which gave me _Locky_5300ad7f.exe (VirusTotal ***)
.. MALWR[4]... Update: I am assured that this is Locky ransomware.. the failure of MALWR to analyse it is due to VM awareness, so it acts different... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/191d142ee08f529c0fb5f57adc1d34cbee4af3f20bbc14430c7d98ccb0820134/analysis/1462389649/
** https://malwr.com/analysis/YTIxOWQzZDAyYmFlNGM1YzlhZmJiMDE2MjA4YTVhMjg/
Hosts
146.120.89.47: https://www.virustotal.com/en/ip-address/146.120.89.47/information/
>> https://www.virustotal.com/en/url/852b1b0a383ee3af8b32dae6724dd963eee7ce836b6368e9eb40fcf423cc1c6f/analysis/
*** https://www.virustotal.com/en/file/b1a824e1a7463c97473db5a6bc12ac996d1acb46f4ea54df3736ceea1e2cc1a0/analysis/
4] https://malwr.com/analysis/YjI2NWVhOTFlMDg2NDIzY2JmYmY1OGNjYzMzNzQxOGE/
:fear::fear: :mad:
AplusWebMaster
2016-05-06, 13:44
FYI...
Fake 'Upcoming Payment' SPAM - JS malware delivers Dridex
- https://myonlinesecurity.co.uk/upcoming-payment-1-month-notice-js-malware-delivers-dridex/
6 May 2016 - "An email with the subject of 'Upcoming Payment – 1 Month Notice' pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Dridex. In exactly the same way as THIS[1] earlier Malspam run, the encrypted JavaScript file contains a long list of compromised sites that the Dridex banking Trojan is downloaded from...
1] https://myonlinesecurity.co.uk/someone-might-be-using-your-account-word-doc-macro-malware-leads-to-dridex/
One of the emails looks like:
From: Mona Gates <GatesMona02@ ideadigitale .org>
Date: Thu 05/05/2016 23:20
Subject: Upcoming Payment – 1 Month Notice
Attachment: user_data_37776.zip
Please, be informed regarding the upcoming payment ID:30724, which must be paid in full until the June 1st, 2016.
Additional information is enclosed in the file down below.
6 May 2016: user_data_37776.zip: Extracts to: details_uQG07BLH189.js - Current Virus total detections 1/56*
.. MALWR** shows a download of Dridex banking trojan from a long list of sites (VirusTotal 7/55***). Sites discovered listed inside the encrypted js file include: (other versions of this might well include other sites):
http ://fashionpoppers .com/adm.exe - 66.147.244.66
http ://sky-hero .com/adm.exe - 213.186.33.171
http ://wbsrainwater .com/adm.exe - 91.146.109.184
http ://burnspots .com/adm.exe - 160.153.32.229
http ://wholesalejaipurkurti .com/adm.exe - 46.166.163.195
http ://bedbugsurvivalguide .com/adm.exe - 54.241.22.111
http ://clearancezone .com.au/adm.exe - 184.164.156.210
http ://asiandukan .co.uk/adm.exe - 192.186.200.169
http ://ribastiendaonline .com/adm.exe - 185.92.247.46
http ://hogcustom .co.uk/adm.exe - 213.246.109.8
http ://shopnutri .com.br/adm.exe - 177.12.173.166
http ://metersdirect .com.au/adm.exe - 52.64.39.102
http ://buyemergencylight .com/adm.exe - 192.117.12.154
http ://lcdistributing .com/adm.exe - 192.249.113.43
http ://liftmaxthailand .com/adm.exe - 119.59.120.32
http ://millersportsaspen .com/adm.exe - 23.235.220.84
http ://hkautosports .com/adm.exe - 205.134.241.120
http ://syntechcs .co.uk/adm.exe - 188.65.114.122
http ://presspig .com/adm.exe - 70.40.220.100
http ://lojaturbo .com.br/adm.exe - 81.19.185.200
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/34b6e696eee806aedd4934998aa8944c32e5460586a8e6fa54fec28d298bc594/analysis/1462487086/
** https://malwr.com/analysis/MjUxNzY0N2M4Yzc4NDc0ZmE3OGQ1ODJjMWJmNDc1OGQ/
Hosts
213.246.109.8
213.186.33.171
192.117.12.154
185.92.247.46
81.19.185.200
52.64.39.102
177.12.173.166
184.164.156.210
91.146.109.184
119.59.120.32
192.249.113.43
70.40.220.100
188.65.114.122
66.147.244.66
192.186.200.169
23.235.220.84
54.241.22.111
46.166.163.195
160.153.32.229
205.134.241.120
*** https://www.virustotal.com/en/file/c1ce282a8511b4d135c10e511d1977c13830e8021e06c34273dd479308801139/analysis/1462507119/
___
Fake 'New Payment Received' SPAM - JS malware delivers Dridex
- https://myonlinesecurity.co.uk/new-payment-received-js-malware-delivers-dridex/
6 May 2016 - "Continuing with the overnight Malspam runs is yet another -Dridex- dropper with a long list of sites embedded inside the encrypted JavaScript file. This is an email with the subject of 'New Payment Received' pretending to come from random senders and email addresses with a zip attachment containing an encrypted JavaScript file... One of the emails looks like:
From: Kathie Miller <MillerKathie8660@ fixed-189-252-187-189-252-125 .iusacell .net>
Date: Fri 06/05/2016 02:01
Subject: New Payment Received
Attachment: caution_rob_522737.zip
You have just received a new payment! Trans number 97407. For more information please review the transaction report enclosed.
6 May 2016: caution_rob_522737.zip: Extracts to: cash_q9rTBHi225.js - Current Virus total detections 1/56*
.. MALWR** shows a download of Dridex banking Trojan from the same list of sites in THIS[1] post.
1] https://myonlinesecurity.co.uk/upcoming-payment-1-month-notice-js-malware-delivers-dridex/
.. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/fdc4df914b951a6f9740029a2e28865a4151d914137876e8a49902b20ef4ae50/analysis/1462497274/
** https://malwr.com/analysis/ZmVhZjIyMjZkOWNhNDllYjg4M2Y5M2JlYjc4NmI1Zjk/
Hosts
213.246.109.8
213.186.33.171
192.117.12.154
185.92.247.46
81.19.185.200
52.64.39.102
177.12.173.166
184.164.156.210
91.146.109.184
119.59.120.32
192.249.113.43
70.40.220.100
188.65.114.122
66.147.244.66
192.186.200.169
23.235.220.84
54.241.22.111
46.166.163.195
160.153.32.229
205.134.241.120
___
Fake '50 transactions' SPAM - JS malware delivers Locky
- https://myonlinesecurity.co.uk/i-have-attached-the-spreadsheet-contains-last-50-transaction-and-your-account-actual-balance-js-malware-delivers-locky/
6 May 2015 - "An email with the subject of 'Re: ' pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Helen Velazquez <VelazquezHelen20082@ sas-pt .com>
Date: Fri 06/05/2016 09:46
Subject: Re:
Attachment: spreadsheet_98B.zip
Good evening driver,
As promised, I have attached the spreadsheet contains last 50 transaction and your account actual balance.
Regards,
Helen Velazquez
6 May 2016: spreadsheet_98B.zip: Extracts to: transactions 11791799.js - Current Virus total detections 23/56*
.. MALWR doesn’t shows any downloads but a manual analysis gives me a download from
http ://girls.web-planet .su/hs93jaks (VirusTotal 3/55**).. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://www.virustotal.com/en/file/f6bbd8616a040cabb3690276915b010930cec24519feb2606d5d53598b7dab2a/analysis/1462525419/
TCP connections
185.22.67.108: https://www.virustotal.com/en/ip-address/185.22.67.108/information/
girls.web-planet .su: 217.107.34.231: https://www.virustotal.com/en/ip-address/217.107.34.231/information/
:fear::fear: :mad:
AplusWebMaster
2016-05-09, 17:51
FYI...
Fake KPN SPAM - CTB-Locker Ransomware
- https://blog.malwarebytes.org/cybercrime/2016/05/kpn-spam-results-in-ctb-locker-infection/
May 9, 2016 - "... an email claiming to be from KPN – a Dutch provider of internet, television, and phone – claiming an amount so high that it should raise questions or at least your blood pressure. We can safely assume that it is intended to peak the receivers curiosity enough to get them to click-one-of-the-links in the mail:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/mail.png
... The spam template is an exact replica of mail KPN sends out to clients. But the “From” address is “KPN-betaalafspraak[AT]kpn[DOT]com” where real ones should come from... The three links all point to the same web address www2[DOT]uebler-gmbh[DOT]de, which is a site that belongs to a German job coaching firm. We informed them of the fact that their site is being used for this, but haven’t heard back yet. We have also informed the Dutch provider KPN through the normal channels, which probably means we will only get an automated response. Clicking-the-links in the mail will result in the download of a zip file containing a file called “Factuur 00055783-63845853.PDF.exe” showing up with a PDF icon. This is a well-known trick to deceive users that have file extensions set to “Hide extensions for known file types” into thinking that they are about to open a (harmless) document... Double-clicking the file will result in the start of the CTB locker ransomware. It creates a copy of the executable with a different name (here hlbvlli.exe) in the %Temp% folder and the creation of a Scheduled Task that will trigger that copied file every time the compromised system boots... After encryption, users are presented with the below ransom note:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/CTBlocker.png
... these tricks as ransomware is becoming a bigger and more prevalent threat -every- day..."
www2[DOT]uebler-gmbh[DOT]de: 217.114.79.125: https://www.virustotal.com/en/ip-address/217.114.79.125/information/
>> https://www.virustotal.com/en/url/d741c84a9b667a2b0bd384e52b3035f4ca4351a13d5ba31de903c88e67c7a6db/analysis/
___
Fake 'IMPORTANT TRANSACTION' SPAM - delivers malware
- https://myonlinesecurity.co.uk/fwdimportant-transaction-sendout-review/
9 May 2016 - "An email that appears to come from Western Union with the subject of 'FWD:IMPORTANT TRANSACTION SENDOUT REVIEW' pretending to come from InternationalOperations@ ababank .com <spil@ tim .spil .co.id> with a zip attachment is another one from the current bot runs which delivers malware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/FWD-IMPORTANT-TRANSACTION-SENDOUT-1024x533.png
9 May 2016: Sendout-Transaction.zip: Extracts to: -2- identical files GRACE..jar and GRACE. MTCN9863521938- Copy.jar - Current Virus total detections 21/57*.. MALWR** ... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/305d5b846a2132c2a17d6f140e2ac312f41c98fcbf6eb456413419c5c3d6c79d/analysis/1462811540/
** https://malwr.com/analysis/ODkxZWZlYTlkNjZhNDQzY2I2ZjkzMmZlN2Q4ZTY3Njk/
___
Locky gets clever
- https://www.fireeye.com/blog/threat-research/2016/05/locky_gets_clever.html
May 9 2016 - "... Locky is aggressively distributed via a JavaScript-based downloader sent as an attachment in spam emails, and may have overshadowed the Dridex banking Trojan as the top spam contributor. FireEye Labs recently observed a new development in the way this ransomware communicates with its control server. Recent samples of Locky are once again being delivered via “Invoice”-related email campaigns, as seen in Figure 1.
1] https://www.fireeye.com/content/dam/fireeye-www/blog/images/Clever%20Locky%20Jain/Fig1.png
When the user runs the attached JavaScript, the JavaScript will attempt to download and execute the Locky ransomware payload from hxxp :// banketcentr .ru/v8usja. This new Locky variant was observed to be highly evasive in its network communication. It uses both symmetric and asymmetric encryption – unlike previous versions that use custom encoding – to communicate with its control server... Crimeware authors are constantly improving their malware. In this case, we see them evolving to protect their malware while maximizing its infection potential. Locky has moved from using simple encoding to obfuscate its network traffic to a complex encryption algorithm using hardware instructions that are very hard to crack. These types of advancements highlight the importance of remaining vigilant against suspicious emails and using advanced technologies to prevent infections..."
banketcentr .ru: 81.177.141.15: https://www.virustotal.com/en/ip-address/81.177.141.15/information/
>> https://www.virustotal.com/en/url/f87404b7a20c85c2a1203e839ec88927ebe8fb534445d85c92c645dc81e97324/analysis/
___
Malvertising Blogspot: Scams, Adult Content and EK's
- https://blog.malwarebytes.org/threat-analysis/2016/05/malvertising-on-blogspot-scams-adult-content-and-exploit-kits/
May 9, 2016 - "... malvertising can and does target free blogging platforms as well. Just this morning, our friends at Virus Bulletin Martijn Grooten and Adrian Luca wrote about some sites hosted on Google’s Blogspot service pushing tech support scams:
> https://www.virusbulletin.com/blog/2016/05/advertisements-blogspot-sites-lead-support-scam/
We also caught some malicious activity on the Blogger platform this past week via the PLYmedia ad network. Some Blogspot websites clearly abuse the platform and stuff ads everywhere:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/blogger_ads.png
When browsing that Blogspot site, we were automatically -redirected- to an adult page, which is definitely not good if you have kids around:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/match99.png
... There were also some -redirections- to the Angler-exploit-kit via -fake- advertisers using the fingerprinting technique:
Ad network: wafra.adk2x .com/ul_cb/imp?p=70368645&size=300×250&ct=html&ap=1300&u=http%3A%2F%2Fzcdnz.blogspot.com%2F2016%2F04%2Ffut-azteca13.html&r=http%3A%2F%2Fzcdnz.blogspot.com%2F2016%2F04%2Ffut-azteca13.html&iss=0&f=1
Rogue ad server: advertising.servometer .com/pagead/re136646/ad.jsp?click=%2F%2Fwafra.adk2x.com%2{redacted}
Google Open Referer: bid.g.doubleclick .net/xbbe/creative/click?r1=http%3A%2F%2Fstewelskoensinkeike.loanreview24.com%2FScKOygTMtj_rlf_qIEgRYCq.aspx
Angler EK landing: stewelskoensinkeike.loanreview24 .com/?k=pREU&o=gQ1U2eo&f=&t=MHl&b=O83rsW&g=&n=9rYB42&h=&j=aCYeE9iDym_Ao_T25Uhszm
... We have alerted Google about this issue and contacted PLYmedia to let them know about that rogue advertiser."
wafra.adk2x .com: 104.154.33.56
130.211.124.223
104.197.69.2
104.197.148.20
104.197.4.140
146.148.73.59
146.148.57.82
130.211.160.193
146.148.47.149
104.197.27.39
104.154.52.119
130.211.124.66
advertising.servometer .com: 51.255.17.36
stewelskoensinkeike.loanreview24 .com: Could not find an IP address for this domain name.
___
Hooplasearch and nt. hooplasearch .com Ads
- http://www.bleepingcomputer.com/virus-removal/remove-hooplasearch-ads
May 6, 2016 - "'Hoopla Search' is a browser hijacker program from the Adware.BrowseFox family that hijacks your browser's default search engine and installs addons and extensions that inject advertisements in web pages and search results. 'Hoopla Search' uses these addons or extensions to -inject- advertisements into the search results on search engines such as Google and Yahoo. When the extension is installed, it will also display its own Hoopla Search page instead of your default home page..."
(Removal instructions at the bleepingcomputer URL above.)
:fear::fear: :mad:
AplusWebMaster
2016-05-10, 13:19
FYI...
Fake 'Draft Receipt' SPAM - malicious doc attachment
- https://myonlinesecurity.co.uk/malware-yafie-group-redraft-receipt/
10 May 2016 - "An email pretending to be a receipt containing terrible spelling or typing mistakes with the subject of 'Re:Draft Receipt' pretending to come from Awad S.Yafie <yinengchem@ yeah .net> with a malicious word doc attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Draft-Receipt-1024x614.png
The malicious word doc shows a blurred image that contains an embedded OLE object that will drop and run a file if you are unwise enough to follow their suggestion to double click to see content:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Double-click-on-the-file-to-view-Properly-1024x535.png
10 May 2016: Draft-MSK-001.docx - Current Virus total detections 15/56*
.. MALWR** which contains an embedded OLE object ..Properly.exe (VirusTotal 21/56***).. MALWR[4]
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/09248b142b6cdfd6a8c7dcc914a4dc24bd99b0d6d71cd6d0c5f2809c9312d757/analysis/1462832094/
** https://malwr.com/analysis/NmM1YTQzMTc4MjdlNDIyYjhlODRhMThjYjNlOTNmM2I/
*** https://www.virustotal.com/en/file/5d1b36716066f0f2f011023d609552de5e9329185b05b326fdda87c9c9865c70/analysis/1462830481/
4] https://malwr.com/analysis/NWYyMTE1ZTUzMWRiNGUzMWIzZDk4MzU0OWIyNjY3ZTU/
___
Fake 'RE: ' SPAM - js malware downloads Locky
- https://myonlinesecurity.co.uk/malware-as-i-promised-the-information-you-requested-is-attached-leads-to-locky/
10 May 2016 - "An email with the subject of 'RE: ' pretending to come from random senders with a zip attachment is another one from the current bot runs... One of the emails looks like:
From: Therese Slater <SlaterTherese8877@ pldt .net>
Date: Tue 10/05/2016 09:42
Subject: RE:
Attachment: wire_xls_AA8.zip
hi rob,
As I promised, the information you requested is attached.
Regards,
Therese Slater
10 May 2016: wire_xls_AA8.zip: Extracts to: transactions 30248504.js - Current Virus total detections 5/57*
.. MALWR** shows a download of Locky ransomware from
http ://jediff .com/fgh7hd (VirusTotal 7/57***) MALWR[4]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/9bf098fe1b95575a49ddd60b7de28b91d5264acc3f1d82ef2d64cd0a0f541fde/analysis/1462870370/
** https://malwr.com/analysis/ODEwNGEwNTE1ZmFkNDVjMjhkOWYwMTExODY0ZWI4YzI/
Hosts
160.153.76.133: https://www.virustotal.com/en/ip-address/160.153.76.133/information/
>> https://www.virustotal.com/en/url/864449220e67ced6b4859b5b626686ba4073f6e71f0e2a522d334f1bab8b3f55/analysis/
185.82.202.170: https://www.virustotal.com/en/ip-address/185.82.202.170/information/
*** https://www.virustotal.com/en/file/6cc3187ae90efdd5a1ffe7379a073dded4b6efc09ec9433345c93a8a92d28771/analysis/1462871373/
4] https://malwr.com/analysis/NjY5OGI4MmMzZDRjNGE3MWE5ZjJkNWZiZTM4YTYyOTY/
Hosts
193.124.185.87: https://www.virustotal.com/en/ip-address/193.124.185.87/information/
jediff .com: 160.153.76.133
- http://blog.dynamoo.com/2016/05/malware-spam-as-promised-document-you.html
10 May 2016 - "This fairly brief spam has a malicious attachment:
From: Alexandra Nunez
Date: 10 May 2016 at 21:10
Subject: Re:
hi [redacted],
As promised, the document you requested is attached
Regards,
Alexandra Nunez
The name of the sender varies. Attached is a ZIP file with a name export_xls_nnn.zip or wire_xls_nnn.zip (where nnn are random letters and numbers) which contains multiple copies of the same malicious .js file (all apparently beginning urgent). These scripts download slightly different binaries from several locations including:
4hotdeals .com.au/j47sfe
stationerypoint .com.au/cnb3kjd
floranectar .com.au/er5tsd
togopp .com/vbg5gf
printjuce .com/rt5tdf
designitlikeal .com/cvb3ujd
There are probably many more download locations. The typical detection rate for these binaries is about 12/56 [1] [2]... and automated analysis [6] [7]... shows network traffic to:
5.34.183.40 (ITL, Ukraine)
185.82.202.170 (Host Sailor, United Arab Emirates / Romania)
185.14.28.51 (ITL, Netherlands)
92.222.71.26 (OVH, France)
88.214.236.11 (Overoptic Systems, UK / Russia)
The payload is Locky ransomware
Recommended blocklist:
5.34.183.40
185.82.202.170
185.14.28.51
92.222.71.26
88.214.236.11 "
1] https://www.virustotal.com/en/file/c6960c64bcec5dd39190d65c0eaa7b98df06c99f8ebf7da200c89aa66f7846ba/analysis/
TCP connections
92.222.71.26
2] https://www.virustotal.com/en/file/989dc958a3ebcfc25bf0d01e0cb0bc5e99dbfb5ca5d646ff5be4a5b34169c5a5/analysis/
TCP connections
185.82.202.170
6] https://malwr.com/analysis/ZGU3YjYxNjcwNGVmNGE2ZDllYjUxNjc1N2Q1NjkzZTY/
Hosts
185.82.202.170
7] https://malwr.com/analysis/NGY1YzE1MDdiYjJmNDdkOWIxZDRlMzdmMGM0ZTIyZDU/
Hosts
185.14.28.51
___
Fake 'credit card statement' SPAM - malicious attachment leads to Locky
- https://myonlinesecurity.co.uk/malware-please-find-your-monthly-credit-card-statement-attached-to-this-e-mail/
10 May 2016 - "An email with the subject of 'FW: 'pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads what looks like Dridex banking Trojan...
Update: according to Payload Security[6] the dropped malware is Locky...
This set of emails has a zip attachment that extracts to an HTA file which is an Internet explorer specific scripting file wrapped inside a standard HTML file that the browser runs. It probably can run however in Chrome, Firefox and any other browser in use. This HTA file is -obscufated- and encodes a long list of malware URLs inside it... One of the emails looks like:
From: Roselia Bellgrove <BellgroveRoselia914@ digicable .in>
Date: Tue 10/05/2016 10:05
Subject: FW:
Attachment: bruxner_copy_873488.zip
Please find your monthly credit card statement attached to this e-mail.
We would also like to let you know that your negative balance has reached a maximum limit.
10 May2016: bruxner_copy_873488.zip: Extracts to: details_v35xnsfc24.hta - Current Virus total detections 0/57*
.. MALWR** doesn’t show any downloads BUT JSUnpack[3] gives me the list of download locations, some of which are live and some are not responding, giving me 403 errors (VirusTotal 2/57[4]) MALWR[5]...
sky-hero .com/ad.exe - 213.186.33.171
buyemergencylight .com/ad.exe - 192.117.12.154
ribastiendaonline .com/ad.exe - 185.92.247.46
clearancezone .com.au/ad.exe - 184.164.156.210
zanvair .co.uk/ad.exe - 82.165.151.207
myfashionfavourites .com/ad.exe - 185.66.171.8
anustyle .co.uk/ad.exe - 46.30.212.102
metersdirect .com.au/ad.exe - 52.64.39.102
atlfitness .com.br/ad.exe - 179.107.83.250
shopnutri .com.br/ad.exe - 177.12.173.166
homesdreams .com/ad.exe - 188.40.28.173
liftmaxthailand .com/ad.exe - 119.59.120.32
new-exhibitions.heckfordclients .co.uk/ad.exe - 95.142.152.194
airconditioning-outlet .co.uk/ad.exe - 87.106.53.6
shoppingsin .com/ad.exe - 142.4.49.157
magnumautomotivo .com.br/ad.exe - 186.202.153.10
melodyderm .com/ad.exe - 23.235.196.128
metersdirect .com.au:80/ad.exe - 52.64.39.102
outletsmarcas .com/ad.exe - 67.20.76.133
shoesmackers .com/ad.exe - 74.220.207.142
store.pinkupcape .com/ad.exe - 67.231.106.60
vizyt-shop .com/ad.exe - 136.243.204.62
warehousestudiochicago .com/ad.exe - 166.62.10.30
mikronjoalheria .com.br/ad.exe - 162.213.193.150
getdattee .com/ad.exe - 50.63.119.14
videale .com.br/ad.exe —– 403 error / 186.202.126.233
pgkdistribution .co.uk/ad.exe - 160.153.50.192
aw-store .com/ad.exe - 160.153.33.104
gmdengineering .com.au/ad.exe - 103.38.10.109
lyintl .com/ad.exe - 23.229.242.166
fashionpoppers .com/ad.exe - 66.147.244.66
cenasuniformes .com.br/ad.exe - 200.98.197.36
merlindistribuidora .com.br/ad.exe - 186.202.153.108
.. This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/e2162d8cfd1e9b12446485ee46a1c89e54096ba052bac4673194dd70e393a236/analysis/1462871863/
** https://malwr.com/analysis/OWE3ODYzYjQ0MGVlNDlmZGE0NGVkZWY4NGRlY2UwYzU/
3] http://jsunpack.jeek.org/?report=9d67b3803d41c32d92807c7f92e81e80a5f0df22
4] https://www.virustotal.com/en/file/50e36b0de919812ceff89f5b3efff70c83d607b00aa0c214352c52e4f83ba344/analysis/1462872640/
5] https://malwr.com/analysis/ZTM4Y2NlMWNhZjExNGZjNmJiOTVjNDQxMWY1NjA2ZDA/
6] https://www.hybrid-analysis.com/sample/50e36b0de919812ceff89f5b3efff70c83d607b00aa0c214352c52e4f83ba344?environmentId=100
Contacted Hosts
217.12.199.94: https://www.virustotal.com/en/ip-address/217.12.199.94/information/
>> https://www.virustotal.com/en/url/14fc27f764fc3f1bc9a6d2b3dbb6adc63aa7aa2eb6d659b7610671fdf5b70ebe/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-05-11, 14:20
FYI...
Fake 'Emailing: Photo' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spam-malware-emailing-photo-05-11-2016-82-95-82-delivers-locky/
11 May 2016 - "An email with the subject of 'Emailing: Photo 05-11-2016, 82 95 82' [random numbers] pretending to come from Your-own-email-address with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... One of the emails looks like:
From: your own email address
Date: Wed 11/05/2016 10:10
Subject: Emailing: Photo 05-11-2016, 82 95 82
Attachment: Photo 05-11-2016, 82 95 82.zip
Your message is ready to be sent with the following file or link
attachments:
Photo 05-11-2016, 82 95 82
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
11 May 2016: Photo 05-11-2016, 82 95 82.zip: Extracts to: Photo 05-11-2016, 42 11 82.js
Current Virus total detections 2/56* | Hybrid analysis** | MALWR*** shows a download of Locky ransomware from
http ://gesdes .com/87yg7yyb (VirusTotal 5/57[4]) MALWR... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC / PDF / JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/be64d99368f70dbe0b59ae9938c96817a428e4b9757583489f17f5a84008bc1b/analysis/1462957811/
** https://www.hybrid-analysis.com/sample/be64d99368f70dbe0b59ae9938c96817a428e4b9757583489f17f5a84008bc1b?environmentId=100
Contacted Hosts
23.229.156.225
88.214.236.11
5.34.183.40
*** https://malwr.com/analysis/YWYwNmEzNmM3YTc2NDVmYTk1OTIwNmI0YTE1M2NhNjQ/
Hosts
23.229.156.225
4] https://www.virustotal.com/en/file/5a7b26907e84d4137fd153e3b0f6a7b6565a6d68ce081c4b627ec5d70b0285c6/analysis/1462958159/
5] https://malwr.com/analysis/YzkzOWNkNWZkNmI4NGIzNWI2ODJhOWE5MjJhN2NkY2I/
gesdes .com: 23.229.156.225: https://www.virustotal.com/en/ip-address/23.229.156.225/information/
>> https://www.virustotal.com/en/url/914b4d0f8dbd9ec275f2386963d51a8fa927cd693e9e02df6e079837675c8232/analysis/
- http://blog.dynamoo.com/2016/05/malware-spam-emailing-photo-05-11-2016.html
11 May 2016 - "This spam comes with a malicious attachment:
From: victim@ victimdomain .tld
To: victim@ victimdomain .tld
Date: 11 May 2016 at 12:39
Subject: Emailing: Photo 05-11-2016, 03 26 04
Your message is ready to be sent with the following file or link
attachments:
Photo 05-11-2016, 03 26 04
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
It appears to come from the sender's own email address, but this is a simple forgery (explained here*). Attached is a ZIP file with a name similar to Photo 05-11-2016, 03 26 04.zip (the numbers in the attachment
match the references in the email). It contains a .js file with a similar name.
* http://blog.dynamoo.com/2011/09/why-am-i-sending-myself-spam.html
Trusted third-party analysis (thank you!) shows the various scripts downloading from:
51941656 .de.strato-hosting .eu/87yg7yyb
67.222.43.30 /87yg7yyb
developinghands .com/87yg7yyb
gesdes .com/87yg7yyb
helpcomm .com/87yg7yyb
neihan8 .tk/87yg7yyb
oldtimerfreunde-pfinztal .de/87yg7yyb
otakutamashi .cl/87yg7yyb
sarikamisotelleri .com/87yg7yyb
This drops a file with a detection rate of 3/56*. This is likely to be Locky ransomware, a full analysis is pending. However an earlier Locky campaign today phoned home to:
185.82.202.170 (Host Sailor, United Arab Emirates)
88.214.236.11 (Overoptic Systems, UK / Russia)
5.34.183.40 (ITL, Ukraine)
According to a DeepViz report**, this sample has identical characteristics.
Recommended blocklist:
185.82.202.170
88.214.236.11
5.34.183.40 "
* https://www.virustotal.com/en/file/b1078a90d01f3b44dc11f169362688964c7cbef72dee46db6d4fa446c5301e54/analysis/1462969284/
** https://sandbox.deepviz.com/report/hash/fdfe7c2af22ed79bc585990d77a918a7/
___
Fake 'attached document' SPAM - JS attachment leads to malware
- https://myonlinesecurity.co.uk/spam-malware-random-subjects-you-may-refer-to-the-attached-document-for-details-delivers-locky/
11 May 2016 - "A series of emails with random subjects pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs... UPDATE: none of the automatic analysers are actually showing Locky, so it might be Dridex... Some of the subjects seen include:
Re: employees
Re: paychecks
Re: other names
Re: company
Re: Items
Re: build assemblies
Re: transfers
Re: credit memos
Re: checks
Re: estimates
Re: Chart of Accounts
Re: receive payments
Re: credit card charges
Re: item receipts
Re: Vendors ...
One of the emails looks like:
From: Nelda Morton <MortonNelda80048@ static .vnpt.vn>
Date: Wed 11/05/2016 10:34
Subject: Re: employees
Attachment:
hello [ recipients name]
You may refer to the attached document for details.
Regards,
Nelda Morton
11 May 2016: vendors_0A591E.zip: Extracts to: -3- identical .js files - urgent 802194.js
Current Virus total detections 4/57* | Payload Security** | MALWR*** shows a download of Locky Ransomware from
http ://compfixuk .co.uk/uy3hds (VirusTotal 11/57[4]) MALWR | Payload Security[6]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC / PDF / JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/69f9750b2716c936b420436b2d586228acbe22d3b4c594094401ba207e2018fa/analysis/1462960440/
** https://www.hybrid-analysis.com/sample/69f9750b2716c936b420436b2d586228acbe22d3b4c594094401ba207e2018fa?environmentId=100
Contacted Hosts
185.14.28.51
88.214.236.11
185.82.202.170
*** https://malwr.com/analysis/OWJmYWMxMTU1NGNjNGI3ZmE4NWY2YjJmMjE3MWU4YWE/
Hosts
81.201.141.119
92.222.71.26
4] https://www.virustotal.com/en/file/5d59e544d6c62d19f848b286804c55715c1e4166d9f4cff02b288bbebf55e7c1/analysis/1462960706/
5] https://malwr.com/analysis/OGVmOWM2ZTU0ZmVlNDk3YmE0NThmMWIyMTUyNGFlNmQ/
Hosts
185.14.28.51
88.214.236.11
6] https://www.hybrid-analysis.com/sample/5d59e544d6c62d19f848b286804c55715c1e4166d9f4cff02b288bbebf55e7c1?environmentId=100
Contacted Hosts
92.222.71.26
compfixuk .co.uk: 81.201.141.119: https://www.virustotal.com/en/ip-address/81.201.141.119/information/
>> https://www.virustotal.com/en/url/e48ef78bd294ec74e6c36c4d21933d76b3b7e3c8392f681db86097ddbd0056fb/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-05-12, 12:18
FYI...
Fake 'application' SPAM - JS malware attachment
- https://myonlinesecurity.co.uk/spam-malware-we-have-reviewed-your-application/
12 May 2016 - "Another email with the subject of 'FW: ' pretending to come from random senders with a zip attachment is another one from the current bot runs... One of the emails looks like:
From: Fannie Strickland <StricklandFannie70829@ hostviper .in>
Date: Thu 12/05/2016 00:37
Subject: FW:
Attachment: xerox.device1_copy_885254.zip
We have reviewed your application #885254 and would like to let you know that some imporant information is missing. Please, review the file attached and complete the highlighted parts to finalize the application process.
12 May 2016: xerox.device1_copy_885254.zip: Extracts to: confirm_bpwmj.js - Current Virus total detections 6/57*
.. MALWR** shows a download from
http ://panthai .com.br/NtJx6X (VirusTotal 5/57***) MALWR[4] | Payload Security[5]
Other sites found include: http ://festlanddesign .com/qcinTX but it looks like this particular Dridex malspam run drops multiple different file # as well as random file names... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC / PDF / JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/4e8c6e5b8cceec46ca03ea8cd12d1eeef55b5864a20c05c05e63ac3fbd5b5f91/analysis/1463028499/
** https://malwr.com/analysis/YjJmZDE4NzA4ZDM2NDgxYThiZjU3NDkwMDQ3NzBkYjk/
Hosts
200.98.201.219
*** https://www.virustotal.com/en/file/c2be66e3a3f64d3e4d9c9b4edeabae146b38a5da665a7eabc9fcf7adf1b6ff44/analysis/1463012592/
4] https://malwr.com/analysis/ZTk5ZTVhYzQwMmNkNDA1ZWE4YjUwZmVhN2JmMzcyNWY/
5] https://www.hybrid-analysis.com/sample/c2be66e3a3f64d3e4d9c9b4edeabae146b38a5da665a7eabc9fcf7adf1b6ff44?environmentId=100
Contacted Hosts
24.199.222.250
213.192.1.171
188.120.253.193
162.251.84.219
panthai .com.br: 200.98.201.219: https://www.virustotal.com/en/ip-address/200.98.201.219/information/
>> https://www.virustotal.com/en/url/d1178f23ec2432ec2514e74e21c6dbc4fe51f2e513bfb47fdf3335615f4a6d6e/analysis/
festlanddesign .com: 176.28.36.108: https://www.virustotal.com/en/ip-address/176.28.36.108/information/
>> https://www.virustotal.com/en/url/2a48cd6114587d822dd77e1c9ae161cb1a2b50106ecbce5abcc840fe67663e6b/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-05-13, 17:50
FYI...
Separate 0-day vulns under attack
- http://arstechnica.com/security/2016/05/beware-of-in-the-wild-0day-attacks-exploiting-windows-and-flash/
5/10/2016 - "... something that doesn't happen every day: the disclosure of -two- zero-day vulnerabilities, one in the Microsoft operating system[1] and the other in Adobe's Flash Player[2]. The Windows bug is being actively exploited in the wild, making it imperative that users install fixes that Microsoft released today as part of its May Patch Tuesday. Cataloged as CVE-2016-0189*, the security flaw allows attackers to surreptitiously execute malicious code when vulnerable computers visit booby-trapped websites...
* https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0189
Last revised: 05/11/2016 - '... Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site...'
7.6 HIGH
... Separately, Adobe officials warned that a newly discovered Flash** vulnerability also gives attackers the ability to remotely hijack machines. It was first reported by researchers from security firm FireEye, and exploits exist in the wild...
** https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4117
Last revised: 05/13/2016 - '... Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016...'
10.0 HIGH
... in-the-wild attacks reported by Symantec[3]... FireEye published a blog post[4]... that described how attackers managed to infect-more-than-100-organizations in North America using a zero-day vulnerability. The bug, however, was CVE-2016-0167, a privilege escalation flaw that Microsoft fixed*** in -last- month's Patch Tuesday..."
*** https://technet.microsoft.com/en-us/library/security/ms16-039.aspx
1] http://technet.microsoft.com/security/bulletin/MS16-051
May 10, 2016
- https://technet.microsoft.com/library/security/ms16-053
May 10, 2016 - Applies to:
Windows Server 2008 R2 Service Pack 1
Windows Server 2008 Service Pack 2
Windows Vista Service Pack 2
2] https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
May 12, 2016
3] http://www.symantec.com/connect/blogs/internet-explorer-zero-day-exploit-used-targeted-attacks-south-korea
10 May 2016
4] https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html
May 11, 2016
___
Tech Support Imposters ...
- https://blog.malwarebytes.org/cybercrime/2016/05/draft-tech-support-imposters-part-ii-where-are-they-now/
May 13, 2016 - "... Fraud is still fraud, no matter how long your disclaimer is. Takedowns have been sent, and Malwarebytes will continue to monitor for the next time this group tries again. For more information on what you should know about tech support scammers to defend yourself, please check out the article here."
> https://blog.malwarebytes.org/tech-support-scams/
:fear::fear: :mad:
AplusWebMaster
2016-05-16, 13:30
FYI...
Fake 'Attached Picture' SPAM - attachment leads to malware
- https://myonlinesecurity.co.uk/spam-malware-attached-picture-from-scanner-copier-at-your-own-email-address/
16 May 2016 - "Another empty-blank-email email with the subject of 'Attached Picture' pretending to come from copier/scanner/[random numbers] @ your-own-email-address with a zip attachment is another one from the current bot runs which downloads what is likely to be Dridex... One of the emails looks like:
From: copier [random numbers] @ your own email address
Date: Mon, 16 May 2016 10:05:40
Subject: Attached Picture
Attachment: mandy@ ... _0779_436592056.zip
Body content: Blank/Empty
11 May 2016: Current Virus total detections 23/56* - MALWR** shows a download of an -unknown- malware from
http ://www.puertasjoaquin .com/987t5t7g?VOoIYjOJwN=BpMuEo (VirusTotal 2/57***) MALWR[4] | Payload Security
None of the auto analysers are able to give a definite result as to what the malware is. It is more likely to be Dridex banking Trojan rather than Locky ransomware, when this happens... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://malwr.com/analysis/Y2M1NGNmOGJlNjk1NDliNDlkNWQzNzRkZTNhNDc5MzY/
Hosts
81.88.48.79
*** https://www.virustotal.com/en/file/eb8487e4c7cc0d2d7c89db208502fd943e1b3256f4b7121814deae399466157d/analysis/1463394033/
4] https://malwr.com/analysis/ODkwM2E4ZmM4ZDc3NDFjMTlhODA4MDYxODFkMTUyMTE/
5] https://www.hybrid-analysis.com/sample/eb8487e4c7cc0d2d7c89db208502fd943e1b3256f4b7121814deae399466157d?environmentId=100
puertasjoaquin .com: 81.88.48.79: https://www.virustotal.com/en/ip-address/81.88.48.79/information/
>> https://www.virustotal.com/en/url/6eed6f6865ae4c014d9fd548cd578d12300224b4523557af634ec2134988f547/analysis/
___
Fake 'spreadsheet' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/05/malware-spam-i-have-attached-revised.html
16 May 2016 - "This spam has a malicious attachment:
From: Britney Hart
Date: 16 May 2016 at 13:15
Subject: Re:
hi [redacted]
I have attached a revised spreadsheet contains customers. Please check if it's correct
Regards,
Britney Hart
Other variations of the body text seen so far:
I have attached a revised spreadsheet contains general journal entries. Please check if it's correct
I have attached a revised spreadsheet contains estimates. Please check if it's correct
Attached is a ZIP file with three identical malicious .js files. The ones I have seen so far download from
fundaciontehuelche .com.ar/897kjht4g34
thetestserver .net/fg45g4g
technobuz .com/876jh5g4g4
There are probably other download locations. Each one downloads a slightly different binary (VirusTotal prognosis [1] [2]..) and automated analysis [5] [6].. shows the malware phoning home to:
188.127.231.124 (SmartApe, Russia)
31.184.197.72 (Petersburg Internet Network, Russia)
92.222.71.26 (RunAbove / OVH, France)
149.202.109.202 (Evgenij Rusachenko aka lite-host.in, Russia / OVH, France)
The payload is Locky ransomware.
Recommended blocklist:
188.127.231.124
31.184.197.72
92.222.71.26
149.202.109.202 "
1] https://www.virustotal.com/en/file/745fe43090b518bf442124a001b023d17dda1ede61d5a494a663c318fd5d5c9c/analysis/1463401158/
2] https://www.virustotal.com/en/file/a4ba7d3816be61916946dbb2ce190658b6983c8e3cd0110ab3ac5bec569abf02/analysis/1463401746/
5] https://malwr.com/analysis/ZjhlNGNjMjQyMDZkNGJiODk2NTlkMWIzZjIxNjgyYmY/
6] https://malwr.com/analysis/Zjc1MWFhNmJmOTk0NDU5ZGJmMWFjYWFmMDY3MTU5MjY/
___
Fake 'Anti-Fraud' SPAM - delivers Locky ransomware
- https://myonlinesecurity.co.uk/spam-malware-anti-fraud-system-332571-delivers-locky/
16 May 2016 - "An email that pretends to alert you to strange activity on your credit card, with the subject of 'Anti-Fraud System-332571' [random numbered] pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Mirabel Orton <OrtonMirabel31@ une .net.co>
Date: Mon 16/05/2016 17:10
Subject: Anti-Fraud System-332571
Attachment: bruxner_data_332571.zip
We have noticed a strange activity. Please, confirm the transaction made from your card and listed in the document attached.
16 May 2016: bruxner_data_332571.zip: Extracts to: post_scan_rhgzp.js - Current Virus total detections 23/56*
.. MALWR** shows a download of Locky ransomware from
http ://steeldrill .com.au/Cs0St6.exe (VirusTotal 6/57***) MALWR[4] | Payload Security... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/ PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://malwr.com/analysis/M2ZlYjk2M2M4YmRiNDc5NTg3Y2I4YWIxODc0ZjFjY2U/
Hosts
203.143.85.203
*** https://www.virustotal.com/en/file/ecbbf4895ccf028a1590f18ba76653f0c30ef8427b43deea6cd18d4ed92e7e43/analysis/1463415891/
4] https://malwr.com/analysis/YWQ0Nzg4ODhiZTIyNDdjZGJiZDBkY2VlNzM3ZDZkY2E/
5] https://www.hybrid-analysis.com/sample/ecbbf4895ccf028a1590f18ba76653f0c30ef8427b43deea6cd18d4ed92e7e43?environmentId=100
Contacted Hosts
217.12.199.151: https://www.virustotal.com/en/ip-address/217.12.199.151/information/
>> https://www.virustotal.com/en/url/5e39b1995c3d9e300053ab9c09bc7cbdd137795e7541ada3dae28c3474d3e18e/analysis/
steeldrill .com.au: 203.143.85.203: https://www.virustotal.com/en/ip-address/203.143.85.203/information/
>> https://www.virustotal.com/en/url/f55199e2bdc86fa0bce9b3f59f6d23258f534d7d26fada3218dfc5f057626b0e/analysis/
___
Fake 'Security report' SPAM - malicious attachment
- https://myonlinesecurity.co.uk/spam-malware-security-report/
16 May 2016 - "An email with the subject of 'Security report' pretending to come from random senders with a zip attachment is another one from the current bot runs... Looks like Locky... One of the emails looks like:
From: Gwennie Patron <PatronGwennie32083@ babygate .net>
Date: Mon 16/05/2016 18:55
Subject: Security report
Attachment:
Hello ,due to the technical problems associated with our security system, we kindly ask our customers to review the recent report in order to approve your last transactions. Thanks
16 May 2016: securityx062CBD2.zip: Extracts to: data_xe2q2mizervx.js - Current Virus total detections 2/57*
.. Payload security** shows a download from one of these 3 locations
mantisputters .com/s7LUXu.exe | blueoxaladdin .com/pArFOY.exe | produtosvivabem .com.br/51aIMi.exe
(VirusTotal 3/57[3]) MALWR[4] | Payload Security [5]... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/3bb0f268469531fa219c303c4594f517146401189f2846ce71e533ec75f89758/analysis/1463421357/
** https://www.hybrid-analysis.com/sample/3bb0f268469531fa219c303c4594f517146401189f2846ce71e533ec75f89758?environmentId=100
Contacted Hosts
52.4.223.98
65.23.141.248
186.202.59.80
3] https://www.virustotal.com/en/file/0152fd5a987c1f56b8437d014d6cda66ef8074f837a00e6fc2a73e61fbb499fa/analysis/1463422004/
4] https://malwr.com/analysis/OTY2M2VlZTIxNzQyNDU2NDllNWEzMTlkMmJhZmUyNTc/
5] https://www.hybrid-analysis.com/sample/0152fd5a987c1f56b8437d014d6cda66ef8074f837a00e6fc2a73e61fbb499fa?environmentId=100
mantisputters .com: 52.4.223.98: https://www.virustotal.com/en/ip-address/52.4.223.98/information/
>> https://www.virustotal.com/en/url/16c45d909a9286bc57c76bddd13a59d90147d070c1ba461e968c53bd5a6242e0/analysis/
blueoxaladdin .com: 65.23.141.248: https://www.virustotal.com/en/ip-address/65.23.141.248/information/
>> https://www.virustotal.com/en/url/fdb8c468dc7d79f490bb628beda808e655eed77b85d084d7739c49f1afb198f2/analysis/
produtosvivabem .com.br: 186.202.59.80: https://www.virustotal.com/en/ip-address/186.202.59.80/information/
___
Lloyds bank - Phish
- https://myonlinesecurity.co.uk/why-phishing-works-so-well/
16 May 2016 - "... the phishers use domain names that are so believable and the registrars allow them to register the domains...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/lloyds_phish-1024x786.png
The link in the email goes to http ://bank-update .com/personal/logon/ ... It even has the Lloyds bank icon in url bar. All they needed to do to make it 100% believable was either add a cheap or free SSL certificate or use a padlock symbol as an icon instead of the Lloyds black horse icon:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/lloyds_bank_update-1024x588.png
This asks you for your user name & password and then 3 characters from your secret information ( as does the genuine Lloyds bank) then full secret information and phone number, then secret information, phone number and password, then -bounces- you to genuine Lloyds bank site."
bank-update .com: 66.225.198.23: https://www.virustotal.com/en/ip-address/66.225.198.23/information/
>> https://www.virustotal.com/en/url/a51889d3f39a2ac642359998857d35be77fac616bd6b8f2fd759f1d670cfe67b/analysis/
104.128.234.224: https://www.virustotal.com/en/ip-address/104.128.234.224/information/
>> https://www.virustotal.com/en/url/e6d8d6db660960d315799a2cffa20ec2ed98e3b43cfbde4417a5fef598101bb4/analysis/
___
Capital One - Phish
- https://myonlinesecurity.co.uk/phishing-e-payment-alert-on-your-account-capital-one-360/
16 May 2016 - "... more difficult to detect phishing attempt this time... Many card companies and banks do send PDF files as attachments with credit card statements. Some no doubt will have links to the bank website. Starts with a Blank email.
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/capital_one_pdf.png
The link in the PDF goes to http ://demelos .com.au/classes/commons/config/actionnn.htm which sends you on to http ://https-secure-capitalone360 .com-myaccount-banking.demelos .com.au/e8ea76f546cb0ea35cc83e95d7ae37eb/
where you see this webpage and it goes on to atypical phishing page asking for loads of personal & private details that compromise you completely.":
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/capital_one_web_phish-1024x656.png
demelos .com.au: 27.121.64.122: https://www.virustotal.com/en/ip-address/27.121.64.122/information/
>> https://www.virustotal.com/en/url/e1630c8deb59fc83727ec4250224de64ad22bdd26bcdde62cdfc344ce707858b/analysis/
>> https://www.virustotal.com/en/url/d78f043e11e6267abdb9539784232fd7e74e7852073a0cda34df500741e20e77/analysis/
___
The Million-Machine 'Clickfraud' Botnet
- http://www.computerworld.com/article/3071007/security/an-https-hijacking-click-fraud-botnet-now-infects-almost-1m-computers.html
May 16, 2016 - "... The click-fraud botnet earns its creators money through Google's AdSense for Search program, according to researchers from security firm Bitdefender*. The affiliate program, intended for website owners, allows them to place a Google-powered custom search engine on their websites to generate revenue when users click on ads displayed in the search results... Strategies have changed dramatically in the past few years, with new approaches... this botnet's operators -intercept- Google, Bing, and Yahoo searches performed by users on their own computers and replace the legitimate results with those generated by their custom search engine. They do this using a malware program that Bitdefender products detect as Redirector.Paco. Since mid-September 2014, Redirector.Paco has infected more than 900,000 computers worldwide, mainly from India, Malaysia, Greece, the U.S., Italy, Pakistan, Brazil, and Algeria, the Bitdefender researchers said in a blog post Monday*..."
* https://labs.bitdefender.com/2016/05/inside-the-million-machine-clickfraud-botnet/
:fear::fear: :mad:
AplusWebMaster
2016-05-17, 14:35
FYI...
Fake Multiple subjects SPAM - attachments delivering Locky ransomware
- https://myonlinesecurity.co.uk/spam-malware-multiple-subjects-and-attachments-all-delivering-locky-ransomware/
17 May 2016 - "... Locky ransomware emails overnight with varying subjects all pretending to come from random senders with either zip attachments or word doc macro attachments... Some of the subjects seen include:
Your .pdf document is attached
Re:
Hedy Castaneda
Dara Keith
The word doc ones have a subject that matches the alleged sender. One of the emails with a word doc attachment looks like:
From: Dara Keith <admin@ hk-mst .com>
Date: Tue 17/05/2016 04:49
Subject: Dara Keith
Attachment: 706-d4390-lncnvy.dotm
Hello
Please find the report attached to this message. The Payment should appear in 1-2 days.
Dara Keith
Alternative body content
Please review the report attached to this email. The Transfer will be posted within one day.
Best regards
17 May 2016: 706-d4390-lncnvy.dotm - Current Virus total detections 2/57* 2/56[1] 2/57[2].. MALWR [a] .. doesn’t show any downloads. It is likely that the download sites will match the other Locky downloaders using zip attachments. I am waiting for full analysis...
Update: finally got an analysis from Payload security[7] of 1 of the word doc files which shows a download from
xlstrategy .com/ch.jpg?Ux=43 which is a genuine jpg, however the jpg contains malware -embedded- inside it, which is extracted via the malicious-macro and a VBS file that the macro creates (VirusTotal 4/57[8]). This actually is Dridex banking trojan not Locky.
7] https://www.hybrid-analysis.com/sample/5c94f471964adb898a65a3f0b89ad024d917d6a8f25394106acb3c8cae2e0d06?environmentId=100
Contacted Hosts
107.180.20.71: https://www.virustotal.com/en/ip-address/107.180.20.71/information/
>> https://www.virustotal.com/en/url/2b13affdc489aae70b7bd441f06552d71a05934e67480f1acf4f1e8034545ac2/analysis/
8] https://www.virustotal.com/en/file/5962c039820c882e22dac13f9ea74c1763f8c7a95cf3be69902379506385e7f2/analysis/1463492903/
* https://www.virustotal.com/en/file/dc3ce138adb045236730ed96a803146d3e1faa5cb29b7263708bb58805b21fc9/analysis/1463461891/
1] https://www.virustotal.com/en/file/d67955f0fe678e1ec94f7f0c02dfd0a5a2f9ea20794ae37b45d788cf2b18ea8e/analysis/1463467476/
2] https://www.virustotal.com/en/file/35d9a84aeab92f36421e8397fa3d3345da557705e085f51ab518f3d7e2dfbf68/analysis/1463467521/
a] https://malwr.com/analysis/MzQwN2Y1MDI1YTNjNDc0ZWEwOWU4YjE1M2UxMTAyOWY/
b1] https://malwr.com/analysis/MGE2MjA1ZjcxY2U3NGY0ODhjMTRhZmFlNDc3OWM2ZDQ/
One of the emails with a zip attachment looks like:
From: Your own email address
Date: Tue 17/05/2016 01:38
Subject: Your .pdf document is attached
Attachment: D948699.zip
Body content: Blank/Empty email body
17 May 2016: D948699.zip: extracts to 20160516_38064087_27108995.js - Current Virus total detections 9/57[3]
.. downloads from hrlpk .com/7834hnf34?XrkJSbPOxS=klrLzHBbOX (VirusTotal 11/56[4])
3] https://www.virustotal.com/en/file/6e995acac1720a3edb1f452f530f1415e66a64e238ae15bf50fed478bc69bced/analysis/1463459479/
4] https://www.virustotal.com/en/file/d2c0135e66b71454d1ab8c5bfbaefa5565a68335e8f833dc7ce603ebf6782048/analysis/1463457732/
TCP connections
217.12.199.151: https://www.virustotal.com/en/ip-address/217.12.199.151/information/
hrlpk .com: 203.124.43.226: https://www.virustotal.com/en/ip-address/203.124.43.226/information/
>> https://www.virustotal.com/en/url/431c22066f385ca7accfea29a4a3e2f3bbe3e3a420c62da6af51222af3e33020/analysis/
Another one of the emails with a zip attachment looks like:
From: Ryan Solomon <SolomonRyan332@ cparsons .net>
Date: Tue 17/05/2016 01:42
Subject: Re:
Attachment: sales orders_BEA6B3A2.zip
hi vbygry
Please refer to the attached document contains sales orders
Let me know if it’s correct
Regards,
Ryan Solomon
17 May 2016: sales orders_BEA6B3A2.zip: extracts to history 8426558.js - Current Virus total detections 6/57[5]
.. downloads from http ://fundacionbraun .com/gh567jj56 (VirusTotal 11/57[6]) The zip attachment here contains 3 identical copies of the .js file all padded with loads of //// to confuse analysis and make them look much bigger than they are...
5] https://www.virustotal.com/en/file/5f71d2c776cd5a42c10dbe0ccc7b764c853d862f6a476accd63203b7f009ee26/analysis/1463462139/
6] https://www.virustotal.com/en/file/db5142820ee3dc7c8a8da2b91183b73b0f01551461d6fbe6d422b24dca6ab6ff/analysis/1463447956/
TCP connections
188.127.231.124: https://www.virustotal.com/en/ip-address/188.127.231.124/information/
fundacionbraun .com: 209.126.254.163: https://www.virustotal.com/en/ip-address/209.126.254.163/information/
>> https://www.virustotal.com/en/url/aecaaafcd225113fc8ef6505b78c3207cc0df1aa02a549c52b788155f68b5ac4/analysis/
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
___
[b]Fake 'car booking' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spam-malware-thank-you-for-booking-you-car-with-us-delivers-locky/
17 May 2016 - "... an email with the subject of 'FW: ' pretending to be a notification of a car booking and also pretending to come from random senders with a zip attachment containing a nemucod javascript downloader is also another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Jo-Ann Crowe <CroweJo-Ann0223@ londonrelax .co.uk>
Date: Tue 17/05/2016 07:54
Subject: FW:
Attachment: copy-20160517122213.zip
Thank you for booking you car with us, we hope you enjoy our service. Rental agreement is enclosed to this e-mail.
17 May 2016: copy-20160517122213.zip: Extracts to: data_vevbypapxx.js - Current Virus total detections 4/57*
.. MALWR** shows a download of Locky ransomware from
http ://myfloralkart .com/MwtBk1.exe (VirusTotal 21/56***).... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/227ff31786e35049f257d63bff7e58cecd3230110bf853390d0bb51a724c086b/analysis/1463468058/
** https://malwr.com/analysis/ODhmNDNmYmNiMDNjNGVlMTg5NTRlNjQ5MDc4NWY4ZmM/
Hosts
198.57.205.1: https://www.virustotal.com/en/ip-address/198.57.205.1/information/
128.199.120.158
176.58.99.126: https://www.virustotal.com/en/ip-address/176.58.99.126/information/
*** https://www.virustotal.com/en/file/0152fd5a987c1f56b8437d014d6cda66ef8074f837a00e6fc2a73e61fbb499fa/analysis/1463463109/
myfloralkart .com: 128.199.120.158: https://www.virustotal.com/en/ip-address/128.199.120.158/information/
>> https://www.virustotal.com/en/url/60a5188054011160fc698bbc45c4b3ad0870e5542cdb54e81a4e3eb4e55feb16/analysis/
___
Fake 'contract' SPAM - downloads Locky
- https://myonlinesecurity.co.uk/spam-malware-thanks-for-choosing-our-company-and-signing-a-contract-with-us/
17 May 2016 - "... email with the subject of 'FW: ' pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Susann Faitele <FaiteleSusann335@ webtravelmarket .com>
Date: Tue 17/05/2016 11:34
Subject: FW:
Attachment: security-20160517160422.zip
Thanks for choosing our company and signing a contract with us, we’re sending you a copy as promised.
17 May 2016: security-20160517160422.zip: Extracts to -2- different files data_veivommzha.js
Current Virus total detections 4/57* and archive_doctomjjz.js (VirusTotal 4/56**) - MALWR [1] [2] shows a download of Locky ransomware from one of these sites (VirusTotal 4/56[3])
http ://soco-care .be/zcHRd8.exe
http ://delicadinha .com.br/MSr7Uy.exe
http ://pro.monbento .com/8Uya5I.exe
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/82997715f4c8b8330307b0c7d6c7d77e63339fa2f6bb6cbad941817ee6eb1902/analysis/1463481488/
** https://www.virustotal.com/en/file/95ebad5f23a4858e703578088bd212244f82953f9ecb52ee9d80e68ee0fb5619/analysis/1463481291/
1] https://malwr.com/analysis/ZmFjZWI2MDAxOGM4NDQxNjliNGE0MWQ4MTIyN2Q0Y2Y/
Hosts
201.94.232.185: https://www.virustotal.com/en/ip-address/201.94.232.185/information/
>> https://www.virustotal.com/en/url/783f3c2a60ac19cddae291ec295d90d70794039c3685c5e2594a1994decfe960/analysis/
79.174.131.11: https://www.virustotal.com/en/ip-address/79.174.131.11/information/
>> https://www.virustotal.com/en/url/f264870f5267be1791a2b1686dcf2d47b27d2aa9be9a1f6fcee0179a6e791bd0/analysis/
188.165.125.141: https://www.virustotal.com/en/ip-address/188.165.125.141/information/
>> https://www.virustotal.com/en/url/6cda8292db5a1de32ef8001647ce19b37daff796265fcc6e00277e5a7a4f09b0/analysis/
2] https://malwr.com/analysis/MGEwMTk5NDc1NDE4NDMzYThlODBjMzVhMmQ4NDJmYjg/
Hosts
201.94.232.185
79.174.131.11
188.165.125.141
3] https://www.virustotal.com/en/file/58363e9ab3803c8debf35e5050a57f54609fd34b87d63ffaec6b05b9d3b1915a/analysis/1463485442/
___
Fake 'Per E-Mail' SPAM - malicious attachment is Locky ransomware
- http://blog.dynamoo.com/2016/05/malware-spam-per-e-mail-senden.html
17 May 2016 - "This German-language -spam- comes with a malicious attachment. It appears to come from the victim themselves, but this is just a simple-forgery.
From: victim@ victimdomain .tld
Date: 17 May 2016 at 13:28
Subject: Per E-Mail senden: DOC0000329040
Folgende Dateien oder Links können jetzt als Anlage mit Ihrer Nachricht
gesendet werden:
DOC0000329040
Attached is a ZIP file that matches the reference number in the subject and body text. I have only seen one sample, downloading a binary from:
katyco .net/0uh8nb7
The VirusTotal detection rate is 4/57*, the comments in that report indicate that this is Locky ransomware and the C&C servers are at:
188.127.231.124 (SmartApe, Russia)
176.53.21.105 (Radore Veri Merkezi Hizmetleri, Turkey)
217.12.199.151 (ITL, Ukraine)
107.181.174.15 (Total Server Solutions, US)
Recommended blocklist:
188.127.231.124
176.53.21.105
217.12.199.151
107.181.174.15 "
* https://www.virustotal.com/en/file/478ab3b1f465dc1088b0d1e7cef8cab1f3b736856f6be279d4e7a8113ad065d5/analysis/
Comments:
> https://myonlinesecurity.co.uk/spam-malware-per-e-mail-senden-print0008451941-delivers-locky/
17 May 2016
>> https://malwr.com/analysis/NmZiZmZhOTE0Mzk2NGQwNDgyNjdkNTU2NjViZDNhM2Q/
Hosts
203.162.53.112: https://www.virustotal.com/en/ip-address/203.162.53.112/information/
katyco .net: 203.162.53.112
___
Fake 'BILL' SPAM - downloads Locky
- https://myonlinesecurity.co.uk/spam-malware-bill-store-nellimarla-jute-mills-co-ltd/
17 May 2016 - "An email with the subject of 'BILL' pretending to come from Store-Nellimarla Jute Mills Co Ltd. <yfstore857@ slsenterprise .com> with a malicious Excel XLS spreadsheet attachment is another one from the current bot runs downloading Locky... The email looks like:
From: . <yfstore857@ slsenterprise .com>
Date:
Subject: BILL
Attachment:
Sir,
Please find the attached file.
17 May 2016: Bill_481575758.xls - Current Virus total detections 6/57*
.. MALWR** shows a download from
http ://seahawkexports .com/89yg67no (VirusTotal ***).. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/6c6bdc90dc98f51880c49fa9b2e46766c360259da45361f93e746af2d88afacc/analysis/1463496996/
** https://malwr.com/analysis/M2VmM2ZjOWFmZWY3NDFiZmFhYTE3Yzk0MGFkYzk4MjE/
Hosts
43.242.215.197: https://www.virustotal.com/en/ip-address/43.242.215.197/information/
>> https://www.virustotal.com/en/url/01689d2d4ba1648821d8bea1d2d0f6b384a8e0a9be9e9a14f41330fec5046167/analysis/
*** https://www.virustotal.com/en/file/ba131ac473c3f7108bb14159bbdabb19ede2eecb35c06efdeadac292221caa9c/analysis/1463500609/
seahawkexports .com: 43.242.215.197
___
Tech Support Scammers - 'Screen Lockers'
- https://blog.malwarebytes.org/cybercrime/social-engineering-cybercrime/2016/05/tech-support-scammers-get-serious-with-screen-lockers/
May 17, 2016 - "... -bogus- browser locks and -fake- AV alerts which are mostly an annoyance and can somewhat easily be disabled... But things have been changing with more serious malware-like techniques to force people into calling rogue tech support call centres. We previously saw a case of fake Blue Screen Of Death (BSOD) actually locking-up people’s desktops and now there is a growing demand for such ‘products’. Below is a Facebook post advertising a 'locker' specifically designed for tech support scams. It tricks users into thinking their Windows license has expired and blocks them from using their computer:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/FB_posting.png
To be clear, this is -not- a fake browser pop up that can easily be terminated by killing the application or restarting the PC. No, this is essentially a piece of malware that starts automatically, and typical Alt+F4 or Windows key tricks will -not- get rid of it. There is an entire ecosystem to distribute these tech support lockers, which includes bundling them into affiliate (Pay Per Install) applications. What you -thought- was a PC optimizer or Flash-Player-update turns out to be a bunch of useless toolbars and, in some cases, one of these lockers. Another reason yet, if there weren’t enough already to -stay-away- from-adware-supported-programs... This is a -fake- Windows update but the average user will probably not see the difference. More troubling is the next screen that comes up and effectively -disables-the-computer- because of an expired license key. The message looks legitimate with the license key and computer name being retrieved from the victim’s actual computer:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/key.png
The only recourse it seems is to call the toll-free number for assistance. As you can imagine, these fake Windows programs are great leads for tech support call centres waiting to collect the credit card numbers of unsuspecting users. We called the number (1-844-872-8686) provided on the locked screen and after much back and forth, the technician revealed a hidden functionality to this locker... However, the rogue ‘Microsoft technician’ would not proceed any further until we paid the $250 fee to unlock the computer, which we weren’t going to... these Windows lockers are a real pain to get rid of and until you do so, your computer is completely unusable. Just in the past few days we have noticed more and more users complaining about these new lockers. This increased sophistication means that people can no longer simply rely on common sense or avoid the typical cold calls from ‘Microsoft’. Now they need to also have their machines protected from these attacks because scammers have already started manufacturing malware tailored for what is essentially plain and simple extortion over the phone..."
:fear::fear: :mad:
AplusWebMaster
2016-05-18, 14:21
FYI...
Fake 'DOC' SPAM - JS malware
- https://myonlinesecurity.co.uk/spam-malware-emailing-doc-05-18-2016-04-49-68-pretending-to-come-from-your-own-email-address/
18 May 2015 - "Another email with the subject of 'Emailing: DOC 05-18-2016, 04 49 68' [random numbered] pretending to come from your own email address with a zip attachment is another one from the current bot runs... slightly different subjects all with random numbers after the date
Emailing: Picture 05-18-2016, 34 57 55
Emailing: DOC 05-18-2016, 04 49 68
Emailing: Image 05-18-2016, 12 20 14
Emailing: photo 05-18-2016, 60 93 51
... One of the emails looks like:
From: Your own email address
Date: Wed 18/05/2016 11:31
Subject: Emailing: DOC 05-18-2016, 04 49 68
Attachment: DOC 05-18-2016, 04 49 68.zip
Your message is ready to be sent with the following file or link
attachments:
DOC 05-18-2016, 04 49 68
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
18 May 2016: DOC 05-18-2016, 04 49 68.zip: Extracts to: HWC4703756.js - Current Virus total detections 6/57*
.. MALWR** shows a download from feedconsumer.upfrontjournal .com/erg54g4?ooGXPymBM=fNULIh (VirusTotal 3/56***)
Payload security[4] shows this downloads a further file from diolrilk .at/files/cyAOiY.exe (virustotal 1/57[5])
which makes this more likely to be Dridex banking Trojan rather than a ransomware version... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ab9f474ce82c55ce3895dfbd0cb035c6280e97fcabacd9f535c6bd7cb4908f13/analysis/1463568343/
** https://malwr.com/analysis/OTM4NTg0NmM3ODBjNDk2YjkyYTc3ZWI1NzVlYzBhYmQ/
Hosts
173.236.177.29: https://www.virustotal.com/en/ip-address/173.236.177.29/information/
*** https://www.virustotal.com/en/file/a48f2b9509045a67d610defb811822820f1dfb3ad8266b27b76988219e47134a/analysis/1463567581/
TCP connections
109.235.139.64: https://www.virustotal.com/en/ip-address/109.235.139.64/information/
31.8.133.98: https://www.virustotal.com/en/ip-address/31.8.133.98/information/
4] https://www.hybrid-analysis.com/sample/a48f2b9509045a67d610defb811822820f1dfb3ad8266b27b76988219e47134a?environmentId=100
Contacted Hosts
109.235.139.64: https://www.virustotal.com/en/ip-address/109.235.139.64/information/
5.105.221.126: https://www.virustotal.com/en/ip-address/5.105.221.126/information/
5] https://www.virustotal.com/en/file/7703f3af9e012a2283ec53a3062b596b5a164583368dae48304bdb32de758a6a/analysis/1463569252/
___
Fake 'Invoice' SPAM - JS malware drops Dridex
- https://myonlinesecurity.co.uk/spam-malware-invoice-1723-812595-drops-dridex/
18 May 2016 - "An email with the subject of 'Invoice 1723-812595' [random numbered] pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which contains what looks like the embedded Dridex binary inside the 274 kb .JS file in a base 64 encoded section... One of the emails looks like:
From: Vasquez.Jaspero@ hcrltd .com.br
Date: Wed 18/05/2016 11:54
Subject: Invoice 1723-812595
Attachment: Invoice 1723-812595.zip
Hi,
Please find attached copy of invoice SN04359806 as requested. I would be grateful if you could reply to this email to ensure I have sent it to the correct address.
Kind Regards, Jasper Vasquez
18 May 2016: Invoice 1723-812595.zip: Extracts to: invoice_6126.js - Current Virus total detections 1/57*
.. MALWR** shows no downloads but shows the dropped bin file in base64 encoding (VirusTotal 3/57***)
.. Payload security[4] gives some more information, but not much... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/14130650828ee168f26ecb7c37f2e2789ddfd2b4842812bb9ce876256fabea78/analysis/1463569142/
** https://malwr.com/analysis/ZmNmZGE1NDI1Y2MxNGI3YWExNzdhNTUzM2MzZjU2Nzk/
*** https://www.virustotal.com/en/file/1a3804e4b14699444ff391f2693ab5cf265ae0e91e74d0bc31224da4685b99bf/analysis/1463570330/
4] https://www.hybrid-analysis.com/sample/14130650828ee168f26ecb7c37f2e2789ddfd2b4842812bb9ce876256fabea78?environmentId=100
___
Fake 'DHL shipment' SPAM - doc malware
- https://myonlinesecurity.co.uk/spam-malware-shipment-address-confirmation-re-send/
18 May 2016 - "An email with the subject of 'shipment address confirmation (re-send)' pretending to come from info <info@ dhl-services .com> with a zip attachment that extracts to a malicious word doc is another one from the current bot runs... The email looks like:
From: info <info@ dhl-services .com>
Date: Wed 18/05/2016 14:25
Subject: shipment address confirmation (re-send)
Attachment: dhl shipment #000516.zip
Dear all
After reviewing your shipment BL container number; we need to confirm, did your company change shipment address? If yes, attach you can find the information to re-confirm your shipment address.
We require your quick confirmation and reply to this development
Regards.
Alice M. York,
5/17/2016
Oversea Frieght Information Manager,
WorldWide Delivery Services DHL ...
18 May 2016: dhl shipment #000516.zip: extracts to shipment details.doc - Current Virus total detections 12/55*
.. MALWR** didn’t show any download but a manual analysis showed a download from
http ://revery.5gbfree .com/rollas/wanfile.exe which is saved to %APPDATA%\flash.exe and autorun (VirusTotal 8/57***)
MALWR[4].. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/bbb210c6514d3e3bc5bb632face3e1421dc1235fd24c47847861008563ff1e9f/analysis/1463526808/
** https://malwr.com/analysis/MjU5MjkwODg4MDZkNDIwNTljOTEwYzFlZjBkMWFmNjY/
*** https://www.virustotal.com/en/file/de98e97c7af2ae6eaf40e293e156e83c1b80e3d197add148ced9b4e98f84a1eb/analysis/1463526879/
4] https://malwr.com/analysis/NmQ1MmU0ZDExMmJhNDNlNjhmMmE1MWI1MTg3MzM2YTI/
Hosts
23.94.151.38: https://www.virustotal.com/en/ip-address/23.94.151.38/information/
revery.5gbfree .com: 209.90.88.138: https://www.virustotal.com/en/ip-address/209.90.88.138/information/
>> https://www.virustotal.com/en/url/d20b90eaa3de0bd28847617013bae8386293737a9b086377b7cf616845f6265d/analysis/
___
Fake 'Remittance Advice' SPAM - doc malware
- https://myonlinesecurity.co.uk/spam-malware-remittance-advice-word-doc-with-embedded-ole-object/
18 May 2016 - "An email with the subject of 'Remittance Advice' pretending to come from random senders and email addresses with a malicious word doc attachment is another one from the current bot runs... The email looks like:
From: Diana Raveche <Diana@ lappgroup .com>
Date: Tue 17/05/2016 15:33
Subject: Remittance Advice
Attachment: 59350_Copy_PS13149_(1).docx
Dear Sirs,
Please find attached remittance advice(s) for reconciliation.
Should you have any queries, kindly contact the address below
Best regards
Daniel Sefah
Treasurer
Manganese Company Limited
18 May 2016: 59350_Copy_PS13149_(1).docx - Current Virus total detections 16/56*
.. MALWR** contains an embedded OLE object that when extracted gives 'Double Click on file to view clear Swift' copy.exe (VirusTotal 14/56***) MALWR[4] which shows a connection to
http ://cf34064.tmweb .ru/cgi-bin/eke/gate.php which gave a 404 when I tried, which might mean it has been taken down or it insists on a referrer from the actual word doc or the extracted malware which several antiviruses detect as a fareit password stealer Trojan. Payload security doesn’t give much more useful info either...
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Double-Click-on-file-to-view-clear-Swift-copy-1024x549.png
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/297bb53736af0645249b6eaa5d9b4b51501476e773afaa2e55c7fb031c177025/analysis/1463574035/
** https://malwr.com/analysis/MTE2MDQ5YzIyZmRmNDY5MjgwOGEzNGQ3YTlhNGNhMjc/
*** https://www.virustotal.com/en/file/db440c12c2e9a70aa50362afd4e3e6a095233110ca275b28ddca15411b9e927b/analysis/1463574066/
4] https://malwr.com/analysis/MTc2Y2QxNmMxOWQxNGM5MmJkMGUxOTE2MDUwMzIzZjM/
Hosts
92.53.118.64: https://www.virustotal.com/en/ip-address/184.95.37.110/information/
:fear::fear: :mad:
AplusWebMaster
2016-05-19, 13:53
FYI...
Fake 'Thank you' SPAM - JS malware attachment
- https://myonlinesecurity.co.uk/spam-malware-thank-you-from-random-companies/
19 May 2016 - "An email with the subject of 'Thank you!' pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads some unknown malware... One of the emails looks like:
From: Stevie Fry <FryStevie3913@ divtec .ch>
Date: Thu 19/05/2016 10:49
Subject: Thank you!
Attachment: webmaster_order_04FDEC03.zip
Hello webmaster,
Please find enclosed invoice no. 871824
Thank you for your order.
We look forward to doing business with you again.
Regards,
Stevie Fry
Pioneer Natural Resources Company
19 May 2016: webmaster_order_04FDEC03.zip: Extracts to: -4- identical copies of history_048.js
Current Virus total detections 6/56*. MALWR** shows a download from
http ://dub3tv .com/2e22dfs (VirusTotal 2/56***). Payload Security[4] | Malwr[5]. Nothing so far is actually telling us what the payload is, but it is likely to be either Locky or Dridex... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/42022dae95e4d9ea4755eab72ce5fc99c6f3791b40098fba8d2fe1fbba552f62/analysis/1463654399/
** https://malwr.com/analysis/N2I1ZjkzMDNiYTY1NDQ2OWE4MTk2YTk4MWVhYmRmNWU/
Hosts
184.168.107.21: https://www.virustotal.com/en/ip-address/184.168.107.21/information/
*** https://www.virustotal.com/en/file/d55dc76862f6f769a31d6ac64b4757d676cfe25d39ede7b071755ef772e21e83/analysis/1463654794/
4] https://www.hybrid-analysis.com/sample/d55dc76862f6f769a31d6ac64b4757d676cfe25d39ede7b071755ef772e21e83?environmentId=100
5] https://malwr.com/analysis/MTNlNzQwYjgyMmY4NGNhMDllMzI4ZTkxYTc5MGU1ZjU/
___
Fake 'WhatsApp' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spam-malware-you-got-a-voice-message-whatsapp-delivers-locky/
19 May 2016 - "An email with the subject of 'You got a voice message!' pretending to come from WhatsApp <Cleo477@ gmx .de> with a zip attachment is another one from the current bot runs which downloads Locky Ransomware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/You-got-a-voice-message-1024x522.png
19 May 2016: MSG0002959373787821.wav.zip: Extracts to: MSG00033066464574474.wav.js
Current Virus total detections 8/56*. MALWR** shows a download of Locky from
http ://denzil .com.au/grh5444tg?WKInfNTzzF=VQkztyPupI (VirusTotal 4/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine WAV/DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/42080550415bce74b1f7e44738c308ada4f82764b0241f0dadc8c273d745bcbc/analysis/1463652406/
** https://malwr.com/analysis/OTRlNmU0ZjA4ODE4NDUzMmJkM2FmNDNmMmNiMzVlMmY/
Hosts
223.130.27.201
89.108.84.155
92.63.87.48
*** https://www.virustotal.com/en/file/59d78e4a6898356dc1426974145b120b893fe764655825ef6804fe39e81eb906/analysis/1463653169/
TCP connections
92.63.87.48: https://www.virustotal.com/en/ip-address/92.63.87.48/information/
denzil .com.au: 223.130.27.201: https://www.virustotal.com/en/ip-address/223.130.27.201/information/
>> https://www.virustotal.com/en/url/a461f0d0caac7713ac5343331bf2b3b5a5578a415ae9d99067b6e332841571b5/analysis/
___
Fake 'Scanned image' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/scanned-image-pretending-to-come-from-your-own-email-domain-delivers-locky/
19 May 2016 - "Another email pretending to come from your-own-email-domain with the subject of 'Scanned image' pretending to come from admin <southlandsxxxx@ victimdomain .tld> with a zip (rar) attachment is another one from the current bot runs which downloads Locky Ransomware... One of the emails looks like:
From: admin <southlandsxxxx@ victimdomain .tld>
Date: Thu 19/05/2016 19:52
Subject: Scanned image
Attachment: MSG00087072.rar
Image data in PDF format has been attached to this email.
19 May 2016: MSG00087072.rar: Extracts to: MSG0004219280705535.js - Current Virus total detections 9/57*
.. MALWR** shows a download of Locky ransomware from
freesource .su/437gfinw2 (VirusTotal 3/56***)
Other sites found include:
freesource .su/437gfinw2 - 136.243.176.66
der-werbemarkt .de/437gfinw2 - 85.158.182.96
criticalcontactinfo .com/437gfinw2 - 192.73.242.42
empiredeckandfence .com/437gfinw2 - 192.185.225.43
... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c02d623d6b8fc7521ede6235e65937adb55dca83cd412f79ddb3dfb865c4f9b1/analysis/1463686171/
** https://malwr.com/analysis/ZjBjOTNmOWNlMjc4NDYzZWE3OTQ0NGEzMzQyMDYwYjU/
Hosts
92.63.87.48
*** https://www.virustotal.com/en/file/a685c6158e86f5446be8caef5dbed2d2616d4ebc1f490618da5131ae6aae0bcd/analysis/1463684566/
TCP connections
92.63.87.48: https://www.virustotal.com/en/ip-address/92.63.87.48/information/
freesource .su: 136.243.176.66: https://www.virustotal.com/en/ip-address/136.243.176.66/information/
>> https://www.virustotal.com/en/url/62bbc35a826863546149d8c562fec3f5f238268835128f8483aa90f5a05d14ab/analysis/
der-werbemarkt .de: 85.158.182.96: https://www.virustotal.com/en/ip-address/85.158.182.96/information/
criticalcontactinfo .com: 192.73.242.42: https://www.virustotal.com/en/ip-address/192.73.242.42/information/
empiredeckandfence .com: 192.185.225.43: https://www.virustotal.com/en/ip-address/192.185.225.43/information/
___
White hats bake TeslaCrypt master key into universal decryptor
Ransomware authors appear to have given up...
- http://www.theregister.co.uk/2016/05/19/white_hats_bake_teslacrypt_master_key_into_universal_decryptor/
19 May 2016 - "The authors of the TeslaCrypt ransomware have handed over their master keys in what appears to be a decision to kill off the net menace. An Eset researcher noticed the gradual decline of TeslaCrypt and, posing as a victim, asked the malware authors for a key. The authors surprisingly offered a free master key and the security wonk quickly produced a free universal decryption tool*. It means victims of two of the worst ransomware tools can decrypt their files for free, with Kaspersky white hats producing a decryption tool yesterday** for the Cryptxxx malware..."
* http://download.eset.com/special/ESETTeslaCryptDecryptor.exe
** http://www.theregister.co.uk/2016/05/18/cryptxxx_decrypted/
- http://support.eset.com/kb6051/
Last Revised: May 19, 2016
Identify the ransomware you’re dealing with...
> https://id-ransomware.malwarehunterteam.com/index.php
"This service currently detects 87 different ransomwares..."
Updated 05/19/2016
> http://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/
May 18, 2016
:fear::fear: :mad:
AplusWebMaster
2016-05-20, 14:26
FYI...
Fake 'refund' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/05/malware-spam-i-wanted-to-follow-up-with.html
20 May 2016 - "This spam comes from random senders and has a malicious attachment. Here is an example:
From: Frederic Spears
Date: 20 May 2016 at 10:29
Subject: Re:
Hi [redacted],
I wanted to follow up with you about your refund.
Please find the attached document
Regards,
Frederic Spears
CBS Corporation
The company name and sender's name varies from message to message. Attached is a ZIP file which contains elements of the recipient's name, which in turn contains one of a variety of malicious scripts. Out of the samples I have seen, I have so far found download locations of:
delicious-doughnuts .net/oqpkvlam
dev.hartis .org/asvfqh2vn
dugoutdad .com/0ygubbvvm
craftbeerventures .nl/hgyf46sx
babamal .com/av2qavqwv
forshawssalads .co.uk/af1fcqav
Only three of those download locations work so far (VirusTotal results [1] [2]..) and automated analysis of those [4] [5].. shows behaviour consistent with Locky ransomware. All of those reports show the malware phoning home to:
91.219.29.106 (FLP Kochenov Aleksej Vladislavovich / uadomen.com, Ukraine)
51.254.240.89 (Relink LLC, Russia / OVH, France)
138.201.118.102 (Hetzner, Germany)
Recommended blocklist:
91.219.29.106
51.254.240.89
138.201.118.102 "
1] https://virustotal.com/en/file/bf2e4ca2fb028f57cbccf9e1e6f00ef5f65a328b9d07ff41f00433509b5f5e2d/analysis/1463737477/
TCP connections
91.219.29.106
2] https://virustotal.com/en/file/d5cbb94a2ccaf7f37e42ab7d97da7991209ae231b1ea6814f6c583b59ae66ca4/analysis/1463738300/
TCP connections
91.219.29.106
4] https://malwr.com/analysis/NmQ1NmY1M2IzNTBmNDFiMGI5YjNkY2E5MDNjNDEyZGQ/
Hosts
138.201.118.102
5] https://malwr.com/analysis/NmU3MTZlZThhNGJkNDFmMzk2NzdhMDNkODA2N2U1MDk/
Hosts
138.201.118.102
- https://myonlinesecurity.co.uk/i-wanted-to-follow-up-with-you-about-your-refund-leads-to-locky/
20 May 2016 - "Another email in the long line of nemucod JavaScript downloaders with the subject of 'Re: ' pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: I wanted to follow up with you about your refund
Date: Fri 20/05/2016 10:24
Subject: Re:
Attachment: rob_refund_947CDB34.zip
Hi rob,
I wanted to follow up with you about your refund.
Please find the attached document
Regards,
Inez Castro
Workday, Inc.
20 May 2016: rob_refund_947CDB34.zip: Extracts to: history.6725.js.js - Current Virus total detections 5/57*
downloads from http ://carseatcoverwarehouse .com.au/zzvmvae (VirusTotal 6/57**). Payload Security***
Some other sites found include:
http ://delicious-doughnuts .net/oqpkvlam – currently 404 for me
http ://carseatcoverwarehouse .com.au/zzvmvae
http ://dev.hartis .org/asvfqh2vn
http ://honeystays .co.za/sajaafafa
http ://dvphysio .com.au/g0bpicjhbv
... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/332e8c0e921c03358252b279094c5bdf1a1e89a1d485cd7140ec86e4127a1eb7/analysis/1463736198/
** https://www.virustotal.com/en/file/2c6247c7ccc058784baa6fe7abc67adf00b3d02b8178b97fdfdf6a60482267e7/analysis/1463736629/
TCP connections
51.254.240.89
*** https://www.hybrid-analysis.com/sample/9dca772d3215b46680eb200b76bf94ff5126ad65be42bfad1acdd05a5fd0cb90?environmentId=100
Contacted Hosts
192.185.198.215
92.63.87.48
51.254.240.89
delicious-doughnuts .net - 213.160.76.117: https://www.virustotal.com/en/ip-address/213.160.76.117/information/
>> https://www.virustotal.com/en/url/36a99f760b7de21bd4d3a8bea5a57d9009940a8df88571a95b9d899fc15746aa/analysis/
carseatcoverwarehouse .com.au - 192.185.198.215: https://www.virustotal.com/en/ip-address/192.185.198.215/information/
>> https://www.virustotal.com/en/url/ec3527809b5f3942ce859f3882fad426b6799efd7a8332d053dbf22bd7c4b119/analysis/
dev.hartis .org - 212.1.214.102: https://www.virustotal.com/en/ip-address/212.1.214.102/information/
>> https://www.virustotal.com/en/url/807f423bdc7980cd45754c4a458c8136f6fb320a65d54b0b47708065ebcb94ba/analysis/
honeystays .co.za - 188.40.0.214: https://www.virustotal.com/en/ip-address/188.40.0.214/information/
>> https://www.virustotal.com/en/url/346741a9d6ad0567f6e62d041dc6f0f9f898ed4f15ad2acbcdce66893507b905/analysis/
dvphysio .com.au - 192.185.182.18: https://www.virustotal.com/en/ip-address/192.185.182.18/information/
>> https://www.virustotal.com/en/url/f859dd4cb3fc2f8acfe845fe47e94439b1dadd3e1b46ffef84c82ee48e2006f9/analysis/
___
Ubiquiti AirOS routers hit with worm
- https://www.helpnetsecurity.com/2016/05/20/ubiquity-routers-backdoor-worm/
May 20, 2016 - "A worm targeting wireless network equipment developed by US-based Ubiquity Networks has already managed to compromise thousands of routers across the world. To spread it, whoever is behind these attacks is exploiting an old bug* in airOS, the firmware that runs on the company’s networking devices... According to Symantec researchers**, once it leverages the exploit, the worm copies itself on the device and creates a backdoor account... Ubiquity has provided a list of devices/firmware versions that are safe from the exploit, and has advised users of others to update their firmware. They have also provided a removal tool[3] for the worm, which also has the option to upgrade firmware to the latest version (5.6.5)."
* https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSwitch-and-airGateway-Released/ba-p/1300494
** http://www.symantec.com/connect/fr/blogs/thousands-ubiquiti-airos-routers-hit-worm-attacks
3] https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949
:fear::fear: :mad:
AplusWebMaster
2016-05-23, 12:59
FYI...
Fake 'invoice' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/please-find-attached-the-file-we-spoke-about-yesterday-leads-to-locky/
23 May 2016 - "... an email with the subject of 'Re: ' pretending to come from random senders and email addresses with a zip attachment is another one which downloads Locky ransomware... One of the emails looks like:
From: Elizabeth Simpson <SimpsonElizabeth4937@ anapest .com>
Date: Mon 23/05/2016 09:15
Subject: Re:
Attachment: copy_invoice_17DF6BE6.zip
Hi jipy,
Please find attached the file we spoke about yesterday.
Thank you,
Elizabeth Simpson
Deutsche Bank AG
23 May 2016: copy_invoice_17DF6BE6.zip: Extracts to: history.8519.js.js.js - Current Virus total detections 1/57*
MALWR** shows a download of Locky from
http ://stylelk .com/12opjwfh (VirusTotal 0/56***). MALWR[4] which is -altered- by the javascript to create
gCBkMdFX463HMBEP.exe (VT 5/57[5]). MALWR [6]. Manual analysis shows also alternative download locations from
maibey .com/bakcy9s (VT 0/56[7]), bekith .com/twe4puv (VT 0/55[8])... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c3eca0d2cbb63106010ac6da0875480de85c5f0f341af25d4025d4e39d774c10/analysis/1463991056/
** https://malwr.com/analysis/YzhhZjcwYzM5MjdiNDg5NmFhNDk2YzdlMmI2ZjE0NWI/
Hosts
160.153.71.230
31.41.44.45
92.63.87.53
176.31.47.100
188.166.168.250
178.63.238.188
*** https://www.virustotal.com/en/file/ba10f9aa9007947ccf587e8d5dff19e174ffba8acde20587365d063a613cb391/analysis/1463992536/
4] https://malwr.com/analysis/Njk4ZGMzYWQ0Y2IzNDY0NmJjNDJiODc0OGUyMjAzNjY/
5] https://www.virustotal.com/en/file/5c18ab258a3a89980aaa9d673a07851fcab4443733a00c4fbf14d21906b65c9e/analysis/1463993646/
TCP connections
92.63.87.53
31.41.44.45
188.166.168.250
176.31.47.100
178.63.238.188
6] https://malwr.com/analysis/NzYxNTZkOTAzODI2NGFkODlhMzE2NmVkZDZmNWQ3YmE/
Hosts
188.166.168.250
176.31.47.100
92.63.87.53
31.41.44.45
178.63.238.188
7] https://www.virustotal.com/en/file/d595ffed27d618f7485f8860e9bf398c081b54822fe907cb82504c2b17f9d553/analysis/1463991121/
8] https://www.virustotal.com/en/file/8d22410766f1c0bd9fd3e68f4fc9edf153bc72ee4b8efebb6872017eb502ccb3/analysis/1463992820/
- http://blog.dynamoo.com/2016/05/malware-spam-please-find-attached-file.html
23 May 2016 - "This spam appears to come from random senders, and leads to Locky ransomware:
From: Graham Roman
Date: 23 May 2016 at 11:59
Subject: Re:
Hi [redacted]
Please find attached the file we spoke about yesterday.
Thank you,
Graham Roman
PCM, Inc.
Attached is a ZIP file starting with copy_invoice_ and then a random sequence. This contains a malicious script file which in the sample I analysed downloads an obfuscated binary from:
oakidea .com/by2eezw8
islandflavaja .com/0p1nz
dragqueenwig .com/itukabk
Automated analysis of the script [1] [2] shows it dropping a file klA1KMQj2D.exe which has a VirusTotal detection rate of 5/56*. Those prior reports plus these additional analyses of the binary [3] [4] [5] show network traffic to:
188.166.168.250 (Digital Ocean, UK)
31.41.44.45 (Relink Ltd, Russia)
92.63.87.53 (MWTV, Latvia)
Those reports all demonstrate clearly that this is Locky ransomware, although the barely encrypted downloaded binaries are a -new- feature. Those prior reports plus these additional analyses of the binary [3] [4] [5] show network traffic to:
188.166.168.250 (Digital Ocean, UK)
31.41.44.45 (Relink Ltd, Russia)
92.63.87.53 (MWTV, Latvia) ...
UPDATE: Trusted third-party analysis (thank you) shows some additional download locations...
... One additional C2 server:
176.31.47.100 (Unihost, Seychelles / OVH , France)
Recommended blocklist:
188.166.168.250
31.41.44.45
92.63.87.53
176.31.47.100 "
1] https://malwr.com/analysis/NzIyZWNjYzAwM2E1NGE2YmJkOWE2OWM0NDA0YzY4Nzg/
Hosts
216.70.68.223
92.63.87.53
2] https://www.hybrid-analysis.com/sample/f4a89d2c527acbdc8f1b9a2326d7fb1e58ce06de343011e904fe80f90eb96573?environmentId=100
Contacted Hosts
188.166.168.250
* https://virustotal.com/en/file/24b252941062ded074c8dfa37e33907322d270fd60a97b4db59baf29e81731a3/analysis/1464002438/
TCP connections
188.166.168.250
3] https://sandbox.deepviz.com/report/hash/86fa752330fb189952a69742244b5890/
4] https://malwr.com/analysis/ZDNjZTc1ZTVhMTUzNDRjZTk4ZDgyNjIzNTgyZWMwZWU/
Hosts
188.166.168.250
5] https://www.hybrid-analysis.com/sample/24b252941062ded074c8dfa37e33907322d270fd60a97b4db59baf29e81731a3?environmentId=100
Contacted Hosts
31.41.44.45
188.166.168.250
___
Fake 'bank account deleted' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/05/malware-spam-your-bank-account-has-been.html
23 May 2016 - "This alarming looking spam has a malicious attachment:
From: Bradyrian Hassell
Date: 23 May 2016 at 14:00
Subject: Account Deleted
Your bank account has been deleted, more information attached.
I have only seen a single copy of this and the ZIP file attached was corrupt, however, it is very likely that this is a variant of the Locky ransomware run from earlier today*."
* http://blog.dynamoo.com/2016/05/malware-spam-please-find-attached-file.html
___
DMA Locker 4.0 – Known Ransomware preps for Massive Distribution
- https://blog.malwarebytes.org/threat-analysis/2016/05/dma-locker-4-0-known-ransomware-preparing-for-a-massive-distribution/
23 May 2016 - "... Behavioral analysis: In contrast to the previous versions, DMA Locker 4.0 cannot encrypt files offline. It needs to download the public RSA key from its C&C. That’s why, if the file has been opened on the computer without the internet connection, it will just install itself and wait. If the machine is connected – it runs silently until it finish encrypting the files. This time DMA Locker comes with a deception layer added – packed sample have an icon pretending a PDF document:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/icon.png
... After it finishes the encryption process, a red window, similar to the one known form the previous editions pops up:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/dma_gui4.png
... The recently observed changes suggest that the product is preparing to be distributed on a massive scale. Few important things got automated. Distribution is now exploit kit based – that makes it reach much more targets..."
(More detail at the malwarebytes URL above.)
___
Tech Support Scammers using Winlogon
- https://blog.malwarebytes.org/cybercrime/2016/05/tech-support-scammers-using-winlogon/
May 23, 2016 - "... Tech Support Scammers are using every trick in the malware-authors-book to get new 'customers'. Here is one that takes over the victims’ Windows system after a reboot by using the Winlogon-Shell registry value... This makes sure that the user gets access to his Taskbar and Desktop (among other things). It can be changed by so-called skins or replacement shells with the users’ consent, but in this case it was done -without- consent... This resulted in this screen after the user logged on:
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/TSSscreen.png
... The installer is a file called 'Hotstar.exe' and was submitted to us by a fellow researcher. We suspect the file was hosted on the site amiga[dot]tech, because of two reasons. The installer opens two browser windows and one of those -queries- that site. The other one opens up exetracking.weebly .com, a site that can be used to keep track of the number of installs, but the account of this author was -suspended- a few weeks ago. The other reason is that amiga[dot]tech still hosts a file called Hotstar.exe, but this one installs a -fake- registry cleaner (The type that finds -896- infections in 0.2 seconds on a -clean- Virtual Machine):
> https://blog.malwarebytes.org/wp-content/uploads/2016/05/infections.png
... We looked at another Tech Support Scam using scare-tactics to lure victims into calling their phone number. The method is a bit different, but the end-goal is the same. Take the money and run. So save yourself the hassle and get protected..."
amiga[dot]tech: 107.180.51.27: https://www.virustotal.com/en/ip-address/107.180.51.27/information/
>> https://www.virustotal.com/en/url/ad49fc6bdb41e4b49d6ae1749d9f55286a59b1d709e4e423f1f2f8ea9b5708d6/analysis/
Malware site ...
exetracking.weebly .com: 199.34.228.53: https://www.virustotal.com/en/ip-address/199.34.228.53/information/
>> https://www.virustotal.com/en/url/61f89ed6147a78e1749c097ab173eddaf0c9024264ccf1c4dacd0f84c0aba807/analysis/
Malware site ...
199.34.228.54: https://www.virustotal.com/en/ip-address/199.34.228.54/information/
weebly .com: 74.115.50.109: https://www.virustotal.com/en/ip-address/74.115.50.109/information/
>> https://www.virustotal.com/en/url/7f1223fd3acda7ffb157dc4486d3c7fef8b0319ac6f69802b17e9cd99aa1648a/analysis/
74.115.50.110: https://www.virustotal.com/en/ip-address/74.115.50.110/information/
>> https://www.virustotal.com/en/url/a922986d4aecfa2978512b53e420a87a6586f5b46396655e06bddc3b33b336b0/analysis/
___
Hacks probe defenses of Middle East banks
Targeted Attacks...
- https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html
May 22, 2016 - "In the first week of May 2016... a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region. The threat actors appear to be performing initial reconnaissance against would-be targets, and the attacks caught our attention since they were using unique -scripts- not commonly seen in crimeware campaigns... The attackers sent multiple emails containing macro-enabled-XLS-files to employees working in the banking sector in the Middle East. The themes of the messages used in the attacks are related to IT Infrastructure such as a log of Server Status Report or a list of Cisco Iron Port Appliance details. In one case, the content of the email appeared to be a legitimate email conversation between several employees, even containing contact details of employees from several banks. This email was then forwarded to several people, with the malicious Excel file attached... This was done for the purpose of social engineering – specifically, to convince the victim that enabling-the-macro did in fact result in the 'unhiding' of additional spreadsheet data... This attack also demonstrates that macro malware is effective even today. Users can protect themselves from such attacks by -disabling- Office macros in their settings and also by being more vigilant when enabling macros (especially when prompted) in documents, even if such documents are from seemingly 'trusted' sources..."
(More detail at the fireeye URL above.)
Disable -macros- in Office
> https://support.office.com/en-us/article/Enable-or-disable-macros-in-Office-documents-7b4fdd2e-174f-47e2-9611-9efe4f860b12#bm2
"... Macro security settings are located in the Trust Center. However, if you work in an organization, your system administrator might have changed the default settings to prevent anyone from changing any settings.
Note: When you change your macro settings in the Trust Center, they are changed only for the Office program that you are currently using. The macro settings are -not- changed for all your Office programs..."
YMMV.
1. DO NOT follow the advice they give to enable macros or enable editing to see the content.
2. The basic rule is NEVER open any attachment to an email, unless you are expecting it - and refer to Rule #1.
___
Ransomware prevalence
- https://atlas.arbor.net/briefs/index#-610101497
May 19, 2016 - "Analysis: Analysts at Microsoft took a three-month snapshot of ransomware incidents ending in mid-May highlighting the overall breadth of compromises they observed. The table provided a list of the top 20 countries where Microsoft discovered ransomware victims... The top ten listed accounted for 651,801 known compromises..."
> https://blogs.technet.microsoft.com/mmpc/2016/05/18/the-5ws-and-1h-of-ransomware/
"... The following table* shows the top 20 countries where ransomware is most prevalent..."
* https://msdnshared.blob.core.windows.net/media/2016/05/R_consumer2.png
Ransomware timeline:
- https://msdnshared.blob.core.windows.net/media/2016/05/R_consumer6.png
:fear::fear: :mad:
AplusWebMaster
2016-05-24, 13:28
FYI...
Fake 'Exchange Rates' SPAM - Java malware
- https://myonlinesecurity.co.uk/updated-exchange-rates-for-all-agents-java-malware/
24 May 2016 - "An email with the subject of 'Updated Exchange Rates For All Agents' pretending to come from Western Union Business Solution <Gerard.Evans@ westernunion .com> with a zip attachment is another one from the current bot runs which delivers a java jacksbot. If you do not have Java installed, then you are safe from this malware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Updated-Exchange-Rates-For-All-Agents-1024x750.png
24 May 2016: New Rates 23_may_2016.rar: Extracts to: Updated rates and adjusted commission fees..jar and
wu fx updated rates.jpg (which is same image as in email). Current Virus total detections 23/57*. MALWR** which doesn't show much, because Java isn’t enabled on the sandbox... Payload Security*** finally gave a report but all it shows is a connection to a dynamic DNS service zingaremit2016.duckdns .org but I still don’t know what for except to divert silently to the actual malware sites and prevent antivirus companies & researchers finding and closing the site... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/90617732e2ba1699c7f2b9d7e36e3f0b29114e8220adcb1e660fa05ac2288c24/analysis/1464063358/
** https://malwr.com/analysis/YjJmNTI3N2VmNzVlNGFhY2I4MGFjMGI5NDIzZGUzNjc/
*** https://www.hybrid-analysis.com/sample/90617732e2ba1699c7f2b9d7e36e3f0b29114e8220adcb1e660fa05ac2288c24?environmentId=100
Contacted Hosts
89.163.154.146
___
Fake 'New Message' SPAM - js malware attachment
- https://myonlinesecurity.co.uk/new-message-from-administrator/
24 May 2016 - "An email with the subject of 'New Message from Administrator' pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads some malware probably Locky ransomware with anti-debugging, anti-analysis protection... One of the emails looks like:
From: Filide Macpherson <MacphersonFilide57@ wateen .net>
Date: Tue 24/05/2016 11:05
Subject: New Message from Administrator
Attachment: copy_577640.zip
You have 1 new message from Administrator. To read it, please open the attachment down below.
24 May 2016: copy_577640.zip: Extracts to: post_scan_7QeOo.js - Current Virus total detections 4/57*
.. MALWR** shows a download from http ://shop2gather .com/0WEGev.exe (VirusTotal 2/56***). MALWR[4] crashed on running this download. Payload security[5] doesn’t give any real useful info, except to suggest anti-debugging and analysis protection... Other sites found in this malware campaign include:
http ://shop2gather .com/0WEGev.exe - 191.234.21.43
http ://davidjubermann .com/kgRATz.exe - 103.16.128.166
http ://americanaintl .com/lFsXD3.exe - 175.45.50.235 giving me a 404
http ://puntacanaprivateoutlet .com/ogZ4Le.exe - 185.42.104.144
http ://piyopiyo .co.uk/XGh7zQ.exe - 23.229.156.163
... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/87747e77192ba81a21497e7b6332e1adfe0a9ab54de82f585d07534d5d1c1c41/analysis/1464085967/
** https://malwr.com/analysis/NTkzMzkxMWYzMmVlNGUxMDhiNDdiODAyYjFiMjliNDU/
Hosts
191.234.21.43
*** https://www.virustotal.com/en/file/07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced/analysis/1464086027/
4] https://malwr.com/analysis/NWRiNGM1ODUwNWVlNGIyY2E1NzliMjFkNjc1YzQ3MDI/
5] https://www.hybrid-analysis.com/sample/07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced?environmentId=100
___
Fake 'logon attempt' SPAM - doc malware
- https://myonlinesecurity.co.uk/suspicious-logon-attempt-or-account-compromised-leads-to-dridex/
24 May 2016 - "An email with the subject of 'Suspicious logon attempt' pretending to come from random senders, companies and email addresses with a malicious word doc inside a zip attachment is another one from the current bot runs... This looks like Dridex using an encrypted-base64-encoded-file inside the word doc that is converted and extracted using Microsoft certutil, using this new method described by MalwareTech Blog[1]...
1] http://www.malwaretech.com/2016/05/dridex-updates-payload-distribution.html
The email looks like:
From: Clay.Mortonp@raiosoldas .com.br
Date: Tue 24/05/2016 11:30
Subject: Suspicious logon attempt
Attachment: Security Report.zip
Attention!
Suspicious logon attempt to your account was detected (Firefox browser, IP-address: 199.30.218.0)
Reason: unusual IP
Please refer to the attached report to view further detailed information.
OROGEN GOLD PLC ...
24 May 2016: Security Report.zip: extracts to Security Report ID(12093937).doc
Current Virus total detections 3/57*. MALWR** - Payload Security***. Neither online sandbox managed to extract a working malware, but all indications point to Dridex... Update: .. THIS is the Dridex payload (VirusTotal 10/56[4]).
.. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/49b0c801462d19d16758454079e42d6aad8d54a4e7fb071946a1499fe7e07f3c/analysis/1464086262/
** https://malwr.com/analysis/NWQ4YzFlYWNiZjI3NGU3NGE3MTQ2Yjg0ZjZlOGVmYWI/
*** https://www.hybrid-analysis.com/sample/49b0c801462d19d16758454079e42d6aad8d54a4e7fb071946a1499fe7e07f3c?environmentId=100
4] https://virustotal.com/en/file/45b881bdc2df77c7c8786da714dcd1ac33a3e9a3f2dc35c1ef1ae08bf61dd999/analysis/
- http://blog.dynamoo.com/2016/05/malware-spam-account-compromised.html
24 May 2016 - "These -fake- security warnings come with a malicious attachment:
From: Jennings.KarlaVk@ ttnet .com.tr
Date: 24 May 2016 at 11:48
Subject: Account Compromised
Attention!
Suspicious logon attempt to your account was detected (Chrome browser, IP-address: 108.127.172.96)
Reason: unusual IP
Please refer to the attached report to view further detailed information.
BMJ Group ...
> Sent from iPad
In the two samples I have seen, there are attachments named Security Report.zip and Security Notification.zip which in turn contain a Word document with a name such as Security Report ID(11701573).doc . The two documents that I have seen have detection rates of about 3/56 [1] [2]...
UPDATE: According to a third party analysis, this apparently drops Dridex which phones home to:
210.245.92.63 (FPT Telecom Company, Vietnam)
162.251.84.219 (PDR Solutions, US)
80.88.89.222 (Aruba, Italy)
213.192.1.171 (EASY Net, Czech Republic)
Recommended blocklist:
210.245.92.63
162.251.84.219
80.88.89.222
213.192.1.171 "
1] https://virustotal.com/en/file/b3fa5fb185ebf75d76af10374c57c8194746f555e72e1d64c4d58436b7de6895/analysis/1464089508/
2] https://virustotal.com/en/file/62a5d3ec0dcda0aa72d13b2deac30307935b41b3e5a0e132fc4cf70cb2688543/analysis/1464089505/
___
Fake 'SAFARI LPO' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/safari-lpo-mal-337659-leads-to-locky/
24 May 2016 - "An email with the subject of 'SAFARI LPO [MAL] 337659' [random numbered] pretending to come from purchase@ safarigroup .net with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: purchase@ safarigroup .net
Date: Tue 24/05/2016 12:31
Subject: SAFARI LPO [MAL] 337659
Attachment: LPOMAL337659-6A9-5006.zip
Please find the attachment
24 May 2016: LPOMAL337659-6A9-5006.zip: Extracts to: IGFH-3503688.js - Current Virus total detections 23/56*
.. MALWR** shows downloads from
http ://alpadv .com/65g434f?YgXKzKkla=TeWMgeqci (VirusTotal 2/56***) or
http ://angelocc.php5 .cz/43454yt32?NjprTmi=EqTcdjEWuM (currently giving me a 404 not found) or
http ://panaceya.nichost .ru/sdfg4g3?gzVmzLqQLkU=oDlhsxWsTBF
Other download sites I have been informed about include :
http ://agro-bum .eu/43454yt32
http ://protei .me/43454yt32
http ://keiciuosi .lt/43454yt32
http ://BenavidezHoy .com/43454yt32
... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/15c7846d81bfb2b62431d57ee39e12e0cc30ba907d7281a162181c8b430078d1/analysis/1441173827/
** https://malwr.com/analysis/OGVlYzg4ZmQ3ZmFiNDBlNjlmM2IzOGU5MGI5Y2U0Y2Y/
Hosts
195.208.1.161
185.82.216.45
173.236.147.27
104.18.36.113
217.198.115.56
*** https://www.virustotal.com/en/file/667e830a41c0dcdb1400397d16abb859b77a197cbc512da8f5605676c31c093f/analysis/1464089771/
TCP connections
185.82.216.45
alpadv .com: 173.236.147.27: https://www.virustotal.com/en/ip-address/173.236.147.27/information/
>> https://www.virustotal.com/en/url/9882695bf4cc8dce8a47e31dacbab654dceb5ba45927848403252a60a4d80dcc/analysis/
angelocc.php5 .cz: 217.198.115.56: https://www.virustotal.com/en/ip-address/217.198.115.56/information/
>> https://www.virustotal.com/en/url/6b6610002305a6ae62f47b1065a864bb7e6cda9771f9b0d073b4c08d05c55b47/analysis/
panaceya.nichost .ru: 195.208.1.161: https://www.virustotal.com/en/ip-address/195.208.1.161/information/
agro-bum .eu: 188.116.19.62: https://www.virustotal.com/en/ip-address/188.116.19.62/information/
>> https://www.virustotal.com/en/url/32ea8b48e632520022dc43bcccea11e1f6320f86b4bca2016c3cf893445599ad/analysis/
protei .me: 198.46.81.204: https://www.virustotal.com/en/ip-address/198.46.81.204/information/
>> https://www.virustotal.com/en/url/d8e3452f9445388c4b952d918927cb7c0ba59d563d7a0c812c4fdb079fb2f2b5/analysis/
keiciuosi .lt: 194.135.87.62: https://www.virustotal.com/en/ip-address/194.135.87.62/information/
>> https://www.virustotal.com/en/url/c5b2e3f409ff55af997e2b6b5b06ddfe1f9037dd80f7f2f9b8b8ecfde6808411/analysis/
benavidezhoy .com: 69.16.243.28: https://www.virustotal.com/en/ip-address/69.16.243.28/information/
>> https://www.virustotal.com/en/url/f6c36886a8c4090adf7f8e376751f37eb1e98f1463a92913573ef8f59393129d/analysis/
___
Fake 'Your Payment' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/we-have-received-your-payment-thank-you-49407b2-delivers-locky/
24 May 2016 - "An email with the subject of 'We Have Received Your Payment – Thank You (#49407B2)' [random numbered] pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware... One of the emails looks like:
From: Chung House <HouseChung30291@ privateclientlegal .com>
Date: Tue 24/05/2016 14:40
Subject: We Have Received Your Payment – Thank You (#49407B2)
Attachment: details_074728.zip
Your payment has been successfully received. Please, notice that in order to ship your order, we need you to fill out the additional form enclosed down below.
24 May 2016: details_074728.zip: Extracts to: letter_kWRDn1.js - Current Virus total detections 3/57*
.. MALWR** shows a download of Locky from
http ://shop.deliciescatalanes .com/SMjheb.exe (VirusTotal 2/56***). MALWR[4]. Manual analysis shows an alternative download from http ://shop.vixtro .com/z2qLMy.exe ... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/0d451b5f02434b56245c78f5fab70a73eba7b45af347ffef8fe7b55fd8361aba/analysis/1464099776/
** https://malwr.com/analysis/NzI5M2E5ODU3OTc5NDUwOGJhNzdhZDk1M2FiZDIzN2Y/share/b3b1980902de4472a9bcbb031824f131
Hosts
212.92.57.70
31.41.44.45
*** https://www.virustotal.com/en/file/4212c799021a1e15cb6947eb123ff8191289cd33f0db033633238417fb4dfe62/analysis/1464091820/
4] https://malwr.com/analysis/NmRjN2NhZWMxOWJiNGViNWEzMGIzZGY1NGU5NTJlYjQ/
Hosts
185.82.216.45
shop.vixtro .com: 202.126.109.134: https://www.virustotal.com/en/ip-address/202.126.109.134/information/
>> https://www.virustotal.com/en/url/4dd23b506c63d41ef38fe6074d3719a4fac288ffe4ed402c4065811f0282c01d/analysis/
___
Evil network: OVH - Angler EK cluster
- http://blog.dynamoo.com/2016/05/evil-network-ovh-kaminskiyradiologistnet.html
24 May 2016 - "Here's an Angler EK cluster, hosted on multiple ranges rented from OVH France.. working first from this list of Angler IPs in OVH address space we can see a common factor.
5.135.249.214
5.135.249.215
51.255.59.119
51.255.59.120
51.255.59.121
51.255.59.123
91.134.206.128
91.134.206.129
91.134.206.130
91.134.206.131
91.134.204.217
91.134.204.218
91.134.204.219
91.134.204.243
91.134.204.245
91.134.204.247
One handy thing that OVH does with suballocated ranges is give clear details about the customer. This certainly helps track down abusers. In this case, the ranges these IPs are in are allocated to:
ORG-KM91-RIPE reference can be looked up on the RIPE database[1]: giving more of these little /30 blocks:
1] https://apps.db.ripe.net/search/full-text.html
5.135.249.212/30
51.255.59.116/30
51.255.59.120/30
51.255.59.124/30
91.134.206.128/30
91.134.204.212/30
91.134.204.216/30
91.134.204.220/30
91.134.204.240/30
91.134.204.244/30
91.134.204.248/30
91.134.204.252/30
164.132.223.192/30
OVH have been pretty good at cleaning up this sort of thing lately (unlike PlusServer*) so hopefully they will get this under control. If you want to find other Angler EK ranges then I have a bunch of 'em in my Pastebin**."
* http://blog.dynamoo.com/2016/04/plusserver-has-plussized-problem-with.html
** http://pastebin.com/u/dynamoo
:fear::fear: :mad:
AplusWebMaster
2016-05-25, 15:16
FYI...
Fake 'invoices' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/05/malware-spam-following-phone.html
25 May 2016 - "These -fake- financial spams come from different companies, all with a malicious attachment.
From: Frank.ClaraZO@ pr-real .com
Date: 25 May 2016 at 11:34
Subject: The invoices from INCHCAPE PLC
Hello,
Following the phone conversation with the accounting department represantatives I'm sending you the invoices.
Thank you for attention,
Kind regards
Clara Frank
INCHCAPE PLC ...
> Sent from Iphone
Attached is a ZIP file with a name similar to Invoice 5044-032841.zip which in turn contains a malicious script named in a similar manner to invoice(677454).js which typically has a detection rate of 3/56*. Hybrid Analysis** of that sample shows the script creating a PFX (personal certificate) file which is then transformed into a PIF (executable) file using the certutil.exe application. This PIF file itself has a detection rate of 6/56*** but automated analysis [1] [2].. is inconclusive. The behaviour is somewhat consistent with the Dridex banking trojan but may possibly be Locky ransomware."
* https://virustotal.com/en/file/375ae45aa5fc3ee5c65661f3d451b0a8f6cb02152754e8cf328d91d8ac67034f/analysis/1464173596/
** https://www.hybrid-analysis.com/sample/375ae45aa5fc3ee5c65661f3d451b0a8f6cb02152754e8cf328d91d8ac67034f?environmentId=100
*** https://virustotal.com/en/file/ceebb2d435a3ef726476a34691f5a54b21cf722350aedb3b8a605e3ce807708f/analysis/1464174246/
1] https://malwr.com/analysis/M2M0ZDRkYjY1OWM1NDVlNjg5YWM1M2I4YTNkNTIwZTY/
2] https://www.hybrid-analysis.com/sample/ceebb2d435a3ef726476a34691f5a54b21cf722350aedb3b8a605e3ce807708f?environmentId=100
___
Fake 'Operational Expense' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/05/malware-spam-operational-expense-leads.html
25 May 2016 - "This -fake- financial spam leads to malware:
From: Theodora Hamer
Date: 25 May 2016 at 12:17
Subject: Operational Expense
Operational Expense of 7,350,80 USD has been credited from your account. For more details please refer to the report that can be found down below
This analysis is based on a trusted source (thank you!). Attached is a ZIP file containing a malicious script, downloading from:
alborzcrane .com/g1slEn.exe
alborzcrane .com/Z94n5r.exe
alintagranito .com/fOA8Bl.exe
alintagranito .com/xB7nku.exe
amazoo.com .br/R0koId.exe
avayeparseh .com/s0faxS.exe
buzzimports .com.au/cRQVC4.exe
buzzimports .com.au/ECScwi.exe
galabel .com/lRkuJX.exe
galabel .com/oQz26K.exe
jett .com/6APaSk.exe
kitchen38 .com/HYPETS.exe
kitchen38 .com/V1ygc2.exe
onestopcableshop .com/J7t6au.exe
osdc .eu/gct5TH.exe
osdc .eu/n2UuEj.exe
purfectcar .com/9OaoqM.exe
purfectcar .com/sHXqZT.exe
wisebuy .com/WiOqzB.exe
yearnjewelry .com/OnvBrc.exe
yearnjewelry .com/t8HnK3.exe
zhaoyk .com/Dmv3As.exe
zhaoyk .com/JbO9uX.exe
This drops what is apparently Locky ransomware, with a detection rate of 3/56*. This phones home to:
164.132.40.47 (OVH, France)
104.131.182.103 (Digital Ocean, US)
This Hybrid Analysis** shows the Locky ransomware in action.
Recommended blocklist:
164.132.40.47
104.131.182.103 "
* https://virustotal.com/en/file/047c5fe2d08b0d6ab1e1be1c4e3e9f84a74252db0bc116b982f8dd02db85cf88/analysis/
** https://www.hybrid-analysis.com/sample/047c5fe2d08b0d6ab1e1be1c4e3e9f84a74252db0bc116b982f8dd02db85cf88?environmentId=100
___
Fake 'URGENT - DELIVERY' SPAM - leads to malware
- http://blog.dynamoo.com/2016/05/malware-spam-urgent-delivery-jobin.html
25 May 2016 - "This -fake- delivery spam leads to malware:
From: Justin harmon
Date: 25 May 2016 at 12:30
Subject: URGENT - DELIVERY
Dear customer.
Please find the attachment.
Thanks & Best Regards
Jobin Jacob
HYTEX ...
Attached is a ZIP file that contains one of many scripts that downloads a binary from one of the following locations (according to a trusted third party, thank you!):
avi-vest .ro/3g34t3t4tggrt?[random-string]=[random-string]
bankruptcymag .com/3g34t3t4tggrt?[random-string]=[random-string]
bizconsulting .ro/3g34t3t4tggrt?[random-string]=[random-string]
brunohenrique .net/3g34t3t4tggrt?[random-string]=[random-string]
cjglobal .co/3g34t3t4tggrt?[random-string]=[random-string]
comecomunicare .eu/3g34t3t4tggrt?[random-string]=[random-string]
crimeshurt .com/3g34t3t4tggrt?[random-string]=[random-string]
digitacaoveloz .com.br/3g34t3t4tggrt?[random-string]=[random-string]
globalcredithub .com/3g34t3t4tggrt?[random-string]=[random-string]
lifeclinics .net/3g34t3t4tggrt?[random-string]=[random-string]
orobos .nyc/3g34t3t4tggrt?[random-string]=[random-string]
selonija .lv/3g34t3t4tggrt?[random-string]=[random-string]
smp.com .mx/3g34t3t4tggrt?[random-string]=[random-string]
sweethomesgroup .com/3g34t3t4tggrt?[random-string]=[random-string]
tspipp .tsu.tula .ru/3g34t3t4tggrt?[random-string]=[random-string]
unijovem .com.br/3g34t3t4tggrt?[random-string]=[random-string]
www .appoutpost .com/3g34t3t4tggrt?[random-string]=[random-string]
Where [random-string] seems to be a random alphanumeric string. The dropped binary is Locky ransomware (as seen in this Malwr report*) which phones home to:
164.132.40.47 (OVH, France)
104.131.182.103 (Digital Ocean, US)
These are the same C2 servers as found here**."
* https://malwr.com/analysis/YTc2MTIxZjFmNjIwNDBlY2IwZTQ0MDVkY2VlZjkwYmM/
Hosts
2.49.203.206
164.132.40.47
** http://blog.dynamoo.com/2016/05/malware-spam-operational-expense-leads.html
___
Fake 'Weekly report' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/05/malware-spam-weekly-report-please-find.html
25 May 2016 - "This -fake- financial spam comes from random senders and companies and has a malicious attachment:
From: Alicia Ramirez
Date: 25 May 2016 at 14:22
Subject: Weekly report
Hi [redacted],
Please find attached the Weekly report.
King regards,
Alicia Ramirez
Castle (A.M.) & Co.
There are a -large- number of these, with a ZIP file -attached- containing malicious scripts with a typical detection rate of 3/56*. In this sample Malwr** analysis, it downloads a file from:
test.glafuri .net/yxk6s
There will certainly be a LOT of other download locations. The dropped file GSKQtcnNu8MS.exe has a detection rate of 4/55*** and that same VirusTotal report indicates C2 traffic to:
138.201.93.46 (Hetzner, Germany)
91.200.14.139 (PP SKS-LUGAN, Ukraine)
104.131.182.103 (Digital Ocean, US)
164.132.40.47 (OVH, France)
Even though other automated analysis -failed- [1] [2] this time we have previously identified -two- of those IPs[3] as being Locky ransomware, so there is little doubt that this will be more of the same.
Recommended blocklist:
138.201.93.46
91.200.14.139
104.131.182.103
164.132.40.47 "
* https://virustotal.com/en/file/98461f9c31f65359bb9321710f8283080984d2dcf5f7f27990ac2c769bf5b177/analysis/
** https://malwr.com/analysis/OWNkNDJjNGI3Y2RiNGUxMThiOGEyODQzN2IzM2JmMWY/
Hosts
176.223.121.193
*** https://virustotal.com/en/file/366dc962b02e9da5d59a968d5703e2208d1b657452be4ed75d94feadbc3b5f47/analysis/
TCP connections
138.201.93.46
91.200.14.139
104.131.182.103
164.132.40.47
69.195.129.70
1] https://www.hybrid-analysis.com/sample/366dc962b02e9da5d59a968d5703e2208d1b657452be4ed75d94feadbc3b5f47?environmentId=100
2] https://malwr.com/analysis/ZWZmZmMzMGE1NmYyNGI2NmJlMTUzNmFiYjM2NTg0Mzc/
3] http://blog.dynamoo.com/2016/05/malware-spam-operational-expense-leads.html
___
Fake 'Pan Card' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/attached-is-the-pan-card-as-requested-delivers-locky/
25 May 2016 - "An email with the subject of 'Pan Card' pretending to come from email2jbala . <email2jbala@ gmail .com> with a malicious word doc attachment downloads Locky ransomware... 'never heard of a 'PAN card' and had to do a Google search to find out what it is. 'Turns out to be an Indian Identity card for income tax payments... The email looks like:
From: email2jbala . <email2jbala@igmail .com>
Date: Wed 25/05/2016 15:37
Subject: Pan Card
Attachment: 2015-25-05_333317.docm
Attached is the PAN card as requested.
You can mail me form 16.
25 May 2016: 2015-25-05_333317.docm - Current Virus total detections 7/55*
.. MALWR** shows a download from
http ://www.asysa .cl/k7jhrt4hertg which gave the hendibe.exe which doesn’t look like an .exe file but is an HTML file (VirusTotal 0/57***) (Currently giving me a 404 'not found'). An alternative version gave me
http ://majaz .co.uk/k7jhrt4hertg (VirusTotal 6/56[4]) which is the same Locky ransomware version from earlier today[5]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/eb0dda5edf2179441c768c854ed6185769dd4ba95aa5f6bee0846fe405e255eb/analysis/1464187080/
** https://malwr.com/analysis/ZGQxODFiN2M2Mjk0NDIxYzhjNmY2OWI5YTFjY2M5YzU/
Hosts
186.67.227.204
*** https://www.virustotal.com/en/file/db6f9bd24b84c95d775581aeb4fe6e3f3b335fa6e0f5eb0e65643bb0a3d034cd/analysis/1464191429/
4] https://www.virustotal.com/en/file/40c331e661c2d5079af5aaf6c4d706f5bbb3eee077853291235f0a470c94fbfb/analysis/1464189317/
TCP connections
164.132.40.47
5] https://myonlinesecurity.co.uk/urgent-delivery-jobin-jacob-hytex-delivers-locky/
asysa .cl: 186.67.227.204: https://www.virustotal.com/en/ip-address/186.67.227.204/information/
>> https://www.virustotal.com/en/url/af4de0f3d7588cbb2d19b57dceb4367f352b5f35d8efa0754d3e40641c3fd834/analysis/
majaz .co.uk: 81.27.85.11: https://www.virustotal.com/en/ip-address/81.27.85.11/information/
>> https://www.virustotal.com/en/url/e3cd46391a35b6e70c683b6d2002c764b23c5038a096147b7f5946c705a2173a/analysis/
___
'WhatsApp Gold' SCAM - spreads malware
- http://www.actionfraud.police.uk/news/dont-install-whatsapp-gold-it-contains-malware-may16
24 May 2016 - "WhatsApp users are being tricked by fraudsters into downloading a -fake- version of WhatsApp which infects Android devices with malware. The "secret" messages sent to peoples inboxes claim you have an exclusive chance to download “WhatsApp Gold”. The scam messages claim to offer enhanced features used by celebrities. Victims are urged to sign up via-a-link-provided... After clicking-on-the-link you will be -redirected- to a -fake- page and your Android device will become infected with malware. If you have already followed the link to download the software, install some -antivirus- software onto your device to remove the malware..."
> https://www.helpnetsecurity.com/2016/05/25/whatsapp-gold-malware/
May 25, 2016 - "... messages that offer 'WhatsApp Gold'..." [which does NOT exist.]
:fear::fear: :mad:
AplusWebMaster
2016-05-26, 13:24
FYI...
Fake 'document' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/05/malware-spam-please-find-attached.html
26 May 2016 - "This spam appears to come from different companies and senders, and has a malicious attachment:
From: Sara Osborne
Date: 26 May 2016 at 10:53
Subject: RE:
Dear sales,
Please find attached a document containing our responses to the other points which we
discussed on Monday 23th May.
Please let me know if you have any queries
Regards,
Wayfair Inc.
Sara Osborne
Attached is a ZIP file (the ones I have seen so far all begin with responses_) which contains a malicious script name in a similar way to employees -382-.js. These have a typical detection rate of 4/56*. Two samples analysed by Malwr [1] [2] show download locations from:
newgeneration2010 .it/mkc27f
projectodetalhe .pt/do5j36a
There will be many other download locations too. These drop two different binaries (VirusTotal results [3] [4]). Those two VT results plus these two DeepViz analyses [5] [6] show the malware phoning home to:
138.201.93.46 (Hetzner, Germany)
107.181.187.12 (Total Server Solutions, US)
212.109.219.31 (JSC Server, Russia)
5.152.199.70 (Redstation, UK)
This behaviour is consistent with Locky ransomware.
Recommended blocklist:
138.201.93.46
107.181.187.12
212.109.219.31
5.152.199.70 "
* https://virustotal.com/en/file/d0d6f058322c60c0c063c3a30b8f43c9ff36804cfc3deefda0b41b1454bd66b5/analysis/1464257175/
1] https://malwr.com/analysis/Y2YwZGJiYTY2MGJjNDFmN2E2OGRiMjJhN2Q5N2ZkYWE/
Hosts
217.73.226.220
2] https://malwr.com/analysis/NmIwYzJmM2EzYzkzNDdhZjllNmMwM2M4YjM5YjE0Nzg/
Hosts
50.87.30.230
3] https://virustotal.com/en/file/eb85b01f4d462ae3d52406e0455f8c3c70b8d87c9248df6c9808f130d1d85f0f/analysis/1464258206/
TCP connections
138.201.93.46
4] https://virustotal.com/en/file/a76264fbcdce99e8a1d9663662c1d3798351b22431b2d54bd1f09d57a4371548/analysis/1464258217/
TCP connections
212.109.219.31
5] https://sandbox.deepviz.com/report/hash/06616d1fbb32687a6be3cfcac4596264/
6] https://sandbox.deepviz.com/report/hash/420e191a7edfaef909ae92a895d04552/
___
Fake 'document' SPAM - jpg embedded malware
- https://myonlinesecurity.co.uk/i-have-attached-the-document-from-random-company-delivers-a-jpg-with-embedded-malware/
26 May 2016 - "A series of emails spoofing different companies with the subject of 'I/we have attached the [document/file/declaration]' from [random company name] coming from random senders with a malicious word doc attachment is another one from the current bot runs... Other subject lines include:
Please review the attached relation from
Some of the alleged senders with compromised email address I have received from include:
Nec Consulting <audiovideo7@ yandex .com>
Turpis Inc. <rahul_k@ asus .com>
Pharetra Sed Consulting <dibyendu@ digitexwebitsolutions .com>
Aliquet Proin Velit Inc. <jdybala@ realmindhosting .com>
Lobortis Corporation <apayne@ msicorp .com>
The email looks like:
From: Nec Consulting <audiovideo7@ yandex .com>
Date: Thu 26/05/2016 05:06
Subject: I have attached the document from Nec Consulting.
Attachment: 2-7925_273378123.dot
I have attached the document from Nec Consulting.
26 May 2016: 2-7925_273378123.dot - Current Virus total detections 4/57*
.. Payload security** shows a download from 3dcadtools .com/img.jpg?FL=1 (VirusTotal 4/56***) which gives a proper jpg that contains embedded malware... will update later when one of the analysts has done it.
Screenshot of image: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/jpg.png
.. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/b08df90209e1725ed403d102642f4c33e1e54a688f0ee14563576f173d472e4d/analysis/1464239384/
** https://www.hybrid-analysis.com/sample/b08df90209e1725ed403d102642f4c33e1e54a688f0ee14563576f173d472e4d?environmentId=100
Contacted Hosts
208.66.129.67: https://www.virustotal.com/en/ip-address/208.66.129.67/information/
*** https://www.virustotal.com/en/file/6cbf884d03a2e02f9134dee1c87186667dc35d648391ea58cdefe2dc228c9ed8/analysis/1464242851/
3dcadtools .com: 208.66.129.67
___
Fake 'Summons' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/summons-on-the-case-4e459e46-delivers-locky-ransomware/
26 May 2016 - "... An email with the subject of 'Summons On The Case #4E459E46' [random numbered] pretending to come from random senders with a zip attachment containing a JavaScript file which downloads Locky. It downloads the same Locky version from the -same- locations described by Techhelplist[1]. So far he has found 150 odd download locations for this version. It should be noted that these JavaScript files have 2 encrypted download locations in them...
1] https://techhelplist.com/spam-list/1080-credit-card-has-been-declined-malware
26 May 2016 - "... Checks in with these C2 sites:
212.109.219.31: https://www.virustotal.com/en/ip-address/212.109.219.31/information/
>> https://www.virustotal.com/en/url/3d1ba9033942810e28f9ab98f38bc36dd8452d251fcb5cf01f42f576aa622759/analysis/
5.152.199.70: https://www.virustotal.com/en/ip-address/5.152.199.70/information/
>> https://www.virustotal.com/en/url/92af159208dc5c07ce2e14ff40a5804fa9741038a4afd77f3d082c2561c01971/analysis/
107.181.187.12: https://www.virustotal.com/en/ip-address/107.181.187.12/information/
>> https://www.virustotal.com/en/url/b3f38aff82bddbf0e0ae5de7c34146ce6d20c1632b1287d9d29d61a4fbb96cc3/analysis/
..."
One of the emails looks like:
From: Faye Third <ThirdFaye15@ booneritterinsurance .com>
Date: Thu 26/05/2016 17:02
Subject: Summons On The Case #4E459E46
Attachment: copy_260713.zip
Good day, You are being summonsed to the court on the case #4E459E46. The penalty in the amount of $9,793,18 will be assigned in case you don’t show up. Information on the case is listed in the document enclosed.
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
___
'Telegraphic transfer' - Phish
- http://blog.dynamoo.com/2016/05/phish-please-find-attached-telegraphic.html
26 May 2016 - "At first glance this spam looks like malware, but it appears to be a -phish- instead:
From: General trading ltd [info@ 7studio .co]
Date: 26 May 2016 at 05:04
Subject: Payment
Dear Sir/Ma'am!
As requested by our customer
Please find attached telegraphic transfer copy for payment made to your account today.
Kindly confirm once you received this payment.
Regards
Muhammad Farooq
Exchange Manager,
MCB New Garden Exchange
U.A.E (1080) ...
Attached is a file TT-USD.pdf .. as a rule I would recommend -not- opening PDF files or other attachments from -unknown- sources. When you open the file it looks like this:
> https://2.bp.blogspot.com/-B-_Ep2-MkGI/V0azOAm-WXI/AAAAAAAAH7E/6fAAY7f9vzk80l_Cps7A52aOmttfpD_pwCLcB/s1600/pdf-phish.jpg
Yes, it does look that blurry. The enticement here is to click-the-link in the document, which is something I wouldn't recommend that you do because it could lead to a malicious download, exploit kit or in this case a simple phishing page hosted on poloimport2012 .com:
> https://4.bp.blogspot.com/-X0D3k1PPWzU/V0a5kh3TQAI/AAAAAAAAH7U/RtcbYlnn7X8uPtpGXIFww0tTVTYhHIHDQCLcB/s1600/pdf-phish-2.jpg
poloimport2012 .com: 192.185.214.25: https://www.virustotal.com/en/ip-address/192.185.214.25/information/
>> https://www.virustotal.com/en/url/c193eda89d4865e2a1a38c591ff4c51b8cdcda46c3d7794fded46b904317f752/analysis/
This seems to be phishing for general webmail credentials. Of course, once a hacker has those they can use your account to send spam or even rifle through your private emails and reset passwords and gain access to other important accounts.Signing in with any credentials appears to fail*, but of course the bad guys have just harvested your password..
* https://3.bp.blogspot.com/-Ud6V07WniKM/V0a6uDtZdXI/AAAAAAAAH7g/BcxKGu3cmfMdJbiG8B-e0z_vgGG6-dq9wCLcB/s1600/pdf-phish-3.jpg
.. I don't recommend opening files like this and clicking-links to see where they go. I use a test environment to do this, but some similar spam emails can deliver malware that will silently plant itself on your computer which can be even more dangerous than this phish."
___
Fake 'new fax' SPAM - ransomware
- https://myonlinesecurity.co.uk/you-have-received-a-new-fax-from-your-own-email-address-delivers-malware/
25 May 2016 - "An email with the subject of 'You have received a new fax' pretending to come from Incoming Fax <Incoming.Fax@ victim domain .tld> with a zip attachment is another one from the current bot runs which delivers some malware... Edit: I am being told it is cerber ransomware:
> http://www.bleepingcomputer.com/news/security/the-cerber-ransomware-not-only-encrypts-your-data-but-also-speaks-to-you/
One of the emails looks like:
From: Incoming Fax <Incoming.Fax@ victim domain .tld>
Date: Wed 25/05/2016 19:27
Subject: You have received a new fax
Attachment: IncomeMessage.zip
You have received fax from XEROX41733530 at thespykiller .co.uk
Scan date: Wed, 25 May 2016 10:26:43 -0800
Number of page(s): 15
Resolution: 400×400 DPI
Name: Fax5704504
Attached file is scanned image in PDF format.
25 May 2016: IncomeMessage.zip: Extracts to: IncomeMessage127286.scr - Current Virus total detections 3/57*
.. MALWR** shows some strange data files created/dropped by this that I assume need decrypting into an exe file. It also drops opencandy.dll, whether this is connected with the Open Candy adware or is just a coincidental name is open for discussion... Payload Security*** tells us it contacts 1 domain and -16385- hosts. View the network section[1] for more details... being told it is cerber ransomware... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/690841fb92ccbb8bb08b157aaaed40cdd26f9ba2e70de9cdb7e8a1be8ffc9e09/analysis/1464200261/
** https://malwr.com/analysis/N2U5YTJlNDQwYjM2NDExY2I0Njg3ZWQzYTVjYjUxYmU/
*** https://www.hybrid-analysis.com/sample/690841fb92ccbb8bb08b157aaaed40cdd26f9ba2e70de9cdb7e8a1be8ffc9e09?environmentId=100
Contacted Hosts
ipinfo .io: 54.93.140.37: https://www.virustotal.com/en/ip-address/54.93.140.37/information/
1] https://www.hybrid-analysis.com/sample/690841fb92ccbb8bb08b157aaaed40cdd26f9ba2e70de9cdb7e8a1be8ffc9e09?environmentId=100#sample-network-traffic
:fear::fear: :mad:
AplusWebMaster
2016-05-27, 12:41
FYI...
Ransomware - Free Tools
- http://free.antivirus.com/us/index.html
May 26, 2016 - "These free ransomware tools can help users who have been infected with certain versions of ransomware and crypto-ransomware, allowing them to regain access to their system and files..."
> Crypto-Ransomware File Decryptor Tool:
- https://esupport.trendmicro.com/solution/en-US/1114221.aspx
> Lock Screen Ransomware Tool - unavailable at this time - check back later.
___
Fake 'Information request' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/information-request-delivers-locky/
27 May 2016 - "... an email with the subject of 'Information request' pretending to come from random senders with a zip attachment which downloads Locky ransomware... One of the emails looks like:
From: Damien Benson <BensonDamien52@ silvanasoda .com.br>
Date: Fri 27/05/2016 11:38
Subject: Information request
Attachment: changes_scan.910.zip
Dear scan.910,
As per our discussion yesterday, please find attached the amended meeting minutes.
I have accepted the majority of the changes requested, however there are some that I have left in the document.
I have included the edits as track changes.
Please confirm that the changes we have made are acceptable.
Many thanks
Regards,
Freshpet, Inc.
Damien Benson ...
27 May 2016: changes_scan.910.zip: Extracts to: changes-4354-.js - Current Virus total detections 2/57*
.. MALWR** shows a download... from http ://genius-versand .de/n2e2n (VirusTotal 0/57***) which is another one of these malware that get downloaded as an encrypted text file that needs to be decrypted by the javascript (which is itself encrypted) to give a working .exe file and bypass antivirus & perimeter defences that block download of executable files. Payload security[4] gives us TC9ck9tl.exe (VirusTotal 7/57[5]). These all have anti analysis/Anti sandbox/VM protection to prevent analysis by security companies and researchers... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c1613b6c59ccfc04c4fc8c7b597dd26c3d0b9eaf90e5ffa140dfa2e323b510d6/analysis/1464345360/
** https://malwr.com/analysis/YTFkYjA3ZjIwZGJkNDNmOWEyNGE3OGNmMGY0MjIyNjA/
Hosts
78.46.53.123: genius-versand .de: https://www.virustotal.com/en/ip-address/78.46.53.123/information/
>> https://www.virustotal.com/en/url/bc46a201bc5a14834d7531785c661f575332fb4d60ce579405a4e84219b2efa7/analysis/
*** https://www.virustotal.com/en/file/e90516d7275e9b8ded9471d90a43b384e1b92eae46bd13db5b4642e3e9ca3542/analysis/1464346231/
4] https://www.hybrid-analysis.com/sample/c1613b6c59ccfc04c4fc8c7b597dd26c3d0b9eaf90e5ffa140dfa2e323b510d6?environmentId=100
Contacted Hosts
78.46.53.123
5] https://www.virustotal.com/en/file/6f45451e9787cc52adc6ae34cfc6776674921bd3fe78adad708a79c4c7a15fa8/analysis/1464346123/
TCP connections
5.152.199.70: https://www.virustotal.com/en/ip-address/5.152.199.70/information/
>> https://www.virustotal.com/en/url/92af159208dc5c07ce2e14ff40a5804fa9741038a4afd77f3d082c2561c01971/analysis/
- http://blog.dynamoo.com/2016/05/malware-spam-as-per-our-discussion.html
27 May 2016 - "This spam leads to Locky ransomware:
From: Meagan Branch
Date: 27 May 2016 at 12:35
Subject: Information request
Dear [redacted],
As per our discussion yesterday, please find attached the amended meeting minutes.
I have accepted the majority of the changes requested, however there are some that I have left in the document.
I have included the edits as track changes.
Please confirm that the changes we have made are acceptable.
Many thanks
Regards,
Oramed Pharmaceuticals Inc.
Meagan Branch ...
The senders vary from email to email. Attached is a ZIP file with a malicious script, which in the examples that I have found downloads one of a variety of malicious executables [1] [2].. which call home to the -same- IP addresses found in this earlier spam run*.
1] https://virustotal.com/en/file/ac32f46cf7272aeba55f01be1356a17f0c55dd32ebde9ad70a0d1d6e7e8062ed/analysis/1464345833/
TCP connections
5.152.199.70
2] https://virustotal.com/en/file/dae6fe7633927ea16f22bd2147ed71bb0fbeb84937df4e485ea834ae58d36009/analysis/1464345851/
TCP connections
193.9.28.13
* http://blog.dynamoo.com/2016/05/malware-spam-neue-abrechnung-nr-746441.html
27 May 2016 - "... The payload is Locky ransomware.
Recommended blocklist:
193.9.28.13
5.152.199.70
212.109.219.31
107.181.187.12 "
___
'Final PO Contract' - Phish
- http://blog.dynamoo.com/2016/05/phish-final-po-contractxlsx.html
27 May 2016 - "This spam email is phishing for email credentials. Unlike some, this one seems to be quite well done and might convince unsuspecting people that it is genuine.
From: M Tufail Shakir [admin@ ebookmalls .com]
Date: 27 May 2016 at 08:42
Subject: Re: Final PO Contract..xlsx
Please see below attachment for the final signed contract
Regards,
27-05-2016
Tom Yip | Regional Sales Team | Marchon Eyewear (HK) Ltd...
The link in this email goes to:
cagselectrical .com.au/libraries/emb/excel/excel/index.php?email=[redacted]
This gives a pretty convincing looking facsimile of an Excel spreadsheet, prompting for credentials:
> https://2.bp.blogspot.com/-lNnthg-6Dug/V0gEg9WOMMI/AAAAAAAAH74/4X2KB5fd2T0Zjssi3cVlpHHXMK_WUzumACLcB/s1600/excel-phish.jpg
Entering any combination of username and password seems to work, then you get -redirected- to a GIF of a spreadsheet:
> https://2.bp.blogspot.com/-SgxiI71M5g4/V0gE4KGGUPI/AAAAAAAAH78/illdDTKH_BEEihgv0c19Lb9xXyZCDGUOACLcB/s1600/excel-phish-2.jpg
Curiously, this GIF is not part of a phishing site but is on a wholly legitimate site belonging to a software company called Aspera (you can see it here):
> http://download.asperasoft.com/download/docs/console/2.0/linux/html/index.html
The asperasoft .com domain is NOT involved in the phishing nor has it been compromised. As ever, I would advise you -not- to explore links like this as they might lead to an exploit kit or malware, and bear in mind that some phishing pages are better than others, and this is one of the more convincing ones that I have seen recently."
cagselectrical .com.au: 103.1.110.130: https://www.virustotal.com/en/ip-address/103.1.110.130/information/
>> https://www.virustotal.com/en/url/060d7af134051c5875b5a26e0efed06d1930a958a0ad06bb7182b0629fd59dbc/analysis/
___
'Window Users Award' - Phish
- https://myonlinesecurity.co.uk/microsoft-window-users-award-microsoft-lottery-scam/
27 May 2016 - "An email with the subject of 'Microsoft Window Users Award' pretending to come from Mr. Thomas Fisher <11@ nokopings .jp.tn> with a PDF attachment is a phishing scam... One of the emails looks like:
From: Mr. Thomas Fisher <11@ nokopings .jp.tn>
Date: Fri 27/05/2016 08:40
Subject: Microsoft Window Users Award..,
Attachment: convert to microsoft.pdf
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/microsoft-lottery-scam-1024x550.png
:fear::fear: :mad:
AplusWebMaster
2016-05-31, 12:27
FYI...
Fake 'Account Suspended' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/fraudlent-behavior-account-suspended-malspam-delivers-locky/
31 May 2016 - "... an email with the subject of 'Fraudlent Behavior – Account Suspended' pretending to come from random senders with a zip attachment which downloads Locky ransomware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/Fraudlent-Behavior-Account-Suspended-1024x447.png
31 May 2016: caution_ubmit_63883018.zip: Extracts to: details_AbSfS.js - Current Virus total detections 3/57*
.. MALWR** shows a download of Locky ransomware from
http ://handmee .com/hIPTXx (VirusTotal 3/57***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ace24f437fde5ee2fcdae4b9ae28c0d5608bd4d7207e02811b6e32b8e921913a/analysis/1464686472/
** https://malwr.com/analysis/NzM3MTg4OTk3MGFhNGMzNDgwNWU4NjVmYWY3NzczNmM/
Hosts
134.0.10.15
93.170.123.60
*** https://www.virustotal.com/en/file/03e3cc01a263edb9aefb411ebf2efb74d2130651400dc3baaa5e344ff1ec47ad/analysis/1464687464/
TCP connections
195.154.69.90
handmee .com: 134.0.10.15: https://www.virustotal.com/en/ip-address/134.0.10.15/information/
>> https://www.virustotal.com/en/url/2d0ed71bbe8e69a8c759c4f9541f23505a8f64de6c8174e07683e4d8215a2873/analysis/
___
Fake 'Proposal' SPAM - RTF attachment malware
- https://myonlinesecurity.co.uk/the-attached-proposal-includes-declaration-malspam-broken-malware-macros/
31 May 2016 - "An email where the subject is the word 'FWD: ' or 'Fw: ' and the alleged senders name pretending to come from random senders with a malicious word RTF doc spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Blossom J. Evans <garry@ tierneyandco .com>
Date: Tue 31/05/2016 10:47
Subject:Fw:Blossom J. Evans
Attachment: r03va37cl81h.rtf
The attached proposal includes declaration.
Blossom J. Evans
31 May 2016: r03va37cl81h.rtf - Current Virus total detections 4/57*
.. Malwr** isn’t showing any download or dropped content. Payload Security*** shows a download from
admiralty .co.za/jsckhr.jpg?TXnIQmQZO=59 (VirusTotal 3/57[4]) which should be converted-by-the-macro to an exe file (however Payload does not show any actual .exe file in the report)..
31 May 2016: u18c.rtf - Current Virus total detections 4/57[5]. Malwr[6] isn’t showing any download or dropped content. Payload Security[7] shows the same jpg download as the other rtf file... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/2dde9e214ce0aee784229cac5f87085e419eb67568d24dd616c879083480b8b6/analysis/1464688896/
** https://malwr.com/analysis/ZDkzZDJkMWNhY2RlNDAxYmIyMmEyNjUxNTE0OTg2MTQ/
*** https://www.hybrid-analysis.com/sample/2dde9e214ce0aee784229cac5f87085e419eb67568d24dd616c879083480b8b6?environmentId=100
Contacted Hosts
41.72.154.148: https://www.virustotal.com/en/ip-address/41.72.154.148/information/
4] https://www.virustotal.com/en/file/3de9ab5f2a6804fda6bfbc368d39e2fc481f7d2e0b3894f3001f1f40fc6adfe7/analysis/1464690295/
5] https://www.virustotal.com/en/file/306d3d1aa594b21d43f658de0da83b9fc1312b2f2e689098d279695d3fc04cf2/analysis/1464689088/
6] https://malwr.com/analysis/ZDkzZDJkMWNhY2RlNDAxYmIyMmEyNjUxNTE0OTg2MTQ/
7] https://www.hybrid-analysis.com/sample/306d3d1aa594b21d43f658de0da83b9fc1312b2f2e689098d279695d3fc04cf2?environmentId=100
Contacted Hosts
41.72.154.148
admiralty .co.za: 41.72.154.148
___
Fake 'New Message' SPAM - attachment leads to Locky
- http://blog.dynamoo.com/2016/05/malware-spam-you-have-1-new-message.html
31 May 2016 - "This -fake- financial spam has a malicious attachment:
From: Lanna Weall
Date: 31 May 2016 at 12:18
Subject: New Message from your bank manager
You have 1 new message from bank manager. To read it, please open the attachment down below.
In the sample I saw there was an attachment see_it_77235678.zip containing a malicious script warning_letter_Bdrh5W.js (detection rate 4/57*) and the Malwr analysis** of that sample shows that it downloads a binary from:
pvprojekt .pl/oLlqvX
The dropped binary is Locky ransomware with a detection rate of 4/56***. All those reports plus these analyses [1] [2] [3] show network traffic to:
85.17.19.102 (Leaseweb, Netherlands)
195.154.69.90 (Iliad Entreprises, France)
93.170.123.60 (PE Gornostay Mikhailo Ivanovich / time-host.net, Ukraine)
A trusted source (thank you) indicated that there was a earlier Locky campaign today...
Recommended blocklist:
85.17.19.102
195.154.69.90
93.170.123.60 "
* https://virustotal.com/en/file/2bcbc345d39ac74422e210309ef2f9ba910e3f9ec4ed5c1b0f8d13cb2d47a77b/analysis/
** https://malwr.com/analysis/YTI4OTk3ZTlmMGNlNGEwYThjNjk3MmNjNmYwNDAxNTk/
Hosts
193.107.88.86
85.17.19.102
*** https://virustotal.com/en/file/03e3cc01a263edb9aefb411ebf2efb74d2130651400dc3baaa5e344ff1ec47ad/analysis/1464694646/
TCP connections
195.154.69.90
1] https://malwr.com/analysis/YmIyMzlmNjQ2MTkxNDllNThhZTNkMjU3YWU1NTNlNDk/
Hosts
195.154.69.90
2] https://www.hybrid-analysis.com/sample/03e3cc01a263edb9aefb411ebf2efb74d2130651400dc3baaa5e344ff1ec47ad?environmentId=100
3] https://sandbox.deepviz.com/report/hash/6f8987e28fed878d08858a943e7c6e7c/
- https://myonlinesecurity.co.uk/new-message-from-your-bank-manager-malspam-delivers-locky/
31 May 2016
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/05/New-Message-from-your-bank-manager-1024x386.png
"... This one delivers the -same- Locky payload from the -same- sites in today’s earlier malspam run[1]..."
1] https://myonlinesecurity.co.uk/fraudlent-behavior-account-suspended-malspam-delivers-locky/
___
Fake 'New Company Order' SPAM - leads to malware
- http://blog.dynamoo.com/2016/05/malware-spam-new-company-order-abc.html
31 May 2016 - "This -fake- financial spam leads to malware:
From: accounting@ abcimportexport .com
Reply-To: userworldz@ yahoo .com
To: Recipients [accounting@ abcimportexport .com]
Date: 31 May 2016 at 12:31
Subject: New Company Order
Good Day,
Find the attached specifications in the purchase order for our company mid year order & projects before sending your Proforma Invoice and do get back to me with your quotations asap.
An Official order placement will follow as soon as possible.
CLICK HERE TO DOWNLOAD & VIEW PURCHASE ORDER IF DOESNT WORK THEN CLICK
HERE TO DOWNLOAD SECURE PURCHASE ORDER ...
ABC Import & Export,LLC 2534 Royal Lane
Suite # 205
Dallas,Texas 75229
USA ...
The link in the email message goes to gallery.mailchimp .com/4dcdbc9b7e95edf6788be6723/files/scan_purchase_orders.zip . This contains a malicious executable scan purchase orders.exe which has a detection rate of 3/56*. That VirusTotal report and these other analyses [1] [2].. shows network traffic to:
185.5.175.211 (Voxility SRL, Romania)
This executable drops another similar EXE [4] [5].. which phones home to the same IP. Between them, these reports indicate some sort of keylogger. There seems to be little of anything of value in this /24, so I would recommend blocking 185.5.175.0/24 "
* https://virustotal.com/en/file/0e7961d0dbe5ea3e20ffb29890fc4c4bcd220688ee6daf60eecbc11ab1a29219/analysis/1464698175/
TCP connections
185.5.175.211
1] https://malwr.com/analysis/NDcyYzBkNGJiNzk3NDA4MTg1MDJlYWY4MDc2ODMzOGE/
Hosts
185.5.175.211
2] https://www.hybrid-analysis.com/sample/0e7961d0dbe5ea3e20ffb29890fc4c4bcd220688ee6daf60eecbc11ab1a29219?environmentId=100
Contacted Hosts
185.5.175.211
4] https://virustotal.com/en/file/04178ae4cf989e89877e90a18ad2af6863cc828c81282710853f163c265fe1a6/analysis/
TCP connections
185.5.175.211
5] https://malwr.com/analysis/OGVkNjQwOGYyNTI2NDk0Y2JkNzkxMzJiNGE5OTUyZjE/
Hosts
185.5.175.211
___
Fake 'Lottery Ticket' SPAM - downloads Locky
- https://myonlinesecurity.co.uk/lottery-ticket-71088492-malspam-leads-to-locky/
31 May 2016 - "... email from the Locky gang with the subject of 'Lottery Ticket #71088492' [random numbered] pretending to come from random senders with a zip attachment which downloads Locky ransomware... One of the emails looks like:
From: Jesse Amis <AmisJesse74004@ sabanet .ir>
Date: Tue 31/05/2016 15:34
Subject: Lottery Ticket #71088492
Attachment: warning_71088492.zip
The e-version of your lottery ticket is enclosed to this e-mail.
31 May 2016: warning_71088492.zip: Extracts to: scanned_doc_Ay9bE.js - Current Virus total detections 8/57*
.. MALWR shows a download of Locky from
http ://lizdion .net/9cRXIl (VirusTotal ***) Which is the -same- Locky ransomware version that has been used all day... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/bda9620c11d17f6b18ed92412f02d817671e95e718395aa088eefa601a9f7881/analysis/1464705905/
** https://malwr.com/analysis/ODQxNWUwY2ZjZTI2NDM3Y2JlMzkxYWJmMzU3NjU3ZjM/
Hosts
97.74.158.1
93.170.123.60
*** https://www.virustotal.com/en/file/03e3cc01a263edb9aefb411ebf2efb74d2130651400dc3baaa5e344ff1ec47ad/analysis/1464706206/
TCP connections
195.154.69.90
lizdion .net: 97.74.158.1: https://www.virustotal.com/en/ip-address/97.74.158.1/information/
>> https://www.virustotal.com/en/url/bbe7446468a5e57b2bdb1ecec38a9c657c93c1c5f00f6e9db315d67bdff658c2/analysis/
___
Crypto-ransomware attacks Win7 and later ...
- http://blog.trendmicro.com/trendlabs-security-intelligence/crypto-ransomware-attacks-windows-7-later-scraps-backward-compatibility/
May 31. 2016 - "... new ZCRYPT ransomware family*... family only targets systems with newer versions of Windows, specifically Windows 7 and later:
* https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_zcrypt.a
... It makes the usual threats of deleting the files if the victim don’t pay up within a week. Ransom is set at 1.2 BTC (approximately 500 US dollars), with the ransom going up to 5 BTC (approximately 2,200 US dollars) after four days. The ransom note looks like this:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/05/zcrypt.png
... According to our analysis, it fails to either encrypt the files properly or display the ransom note when launched in an older version of Windows, such as Windows XP. The malware calls a function which does not exist in earlier versions of Windows; this breaks-it for the older operating systems... this particular family also tried to spread via USB flash disks: it plants a copy of itself onto removable drives.
This is relatively unusual in crypto-ransomware... The threat actor also enjoyed free anonymity because the domain registration masked the actual identity of registrant. The C&C domain is already tagged “canceled, suspended, refused, or reserved”.
Industry Practices: Backing up is still the best defense against crypto-ransomware; the 3-2-1 rule ensures that users still have a copy of their data even if they are affected by similar threats. We strongly advise against paying the ransom; this only ensures that the threat will continue to become bigger..."
>> https://www.trendmicro.com/us/security-intelligence/enterprise-ransomware/index.html
:fear::fear: :mad:
AplusWebMaster
2016-06-01, 14:27
FYI...
Fake 'ACH Bank account' SPAM - delivers Cerber ransomware
- https://myonlinesecurity.co.uk/ach-bank-account-information-form-malspam-delivers-cerber-ransomware/
31 May 2016 - "An email with the subject of 'ACH – Bank account information form' pretending to come from Ali Bolton <Ali.Bolton@ jpmchase .com> with a zip attachment which downloads Cerber ransomware... One of the emails looks like:
From: Ali Bolton <Ali.Bolton@ jpmchase .com>
Date: Tue 31/05/2016 21:29
Subject: ACH – Bank account information form
Attachment: Check_Copy_Void.zip
Please fill out and return the attached ACH form along with a copy of a voided check.
Ali Bolton,
JPMorgan Chase
GRE Project Accounting
Vendor Management & Bid/Supervisor ...
31 May 2016: Check_Copy_Void.zip: Extracts to: Check_Copy_Void.scr - Current Virus total detections 5/57*
.. Payload security** doesn’t show any download location of any further malware but the network section shows a connection to ipinfo .io and -16386- hosts which is a definite indication of Cerber ransomware.
MALWR*** doesn’t show anything interesting and is only mentioned for other researchers to download the sample. Whoever uploaded at Payload Security declined to share the sample... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/060f89f9ccfb00a65f9f2aa2aed7bee7ea20688b9d510708d14ac17d62ab8240/analysis/1464726882/
** https://www.hybrid-analysis.com/sample/060f89f9ccfb00a65f9f2aa2aed7bee7ea20688b9d510708d14ac17d62ab8240?environmentId=100
*** https://malwr.com/analysis/OGQ4ODRkMGU2ODU4NDg2YThhMTRhOWUwNTg0OTU3ZWU/
ipinfo .io: 52.3.78.30: https://www.virustotal.com/en/ip-address/52.3.78.30/information/
>> https://www.virustotal.com/en/url/a626f42954f1a9d87aeaa6bcecd16856a23bf16d8203d6a07ad03e2a18980842/analysis/
54.84.252.139: https://www.virustotal.com/en/ip-address/54.84.252.139/information/
>> https://www.virustotal.com/en/url/dcf49f947f6c9b0d8f369c23743d1a48f8ed32ac3507816dbf9d7aab64b6e375/analysis/
54.88.175.149: https://www.virustotal.com/en/ip-address/54.88.175.149/information/
>> https://www.virustotal.com/en/url/a626f42954f1a9d87aeaa6bcecd16856a23bf16d8203d6a07ad03e2a18980842/analysis/
___
DRIDEX Poses as Fake Certificate in Latest Spam Run
- http://blog.trendmicro.com/trendlabs-security-intelligence/dridex-poses-as-fake-certificate/
Jun 1, 2016 - "... we observed a sudden spike in DRIDEX–related spam emails after its seeming ‘hiatus.’ This spam campaign mostly affected users in the United States, Brazil, China, Germany, and Japan:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/05/dridex_spam_affectedcountries-2.jpg
... Instead of the usual -fake- invoice or notification baits, DRIDEX plays on people’s fears of having their accounts compromised. Besides the change in email subjects, DRIDEX also has new tricks... On top of its macro usage, it also leverages Certutil*, a type of command-line program in relation to certificate services to pass it off as a legitimate certificate. These two elements (use of macros and Certutil) combined together can add to DRIDEX’s prevalence and pose challenges to detection...
* https://technet.microsoft.com/en-us/library/cc732443%28v=ws.11%29.aspx
... Despite DRIDEX’s prevalence, users and organizations can do simple preventive measures such as not opening attachments and enabling macros when you receive emails from unknown sources. When you get emails about compromised accounts, check and verify first the source... enterprises can create policies that will block off email messages with attachments from unknown sources..."
(More detail at the trendmicro URL above.)
___
Windows 0-day vuln for sale ...
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Zero-Day-Auction-for-the-Masses/
May 31, 2016 - "... a zero day being offered-for-sale stood out among the other offerings in an underground market for Russian-speaking cyber criminals. This specific forum serves as a collaboration platform where one can hire malware coders, lease an exploit kit, buy web shells for compromised websites, or even rent a whole botnet for any purpose... The zero day in question claims to be a Local Privilege Escalation (LPE) vulnerability in Windows... We have notified Microsoft of the zero day offering and we continue to monitor the situation. We plan to update this blog post should we come across any new information."
> https://www.helpnetsecurity.com/2016/06/01/windows-zero-day-exploit/
___
APWG - Phishing Trends Report - Q1 2016
> https://apwg.org/apwg-news-center/APWG-News/
May 23 2016: "APWG releases its Phishing Trends Report for Q1 2016:
Some Key Findings in this report:
• The Retail/Service sector remained the most- targeted industry sector during the first quarter of 2016, with 42.71% of attacks.
• The number of brands targeted by phishers in the first quarter remained constant – ranging from 406 to 431 brands each month.
• The United States continued its position at top on the list of nations hosting phishing websites.
• In Q1 2016, 20 million -new- malware samples were captured.*
• The world's most-infected countries are led by China, where 57.24% of computers are infected, followed by Taiwan (49.15%) and Turkey at 42.52%."
> PDF/Full report: https://docs.apwg.org/reports/apwg_trends_report_q1_2016.pdf
* https://www.av-test.org/en/statistics/malware/
See "Total Malware" - charted
:fear::fear: :mad:
AplusWebMaster
2016-06-02, 15:26
FYI...
IC3 Warns of Extortion Email Schemes
- https://www.us-cert.gov/ncas/current-activity/2016/06/01/IC3-Warns-Extortion-Email-Schemes
June 01, 2016 - "The Internet Crime Complaint Center (IC3) has issued an alert on extortion schemes that relate to recent high-profile data thefts. Fraudsters often use the news release of high-profile data breaches to scare victims into clicking-on-a-link or paying a ransom.
US-CERT encourages users and administrators to review the IC3 Alert* for details and refer to US-CERT Tip ST04-014** for information on social engineering and phishing attacks."
* https://www.ic3.gov/media/2016/160601.aspx
June 01, 2016 - "The Internet Crime Complaint Center (IC3) continues to receive reports from individuals who have received extortion attempts via e-mail related to recent high-profile data thefts. The recipients are told that personal information, such as their name, phone number, address, credit card information, and other personal details, will be released to the recipient's social media contacts, family, and friends if a ransom is not paid. The recipient is instructed to pay in Bitcoin, a virtual currency that provides a high degree of anonymity to the transactions. The recipients are typically given a short deadline. The ransom amount ranges from 2 to 5 bitcoins or approximately $250 to $1,200..."
** https://www.us-cert.gov/ncas/tips/ST04-014
:fear::fear: :mad:
AplusWebMaster
2016-06-03, 11:39
FYI...
Fake 'PayPal' SPAM - malware delivery
- https://myonlinesecurity.co.uk/spam2ls-suspicious-activity-on-your-paypal-account-delivers-malware/
3 June 2016 - "An email with the subject of 'Spam2Ls Suspicious activity on your PayPal Account' pretending to come from PayPal <service@ intl.paypal .com> with a -link- in the email that when -clicked- downloads a password stealing malware. At first, I thought this was a typical badly done phishing attempt, but no! this is a genuine malware delivery attempt... the link in the email http ://188.120.230.100 /paypal/report.pdf- and note the – after the pdf... Of course it is -not- a PDF but delivers report.exe. I am being told that this is - a version of LATENT BOT:
- https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html
188.120.230.100: https://www.virustotal.com/en/ip-address/188.120.230.100/information/
>> https://www.virustotal.com/en/url/c319a91b4449289a0864613d08cda49de52944ba797f580af38f2d2e7336110b/analysis/
Update: a -second- run of this email with the subject just saying: 'Suspicious activity on your PayPal Account' and contains a link to http ://188.120.225.210 /paypal/report.pdf-
188.120.225.210: https://www.virustotal.com/en/ip-address/188.120.225.210/information/
>> https://www.virustotal.com/en/url/f91fd8c110cf21659483754bbd9cf03655dedb17ce8060a0ca6d656efd531348/analysis/
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/Spam2Ls-Suspicious-activity-on-your-PayPal-Account-1024x399.png
3 June 2016: report.exe - Current Virus total detections 9/56*
.. MALWR** ... Payload Security*** ... shows interesting connections where this malware posts files to a webserver and downloads various data and zip files. All the zip files I tried, were not actually zip files but encrypted data... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/03a47410cd61fd9c4d1393b37d019f735931abd6340540bcbb3132f6f84ec7e4/analysis/1464928075/
** https://malwr.com/analysis/MTI5OGZjMDg3YzhkNGNlOGJmYWFkZGY1NzJhYjAyZDE/
Hosts
107.161.145.159
*** https://www.reverse.it/sample/03a47410cd61fd9c4d1393b37d019f735931abd6340540bcbb3132f6f84ec7e4?environmentId=100
Contacted Hosts
107.161.145.159: https://www.virustotal.com/en/ip-address/107.161.145.159/information/
>> https://www.virustotal.com/en/url/8bc9c52e6ab2661585215c7182a5c4aa5ec419fe46e6d8ef937d7ea7f8c24d15/analysis/
___
More Tech Support Scams
- https://www.ic3.gov/media/2016/160602.aspx
June 2, 2016 - "The Internet Crime Complaint Center (IC3) is receiving an increase in complaints related to technical support scams, where the subject claims to be an employee (or an affiliate) of a major computer software or security company offering technical support to the victim. Recent complaints indicate some subjects are claiming to be support for cable and Internet companies to offer assistance with digital cable boxes and connections, modems, and routers. The subject claims the company has received notifications of errors, viruses, or security issues from the victim's internet connection. Subjects are also claiming to work on behalf of government agencies to resolve computer viruses and threats from possible foreign countries or terrorist organizations. From January 1, 2016, through April 30, 2016, the IC3 received 3,668 complaints with adjusted losses of $2,268,982...
Technical Details ...
Variations and Trends ...
Additional Threats ...
Defense and Mitigation ..."
(More detail at the ic3 URL above.)
___
Apple - all services resume after outage
- http://www.reuters.com/article/us-apple-disruption-idUSKCN0YO2R3
Jun 3, 2016 - "Apple Inc said all its services, including the popular App Store, have resumed following an outage that started late afternoon on Thursday. Apple's U.S. web page showed* all applications had resumed as of 11:55 p.m. Eastern Daylight Time (0355 GMT)... services related to iCloud and the Photos application have also resumed..."
* https://www.apple.com/in/support/systemstatus/
:fear::fear: :mad:
AplusWebMaster
2016-06-07, 00:33
FYI...
Angler EK now evades EMET on Win7 ...
- https://www.fireeye.com/blog/threat-research/2016/06/angler_exploit_kite.html
June 06, 2016 - "We recently encountered some exploits from Angler Exploit Kit (EK) that are completely evading Microsoft’s Enhanced Mitigation Experience Toolkit (EMET). This is something we are seeing for the first time in the wild, and we only observed it affecting systems running Windows 7. Angler EK uses complex multi-layered code obfuscation and leverages multiple exploits...
Conclusion: The level of sophistication in exploits kit has increased significantly throughout the years. Where obfuscation and new zero days were once the only additions in the development cycle, evasive code has now been observed being embedded into the framework and shellcode.
Remediation guidance: Although there are no quick solutions for the DEP, EAF, and EAF+ evasion techniques, organizations can mitigate this threat through a robust vulnerability management program for end user systems, which includes the installation of security updates for third party software. Applications such as Adobe Flash, web browsers, and Oracle Java should be patched routinely, prioritizing critical patches, or removed if possible. Because the web browser plays an important role in the infection process, disabling browser plugins for Flash or Silverlight may also reduce the browser attack surface."
- http://arstechnica.com/security/2016/06/drive-by-exploits-pushing-ransomware-now-able-to-bypass-microsoft-emet/
Jun 6, 2016 - "... there's nothing stopping Angler from using the EMET evasions to install other malicious applications..."
___
Malvertising - DoubleClick Ad Fraud
- https://blog.malwarebytes.org/cybercrime/social-engineering-cybercrime/2016/06/malvertising-campaign-leads-to-doubleclick-ad-fraud/
June 6, 2016 - "Malvertising isn’t only used to infect users via drive-by downloads or to deceitfully push fake-software-updates. A campaign currently going on via the -TrafficHolder- adult ad platform leverages the promise of raunchy videos to lure people into ad fraud. The trick is simple and yet effective. While browsing, users are automatically redirected to what appears to be YouTube for adult content. The page looks completely normal, except for the fact that it is a giant image slapped across an actual ‘normal’ WordPress website. To the naked eye the large JPEG or GIF looks legit, and curious visitors may me tempted to push the Play button to watch the saucy movie. Rather than playing any content, this click is used to launch a real and paid advert via Google’s DoubleClick. This technique referred to as ‘clickjacking’ is very popular and can take different forms while the end goal remains to generate legitimate-looking clicks on adverts:
> https://blog.malwarebytes.org/wp-content/uploads/2016/06/Flow__.png
The crooks are using hundreds of what appear to be -bogus- (insurance, loans and other scams) WordPress sites to carry out this fraudulent scheme. A simple layer is added on top of the page to give this optical illusion. JavaScript code is able to track mouse movements and knows if the user has actually clicked on the advert... The fake adult image (which covers the whole page) is dynamically generated on the fly and a new one is retrieved randomly from a remote server (5.39.99.215)... that image will disappear after a few seconds of inactivity to reveal the actual underlying WordPress site. The majority of the sites we found were highly suspicious and most likely used for hosting various other spammy content. When users click to play the -bogus- video, their action triggers the ad fraud component of this scam by abusing Google’s DoubleClick... In this particular malvertising instance, users are not put at risk with malicious code, they are simply being duped so that the crooks behind this can generate ad money for each click. However, we have also observed redirections to exploit kits via the same ad platform (TrafficHolder) so you should be extra vigilant and use a proactive line of defence such as exploit protection to avoid getting infected. We have reported this ad fraud to Google and will keep monitoring the situation as one can expect those rogue actors to come up with a different plan to monetize low quality traffic."
5.39.99.215: https://www.virustotal.com/en/ip-address/5.39.99.215/information/
___
Password Re-user? Get Ready to Get Busy
- http://krebsonsecurity.com/2016/06/password-re-user-get-to-get-busy/
June 6, 2016 - "In the wake of megabreaches at some of the Internet’s most-recognized destinations, don’t be surprised if you receive password-reset-requests from numerous companies that didn’t experience a breach:
Some big name companies — including Facebook and Netflix — are in the habit of combing through huge data leak troves for credentials that match those of their customers and then forcing a password reset for those users. Netflix .com, for example, sent out a notification late last week to users who made the mistake of re-using their Netflix password at Linkedin, Tumblr or MySpace. All of three of those breaches are years old, but the scope of the intrusions (more than a half -billion- usernames and passwords leaked in total) only became apparent recently when the credentials were posted online at various sites and services:
>> http://krebsonsecurity.com/wp-content/uploads/2016/06/netflixnotice-580x1031.png
... Netflix is taking this step because it knows from experience that -cybercriminals-will- be using the credentials leaked from Tumblr, MySpace and LinkedIn to see if they work on a variety of third-party sites (including Netflix)... Facebook* also has been known to mine-data-leaked in major external password breaches for any signs that users are re-using their passwords at the hacked entity."
* http://krebsonsecurity.com/2013/11/facebook-warns-users-after-adobe-breach/
:fear::fear: :mad:
AplusWebMaster
2016-06-07, 16:00
FYI...
LinkedIn breach data Used for Malicious E-Mails
- https://isc.sans.edu/diary.html?storyid=21139
2016-06-07 - "Yesterday, the German federal CERT (CERT-BUND) warned of phishing e-mails that are more plausible by using data that appears to originate from the recently leaked LinkedIn data set. The e-mail address the recipient by full name and job title. Typically, the attachments claim to contain an invoice. We have since received a couple of users who reported receiving e-mails that match the pattern. For example:
> https://isc.sans.edu/diaryimages/images/Screen%20Shot%202016-06-07%20at%208_44_56%20AM.png
The e-mails arrive in different languages. They address the recipient by full name, job title and company name, to make the e-mail more plausible. This is similar to the way social media was used in the past to create more convincing phishing e-mails. For example, see this old article from 3 years ago* about how Facebook data is used in this way. With the LinkedIn leak, data has become available that wasn't reachable by simple screen scrapers (or API users) in the past."
* https://isc.sans.edu/diary.html?storyid=15265
2013-02-25
___
TeamViewer confirms number of abused user accounts is “significant”
- http://arstechnica.com/security/2016/06/teamviewer-says-theres-no-evidence-of-2fa-bypass-in-mass-account-hack/
Jun 5, 2016 - "It was a tough week for TeamViewer, a service that allows computer professionals and consumers to log into their computers from remote locations. For a little more than a month, a growing number of users have reported their accounts were accessed by criminals who used their highly privileged position to drain PayPal and bank accounts. Critics have speculated TeamViewer itself has fallen victim to a breach that's making the mass hacks possible. On Sunday, TeamViewer spokesman Axel Schmidt acknowledged to Ars that the number of takeovers was 'significant', but he continued to maintain that the compromises are the result of user passwords that were compromised through a cluster of recently exposed megabreaches involving more than 642 million passwords belonging to users of LinkedIn, MySpace, and other services..."
- http://www.zdnet.com/article/teamviewer-confirms-extent-of-hack-significant/
"... If you think you may have been involved in the breach, check HaveIbeenPwned* and change your passwords as soon as possible..."
* https://haveibeenpwned.com/
:fear::fear: :mad:
AplusWebMaster
2016-06-08, 12:54
FYI...
Fake 'résumé' SPAM - drops Cerber ransomware
- http://blog.dynamoo.com/2016/06/malware-spam-good-morning-resume-spam.html
8 June 2016 - "This -fake- résumé spam leads to malware:
From: Dora Bain
Date: 7 June 2016 at 03:37
Subject: Good morning
What's Up?
I visited your website today..
I'm currently looking for work either full time or as a intern to get experience in the field.
Please look over my CV and let me know what you think.
With gratitude,
Dora Bain
In the sample I saw, the attached file was named Dora-Resume.doc and had a VirusTotal detection rate of 11/56*. The Malwr report** and Hybrid Analysis*** show that a -script- executes that tries to make a political statement along the way.. This downloads a file from 80.82.64.198 /subid1.exe which is then saved as %APPDATA%\us_drones_kills_civilians.exe which VirusTotal gives a detection rate of 20/56[4] and seems to give an overall diagnosis as being Cerber ransomware. The IP address of 80.82.64.198 is allocated to an apparent Seychelles shell company called Quasi Networks Ltd (which is probably Russian). There seems to be little if anything of value in 80.82.64.0/24 which could be a good candidate to block. Incidentally, the IP hosts best-booters .com which is likely to be a DDOS-for-hire site. According to the VT report[5] the malware scans for a response on port 6892 on the IP addresses 85.93.0.0 through to 85.93.63.255. However, this Hybrid Analysis[6] indicates that the only server to respond is on 85.93.0.124 (GuardoMicro SRL, Romania) which is part of the notoriously bad 85.93.0.0/24 which is a good thing to block. That report also shows traffic to ipinfo .io which is a legitimate "what is my IP" service. While not malicious in its own right, it does make a potentially good indicator of compromise.
Recommended blocklist:
80.82.64.0/24
85.93.0.0/24 "
* https://virustotal.com/en/file/3b8257c19229a0ba19571d7e467b067f95707e1e12e803f34e950d4691d6a202/analysis/1465377335/
** https://malwr.com/analysis/MjAwOWJjMGZmMzRjNGE5MTk4MzA3ZTM0ODJlYWI5N2E/
*** https://www.hybrid-analysis.com/sample/3b8257c19229a0ba19571d7e467b067f95707e1e12e803f34e950d4691d6a202?environmentId=100
4] https://virustotal.com/en/file/87d809141f03ad74c605af8c700408d26bcfd5f00d9ed14d002105d03c25b1bb/analysis/1465377604/
TCP connections
52.29.28.100: https://www.virustotal.com/en/ip-address/52.29.28.100/information/
5] https://virustotal.com/en/file/87d809141f03ad74c605af8c700408d26bcfd5f00d9ed14d002105d03c25b1bb/analysis/1465377604/
TCP connections
52.29.28.100
6] https://www.hybrid-analysis.com/sample/be839b563b534e36e7c6793e026026833a0266a97c2489070685081811cf5783?environmentId=100
___
Automated tax refund notification – Phish
- https://myonlinesecurity.co.uk/automated-tax-refund-notification-phishing/
8 June 2016 - "One of the frequent subjects in a phishing attempt is 'Tax returns' or 'tax refunds', where especially in UK, you need to submit your Tax Return online. The phishers have caught on to the fact that in UK -all- government services are now dealt with by a common gateway and you need to register for a Government Gateway account. This one wants your personal details and your credit card and bank details...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/tax_refund_email_phish-1024x428.png
If you follow the link: http ://americasfootcenter .com/automated.refund.application.online.start.account.for.special.refund/1255bbc5b01e0284db618c7bc75d643c/registration.php?ip=[redacted]
.. you see a webpage asking for name, address, birth date etc. looking like:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/gov_gateway_phish-1024x560.png
.. Then you are asked for your address and mobile number:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/gov_gateway_phish_2-1024x461.png
.. Next credit card details:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/gov_gateway_phish_3.png
.. Next is Bank details:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/gov_gateway_phish_4.png
.. Next is a 'done' page, where you are told that it will take 5 to 7 days to deal with and give you the refund. and you are then automatically forwarded to the genuine gov .uk start page:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/gov_gateway_phish_5.png
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email... whether it is a straight forward attempt, like this one, to -steal- your personal, bank, credit card or email and social networking log in details..."
americasfootcenter .com: 50.87.146.116: https://www.virustotal.com/en/ip-address/50.87.146.116/information/
>> https://www.virustotal.com/en/url/d49c84de37ae93540fbfbc510475c7234d7caab5faf6fc227e1c974ef3c9c4cc/analysis/
>> https://www.virustotal.com/en/url/343cda6eb20b1ade8df822e823d227e43e14a794a567934268422afa1e833d87/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-09, 15:07
FYI...
'Chat' for Ransom Attempts
- http://blog.trendmicro.com/trendlabs-security-intelligence/jigsaw-crypto-ransomware-turns-customer-centric-uses-chat-ransom-attempts/
June 9, 2016 - "... The innovation brought forth by some new JIGSAW variants? Instead of using dark web sites, it communicates to the user via… live chat. The threats displayed by these new variants (detected as Ransom_JIGSAW.H) are similar to those shown by the earlier JIGSAW variants...
JIGSAW ransom note: https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/06/jigsaw1.png
One big difference should be apparent: there is now a link which appears to go to a live chat session:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/06/jigsaw3.png
The attackers actually have people standing by to answer questions... The cybercriminals behind this JIGSAW variant didn’t build their own chat client; instead they used onWebChat, a publicly available chat platform. A script that calls the onWebChat client is embedded in the website. The connection to onWebchat’s servers is protected with SSL/TLS, making packet capture and interception more difficult in the absence of a proxy intercepting encrypted traffic. We have reached out to onWebChat and informed them of this issue.
Interestingly, the cybercriminal on the other end of the chat conversation doesn’t actually know when the user was infected. The “timer” is only based on a cookie set on the affected machine – if this cookie is deleted, the countdown resets to 24 hours. As a result, the cybercriminals are actually reliant on the user’s honesty when it comes to finding out how much ransom should be paid! There are some perverse incentives at work for cybercriminals to decide to focus on their “customers” (i.e., victims) in this way. Whatever those incentives may be, the victims of this crime now have an immediate, human voice to go to when their files are encrypted. This may predispose them to pay up if they are victimized – something we do not encourage. One more thing to note. While looking into the site hosting this instant chat, we found a -second- piece of malware that used the same site. This one, however, was “only” lockscreen malware, which can be bypassed and removed by booting into safe mode... This kind of “customer-centric” approach to ransomware is unusual, although not entirely unprecedented... Users can likewise take advantage of our free tools such as the Trend Micro Lock Screen Ransomware Tool*, which is designed to detect and remove screen-locker ransomware; as well as Trend Micro Crypto-Ransomware File Decryptor Tool**, which can decrypt certain variants of crypto-ransomware without paying the ransom or the use of the decryption key..."
* https://esupport.trendmicro.com/en-us/home/pages/technical-support/1105975.aspx
** https://esupport.trendmicro.com/solution/en-US/1114221.aspx
___
Fake 'Fedex' SPAM - leads to Andromeda
- http://blog.dynamoo.com/2016/06/malware-spam-david-bernard-agent-fedex.html
8 June 2016 23:21 - "This fake FedEx (or FeDex?) spam has a malicious attachment:
From: Secure-FeDex
Date: 8 June 2016 at 18:17
Subject: David Bernard agent Fedex
Deаr [redacted] ,
We tried tо delivеr уour item on June 08th, 2016, 10:45 АM.
The delivеry attempt failеd because thе аddress was business сlоsed оr nobodу сould sign fоr it.
Тo piсk up the package, please, рrint the receipt that is аttаchеd to this еmаil and visit FеdEx
office indicated in the invoice. If the pасkagе is nоt piсkеd up within 24 hоurs, it will bе returnеd to thе shipper.
Receipt Number: 98402839289
Eхpесted Delivеrу Dаte: June 08th, 2016
Class: Intеrnаtional Paсkаge Sеrviсe
Servicе(s): Delivеrу Cоnfirmation
Status: Notifiсatiоn sent
Thank you for choosing our service ...
In this case there was an attachment FedEx_track_98404283928.zip which unzipped into a folder FedEx_track_98404283928 containing in turn a -malicious-script- FedEx_track_98404283928.js which (according to Malwr*) attempts to download a binary from one of the following locations:
www .brusasport .com/Brusa/vario/direct/teamviiverupdate2918372.exe
www .microsoft .com/Brusa/vario/direct/teamviiverupdate2918372.exe
www .mega .net/Brusa/vario/direct/teamviiverupdate2918372.exe
www .google .com/Brusa/vario/direct/teamviiverupdate2918372.exe
www .yahoo .com/Brusa/vario/direct/teamviiverupdate2918372.exe
Only the first one is a valid download location, the rest are a smokescreen. The dropped binary has a detection rate of 5/56** but automated analysis [1] [2] [3] is inconclusive. However those reports do seem to indicate attempted network traffic to:
secure .adnxs.metalsystems .it
upfd .pilenga .co.uk
These two subdomains appears to have been hijacked from unrelated Register.IT customers and are hosted on a questionable-looking customer of OVH Italy on 188.165.157.176 ... Other -hijacked- subdomains on the same IP are:
tgr .tecnoagenzia .eu
bmp.pilenga .co.uk
maps.pilenga .co.uk
sundication .twitter.luigilatruffa .com
tit.pilenga .net
trw.pilenga .net
ocsp.pilenga .net
plda.pilenga .net
maps.pilenga .mobi
plda.pilenga .mobi
This Tweet[4] from @pancak3lullz indicates that this IP is associated with Anrdomeda rather than the usual recent patterns of Locky or Dridex (which has.. err.. dried up recently). It appears to have been a malicious IP for more than a month[5]. Of interest is that almost every part of this chain (including the spam sending IP of 31.27.229.22) is in Italy. As with a great deal of recent spam, this is delivered via a .js script in a ZIP file. If you can configure your mail filters to reject such things then you will be a whole lot safer.
Recommended blocklist:
188.165.157.176/30 "
* https://malwr.com/analysis/ZDViYmNjMjNlMmQ3NDljODk2NmEyN2I0MGIxODc3OTU/
** https://www.virustotal.com/en/file/066363c3a29fc2ee223ecd6197ab13db0e1d17fb90fb2c5ea5322b5c8fe83a1a/analysis/1465421690/
1] https://malwr.com/analysis/OGMxMzE5Nzk3YzY5NDIxMTgwODEwMzMxYTEyZmM0YmQ/
2] https://sandbox.deepviz.com/report/hash/98c276b6e8a6f8172611f8fa82586980/
3] https://www.hybrid-analysis.com/sample/066363c3a29fc2ee223ecd6197ab13db0e1d17fb90fb2c5ea5322b5c8fe83a1a?environmentId=100
4] https://twitter.com/pancak3lullz/status/727191468238983168
5] https://malwr.com/analysis/N2I4YWZlZjNkMzk3NGZlZThmNzQyYzhlOGJlODE3MGI/
___
Increased Risks from Macro-Based Malware
- https://www.us-cert.gov/ncas/current-activity/2016/06/09/Increased-Risks-Macro-Based-Malware
June 09, 2016 - "Microsoft Office applications use macros to automate routine tasks. However, macros can contain malicious code that can be used to exploit vulnerable systems. Recently, there has been a resurgence of malware that is spread via macros. Individuals and organizations should proactively secure systems against macro-based malware. Users and administrators are encouraged to review CERT's article (link* is external) on the resurgence of macro exploitation and apply recommendations outlined in CERT Australia's report** on macro security."
* https://insights.sei.cmu.edu/cert/2016/06/who-needs-to-exploit-vulnerabilities-when-you-have-macros.html
June 8, 2016
** http://www.asd.gov.au/publications/protect/Microsoft_Office_Macro_Security.pdf
___
Google Dorking ...
Google Dorking sounds harmless, but it can take your company down. Here's what you need to know to avoid being hacked
- http://www.darkreading.com/cloud/google-dorking-exposing-the-hidden-threat/a/d-id/1325842
6/9/2016
> http://www.darkreading.com/cloud-security.asp
- http://arstechnica.com/security/2016/06/more-corporate-shared-folders-in-cloud-filled-with-malware-research-finds/
Jun 9, 2016 - "About 11 percent of shared cloud folders contain nasty surprises, according to recent research..."
___
Rotten Apples: Apple-like Malicious Phishing Domains
- https://www.fireeye.com/blog/threat-research/2016/06/rotten_apples_apple.html
June 07, 2016 - "At FireEye Labs we have an automated system designed to proactively detect newly registered malicious domains. This system observed some -phishing- domains registered in the first quarter of 2016 that were designed to appear as legitimate Apple domains. These -phony-Apple-domains- were involved in phishing attacks against Apple iCloud users in China and UK. In the past we have observed several phishing domains targeting Apple, Google and Yahoo users; however, these campaigns are unique as they are serving the same malicious phishing content from different domains to target Apple users. Since January 2016 we have observed several phishing campaigns targeting the Apple IDs and passwords of Apple users. Apple provides all of its customers with an Apple ID, a centralized personal account that gives access to iCloud and other Apple features and services such as the iTunes Store and App Store. Users will provide their Apple ID to sign in to iCloud[.]com, and use the same Apple ID to set up iCloud on their iPhone, iPad, iPod Touch, Mac, or Windows computer..."
(More detail at the fireeye URL above.)
:fear::fear: :mad:
AplusWebMaster
2016-06-13, 20:00
FYI...
Malvertising: How to beat bad ads
- https://blog.malwarebytes.org/101/2016/06/truth-in-malvertising-how-to-beat-bad-ads/
June 13, 2016 - "... Malvertising, or malicious advertising, is the use of online advertising to distribute malware with little to no user interaction required. You could be researching business trends on a site like NYTimes .com and, without ever having clicked on an ad, be in trouble. A tiny piece of code hidden deep in the ad [re]directs your computer to criminal servers. These servers catalog details about your computer and its location, and then select the 'right' malware for you... the problem’s only getting worse. In 2015, Google disabled more than 780 million bad ads, a nearly 50% increase over 2014. According to RiskIQ*, in just the first half of 2015, malvertising increased 260% compared against all of 2014... infected ads often use an iframe, or invisible webpage element, to do its work. You don’t even need to click on the ad to activate it — just visit the webpage hosting the ad. (Hence the term 'drive-by download'). The iframe redirects to an exploit landing page, and malicious code attacks your system from the landing page via exploit. The exploit kit delivers malware — and 70 percent of the time, it’s ransomware..."
(More detail at the malwarebytes URL above.)
* https://www.riskiq.com/blog/riskiq-labs/tag/malvertising
:fear::fear: :mad:
AplusWebMaster
2016-06-14, 22:46
FYI...
Hacks sought to steal $3bln+ through wire-transfer fraud - FBI
- http://www.reuters.com/article/us-cyber-fraud-email-idUSKCN0Z023W
Jun 14, 2016 - "Hackers have sought to steal more than $3 billion from businesses in a pernicious, fast-growing type of scam in which criminals impersonate company executives in emails ordering large wire transfers, the Federal Bureau of Investigation warned on Tuesday. The FBI disclosed the data as it launched a public awareness campaign providing tips on how to defend against such scams... U.S. and foreign victims reported 22,143 cases involving business email compromise cases in which cyber criminals sent requests for some $3.1 billion in fraudulent transfers from October 2013 through last month, according to the FBI. That represents a significant increase from the agency's previous tally, which put attempted losses at $2.3 billion through February of this year. Supervisory Special Agent Mitchell Thompson said victims should notify the FBI immediately if they find they have been victimized in such scams, so the bureau can work with agents overseas to ask foreign banks to -freeze- the funds before fraudsters pull them out of the banking system... The bulk of the cases involved requests to transfer funds to banks in Hong Kong and China, though a total of 79 countries have been identified to date, according to the bureau. Thompson said he could not say how much money victims actually lost through the schemes, but said about one-in-four U.S. victims respond by wiring money to fraudsters... The FBI said the sharp jump in cases since its last tally was due to the high level of recent activity, as well as an effort by law enforcement agencies around the world to identify such scams as business email compromise, rather than generic wire fraud. The FBI said it has seen a 1,300 percent increase in identified exposed losses since January 2015. The size of the losses vary widely from case to case, from about $10,000 to tens of millions of dollars, according to Thompson. Austrian aircraft parts FACC said in January that it lost about 50 million euros ($55 million) through such a scam."
>> https://www.fbi.gov/cleveland/press-releases/2016/fbi-warns-of-rise-in-schemes-targeting-businesses-and-online-fraud-of-financial-officers-and-individuals
>> https://www.ic3.gov/media/2016/160614.aspx
Business Email Compromise
- http://blog.trendmicro.com/trendlabs-security-intelligence/company-cfos-targeted-bec-schemes/
June 9, 2016 - "... Today, Business Email Compromise (BEC) scammers use this regard of authority to target internal employees who may deal with and handle the finance of the company: the Chief Financial Officers (CFOs). Business Email Compromise (BEC) campaigns can be considered as one of the most dangerous threats that businesses of any size today are at risk of becoming a victim of. Not only does it not rely on detectable malicious components for its success—instead relying on pure deception and social engineering — it targets entities in the company that are responsible for the financial welfare of said company and those vulnerable to such underhanded tactics (such as executives, HR personnel, personal assistants, etc). It is a threat that can (and has already had) rob businesses blind. In our continued efforts to study and understand BECs—an effort that also included looking into the BEC incidents of the past couple of years — we discovered some underlying patterns that organizations may find interesting. Some of them include:
• 40% of BECs in the past two years have targeted CFOs more than any other company position;
• 31% of BECs used the position of CEO to set up the scam;
• Some of the most commonly used email subjects for BEC mails include the words ‘Transfer’, ‘Request’, and ‘Urgent’.
Wire frauds - Pick your poison: Apart from the now-infamous assuming of an executive’s identity or “CEO Fraud”, wire frauds can be deployed in a variety of ways — and at a cheap price, too. Malware used in BEC schemes can be purchased online for US$50, while some may even come for free. In other cases, the scam may go further than email spoofing. The cybercriminal can turn to hacking the legitimate email account to ask for wire transfers involving fraudulent accounts on the other end. Through phishing or keylogger, cybercriminals can steal credentials that would allow them to send transfer wire requests. Some may even take the air of legitimacy a notch higher via a quick phone call to seal the deal. Businesses dealing with foreign suppliers are also ripe targets for payment modification — that is, changing where the payment should be directed to... Because of the duplicitous and insidious nature of BECs, simple best practices or security solutions are not enough to effectively defend against them. BEC scams highlight how employees are the primary and final line of defense when it comes down to protecting an organization’s valued assets. Security awareness and solutions that can go beyond the traditional email threats create the barrier between company response and a thousand dollar wire transfer..."
:fear::fear: :mad:
AplusWebMaster
2016-06-15, 15:44
FYI...
Do NOT run JS email attachments ...
- http://www.infoworld.com/article/3083419/javascript/dont-run-js-email-attachments-they-can-carry-potent-ransomware.html
Jun 14, 2016 - "Attackers are infecting computers with a new ransomware program called RAA that's written entirely in -JavaScript- and locks users' files by using strong encryption. Most malware programs for Windows are written in compiled programming languages like C or C++ and take the form of portable executable files such as .exe or .dll. Others use command-line scripting such as Windows batch or PowerShell. It's rare to see client-side malware written in web-based languages such as JavaScript, which are primarily intended to be interpreted by browsers. Yet the Windows Script Host, a service built into Windows, can natively execute .js and other scripting files out of the box. Attackers have taken to this technique in recent months, with Microsoft warning about a spike in malicious email attachments containing JavaScript files back in April. Last month, security researchers from ESET warned of a wave of spam that distributes the Locky ransomware through .js attachments. In both of those cases the JavaScript files were used as malware downloaders - scripts designed to download and install a traditional malware program. In the case of RAA, however, the whole ransomware is written in JavaScript. According to experts from tech support forum BleepingComputer*, RAA relies on CryptoJS, a legitimate JavaScript library, to implement its encryption routine. The implementation appears to be solid, using the AES-256 encryption algorithm..."
* http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/
___
Advanced phishing tactics used to steal PayPal credentials
- https://blog.malwarebytes.org/cybercrime/2016/06/advanced-phishing-tactics-used-to-steal-paypal-credentials/
June 14, 2016 - "Phishers are back to using an old tactic in a -new- fashion to get hold of their victims’ credentials. One of the first lessons you will learn during anti-phishing training is to hover over the links in a mail to see if they point to the site where you would expect them to point. Although good advice, this is NOT a guarantee that you are going to be safe. Always visit sites directly, never follow the URLs presented to you in emails-or-attachments... As reported by UK malware researcher @dvk01uk*, the phishers are using -Javascript- to send the user to the promised PayPal site while the login credentials are being-sent-to-an-entirely-different domain:
> https://twitter.com/dvk01uk/status/742233789531852800
'The javascript runs as soon as the page (HTML attachment) is loaded and -intercepts- all posts to PayPal .com and -diverts- them to the actual phishing page to accept all your details, if you are unwise enough to fall for this trick.'
In this case, the phish was pointing to PayPal and the phishing page is www[dot]egypt-trips[dot]co which appears to be an unused WordPress site. (We have informed the registrant of the phish, so we hope they will take appropriate measures)... The original blogpost about this particular phish, including screenshots and code snippets, can be found here:
> https://myonlinesecurity.co.uk/very-unusual-paypal-phishing-attack/
egypt-trips[dot]co: 160.153.162.9: https://www.virustotal.com/en/ip-address/160.153.162.9/information/
>> https://www.virustotal.com/en/url/6e17808d0599170db55d58eeeb3e4a590c840a5d8d56ee9188a28013c1a3189e/analysis/
>> https://www.virustotal.com/en/url/91004547b09c91a16be19829185744ed9da1ea7dfa51215863e82f5a6a5959af/analysis/
>> https://www.virustotal.com/en/url/77bdb6ff594ee7c6c4f6154a765bf806adbfad81e89d43501251b47ab20f97d0/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-16, 14:02
FYI...
Locky/Dridex trying to come back
- https://myonlinesecurity.co.uk/locky-ransomware-dridex-banking-trojan-trying-to-come-back/
16 June 2016 - "Since yesterday 15 June 2016, we have been hearing about a slow but steady trickle of Locky ransomware / Dridex banking Trojan -JavaScript- downloaders inside zip file attachments. The first one I received on my mail server were at about 4 am UTC today. I am pretty sure these are only test mails, because the JavaScript is so well detected and the site linked to inside the JavaScript is a site that was seen several weeks ago & is currently down, although appears to have still been active yesterday at some stage. The emails that I am currently seeing this morning are very basic and simple, but they do always catch the unwary or curious user. They are all pretending to come from various yahoo email addresses with a subject of Photos and a completely blank / -empty- email body. One of the emails looks like:
From: Mitchell <Mitchell842@ yahoo .com>
Date: Thu 16/06/2016 05:55
Subject: Photos
Attachment: Photo.zip
Body content: Blank/Empty
All copies I have seen so far today contain exactly the same docment_380578378.js inside the photo.zip
(VirusTotal Detections 35/55*). Payload Security** shows the download was from shivshanti .in/n78f7gbniu
(VirusTotal detections 46/55***) which shows the same file from 2 weeks ago before the Necurs botnet went down and Locky was unable to spread with its previous intensity. It looks like our short holiday from the onslaught of email delivered malware has come to an end and we should all be prepared for a massive attack over the next few days."
* https://www.virustotal.com/en/file/5a878ac22eb059159c2976d11840bdae09111ba8e17933794dbfb23435d89bdd/analysis/1466045706/
** https://www.hybrid-analysis.com/sample/5a878ac22eb059159c2976d11840bdae09111ba8e17933794dbfb23435d89bdd?environmentId=100
Contacted Hosts
43.242.215.197
85.17.19.102
195.154.69.90
93.170.123.60
95.211.174.92
*** https://www.virustotal.com/en/file/0c357e3d47167b7370ce5578bb25c4f1c8b1cd87dbd398ecc07bccdac5087aa1/analysis/1466045706/
shivshanti .in: 43.242.215.197: https://www.virustotal.com/en/ip-address/43.242.215.197/information/
>> https://www.virustotal.com/en/url/71a4790a29fa03469af1735547e7f647be73fc00dc7fbd2e1ff18f075d38c29b/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-18, 15:30
FYI...
'Credit/Debit Card temporarily disabled' – PHISH
- https://myonlinesecurity.co.uk/we-have-temporarily-disabled-your-creditdebit-card-phishing/
18 June 2016 - "There are a few major common subjects in a phishing attempt. Lots of them are either PayPal, your Bank or your Credit Card, with a message saying some thing like :
Urgent: Your card has been stopped !
There have been unauthorised or suspicious attempts to log in to your account, please verify
Your account has exceeded its limit and needs to be verified
Your account will be suspended !
You have received a secure message from < your bank>
We are unable to verify your account information
Update Personal Information
Urgent Account Review Notification
We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
Confirmation of Order
We have temporarily disabled your Credit/Debit Card
The original email looks like this. It will NEVER be a genuine email from PayPal, your Bank or credit card so don’t ever follow the links or fill in the html (webpage) form that comes attached to the email. Note the bad spelling of norepply and the VLSA .COM that is supposed to say visa .com (using lookalike domains is a common trick that phishers use. The English Grammar in the email is just not quite right, so suggesting that this was created by somebody that doesn’t have English as their primary language...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/We-have-temporarily-disabled-your-Credit-Debit-Card-1024x700.png
This particular phishing campaign starts with an email-with-a-link. The link in this case goes to http ://adistancia.favaloro .edu.ar/themes/landingPage.html where you are invited to enter the case ID from the email:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/visa_phish_1-1024x811.png
Without the ID number, you just get an error message:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/visa_phish_1a.png
If you enter the correct ID you get:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/visa_phish_2-1024x760.png
... Which is a typical phishing page that looks very similar to a genuine visa page, if you don’t look carefully at the URL in the browser address bar. This one wants your personal details, Your SSN (US Social Security Number), your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details..."
adistancia.favaloro .edu.ar: 190.12.101.227: https://www.virustotal.com/en/ip-address/190.12.101.227/information/
>> https://www.virustotal.com/en/url/1560c11870570c194d9ad925b4e194c90f7e67c66025a44d7c9fe8624eb11c78/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-20, 13:45
FYI...
Fake 'Apple ID' SPAM / Phish
- https://myonlinesecurity.co.uk/your-apple-id-has-been-disabled-for-security-reasons-phishing/
20 June 2016 - "... Apple phishing attempt... 300 copies in the last couple of hours. The subject is one we see regularly 'Your Apple ID has been disabled for security reasons!'... several copies where all the body content is in the subject line & nothing in the body:
From: Apple <apples@ applestuffs .com>
Date: Mon 20/06/2016 11:12
Subject: Your Apple ID has been disabled for security reasons!
Attachment: None
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/Your-Apple-ID-has-been-disabled-for-security-reasons-1024x693.png
The link behind the verify now goes to http ://interwurlitzer .com/write/it.html which -redirects- to
http ://flyingstart .ca/science/disabled/apple/index.php neither of which look even vaguely like any Apple site so shouldn’t fool anybody... some careless users will click through, not look at the URL in the browser and give all their details:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/flyinmgstart_apple_phish-1024x596.png
If you are careless enough or unwise enough to enter your apple ID & password, you get to this page where they ask for all the personal & financial information:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/verify_apple_ID_ab-754x1024.png
... Watch for any site that invites you to enter -ANY- personal or financial information. It might be an email that says 'you have won a prize' or 'sign up to this website for discounts, prizes and special offers'..."
interwurlitzer .com: 87.229.45.133: https://www.virustotal.com/en/ip-address/87.229.45.133/information/
>> https://www.virustotal.com/en/url/25205836fafdff2e7452b38693d1aaf6358a5353d70998345c4a30c0fd4c7f5b/analysis/
flyingstart .ca: 67.212.91.221: https://www.virustotal.com/en/ip-address/67.212.91.221/information/
>> https://www.virustotal.com/en/url/1d29971c29e1dc65a095bb12859ade2467a14d4c37249aa851b5d44c8c57da44/analysis/
___
Fake 'Swift Payment Notice' SPAM - malicious link
- https://isc.sans.edu/diary.html?storyid=21177
2016-06-20 - "Some of our readers reported spam messages related to the recent Swift case. With all the buzz around this story, it looks legitimate to see more and more attackers using this scenario to entice victims to open malicious files. The mail subject is "Swift Payment Notice, pls check" and contains an image of a receipt embedded in an HTML page... The HTML-link-points to a malicious PE file called "SWIFT COPY.exe" (MD5: 6ccabab506ad6a8f13c6d84b955c3037). The file is downloaded from a compromized Wordpress instance and seems to contain a keylogger. Data are sent to onyeoma5050s .ddns .net. The host resolved to 95.140.125.110 but it is not valid anymore (take down already completed?). Even if PE files should be blocked by most web proxies, the current VT score remains low (6/55*) which still makes it dangerous."
* https://www.virustotal.com/en/file/364e3388c27dd27f8d07951535d1589d0a522e3c84f65529b8f2b8979732d794/analysis/
___
Fake Dropbox SPAM - js malware
- https://myonlinesecurity.co.uk/andrew-lumley-sent-you-scan001-zip/
20 June 2016 - "... an email with the subject of 'Andrew Lumley sent you Scan001.zip' pretending to come from Andrew Lumley via Dropbox <no-reply@ dropbox .com> with a link to a zip file containing 3 identical JavaScript files...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/Andrew-Lumley-sent-you-Scan001-zip-1024x715.png
20 June 2016: scan001.zip: Extracts to: scan0001.js - Current Virus total detections 3/56*
.. Payload security** shows a download from 69.20.55.160 :80/Scripts/rex7.exe (VirusTotal 3/56[3])
(Payload Security[4])... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/ccf1ebcc76bd843a1a91d49fccc5e3c91c2d37dc28c777247ea6f1c278f5e2a3/analysis/1466428353/
** https://www.reverse.it/sample/ccf1ebcc76bd843a1a91d49fccc5e3c91c2d37dc28c777247ea6f1c278f5e2a3?environmentId=100
Contacted Hosts
69.20.55.160
3] https://www.virustotal.com/en/file/06397e779f17d4bc4f2ffb8fe7aed2047e1804fd4395fa68a36b94bbf844802c/analysis/1466428353/
4] https://www.reverse.it/sample/06397e779f17d4bc4f2ffb8fe7aed2047e1804fd4395fa68a36b94bbf844802c?environmentId=100
69.20.55.160: https://www.virustotal.com/en/ip-address/69.20.55.160/information/
>> https://www.virustotal.com/en/url/4ed7b098b565be6ca21f7504ed0f18f0f1f2ed8ce5dbd282adbb070799b6b8f5/analysis/
___
Fake 'VAT Return' SPAM - macro malware
- https://myonlinesecurity.co.uk/vat-return-macro-malware-downloads-ransomware/
20 June 2016 - "... an email with the subject of 'VAT Return' pretending to come from noreply@ hmrc .gov.uk with a malicious word doc attachment is another one from the current bot runs...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/vat-return-1024x450.png
20 June 2016: vat030116-0530161.doc - Current Virus total detections 4/55*.
.. Payload Security[2] shows it downloads http ://xbdev .net/hmrc.zip (VirusTotal 4/56**)... it is Sharik which is a password stealer... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/a7ac9f54bf64e4bb09fdcf74bea7e9430c4c13d418f94add3578a806e6cfdf21/analysis/1466424536/
2] https://www.reverse.it/sample/a7ac9f54bf64e4bb09fdcf74bea7e9430c4c13d418f94add3578a806e6cfdf21?environmentId=100
** https://www.virustotal.com/en/file/2f6a504dd687df64b509158add20c2215b84b58fdaca1b016c4660af0a5b3227/analysis/1466429914/
xbdev .net: 208.97.176.242: https://www.virustotal.com/en/ip-address/208.97.176.242/information/
>> https://www.virustotal.com/en/url/21e63342ddd63908fb7073a03c5f35e57b784bcb03612bf293831f794dad86f8/analysis/
___
Fake 'PO' SPAM - Java malware attachment
- https://myonlinesecurity.co.uk/order-for-scarves-java-malware/
20 June 2016 - "An email pretending to be an order for scarves with the subject of 'Re: PO' pretending to come from Martina O’Shea <Martinashea@ maf .ae> with a Java jar attachment... One of the emails looks like:
From: Martina O’Shea <Martinashea@ maf .ae>
Date: Mon 20/06/2016 11:46
Subject: Re: PO
Attachment: 23456445.jar
Good morning
Please find attached an order for some scarves
for delivery to our warehouse in Churchfield,
Cork.
Please confirm all scarves are available and a
delivery date for same.
Many thanks.
Kind regards,
Manager – Buying Administration Dept
The Kilkenny Group ...
20 June 2016: 23456445.jar - Current Virus total detections 15/56*
I don’t have Java installed and none of the online analysers ever tell us anything really useful about java files but MALWR** does show several files being dropped or downloaded... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/61961155846e65e4f2362ad9e8da7a204099b0b26446c4c01f9a08abe55addbb/analysis/1466389366/
** https://malwr.com/analysis/NjQ0ZmUwM2RlMjY4NGY5MWI1YzczZTRlYWYwZjU4MzI/
___
JavaScript ransomware
- http://www.trendmicro.com.au/vinfo/au/security/news/cybercrime-and-digital-threats/new-raa-ransomware-uses-only-javascript-to-infect-computers
June 16, 2016 - "... ransomware called RAA is composed entirely of JavaScript and has been spreading via email attachments that pretend to be doc files with names like mgJaXnwanxlS_doc_.js. Once the JavaScript is opened, it will encrypt files in the affected machine and demand a ransom amounting roughly to US$250 to get the files. Reportedly, RAA infections display the ransom note in Russian, however, it’s only a matter of time until it’s distributed more widely and localized for other languages. Additionally, the ransomware also infects the victim’s computer by installing Pony, a well-known password-stealing malware embedded in the JavaScript file. This malware can collect browser passwords and other user information from an infected machine, and is usually used by hackers to gather critical information on infected systems. Pony is similar with banking trojans, but its behavior was not manifested in RAA. The RAA ransomware is considered unique because it’s rare to see client-side malware written in web-based languages like JavaScript, which are primarily designed to be interpreted by browsers. Microsoft has previously warned* about a spike in malicious email attachments containing JavaScript files in April 2016. The following month, security researchers alerted about spam emails that delivers and distributes the Locky ransomware via .js attachments. Both Locky and RAA uses JavaScript files as malware downloaders — designed to download and install a traditional malware program. With RAA however, the entire ransomware is written in JavaScript..."
* https://blogs.technet.microsoft.com/mmpc/2016/04/18/javascript-toting-spam-emails-what-should-you-know-and-how-to-avoid-them/
"... The spam email contains a .zip or .rar file attachment which carries a malicious JavaScript..."
> http://www.bleepingcomputer.com/news/security/the-new-raa-ransomware-is-created-entirely-using-javascript/
:fear::fear: :mad:
AplusWebMaster
2016-06-21, 15:46
FYI...
Fake 'Invoice' SPAM - malicious attachment
- https://myonlinesecurity.co.uk/fw-invoice_515002/
21 June 2016 - "An email pretending to be a sage invoice with the subject of 'FW: Invoice_515002' coming from “postmaster@footballplayers19.gq”@ footballplayers19 .gq; on behalf of; Leanna Sage Whitaker <postmaster@footballplayers19 .gq> with a zip attachment... We have been seeing a few emails over the last couple of weeks from the footballplayers*.g* domains. Some pure spam, some phishing and some malware. It looks like a mailing list that must have some vulnerability to allow external users to be sent emails via them. One of the emails looks like:
From:”postmaster@footballplayers19.gq”@ footballplayers19 .gq; on behalf of; Leanna Sage Whitaker <postmaster@ footballplayers19 .gq>
Date: Tue 21/06/2016 10:05
Subject: FW: Invoice_515002
Attachment:
Please see attached copy of the original invoice (sage_invoice_131340_711410101502668.pdf).
21 June 2016: sage_invoice_515002_3841674267107.zip: Extracts to: sage_invoice_225224_4233.exe
Current Virus total detections 6/56*.. Payload Security** shows it posts some information to a Ukrainian IP 217.12.199.87... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d22a50f6a2e2aa98197135f39113ed54a2d037e2b59d9d9faea3971997205c66/analysis/1466500334/
** https://www.hybrid-analysis.com/sample/d22a50f6a2e2aa98197135f39113ed54a2d037e2b59d9d9faea3971997205c66?environmentId=100
Contacted Hosts
217.12.199.87: https://www.virustotal.com/en/ip-address/217.12.199.87/information/
___
Fake 'RE:' SPAM - Locky .js attachment
- https://myonlinesecurity.co.uk/it-looks-like-locky-is-back/
21 June 2016 - "It looks like Locky ransomware is back tonight with a series of generic emails pretending to be invoices with the subject of 'RE:' pretending to come from random senders with a zip attachment which downloads what looks suspiciously like Locky Ransomware... None of the auto analysers can effectively decode these encrypted javascripts inside the zips... One of the emails looks like:
From: Titus Sampson <Sampson.FAC43DD@ melhonretail .com>
Date: Tue 21/06/2016 18:16
Subject: RE:
Attachment: wilbarger_invoice_181696.zip
Dear wilbarger:
Please find attached our invoice for services rendered and additional disbursements in the above-
mentioned matter.
Hoping the above to your satisfaction, we remain.
Sincerely,
Titus Sampson
General Manager
21 June 2016: wilbarger_invoice_181696.zip: Extracts to: addition-546.js - Current Virus total detections 2/56*
.. I am being told one of sites containing an encrypted Locky binary is easysupport .us/fl85xie ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/bdb7f27631e1a9c4ae2dd5b010ad6a9f61f3ea5032bdbd6976742d629f092b98/analysis/1466529396/
easysupport .us: 198.58.93.28: https://www.virustotal.com/en/ip-address/198.58.93.28/information/
>> https://www.virustotal.com/en/url/087cf262be82a734b170089475057df798ba3dc60cd7b37a15376b0911f5d3b2/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-22, 14:11
FYI...
Ransomware decrypter released
- https://www.helpnetsecurity.com/2016/06/22/decrypter-apocalypsevm/
June 22, 2016 - "... Emsisoft has added yet another ransomware decrypter tool to its stable: a decrypter for ApocalypseVM*. The tool works on the latest versions of the ransomware in question:
> https://www.helpnetsecurity.com/images/posts/Decrypter-ApocalypseVM.jpg
... The victim can then decide to use it on one, some, or all encrypted files. The tool selects the C: partition of the disk by default, but victims can choose other partitions or files to be decrypted. Emsisoft recommends testing the key first on a few files, then to proceed decrypting the rest if everything goes well with the test..."
* https://decrypter.emsisoft.com
Jun, 18, 2016 - Version: 1.0.0.23
___
Fake 'Corresponding Invoice' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/06/malware-spam-corresponding-invoice.html
22 June 2016 - "This spam has a malicious attachment... leading to Locky ransomware:
From: Althea Duke
Date: 22 June 2016 at 16:00
Subject: Corresponding Invoice
Dear lisa:
Thank you for your email regarding your order of 21 June, and sorry for the delay in replying. I am
writing to confirm receipt of your order, and to inform you that the item you requested will be delivered
by 25 June at the latest. If you require more information regarding this order, please do not hesitate to
contact me.
Also, our records show that we have not yet received payment for the previous order of 11 June,
so I would be grateful if you could send payment as soon as possible. Please find attached the
corresponding invoice.
If there is anything else you require, our company would be pleased to help. Looking forward to
hearing from you soon.
Yours sincerely
Althea Duke
Managing Director
UPDATE: A little bit of analysis, via these automated reports [1] [2].. show some download locations as:
personal-architecture .nl/6gcpaey
ding-a-ling-tel .com/b289dg
plasticsmachine .com/d43ndxna
hyip-all .com/9qwmc65
Various files are dropped, including these samples [6] [7] the latter of which is a three week old version of Locky. Go figure. The comments in this report show C2 servers at:
51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
185.82.216.55 (ITL, Bulgaria)
93.170.169.188 (PE Dunaeivskyi Denys Leonidovich, Ukraine)
Three out of those four servers are the -same- as yesterday*.
Recommended blocklist:
51.254.240.48
91.219.29.41
185.82.216.55
93.170.169.188."
* http://blog.dynamoo.com/2016/06/malware-spam-please-find-attached-our.html
1] https://malwr.com/analysis/NDE5YTY1MjMwNjVjNDdiMDhkYzhmZDE1ZmIyMTI5ZTE/
2] https://malwr.com/analysis/NWUxOTBkOGQyNzA4NDUxMTkzNGYzNWUyZGE1MjhjMGI/
6] https://virustotal.com/en/file/9d9caad76dd52b00ee362977bd0672510778b353cdf790bf63ad9dceae714b76/analysis/
7] https://virustotal.com/en/file/ed2b402d067244f97f88a0f5d8c85a6dbbc46301496f9cf777df6bd88cc9b731/analysis/
- https://myonlinesecurity.co.uk/thank-you-for-your-email-regarding-your-order-of-21-june-and-sorry-for-the-delay-in-replying-delivers-locky-ransomware/
22 June 2016 - "An email with the subject of 'Corresponding Invoice' pretending to come from random senders with a zip attachment which downloads Locky ransomware... These contain a heavily obfuscated JavaScript inside the zip. It has several layers of obfuscation. The alleged senders name matches the name in the body of the email. The job title is also random and can be anything from Sales Director, Account Director or any other position that any company might think of... This Blog post* describes how to manually deobfuscate these horridly difficult & tricky JavaScript files.
* https://malcat.moe/?p=53
One of the emails looks like:
From: Mariano Hoover <Hoover.20718@215-132 .thezone .bg>
Date: Wed 22/06/2016 15:10
Subject: Corresponding Invoice
Attachment: rob_unpaid_673442.zip
Dear rob:
Thank you for your email regarding your order of 21 June, and sorry for the delay in replying. I am
writing to confirm receipt of your order, and to inform you that the item you requested will be delivered
by 25 June at the latest. If you require more information regarding this order, please do not hesitate to
contact me.
Also, our records show that we have not yet received payment for the previous order of 11 June,
so I would be grateful if you could send payment as soon as possible. Please find attached the
corresponding invoice.
If there is anything else you require, our company would be pleased to help. Looking forward to
hearing from you soon.
Yours sincerely
Mariano Hoover
Regional Sales Director
22 June 2016: rob_unpaid_673442.zip: Extracts to: unpaid-5967.js - Current Virus total detections 2/56**
.. Payload Security*** shows us downloads from totalsportnetwork .com/kpbrp2mq or modelestrazackie .za.pl/zfww8nx which are encrypted files that get decrypted by the original JavaScript files to give
%TEMP%\OVAkXuGy.exe (VirusTotal 12/55[4]). These encrypted files make it very difficult for an antivirus to prevent download because they are are plain text, albeit in total gibberish to a human reader... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
** https://www.virustotal.com/en/file/c9aeeb31a88474ae856d072de007b2bec88dc06207c825979d0692522039ee10/analysis/1466604801/
*** https://www.hybrid-analysis.com/sample/c9aeeb31a88474ae856d072de007b2bec88dc06207c825979d0692522039ee10?environmentId=100
Contacted Hosts
192.186.209.5
193.203.99.113
4] https://www.virustotal.com/en/file/ffe1f28ea563d13f819c69c75406ef099a16bdf3138d51b8cb1a806d7acbbb7f/analysis/
___
Fake 'On Hold Transactions' SPAM - malicious attachment
- https://myonlinesecurity.co.uk/on-hold-transactions-from-21-06-2016-xpress-money-services/
22 June 2016 - "An email with the subject of 'On Hold Transactions From 21.06.2016' pretending to come from Saeed Abugharbieh <saeed.abugharbieh@ xpressmoney .com> with a zip attachment that contains a Barys Trojan and a copy of the image in the email. The .exe file drops a JAVA jar file that is most likely Java Jacksbot Trojan...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/On-Hold-Transactions-1024x552.png
22 June 2016: On Hold Transactions From 21.06.2016.zip: Extracts to: On Hold Transactions From 21.06.2016.exe
Current Virus total detections 15/56*.. MALWR** shows this drops a JAVA.jar file 812594500.jar which appears to be Java Jacksbot Trojan (VirusTotal 29/56***). MALWR[4]... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/c79000167a1ba40bbf4c38425f1e0eb1932bfeb8e555458944ed602ea4c4249c/analysis/1466613297/
** https://malwr.com/analysis/MjgyMjg5NTEzOTQyNDk0NWE1ZTI4NmY1MjY3YmFiMzY/
*** https://www.virustotal.com/en/file/94e432834e18aeb4e7aab87cf7f162bc9a3c342daaf3c26e5e8a8cfbfde38e6f/analysis/1466613895/
4] https://malwr.com/analysis/NzJmMmVkNWE2ZjRkNGIxODg0ZGRkM2M0MTdhZDJhZjI/
___
Fake 'Payment' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/our-records-show-that-we-have-not-yet-received-payment-for-the-previous-order-delivers-locky/
22 June 2016 - "An email with the subject of 'Payment' pretending to come from random senders with a zip attachment which downloads Locky ransomware... These contain a heavily obfuscated JavaScript inside the zip. It has several layers of obfuscation. The alleged senders name matches the name in the body of the email. The job title is also random and can be anything from Sales Director, Account Director or any other position that any company might think of... This Blog post* describes how to manually deobfuscate... JavaScript files. The JavaScript in this one is the -same- as THIS earlier run of Locky downloaders**...
* https://malcat.moe/?p=53
** >> https://myonlinesecurity.co.uk/thank-you-for-your-email-regarding-your-order-of-21-june-and-sorry-for-the-delay-in-replying-delivers-locky-ransomware/
One of the emails looks like:
From: Luz Odonnell <Odonnell.198@ frionline .com.br>
Date: Wed 22/06/2016 20:36
Subject: Payment
Attachment: details_rob_440235.zip
Dear rob,
Our records show that we have not yet received payment for the previous order #A-440235
Could you please send payment as soon as possible?
Please find attached file for details.
Yours sincerely
Luz Odonnell
Head of Maintenance
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
___
Fake 'documents for your reference' PHISH
- https://myonlinesecurity.co.uk/please-find-below-documents-for-your-reference-kindly-sign-owa-phishing/
22 June 2016 - "An email saying 'Please find below documents for your reference kindly sign' pretending to come from gccremittance@ emirates .net.ae is one of the latest -phish- attempts to steal your Outlook Web App log on details which is generally your Microsoft account details...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/gccremittance-1024x471.png
-If- you follow the link http ://intimeshop .com/reviews/cgi-bin/login sure owa/index.html which goes to you get a pop up message:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/timeshop1-1024x193.png
.. press OK & you go to:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/timeshop2-1024x536.png
After giving an email address & password you are sent to:
http ://integrare .inf.br/images/Servicos/process/process.php which is currently giving a 404 error... these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
intimeshop .com: 195.154.232.157: https://www.virustotal.com/en/ip-address/195.154.232.157/information/
>> https://www.virustotal.com/en/url/9fc84eb3d4181742f5143f79710f4322e44e53beaef03085842a6989cb514981/analysis/
integrare .inf.br: 177.12.163.97: https://www.virustotal.com/en/ip-address/177.12.163.97/information/
___
Fake 'invoice' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/06/malware-spam-please-find-attached-our.html
21 June 2016 - "This malicious spam leads to Locky ransomware, something that we haven't seen for several weeks:
From: Lilian Fletcher
Date: 21 June 2016 at 20:01
Subject: Re:
Dear lisa:
Please find attached our invoice for services rendered and additional disbursements in the above-
mentioned matter.
Hoping the above to your satisfaction, we remain.
Sincerely,
Lilian Fletcher
Head of Maintenance
These are being sent out in huge numbers at the moment. Details vary from message to message, but the body text is essentially the same. Attached is a ZIP file containing the words 'addition', 'invoice' or 'services' plus the recipients email address and a number (e.g. lisa_addition_278292.zip) containing a malicious script beginning with the word "addition"... Analysis.. shows that it phones home to:
51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
185.82.216.55 (ITL, Bulgaria)
217.12.223.83 (ITL, Ukraine)
As I mentioned before, this is Locky ransomware which has not been circulating at all since about 31st May.
Recommended blocklist:
51.254.240.48
91.219.29.41
185.82.216.55
217.12.223.83 "
51.254.240.48: https://www.virustotal.com/en/ip-address/51.254.240.48/information/
>> https://www.virustotal.com/en/url/8c79d4515652c405d248bc7527ce9cd3819e2705c1d05266741137582984e1d3/analysis/
91.219.29.41: https://www.virustotal.com/en/ip-address/91.219.29.41/information/
>> https://www.virustotal.com/en/url/e7d4b3cef886109b057aeb8ef3b55be82176ee85a987f645be71d3b86f422a51/analysis/
185.82.216.55: https://www.virustotal.com/en/ip-address/185.82.216.55/information/
>> https://www.virustotal.com/en/url/2554e01ef0f17970baab94c980d8673847097668e550a032983c103a186c2f8b/analysis/
217.12.223.83: https://www.virustotal.com/en/ip-address/217.12.223.83/information/
>> https://www.virustotal.com/en/url/764c5700dccac94a1a447e26febb1f3267917a7c6aac56bf55b3ef634c71fd5e/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-23, 12:55
FYI...
Fake 'report' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/06/malware-spam-final-version-of-report.html
23 June 2016 - "This spam leads to malware:
From: Julianne Pittman
Date: 23 June 2016 at 09:48
Subject: Final version of the report
Dear info,
Patrica Ramirez asked me to send you the attached Word document, which contains the final version of the report.
Please let me know if you have any trouble with the file, and please let Patrica know if you have any questions about the contents of the report.
Kind regards
Julianne Pittman
Operations Director (CEO Designate)
The names in each version of the email vary. Attached is a ZIP file with a filename containing some version of the recipients email address and the word "report" which contains in turn a malicious ZIP .js script beginning with the words "unpaid"...
UPDATE... Hybrid Analysis of three sample scripts [1] [2].. show three download locations (you can bet there will be many more):
bptec .ir/kvk9leho
promoresults .com.au/gx4al
boranwebshop .nl/ggc7ld
Each one drops a slightly different binary (VirusTotal results [4] [5]..).. C2 servers are at:
51.254.240.48 (Rackspace, US)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
217.12.223.88 (ITL, Ukraine)
195.123.209.227 (ITL, Latvia)
93.170.169.188 (PE Dunaeivskyi Denys Leonidovich, Ukraine)
The malware uses the path /upload/_dispatch.php on the C2 servers.
Recommended blocklist:
51.254.240.48
91.219.29.41
217.12.223.88
195.123.209.227
93.170.169.188 "
1] https://www.hybrid-analysis.com/sample/1a0b5636e168c262e7c0d9c4a7a88874877856615c2207d7c82d7349cfd557e4?environmentId=100
2] https://www.hybrid-analysis.com/sample/3d24b8d7b80b43afcd323a9bc1bc4369b4875879611616c350a67714e7f3556e?environmentId=100
4] https://www.virustotal.com/en/file/26944c2d9c69bf2582ec8296a67dbc3c6c243d11092f8c185e43c0a0f4d4773e/analysis/
5] https://www.virustotal.com/en/file/86e9f22e9fc108ccea48bde6eb8f763d6e6b1fcb0831844bc4c6a9ba0a2591e5/analysis/
- https://myonlinesecurity.co.uk/final-version-of-the-report-malspam-leads-to-locky-ransomware/
23 June 2016 - "An email with the subject of 'Final version of the report' pretending to come from random senders with a zip attachment containing a JavaScript file which downloads Locky Ransomware... One of the emails looks like:
From: Jeri Kline <Kline.35895@ moon-maker .com>
Date: Thu 23/06/2016 09:41
Subject: Final version of the report
Attachment: rob_scan_report_094249.zip
Dear rob,
Randall Franks asked me to send you the attached Word document, which contains the final version of the report.
Please let me know if you have any trouble with the file, and please let Randall know if you have any questions about the contents of the report.
Kind regards
Jeri Kline
Key Account Director Municipalities
23 June 2016: rob_scan_report_094249.zip: Extracts to: unpaid-068.js - Current Virus total detections 1/56*
.. Payload security** shows a download of encrypted Locky from
abligl .com/8v62l4i4 which the JavaScript from the email converts to 2oyWQ1WPdr1i.exe (VirusTotal 4/55***).
These encrypted files make it very difficult for an antivirus to prevent download because they are just plain text, albeit in total gibberish to a human reader... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/d44a916aab7adab16e0440f766138e3036e30e64eca2575421545693e685cf7d/analysis/1466674224/
** https://www.hybrid-analysis.com/sample/d44a916aab7adab16e0440f766138e3036e30e64eca2575421545693e685cf7d?environmentId=100
Contacted Hosts
160.153.73.196
*** https://www.virustotal.com/en/file/9211fe83e68c1f650c2f65bd23068bea710a484a36405a0062a25d7d9b1b6425/analysis/1466674585/
abligl .com: 160.153.73.196: https://www.virustotal.com/en/ip-address/160.153.73.196/information/
>> https://www.virustotal.com/en/url/d39b70937527d25f042622f52f6cec8ca827dc69bf2afb8644937990be09a652/analysis/
___
Fake 'swift copy' SPAM - malspam RTF exploit
- https://myonlinesecurity.co.uk/please-kindly-find-attached-your-swift-copy-of-payment-malspam-with-rtf-exploit/
23 June 2016 - "An email with the subject of 'Fwd: Re: TT-USD78600.00' pretending to come from barat.mnupack@ mnubd .com with a malicious word doc attachment is an attempt to exploit CVE-2010-3333 which is a buffer overflow in word RTF files...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/Fwd-Re-TT-USD78600-1024x447.png
23 June 2016: TRANSFER STATEMENT.doc - Current Virus total detections 15/55*
.. where it is described as CVE-2010-3333[1] exploit which was fixed by Microsoft in 2010/2011...
Update: The download site is http ://www.akkoprint .ro/wp-content/uploads/2016/06/office.exe (VirusTotal 43/55**)
Payload Security*** ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/f86ae6af50668da4fe06e17f4fd8534b038fc0eeddee16f3102a2eeab5bb1b16/analysis/1466692832/
1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3333
Last revised: 09/21/2011
** https://www.virustotal.com/en/file/17ef0fc9f1d3ae56620d04b98efe906145ee48dab9ea50bfe4b79323af486132/analysis/1466711510/
*** https://www.hybrid-analysis.com/sample/17ef0fc9f1d3ae56620d04b98efe906145ee48dab9ea50bfe4b79323af486132?environmentId=100
Contacted Hosts
111.90.144.71
akkoprint .ro: 5.2.228.65: https://www.virustotal.com/en/ip-address/5.2.228.65/information/
>> https://www.virustotal.com/en/url/0caf64dc0fbc66b9b375578c45893b0cfdb3122d738b2bef6a7bd73c28a7abbb/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-24, 17:42
FYI...
Ransomware epidemic - 2014-2016
- https://securelist.com/analysis/publications/75145/pc-ransomware-in-2014-2016/
June 22, 2016 - "... Main findings:
• The total number of users who encountered ransomware between April 2015 and March 2016 rose by 17.7% compared to the previous 12 months (April 2014 to March 2015) – from 1,967,784 to 2,315,931 users around the world;
• The proportion of users who encountered ransomware at least once out of the total number of users who encountered malware rose 0.7 percentage points, from 3.63% in 2014-2015 to 4.34% in 2015-2016;
• Among those who encountered ransomware, the proportion who encountered cryptors rose dramatically – up 25 percentage points, from 6.6% in 2014-2015 to 31.6% in 2015-2016;
• The number of users attacked with cryptors rose 5.5 times, from 131,111 in 2014-2015 to 718,536 in 2015-2016;
• The number of users attacked with Win-lockers decreased 13.03%, from 1,836,673 in 2014-2015 to 1,597,395 in 2015-2016..."
> https://noransom.kaspersky.com/
> https://www.helpnetsecurity.com/2016/06/24/crypto-ransomware-attacks-hit-700000-users/
June 24, 2016 - "... increase in encryption ransomware attacks, with 718,536 users hit between April 2015 and March 2016. This is an increase of 5.5 times compared to the same period in 2014-2015, showing that crypto-ransomware has become an epidemic..."
___
Piracy extortion SCAM emails
- https://torrentfreak.com/piracy-phishing-scam-targets-u-s-isps-subscribers-160624/
Jun 24, 2016 - "... TorrentFreak was alerted to a takedown notice Lionsgate purportedly sent to a Cox subscriber, for allegedly downloading a pirated copy of the movie Allegiant. Under threat of a lawsuit, the subscriber was asked to pay a $150 settlement fee. This request is unique as neither Lionsgate nor its tracking company IP-Echelon are known to engage in this practice. When we contacted IP-Echelon about Lionsgate’s supposed settlement offer, we heard to our surprise that these emails are part of a large phishing scam, which has at least one large ISPs fooled. 'The notices are fake and not sent by us. It’s a phishing scam', IP-Echelon informed TorrentFreak. For a phishing scam the -fake- DMCA notice does its job well. At first sight the email appears to be legit, and for Cox Communications it was real enough to forward it to their customers... In response, a Cox representative confirmed that the email is real and explained that it was forwarded by the network security team. Apparently, the -phishing-scam- was good enough to have the security experts fooled. TorrentFreak alerted Cox to the -fake- notices but at the time of writing we have yet to receive a response. Whether any other ISPs have fallen for the same scam is unknown at this point..."
:fear::fear: :mad:
AplusWebMaster
2016-06-27, 12:52
FYI...
Fake 'DOC' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/06/malware-spam-doc1234-document4321.html
27 June 2016 - "This rather terse spam run leads to Locky ransomware and appears to come from the sender's own email account (but doesn't*). The subject is some variation of DOC / Document / document plus a number. There is a ZIP file attached with a name matching the subject, there is no body text.
* http://blog.dynamoo.com/2011/09/why-am-i-sending-myself-spam.html
Some examples:
Subject: DOC541887
Attachment: DOC541887.zip
Subject: document36168
Attachment: document36168.zip
Subject: Document453567810
Attachment: Document453567810.zip
Contained within the ZIP file is one of several different .js scripts. Trusted third-party analysis (you know who you are, thank you!) shows download locations at:
calcoastlogistics .com/09ujnb76v5?yNVICJbit=nFikKFve
labthanhthanhpg .com/09ujnb76v5?yNVICJbit=nFikKFve
patmagifts .asia/09ujnb76v5?yNVICJbit=nFikKFve
shadowbi .com/09ujnb76v5?yNVICJbit=nFikKFve
www .tmdmagento .com/09ujnb76v5?yNVICJbit=nFikKFve
Detection rates for the dropped binary are 5/54**. The malware phones home to the following IPs:
51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
217.12.223.88 (ITL, Ukraine)
195.123.209.227 (ITL, Latvia)
185.82.216.61 (ITL, Bulgaria)
Recommended blocklist:
51.254.240.48
217.12.223.88
195.123.209.227
185.82.216.61 "
** https://www.virustotal.com/en/file/3f5ff5d9d0615cc04e644297dcbfa999f6d6930850848f038464d0a486e6b8d0/analysis/
___
Fake 'Requested document' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/06/malware-spam-requested-document.html
27 June 2016 - "This spam comes from various senders, and leads to Locky ransomware:
From: Trudy Bonner
Date: 27 June 2016 at 15:39
Subject: Requested document
Dear [redacted],
The document you requested is attached.
Best regards
Trudy Bonner
Group Director of Strategy
Attached is a ZIP file containing elements of the recipients email address, the words "document", "doc" or "scanned" plus a random number. Contained within is a random .js script beginning with 'unpaid'. Trusted external analysis (thank you as ever) shows the scripts downloading... The malware phones home to the following hosts:
51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
109.234.35.71 (McHost.ru, Russia)
185.82.216.61 (ITL, Bulgaria)
185.146.169.16 (Pavel Poddubniy aka CloudPro, Russia)
195.123.209.227 (ITL, Latvia)
217.12.223.88 (ITL, Ukraine)
217.12.223.89 (ITL, Ukraine)
Lots of ITL recently... you might want to block /24s here instead of single IPs.
Recommended blocklist:
51.254.240.48
109.234.35.71
185.82.216.61
185.146.169.16
195.123.209.227
217.12.223.88
217.12.223.89 "
___
Fake 'Barclays security update' – Phish
- https://myonlinesecurity.co.uk/new-barclays-security-update-phishing-scam/
27 June 2016 - "After the Brexit vote on Thursday, we are starting to see the scammers and phishers using the uncertainty, fear and doubt about the UK and the EU to scam you. The first one today is an email pretending to come from Barclays bank saying New Barclays security update. The original email looks like this:
From: Barclays Online <Barclays@ bt .co.uk>
Date: Mon 27/06/2016 08:01
Subject: New Barclays security update.
Dear Customer
Due to security and removal from the EU we have introduce the new look of Barclays Bank security to help maintain our customers profit
You would be required to re – activate your online banking access to proceed
Activate Your Online Security
Thank you for choosing Barclays Bank.(c)2016
The link behind the activate line goes to http ://whatdoesmybusinessneed .com/wp-admin/hhaa.html and -redirects-
to another page on the same hacked site http ://whatdoesmybusinessneed .com/wp-admin/auth/b.htm
where they have a fairly good imitation of a genuine Barclays bank site asking for all the usual personal data, log ins and financial information."
whatdoesmybusinessneed .com: 104.244.124.101: https://www.virustotal.com/en/ip-address/104.244.124.101/information/
>> https://www.virustotal.com/en/url/42910326baaa24b80e274ccb5683d07f2d8084dd118b7967126dd86aed2c4ba4/analysis/
:fear::fear: :mad:
AplusWebMaster
2016-06-28, 13:57
FYI...
Fake 'report' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/06/malware-spam-report-ie-attached-report.html
28 June 2016 - "This spam has a weird problem with its apostrophe and comes with a malicious attachment:
From: Kris Ruiz
Date: 28 June 2016 at 10:38
Subject: report
Hi info,
I致e attached the report you asked me to send.
Regards
Kris Ruiz
Head of Finance UKGI Planning
The details of the sender will vary from message to message. Attached is a ZIP file containing components of the recipient's email address and the words "report" and/or "pdf". Contained within is a malicious .js script file with a name starting with 'swift'. This analysis comes from a trusted third party (thank you again). The script downloads a file... The file is then decrypted (although I don't have a sample yet) and appears to be Locky ransomware. It phones home to the following servers:
109.234.35.71 (McHost.ru, Russia)
185.146.169.16 (Pavel Poddubniy aka Cloudpro LLC, Russia)
193.9.28.254 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
194.31.59.147 (HostBar, Russia)
195.123.209.227 (Layer6 Networks, Latvia)
217.12.223.88 (ITL, Ukraine)
217.12.223.89 (ITL, Ukraine)
Recommended blocklist:
109.234.35.71
185.146.169.16
193.9.28.254
194.31.59.147
195.123.209.227
217.12.223.88
217.12.223.89 "
___
Fake 'Money Certificate' SPAM - java jacksbot Trojan
- https://myonlinesecurity.co.uk/new-xpress-money-certificate-java-jacksbot-trojan/
28 June 2016 - "An email with the subject of 'New Xpress Money Certificate' pretending to come from xm.ca@ xpressmoney .com with a zip attachment which delivers a java jacksbot Trojan...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/New-Xpress-Money-Certificate-1024x536.png
28 June 2016: New Xpress Money Certificate.zip: Extracts to: New Xpress Money Certificate.jar and a copy of the image in the email. Current Virus total detections 24/55*
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/6fe3370b10d1e41c2fa22b9651604db4636fad9cb5029d3015b262bb973c29d2/analysis/1467110905/
.JAR File: "... runs -if- the [Java] JRE is installed on the computer.."
:fear::fear: :mad:
AplusWebMaster
2016-06-29, 14:16
FYI...
Fake 'Additional Order' SPAM - delivers Java Adwind backdoor Trojan
- https://myonlinesecurity.co.uk/additional-order-additional-items-malspam-delivering-java-adwind-backdoor-trojan/
29 June 2016 - "An email with the subject of 'Additional Order (Additional Items)' pretending to come from Ahmed <Ahmed@ malothgroups .com> with a java .jar which is a variant of Java Adwind Trojan. These are very nasty backdoor Remote Access, password stealers...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/Additional-Order-Additional-Items-1024x668.png
29 June 2016: PO_70386804.jar - Current Virus total detections 15/56*. Payload Security** shows a contact with a Russian IP number 185.17.1.82 which is fairly well known for malicious activity over the last few weeks although nothing appearing on VirusTotal, until today... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/5dea187ee0102862c61808e31fc3ea604a6708270a433e08ee88c42f8493da4f/analysis/1467176037/
** https://www.reverse.it/sample/5dea187ee0102862c61808e31fc3ea604a6708270a433e08ee88c42f8493da4f?environmentId=100
Contacted Hosts
185.17.1.82: https://www.virustotal.com/en/ip-address/185.17.1.82/information/
> https://virustotal.com/en/url/f369d5544946201e7416798cd16f3ea98bd1091b1a275d64f1ce570af9de2e47/analysis/
___
Fake 'Financial report' SPAM - malicious attachment
- http://blog.dynamoo.com/2016/06/malware-spam-financial-report-i-have.html
29 June 2016 - "This spam appears to come from various sources, but has a malicious attachment:
From: Hester Stanley
Date: 29 June 2016 at 13:25
Subject: Financial report
Hello [redacted],
I have attached the financial report you requested.
Regards
Hester Stanley
Chief Executive Officer
Attached is a ZIP file containing some version of the recipient's email address, the words "report" or "freport" or "financial" plus a number. This contains a malicious .js file beginning with "swift". Trusted analysis by another party (thank you as ever) gives download locations... The payload is Locky ransomware, phoning home to the following servers:
93.170.123.219 (PE Gornostay Mikhailo Ivanovich aka time-host.net, Ukraine)
149.154.159.125 (EDIS, Germany)
151.236.17.45 (EDIS, Germany)
151.236.17.47 (EDIS, Germany)
194.31.59.147 (Hostbar, Russia)
I don't currently have a copy of the payload.
Recommended blocklist:
93.170.123.219
149.154.159.125
151.236.17.45
151.236.17.47
194.31.59.147 "
- https://myonlinesecurity.co.uk/continuing-with-locky-delivered-via-malspam/
29 June 2016 - "... continual Locky JavaScript downloaders... Today’s are no different so far coming in 2 batches. 1st about a financial report and the second with a totally blank body saying images, photos or pictures. The 1st ones contain a heavily obfuscated JavaScript inside the zip. It has several layers of obfuscation. The alleged senders name matches the name in the body of the email. The job title is also random and can be anything from Sales Director, Account Director or any other position that any company might think of... They all deliver Ransomware versions that encrypt your files and demand money...
29 June 2016: photo42744.zip: Extracts to: NIKON00061473034407.js - Current Virus total detections 10/54*
.. MALWR** shows a download from http ://www.cristaleriadominguez .com/8y7gvt65v?utajtJu=UwxvtvuRe which was -renamed- on download to spuMCzFlvvg.exe (VirusTotal 6/53***).
29 June 2016: rob_report_xls_227699.zip: Extracts to: swift 7c7.js - Current Virus total detections 2/54[4]
.. MALWR [5] shows a download from http ://www.oemsen.gmxhome .de/sh91u3a which gives an encrypted file that is detected as plain txt or data but gets -converted- by the javascript to ye6WVhz4F2H94WZX.exe (VirusTotal 5/56[6])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/fbec22d0d98b4fb2013d445c450814c9a6773e163fe5c97d0ae9d72b7f65289f/analysis/1467205005/
** https://malwr.com/analysis/N2I2MTc2MDQzYmFiNDAxYWFjNjEwMWNmYWVhMzFiMmM/
Hosts
62.42.230.17
*** https://www.virustotal.com/en/file/2fcd597cef85c840072220a4742941c57cb1b19aee71107828faafa06d2f57b7/analysis/1467202241/
4] https://www.virustotal.com/en/file/694f4f829b0605da7217d8e8dc41084874eccf3a3031bc65685682a077d10a9f/analysis/1467204977/
5] https://malwr.com/analysis/MzNlNGI4ZDg2NjY0NDY5NGJmY2M3MWI0ZThlMGUwZTg/
Hosts
82.165.62.68
6] https://www.virustotal.com/en/file/a7384c1ce74a1ec82c699e20db01d370c8adaa9b1d6ad9878dae094547e31a03/analysis/1467200971/
cristaleriadominguez .com: 62.42.230.17: https://www.virustotal.com/en/ip-address/62.42.230.17/information/
>> https://www.virustotal.com/en/url/9e28b8cfceea7f640205ab3628cff0aab67069b398155586a81228b8745d8743/analysis/
oemsen.gmxhome .de: 82.165.62.68: https://www.virustotal.com/en/ip-address/82.165.62.68/information/
>> https://www.virustotal.com/en/url/98fdeb531a4f71f4290574953c499d0f39cc60dc7012d713bc197ddfdfcf751b/analysis/
___
Phish - via JavaScript Google
- https://myonlinesecurity.co.uk/phishing-via-javascript-google-this-time-not-paypal/
29 June 2016 - "... This one fulfils our worst fears and the entire -phish- is performed on a website that actually is the genuine Google log in page and really makes you believe that you are entering your Google credentials only on the genuine Google page, but in fact you are sending your details to the phisher whilst on the genuine Google site... shortly after publishing this post & reporting the http ://goo .gl/NL4EmV to Google, they -removed- that short URL redirect. However the nwfacilities page is still-active & live and it will be trivial for the phisher to create other short urls on Goo .gl and malspam them out... This is the Genuine Google page that you are on while your browser still has the http ://nwfacilities .top pages & JavaScript still loaded but -hidden- to view completely and performing all the nefarious actions and stealing your information. The only difference between you going to the Google log in page yourself & this one are the words data:text/html, at the start of the url
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/google_phish_javascript-1024x791.png
This only appears to work in Google Chrome because Internet Explorer gives this message and doesn’t know what to do with data:text/html commands in the browser (thankfully). Firefox just gives a blank page until you use the view source option:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/IE_Google_phish.png "
:fear::fear: :mad:
AplusWebMaster
2016-06-30, 12:08
FYI...
Fake 'WeTransfer' SPAM - delivers Cerber ransomware
- https://myonlinesecurity.co.uk/wetransfer-random-name-at-your-own-domain-has-sent-you-a-file-malspam-delivers-cerber-ransomware/
30 June 2016 - "An email with the subject of 'name@ victim domain .tld' has sent you a file via 'WeTransfer' pretending to come from WeTransfer <noreply@ wetransfer .com> with a link to download a zip attachment which downloads Cerber Ransomware. Luckily Cerber doesn’t mass malspam in the same way that Locky does. These Cerber emails tend to be slightly more targeted (spear Phishing) at small business or organisations where IT might not be such a high priority or be so aware...
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/we-transfer-sent-you-a-file-1024x712.png
The link behind the download goes to
https ://www.cubbyusercontent .com/pl/Scanned+Documents.zip/_08fa4c28262f424b970037c786caf840 -not- to any WeTransfer page...
30 June 2016: Scanned Documents.zip: Extracts to: 3 identical copies of Scan001.js
Current Virus total detections 1/53*. MALWR** shows a download of Cerber Ransomware from
http ://69.24.80.121 /Styles/ie7/header.css which is -not- a css file but a -renamed- .exe file
(VirusTotal 4/53***).. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/8bdfe41712f323f21ac518c9402db3fbf00f6c6855ad58fd15cd44b4c3781509/analysis/1467276692/
** https://malwr.com/analysis/MGQ5OTc2NGE4MGJkNGMwMTgwMmFmODQwYTUyMmMxZmU/
*** https://www.virustotal.com/en/file/1423e6fa22181cec6b1da4f8585958a584c0bfc8bcd4f4f597849856f76330a9/analysis/1467276011/
69.24.80.121: https://www.virustotal.com/en/ip-address/69.24.80.121/information/
>> https://www.virustotal.com/en/url/f186bf688f0bb18916967c004675666d59b7fd524326fdc05f1bae61e456dbd9/analysis/
___
Phish - with Blurred Images
- https://isc.sans.edu/diary.html?storyid=21207
Last Updated: 2016-06-30 - "... seeing a lot of phishing emails that try to steal credentials from victims... this time, the scenario is quite different:
- The malicious email contains an HTML body with nice logos and texts pretending to be from a renowned company or service provider. There is a link that opens a page with a -fake- document but -blurred- with a popup login page on top of it. The victim is enticed to enter his/her credentials to read the document. I found samples for most of the well-known office documents. Here are some screenshots:
1] https://isc.sans.edu/diaryimages/images/isc_blurry1.png
2] https://isc.sans.edu/diaryimages/images/isc_blurry2.png
3] https://isc.sans.edu/diaryimages/images/isc_blurry3.png
4] https://isc.sans.edu/diaryimages/images/isc_blurry4.png
The strange fact is that it is -not- clear which credentials are targeted: Google, Microsoft or corporate accounts? The success of an efficient phishing is to take the victim by the hand and "force" him/her to -disclose- what we are expecting. So, nothing fancy behind this kind of phishing but it’s always interesting to perform further investigations and, for one of them, it was a good idea. Everybody makes mistakes and attackers too! The phishing page was hosted on a Brazilian website. Usually, such material is hosted on a -compromised- CMS like, not mentioning names but Wordpress, Joomla or Drupal. The Apache server had the feature 'directory indexing' enabled making all the files publicly available and, amongst the .php and .js files, a zip archive containing the "package" used by the attackers to build the phishing campaign. It was too tempting to have a look at it. The “blurred” effect was implemented in a very easy way: the -fake- document is a low-resolution screenshot displayed with a higher resolution. Like this:
> https://isc.sans.edu/diaryimages/images/blurred.jpg
... the presence of a JavaScript function to validate the victim’s email address but also to check the TLD. Is it a targeted attack? The presence of .mil, .edu or .gov is interesting while .com included all major -free- email providers... Then, an HTTP -redirect- is performed to a second page: "phone.html" which mimics a Google authentication page and asks for the user phone number. Here again, POST data are processed via "phone.php" which sends a second email with the victim's phone number. Emails are sent to two addresses (not disclosed here):
One @gmail .com account
One @inbox .ru account ..."
AVOID and DELETE.
:fear::fear: :mad:
AplusWebMaster
2016-07-01, 13:28
FYI...
Fake 'Transactions' SPAM - Java adwind Trojans
- https://myonlinesecurity.co.uk/malspam-emails-with-java-adwind-trojans/
1 July 2016 - "We are seeing emails -daily- with a zip attachment containing java jar file which are variants of Java Adwind Trojan(1)... There are 2 different emails that arrived overnight both containing the same Java Adwind Trojan, although both having different subjects, senders and file names. For some reason the image that appears in the -body- of the email is also included in the zip files...
1) https://securelist.com/blog/research/73660/adwind-faq/
Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/07/confirm-to-release-1024x660.png
The Second email looks like:
From: z.hraahleh@ shift-sg .com <sales@ planetacyber .psi.br>
Date: Fri 01/07/2016 02:44
Subject: Transactions for Amendment
Attachment: PENDING REMITTANCE RECIEPTS FOR APPROVAL.zip extracts to PENDING REMITTANCE RECIEPTS FOR APPROVAL..jar
kindly find attached listed trasactions for amendment,please do the corrections and send back to us. thanks
Screenshot: NONE of the email but this logo was in the zip:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/07/logo1.png
1 July 2016: Confirm Transactions.zip: Extracts to: Transactions on Hold.Reason because beneficiary last name is wrong..jar
Current Virus total detections 15/56*. MALWR** shows the usual masses of files created/dropped and entries created on the computer. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/9d84124240032c60948c7df4cffa9c85f8609cf262bc7b94d6f186ed8f43f35f/analysis/1467206759/
** https://malwr.com/analysis/ZGY1N2NkMjg4NzA3NGIxZmE5MjA0NjNhMzgyYWQ0OTc/
Hosts
89.163.154.146: https://www.virustotal.com/en/ip-address/89.163.154.146/information/
.JAR File: ... runs -if- the [Java] JRE is installed.
:fear::fear: :mad:
AplusWebMaster
2016-07-03, 05:39
FYI...
Fake 'RE: info' SPAM - Cerber Ransomware
- https://myonlinesecurity.co.uk/blank-malspam-email-with-jse-attachment-downloading-unknown-malware/
2 July 2016 - "A blank email with the subject of 'RE: info' pretending to come from asisianu@ pauleycreative .co.uk with a zip attachment with a jse file... Update: I am assured that it definitely is Cerber Ransomware... One of the emails looks like:
From: asisianu@ pauleycreative .co.uk
Date: Sat 02/07/2016 19:40
Subject: RE: info
Attachment: info_1218307442.zip
Body content: Totally blank/empty
2 July 2016: info_1218307442.zip: Extracts to: 5.jse - Current Virus total detections 2/55*
.. PayLoad Security** | MALWR*** shows a download from
http ://adiidiam .top/admin.php?f=1.jpg (which is -not- a jpg but a .exe file)
(VirusTotal 1/56[4]) (MALWR[5]) (Payload Security[6])... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/a259fb8946b843227ead174be057d2711642726ee6ef5bfb68c4773c5973d177/analysis/1467464033/
** https://www.reverse.it/sample/a259fb8946b843227ead174be057d2711642726ee6ef5bfb68c4773c5973d177?environmentId=100
Contacted Hosts
202.9.68.138
52.28.98.176
31.184.232.*
*** https://malwr.com/analysis/MjkyNWE0ZTYxZDRjNDExNGE5N2VjMzA2M2Y1YTMwMWU/
Hosts
202.9.68.138
4] https://www.virustotal.com/en/file/6df706d52dc2de68882feb0215b8848e4605e5b1f6304f77e96cdf1315e47e27/analysis/1467471194/
5] https://malwr.com/analysis/OWYyYjhlYjA4MWE2NDA4ZmJjODU2NGFiNWY2MzJhZTE/
6] https://www.reverse.it/sample/6df706d52dc2de68882feb0215b8848e4605e5b1f6304f77e96cdf1315e47e27?environmentId=100
Contacted Hosts
52.58.188.104
31.184.232.*
adiidiam .top: 66.225.198.20: https://www.virustotal.com/en/ip-address/66.225.198.20/information/
>> https://www.virustotal.com/en/url/e70cf587a841baf1c5be2c6e4113143674961e0e75c134a2c6b66fc031e31a4e/analysis/
216.170.126.19: https://www.virustotal.com/en/ip-address/216.170.126.19/information/
>> https://www.virustotal.com/en/url/297dd645ad96354335787969c79d30baeb0bdd59ac459877aec22a46eaa68843/analysis/
:fear::fear: :mad: