Page 8 of 132 FirstFirst ... 4567891011121858108 ... LastLast
Results 71 to 80 of 1320

Thread: SPAM frauds, fakes, and other MALWARE deliveries...

  1. #71
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Bogus DHL emails / Angry Birds Star Wars Android apk...

    FYI...

    Bogus DHL emails serve malware
    - http://blog.webroot.com/2012/11/28/b...serve-malware/
    Nov 28, 2012 - "From UPS, USPS to DHL, bogus and malicious parcel tracking confirmations are a common social engineering technique often used by cybercriminals to trick users into clicking on malicious links or executing malicious attachments found in the spamvertised emails. Continuing what appears to be a working social engineering tactic, cybercriminals are currently mass mailing bogus DHL ‘Express Delivery Notifications’ in an attempt to trick users into executing the malicious attachment. Once executed, it opens a backdoor on the affected host allowing the cybercriminals behind the campaign complete access to the infected PC...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....am_malware.png
    Sample detection rate for the malicious attachment: MD5: b0d4dad91f8e56caa184c8ba8850a6bd * ... Trojan-Downloader.Win32.Andromeda.daq.
    What’s particularly interesting about this MD5 is that there are files named T-Mobile-Bill.pdf.exe that have also been submitted to VirusTotal, indicating that there’s a -another- T-Mobile themed campaign, that’s currently circulating in the wild. PEiD Signature of the file: BobSoft Mini Delphi -> BoB / BobSoft. It also creates %AllUsersProfile%\svchost.exe on the system, plus a Registry Value – “[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] SunJavaUpdateSched = “%AllUsersProfile%\svchost.exe” so that svchost.exe runs every time Windows starts."
    * https://www.virustotal.com/file/148a...is/1353774086/
    File name: DHL-EXPRESS-DELIVERY-NOTIFICATION.exe
    Detection ratio: 34/42
    Analysis date: 2012-11-24
    ___

    Fake Angry Birds Star Wars Android SMS Sender
    - http://www.gfi.com/blog/the-fail-is-...id-sms-sender/
    Nov 28, 2012 - "Back in April, fake copies of Angry Birds Space were in circulation – with the recent release of Angry Birds Star Wars, scammers have caused a great disturbance in the Force, as if millions of phones cried out in terror and were suddenly silenced... Fake apps are once again the order of the day – here’s one our Labs have found and taken a look at, offered up for download from a dedicated website over at
    angrybirdsstarwars-android(dot)ru [ 5.9.112.10 - AS24940**]
    > http://www.gfi.com/blog/wp-content/u...rsfakeapp1.png
    As with so many similar fakeouts, Android owners must download the app from the website then install it on their phone (downloading with anything other than your mobile device – say, a web browser – offers up a .jar file instead)... This one acts like a typical Boxer Android file, sending premium SMS messages before downloading a valid version of the software. All in all, a rather costly mistake given you could pay the one time fee for the legitimate Google Play download and Angry Bird yourself into a (non-scammed) frenzy instead. VirusTotal results can be found here*, and we detect this as Trojan.AndroidOS.Generic.A with VIPRE Mobile.
    End-users should always be cautious of websites offering up Android files that aren’t the Google Play store, especially when based around a hot new property or must-have game..."
    * https://www.virustotal.com/file/d1eb...is/1354052956/
    File name: Angry_Birds_Star_Wars_install.apk
    Detection ratio: 7/43
    Analysis date: 2012-11-27
    ** https://www.google.com/safebrowsing/...?site=AS:24940
    "... over the past 90 days, 5998 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2012-11-28, and the last time suspicious content was found was on 2012-11-28... Over the past 90 days, we found 817 site(s)... that appeared to function as intermediaries for the infection of 4963 other site(s)... We found 1714 site(s)... that infected 9332 other site(s)..."
    > http://sitevet.com/db/asn/AS24940
    Blacklisted URLs: 3081
    ___

    Changelog SPAM / ganadeion .ru
    - http://blog.dynamoo.com/2012/11/chan...nadeionru.html
    28 Nov 2012 - "This fake changelog spam leads to malware at ganadeion .ru:
    Date: Wed, 28 Nov 2012 05:21:35 -0500
    From: LinkedIn Password [password @ linkedin .com]
    Subject: Re: Changelog as promised (upd.)
    Hello,
    as prmised updated changelog - View
    C. BERGMAN


    The malicious payload is at [donotclick]ganadeion .ru:8080/forum/links/column.php hosted on some familiar looking IP addresses that you should block if you can:
    202.180.221.186 (GNet, Mongolia)
    203.80.16.81 (MYREN, Malaysia)
    208.87.243.131 (Psychz Networks, US)"
    ___

    Fake UPS email serves Fake AV
    - http://www.gfi.com/blog/festive-ups-...es-up-fake-av/
    Nov 28, 2012 - "... seasonal looking fake UPS delivery notification, claiming in broken English that “Your package delivered to the nearest Postal Office. When receiving, please show a mailing receipt. Address of the nearest office you can find on our website”.
    > http://www.gfi.com/blog/wp-content/u...xNI1r6pupn.png
    Depending on the spam campaign you happen to stumble upon, you’ll most likely be redirected through a collection of websites before arriving at your final destination which in this case happens to be Fake AV – specifically, System Progressive Protection.
    > http://www.gfi.com/blog/wp-content/u...upsfakeav2.png
    Fake UPS spam is a perennial favourite of Malware pushers... We detect the above as Lookslike.Win32.Winwebsec.p (v)... treat delivery notification emails with the utmost caution. If in doubt, simply visit the website of your chosen parcel delivery service and have fun typing in tracking codes instead. It’s a lot safer."

    Last edited by AplusWebMaster; 2012-11-28 at 18:14.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #72
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake T-mobile / Vodafone U.K. malicious emails...

    FYI...

    Fake T-mobile U.K. malicious emails
    - http://blog.webroot.com/2012/11/29/c...serve-malware/
    Nov 29, 2012 - "Cybercriminals are currently impersonating T-Mobile U.K, in an attempt to trick its customers into downloading a bogus billing information report. Upon execution, the malware opens a backdoor on the affected host, allowing the cybercriminals behind the campaign complete access to the infected PC...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....ng_malware.png
    ... malicious executable: MD5: b0d4dad91f8e56caa184c8ba8850a6bd * ... Worm:Win32/Gamarue
    That’s the same MD5 that was served in the recently profiled “Bogus DHL ‘Express Delivery Notifications’ serve malware” malicious campaign..."
    * https://www.virustotal.com/file/148a...is/1353777713/
    File name: T-Mobile-Bill.pdf.exe
    Detection ratio: 35/44
    Analysis date: 2012-11-24
    ___

    Fake Vodafone U.K. malicious emails
    - http://blog.webroot.com/2012/11/28/c...notifications/
    Nov 28, 2012 - "Over the past couple of days, cybercriminals have launched yet another massive spam campaign, once again targeting U.K users. This time, they are impersonating Vodafone U.K, in an attempt to trick its customers into executing a bogus MMS attachment found in the malicious emails. Upon execution, the sample opens a backdoor on the affected hosts, allowing the cybercriminals behind the campaign complete access to the affected PC...
    Sample screenshot from the spamvertised email:
    > https://webrootblog.files.wordpress....tification.png
    ... malicious attachment: MD5: 3ce2b9522a476515737d07b877dae06e * ... Trojan-Downloader.Win32.Andromeda.coh.
    Upon execution, the sample creates %AllUsersProfile%\svchost.exe on the host. It also creates a Registry Value - [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] -> SunJavaUpdateSched = “%AllUsersProfile%\svchost.exe” so that svchost.exe starts evert time Windows starts..."
    * https://www.virustotal.com/file/cd3e...is/1353773239/
    File name: Vodafone_MMS.jpg.exe
    Detection ratio: 36/44
    Analysis date: 2012-11-24
    ___

    More "Wire Transfer" SPAM / dimarikanko .ru
    - http://blog.dynamoo.com/2012/11/wire...rikankoru.html
    29 Nov 2012 - "This fake "Wire Transfer" spam leads to malware on dimarikanko .ru:
    Date: Thu, 29 Nov 2012 06:01:55 +0700
    From: LinkedIn Connections [connections @ linkedin .com]
    Subject: Re: Fwd: Wire Transfer (75631MU030)
    Dear Bank Account Operator,
    WIRE TRANSFER: FED675249061747420
    CURRENT STATUS: PENDING
    Please REVIEW YOUR TRANSACTION as soon as possible.


    The malicious payload is at [donotclick]dimarikanko .ru:8080/forum/links/column.php hosted on a bunch of familiar looking IP addresses which have been used in several recent attacks:
    202.180.221.186 (GNet, Mongolia)
    203.80.16.81 (MYREN, Malaysia)
    208.87.243.131 (Psychz Networks, US)..."
    ___

    Vobfus sites to block
    - http://blog.dynamoo.com/2012/11/vobf...-to-block.html
    29 Nov 2012 - "These domains and sites appear to be connected to the Vobfus worm, hosted on 222.186.36.108 (Chinanet Jiangsu Province Network). There seems to be quite a bit of this -worm- about..."
    (More detail at the dynamoo URL above.)

    What’s the Fuss with WORM_VOBFUS?
    - http://blog.trendmicro.com/trendlabs...h-worm_vobfus/
    Nov 29, 2012 - "Some malware are more persistent than others – like WORM_VOBFUS. This recent heap of WORM_VOBFUS variants seen spreading on Facebook does not exhibit new routines, but it is a good reminder for users about well-known, but easily forgotten safe computing practices... Disabling AUTORUN has its merits – but not everyone knows. Worms, like WORM_VOBFUS, are known to propagate by taking advantage of Windows Autorun feature on drives. To address this, users are often advised to disable Autorun to prevent their drives from being infected. For reason of inconvenience (or maybe forgetfulness?) users do -not- disable this feature... As WORM_VOBFUS and other threats using old but reliable exploit show, threats do not burn and turn into ashes easily. Sometimes, they fade away but surface again..."
    ___

    Dynamic DNS sites you might want to block II
    - http://blog.dynamoo.com/2012/11/dyna...ant-to_29.html
    29 Nov 2012 - "These Dynamic DNS domains belong to a mystery outfit called dnsdynamic .org, and several of them seem to be in the process of being abused by third parties (for example). The registrations seem to be anonymised, some poking around at the recent WHOIS history of one of these domains (freedynamicdns .com) reveals ownership details of:
    Manager, Domain manager @ invertebrateisp .com
    Invertebrate ISP
    PO Box 405
    Glenmont, New York 12077
    United States
    +1.2623946781

    More digging at invertabrateisp .com comes up with a real name:
    Wilde, Tim [redacted]
    [redacted]
    Glenmont, New York 12077
    United States
    [redacted] Fax --

    Anyway, Mr Wilde is -not- connected with the malicious activity going on with these domains, but he is providing a service that is being abused. Interestingly he founded DynDNS before selling it on. Dynamic DNS services can be useful, but my personal recommendation is that you should consider blocking them as the bad guys are very good at abusing them. Overall, these are not as bad as the ones run by ChangeIP .com (see here*). There are two versions of this list, one links through to the Google Safe Browsing diagnostics report in case you want to review them on a case-by-case basis before blocking them (-yellow- highlighted ones have some malware, -red- highlighted ones are blocked by Google). The second one is a plain list of everything in case you want to block them completely..."
    (More detail and "the lists" at the dynamoo URL above)

    * http://blog.dynamoo.com/2012/11/dyna...t-want-to.html
    ___

    DNS server redirections ...
    - http://www.theregister.co.uk/2012/11...ania_dns_hack/
    28 Nov 2012 - "A hacker -redirected- web surfers looking for Yahoo, Microsoft or Google to a page showing a TV test card by apparently poisoning Google's public DNS system. Punters and organisations relying on Google's free service were affected, rather than the websites themselves being compromised. Visitors to yahoo .ro, microsoft .ro and google .ro were served a message from an Algerian miscreant using the moniker MCA-CRB. Traffic destined for the Romanian websites of Kaspersky Lab and Paypal was also hijacked... MCA-CRB is a prolific online graffiti artist who has defaced at least 5,000 sites, according to records kept by Zone-H*. The latest attack was carried out to gain bragging rights rather than to trouser a profit or stage a political protest... Last week, defaced copies of Google, Yahoo!, Microsoft, eBay and Apple's Pakistan websites were shown to surfers, again as a result of a DNS hijack... the affected Romanian sites was restored by Wednesday lunchtime, except Paypal.ro which proved difficult to reach in any case..."
    * http://www.zone-h.org/archive/notifier=MCA-CRB
    ___

    Bogus ‘Meeting Reminder” emails serve malware
    - http://blog.webroot.com/2012/11/29/b...serve-malware/
    Nov 29, 2012 - "Cybercriminals are mass mailing malicious emails about a meeting you wouldn’t want to attend .. Once executed, the malicious attachment opens a backdoor on the affected host, allowing the cybercriminals behind the campaign to gain complete access to the affected host. Naturally, we’ve been monitoring their operations for quite some time, and are easily able to identify multiple connections between their previously launched campaigns...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....am_malware.png
    ... the malicious executable: MD5: a684feff699bb7e3b8814c32c1da8277 * ... Worm:Win32/Cridex.E.
    It also creates the following registry keys:
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CFBDC89D4
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\S25BC2D7B
    The newly created Registry Value is:
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    KB00121600.exe = “”%AppData%\KB00121600.exe” so that KB00121600.exe runs every time Windows starts.
    Upon execution, the sample phones back to 64.150.187.72 :8080/AJw/UCygrDAA/Ud+asDAA (AS10316**)... We’ve also seen the same IP (64.150.187.72) used as name server in a previously profiled malicious campaign..."
    * https://www.virustotal.com/file/1be5...is/1353778430/
    File name: Report.exe
    Detection ratio: 38/44
    Analysis date: 2012-11-24
    ** https://www.google.com/safebrowsing/...?site=AS:10316

    Last edited by AplusWebMaster; 2012-11-29 at 23:49.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #73
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Bogus Intuit / Invoice emails serve malware and client-side exploits

    FYI...

    Bogus ‘Intuit Software Order Confirmations’ lead to BlackHole Exploit Kit
    - http://blog.webroot.com/2012/11/30/b...e-exploit-kit/
    Nov 30, 2012 - "Sticking to their well proven practice of systematically rotating impersonated brands, the cybercriminals behind a huge majority of the malicious campaigns that we’ve been profiling recently are once again impersonating Intuit in an attempt to trick its customers into clicking on links exposing them to the client-side exploits served by the BlackHole Exploit Kit...
    Sample screenshot from the spamvertised email:
    > https://webrootblog.files.wordpress....ts_malware.png
    Sample spamvertised URL re-director: hxxp ://www.mysnap .com.tw/sites/default/files/upload.htm?RANDOM_CHARACTERS
    Client-side exploits serving URL: hxxp ://moneymakergrow .ru:8080/forum/links/column.php
    Malicious domain name reconnaissance:
    moneymakergrow .ru – 202.180.221.186, AS24496; 203.80.16.81, AS24514; 207.126.57.208
    Name server: ns1.moneymakergrow .ru – 62.76.178.233
    Name server: ns2.moneymakergrow .ru – 132.248.49.112
    Name server: ns3.moneymakergrow .ru – 84.22.100.108
    Name server: ns4.moneymakergrow .ru – 65.99.223.24
    ... Although we couldn’t reproduce the client-side exploitation, we’ve already seen the majority of these malicious domains in previously profiled campaigns..."
    ___

    Bogus ‘End of August Invoices’ emails serve malware and client-side exploits
    - http://blog.webroot.com/2012/11/30/b...side-exploits/
    Nov 30, 2012 - "Cybercriminals have recently launched yet another massive spam campaign attempting to trick users into clicking on malicious links or executing malicious attachments found in the spamvertised emails...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....e_exploits.png
    Sample detection rate for the malicious attachment: MD5: 8b194d05c7e7f96a37b1840388231791 * ... Trojan:Win32/Ransom
    Sample client-side exploits serving URL: hxxp ://forumibiza .ru:8080/forum/links/column.php
    Although we couldn’t obtain the actual payload, the gathered intelligence indicates that this is a campaign launched by the same group that we’ve been monitoring for a few weeks now, allowing us to more effectively expose their campaigns and protect Internet users...
    Malicious domain name reconnaissance:
    forumibiza.ru – 65.99.223.24, AS30496; 103.6.238.9, AS21125; 203.80.16.81, AS24514
    Name server: ns1.forumibiza .ru – 62.76.186.190
    Name server: ns2.forumibiza .ru – 84.22.100.108
    Name server: ns3.forumibiza .ru – 50.22.102.132
    Name server: ns4.forumibiza .ru – 213.251.171.30
    ... malicious domains also respond to the same IPs (65.99.223.24; 103.6.238.9; 203.80.16.81). We’ve already seen these in several previously profiled malicious campaigns..."
    (More detail at the webroot URL above.)
    * https://www.virustotal.com/file/d86d...is/1353823689/
    File name: Invoices.exe
    Detection ratio: 39/44
    Analysis date: 2012-11-25
    ___

    (Here they come...) Santa SCAMS...
    - http://community.websense.com/blogs/...mta-claus.aspx
    Nov 30, 2012 - "... detected a marked increase in spam emails seeking to exploit fans of the big man himself: Santa Claus... They claim to offer alternative services to ensure that your "little ones" receive personalized responses from Santa. As is often the case in today’s unsolicited email world, the links within these emails don’t take you to a reputable and Santa-approved communication facilitator. Rather than being prompted for personal details about your little ones (which in itself poses an interesting discussion of internet safety and the sharing of personal details with random websites) you’ll probably find that you’re either a winner, or a potential winner, of some new fruit-branded hardware. All you have to do is complete a survey or an affiliate offer...
    > http://community.websense.com/cfs-fi...360.santa1.png
    ... subject lines to catch your attention and elicit a response:
    - Personal Letter From Santa For Your Child
    - (A) Letter From Santa For Your Child
    - Santa Claus Letters
    - A personal letter from Santa for your little ones
    - Custom Santa Letters
    > http://community.websense.com/cfs-fi...848.santa2.png
    Clicking the "Click Here" links within many of these messages directs you to an official-looking web-browser opinion survey, tailored to the browser from which you are viewing the page: Simple browser detection and IP geolocation techniques are used to appear convincing.
    Unfortunately, other than the opinion survey, the only personalized item you’re likely to receive from this point on is more spam, scams, or empty offers. No amount of form-filling, survey submissions, or offer completions are likely to result in the desired letter from Santa Claus. Therefore, if you are looking to assist Santa with his letter-sending duties, please stick to reputable organizations. Many charities, for example, provide this service legitimately..."
    ___

    "Copies of Policies" SPAM / podarunoki .ru
    - http://blog.dynamoo.com/2012/11/copi...arunokiru.html
    30 Nov 2012 - "This spam leads to malware on podarunoki .ru:
    Date: Fri, 30 Nov 2012 04:54:30 -0300
    From: Jone Castaneda via LinkedIn [member@linkedin.com]
    Subject: RE: Leonie - Copies of Policies.
    Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
    Here is the Package and Umbrella,
    and a copy of the most recent schedule.
    Leonie Doyle,
    ==========
    Date: Fri, 30 Nov 2012 02:32:21 -0400
    From: sales1@[victimdomain].com
    Subject: RE: Samson - Copies of Policies.
    Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
    Here is the Package and Umbrella,
    and a copy of the most recent schedule.
    Samson Henry,


    The malicious payload is at [donotclick]podarunoki .ru:8080/forum/links/column.php hosted on some familiar IP addresses which should be blocked if you can:
    202.180.221.186 (GNet, Mongolia)
    203.80.16.81 (MYREN, Malaysia)..."
    ___

    iTunes SPAM / mokingbirdgives .org
    - http://blog.dynamoo.com/2012/11/itun...dgivesorg.html
    30 Nov 2012 - "This fake iTunes spam leads to malware on mokingbirdgives .org:
    From: iTunes itunes @ new .itunes .com
    To: purchasing [purchasing @victimdomain .com]
    Date: 30 November 2012 17:02
    Subject: Your receipt #16201509085048
    Billed To:
    %email%
    Order Number: M1V008146011
    Receipt Date: 30/11/2012
    Order Total: $699.99
    Billed To: Credit card
    Item Number Description Unit Price
    1 Postcard (View\Download )
    Cancel order Not your order?Report a Problem $699.99
    Subtotal: $699.99
    Tax: $0.00
    Order Total: $699.99
    Please retain for your records.
    Please See Below For Terms And Conditions Pertaining To This Order.
    Apple Inc.
    You can find the iTunes Store Terms of Sale and Sales Policies by launching your iTunes application and clicking on Terms of Sale or Sales Policies
    FBI ANTI-PIRACY WARNING
    UNAUTHORIZED COPYING IS PUNISHABLE UNDER FEDERAL LAW.
    Answers to frequently asked questions regarding the iTunes Store can be found at http ://www.apple .com/support/itunes/store/
    Apple ID Summary • Detailed invoice
    Apple respects your privacy.
    Copyright © 2011 Apple Inc. All rights reserved


    The malicious payload is at [donotclick]mokingbirdgives .org/less/demands-probably.php (report here) hosted on 184.82.100.201 (HostNOC, US) along with the following domains which also appear to be malicious: ..."
    (Long list at the dynamoo URL above..)

    Last edited by AplusWebMaster; 2012-12-01 at 03:40.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #74
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Malicious email MMS targets mobile phone users

    FYI...

    Malicious email MMS targets mobile phone users
    - http://community.websense.com/blogs/...one-users.aspx
    2 Dec 2012 - "... Websense... has detected a malicious spam campaign that tries to exploit customers of major mobile phone companies. Specifically, we have detected thousands of emails claiming users have received MMS content via email localized to Australian and German carriers late last week:
    > http://community.websense.com/cfs-fi.../3731.both.png
    Because mobile phone use is an everyday activity, users could be tricked into opening and running attachments, especially those that appear to come from their carriers. Once the malware is launched, it connects to a list of remote servers to download more malicious binaries. What is interesting about these samples is that they are heavily encrypted and have many anti-debug tricks. Unlike other malware, this sample deploys several decryption phases before finally executing its malicious function. Even more interesting, it implements all its tricks, like decryption and patching, only in memory... It downloads malicious binaries from these remote servers:
    > http://community.websense.com/cfs-fi...downloader.jpg
    173.254.28.81 ... During our analysis, some of the remote servers were still available, and the malicious binary files were still downloadable..."
    ___

    More Wire Transfer SPAM / panamechkis .ru
    - http://blog.dynamoo.com/2012/12/wire...mechkisru.html
    3 Dec 2012 - "This fake wire transfer spam leads to malware on panamechkis .ru:
    Date: Mon, 3 Dec 2012 11:34:38 +0330
    From: HarrisonCrumm @ mail .com
    Subject: RE: Wire Transfer cancelled
    Dear Customers,
    Wire transfer was canceled.
    Rejected transfer:
    FED NUMBER: 1704196955WIRE580676
    Transaction Report: View
    Federal Reserve Wire Network


    The malicious payload is at [donotclick]panamechkis .ru:8080/forum/links/column.php hosted on:
    113.197.88.226 (ULNetworks, Korea)
    202.180.221.186 (GNet, Mongolia)
    203.80.16.81 (MYREN, Malaysia)
    Of these, 113.197.88.226 seems to be a new one which should be added to your blocklists."
    ___

    GFI Labs Email Roundup for the Week
    - http://www.gfi.com/blog/gfi-labs-ema...or-the-week-4/
    Dec 3, 2012 - "... noteworthy spam samples found and documented by our researchers in the AV Labs in our Tumblr page*..."
    * http://gfisoftware.tumblr.com/
    NY Better Business Bureau Attachment Spam - December 03, 2012
    Malicious HP ScanJet Spam Continue - December 03, 2012
    Malicious Wire Transfer Spam Continued - Dec 3, 2012
    Account has been blocked - Dec 2, 2012
    RapidFAX Spam - Dec 3, 2012
    NACHA Spam: Your Direct Deposit software is out of date
    eFax Corporate Message Spam - Nov 29, 2012
    Malicious FedEx Spam Continues - Nov 24, 2012 ...
    ___


    - http://www.ironport.com/toc/

    - http://tools.cisco.com/security/cent...utbreak.x?i=77
    Malicious Personal Pictures Attachment E-mail Messages - December 04, 2012
    Fake Scanned Document E-mail Messages - December 04, 2012
    Malicious Attachment E-mail Messages - December 04, 2012
    Fake Picture Link E-mail Messages - December 04, 2012
    Fake Tax Refund Notification E-mail Messages - December 04, 2012
    Fake Credit Card Transaction Notification E-mail Messages - December 04, 2012
    Fake Scanned Document E-mail Messages - December 03, 2012
    Fake ADP Digital Certificate Notification E-mail Messages - December 03, 2012
    Fake Business Complaint E-mail Messages - December 03, 2012
    Fake FedEx Shipment Notification E-mail Messages - December 03, 2012
    Fake Xerox Scan Attachment E-mail Messages - December 03, 2012
    Fake Picture Link E-mail Messages - December 03, 2012
    Malicious Personal Pictures Attachment E-mail Messages - December 03, 2012
    Fake Picture Posting Notification E-mail Messages - December 03, 2012
    Fake Discount Purchases Notification E-mail Messages - December 03, 2012
    Fake Telegram Notification E-mail Messages - December 03, 2012 ...

    Last edited by AplusWebMaster; 2012-12-04 at 22:06.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #75
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake FedEx emails lead to malware

    FYI...

    Fake FedEx emails lead to malware
    - http://blog.webroot.com/2012/12/04/f...ad-to-malware/
    Dec 4, 2012 - "At the end of October, a cybercriminal or group of cybercriminals launched three massive spam campaigns in an attempt to trick users into clicking on a deceptive link and downloading a malicious attachment. Upon execution, the malware phones back to the command and control servers operated by the party that launched it, allowing complete access to the infected PC. This time they didn’t try impersonating USPS, UPS or DHL, but FedEx...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....ware.png?w=481
    Second screenshot of a sample spamvertised email, again, part of the same campaign:
    > https://webrootblog.files.wordpress....late.png?w=545
    Third screenshot of a sample spamvertised email used in the campaign:
    > https://webrootblog.files.wordpress....late.png?w=495
    Sample detection rate for the first sample: MD5: 0e2e1ef473bb731d462fb1c8b3dd7089 * ... Trojan.Win32.Buzus.mruv
    Upon execution, it phones back to the following URLs:
    hxxp ://91.121.90.80 :8080/...
    hxxp ://84.40.69.119 :8080/...
    hxxp ://211.172.112.7 :8080/...
    Sample detection rate for the second sample: MD5: ab25d6dbf9b041c0a7625f660cfa17aa ** ... Trojan-Dropper.Win32.Dapato.bxhg
    Upon execution, it phones back to the following URLs:
    hxxp //59.25.189.234 :8080/...
    hxxp //140.135.66.217 :8080/...
    hxxp //82.113.204.228 :8080/...
    hxxp //59.126.131.132 :8080/...
    None of these IPs currently respond to any specific domains, besides 59.126.131.132.
    songwriter .tw is currently responding to 59.126.131.132 – Email: songwriter .tw@ gmail .com...
    > https://webrootblog.files.wordpress....ver.png?w=1024
    The domain seems to be a legitimate Taiwanese songwriting company/individual, indicating that their server has been compromised and is currently used as command and control server.
    Sample detection rate for the third sample: MD5: 252c797959273ff513d450f9af1d0242 *** ... TrojanDownloader:Win32/Kuluoz.B..."
    * https://www.virustotal.com/file/eab5...is/1354489330/
    File name: Postal_Receipt.exe
    Detection ratio: 35/46
    Analysis date: 2012-12-02
    ** https://www.virustotal.com/file/2b6e...is/1354489404/
    File name: Postal_Receipt1.exe
    Detection ratio: 37/46
    Analysis date: 2012-12-02
    *** https://www.virustotal.com/file/ecb9...is/1354489465/
    File name: PostalReceipt2.exe
    Detection ratio: 25/46
    Analysis date: 2012-12-02
    ___

    "ARK Bureau" fake job offer
    - http://blog.dynamoo.com/2012/12/ark-...job-offer.html
    4 Dec 2012 - "The ARK Architecture Bureau is a genuine company. This fake job offer is -not- from ARK Bureau, but is some sort of illegal activity such as money laundering.
    From: Odette Holcomb [mailto:nbnian@esonchem.co.kr]
    Sent: 03 December 2012 12:32
    Subject: Help wanted.
    POSITION: Customer Assistant
    ABOUT COMPANY:
    ARK Bureau has served hundreds of clients in the United Kingdom, Poland, France and Germany since 1998.
    The firm was created by Lorinda Rogers, a young architect of Canadian origin. From its inception, ARK Bureau.s vision for design and construction was based on system approach, incorporating both building and landscape design. That philosophy has always meant the highest quality for our clients. That.s probably why ARK Bureau enjoys a strong loyalty from the past customers.
    Now we have open vacancy in the U.S.: Customer Assistant
    RESPONSIBILITIES:
    - Process payments from customers;
    - Filing invoices, statements and associated documents;
    - Meet and exceed performance and time management goals;
    - Other duties as required.
    GENERAL SKILLS:
    - High communication skills;
    - Strong problem solving and planning skills;
    - Experienced computer & internet user.
    APPLY:
    To apply please: arkbureaumanager @nokiamail .com


    An alternative version uses the email address of arkbureau_manager @nokiamail .com. The two samples that I have seen have originating IP addresses of 174.52.171.8 (Comcast, US) and 109.173.54.245 (NCNET, Russia). You should give this fake company a wide berth unless you want to end up in serious trouble with law enforcement."
    ___

    ADP SPAM / fsblimitedrun .pro
    - http://blog.dynamoo.com/2012/12/adp-...tedrunpro.html
    3 Dec 2012 - "This fake ADP spam leads to malware on fsblimitedrun .pro:
    From: ADP Transaction Status
    Date: 3 December 2012 17:55
    Subject: ADP Major Accounts Processed Case
    Valued customer:
    James lately covered Transaction at your account. Event # 433933082.
    Case Caption: 6CO7
    Incident Substantiation: Download
    We at ADP obtain to create a personalized and client focused experience with every client interaction.
    Please view transaction changed by visiting the link below.
    Click here - ADP Major Accounts Operation Progress mentioned above
    Best Wishes,
    James Brooks
    Vice President of Customer Care Department ADP
    ADP Major Accounts
    ***Reminder***
    Please remember to complete your Semi-Annual Service Quality Survey!
    Our Goal is to ensure you are VERY SATISFIED with each interaction you have with our Service Associates and we ask that you consider your overall experience in the 6 months preceding your receipt of the survey. We strive to provide WORLD CLASS SERVICE and determine our success by your satisfaction with ADP's services.
    **********
    This e-mail was delivered from an robot account.
    Please don't reply to this message. auomatic informational system unable to accept incoming email.


    The malicious payload is at [donotclick]fsblimitedrun .pro/detects/survey_success-complete.php hosted on 41.215.225.202 (Essar Wireless Kenya Ltd) along with the following malicious domain: fdic-update-install .info . Blocking access to this IP address would probably be prudent.
    ___

    "Scan from a Hewlett-Packard ScanJet" SPAM / somaliaonfloor .ru
    - http://blog.dynamoo.com/2012/12/scan...njet-spam.html
    3 Dec 2012 "This fake printer spam leads to malware on somaliaonfloor .ru:
    Date: Mon, 3 Dec 2012 09:25:59 -0600
    From: Bebo Service [service@noreply.bebo.com]
    Subject: Fwd: Re: Scan from a Hewlett-Packard ScanJet #3838
    A document was scanned and sent to you using a Hewlett-Packard HP15310290
    Sent to you by: ROSIO
    Pages : 8
    Filetype(s): Images (.jpeg) View
    ==========
    Date: Mon, 3 Dec 2012 11:06:22 -0500
    From: "service@paypal.com" [service@paypal.com]
    Subject: Re: Fwd: Scan from a Hewlett-Packard ScanJet 33712789
    A document was scanned and sent to you using a Hewlett-Packard HP8220647
    Sent to you by: CLAUDIA
    Pages : 7
    Filetype(s): Images (.jpeg) View


    The malicious payload is at [donotclick]somaliaonfloor .ru:8080/forum/links/public_version.php hosted on the same IPs used in this attack.
    113.197.88.226 (ULNetworks, Korea)
    202.180.221.186 (GNet, Mongolia)
    203.80.16.81 (MYREN, Malaysia)..."
    ___

    "Most recent events on Facebook" SPAM / attachedsignup .pro
    - http://blog.dynamoo.com/2012/12/most...book-spam.html
    4 Dec 2012 - "This fake Facebook spam leads to malware on Most recent events on attachedsignup .pro:
    Date: Tue, 4 Dec 2012 15:19:16 +0100
    From: " Facebook Security Team" [fractionallyb9 @hendrickauto .com]
    Subject: Most recent events on Facebook
    facebook
    Hi [redacted],
    You have closed your Facebook account. You can rebuild your account whenever you wish by logging into Facebook using your current login email address and password. Subsequently you will be able to take advantage of the site as usually.
    Please use the link below to reactivate :
    http://www.facebook.com/home.php
    If this was you, please pass over this informer. If this wasn't you, please secure your account, as some outlaw person may be explore it.
    Best regards, The FaceBook Team
    Please note: Facebook will never ask for your personal data through email.
    This message was sent to [redacted] from your profile details. Facebook, Inc., Attention: Department 437, PO Box 20000, Palo Alto, CA 96906


    The malicious payload is at [donotclick]attachedsignup .pro/detects/links-neck.php (report here*) hosted on 41.215.225.202 (Essar Wireless Kenya Ltd) which also hosts the probably malicious domain sessionid0147239047829578349578239077 .pl..."
    * http://wepawet.iseclab.org/view.php?...631759&type=js
    ___

    US Airways SPAM / attachedsignup .pro
    - http://blog.dynamoo.com/2012/12/us-a...signuppro.html
    4 Dec 2012 - "This fake US Airways spam leads to malware on attachedsignup .pro:
    From: US Airways - Booking [reservations @myusairways .com][
    Date: 4 December 2012 14:30
    Subject: US Airways online check-in.
    You can check in from 24 hours and up to 60 minutes before your flight (2 hours if you're flying internationally). After that, all you have to do is print your boarding pass and go to the gate.
    Purchase code: 183303
    Check-in online: Online booking details
    Payment method: Credit card
    Money will be withdrawn in next 3 days
    Voyage
    5990
    Departure city and time
    Massachusets MA (DCA) 10:10 AM
    Depart date: 12/05/2012
    We takes care to protect your privacy. Your information is kept private and confidential. For information about our privacy policy visit usairways.com.
    US Airways, 145 W. Rio Salado Pkwy, Tempe, AK 93426 , Copyright US Airways , All rights reserved.


    The payload and IP addresses are identical to this spam* doing the rounds today."
    * http://blog.dynamoo.com/2012/12/most...book-spam.html
    ___

    Facebook "You have notifications pending" SPAM / francese .ru
    - http://blog.dynamoo.com/2012/12/face...s-pending.html
    4 Dec 2012 - "This fake Facebook spam leads to malware on francese.ru:
    Date: Tue, 4 Dec 2012 03:38:42 +0000
    From: KaseyElleman @victimdomain .com
    Subject: You have notifications pending
    facebook
    Hi,
    Here's some activity you may have missed on Facebook.
    SALLIE FELIX has posted statuses, photos and more on Facebook.
    Go To Facebook
    See All Notifications
    This message was sent to postinialerts@[redacted]. If you don't want to receive these emails from Facebook in the future or have your email address used for friend suggestions, please click: unsubscribe.
    Facebook, Inc. Attention: Department 415 P.O Box 10005 Palo Alto CA 94303


    The malicious payload is at [donotclick]francese .ru:8080/forum/links/column.php hosted on the following IP addresses:
    42.121.116.38 (Aliyun Computing Co, China)
    202.180.221.186 (GNet, Mongolia)
    203.80.16.81 (MYREN, Malaysia)
    208.87.243.131 (Psychz Networks , US)
    219.255.134.110 (SK Broadband, Korea)
    Plain list for copy-and-pasting:
    42.121.116.38
    202.180.221.186
    203.80.16.81
    208.87.243.131
    219.255.134.110
    ..."

    Last edited by AplusWebMaster; 2012-12-04 at 17:47.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #76
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Zbot sites to block 5/12/12

    FYI...

    Zbot sites to block 5/12/12
    - http://blog.dynamoo.com/2012/12/zbot...ock-51212.html
    5 Dec 2012 - "These domains and IPs are involved in malware distribution, especially the Zbot trojan. Most are using the nameservers in the dnsnum10 .com domain, or are co-hosted on the same server and have malicious characteristics. I've come up with a recommended blocklist based on the characteristics on the netblocks in question. If you are based in Russia, Ukraine, Poland or Iran then you may want to review these carefully.
    IP addresses and hosts
    31.184.244.73 (TOEN Incorporated, UAE)
    62.122.74.47 (Leksim, Poland)
    77.72.133.69 (Colobridge, Germany)
    78.46.205.130 (Hetzner, Germany)
    78.140.135.211 (Webazilla, Gibraltar)
    85.143.166.132 (PIRIX, Russia)
    87.107.121.131 (Soroush Rasanheh Company Ltd, Iran)
    91.211.119.56 (Zharkov Mukola Mukolayovuch, Ukraine)
    91.231.156.25 (Sevzapkanat-Unimars, Russia)
    91.238.83.56 (Standart LLC, Moldova)
    146.185.255.161 (Sergeev Sergei Yurievich PE, Russia)
    178.162.132.202 (Tower Marketing, Belize)
    178.162.134.176 (Silin Vitaly Petrovich, Belarus)
    188.93.210.28 (Hosting Service, Russia)
    195.88.74.110 (Info Data Center, Bulgaria)
    198.144.183.227 (Colocrossing, US)
    ... Recommended blocklist:
    31.184.244.73
    62.122.72.0/21
    77.72.133.69
    78.46.5.128/29
    78.140.135.211
    85.143.166.0/24
    87.107.96.0/19
    91.211.119.56
    91.231.156.0/24
    91.238.83.0/24
    146.185.255.0/24
    178.162.132.0/24
    178.162.134.128/26
    188.93.210.28
    195.88.74.110
    198.144.183.227
    ..."
    (More detail at the dynamoo URL above.)
    ___

    BBB SPAM / leberiasun .ru
    - http://blog.dynamoo.com/2012/12/bbb-...eriasunru.html
    5 Dec 2012 - "This fake BBB spam leads to malware on leberiasun .ru:
    Date: Wed, 5 Dec 2012 11:32:47 +0330
    From: Bebo Service [service @noreply .bebo .com]
    Subject: Urgent information from BBB
    Attn: Owner/Manager
    Here with the Better Business Bureau notifies you that we have received a complaint (ID 243917811)
    from one of your customers with respect to their dealership with you.
    Please open the COMPLAINT REPORT below to obtain more information on this matter and let us know of your point of view as soon as possible.
    We are looking forward to your prompt reply.
    Regards,
    JONELLE Payne


    The malicious payload is at [donotclick]leberiasun .ru:8080/forum/links/column.php (report here) hosted on the following IPs:
    42.121.116.38 (Aliyun Computing Co, China)
    202.180.221.186 (GNet, Mongolia)
    208.87.243.131 (Psychz Networks, US)
    219.255.134.110 (SK Broadband, Korea)..."

    Last edited by AplusWebMaster; 2012-12-05 at 20:24.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #77
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down SPAM gets Socl - other BOGUS spam...

    FYI...

    SPAM gets Socl ...
    - http://www.gfi.com/blog/spam-gets-socl/
    Dec 6, 2012 - "Microsoft have thrown open the gates to their new social network, Socl (which has a faint whiff of Pinterest about it and is also pronounced “social”. No, really). It didn’t take spammers very long to sink their claws in... we have all the Canadian Pharmacy spam you can eat...
    > http://www.gfi.com/blog/wp-content/u.../soclspam1.jpg
    ... links all currently lead to a page touting a 404 error... we can only hope Microsoft (will) have a Banhammer in place to deal with what will no doubt be a bump up in bad content as word of the latest social network to hit the ground running spreads across the news. We haven’t come across any Malware links yet, but as with Tumblr, Pinterest and Twitter end-users shouldn’t abandon common sense in favour of shiny, blinky things carrying a sting in the tail..."
    ___

    Amazon SPAM / evokeunreasoning .pro
    - http://blog.dynamoo.com/2012/12/amaz...soningpro.html
    6 Dec 2012 - "A few different variants of this today, all pretending to be from Amazon and leading to malware on evokeunreasoning .pro:
    Date: Thu, 6 Dec 2012 17:32:38 +0200
    From: "Amazon . com" [digital-notifier@amazon.com]
    Subject: Your Amazon.com order receipt.
    Click here if the e-mail below is not displayed correctly.
    Follow us:
    Your Amazon.com Today's Deals See All Departments
    Dear Amazon.com Member,
    Thanks for your order, clongmore @arrowuk .com
    Did you know you can view and edit your orders online, 24 hours a day? Visit Your Account.
    Order Overview:
    E-mail Address: [redacted]
    Billing Address:
    1113 4th Street
    Fort North NC 71557-2319,,FL 67151}
    United States
    Phone: 1-491-337-0438
    Order Grand Total: $ 50.99
    Earn 3% rewards on your Amazon.com orders with the Amazon Visa Card. Learn More
    Order Summary:
    Details:
    Order #: C47-8578330-3362713
    Subtotal of items: $ 50.99
    ------
    Total before tax: $ 50.99
    Tax Collected: $0.00
    ------
    Grand Total: $ 50.00
    Gift Certificates: $ 0.99
    ------
    Total for this Order: $ 50.99
    Find Great Deals on Millions of Items Storewide
    We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort from Amazon.com, please opt-out here.
    2012 Amazon.com, Inc. or its affiliates. All rights reserved. Amazon, Amazon.com, the Amazon.com logo and 1-Click are registered trademarks of Amazon.com, Inc. or its affiliates. Amazon.com, 475 Larry Ave. N., Seattle, MI 83304-6203. Reference: 61704824
    Please note that this message was sent to the following e-mail address: [redacted]


    The malicious payload is at [donotclick]evokeunreasoning .pro/detects/slowly_apply.php but at the time of writing the domain does not seem to be resolving."
    ___

    Phishing For Bank Account Information
    - http://blog.webroot.com/2012/12/06/p...t-information/
    Dec 6, 2012 - "... always on the look out for anything that looks ‘phishy’, even if it’s on your own personal time. Today, I opened my personal email to find this:
    > https://webrootblog.files.wordpress....ng?w=413&h=444
    Although the email looked very convincing, I don’t bank with Smile Bank so I knew something was up. Smile Bank is an actual bank based in the UK. The bad guys used a spoofed email address to make it look like it came from the legit Smile Bank domain smile.co.uk. If someone did bank with Smile Bank, I can see how they could easily be tricked. It’s the “Click here to proceed” link that gives the bad guys away. The link goes to a page hosted by pier3 .hk, which is a legitimate domain, but appears to be compromised with a simple HTM page that is a -redirect- to the real malicious site. The redirect sends you here:
    > https://webrootblog.files.wordpress....ng?w=491&h=354
    ... This trick could easily be done with any large bank. Make sure to always be suspicious of any email claiming to be from your bank that -threatens- your account has been locked and insists that you need to enter your account information. Also, if the link to enter your account information isn’t to the URL of the bank it claims to be from, you know it’s malicious."
    ___

    More "Copies of policies" SPAM / cinemaallon .ru
    - http://blog.dynamoo.com/2012/12/copi...maallonru.html
    6 Dec 2012 - "This spam leads to malware on cinemaallon .ru:
    Date: Thu, 6 Dec 2012 06:41:01 -0500
    From: Isidro Pierre via LinkedIn [member @linkedin .com]
    Subject: RE: ASHTON - Copies of Policies.
    Unfortunately, I cannot obtain electronic copies of the Ocean, Warehouse or EPLI policy.
    Here is the Package and Umbrella,
    and a copy of the most recent schedule.
    ASHTON QUINONES,


    The malicious payload is at [donotclick]cinemaallon .ru:8080/forum/links/column.php hosted on the following familiar IPs:
    202.180.221.186 (Gnet, Mongolia)
    208.87.243.131 (Psychz Networks, US)..."
    ___

    Bogus ‘Facebook Account Cancellation Request’ emails serve client-side exploits and malware
    - http://blog.webroot.com/2012/12/05/b...s-and-malware/
    Dec 5, 2012 - "Facebook users, watch what you click on! Cybercriminals are currently mass mailing bogus “Facebook Account Cancellation Requests“, in an attempt to trick Facebook’s users into clicking on the malicious link found in the email. Upon clicking on the link, users are exposed to client-side exploits which ultimately drop malware on the affected host...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....ware.png?w=629
    ... Sample client-side exploits served: CVE-2010-0188; CVE-2011-3544; CVE-2010-0840
    Malicious domain name reconnaissance:
    lakkumigdc .com – 68.168.100.135 – Email: dolphinkarthi @gmail .com
    Name Server: NS1.MACROVIEWTECH .COM – 68.168.100.136
    Name Server: NS2.MACROVIEWTECH .COM – 68.168.100.137
    Domains responding to the same IP, including domains also registered with the same GMail account...
    Upon successsful client-side exploitation, the campaign drops MD5: 8b3979c1a9c85a7fd5f8ff3caf83fc56 * ... PWS-Zbot.gen.aru
    Upon execution, the sample creates the following file on the affected hosts:
    %AppData%\Ixriyv\emarosa.exe – MD5: A33684FD2D1FA669FF6573921F608FBB
    It also creates the following directories:
    %AppData%\Ixriyv
    %AppData%\Uxwonyl
    As well as the following Mutex: Local\{7A4AAF46-5391-8FF9-A32F-78A34C8B50D7}
    It then phones back to shallowave.jumpingcrab .com (93.174.95.78) on port 8012. Another similar subdomain on this host (takemeout.jumpingcrab .com), was also seen in a crowdsourced DDoS campaign in 2009..."
    * https://www.virustotal.com/file/cef2...6f00/analysis/
    File name: 8b3979c1a9c85a7fd5f8ff3caf83fc56
    Detection ratio: 3/46
    Analysis date: 2012-12-03
    ___

    eBay, PayPal SPAM / ibertomoralles .com
    - http://blog.dynamoo.com/2012/12/ebay...rallescom.html
    6 Dec 2012 - "These spam messages lead to malware on ibertomoralles .com:
    Date: Thu, 6 Dec 2012 13:12:16 -0600
    From: "PayPal" [service @paypal .com]
    Subject: Your Ebay.com transaction details.
    Dec 5, 2012 09:31:49 CST
    Transaction ID: U5WZP603SNLLWR5DT
    Hello [redacted],
    You sent a payment of $363.48 USD to Normand Akers.
    It may take a several minutes for this transaction to appear in your transactions history.
    Seller
    Normand-Akers @aol .com
    Instructions to seller
    You haven't entered any instructions.
    Shipping address - confirmed
    Hyde Rd
    Glendale SC 58037-0659
    United States
    Shipping details
    The seller hasn't provided any shipping details yet.
    Description Qty. Amount
    NordicTrack Mini Cycle
    Item# 118770508253 24 $363.48 USD
    Shipping and handling $24.99 USD
    Insurance - not offered ----
    Total $363.48 USD
    Payment $363.48 USD
    Payment sent to Normand Akers
    Receipt ID: D-69NQRGN113A3A9UQ3
    Issues with this transaction?
    You have 45 days from the date of the transaction to open a dispute in the Resolution Center.
    Please do not reply to this message. auto informer system unable to accept incoming messages. For immediate answers to your issues, visit our Help Center by clicking "Help" located on any PayPal page.
    PayPal Email ID PZ147
    ==========
    Date: Thu, 6 Dec 2012 19:57:37 +0100
    From: "PayPal" [noreply @paypal .com]
    Subject: Your Paypal.com transaction confirmation.
    Dec 5, 2012 09:50:54 CST
    Transaction ID: 8P7D295HFIIIMUC4Q
    Hello [redacted],
    You done a payment of $894.48 USD to Carol Brewster.
    It may take a few moments for this transfer to appear in your transactions history.
    Merchant
    Carol-Brewster @aol .com
    Instructions to seller
    You haven't entered any instructions.
    Shipping address - confirmed
    Pharetra Street
    Manlius NY 74251-6442
    United States
    Shipping details
    The seller hasn't provided any shipping details yet.
    Description Qty. Amount
    TaylorMade R11 Driver Golf Club
    Item# 703099838857 54 $894.48 USD
    Shipping and handling $14.49 USD
    Insurance - not offered ----
    Total $894.48 USD
    Payment $894.48 USD
    Payment sent to Carol Brewster
    Receipt ID: H-K01U2WSTLZZMRAB90
    Issues with this transaction?
    You have 45 days from the date of the purchase to issue a dispute in the Resolution Center.
    Please DO NOT reply to this message. auto-notification system can't accept incoming mail. For fast answers to your subjects, visit our Help Center by clicking "Help" located on any PayPal page.
    PayPal Email ID P8695


    The malicious payload is at [donotclick]ibertomoralles .com/detects/slowly_apply.php hosted on 59.57.247.185 (Xiamen JinLongLvXingChe, China). The following malicious domains also appear to be hosted on the same server..."
    (More detail at the dynamoo URL above.)

    Last edited by AplusWebMaster; 2012-12-06 at 22:54.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #78
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down #1 malware threat - Blackhole exploit kits

    FYI...

    #1 malware threat - Blackhole exploit kits
    - http://h-online.com/-1762913
    5 Dec 2012 - "... according to Sophos*, 30.81% of sites hosting it are in the United States, which is followed by Russia at 17.88% and Chile at 10.77%. Sophos says that between October 2011 and March 2012, almost 30% of detected threats were either directly from Blackhole or diversions to Blackhole kits that had been rigged on formerly reputable sites... Sophos says that in 2012 the biggest problems were cloud services, the Bring Your Own Device (BYOD) movement, hacking of SQL databases, improving social engineering methods, and an increasing number of attacks on the Android mobile operating system. The latter has seen everything from SMS fraud, apparent botnets on phones, banking malware, and bogus or rogue applications from application stores..."
    * http://www.sophos.com/en-us/security...e-exploit.aspx
    Video - 3:02

    Drive-by redirects and exploit sites - attack landscape on the net (graphic)
    > http://www.h-online.com/security/new...ew=zoom;zoom=4

    Defenses against the Blackhole exploit kit
    >> https://en.wikipedia.org/wiki/Blackh...le_exploit_kit
    " ... Make sure the browser, browser's plugins, and operating system are up to date..."

    Test your browser here: https://browsercheck.qualys.com/?scan_type=js
    ___

    - https://blogs.technet.com/b/security...edirected=true
    12 Nov 2012 - "... Blacole, a family of exploits used by the so-called Blackhole exploit kit to deliver malicious software through infected webpages, was the most commonly detected exploit family in the first half of 2012 by a large margin..."
    > https://blogs.technet.com/cfs-filesy...2D00_550x0.jpg
    Vulnerabilities targeted by the Blacole exploit kit in 1Q12 and 2Q12
    > https://blogs.technet.com/cfs-filesy...2D00_550x0.jpg

    Last edited by AplusWebMaster; 2012-12-09 at 01:44.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #79
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Bank/PayPal/iTunes emails lead to malware

    FYI...

    Malicious ‘Security Update for Banking Accounts’ emails lead to BlackHole Exploit Kit
    - http://blog.webroot.com/2012/12/07/m...e-exploit-kit/
    Dec 7, 2012 - "Cybercriminals have recently launched yet another massive spam campaign attempting to trick e-banking users into thinking that their ability to process ACH transactions has been temporarily disabled. Upon clicking on the link found in the malicious email, users are exposed to the client-side exploits served by the Black Hole Exploit Kit...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....ts_malware.png
    Sample spamvertised compromised URLs:
    hxxp ://promic .pl/page4.htm
    hxxp ://promic .pl/rating.htm
    Sample client-side exploits serving URLs:
    hxxp ://bamanaco .ru:8080/forum/links/column.php
    hxxp ://lentuiax .ru:8080/forum/links/column.php
    Malicious domains reconnaissance:
    bamanaco.ru – 82.165.193.26 (AS8560); 203.80.16.81 (AS24514); 216.24.196.66 (AS40676)
    Name servers:
    ns1.bamanaco .ru - 62.76.178.233
    ns2.bamanaco .ru – 41.168.5.140
    ns3.bamanaco .ru – 132.248.49.112
    ns4.bamanaco .ru – 209.51.221.247
    lentuiax .ru – 203.80.16.81 (AS24514)
    Name servers:
    ns1.lentuiax .ru – 62.76.178.233
    ns2.lentuiax .ru – 41.168.5.140
    ns3.lentuiax .ru – 132.248.49.112
    ns4.lentuiax .ru – 209.51.221.247
    Sample detection rate for the redirection script: MD5: 35e6ddb6ce4229d36c43d9d3ccd182f3 * ... Trojan-Downloader.JS.Iframe.dby.
    Although we couldn’t reproduce the malicious exploitation taking place through bamanaco .ru and lentuiax .ru, we found out that, during the time of the attack, similar client-side exploit serving URls were also responding to the same IPs, leading us to the actual malicious payload found on two of these domains..."
    (More detail available at the webroot URL above.)
    * https://www.virustotal.com/file/ff5e...is/1353822844/
    File name: August.html
    Detection ratio: 21/44
    Analysis date: 2012-11-25
    ___

    Fake PayPal Emails: Windows 8 and Vintage Photo Collections
    - http://www.gfi.com/blog/fake-paypal-...o-collections/
    Dec 7, 2012 - "If you want to panic over a mysterious transaction on Ebay to the tune of $564.48 for a “Microsoft Windows 8 Pro Anytime Upgrade”, then this is probably the email you’ve been waiting for.
    It reads:
    You have made an Ebay.com purchase.
    Hello [removed],
    You sent a payment of $564.48 USD to [removed].
    Microsoft Windows 8 Pro Anytime Upgrade
    Item# 16 $564.48 USD

    > http://www.gfi.com/blog/wp-content/u...2/ebaywin8.png
    Clicking the link in the fake PayPal email will take end-users to the usual round of Cridex / Blackhole URLs. On a similar note, there’s an additional email floating around that claims you purchased 84 copies of “Vintage photo collection sexy college girls 1990s or 2000s”.
    > http://www.gfi.com/blog/wp-content/u.../ebaywin82.png
    Last time we saw this one was back in June* where the tally was -23- ..."
    * http://blog.dynamoo.com/2012/06/payp...rshipznet.html
    ___

    iTunes "Christmas gift card" SPAM / api.myobfuscate .com / nikolamireasa .com
    - http://blog.dynamoo.com/2012/12/itun...gift-card.html
    6 Dec 2012 - "Here's a malware-laden spam with a twist:
    From: iTunes [shipping @new. itunes .com]
    To: purchasing [purchasing @ [redacted]]
    Date: 6 December 2012 20:59
    Subject: Christmas gift card
    Order Number: M1V7577311
    Receipt Date: 06/12/2012
    Shipping To: purchasing @[redacted]
    Order Total: $500.00
    Billed To: Hilary Shandonay, Credit card
    Item Number Description Unit Price
    1 Christmas gift card (View\Download ) $500.00
    Subtotal: $500.00
    Tax: $0.00
    Order Total: $500.00
    Please retain for your records.
    Please See Below For Terms And Conditions Pertaining To This Order.
    Apple Inc.
    You can find the iTunes Store Terms of Sale and Sales Policies by launching your iTunes application and clicking on Terms of Sale or Sales Policies
    FBI ANTI-PIRACY WARNING
    UNAUTHORIZED COPYING IS PUNISHABLE UNDER FEDERAL LAW.
    Answers to frequently asked questions regarding the iTunes Store can be found at http ://www.apple .com/support/itunes/store/
    Apple ID Summary ??????????¬?‚?? Detailed invoice
    Apple respects your privacy.
    Copyright ??????‚?© 2011 Apple Inc. All rights reserved


    In this case the link goes through a free web hosting site at [donotclick]longa-neara.ucoz .org which contains some heavily obfuscated javascript that eventually leads to a malicious landing page on [donotclick]nikolamireasa .com/less/demands-probably.php hosted on 188.93.210.133 (logol .ru, Russia). That IP hosts the following toxic domains that you should block:
    nikolamireasa .com
    portgazza. cu .cc
    hopercac. cu .cc
    hopercas. cu .cc
    ukumuxur. qhigh .com
    ymuvyjih.25u .com
    ... you might just want to cut your losses and block 188.93.210.0/23 too. Anyway, the curious thing is that the malicious javascript uses an intermediary obfuscation site called api.myobfuscate .com... if the bad guys have a use for it then you can bet they are probably about to abuse it in a big way. Both api.myobfuscate .com and www .myobfuscate .com are hosted on the same IP at 188.64.170.17 (also in Russia) which is part of a tiny netblock of 188.64.170.16/31 which you may as well block too. The 188.64.170.17 IP also contains the following domains which might also be abused in the same way:
    htmlobfuscator .com
    api.htmlobfuscator .com
    htmlobfuscator .info
    javascript-obfuscator .info
    javascriptcompressor .info
    javascriptcrambler .com
    javascriptobfuscate .com
    javascriptobfuscator .info
    myobfuscate .com
    api.myobfuscate .com
    obfuscatorjavascript .com
    api.obfuscatorjavascript .com
    js.robotext .com
    js.robotext .info
    js.robottext .ru

    In my opinion, obfuscating javascript is a really bad thing and there is no legitimate reason to use it. Blocking access to free-to-use obfuscation tools like this may run the risk of breaking some legitimate sites. But only if they have been coded by idiots."

    - http://www.avgthreatlabs.com/webthreats/
    ... last updated on Dec 08, 2012 GMT.
    Viruses & Threats on the Rise
    1) Cool Exploit Kit - 19.24% of all detections...
    2) Blackhole Exploit Kit - 19.16% of all detections...
    3) JavaScript Obfuscation - 12.70% of all detections...
    ___

    AICPA SPAM / ibertomoralles .org
    - http://blog.dynamoo.com/2012/12/aicp...rallesorg.html
    7 Dec 2012 - "I haven't seen fake AICPA spam like this for a while, it leads to malware on ibertomoralles .org:
    From: AICPA [noreply@aicpa.org]
    Date: 7 December 2012 16:55
    Subject: Your accountant license can be cancelled.
    You're receiving this information as a Certified Public Accountant and a member of AICPA.
    Having any problems reading this email? See it in your favorite browser.
    AICPA logo
    Revocation of CPA license due to income tax fraud accusations
    Dear AICPA participant,
    We have been informed of your potential involvement in tax return swindle on behalf of one of your employers. In obedience to AICPA Bylaw Article 700 your Certified Public Accountant position can be discontinued in case of the aiding of filing of a phony or fraudulent income tax return for your client or employer.
    Please be notified below and provide explanation of this issue to it within 14 work days. The rejection to provide elucidation within this time-frame would finish in decline of your Accountant status.
    Delation.pdf
    The American Institute of Certified Public Accountants.
    Email: service @aicpa .org
    Tel. 888.777.7077
    Fax. 800.362.5066
    ===================
    Date: Fri, 7 Dec 2012 18:31:58 +0100
    From: "AICPA" [do-not-reply @aicpa .org]
    Subject: Tax return assistance contrivance.
    You're receiving this note as a Certified Public Accountant and a part of AICPA.
    Having any problems reading this email? See it in your favorite browser.
    Cancellation of Public Account Status due to tax return indictment
    Respected accountant officer,
    We have received a note of your presumable interest in income tax fraud for one of your clients. In concordance with AICPA Bylaw Article 600 your Certified Public Accountant status can be discontinued in case of the event of submitting of a fake or fraudulent income tax return on the member's or a client's behalf.
    Please familiarize yourself with the complaint below and provide your feedback to it within 14 work days. The rejection to respond within this time-frame will result in end off of your CPA license.
    Delation.doc
    The American Institute of Certified Public Accountants.
    Email: service@aicpa.org
    Tel. 888.777.7077
    Fax. 800.362.5066


    The malicious payload is at [donotclick]ibertomoralles.org/detects/five-wise_leads_ditto.php hosted on the same Chinese IP address of 59.57.247.185 as used in this spam yesterday*."
    * http://blog.dynamoo.com/2012/12/ebay...rallescom.html
    ___

    BBB SPAM / ibertomoralles .org
    - http://blog.dynamoo.com/2012/12/bbb-...rallesorg.html
    "This bizarrely worded fake BBB spam leads to malware on ibertomoralles .org:
    Date: Fri, 7 Dec 2012 18:43:08 +0100
    From: "Better Business Bureau" [complaint @bbb .org]
    Subject: BBB Complaint No.65183683
    Sorry, your e-mail does not support HTML format. Your messages can be viewed in your browser
    Better Business Bureau �
    Start With Trust �
    Fri, 7 Dec 2012
    RE: Complaint N. 65183683
    Hello
    The Better Business Bureau has been booked the above said complaint from one of your purchasers in regard to their business relations with you. The detailed description of the consumer's disturbance are available visiting a link below. Please give attention to this point and let us know about your mind as soon as possible.
    We amiably ask you to overview the GRIEVANCE REPORT to reply on this claim letter.
    We are looking forward to your prompt reaction.
    Faithfully yours
    Natalie Richardson
    Dispute Councilor
    Better Business Bureau
    3073 Wilson Blvd, Suite 600 Arlington, VA 28201
    Phone: 1 (703) 276.0100 Fax: 1 (703) 525.8277
    This message was sent to [redacted]. Don't want to receive these emails anymore? You can unsubscribe
    ====================
    Date: Fri, 7 Dec 2012 19:42:23 +0200
    From: "Better Business Bureau" [noreply@bbb.org]
    Subject: BBB Appeal No.05P610Q78
    Sorry, your e-mail does not support HTML format. Your messages can be viewed in your browser
    Better Business Bureau �
    Start With Trust �
    Fri, 7 Dec 2012
    RE: Case # 05P610Q78
    Hello
    The Better Business Bureau has been filed the above said reclamation from one of your customers in respect of their dealings with you. The details of the consumer's disturbance are available at the link below. Please pay attention to this issue and notify us about your sight as soon as possible.
    We politely ask you to visit the PLAINT REPORT to meet on this claim.
    We are looking forward to your prompt reaction.
    Yours respectfully
    Dylan Peterson
    Dispute Councilor
    Better Business Bureau
    3003 Wilson Blvd, Suite 600 Arlington, VA 25301
    Phone: 1 (703) 276.0100 Fax: 1 (703) 525.8277
    This message was delivered to [redacted] Don't want to receive these emails anymore? You can unsubscribe
    ====================
    From: Better Business Bureau [mailto:information@bbb.org]
    Sent: Fri 07/12/2012 17:01
    Subject: Better Business Beareau Pretension No.S8598593
    Sorry, your e-mail does not support HTML format. Your messages can be viewed in your browser
    Better Business Bureau ©
    Start With Trust
    Fri, 7 Dec 2012
    RE: Complaint N. S8598593
    Valued client
    The Better Business Bureau has been entered the above mentioned grievance from one of your clientes with reference to their dealings with you. The details of the consumer's worry are available at the link below. Please give attention to this problem and let us know about your opinion as soon as possible.
    We pleasantly ask you to click and review the CLAIM LETTER REPORT to respond on this grievance.
    We awaits to your prompt response.
    WBR
    Aiden Thompson
    Dispute Advisor
    Better Business Bureau
    3003 Wilson Blvd, Suite 600 Arlington, VA 26701
    Phone: 1 (703) 276.0100 Fax: 1 (703) 525.8277
    This letter was delivered to [redacted]. Don't want to receive these emails anymore? You can unsubscribe


    The payload and IP addresses are exactly the same as the ones found in this spam run*."
    * http://blog.dynamoo.com/2012/12/aicp...rallesorg.html
    ___

    Sendspace "You have been sent a file" SPAM / pelamutrika .ru
    - http://blog.dynamoo.com/2012/12/send...file-spam.html
    7 Dec 2012 - "This fake Sendspace spam leads to malware on pelamutrika .ru:
    Date: Fri, 7 Dec 2012 10:53:57 +0200
    From: Badoo [noreply @badoo .com]
    Subject: You have been sent a file (Filename: [victimname]-64.pdf)
    Sendspace File Delivery Notification:
    You've got a file called [victimname]-792244.pdf, (337.19 KB) waiting to be downloaded at sendspace.(It was sent by CHASSIDY PROCTOR).
    You can use the following link to retrieve your file:
    Download Link
    The file may be available for a limited time only.
    Thank you,
    sendspace - The best free file sharing service.
    ----------------------------------------------------------------------
    Please do not reply to this email. This auto-mailbox is not monitored and you will not receive a response.


    The malicious payload is at [donotclick]pelamutrika .ru:8080/forum/links/column.php hosted on the following familiar IP addresses which you should definitely try to block:
    202.180.221.186 (GNet, Mongolia)
    208.87.243.131 (Psychz Networks, US)"
    ___

    Searching for “Windows Android Drivers” Leads to Malware and Bogus Google Play Markets
    - http://www.gfi.com/blog/searching-fo...-play-markets/
    7 Dec 2012 - "If you’re on the lookout for Android USB drivers for your Windows OS, be very careful. Such strings like “Windows Android Drivers” or combinations of these may bring up results that you would rather stay away from. Our researchers in the AV Labs have found this peculiar search result on Yahoo!... Visiting the Russian URL, bestdrivers(dash)11(dot)ru, automatically downloads a file called install.exe... Running the .exe file, which is a Trojan that we detect as Trojan.Win32.Generic!BT, allows it to modify the start page of the user’s IE browser to 94(dot)249(dot)188(dot)143/stat/tuk/187, a sign-up page for a Russian “escort” site. It does this so users are directed to the page by default whenever they open their IE browser..." (-aka- Hijacked...)
    (More detail and screenshots at the gfi URL above.)
    ___

    Christmas themed SCAMS on Facebook ...
    - http://community.websense.com/blogs/...-facebook.aspx
    06 Dec 2012 - "... We spotted more than 3,000 unique URLs used for this scam on Facebook. The high variation is used by cyber criminals to assure persistence and redundancy in case some URLs or domains get blacklisted.
    > http://community.websense.com/cfs-fi..._5F00_xmas.jpg
    ... Here are some of the offending IP addresses found to be part of the scam infrastructure hosting the scam web sites:
    208.73.210.147
    213.152.170.193
    184.107.164.158
    216.172.174.53
    199.188.206.214
    198.187.30.161
    198.154.102.28
    68.168.21.68
    198.154.102.29
    174.132.156.176
    198.154.102.27
    88.191.118.153
    208.91.199.252

    We believe that this attack is now under control and is being successfully mitigated by Facebook. We're seeing a gradual decline in incidences, but it's safe to say that while it's declining it's still going strong..."

    Last edited by AplusWebMaster; 2012-12-08 at 23:15.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #80
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Sendspace/AICPA SPAM lead to malware

    FYI...

    Fake Sendspace SPAM "You have been sent a file" / anifkailood .ru:
    - http://blog.dynamoo.com/2012/12/you-...pace-spam.html
    10 Dec 2012 - "This fake Sendspace spam leads to malware on anifkailood .ru:
    Date: Mon, 10 Dec 2012 06:01:01 -0500
    From: "Octavio BOWMAN" [AdlaiBaldacci @telefonica .net]
    Subject: You have been sent a file (Filename: [redacted]-722.pdf)
    Sendspace File Delivery Notification:
    You've got a file called [redacted]-018.pdf, (767.2 KB) waiting to be downloaded at sendspace.(It was sent by Octavio BOWMAN).
    You can use the following link to retrieve your file:
    Download Link
    The file may be available for a limited time only.
    Thank you,
    sendspace - The best free file sharing service.
    Please do not reply to this email. This auto-mailbox is not monitored and you will not receive a response.


    The malicious payload is at [donotclick]anifkailood .ru:8080/forum/links/column.php hosted on the following IPs:
    202.180.221.186 (GNet, Mongolia)
    212.162.52.180 (Secure Netz, Germany)
    212.162.56.210 (Secure Netz, Germany)..."
    ___

    Fake AICPA SPAM / eaglepointecondo .co
    - http://blog.dynamoo.com/2012/12/aicp...tecondoco.html
    10 Dec 2012 - "This fake AICPA spam leads to malware on eaglepointecondo .co:
    Date: Mon, 10 Dec 2012 19:29:21 +0400
    From: "AICPA" [alerts@aicpa.org]
    Subject: Income fake tax return accusations.
    You're receiving this email as a Certified Public Accountant and a member of AICPA.
    Having difficulties reading this email? Take a look at it in your browser.
    Termination of Public Account Status due to income tax fraud allegations
    Respected accountant officer,
    We have received a denouncement about your probable interest in income tax return swindle for one of your customers. In concordance with AICPA Bylaw Head # 500 your Certified Public Accountant status can be revoked in case of the occurrence of submitting of a faked or fraudulent income tax return for your client or employer.
    Please be notified below and provide explanation of this issue to it within 21 business days. The rejection to provide elucidation within this period would finish in end off of your CPA license.
    SubmittedReport.doc
    The American Institute of Certified Public Accountants.
    Email: service @aicpa .org
    Tel. 888.777.7077
    Fax. 800.362.5066


    The malicious payload is at [donotclick]eaglepointecondo .co/detects/denouncement-reports.php hosted on 59.57.247.185 in China, which has been used a few times recently* for malware distribution..."
    * http://blog.dynamoo.com/search?q=59.57.247.185

    > http://www.aicpa.org/news/featuredne...ent-email.aspx

    Your CPA License has -not- been revoked
    - https://isc.sans.edu/diary.html?storyid=14674
    Last Updated: 2012-12-10 - "I have been seeing some e-mails hitting my spam traps today, warning me of my revoked CPA license. No, I am not a CPA. But the e-mails are reasonably well done, so I do think some CPAs may fall for them. At least they got the graphics nice and pretty, but the text could be better worded.
    > https://isc.sans.edu/diaryimages/images/CPAEmail.png
    The only clickable link is the "Delation.pdf" (maybe that should be deletion?). Upon clicking the link, we are send on the usual malware redirect loop:
    The first stop is httx ://tesorogroup .com/components/com_ag_google_analytics2/taxfraudalert.html
    It includes javascript and meta tag redirects to
    httx ://eaglepointecondo. co/ detects /denouncement-reports.php
    ... which will test our browser for vulnerable plugins and try to run a java applet. Looks all very "standard". You may want to check your DNS server logs for anybody resolving tesorogroup.com or eaglepointecondo.co . The two host currently resolve to 64.15.152.49 and 59.57.247.185 respectively.
    Wepawet does a nice job analysing the obfuscated javascript:
    http://wepawet.iseclab.org/view.php?...160668&type=js ..."
    ___

    Facebook SCAM goes wild - doubles over the weekend ...
    - http://community.websense.com/blogs/...e-weekend.aspx
    10 Dec 2012 - "Last week we wrote a blog* about a specific Facebook scam that appeared to spread rather aggresively... Websense.. detected that the scam has increased and multiplied over the weekend - particularly on Saturday where we saw the amount of unique URLs related to this scam double. This shows how cyber crooks time their attacks to times where users are more laid back and when the security community is less likely to alert users on this type of threat... The scam spreads using click-jacking techniques and employs a mass number of varied scam hosts by using the infrastructure of the legitimate service at freedns.afraid .org... A graph showing the volume of unique scam URLs vs. active URLs (available URLs) over the past few days:
    > http://community.websense.com/cfs-fi...as_5F00_23.jpg
    Screenshot of the scam's main page:
    > http://community.websense.com/cfs-fi...as_5F00_24.jpg
    How the scam looks like in Facebook's new feed. The scam uses varied sexual implied images and varied enticing wording to lure for user's clicks:
    > http://community.websense.com/cfs-fi...as_5F00_25.jpg

    * http://community.websense.com/blogs/...-facebook.aspx

    Facebook Spam leverages/abuses Instagram App
    - http://blog.trendmicro.com/trendlabs...instagram-app/
    Dec 10, 2012 - "... social networking sites have been often used to proliferate malware. Just recently, we spotted a Facebook clickjacking attack that leverages and abuses Instagram to point users to malicious websites. Users encounter this threat by being tagged in a photo posted by one of their contacts on Facebook. The post states that users can know who visited their profile on Faceboofk and how often. It also includes a photo posted via Instagram. We noticed that the photo and the names used in the “Recent Profile Views” (see below) are used repeatedly for other attacks.
    > http://blog.trendmicro.com/trendlabs...screenshot.gif
    Should users decide to click the link, they are lead to a page with instructions on how to generate the verification code. Once done, a pop-up window appears, which is actually the Instagram for Facebook app asking users to click “Go to App” button. Once done, it -redirects- users to a page that looks like the Facebook Home page.
    > http://blog.trendmicro.com/trendlabs...e_facebook.gif
    ... the address bar is different from the legitimate Facebook homepage. Users are then asked to copy and paste the malicious URL (which varies per user) in a certain dialog box and to click ‘continue’... the link so far gathered 825,545 clicks worldwide, mostly coming from the Philippines and India. The said link is attributed to the account maygup88, who is also responsible for other 130 domains blocked. This type of threat on Facebook has taken on different forms these past months, usually under the veil of popular brands such as Diablo 3 and iPad. It even expanded to other social networking sites like Pinterest and Tumblr, which only means one thing: users are still falling for these scams. With this in mind, users are advised to take precautionary steps such as double-checking the legitimacy of links and posts. And remember: just because a contact posted that link, it does not mean it’s safe..."
    ___

    AICPA SPAM / eaglepointecondo .org
    - http://blog.dynamoo.com/2012/12/aicpa-spam.html
    10 Dec 2012 - "Yet another fake AICPA spam run today with a slightly different domain from before, now on eaglepointecondo .org:
    Date: Mon, 10 Dec 2012 18:51:38 +0100
    From: "AICPA" [info @aicpa .org]
    Subject: Tax return assistance fraud.
    You're receiving this message as a Certified Public Accountant and a part of AICPA.
    Having any issues reading this email? Overview it in your favorite browser.
    Suspension of CPA license due to income tax indictment
    Valued AICPA participant,
    We have been notified of your potential participation in income tax refund shady transactions for one of your customers. In concordance with AICPA Bylaw Head # 740 your Certified Public Accountant status can be terminated in case of the act of submitting of a phony or fraudulent tax return for your client or employer.
    Please be informed of the complaint below and respond to it within 7 work days. The refusal to respond within this period will finish in cancellation of your Accountant status.
    Delation.pdf
    The American Institute of Certified Public Accountants.
    Email: service @aicpa .org
    Tel. 888.777.7077
    Fax. 800.362.5066
    ===================
    Date: Mon, 10 Dec 2012 14:50:40 -0300
    From: "AICPA" [noreply @aicpa .org]
    Subject: Your accountant license can be end off.
    You're receiving this message as a Certified Public Accountant and a part of AICPA.
    Having problems reading this email? Review it in your browser.
    Suspension of Accountant status due to tax return fraud prosecution
    Respected AICPA member,
    We have received a complaint about your alleged participation in income tax return fraudulent activity for one of your employees. In accordance with AICPA Bylaw Section No. 500 your Certified Public Accountant license can be terminated in case of the event of presenting of a false or fraudulent tax return for your client or employer.
    Please find the complaint below below and provide your feedback to it within 3 work days. The rejection to provide the clarifications within this time-frame would abide in end off of your Certified Accountant Career.
    SubmittedReport.pdf
    The American Institute of Certified Public Accountants.
    Email: service @aicpa .org
    Tel. 888.777.7077
    Fax. 800.362.5066


    In this case the malicious payload is at [donotclick]eaglepointecondo .org/detects/denouncement-reports.php hosted on 59.57.247.185 in China, as with the earlier spam run today*."
    * http://blog.dynamoo.com/2012/12/aicp...tecondoco.html
    ___

    GFI Labs Email Roundup for the Week
    - http://www.gfi.com/blog/gfi-labs-ema...or-the-week-5/
    Dec 10, 2012 - "... noteworthy email threats for the week of December 3 to 7:
    - Phishers Target Wells Fargo Clients
    - Message from the Department of Investigations
    - Amazon eBook Spam in the Wild
    - Spam from AICPA ...
    (More detail and screenshots at the gfi URL above.)

    Last edited by AplusWebMaster; 2012-12-11 at 04:53.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •