Fake NACHA SPAM, ransomware kits...
FYI...
NACHA .ZIP file attachment spam
- http://threattrack.tumblr.com/post/5...ttachment-spam
June 1, 2013 - "Subjects Seen:
ACH Payment rejected: #<uniq_id>
Typical e-mail details:
Ach payment canceled Transaction ID: #[removed] The ACH transaction, recently initiated from your checking account (by you or any other person), was canceled by the other financial institution.
Transaction Status: Rejected Transaction ID: [uniq number removed\
Amount : $
To view more details for this transaction , please check the attached file .
NACHA works to maintain the privacy of any personally identifiable information (name, mailing address, e-mail address, etc.) that may be collected though our Web site. This Web site has security measures in place; however, NACHA does not represent, warrant or guarantee that personal information will be protected against unauthorized access, loss, misuse or alterations. Similarly, NACHA disclaims liability for personal information submitted through this Web site. Users are hereby advised that they submit such personal information at their own risk.
Thank you,
13450 Sunrise Valley Drive
Suite 100 Herndon
VA 20171
© 2013 NACHA - The Electronic Payments Association
Malicious URLs
Spam contains a malicious attachment.
Screenshot: https://gs1.wac.edgecastcdn.net/8019...WMy1qz4rgp.png
___
iOS7 announcement prompts themed ransomware kits
- http://community.websense.com/blogs/...ware-kits.aspx
May 31, 2013 - "... phishing domain related to the imminent release of the Apple iOS7 Operating System. As gossips circulate news in the wild about iOS7 after the D11 conference... cybercriminals are setting up a foundation for phishing and malicious activities...
ios7news .net - 85.25.20.153 **
> http://community.websense.com/cfs-fi...0.sshto004.PNG
... As a ransomware toolkit, Silence Locker can generate a malicious file associated with familiar police enforcement pictures, based on the country of the potential victims. For example, in the following page the fake FBI Cyber Squad Investigation team is bound with a binary file that has been uploaded:
> http://community.websense.com/cfs-fi...1.sshto003.PNG
... we noticed that the AutoIT tool was used to package the malware. This conforms to the current trend of packaging malware to make detection more difficult. We continued our investigation by gathering some telemetry about the IP address that hosts this domain (ios7news .net). From what we discovered, it seems that this IP address is also used for other phishing domains... The domain "hxxp ://gamingdaily .us" is most likely a phishing domain for a gaming news website that is also used to host the exploit kit BleedingLife*... both IT news and rumors could be used by the attackers to leverage people's curiosity, as was done here. In this case, we can suppose (due to details such as the open directory access) that the attackers are going to use and configure that domain for malicious activities based on ransomware."
* http://community.websense.com/blogs/...ploit-kit.aspx
"... The Bleeding Life exploit kit uses exploits which can bypass ASLR and DEP, which means this product could be used successfully against Windows 7 and Windows Vista operating systems..."
** https://www.google.com/safebrowsing/...c?site=AS:8972
:mad::fear:
Malicious photo, Fivserv SPAM, Threat Outbreak Alerts ...
FYI...
Malicious photo attachment Spam
- http://threattrack.tumblr.com/post/5...ttachment-spam
June 3, 2013 - "Subjects Seen:
Check the attachment you have to react somehow to this picture
Typical e-mail details:
Hi there ,
I got to show you this picture in attachment. I can’t tell who gave it to me sorry but this chick looks a lot like your ex-gf. But who’s that dude??
Malicious File Name and MD5:
IMG[removed].zip (724bb53c12ebeb9df3e8525c6e1f9052)
ThreatAnalyzer Report: http://www.threattracksecurity.com/e...-software.aspx
- http://db.tt/2ZLJo3Wq [PDF]
Screenshot: https://gs1.wac.edgecastcdn.net/8019...1JB1qz4rgp.png
___
Fivserv Secure Email Notification Spam
- http://threattrack.tumblr.com/post/5...ification-spam
June 3, 2013 - "Subjects Seen:
Fiserv Secure Email Notification - [removed]
Typical e-mail details:
You have received a secure message
Read your secure message by opening the attachment, SecureMessage_[removed].zip.
The attached file contains the encrypted message that you have received.
To decrypt the message use the following password - [removed]
To read the encrypted message, complete the following steps:
- Double-click the encrypted message file attachment to download the file to your computer.
- Select whether to open the file or save it to your hard drive. Opening the file displays the attachment in a new browser window.
- The message is password-protected, enter your password to open it.
To access from a mobile device, forward this message to mobile-- @res.fiserv -- .com to receive a mobile login URL.
If you have concerns about the validity of this message, please contact the sender directly...
Malicious URLs
116.122.158.195 :8080/ponyb/gate.php
nourrirnotremonde .org/ponyb/gate.php
zoecopenhagen .com/ponyb/gate.php
goldenstatewealth .com/ponyb/gate.php
190.147.81.28 /yqRSQ.exe
paulcblake .com/ngY.exe
207.204.5.170 /PXVYGJx.exe
netnet-viaggi .it/2L6L.exe
Screenshot: https://gs1.wac.edgecastcdn.net/8019...qkk1qz4rgp.png
- http://blog.dynamoo.com/2013/06/fise...tion-spam.html
3 Jun 2013 - "This spam email contains an encrypted ZIP file with password-protected malware.
Date: Mon, 3 Jun 2013 14:11:14 -0500 [15:11:14 EDT]
From: Fiserv Secure Notification [secure .notification @fiserv .com]
Subject: Fiserv Secure Email Notification - IZCO4O4VUHV83W1
You have received a secure message
Read your secure message by opening the attachment, SecureMessage_IZCO4O4VUHV83W1.zip.
The attached file contains the encrypted message that you have received.
To decrypt the message use the following password - Iu1JsoKaQ
To read the encrypted message, complete the following steps:
- Double-click the encrypted message file attachment to download the file to your computer.
- Select whether to open the file or save it to your hard drive. Opening the file displays the attachment in a new browser window.
- The message is password-protected, enter your password to open it...
If you have concerns about the validity of this message, please contact the sender directly.
Of course, it would be supremely pointless password protecting a document and then including the password in the email! The file has been password protected in an attempt to thwart anti-virus software. In this case, the password for the file SecureMessage_IZCO4O4VUHV83W1.zip is Iu1JsoKaQ which in turn leads to a file called SecureMessage_06032013.exe (note the date in included in that filename). At the moment the VirusTotal detection rate is a so-so 16/47*. The ThreatTrack analysis** identifies some locations that the malware phones home to:
netnet-viaggi .it
paulcblake .com
74.54.147.146
116.122.158.195
190.147.81.28
194.184.71.7
207.204.5.170 ..."
* https://www.virustotal.com/en/file/8...is/1370289657/
File name: SecureMessage_06032013.exe
Detection ratio: 16/47
Analysis date: 2013-06-03
** http://www.dynamoo.com/files/analysi...3135add304.pdf
___
Threat Outbreak Alerts
- http://tools.cisco.com/security/cent...utbreak.x?i=77
Fake Secure Message Notification E-mail Messages - 2013 Jun 03
Malicious Attachment E-mail Messages - 2013 Jun 03
Fake Product Order E-mail Messages - 2013 Jun 03
Fake Bank Transfer Notification E-mail Messages - 2013 Jun 03
Fake Customer Complaint Notification E-mail Messages - 2013 Jun 03
Malicious Attachment E-mail Messages - 2013 Jun 03
Fake Order Invoice Notification E-mail Messages - 2013 Jun 03
Fake Payment Confirmation Notification E-mail Messages - 2013 Jun 03
Malicious Attachment E-mail Messages - 2013 Jun 03
Fake Remittance Slip with Invalid Digital Signature E-mail Messages - 2013 Jun 03
Fake Scanned Document Attachment E-mail Messages - 2013 Jun 03
Fake Product Order Quotation E-mail Messages - 2013 Jun 03
Fake Product Order Request E-mail Messages - 2013 Jun 03
Fake Online Dating Personal Photos Sharing E-mail Messages - 2013 Jun 03
Fake Purchase Order Request E-mail Messages - 2013 Jun 03
Fake Online Dating Proposal E-mail Messages - 2013 Jun 03
Fake Product Order Quotation E-mail Messages - 2013 Jun 03
Fake Processes and Subpoenas Notification E-mail Messages - 2013 Jun 03
(More detail and links available at the cisco URL above.)
:mad: :fear:
Fake Xerox WorkCentre Attachment Spam
FYI...
Fake Xerox WorkCentre Attachment Spam
- http://threattrack.tumblr.com/post/5...ttachment-spam
June 5, 2013 - "Subjects Seen:
Scanned Image from a Xerox WorkCentre
Typical e-mail details:
Reply to: Xerox.WorkCentre @[removed]
Device Name: Not Set
Device Model: XEROX-2178N
Location: Not Set
File Format: PDF (Medium)
File Name: Xerox_Scan_06-04-2013-466.zip
Resolution: 200dpi x 200dpi
Attached file is scanned image in PDF format.
Malicious URLs
116.122.158.195 :8080/ponyb/gate.php
4renttulsa .com/ponyb/gate.php
4rentunitedstates .com/ponyb/gate.php
newsouthdental .com/jENnMd2X.exe
leclosdelentaille .fr/2Zxq1hZ.exe
forexwinnersacademy .com/fmy.exe
Malicious File Name and MD5:
Xerox_Scan_06-04-2013-[removed].zip (e45db46d63330f20ef8c381f6c0d8f1a)
Xerox_Scan_06-04-2013-[removed].exe (7e4b3aca9a2a86022d50110d5d9498e2)
fmy.exe (c3c103ebb3ce065b8b62b08fba40483f)
ThreatAnalyzer Report: http://db.tt/yJoSwFM8 [PDF]
199.168.184.198, 82.165.79.64, 69.163.187.171, 216.172.167.17
Screenshot: https://gs1.wac.edgecastcdn.net/8019...8Hw1qz4rgp.png
___
Don't like clicking when you won't know where you're going?
- http://urlxray.com/
Find out where shortened URLs lead to without clicking on them
Enter any shortened URL...
___
More Champions Club Community SPAM
- http://blog.dynamoo.com/2013/06/more...nity-spam.html
5 June 2013 - "... the originating IP is 217.174.248.194 [web1-opp2.champions-bounce .co.uk] (Fasthosts, UK). Spamvertised domains are champions.onlineprintproofing .co.uk also on 217.174.248.194 and championsclubcommunity .com on 109.203.113.124 (Eukhost, UK). Give these spammers a wide berth..."
- http://blog.dynamoo.com/2013/03/cham...community.html
___
Backdoor Wipes MBR, Locks Screen
- http://blog.trendmicro.com/trendlabs...-locks-screen/
June 5, 2013 - "German users are at risk of having their systems rendered unusable by a malware that we’re seeing being sent via spam messages. This particular malware, on top of its ability to remotely control an affected system, is able to wipe out the Master Boot Record – a routine that had previously caused a great crisis in South Korea. We recently uncovered this noteworthy backdoor as an attached file in certain spam variants. The spam sample we found is in German and forces recipients to pay for a certain debt, the details of which are contained in the attachment. Those who open the attachment are actually tricked into executing the malware, in this instance, a backdoor.
> http://blog.trendmicro.com/trendlabs...ached-file.jpg
Like any backdoor, BKDR_MATSNU.MCB performs certain malicious commands, which include gathering machine-related information and send it to its command-and-control (C&C) server. However, the backdoor’s most noteworthy feature is its capability to wipe the Master Boot Record (MBR). The wiping of the MBR was recently used in the high-profile (but different) attack against certain South Korean institutions. What makes this routine problematic is that once done, infected systems won’t reboot normally and will leave users with unusable machines. Another command is the backdoor’s capability to lock and unlock a screen. This locking of screen is definitely a direct copy from ransomware’s playbook, in which the system remains completely or partially inaccessible unless the victim pays for the “ransom”. Ransomware is a malware that locks an infected system’s screen and display a message, which instructs users to pay for a “ransom” thru certain payment methods... During our testing, BKDR_MATSNU.MCB readily performed the MBR wiping routine. The remote malicious (via server) only needs to communicate this command to the backdoor and it can execute this routine immediately. However, this is not the case with the screen locking. BKDR_MATSNU.MCB is likely to download a different module onto the system, which will then lock the screen. As to what routines will be first executed or not is dependent on the remote malicious user. Attackers may opt to lock the screen first then initiate the MBR overwriting or just initiate any of the two. Another possible scenario is that another version of BKDR_MATSNU is integrated with the screen blocking routine, which will make the screen locking command easier to execute... For better protection, users should always be cautious be the email they receive and must not readily open any attachments. If your system is already infected, it is a safer bet to not pay for the “ransom”, as paying does not guarantee anything..."
:mad: :fear:
Fake Innex SPAM, rxlogs .net ...
FYI...
Fake Innex, Inc SPAM
- http://blog.dynamoo.com/2013/06/inne...fake-spam.html
6 June 2013 - "Innex, Inc is a real company. This spam email message is -not- from Innex, Inc.
From: PURCHASING DEPARTMENT [fdmelo @fucsalud .edu.co]
To:
Reply-To: pinky .yu@chanqtjer .com.tw
Date: 6 June 2013 08:55
Subject: Innex, Inc.
Sir/Madam,
Our Company is interested in your product, that we saw in trading site,
Your early reply is very necessary for further detail specification immediately you receive our email.
Regards
Purchasing manager,
Mr James Vincent ...
Innex is based in California in the US, but the email appears to be from a university in Colombia and solicits replies to an email address in Taiwan. Note as well that the email is very vague about the "product" they are interested in, and the To: field is blank as the recipient list has been suppressed (i.e. it is being sent to multiple recipients). Avoid."
___
rxlogs .net: spam or Joe Job?
- http://blog.dynamoo.com/2013/06/rxlo...r-joe-job.html
6 June 2013 - "I've had nearly one hundred of these this morning. Is it a genuine spam run or a Joe Job**?
Date: Thu, 6 Jun 2013 09:44:18 -0700 [12:44:18 EDT]
From: Admin [whisis101 @gmail .com]
Reply-To: ec2-abuse @amazon .com
facebook
You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to reset your password 4 ago.
This is a reminder that you need to complete this action by clicking this link and Confirm or Cancel your request.
If you have any other questions, please visit our Help Center.
Thanks,
The Facebook Team
Screenshot: https://lh3.ggpht.com/-ToJ6cyCDWME/U...600/rxlogs.png
The link in the emails goes to multiple pages on rxlogs .net which as far I as can tell is -not- malware*, but is a blog about online pharmacies. But is is spam? Well, let's dig a little deeper.. Each email comes from a different IP, probably being sent by a botnet. That's pretty normal for pharma spam, but in this case there appear to be some anomalous addition headers.. The mildly munged headers from an example email are quite revealing. It appears that there are references to Amazon ECS (Amazon's cloud service) and a valid sender address of whisis101 -at- gmail.com injected into the headers, along with a load of other elements that you'd expect from botnet spam. The email has at no point hit either Gmail or Amazon, but the headers appear to have been -faked- in order to generate reports to Amazon and/or Gmail. It's worth noting that rxlogs .net is hosted on 107.20.147.122 which is an Amazon IP... I believe this is a Joe Job and not a "genuine" spam run, and rxlogs .net is simply another victim of the bad guys."
* http://urlquery.net/report.php?id=2919241
Source IP: 94.102.48.224 - Known RBN IP
** http://searchsecurity.techtarget.com/definition/Joe-job
___
Fake NatPay SPAM / usforclosedhomes .net
- http://blog.dynamoo.com/2013/06/natp...tion-spam.html
6 Jun 2013 - "This fake NatPay spam leads to malware on usforclosedhomes .net.
Version 1:
Date: Thu, 6 Jun 2013 20:53:08 +0600 [10:53:08 EDT]
From: National Payment Automated Reports System [dunks @services .natpaymail .net]
Subject: Transmission Confirmation ~26306682~N25BHHL1~
Transmission Verification
Contact Us
To:
NPC Account # 26306682
Xavier Reed
Re:
NPC Account # 26306682
D & - D5
Thursday, July 04, 2013, Independence Day is a Federal Banking Holiday. All banks are closed for this holiday, therefore NatPay will not be able to process any files on that date. If you plan on transmitting for a paydate that falls between Thursday, July 04, 2013 and Thursday, July 11, 2013 you will need to the file a day earlier.
Batch Number 408
Batch Description VENDOR PAY
Number of Dollar Entries 2
Number of Prenotes 0
Total Deposit Amount $3,848.19
Total Withdraw Amount $3,848.19
Batch Confirmation Number 50983
Date Transmitted Thursday, June 06, 2013 ...
---
Version 2:
Date: Thu, 6 Jun 2013 09:59:06 -0500
From: National Payment Automated Reports System [lemuel @emalsrv.natpaymail .com]
Subject: Transmission Confirmation ~10968697~607MPYRC~
Transmission Verification
Contact Us
To: NPC Account # 10968697
Benjamin Turner
Re: NPC Account # 10968697
D & - MN
Thursday, July 04, 2013, Independence Day is a Federal Banking Holiday. All banks are closed for this holiday, therefore NatPay will not be able to process any files on that date. If you plan on transmitting for a paydate that falls between Thursday, July 04, 2013 and Thursday, July 11, 2013 you will need to the file a day earlier.
Batch Number 219
Batch Description VENDOR PAY
Number of Dollar Entries 2
Number of Prenotes 0
Total Deposit Amount $2,549.12
Total Withdraw Amount $2,549.12
Batch Confirmation Number 24035 ...
The malicious payload is on [donotclick]usforclosedhomes .net/news/walls_autumns-serial.php (report here*) hosted on the following IPs:
41.89.6.179 (Kenya Education Network, Kenya)
46.18.160.86 (Saudi Electronic Info Exchange Company (Tabadul) JSC, Saudi Arabia)
93.89.235.13 (FBS Bilisim Cozumleri, Cyprus)
112.170.169.56 (Korea Telecom, South Korea)
The cluster of IPs and domains this belongs to identifies it as part of the Amerika spam run.
Blocklist:
41.89.6.179
46.18.160.86
93.89.235.13
112.170.169.56 ..."
* http://urlquery.net/report.php?id=2926577
___
USPS Package Pickup Spam
- http://threattrack.tumblr.com/post/5...ge-pickup-spam
June 6, 2013 - "Subjects Seen:
USPS - Your package is available for pickup ( Parcel [removed])
Typical e-mail details:
We attempted to deliver your item at 6 Jun 2013.
Courier service could not make the delivery of your parcel.
Status Deny / Invalid ZIP Code.
If the package is not scheduled for redelivery or picked up within 48 hours, it will be returned to the sender.
Label/Receipt Number: [removed]
Expected Delivery Date: Jun 6, 2013
Class: Package Services
Service(s): Delivery Confirmation
Status: eNotification sent
For mode details and shipping label please see the attached file.
Print this label to get this package at our post office...
Malicious URLs
michaelscigars .net/ponyb/gate.php
montverdestore .com/ponyb/gate.php
errezeta .biz/ToSN79T.exe
190.147.81.28 /yqRSQ.exe
207.204.5.170 /PXVYGJx.exe
archeting .it/86zP.exe
Screenshot: https://gs1.wac.edgecastcdn.net/8019...IUE1qz4rgp.png
___
Global $200M credit card hacking ring busted
- http://www.reuters.com/article/2013/...95419G20130605
Jun 5, 2013 - "Eleven people in the United States, the UK and Vietnam have been arrested and accused of running a $200 million worldwide credit card fraud ring, U.S. and UK law enforcement officials said... Federal prosecutors in New Jersey said they had filed charges against a 23-year-old man from Vietnam... authorities in Vietnam had arrested Duy Hai Truong on May 29 in an effort to break up a ring he is accused of running with co-conspirators, who were not named in the statement... The arrests come as law enforcement officials around the world are cracking down on Internet-related heists. Two weeks ago, authorities raided Liberty Reserve, a Costa Rica-based company that provided a virtual currency system used frequently by criminals to move money around the world without using the traditional banking system. Earlier last month, authorities arrested seven people involved in a $45 million heist in which hackers removed limits on prepaid debit cards and used ATM withdrawals to drain cash from two Middle Eastern banks... the charges were filed in New Jersey's federal court because some of the victims of the scheme are residents of the state. Prosecutors claim Truong and accomplices stole information related to more than a million credit cards and resold it to criminal customers... According to the complaint, Truong hacked into websites that sold goods and services over the Internet and collected personal credit card information from the sites' customers. "The victims' credit cards incurred, cumulatively, more than $200 million in fraudulent charges," the complaint said..."
- http://www.soca.gov.uk/news/552-elev...inal-web-forum
:fear::fear: :sad:
Malware sites to block, Fake USPS SPAM...
FYI...
Malware sites to block 7/6/13
- http://blog.dynamoo.com/2013/06/malw...lock-7613.html
7 June 2013 - "Two IPs that look related, the first is 37.235.48.185 (Edis, Poland or Austria) which host some domains that are also found here** (158.255.212.96 and 158.255.212.97, also Edis) that seem to be used in injection attacks. I can identify the following domains linked to 37.235.48.185:
faggyppvers5 .info
finger2 .climaoluhip.org
linkstoads .net
node1.hostingstatics .org
node2.hostingstatics .org
Injecting some of the same sites as the domains on the above IPs is jstoredirect .net which is currently offline but was hosted on 149.154.152.18 which is also Edis (can you see the pattern yet?) so I would assume that they are linked. In the few days that jstoredirect .net was online it managed to infect over 1500 sites*.
Aggregate blocklist:
98.126.9.34
114.142.147.51
158.255.212.96
158.255.212.97
nethostingdb .com
netstoragehost .com
connecthostad .net
climaoluhip .org
hostingstatics .org
systemnetworkscripts .org
numstatus .com
linkstoads .net
faggyppvers5 .info
jstoredirect .net ..."
* http://www.google.com/safebrowsing/d...toredirect.net
** http://blog.dynamoo.com/2013/05/some...21296-and.html
___
Fake USPS SPAM / USPS_Label_861337597092.zip
- http://blog.dynamoo.com/2013/06/usps...597092zip.html
6 June 2013 - "This fake USPS spam contains a malicious attachment:
Date: Thu, 6 Jun 2013 10:43:56 -0500 [11:43:56 EDT]
From: USPS Express Services [service-notification @usps .com]
Subject: USPS - Your package is available for pickup ( Parcel 861337597092 )
Postal Notification,
We attempted to deliver your item at 6 Jun 2013.
Courier service could not make the delivery of your parcel.
Status Deny / Invalid ZIP Code.
If the package is not scheduled for redelivery or picked up within 48 hours, it will be returned to the sender.
Label/Receipt Number: 861337597092
Expected Delivery Date: Jun 6, 2013
Class: Package Services
Service(s): Delivery Confirmation
Status: eNotification sent
For mode details and shipping label please see the attached file.
Print this label to get this package at our post office.
Thank you,
© 2013 Copyright© 2013 USPS. All Rights Reserved.
*** This is an automatically generated email, please do not reply ...
There is an attachment called USPS_Label_861337597092.zip which in turn contains a malicious executable file USPS_Label_06062013.exe (note the date is encoded into the filename). VirusTotal results for this are 18/47*. The Comodo CAMAS report** shows an attempt to download more components from michaelscigarbar .net on 184.95.37.109 (Jolly Works Hosting, Philippines.. rented from Secured Servers in the US). URLquery shows a very large amount of malware activity on that IP, mostly apparently running on legitimate -hacked- domains. You should probably treat all of the following domains as hostile:
alliancelittleaviators .com
apparelacademy .com
apparelacademy .net
brokerforcolorado .com
carlaellisproperties .com
dragoncigars .net
heavenlycigars .net
libertychristianstore .com
michaelscigarbar .com
michaelscigarbar .net
michaelscigars .net
montverdestore .com
montverdestore .net
montverdestore .org ..."
* https://www.virustotal.com/en/file/8...is/1370549956/
File name: USPS_Label_06062013.exe
Detection ratio: 18/47
Analysis date: 2013-06-06
** http://camas.comodo.com/cgi-bin/subm...b2b4cf553ab695
*** http://urlquery.net/search.php?q=184...3-06-06&max=50
___
Better Business Bureau Compliant Spam
- http://threattrack.tumblr.com/post/5...compliant-spam
7 June 2013 - "Subjects Seen:
BBB Appeal [removed]
Typical e-mail details:
The Better Business Bureau has been booked the above mentioned grievance from one of your users in respect to their dealings with you. The detailed description of the consumer’s trouble are available for review at a link below. Please give attention to this matter and notify us about your sight as soon as possible.
We graciously ask you to overview the CLAIM REPORT to answer on this plaint.
We awaits to your prompt answer.
WBR
Ryan Myers
Dispute Advisor
Malicious URLs
amapi .com .br/bbb.html
pnpnews .net/news/readers-sections.php?hvv=rvjzzloo&jnjpe=thpe
pnpnews .net/news/readers-sections.php?yf=1i:1f:32:33:2v&re=1n:2w:1n:1g:30:1f:1o:1n:1i:2v&u=1f&br=b&sd=c&jopa=5698723
Screenshot: https://gs1.wac.edgecastcdn.net/8019...pWf1qz4rgp.png
- http://blog.dynamoo.com/2013/06/bbb-...npnewsnet.html
7 June 2013 - "This fake BBB spam leads to malware on pnpnews .net:
From: Better Business Bureau [mailto:standoffzwk68 @clients.bbb .com]
Sent: 07 June 2013 15:08
Subject: BBB information regarding your customer's pretension No. 00167486
Better Business Bureau ©
Start With Trust ©
Fri, 7 Jun 2013
RE: Complaint No. 00167486
[redacted]
The Better Business Bureau has been entered the above said grievance from one of your users in regard to their business relations with you. The information about the consumer's trouble are available visiting a link below. Please pay attention to this matter and notify us about your sight as soon as possible.
We kindly ask you to overview the CLAIM LETTER REPORT to meet on this claim.
We awaits to your prompt answer.
Faithfully yours
Jonathan Edwards
Dispute Advisor
Better Business Bureau ...
Screenshot: https://lh3.ggpht.com/-RY4L1o2A9_w/U...Q/s400/bbb.png
The link in the email goes through a legitimate hacked site and then to a payload at [donotclick]pnpnews .net/news/readers-sections.php (report here*) hosted on:
46.18.160.86 - Saudi Electronic Info Exchange Company (Tabadul) JSC
93.89.235.13 - FBS Bilisim Cozumleri, Cyprus
178.16.216.66 - Gabrielson Invest AB, Sweden
186.215.126.52 - Global Village Telecom, Brazil
190.93.23.10 - Greendot, Trinidad and Tobago
Blocklist:
46.18.160.86
93.89.235.13
178.16.216.66
186.215.126.52
190.93.23.10 ..."
* http://urlquery.net/report.php?id=2944992
... Detected BlackHole v2.0 exploit kit URL pattern ...
___
Fake American Express PAYVE Remit Spam
- http://threattrack.tumblr.com/post/5...yve-remit-spam
June 7, 2013 - "Subjects Seen:
PAYVE - Remit file
Typical e-mail details:
A payment(s) to your company has been processed through the American Express Payment Network.
The remittance details for the payment(s) are attached ([removed].zip).
- The remittance file contains invoice information passed by your buyer. Please contact your buyer for additional information not available in the file.
- The funds associated with this payment will be deposited into your bank account according to the terms of your American Express merchant agreement and may be combined with other American Express deposits. For additional information about Deposits, Fees, or your American Express merchant agreement:
Contact American Express Merchant Services at 1-800-528-0933 Monday to Friday, 8:00 AM to 8:00 PM ET.
- You can also view PAYVE payment and invoice level details using My Merchant Account/Online Merchant Services. If you are not enrolled in My Merchant Account/OMS, you can do so at americanexpress .com/mymerchantaccount or call us at 1-866-220-7374, Monday - Friday between 9:00 AM-7:30 PM ET, and we’ll be glad to help you.
For quick and easy enrollment, please have your American Express Merchant Number, bank account ABA (routing number) and DDA (account number) on hand.
This customer service e-mail was sent to you by American Express. You may receive customer service e-mails even if you have unsubscribed from marketing e-mails from American Express...
Malicious URLs
storeyourbox .net/ponyb/gate.php
storeyourthings .net/ponyb/gate.php
drjoycethomasderm .com/ponyb/gate.php
errezeta .biz/ToSN79T.exe
190.147.81.28 /yqRSQ.exe
207.204.5.170 /PXVYGJx.exe
archeting .it/86zP.exe
Screenshot: https://gs1.wac.edgecastcdn.net/8019...c6a1qz4rgp.png
- http://blog.dynamoo.com/2013/06/payv...file-spam.html
7 June 2013 - "This fake American Express Payment Network spam has a malicious attachment.
Date: Fri, 7 Jun 2013 20:41:25 +0600 [10:41:25 EDT]
From: "PAYVESUPPORT @AEXP .COM" [PAYVESUPPORT @AEXP .COM]
Subject: PAYVE - Remit file ...
Attached to the email is an archive file called CD0607213.389710762910.zip which in turn contains an executable named CD06072013.239871839.exe (note that the date is included in the filename). Virustotal reports that just 8/46* anti-virus scanners detect it.
The Comodo CAMAS report*** gives some details about the malware, including the following checksums:
MD5 fd18576bd4cf1baa8178ff4a2bef0849
SHA1 8b8ba943393e52a3972c11603c3f1aa1fc053788
SHA256 f31ca8a9d429e98160183267eea67dd3a6e592757e045b2c35bb33d5e27d6875
The malware attempts to download further components from storeyourbox .com on 97.107.137.239 (Linode, US) which looks like a legitimate server that has been -badly- compromised**. The following domains appear to be on the server, I would advise that they are all dangerous at the moment:
drjoycethomasderm .com
goodvaluemove .com
jacksonmoving .com
jacksonmoving .net
napervillie-movers .com
reebie .net
storageandmoving .net
storeyourbox .com
storeyourbox .net
storeyourthings .net "
* https://www.virustotal.com/en/file/f...is/1370627576/
File name: CD06072013.239871839.exe
Detection ratio: 8/46
Analysis date: 2013-06-07
** https://www.virustotal.com/en/ip-add...9/information/
*** http://camas.comodo.com/cgi-bin/subm...bb33d5e27d6875
:fear: :mad:
Fake Wells Fargo - attachment Spam
FYI...
Fake Wells Fargo - attachment Spam
- http://threattrack.tumblr.com/post/5...ttachment-spam
June 19, 2013 - "Subjects Seen:
IMPORTANT - WellsFargo
Typical e-mail details:
Please check attached documents.
Michael_Kane
Wells Fargo Advisors
817-563-5247 office
817-368-5170 cell [removed]
ATTENTION: THIS E-MAIL MAY BE AN ADVERTISEMENT OR SOLICITATION FOR PRODUCTS AND SERVICES.
To unsubscribe from marketing e-mails from:
· An individual Wells Fargo Advisors financial advisor: Reply to one of his/her e-mails and type “Unsubscribe” in the subject line.
· Wells Fargo and its affiliates: Unsubscribe at wellsfargoadvisors.com/unsubscribe.
Neither of these actions will affect delivery of important service messages regarding your accounts that we may need to send you or preferences you may have previously set for other e-mail services.
For additional information regarding our electronic communication policies, visit wellsfargoadvisors.com/disclosures/email-disclosure.html .
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC. 1 North Jefferson, St. Louis, MO 63103
Malicious URLs
megmcenery .com/ponyb/gate.php
mceneryfinancial .com/ponyb/gate.php
margueritemcenery .com/ponyb/gate.php
hraforbiz. com/ponyb/gate.php
ftp(DOT)impactdata .com/da4.exe
errezeta .biz/ToSN79T.exe
ftp(DOT)myfxpips .com/PMLyQRMt.exe
207.204.5.170 /PXVYGJx.exe
Malicious File Name and MD5:
WellsFargo.<random>.zip (05c33cfcf22c5736C4a162f6d7c2eeac)
Important WellsFargo Docs.exe (47e739106c24fbf52ed3b8fd01dc3668)
Screenshot: https://gs1.wac.edgecastcdn.net/8019...1ca1qz4rgp.png
- http://blog.dynamoo.com/2013/06/well...ellsfargo.html
10 June 2013 - "This fake Wells Fargo spam run comes with one of two malicious attachments:
Date: Mon, 10 Jun 2013 13:00:13 -0500 [14:00:13 EDT]
From: Anthony_Starr @wellsfargo .com
Subject: IMPORTANT - WellsFargo
Please check attached documents.
Anthony_Starr
Wells Fargo Advisors
817-563-9816 office
817-368-5471 cell Anthony_Starr @ wellsfargo .com
ATTENTION: THIS E-MAIL MAY BE AN ADVERTISEMENT OR SOLICITATION FOR PRODUCTS AND SERVICES.
To unsubscribe from marketing e-mails from:
· An individual Wells Fargo Advisors financial advisor: Reply to one of his/her
e-mails and type “Unsubscribe” in the subject line.
· Wells Fargo and its affiliates: Unsubscribe at
www .wellsfargoadvisors .com/unsubscribe. Neither of these actions will affect delivery of
important service messages regarding your accounts that we may need to send you or
preferences you may have previously set for other e-mail services.
For additional information regarding our electronic communication policies, visit
http :// wellsfargoadvisors .com/disclosures/email-disclosure.html .
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member
FINRA/SIPC. 1 North Jefferson, St. Louis, MO 63103 ...
There is a ZIP file attached to the email message, and the spammers have attempted to name the attachment after the recipient.. but because the spam has multiple recipients it may end up with a random name. Inside the ZIP file is an EXE file, and there appear to be -two- variants.
One is called Important WellsFargo Doc.exe and it has a pretty shocking VirusTotal detection rate of 0/47* (yup.. none at all). The Comodo CAMAS report** gives the following checksums..
Name Value
Size 94720
MD5 70e604777a66980bcc751dcb00eafee5
SHA1 52ef61b6296f21a3e14ae35320654ffe3f4e769d
SHA256 f669768216872c626abc46e4dd2e0b1d783ba5927166282922c16d6db3b8adae
..it identifies that this version of the malware attempts to download additional components from mceneryfinancial .com on 173.255.213.171 (specifically it is a pony downloader querying /ponyb/gate.php)... ThreatTrack has a more detailed report*** which also identifies callbacks to www.errezeta .biz and ftp.myfxpips .com. ThreatExpert has a slightly different report (1) and further identifies megmcenery .com, taxfreeincomenow .com, taxfreeincomenow .info and 207.204.5.170 (Linode, US). The second version has a similarly named files called Important WellsFargo Docs.exe (plural) with a higher VirusTotal detection rate of 11/46 (2). Comodo CAMAS reports(3) the following file characteristics..
Name Value
Size 114176
MD5 47e739106c24fbf52ed3b8fd01dc3668
SHA1 b85b4295d23c912f9446a81fd605576803a29e53
SHA256 2d0d16d29ceca912d529533aa850f1e1539f4b509ea7cb89b8839f672afb418b
..in this case the pony download contacts hraforbiz .com (also on 173.255.213.171). Other analyses are pending. Several of these malware domains are hosted on 173.255.213.171 (Linode, US) and we can assume that this server is compromised along with all the domains on it. 62.149.131.162 (Aruba, Italy) also seems to be compromised(4). 173.254.68.134 (5) (Unified Layer, US) and 207.204.5.170 (6) (Register .com, US) appear to be compromised in some way to. Of note is the fact that almost all of these domains appear to be legitimate but have been -hacked- in some way, I would expect them to be cleaned up at some point in the future. Putting all these IPs and domains together gives a recommended blocklist:
173.254.68.134
173.255.213.171
207.204.5.170
62.149.131.162 ..."
(More listed at the dynamoo URL above.)
* https://www.virustotal.com/en/file/f...is/1370888138/
File name: Important WellsFargo Doc.exe
Detection ratio: 0/47
Analysis date: 2013-06-10
** http://camas.comodo.com/cgi-bin/subm...c16d6db3b8adae
*** http://www.dynamoo.com/files/analysi...cb00eafee5.pdf
1) http://www.threatexpert.com/report.a...751dcb00eafee5
2) https://www.virustotal.com/en/file/2...is/1370888252/
File name: Important WellsFargo Docs.exe
Detection ratio: 11/46
Analysis date: 2013-06-10
3) http://camas.comodo.com/cgi-bin/subm...c16d6db3b8adae
4) https://www.virustotal.com/en/ip-add...2/information/
5) https://www.virustotal.com/en/ip-add...4/information/
6) https://www.virustotal.com/en/ip-add...0/information/
___
- http://tools.cisco.com/security/cent...utbreak.x?i=77
E-mail Messages with Malicious Attachments - 2013 Jun 10
Fake Deposit Transfer Confirmation Notification E-mail Messages - 2013 Jun 10
Fake Documents Attachment Email Messages - 2013 Jun 10
Malicious Attachment Email Messages - 2013 Jun 10
Fake Bill Payment Notification Email Messages - 2013 Jun 10
Fake Legal Assistance Inquiry E-mail Messages - 2013 Jun 10
Fake Products Advertisement E-mail Messages - 2013 Jun 10
Fake FedEx Shipment Notification E-mail Messages - 2013 Jun 10
Fake Xerox Scan Attachment Email Messages - 2013 Jun 10
Fake Gift Voucher Redemption Email Messages - 2013 Jun 10
Fake Deposit Statement Notification E-mail Messages - 2013 Jun 10
(More detail and links at the cisco URL above.)
:fear::fear::mad:
Fake Fax email, new ZBOT malware ...
FYI...
Fake Fax Transmission emails lead to malware
- http://blog.webroot.com/2013/06/11/f...ad-to-malware/
June 11, 2013 - "Have you sent an eFax recently? Watch out for an ongoing malicious spam campaign that tries to convince you that there’s been an unsuccessful fax transmission. Once socially engineered users execute the malicious attachment found in the fake emails, their PCs automatically join the botnet of the cybercriminals behind the campaign...
Sample screenshot of the spamvertised email:
> https://webrootblog.files.wordpress....ngineering.png
Detection rate for the malicious attachment: MD5: 66140a32d7d8047ea93de0a4a419880b * ... UDS:DangerousObject.Multi.Generic... phones back to the following C&C server hxxp ://lukafalls .com/banners/index.php – 95.154.254.17, as well as to the following C&C IPs:
95.154.254.17, 190.179.212.30, 65.92.129.196, 125.25.82.22, 69.235.15.127, 108.215.44.142, 188.153.47.135, 76.226.112.216, 78.100.36.98, 190.162.42.76, 78.99.110.225, 118.101.184.54, 90.156.118.144, 212.182.121.226, 99.97.73.189, 181.67.50.91, 2.87.2.21, 108.215.99.94, 84.59.222.81, 142.136.161.103, 178.203.226.84, 95.234.169.221, 217.41.0.85, 71.143.224.43, 74.139.10.100, 78.38.40.207, 213.215.153.212 ..."
(More detail at the webroot URL above.)
* https://www.virustotal.com/en/file/6...2f68/analysis/
File name: Fax details and transmission_report.doc.exe
Detection ratio: 31/47
Analysis date: 2013-06-10
___
Self-propagating ZBOT malware ...
- http://blog.trendmicro.com/trendlabs...lware-spotted/
June 10, 2013 - "... we have spotted a new ZBOT variant that can spread on its own. This particular ZBOT variant arrives through a malicious PDF file disguised as a sales invoice document. If the user opens this file using Adobe Reader, it triggers an exploit which causes the following pop-up window to appear:
> http://blog.trendmicro.com/trendlabs...3/06/zbot1.jpg
... error message upon execution of the malicious PDF file
While this is going on, the malicious ZBOT variant – WORM_ZBOT.GJ – is dropped onto the system and run. It is here that several differences start to appear. First of all, WORM_ZBOT.GJ has an autoupdate routine: it can download and run an updated copy of itself. Secondly, however, it can spread onto other systems via removable drives, like USB thumb drives. It does thus by searching for removable drives and then creating a hidden folder with a copy of itself inside this folder, and a shortcut pointing to the hidden ZBOT copy.
> http://blog.trendmicro.com/trendlabs...ot-BD-JPEG.jpg
... Portion of WORM_ZBOT.GJ code creating copy of itself
This kind of propagation by ZBOT is unusual... ZBOT malware is usually distributed by exploit kits and/or malicious attachments..."
- https://net-security.org/malware_news.php?id=2515
June 11, 2013 - "The Zeus / Zbot Trojan has been around since 2007, and it and its variants continued to perform MitM attacks, log keystrokes and grab information entered in online forms. It is usually spread via exploit kits (drive-by-downloads), phishing schemes, and social media..."
___
Washington Free Beacon compromised to serve up Malware
- http://www.invincea.com/2013/06/kia-...ve-up-malware/
UPDATE 10:02 a.m. 6/11 – "Repeated attempts to reach the Beacon have been unsuccessful. We have not seen reinfection in subsequent visits but it is hard to know without navigating every page...
WARNING: Do NOT browse to freebeacon[.]com until further notice, as the site is still actively redirecting user traffic to malware. The Washington Free Beacon has been notified but have not confirmed nor responded... an article from The Washington Free Beacon on the breaking NSA Leaks story (freebeacon[.]com/nsa-leaker-surfaces-in-hong-kong/) linked to by the Drudge report has been compromising readers with a Java-based exploit kit* ... patching Java to the latest version (if you can) may be your only (temporary) protection..."
- http://www.invincea.com/wp-content/uploads/27.png
(More detail at the invincea URL above.)
* https://www.virustotal.com/en/file/b...is/1370873028/
File name: 1.jar
Detection ratio: 3/47
Analysis date: 2013-06-10
___
Something evil on 173.255.213.171
- http://blog.dynamoo.com/2013/06/some...255213171.html
11 June 2013 - "As a follow-up to this post*, the exploit server on 173.255.213.171 (Linode, US) is hosting a number of -hijacked- GoDaddy-registered domains that are serving an exploit kit [1] [2]... block 173.255.213.171 ..."
* http://blog.dynamoo.com/2013/06/well...ellsfargo.html
1) https://www.virustotal.com/en/ip-add...1/information/
2) http://urlquery.net/search.php?q=173...3-06-11&max=50
___
CitiBank Secure Message Spam
- http://threattrack.tumblr.com/post/5...e-message-spam
June 11, 2013 - "Subjects Seen:
(SECURE)Electronic Account Statement [removed]
Typical e-mail details:
You have received a Secure PDF message from the CitiSecure Messaging Server.
Open the PDF file attached to this notification. When prompted, enter your Secure PDF password to view the message contents.
To reply to this message in a secure manner, it is important that you use the Reply link inside the Secure PDF file. This will ensure that any confidential information is sent back securely to the sender.
Help is available 24 hours a day by calling 1-866-535-2504 or 1-904-954-6181 or by email at secure.emailhelp @citi .com
Please note: Adobe Reader version 7 or above is required to view all SecurePDF messages.
Malicious URLs
chriscarlson .com/ponyb/gate.php
chrisandannwedding .com/ponyb/gate.php
ccrtl .com/ponyb/gate.php
chrisandannwedding .com/ponyb/gate.php
hoteloperaroma .it/Sb9A7JV1.exe
stitaly .net/E2KYVJD.exe
newmountolivet .org/iUHgGvn.exe
mozzarellabroker .com/pZYTn.exe
Malicious File Name and MD5:
Secure.<random>.zip (05c33cfcf22c5736C4a162f6d7c2eeac)
secure.pdf.exe (4209430a3393287d5e28def88e43b93b)
ThreatAnalyzer Report: http://db.tt/RtlUb5Vs [PDF]
Screenshot: https://gs1.wac.edgecastcdn.net/8019...8e01qz4rgp.png
___
Amazon Order Notification Spam
- http://threattrack.tumblr.com/post/5...ification-spam
June 11, 2013 - "Subjects Seen:
Payment for Your Amazon Order # [removed]
Typical e-mail details:
We’re writing to let you know that we are having difficulty processing your payment for the above transaction. To protect your security and privacy, your issuing bank cannot provide us with
information regarding why your credit card was declined.
However, we suggest that you double-check the billing address, expiration date and cardholder name
that you entered; if entered incorrectly these will sometimes cause a card to decline. There is no
need to place a new order as we will automatically try your credit card again.
There are a few steps you can take to make the process faster:
1. Verify the payment information for this order is correct (expiration date, billing address, etc).
You can update your account and billing information at :
amazon .com/gp/css/summary/edit.html?ie=UTF8&orderID=[removed]
2. Contact your issuing bank using the number on the back of your card to learn more about their
policies. Some issuers put restrictions on using credit cards for electronic or internet
purchases. Please have the exact dollar amount and details of this purchase when you call the
bank. If paying by credit card is not an option, buy Amazon.com Gift Card claim codes with cash
from authorized resellers at a store near you. Visit amazon.com/cashgcresellers to learn
more.
Thank you for shopping at Amazon.com. Sincerely, Amazon.com Customer Service
Malicious URLs
gnqlawyers .com/proteans/index.html
eucert .com/herein/index.html
gauravvashisht .com/desisted/index.html
goldcoinvault .com/news/pictures_hints_causes.php
sweethomesorrento .it/t0q.exe
server1.extra-web .cz/fdCtJM.exe
Screenshot: https://gs1.wac.edgecastcdn.net/8019...ZjB1qz4rgp.png
- http://blog.dynamoo.com/2013/06/amaz...nvaultcom.html
June 11, 2013 - "This fake Amazon.com spam leads to malware on goldcoinvault .com:
Date: Tue, 11 Jun 2013 14:25:21 -0600 [16:25:21 EDT]
From: "Amazon.com Customer Care Service" [payments-update @amazon .com]
Subject: Payment for Your Amazon Order # 104-884-8180383
Regarding Your Amazon.com Order
Order Placed: June 11, 2013
Amazon.com order number: 104-884-8180383
Order Total: $2761.86 ...
The link in the email goes through a legitimate hacked site to an intermediate page with the following redirectors:
[donotclick]ftp.blacktiedjent .com/mechanic/vaccinated.js
[donotclick]piratescoveoysterbar .com/piggybacks/rejoiced.js
[donotclick]nteshop .es/tsingtao/flanneling.js
..from there it hits the main malware payload site at [donotclick]goldcoinvault .com/news/pictures_hints_causes.php (report here*) hosted on goldcoinvault .com which is a hacked GoDaddy domain -hijacked- to point at 173.255.213.171 (Linode, US). This same server is very active and has been spotted here** and here***, also using hacked GoDaddy domains, but right at the moment the malware page appears to be 403ing which is good..."
* http://urlquery.net/report.php?id=3054553
** http://blog.dynamoo.com/2013/06/some...255213171.html
*** http://blog.dynamoo.com/2013/06/well...ellsfargo.html
:fear::fear: :mad:
Malware sites to block, Casino PUA software SPAM, Fake BBB SPAM...
FYI...
Casino PUA software SPAM ...
- http://blog.webroot.com/2013/06/12/t...-w32casonline/
June 12, 2013 - "Fraudsters are currently spamvertising tens of thousands of emails enticing users into installing rogue, potentially unwanted (PUAs) casino software. Most commonly known as W32/Casonline, this scam earns revenue through the rogue online gambling software’s affiliate network... (multiple screenshots at the URL above)... Spamvertised URLs:
hxxp ://luckynuggetcasino .com – 67.211.111.163
hxxp ://888casino .com – 213.52.252.59
hxxp ://spinpalace.com – 109.202.114.65
hxxp ://alljackpotscasino.com – 64.34.230.122
hxxp ://allslotscasino.com – 64.34.230.149
... (multiple) MD5s... have also phoned back to the same IP (213.52.252.59)... (Low detection rates per Virustotal - links at the webroot URL above)...
We advise users to avoid interacting with any kind of content distributed through spam messages, especially clicking on any of the links found in such emails...."
___
Fake BBB SPAM / trleaart .net
- http://blog.dynamoo.com/2013/06/bbb-...leaartnet.html
12 June 2013 - "This fake BBB spam with a "PLAINT REPORT" (sic) leads to malware on trleaart .net:
From: Better Business Bureau [mailto:rivuletsjb72 @bbbemail .org]
Sent: 11 June 2013 18:04
Subject: Better Business Beareau Complaint ¹ S3452568
Importance: High
Sorry, your e-mail does not support HTML format. Your messages can be viewed in your browser
Better Business Bureau ©
Start With Trust
Tue , 11 Jun 2013
Issue N. S3452568
The Better Business Bureau has been booked the above said claim letter from one of your customers in respect of their dealings with you. The detailed description of the consumer's trouble are available visiting a link below. Please pay attention to this matter and inform us about your mind as soon as possible.
We amiably ask you to open the PLAINT REPORT to answer on this claim.
We awaits to your prompt response.
Faithfully yours
Daniel Cox
Dispute Advisor...
Better Business Bureau...
Screenshot: https://lh3.ggpht.com/-ZaIrOeD1dnc/U.../s400/bbb2.png
The link goes through a legitimate -hacked- site and end up with a malware landing page on [donotclick]trleaart .net/news/members_guarantee.php (report here*) hosted on the following IPs:
160.75.169.49 (Istanbul Technical University, Turkey)
186.215.126.52 (Global Village Telecom, Brazil)
190.93.23.10 (Greendot, Trinidad and Tobago)
193.254.231.51 (Universitatea Transilvania Brasov, Romania)
This network of evil sites is rather large... in the meantime here is a partial blocklist:
160.75.169.49
186.215.126.52
190.93.23.10
193.254.231.51 ..."
* http://urlquery.net/report.php?id=3067317
___
Malware sites to block 12/6/13
- http://blog.dynamoo.com/2013/06/malw...ock-12613.html
12 June 2013 - "This is a refresh of this list of domains and IPs controlled by what I call the "Amerika" gang, and it follows on from this BBB spam run earlier. Note that IPs included in this list show recent malicious activity, but it could be that they have now been fixed. I also noticed that a couple of the domains may have been sinkholed, but it will do you no harm to block them anyway..."
(LONG list at the dynamoo URL above - includes "Plain IPlist for copy-and-pasting".)
___
Fake "Activation Needed" emails...
- http://security.intuit.com/alert.php?a=82
6/11/13 - "People are receiving -fake- emails with the title "Important Activation Needed/"
Below is a copy of part of the email people are receiving:
Screenshot: http://security.intuit.com/images/importact.jpg
... This is the end of the -fake- email.
Steps to Take Now
Do not open the attachment in the email...
Delete the email..."
___
GAMARUE malware uses Sourceforge to host files
- http://blog.trendmicro.com/trendlabs...to-host-files/
June 11, 2013 - "In our monitoring of the GAMARUE malware family, we found a variant that used the online code repository SourceForge to host malicious files... SourceForge is a leading code repository for many open-source projects, which gives developers a free site that allows them to host and manage their projects online. It is currently home to more than 324,000 projects and serves more than 4 million downloads a day... GAMARUE malware poses a serious risk to users; attackers are able to gain complete control of a system and use it to launch attacks on other systems, as well as stealing information. Among the most common ways it reaches user systems are: infected removable drives, or the user has visited sites compromised with the Blackhole Exploit Kit. This attack is made up of four files. The first is a shortcut, which appears to be a shortcut to an external drive. (This is detected as LNK_GAMARUE.RMA.) Instead of a drive, however, it points to a .COM file (detected as TROJ_GAMARUE.LMG)...
> http://blog.trendmicro.com/trendlabs...ruediagram.png
GAMARUE Infection Chain
Once the executable file is decrypted, it downloads updates to itself, as well as malicious files from a SourceForge project. In effect, it uses SourceForge to unwittingly host malicious files... The malicious files in the above example were hosted under the tradingfiles project. The same user created two more projects that were also used to host malicious GAMARUE files: ldjfdkladf and stanteam. New files were uploaded in these projects from June 1 onwards..."
- https://net-security.org/malware_news.php?id=2517
June 12, 2013 - "... the infection with a variant of the information-stealing Gamarue starts with a shortcut file to an external file, and ends with malicious files being downloaded from one of three (obviously bogus) Sourceforge projects: "tradingfiles," "stanteam," and "ldjfdkladf". The first two have already been deleted, and the third one emptied of all files. The account of the user who created them has been deleted (whether or not by Sourceforge or the user it's impossible to tell), but according to the researchers new files were uploaded into these projects from June 1 onwards..."
___
Fake Xerox WorkCentre Spam
- http://threattrack.tumblr.com/post/5...orkcentre-spam
June 12, 2013 - "Subjects Seen:
Scan from a Xerox WorkCentre
Typical e-mail details:
Please download the document. It was scanned and sent to you using a Xerox multifunction device.
File Type: pdf
Download: Scanned from a Xerox multi~3.pdf
multifunction device Location: machine location not set
Device Name: Xerox6592
For more information on Xerox products and solutions, please visit xerox .com
Malicious URLs
forum.xcpus .com:8080/webstats/counter.php
buildmybarwebsite .com/webstats/counter.php
continentalfuel .com/webstats/counter.php
apparellogisticsgroup .net/Aq70QrZ.exe
ftp(DOT)celebritynetworks .com/dNYC.exe
portal.wroctv .com/inZGwEH.exe
videotre .tv .it/UmQ.exe
Malicious File Name and MD5:
Scan_<random>.zip (0375c95289fc0e2dd94b63c105c24373)
Scan_<random> (8fcba93b00dba3d182b1228b529d3c9e)
Screenshot: https://gs1.wac.edgecastcdn.net/8019...zKT1qz4rgp.png
- http://blog.dynamoo.com/2013/06/scan...ntre-spam.html
12 June 2013 - "This fake Xerox WorkCentre spam comes with a malicious attachment and appears to come from the victim's own domain:
Date: Wed, 12 Jun 2013 10:36:16 -0500 [11:36:16 EDT]
From: Xerox WorkCentre [Xerox.Device9@victimdomain.com]
Subject: Scan from a Xerox WorkCentre
Please download the document. It was scanned and sent to you using a Xerox multifunction device.
File Type: pdf
Download: Scanned from a Xerox multi~3.pdf
multifunction device Location: machine location not set
Device Name: Xerox2023
For more information on Xerox products and solutions, please visit http ://www.xerox .com
Attached is a ZIP file, in this case called Scan_06122013_29911.zip which in turn contains an executable Scan_06122013_29911.exe. Note that the date is encoded into the filename so future versions will be different. VirusTotal results are 23/47* which is typically patchy. Comodo CAMAS reports** that the malware attempts to phone home to forum.xcpus .com on 71.19.227.135 and has the following checksums:
MD5 8fcba93b00dba3d182b1228b529d3c9e
SHA1 54f02f3f1d6954f98e14a9cee62787387e5b072c
SHA256 544c08f288b1102d6304e9bf3fb352a8fdfb59df93dc4ecc0f753dd30e39da0c
... the ThreatTrack report [pdf]*** is more detailed and also identifies the following domains and IPs which are probably worth blocking or looking out for:
71.19.227.135
205.178.152.164
198.173.244.62
204.8.121.24
195.110.124.133
173.246.106.150 ..."
* https://www.virustotal.com/en/file/5...is/1371077066/
File name: Scan_06122013_29911.exe
Detection ratio: 23/47
Analysis date: 2013-06-12
** http://camas.comodo.com/cgi-bin/subm...753dd30e39da0c
*** http://www.dynamoo.com/files/analysi...8b529d3c9e.pdf
___
Fake Fedex SPAM / oxfordxtg .net
- http://blog.dynamoo.com/2013/06/fede...ordxtgnet.html
12 June 2013 - "This fake FedEx spam leads to malware on oxfordxtg .net:
Date: Thu, 13 Jun 2013 01:18:09 +0800 [13:18:09 EDT]
From: FedEx [wringsn052 @emc.fedex .com]
Subject: Your Fedex invoice is ready to be paid now.
FedEx(R) FedEx Billing Online - Ready for Payment
fedex.com
Hello [redacted]
You have a new outstanding invoice(s) from FedEx that is ready for payment.
The following ivoice(s) are to be paid now :
Invoice Number
5135-13792
To pay or review these invoices, please sign in to your FedEx Billing Online account by clicking on this link: http ://www.fedex .com/us/account/fbo
Note: Please do not use this email to submit payment. This email may not be used as a remittance notice. To pay your invoices, please visit FedEx Billing Online, http ://www.fedex .com/us/account/fbo
Thank you,
Revenue Services
FedEx...
Screenshot: https://lh3.ggpht.com/-gOwdBh9V5Os/U...1600/fedex.png
The link in the email goes through a legitimate hacked site and ends up on a malware payload page at [donotclick]oxfordxtg .net/news/absence_modern-doe_byte.php (report here*) hosted on:
124.42.68.12 (Langfang University, China)
190.93.23.10 (Greendot, Trinidad and Tobago)
The following partial blocklist covers these two IPs, but I recommend you also apply this larger blocklist of related sites** as well.
124.42.68.12
190.93.23.10 ..."
* http://urlquery.net/report.php?id=3082461
** http://blog.dynamoo.com/2013/06/malw...ock-12613.html
___
Fake "'Anonymous' sent you a payment" emails...
- http://security.intuit.com/alert.php?a=83
6/12/13 - " People are receiving fake emails with the title "X sent you a payment (where X is a person's name)." Below is a copy of the email people are receiving:
Screenshot: http://security.intuit.com/images/paymentnetwork.jpg
This is the end of the fake email.
Steps to Take Now
Do -not- open the attachment in the email...
Delete the email..."
:fear::fear::mad:
Fake LinkedIn, UPS SPAM...
FYI...
Fake LinkedIn SPAM...
- http://threattrack.tumblr.com/post/5...nvitation-spam
June 14, 2013 - "Subjects Seen:
Invitation to connect on LinkedIn
Typical e-mail details:
Hattie Fitzgerald, wants to connect with you on LinkedIn.
Malicious URLs
50.63.46.110 /jotted/index.html
audio-mastering-music .com/news/pictures_hints_causes.php?jnlp=bd187af1d0
audio-mastering-music .com/news/pictures_hints_causes.php?rwiezly=qzxqjh&rzvaax=abldjf
audio-mastering-music .com/news/pictures_hints_causes.php?pf=2w:1l:1n:1f:1j&ze=2w:31:1g:1n:1m:2v:33:1g:31:1f&x=1f&xu=s&ma=o&jopa=1715713
Screenshot: https://gs1.wac.edgecastcdn.net/8019...IOr1qz4rgp.png
___
Fake UPS Package Pickup Spam
- http://threattrack.tumblr.com/post/5...ge-pickup-spam
June 14, 2013 - "Subjects Seen:
UPS - Your package is available for pickup ( Parcel [removed] )
Typical e-mail details:
The courier company was not able to deliver your parcel by your address.
Cause: Error in shipping address.
You may pickup the parcel at our post office.
Please attention!
For mode details and shipping label please see the attached file.
Print this label to get this package at our post office.
Please do not reply to this e-mail, it is an unmonitored mailbox!
Thank you,
UPS Logistics Services.
Malicious URLs
bestseoamerica .com/ponyb/gate.php
austinremoterecording .com/ponyb/gate.php
audiomasteringsearch .com/ponyb/gate.php
audiomasteringmeistro .com/ponyb/gate.php
sistersnstyle .co/4bnsSjBb.exe
destinationgreece .com/7tW.exe
villa-anastasia-crete .com/JWHvdgW.exe
kahrobaa .com/14VkWHU0 .exe
Malicious File Name and MD5:
UPS_Label_<random>.zip (05c33cfcf22c5736c4a162f6d7c2eeac)
UPS-Label_Parcel_<random>.exe (bc48d3e736c66f577636ed486a990eeb)
Screenshot: https://gs1.wac.edgecastcdn.net/8019...KRF1qz4rgp.png
:mad: :fear: