Page 21 of 132 FirstFirst ... 111718192021222324253171121 ... LastLast
Results 201 to 210 of 1320

Thread: SPAM frauds, fakes, and other MALWARE deliveries...

  1. #201
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake NACHA SPAM, ransomware kits...

    FYI...

    NACHA .ZIP file attachment spam
    - http://threattrack.tumblr.com/post/5...ttachment-spam
    June 1, 2013 - "Subjects Seen:
    ACH Payment rejected: #<uniq_id>
    Typical e-mail details:
    Ach payment canceled Transaction ID: #[removed] The ACH transaction, recently initiated from your checking account (by you or any other person), was canceled by the other financial institution.
    Transaction Status: Rejected Transaction ID: [uniq number removed\
    Amount : $
    To view more details for this transaction , please check the attached file .
    NACHA works to maintain the privacy of any personally identifiable information (name, mailing address, e-mail address, etc.) that may be collected though our Web site. This Web site has security measures in place; however, NACHA does not represent, warrant or guarantee that personal information will be protected against unauthorized access, loss, misuse or alterations. Similarly, NACHA disclaims liability for personal information submitted through this Web site. Users are hereby advised that they submit such personal information at their own risk.
    Thank you,
    13450 Sunrise Valley Drive
    Suite 100 Herndon
    VA 20171
    © 2013 NACHA - The Electronic Payments Association


    Malicious URLs
    Spam contains a malicious attachment.


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...WMy1qz4rgp.png
    ___

    iOS7 announcement prompts themed ransomware kits
    - http://community.websense.com/blogs/...ware-kits.aspx
    May 31, 2013 - "... phishing domain related to the imminent release of the Apple iOS7 Operating System. As gossips circulate news in the wild about iOS7 after the D11 conference... cybercriminals are setting up a foundation for phishing and malicious activities...
    ios7news .net - 85.25.20.153 **
    > http://community.websense.com/cfs-fi...0.sshto004.PNG
    ... As a ransomware toolkit, Silence Locker can generate a malicious file associated with familiar police enforcement pictures, based on the country of the potential victims. For example, in the following page the fake FBI Cyber Squad Investigation team is bound with a binary file that has been uploaded:
    > http://community.websense.com/cfs-fi...1.sshto003.PNG
    ... we noticed that the AutoIT tool was used to package the malware. This conforms to the current trend of packaging malware to make detection more difficult. We continued our investigation by gathering some telemetry about the IP address that hosts this domain (ios7news .net). From what we discovered, it seems that this IP address is also used for other phishing domains... The domain "hxxp ://gamingdaily .us" is most likely a phishing domain for a gaming news website that is also used to host the exploit kit BleedingLife*... both IT news and rumors could be used by the attackers to leverage people's curiosity, as was done here. In this case, we can suppose (due to details such as the open directory access) that the attackers are going to use and configure that domain for malicious activities based on ransomware."
    * http://community.websense.com/blogs/...ploit-kit.aspx
    "... The Bleeding Life exploit kit uses exploits which can bypass ASLR and DEP, which means this product could be used successfully against Windows 7 and Windows Vista operating systems..."

    ** https://www.google.com/safebrowsing/...c?site=AS:8972

    Last edited by AplusWebMaster; 2013-06-01 at 16:24.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #202
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Malicious photo, Fivserv SPAM, Threat Outbreak Alerts ...

    FYI...

    Malicious photo attachment Spam
    - http://threattrack.tumblr.com/post/5...ttachment-spam
    June 3, 2013 - "Subjects Seen:
    Check the attachment you have to react somehow to this picture
    Typical e-mail details:
    Hi there ,
    I got to show you this picture in attachment. I can’t tell who gave it to me sorry but this chick looks a lot like your ex-gf. But who’s that dude??


    Malicious File Name and MD5:
    IMG[removed].zip (724bb53c12ebeb9df3e8525c6e1f9052)
    ThreatAnalyzer Report: http://www.threattracksecurity.com/e...-software.aspx
    - http://db.tt/2ZLJo3Wq [PDF]

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...1JB1qz4rgp.png
    ___

    Fivserv Secure Email Notification Spam
    - http://threattrack.tumblr.com/post/5...ification-spam
    June 3, 2013 - "Subjects Seen:
    Fiserv Secure Email Notification - [removed]
    Typical e-mail details:
    You have received a secure message
    Read your secure message by opening the attachment, SecureMessage_[removed].zip.
    The attached file contains the encrypted message that you have received.
    To decrypt the message use the following password - [removed]
    To read the encrypted message, complete the following steps:
    - Double-click the encrypted message file attachment to download the file to your computer.
    - Select whether to open the file or save it to your hard drive. Opening the file displays the attachment in a new browser window.
    - The message is password-protected, enter your password to open it.
    To access from a mobile device, forward this message to mobile-- @res.fiserv -- .com to receive a mobile login URL.
    If you have concerns about the validity of this message, please contact the sender directly...


    Malicious URLs
    116.122.158.195 :8080/ponyb/gate.php
    nourrirnotremonde .org/ponyb/gate.php
    zoecopenhagen .com/ponyb/gate.php
    goldenstatewealth .com/ponyb/gate.php
    190.147.81.28 /yqRSQ.exe
    paulcblake .com/ngY.exe
    207.204.5.170 /PXVYGJx.exe
    netnet-viaggi .it/2L6L.exe


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...qkk1qz4rgp.png

    - http://blog.dynamoo.com/2013/06/fise...tion-spam.html
    3 Jun 2013 - "This spam email contains an encrypted ZIP file with password-protected malware.
    Date: Mon, 3 Jun 2013 14:11:14 -0500 [15:11:14 EDT]
    From: Fiserv Secure Notification [secure .notification @fiserv .com]
    Subject: Fiserv Secure Email Notification - IZCO4O4VUHV83W1
    You have received a secure message
    Read your secure message by opening the attachment, SecureMessage_IZCO4O4VUHV83W1.zip.
    The attached file contains the encrypted message that you have received.
    To decrypt the message use the following password - Iu1JsoKaQ
    To read the encrypted message, complete the following steps:
    - Double-click the encrypted message file attachment to download the file to your computer.
    - Select whether to open the file or save it to your hard drive. Opening the file displays the attachment in a new browser window.
    - The message is password-protected, enter your password to open it...
    If you have concerns about the validity of this message, please contact the sender directly.


    Of course, it would be supremely pointless password protecting a document and then including the password in the email! The file has been password protected in an attempt to thwart anti-virus software. In this case, the password for the file SecureMessage_IZCO4O4VUHV83W1.zip is Iu1JsoKaQ which in turn leads to a file called SecureMessage_06032013.exe (note the date in included in that filename). At the moment the VirusTotal detection rate is a so-so 16/47*. The ThreatTrack analysis** identifies some locations that the malware phones home to:
    netnet-viaggi .it
    paulcblake .com
    74.54.147.146
    116.122.158.195
    190.147.81.28
    194.184.71.7
    207.204.5.170
    ..."
    * https://www.virustotal.com/en/file/8...is/1370289657/
    File name: SecureMessage_06032013.exe
    Detection ratio: 16/47
    Analysis date: 2013-06-03
    ** http://www.dynamoo.com/files/analysi...3135add304.pdf
    ___

    Threat Outbreak Alerts
    - http://tools.cisco.com/security/cent...utbreak.x?i=77
    Fake Secure Message Notification E-mail Messages - 2013 Jun 03
    Malicious Attachment E-mail Messages - 2013 Jun 03
    Fake Product Order E-mail Messages - 2013 Jun 03
    Fake Bank Transfer Notification E-mail Messages - 2013 Jun 03
    Fake Customer Complaint Notification E-mail Messages - 2013 Jun 03
    Malicious Attachment E-mail Messages - 2013 Jun 03
    Fake Order Invoice Notification E-mail Messages - 2013 Jun 03
    Fake Payment Confirmation Notification E-mail Messages - 2013 Jun 03
    Malicious Attachment E-mail Messages - 2013 Jun 03
    Fake Remittance Slip with Invalid Digital Signature E-mail Messages - 2013 Jun 03
    Fake Scanned Document Attachment E-mail Messages - 2013 Jun 03
    Fake Product Order Quotation E-mail Messages - 2013 Jun 03
    Fake Product Order Request E-mail Messages - 2013 Jun 03
    Fake Online Dating Personal Photos Sharing E-mail Messages - 2013 Jun 03
    Fake Purchase Order Request E-mail Messages - 2013 Jun 03
    Fake Online Dating Proposal E-mail Messages - 2013 Jun 03
    Fake Product Order Quotation E-mail Messages - 2013 Jun 03
    Fake Processes and Subpoenas Notification E-mail Messages - 2013 Jun 03
    (More detail and links available at the cisco URL above.)

    Last edited by AplusWebMaster; 2013-06-04 at 04:47.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #203
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Xerox WorkCentre Attachment Spam

    FYI...

    Fake Xerox WorkCentre Attachment Spam
    - http://threattrack.tumblr.com/post/5...ttachment-spam
    June 5, 2013 - "Subjects Seen:
    Scanned Image from a Xerox WorkCentre
    Typical e-mail details:
    Reply to: Xerox.WorkCentre @[removed]
    Device Name: Not Set
    Device Model: XEROX-2178N
    Location: Not Set
    File Format: PDF (Medium)
    File Name: Xerox_Scan_06-04-2013-466.zip
    Resolution: 200dpi x 200dpi
    Attached file is scanned image in PDF format.


    Malicious URLs
    116.122.158.195 :8080/ponyb/gate.php
    4renttulsa .com/ponyb/gate.php
    4rentunitedstates .com/ponyb/gate.php
    newsouthdental .com/jENnMd2X.exe
    leclosdelentaille .fr/2Zxq1hZ.exe
    forexwinnersacademy .com/fmy.exe


    Malicious File Name and MD5:
    Xerox_Scan_06-04-2013-[removed].zip (e45db46d63330f20ef8c381f6c0d8f1a)
    Xerox_Scan_06-04-2013-[removed].exe (7e4b3aca9a2a86022d50110d5d9498e2)
    fmy.exe (c3c103ebb3ce065b8b62b08fba40483f)

    ThreatAnalyzer Report: http://db.tt/yJoSwFM8 [PDF]
    199.168.184.198, 82.165.79.64, 69.163.187.171, 216.172.167.17

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...8Hw1qz4rgp.png
    ___

    Don't like clicking when you won't know where you're going?
    - http://urlxray.com/
    Find out where shortened URLs lead to without clicking on them
    Enter any shortened URL...
    ___

    More Champions Club Community SPAM
    - http://blog.dynamoo.com/2013/06/more...nity-spam.html
    5 June 2013 - "... the originating IP is 217.174.248.194 [web1-opp2.champions-bounce .co.uk] (Fasthosts, UK). Spamvertised domains are champions.onlineprintproofing .co.uk also on 217.174.248.194 and championsclubcommunity .com on 109.203.113.124 (Eukhost, UK). Give these spammers a wide berth..."
    - http://blog.dynamoo.com/2013/03/cham...community.html
    ___

    Backdoor Wipes MBR, Locks Screen
    - http://blog.trendmicro.com/trendlabs...-locks-screen/
    June 5, 2013 - "German users are at risk of having their systems rendered unusable by a malware that we’re seeing being sent via spam messages. This particular malware, on top of its ability to remotely control an affected system, is able to wipe out the Master Boot Record – a routine that had previously caused a great crisis in South Korea. We recently uncovered this noteworthy backdoor as an attached file in certain spam variants. The spam sample we found is in German and forces recipients to pay for a certain debt, the details of which are contained in the attachment. Those who open the attachment are actually tricked into executing the malware, in this instance, a backdoor.
    > http://blog.trendmicro.com/trendlabs...ached-file.jpg
    Like any backdoor, BKDR_MATSNU.MCB performs certain malicious commands, which include gathering machine-related information and send it to its command-and-control (C&C) server. However, the backdoor’s most noteworthy feature is its capability to wipe the Master Boot Record (MBR). The wiping of the MBR was recently used in the high-profile (but different) attack against certain South Korean institutions. What makes this routine problematic is that once done, infected systems won’t reboot normally and will leave users with unusable machines. Another command is the backdoor’s capability to lock and unlock a screen. This locking of screen is definitely a direct copy from ransomware’s playbook, in which the system remains completely or partially inaccessible unless the victim pays for the “ransom”. Ransomware is a malware that locks an infected system’s screen and display a message, which instructs users to pay for a “ransom” thru certain payment methods... During our testing, BKDR_MATSNU.MCB readily performed the MBR wiping routine. The remote malicious (via server) only needs to communicate this command to the backdoor and it can execute this routine immediately. However, this is not the case with the screen locking. BKDR_MATSNU.MCB is likely to download a different module onto the system, which will then lock the screen. As to what routines will be first executed or not is dependent on the remote malicious user. Attackers may opt to lock the screen first then initiate the MBR overwriting or just initiate any of the two. Another possible scenario is that another version of BKDR_MATSNU is integrated with the screen blocking routine, which will make the screen locking command easier to execute... For better protection, users should always be cautious be the email they receive and must not readily open any attachments. If your system is already infected, it is a safer bet to not pay for the “ransom”, as paying does not guarantee anything..."

    Last edited by AplusWebMaster; 2013-06-05 at 20:30.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #204
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Innex SPAM, rxlogs .net ...

    FYI...

    Fake Innex, Inc SPAM
    - http://blog.dynamoo.com/2013/06/inne...fake-spam.html
    6 June 2013 - "Innex, Inc is a real company. This spam email message is -not- from Innex, Inc.
    From: PURCHASING DEPARTMENT [fdmelo @fucsalud .edu.co]
    To:
    Reply-To: pinky .yu@chanqtjer .com.tw
    Date: 6 June 2013 08:55
    Subject: Innex, Inc.
    Sir/Madam,
    Our Company is interested in your product, that we saw in trading site,
    Your early reply is very necessary for further detail specification immediately you receive our email.
    Regards
    Purchasing manager,
    Mr James Vincent ...


    Innex is based in California in the US, but the email appears to be from a university in Colombia and solicits replies to an email address in Taiwan. Note as well that the email is very vague about the "product" they are interested in, and the To: field is blank as the recipient list has been suppressed (i.e. it is being sent to multiple recipients). Avoid."
    ___

    rxlogs .net: spam or Joe Job?
    - http://blog.dynamoo.com/2013/06/rxlo...r-joe-job.html
    6 June 2013 - "I've had nearly one hundred of these this morning. Is it a genuine spam run or a Joe Job**?
    Date: Thu, 6 Jun 2013 09:44:18 -0700 [12:44:18 EDT]
    From: Admin [whisis101 @gmail .com]
    Reply-To: ec2-abuse @amazon .com
    facebook
    You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to reset your password 4 ago.
    This is a reminder that you need to complete this action by clicking this link and Confirm or Cancel your request.
    If you have any other questions, please visit our Help Center.
    Thanks,
    The Facebook Team


    Screenshot: https://lh3.ggpht.com/-ToJ6cyCDWME/U...600/rxlogs.png

    The link in the emails goes to multiple pages on rxlogs .net which as far I as can tell is -not- malware*, but is a blog about online pharmacies. But is is spam? Well, let's dig a little deeper.. Each email comes from a different IP, probably being sent by a botnet. That's pretty normal for pharma spam, but in this case there appear to be some anomalous addition headers.. The mildly munged headers from an example email are quite revealing. It appears that there are references to Amazon ECS (Amazon's cloud service) and a valid sender address of whisis101 -at- gmail.com injected into the headers, along with a load of other elements that you'd expect from botnet spam. The email has at no point hit either Gmail or Amazon, but the headers appear to have been -faked- in order to generate reports to Amazon and/or Gmail. It's worth noting that rxlogs .net is hosted on 107.20.147.122 which is an Amazon IP... I believe this is a Joe Job and not a "genuine" spam run, and rxlogs .net is simply another victim of the bad guys."
    * http://urlquery.net/report.php?id=2919241
    Source IP: 94.102.48.224 - Known RBN IP

    ** http://searchsecurity.techtarget.com/definition/Joe-job
    ___

    Fake NatPay SPAM / usforclosedhomes .net
    - http://blog.dynamoo.com/2013/06/natp...tion-spam.html
    6 Jun 2013 - "This fake NatPay spam leads to malware on usforclosedhomes .net.
    Version 1:
    Date: Thu, 6 Jun 2013 20:53:08 +0600 [10:53:08 EDT]
    From: National Payment Automated Reports System [dunks @services .natpaymail .net]
    Subject: Transmission Confirmation ~26306682~N25BHHL1~
    Transmission Verification
    Contact Us
    To:
    NPC Account # 26306682
    Xavier Reed
    Re:
    NPC Account # 26306682
    D & - D5
    Thursday, July 04, 2013, Independence Day is a Federal Banking Holiday. All banks are closed for this holiday, therefore NatPay will not be able to process any files on that date. If you plan on transmitting for a paydate that falls between Thursday, July 04, 2013 and Thursday, July 11, 2013 you will need to the file a day earlier.
    Batch Number 408
    Batch Description VENDOR PAY
    Number of Dollar Entries 2
    Number of Prenotes 0
    Total Deposit Amount $3,848.19
    Total Withdraw Amount $3,848.19
    Batch Confirmation Number 50983
    Date Transmitted Thursday, June 06, 2013 ...
    ---
    Version 2:
    Date: Thu, 6 Jun 2013 09:59:06 -0500
    From: National Payment Automated Reports System [lemuel @emalsrv.natpaymail .com]
    Subject: Transmission Confirmation ~10968697~607MPYRC~
    Transmission Verification
    Contact Us
    To: NPC Account # 10968697
    Benjamin Turner
    Re: NPC Account # 10968697
    D & - MN
    Thursday, July 04, 2013, Independence Day is a Federal Banking Holiday. All banks are closed for this holiday, therefore NatPay will not be able to process any files on that date. If you plan on transmitting for a paydate that falls between Thursday, July 04, 2013 and Thursday, July 11, 2013 you will need to the file a day earlier.
    Batch Number 219
    Batch Description VENDOR PAY
    Number of Dollar Entries 2
    Number of Prenotes 0
    Total Deposit Amount $2,549.12
    Total Withdraw Amount $2,549.12
    Batch Confirmation Number 24035 ...


    The malicious payload is on [donotclick]usforclosedhomes .net/news/walls_autumns-serial.php (report here*) hosted on the following IPs:
    41.89.6.179 (Kenya Education Network, Kenya)
    46.18.160.86 (Saudi Electronic Info Exchange Company (Tabadul) JSC, Saudi Arabia)
    93.89.235.13 (FBS Bilisim Cozumleri, Cyprus)
    112.170.169.56 (Korea Telecom, South Korea)
    The cluster of IPs and domains this belongs to identifies it as part of the Amerika spam run.
    Blocklist:
    41.89.6.179
    46.18.160.86
    93.89.235.13
    112.170.169.56
    ..."
    * http://urlquery.net/report.php?id=2926577
    ___

    USPS Package Pickup Spam
    - http://threattrack.tumblr.com/post/5...ge-pickup-spam
    June 6, 2013 - "Subjects Seen:
    USPS - Your package is available for pickup ( Parcel [removed])
    Typical e-mail details:
    We attempted to deliver your item at 6 Jun 2013.
    Courier service could not make the delivery of your parcel.
    Status Deny / Invalid ZIP Code.
    If the package is not scheduled for redelivery or picked up within 48 hours, it will be returned to the sender.
    Label/Receipt Number: [removed]
    Expected Delivery Date: Jun 6, 2013
    Class: Package Services
    Service(s): Delivery Confirmation
    Status: eNotification sent
    For mode details and shipping label please see the attached file.
    Print this label to get this package at our post office...


    Malicious URLs
    michaelscigars .net/ponyb/gate.php
    montverdestore .com/ponyb/gate.php
    errezeta .biz/ToSN79T.exe
    190.147.81.28 /yqRSQ.exe
    207.204.5.170 /PXVYGJx.exe
    archeting .it/86zP.exe


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...IUE1qz4rgp.png
    ___

    Global $200M credit card hacking ring busted
    - http://www.reuters.com/article/2013/...95419G20130605
    Jun 5, 2013 - "Eleven people in the United States, the UK and Vietnam have been arrested and accused of running a $200 million worldwide credit card fraud ring, U.S. and UK law enforcement officials said... Federal prosecutors in New Jersey said they had filed charges against a 23-year-old man from Vietnam... authorities in Vietnam had arrested Duy Hai Truong on May 29 in an effort to break up a ring he is accused of running with co-conspirators, who were not named in the statement... The arrests come as law enforcement officials around the world are cracking down on Internet-related heists. Two weeks ago, authorities raided Liberty Reserve, a Costa Rica-based company that provided a virtual currency system used frequently by criminals to move money around the world without using the traditional banking system. Earlier last month, authorities arrested seven people involved in a $45 million heist in which hackers removed limits on prepaid debit cards and used ATM withdrawals to drain cash from two Middle Eastern banks... the charges were filed in New Jersey's federal court because some of the victims of the scheme are residents of the state. Prosecutors claim Truong and accomplices stole information related to more than a million credit cards and resold it to criminal customers... According to the complaint, Truong hacked into websites that sold goods and services over the Internet and collected personal credit card information from the sites' customers. "The victims' credit cards incurred, cumulatively, more than $200 million in fraudulent charges," the complaint said..."
    - http://www.soca.gov.uk/news/552-elev...inal-web-forum

    Last edited by AplusWebMaster; 2013-06-06 at 23:10.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #205
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Malware sites to block, Fake USPS SPAM...

    FYI...

    Malware sites to block 7/6/13
    - http://blog.dynamoo.com/2013/06/malw...lock-7613.html
    7 June 2013 - "Two IPs that look related, the first is 37.235.48.185 (Edis, Poland or Austria) which host some domains that are also found here** (158.255.212.96 and 158.255.212.97, also Edis) that seem to be used in injection attacks. I can identify the following domains linked to 37.235.48.185:
    faggyppvers5 .info
    finger2 .climaoluhip.org
    linkstoads .net
    node1.hostingstatics .org
    node2.hostingstatics .org
    Injecting some of the same sites as the domains on the above IPs is jstoredirect .net which is currently offline but was hosted on 149.154.152.18 which is also Edis (can you see the pattern yet?) so I would assume that they are linked. In the few days that jstoredirect .net was online it managed to infect over 1500 sites*.
    Aggregate blocklist:
    98.126.9.34
    114.142.147.51
    158.255.212.96
    158.255.212.97
    nethostingdb .com
    netstoragehost .com
    connecthostad .net
    climaoluhip .org
    hostingstatics .org
    systemnetworkscripts .org
    numstatus .com
    linkstoads .net
    faggyppvers5 .info
    jstoredirect .net
    ..."
    * http://www.google.com/safebrowsing/d...toredirect.net

    ** http://blog.dynamoo.com/2013/05/some...21296-and.html
    ___

    Fake USPS SPAM / USPS_Label_861337597092.zip
    - http://blog.dynamoo.com/2013/06/usps...597092zip.html
    6 June 2013 - "This fake USPS spam contains a malicious attachment:
    Date: Thu, 6 Jun 2013 10:43:56 -0500 [11:43:56 EDT]
    From: USPS Express Services [service-notification @usps .com]
    Subject: USPS - Your package is available for pickup ( Parcel 861337597092 )
    Postal Notification,
    We attempted to deliver your item at 6 Jun 2013.
    Courier service could not make the delivery of your parcel.
    Status Deny / Invalid ZIP Code.
    If the package is not scheduled for redelivery or picked up within 48 hours, it will be returned to the sender.
    Label/Receipt Number: 861337597092
    Expected Delivery Date: Jun 6, 2013
    Class: Package Services
    Service(s): Delivery Confirmation
    Status: eNotification sent
    For mode details and shipping label please see the attached file.
    Print this label to get this package at our post office.
    Thank you,
    © 2013 Copyright© 2013 USPS. All Rights Reserved.
    *** This is an automatically generated email, please do not reply ...


    There is an attachment called USPS_Label_861337597092.zip which in turn contains a malicious executable file USPS_Label_06062013.exe (note the date is encoded into the filename). VirusTotal results for this are 18/47*. The Comodo CAMAS report** shows an attempt to download more components from michaelscigarbar .net on 184.95.37.109 (Jolly Works Hosting, Philippines.. rented from Secured Servers in the US). URLquery shows a very large amount of malware activity on that IP, mostly apparently running on legitimate -hacked- domains. You should probably treat all of the following domains as hostile:
    alliancelittleaviators .com
    apparelacademy .com
    apparelacademy .net
    brokerforcolorado .com
    carlaellisproperties .com
    dragoncigars .net
    heavenlycigars .net
    libertychristianstore .com
    michaelscigarbar .com
    michaelscigarbar .net
    michaelscigars .net
    montverdestore .com
    montverdestore .net
    montverdestore .org
    ..."

    * https://www.virustotal.com/en/file/8...is/1370549956/
    File name: USPS_Label_06062013.exe
    Detection ratio: 18/47
    Analysis date: 2013-06-06
    ** http://camas.comodo.com/cgi-bin/subm...b2b4cf553ab695

    *** http://urlquery.net/search.php?q=184...3-06-06&max=50
    ___

    Better Business Bureau Compliant Spam
    - http://threattrack.tumblr.com/post/5...compliant-spam
    7 June 2013 - "Subjects Seen:
    BBB Appeal [removed]
    Typical e-mail details:
    The Better Business Bureau has been booked the above mentioned grievance from one of your users in respect to their dealings with you. The detailed description of the consumer’s trouble are available for review at a link below. Please give attention to this matter and notify us about your sight as soon as possible.
    We graciously ask you to overview the CLAIM REPORT to answer on this plaint.
    We awaits to your prompt answer.
    WBR
    Ryan Myers
    Dispute Advisor


    Malicious URLs
    amapi .com .br/bbb.html
    pnpnews .net/news/readers-sections.php?hvv=rvjzzloo&jnjpe=thpe
    pnpnews .net/news/readers-sections.php?yf=1i:1f:32:33:2v&re=1n:2w:1n:1g:30:1f:1o:1n:1i:2v&u=1f&br=b&sd=c&jopa=5698723


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...pWf1qz4rgp.png

    - http://blog.dynamoo.com/2013/06/bbb-...npnewsnet.html
    7 June 2013 - "This fake BBB spam leads to malware on pnpnews .net:
    From: Better Business Bureau [mailto:standoffzwk68 @clients.bbb .com]
    Sent: 07 June 2013 15:08
    Subject: BBB information regarding your customer's pretension No. 00167486
    Better Business Bureau ©
    Start With Trust ©
    Fri, 7 Jun 2013
    RE: Complaint No. 00167486
    [redacted]
    The Better Business Bureau has been entered the above said grievance from one of your users in regard to their business relations with you. The information about the consumer's trouble are available visiting a link below. Please pay attention to this matter and notify us about your sight as soon as possible.
    We kindly ask you to overview the CLAIM LETTER REPORT to meet on this claim.
    We awaits to your prompt answer.
    Faithfully yours
    Jonathan Edwards
    Dispute Advisor
    Better Business Bureau ...


    Screenshot: https://lh3.ggpht.com/-RY4L1o2A9_w/U...Q/s400/bbb.png

    The link in the email goes through a legitimate hacked site and then to a payload at [donotclick]pnpnews .net/news/readers-sections.php (report here*) hosted on:
    46.18.160.86 - Saudi Electronic Info Exchange Company (Tabadul) JSC
    93.89.235.13 - FBS Bilisim Cozumleri, Cyprus
    178.16.216.66 - Gabrielson Invest AB, Sweden
    186.215.126.52 - Global Village Telecom, Brazil
    190.93.23.10 - Greendot, Trinidad and Tobago
    Blocklist:
    46.18.160.86
    93.89.235.13
    178.16.216.66
    186.215.126.52
    190.93.23.10
    ..."
    * http://urlquery.net/report.php?id=2944992
    ... Detected BlackHole v2.0 exploit kit URL pattern ...
    ___

    Fake American Express PAYVE Remit Spam
    - http://threattrack.tumblr.com/post/5...yve-remit-spam
    June 7, 2013 - "Subjects Seen:
    PAYVE - Remit file
    Typical e-mail details:
    A payment(s) to your company has been processed through the American Express Payment Network.
    The remittance details for the payment(s) are attached ([removed].zip).
    - The remittance file contains invoice information passed by your buyer. Please contact your buyer for additional information not available in the file.
    - The funds associated with this payment will be deposited into your bank account according to the terms of your American Express merchant agreement and may be combined with other American Express deposits. For additional information about Deposits, Fees, or your American Express merchant agreement:
    Contact American Express Merchant Services at 1-800-528-0933 Monday to Friday, 8:00 AM to 8:00 PM ET.
    - You can also view PAYVE payment and invoice level details using My Merchant Account/Online Merchant Services. If you are not enrolled in My Merchant Account/OMS, you can do so at americanexpress .com/mymerchantaccount or call us at 1-866-220-7374, Monday - Friday between 9:00 AM-7:30 PM ET, and we’ll be glad to help you.
    For quick and easy enrollment, please have your American Express Merchant Number, bank account ABA (routing number) and DDA (account number) on hand.
    This customer service e-mail was sent to you by American Express. You may receive customer service e-mails even if you have unsubscribed from marketing e-mails from American Express...


    Malicious URLs
    storeyourbox .net/ponyb/gate.php
    storeyourthings .net/ponyb/gate.php
    drjoycethomasderm .com/ponyb/gate.php
    errezeta .biz/ToSN79T.exe
    190.147.81.28 /yqRSQ.exe
    207.204.5.170 /PXVYGJx.exe
    archeting .it/86zP.exe

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...c6a1qz4rgp.png

    - http://blog.dynamoo.com/2013/06/payv...file-spam.html
    7 June 2013 - "This fake American Express Payment Network spam has a malicious attachment.
    Date: Fri, 7 Jun 2013 20:41:25 +0600 [10:41:25 EDT]
    From: "PAYVESUPPORT @AEXP .COM" [PAYVESUPPORT @AEXP .COM]
    Subject: PAYVE - Remit file ...


    Attached to the email is an archive file called CD0607213.389710762910.zip which in turn contains an executable named CD06072013.239871839.exe (note that the date is included in the filename). Virustotal reports that just 8/46* anti-virus scanners detect it.
    The Comodo CAMAS report*** gives some details about the malware, including the following checksums:
    MD5 fd18576bd4cf1baa8178ff4a2bef0849
    SHA1 8b8ba943393e52a3972c11603c3f1aa1fc053788
    SHA256 f31ca8a9d429e98160183267eea67dd3a6e592757e045b2c35bb33d5e27d6875
    The malware attempts to download further components from storeyourbox .com on 97.107.137.239 (Linode, US) which looks like a legitimate server that has been -badly- compromised**. The following domains appear to be on the server, I would advise that they are all dangerous at the moment:
    drjoycethomasderm .com
    goodvaluemove .com
    jacksonmoving .com
    jacksonmoving .net
    napervillie-movers .com
    reebie .net
    storageandmoving .net
    storeyourbox .com
    storeyourbox .net
    storeyourthings .net
    "
    * https://www.virustotal.com/en/file/f...is/1370627576/
    File name: CD06072013.239871839.exe
    Detection ratio: 8/46
    Analysis date: 2013-06-07
    ** https://www.virustotal.com/en/ip-add...9/information/

    *** http://camas.comodo.com/cgi-bin/subm...bb33d5e27d6875

    Last edited by AplusWebMaster; 2013-06-07 at 22:03.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #206
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Wells Fargo - attachment Spam

    FYI...

    Fake Wells Fargo - attachment Spam
    - http://threattrack.tumblr.com/post/5...ttachment-spam
    June 19, 2013 - "Subjects Seen:
    IMPORTANT - WellsFargo
    Typical e-mail details:
    Please check attached documents.
    Michael_Kane
    Wells Fargo Advisors
    817-563-5247 office
    817-368-5170 cell [removed]
    ATTENTION: THIS E-MAIL MAY BE AN ADVERTISEMENT OR SOLICITATION FOR PRODUCTS AND SERVICES.
    To unsubscribe from marketing e-mails from:
    · An individual Wells Fargo Advisors financial advisor: Reply to one of his/her e-mails and type “Unsubscribe” in the subject line.
    · Wells Fargo and its affiliates: Unsubscribe at wellsfargoadvisors.com/unsubscribe.
    Neither of these actions will affect delivery of important service messages regarding your accounts that we may need to send you or preferences you may have previously set for other e-mail services.
    For additional information regarding our electronic communication policies, visit wellsfargoadvisors.com/disclosures/email-disclosure.html .
    Investments in securities and insurance products are:
    NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
    Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member FINRA/SIPC. 1 North Jefferson, St. Louis, MO 63103


    Malicious URLs
    megmcenery .com/ponyb/gate.php
    mceneryfinancial .com/ponyb/gate.php
    margueritemcenery .com/ponyb/gate.php
    hraforbiz. com/ponyb/gate.php
    ftp(DOT)impactdata .com/da4.exe
    errezeta .biz/ToSN79T.exe
    ftp(DOT)myfxpips .com/PMLyQRMt.exe
    207.204.5.170 /PXVYGJx.exe


    Malicious File Name and MD5:
    WellsFargo.<random>.zip (05c33cfcf22c5736C4a162f6d7c2eeac)
    Important WellsFargo Docs.exe (47e739106c24fbf52ed3b8fd01dc3668)

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...1ca1qz4rgp.png

    - http://blog.dynamoo.com/2013/06/well...ellsfargo.html
    10 June 2013 - "This fake Wells Fargo spam run comes with one of two malicious attachments:
    Date: Mon, 10 Jun 2013 13:00:13 -0500 [14:00:13 EDT]
    From: Anthony_Starr @wellsfargo .com
    Subject: IMPORTANT - WellsFargo
    Please check attached documents.
    Anthony_Starr
    Wells Fargo Advisors
    817-563-9816 office
    817-368-5471 cell Anthony_Starr @ wellsfargo .com
    ATTENTION: THIS E-MAIL MAY BE AN ADVERTISEMENT OR SOLICITATION FOR PRODUCTS AND SERVICES.
    To unsubscribe from marketing e-mails from:
    · An individual Wells Fargo Advisors financial advisor: Reply to one of his/her
    e-mails and type “Unsubscribe” in the subject line.
    · Wells Fargo and its affiliates: Unsubscribe at
    www .wellsfargoadvisors .com/unsubscribe. Neither of these actions will affect delivery of
    important service messages regarding your accounts that we may need to send you or
    preferences you may have previously set for other e-mail services.
    For additional information regarding our electronic communication policies, visit
    http :// wellsfargoadvisors .com/disclosures/email-disclosure.html .
    Investments in securities and insurance products are:
    NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
    Wells Fargo Advisors, LLC is a nonbank affiliate of Wells Fargo & Company, Member
    FINRA/SIPC. 1 North Jefferson, St. Louis, MO 63103 ...


    There is a ZIP file attached to the email message, and the spammers have attempted to name the attachment after the recipient.. but because the spam has multiple recipients it may end up with a random name. Inside the ZIP file is an EXE file, and there appear to be -two- variants.
    One is called Important WellsFargo Doc.exe and it has a pretty shocking VirusTotal detection rate of 0/47* (yup.. none at all). The Comodo CAMAS report** gives the following checksums..
    Name Value
    Size 94720
    MD5 70e604777a66980bcc751dcb00eafee5
    SHA1 52ef61b6296f21a3e14ae35320654ffe3f4e769d
    SHA256 f669768216872c626abc46e4dd2e0b1d783ba5927166282922c16d6db3b8adae
    ..it identifies that this version of the malware attempts to download additional components from mceneryfinancial .com on 173.255.213.171 (specifically it is a pony downloader querying /ponyb/gate.php)... ThreatTrack has a more detailed report*** which also identifies callbacks to www.errezeta .biz and ftp.myfxpips .com. ThreatExpert has a slightly different report (1) and further identifies megmcenery .com, taxfreeincomenow .com, taxfreeincomenow .info and 207.204.5.170 (Linode, US). The second version has a similarly named files called Important WellsFargo Docs.exe (plural) with a higher VirusTotal detection rate of 11/46 (2). Comodo CAMAS reports(3) the following file characteristics..
    Name Value
    Size 114176
    MD5 47e739106c24fbf52ed3b8fd01dc3668
    SHA1 b85b4295d23c912f9446a81fd605576803a29e53
    SHA256 2d0d16d29ceca912d529533aa850f1e1539f4b509ea7cb89b8839f672afb418b
    ..in this case the pony download contacts hraforbiz .com (also on 173.255.213.171). Other analyses are pending. Several of these malware domains are hosted on 173.255.213.171 (Linode, US) and we can assume that this server is compromised along with all the domains on it. 62.149.131.162 (Aruba, Italy) also seems to be compromised(4). 173.254.68.134 (5) (Unified Layer, US) and 207.204.5.170 (6) (Register .com, US) appear to be compromised in some way to. Of note is the fact that almost all of these domains appear to be legitimate but have been -hacked- in some way, I would expect them to be cleaned up at some point in the future. Putting all these IPs and domains together gives a recommended blocklist:
    173.254.68.134
    173.255.213.171
    207.204.5.170
    62.149.131.162
    ..."
    (More listed at the dynamoo URL above.)
    * https://www.virustotal.com/en/file/f...is/1370888138/
    File name: Important WellsFargo Doc.exe
    Detection ratio: 0/47
    Analysis date: 2013-06-10
    ** http://camas.comodo.com/cgi-bin/subm...c16d6db3b8adae
    *** http://www.dynamoo.com/files/analysi...cb00eafee5.pdf
    1) http://www.threatexpert.com/report.a...751dcb00eafee5
    2) https://www.virustotal.com/en/file/2...is/1370888252/
    File name: Important WellsFargo Docs.exe
    Detection ratio: 11/46
    Analysis date: 2013-06-10
    3) http://camas.comodo.com/cgi-bin/subm...c16d6db3b8adae
    4) https://www.virustotal.com/en/ip-add...2/information/
    5) https://www.virustotal.com/en/ip-add...4/information/
    6) https://www.virustotal.com/en/ip-add...0/information/
    ___

    - http://tools.cisco.com/security/cent...utbreak.x?i=77
    E-mail Messages with Malicious Attachments - 2013 Jun 10
    Fake Deposit Transfer Confirmation Notification E-mail Messages - 2013 Jun 10
    Fake Documents Attachment Email Messages - 2013 Jun 10
    Malicious Attachment Email Messages - 2013 Jun 10
    Fake Bill Payment Notification Email Messages - 2013 Jun 10
    Fake Legal Assistance Inquiry E-mail Messages - 2013 Jun 10
    Fake Products Advertisement E-mail Messages - 2013 Jun 10
    Fake FedEx Shipment Notification E-mail Messages - 2013 Jun 10
    Fake Xerox Scan Attachment Email Messages - 2013 Jun 10
    Fake Gift Voucher Redemption Email Messages - 2013 Jun 10
    Fake Deposit Statement Notification E-mail Messages - 2013 Jun 10
    (More detail and links at the cisco URL above.)

    Last edited by AplusWebMaster; 2013-06-11 at 14:18.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #207
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Fax email, new ZBOT malware ...

    FYI...

    Fake Fax Transmission emails lead to malware
    - http://blog.webroot.com/2013/06/11/f...ad-to-malware/
    June 11, 2013 - "Have you sent an eFax recently? Watch out for an ongoing malicious spam campaign that tries to convince you that there’s been an unsuccessful fax transmission. Once socially engineered users execute the malicious attachment found in the fake emails, their PCs automatically join the botnet of the cybercriminals behind the campaign...
    Sample screenshot of the spamvertised email:
    > https://webrootblog.files.wordpress....ngineering.png
    Detection rate for the malicious attachment: MD5: 66140a32d7d8047ea93de0a4a419880b * ... UDS:DangerousObject.Multi.Generic... phones back to the following C&C server hxxp ://lukafalls .com/banners/index.php – 95.154.254.17, as well as to the following C&C IPs:
    95.154.254.17, 190.179.212.30, 65.92.129.196, 125.25.82.22, 69.235.15.127, 108.215.44.142, 188.153.47.135, 76.226.112.216, 78.100.36.98, 190.162.42.76, 78.99.110.225, 118.101.184.54, 90.156.118.144, 212.182.121.226, 99.97.73.189, 181.67.50.91, 2.87.2.21, 108.215.99.94, 84.59.222.81, 142.136.161.103, 178.203.226.84, 95.234.169.221, 217.41.0.85, 71.143.224.43, 74.139.10.100, 78.38.40.207, 213.215.153.212 ..."
    (More detail at the webroot URL above.)
    * https://www.virustotal.com/en/file/6...2f68/analysis/
    File name: Fax details and transmission_report.doc.exe
    Detection ratio: 31/47
    Analysis date: 2013-06-10
    ___

    Self-propagating ZBOT malware ...
    - http://blog.trendmicro.com/trendlabs...lware-spotted/
    June 10, 2013 - "... we have spotted a new ZBOT variant that can spread on its own. This particular ZBOT variant arrives through a malicious PDF file disguised as a sales invoice document. If the user opens this file using Adobe Reader, it triggers an exploit which causes the following pop-up window to appear:
    > http://blog.trendmicro.com/trendlabs...3/06/zbot1.jpg
    ... error message upon execution of the malicious PDF file
    While this is going on, the malicious ZBOT variant – WORM_ZBOT.GJ – is dropped onto the system and run. It is here that several differences start to appear. First of all, WORM_ZBOT.GJ has an autoupdate routine: it can download and run an updated copy of itself. Secondly, however, it can spread onto other systems via removable drives, like USB thumb drives. It does thus by searching for removable drives and then creating a hidden folder with a copy of itself inside this folder, and a shortcut pointing to the hidden ZBOT copy.
    > http://blog.trendmicro.com/trendlabs...ot-BD-JPEG.jpg
    ... Portion of WORM_ZBOT.GJ code creating copy of itself
    This kind of propagation by ZBOT is unusual... ZBOT malware is usually distributed by exploit kits and/or malicious attachments..."

    - https://net-security.org/malware_news.php?id=2515
    June 11, 2013 - "The Zeus / Zbot Trojan has been around since 2007, and it and its variants continued to perform MitM attacks, log keystrokes and grab information entered in online forms. It is usually spread via exploit kits (drive-by-downloads), phishing schemes, and social media..."
    ___

    Washington Free Beacon compromised to serve up Malware
    - http://www.invincea.com/2013/06/kia-...ve-up-malware/
    UPDATE 10:02 a.m. 6/11 – "Repeated attempts to reach the Beacon have been unsuccessful. We have not seen reinfection in subsequent visits but it is hard to know without navigating every page...
    WARNING: Do NOT browse to freebeacon[.]com until further notice, as the site is still actively redirecting user traffic to malware. The Washington Free Beacon has been notified but have not confirmed nor responded... an article from The Washington Free Beacon on the breaking NSA Leaks story (freebeacon[.]com/nsa-leaker-surfaces-in-hong-kong/) linked to by the Drudge report has been compromising readers with a Java-based exploit kit* ... patching Java to the latest version (if you can) may be your only (temporary) protection..."
    - http://www.invincea.com/wp-content/uploads/27.png
    (More detail at the invincea URL above.)
    * https://www.virustotal.com/en/file/b...is/1370873028/
    File name: 1.jar
    Detection ratio: 3/47
    Analysis date: 2013-06-10
    ___

    Something evil on 173.255.213.171
    - http://blog.dynamoo.com/2013/06/some...255213171.html
    11 June 2013 - "As a follow-up to this post*, the exploit server on 173.255.213.171 (Linode, US) is hosting a number of -hijacked- GoDaddy-registered domains that are serving an exploit kit [1] [2]... block 173.255.213.171 ..."
    * http://blog.dynamoo.com/2013/06/well...ellsfargo.html

    1) https://www.virustotal.com/en/ip-add...1/information/

    2) http://urlquery.net/search.php?q=173...3-06-11&max=50
    ___

    CitiBank Secure Message Spam
    - http://threattrack.tumblr.com/post/5...e-message-spam
    June 11, 2013 - "Subjects Seen:
    (SECURE)Electronic Account Statement [removed]
    Typical e-mail details:
    You have received a Secure PDF message from the CitiSecure Messaging Server.
    Open the PDF file attached to this notification. When prompted, enter your Secure PDF password to view the message contents.
    To reply to this message in a secure manner, it is important that you use the Reply link inside the Secure PDF file. This will ensure that any confidential information is sent back securely to the sender.
    Help is available 24 hours a day by calling 1-866-535-2504 or 1-904-954-6181 or by email at secure.emailhelp @citi .com
    Please note: Adobe Reader version 7 or above is required to view all SecurePDF messages.


    Malicious URLs
    chriscarlson .com/ponyb/gate.php
    chrisandannwedding .com/ponyb/gate.php
    ccrtl .com/ponyb/gate.php
    chrisandannwedding .com/ponyb/gate.php
    hoteloperaroma .it/Sb9A7JV1.exe
    stitaly .net/E2KYVJD.exe
    newmountolivet .org/iUHgGvn.exe
    mozzarellabroker .com/pZYTn.exe


    Malicious File Name and MD5:
    Secure.<random>.zip (05c33cfcf22c5736C4a162f6d7c2eeac)
    secure.pdf.exe (4209430a3393287d5e28def88e43b93b)

    ThreatAnalyzer Report: http://db.tt/RtlUb5Vs [PDF]

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...8e01qz4rgp.png
    ___

    Amazon Order Notification Spam
    - http://threattrack.tumblr.com/post/5...ification-spam
    June 11, 2013 - "Subjects Seen:
    Payment for Your Amazon Order # [removed]
    Typical e-mail details:
    We’re writing to let you know that we are having difficulty processing your payment for the above transaction. To protect your security and privacy, your issuing bank cannot provide us with
    information regarding why your credit card was declined.
    However, we suggest that you double-check the billing address, expiration date and cardholder name
    that you entered; if entered incorrectly these will sometimes cause a card to decline. There is no
    need to place a new order as we will automatically try your credit card again.
    There are a few steps you can take to make the process faster:
    1. Verify the payment information for this order is correct (expiration date, billing address, etc).
    You can update your account and billing information at :
    amazon .com/gp/css/summary/edit.html?ie=UTF8&orderID=[removed]
    2. Contact your issuing bank using the number on the back of your card to learn more about their
    policies. Some issuers put restrictions on using credit cards for electronic or internet
    purchases. Please have the exact dollar amount and details of this purchase when you call the
    bank. If paying by credit card is not an option, buy Amazon.com Gift Card claim codes with cash
    from authorized resellers at a store near you. Visit amazon.com/cashgcresellers to learn
    more.
    Thank you for shopping at Amazon.com. Sincerely, Amazon.com Customer Service


    Malicious URLs
    gnqlawyers .com/proteans/index.html
    eucert .com/herein/index.html
    gauravvashisht .com/desisted/index.html
    goldcoinvault .com/news/pictures_hints_causes.php
    sweethomesorrento .it/t0q.exe
    server1.extra-web .cz/fdCtJM.exe


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...ZjB1qz4rgp.png

    - http://blog.dynamoo.com/2013/06/amaz...nvaultcom.html
    June 11, 2013 - "This fake Amazon.com spam leads to malware on goldcoinvault .com:
    Date: Tue, 11 Jun 2013 14:25:21 -0600 [16:25:21 EDT]
    From: "Amazon.com Customer Care Service" [payments-update @amazon .com]
    Subject: Payment for Your Amazon Order # 104-884-8180383
    Regarding Your Amazon.com Order
    Order Placed: June 11, 2013
    Amazon.com order number: 104-884-8180383
    Order Total: $2761.86 ...


    The link in the email goes through a legitimate hacked site to an intermediate page with the following redirectors:
    [donotclick]ftp.blacktiedjent .com/mechanic/vaccinated.js
    [donotclick]piratescoveoysterbar .com/piggybacks/rejoiced.js
    [donotclick]nteshop .es/tsingtao/flanneling.js
    ..from there it hits the main malware payload site at [donotclick]goldcoinvault .com/news/pictures_hints_causes.php (report here*) hosted on goldcoinvault .com which is a hacked GoDaddy domain -hijacked- to point at 173.255.213.171 (Linode, US). This same server is very active and has been spotted here** and here***, also using hacked GoDaddy domains, but right at the moment the malware page appears to be 403ing which is good..."
    * http://urlquery.net/report.php?id=3054553

    ** http://blog.dynamoo.com/2013/06/some...255213171.html

    *** http://blog.dynamoo.com/2013/06/well...ellsfargo.html

    Last edited by AplusWebMaster; 2013-06-12 at 05:39.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #208
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Malware sites to block, Casino PUA software SPAM, Fake BBB SPAM...

    FYI...

    Casino PUA software SPAM ...
    - http://blog.webroot.com/2013/06/12/t...-w32casonline/
    June 12, 2013 - "Fraudsters are currently spamvertising tens of thousands of emails enticing users into installing rogue, potentially unwanted (PUAs) casino software. Most commonly known as W32/Casonline, this scam earns revenue through the rogue online gambling software’s affiliate network... (multiple screenshots at the URL above)... Spamvertised URLs:
    hxxp ://luckynuggetcasino .com – 67.211.111.163
    hxxp ://888casino .com – 213.52.252.59
    hxxp ://spinpalace.com – 109.202.114.65
    hxxp ://alljackpotscasino.com – 64.34.230.122
    hxxp ://allslotscasino.com – 64.34.230.149
    ... (multiple) MD5s... have also phoned back to the same IP (213.52.252.59)... (Low detection rates per Virustotal - links at the webroot URL above)...
    We advise users to avoid interacting with any kind of content distributed through spam messages, especially clicking on any of the links found in such emails...."
    ___

    Fake BBB SPAM / trleaart .net
    - http://blog.dynamoo.com/2013/06/bbb-...leaartnet.html
    12 June 2013 - "This fake BBB spam with a "PLAINT REPORT" (sic) leads to malware on trleaart .net:
    From: Better Business Bureau [mailto:rivuletsjb72 @bbbemail .org]
    Sent: 11 June 2013 18:04
    Subject: Better Business Beareau Complaint ¹ S3452568
    Importance: High
    Sorry, your e-mail does not support HTML format. Your messages can be viewed in your browser
    Better Business Bureau ©
    Start With Trust
    Tue , 11 Jun 2013
    Issue N. S3452568
    The Better Business Bureau has been booked the above said claim letter from one of your customers in respect of their dealings with you. The detailed description of the consumer's trouble are available visiting a link below. Please pay attention to this matter and inform us about your mind as soon as possible.
    We amiably ask you to open the PLAINT REPORT to answer on this claim.
    We awaits to your prompt response.
    Faithfully yours
    Daniel Cox
    Dispute Advisor...
    Better Business Bureau...


    Screenshot: https://lh3.ggpht.com/-ZaIrOeD1dnc/U.../s400/bbb2.png

    The link goes through a legitimate -hacked- site and end up with a malware landing page on [donotclick]trleaart .net/news/members_guarantee.php (report here*) hosted on the following IPs:
    160.75.169.49 (Istanbul Technical University, Turkey)
    186.215.126.52 (Global Village Telecom, Brazil)
    190.93.23.10 (Greendot, Trinidad and Tobago)
    193.254.231.51 (Universitatea Transilvania Brasov, Romania)
    This network of evil sites is rather large... in the meantime here is a partial blocklist:
    160.75.169.49
    186.215.126.52
    190.93.23.10
    193.254.231.51
    ..."
    * http://urlquery.net/report.php?id=3067317
    ___

    Malware sites to block 12/6/13
    - http://blog.dynamoo.com/2013/06/malw...ock-12613.html
    12 June 2013 - "This is a refresh of this list of domains and IPs controlled by what I call the "Amerika" gang, and it follows on from this BBB spam run earlier. Note that IPs included in this list show recent malicious activity, but it could be that they have now been fixed. I also noticed that a couple of the domains may have been sinkholed, but it will do you no harm to block them anyway..."
    (LONG list at the dynamoo URL above - includes "Plain IPlist for copy-and-pasting".)
    ___

    Fake "Activation Needed" emails...
    - http://security.intuit.com/alert.php?a=82
    6/11/13 - "People are receiving -fake- emails with the title "Important Activation Needed/"
    Below is a copy of part of the email people are receiving:
    Screenshot: http://security.intuit.com/images/importact.jpg
    ... This is the end of the -fake- email.
    Steps to Take Now
    Do not open the attachment in the email...
    Delete the email..."
    ___

    GAMARUE malware uses Sourceforge to host files
    - http://blog.trendmicro.com/trendlabs...to-host-files/
    June 11, 2013 - "In our monitoring of the GAMARUE malware family, we found a variant that used the online code repository SourceForge to host malicious files... SourceForge is a leading code repository for many open-source projects, which gives developers a free site that allows them to host and manage their projects online. It is currently home to more than 324,000 projects and serves more than 4 million downloads a day... GAMARUE malware poses a serious risk to users; attackers are able to gain complete control of a system and use it to launch attacks on other systems, as well as stealing information. Among the most common ways it reaches user systems are: infected removable drives, or the user has visited sites compromised with the Blackhole Exploit Kit. This attack is made up of four files. The first is a shortcut, which appears to be a shortcut to an external drive. (This is detected as LNK_GAMARUE.RMA.) Instead of a drive, however, it points to a .COM file (detected as TROJ_GAMARUE.LMG)...
    > http://blog.trendmicro.com/trendlabs...ruediagram.png
    GAMARUE Infection Chain
    Once the executable file is decrypted, it downloads updates to itself, as well as malicious files from a SourceForge project. In effect, it uses SourceForge to unwittingly host malicious files... The malicious files in the above example were hosted under the tradingfiles project. The same user created two more projects that were also used to host malicious GAMARUE files: ldjfdkladf and stanteam. New files were uploaded in these projects from June 1 onwards..."

    - https://net-security.org/malware_news.php?id=2517
    June 12, 2013 - "... the infection with a variant of the information-stealing Gamarue starts with a shortcut file to an external file, and ends with malicious files being downloaded from one of three (obviously bogus) Sourceforge projects: "tradingfiles," "stanteam," and "ldjfdkladf". The first two have already been deleted, and the third one emptied of all files. The account of the user who created them has been deleted (whether or not by Sourceforge or the user it's impossible to tell), but according to the researchers new files were uploaded into these projects from June 1 onwards..."
    ___

    Fake Xerox WorkCentre Spam
    - http://threattrack.tumblr.com/post/5...orkcentre-spam
    June 12, 2013 - "Subjects Seen:
    Scan from a Xerox WorkCentre
    Typical e-mail details:
    Please download the document. It was scanned and sent to you using a Xerox multifunction device.
    File Type: pdf
    Download: Scanned from a Xerox multi~3.pdf
    multifunction device Location: machine location not set
    Device Name: Xerox6592
    For more information on Xerox products and solutions, please visit xerox .com


    Malicious URLs
    forum.xcpus .com:8080/webstats/counter.php
    buildmybarwebsite .com/webstats/counter.php
    continentalfuel .com/webstats/counter.php
    apparellogisticsgroup .net/Aq70QrZ.exe
    ftp(DOT)celebritynetworks .com/dNYC.exe
    portal.wroctv .com/inZGwEH.exe
    videotre .tv .it/UmQ.exe


    Malicious File Name and MD5:
    Scan_<random>.zip (0375c95289fc0e2dd94b63c105c24373)
    Scan_<random> (8fcba93b00dba3d182b1228b529d3c9e)

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...zKT1qz4rgp.png

    - http://blog.dynamoo.com/2013/06/scan...ntre-spam.html
    12 June 2013 - "This fake Xerox WorkCentre spam comes with a malicious attachment and appears to come from the victim's own domain:
    Date: Wed, 12 Jun 2013 10:36:16 -0500 [11:36:16 EDT]
    From: Xerox WorkCentre [Xerox.Device9@victimdomain.com]
    Subject: Scan from a Xerox WorkCentre
    Please download the document. It was scanned and sent to you using a Xerox multifunction device.
    File Type: pdf
    Download: Scanned from a Xerox multi~3.pdf
    multifunction device Location: machine location not set
    Device Name: Xerox2023
    For more information on Xerox products and solutions, please visit http ://www.xerox .com


    Attached is a ZIP file, in this case called Scan_06122013_29911.zip which in turn contains an executable Scan_06122013_29911.exe. Note that the date is encoded into the filename so future versions will be different. VirusTotal results are 23/47* which is typically patchy. Comodo CAMAS reports** that the malware attempts to phone home to forum.xcpus .com on 71.19.227.135 and has the following checksums:
    MD5 8fcba93b00dba3d182b1228b529d3c9e
    SHA1 54f02f3f1d6954f98e14a9cee62787387e5b072c
    SHA256 544c08f288b1102d6304e9bf3fb352a8fdfb59df93dc4ecc0f753dd30e39da0c
    ... the ThreatTrack report [pdf]*** is more detailed and also identifies the following domains and IPs which are probably worth blocking or looking out for:
    71.19.227.135
    205.178.152.164
    198.173.244.62
    204.8.121.24
    195.110.124.133
    173.246.106.150
    ..."
    * https://www.virustotal.com/en/file/5...is/1371077066/
    File name: Scan_06122013_29911.exe
    Detection ratio: 23/47
    Analysis date: 2013-06-12
    ** http://camas.comodo.com/cgi-bin/subm...753dd30e39da0c

    *** http://www.dynamoo.com/files/analysi...8b529d3c9e.pdf
    ___

    Fake Fedex SPAM / oxfordxtg .net
    - http://blog.dynamoo.com/2013/06/fede...ordxtgnet.html
    12 June 2013 - "This fake FedEx spam leads to malware on oxfordxtg .net:
    Date: Thu, 13 Jun 2013 01:18:09 +0800 [13:18:09 EDT]
    From: FedEx [wringsn052 @emc.fedex .com]
    Subject: Your Fedex invoice is ready to be paid now.
    FedEx(R) FedEx Billing Online - Ready for Payment
    fedex.com
    Hello [redacted]
    You have a new outstanding invoice(s) from FedEx that is ready for payment.
    The following ivoice(s) are to be paid now :
    Invoice Number
    5135-13792
    To pay or review these invoices, please sign in to your FedEx Billing Online account by clicking on this link: http ://www.fedex .com/us/account/fbo
    Note: Please do not use this email to submit payment. This email may not be used as a remittance notice. To pay your invoices, please visit FedEx Billing Online, http ://www.fedex .com/us/account/fbo
    Thank you,
    Revenue Services
    FedEx...


    Screenshot: https://lh3.ggpht.com/-gOwdBh9V5Os/U...1600/fedex.png

    The link in the email goes through a legitimate hacked site and ends up on a malware payload page at [donotclick]oxfordxtg .net/news/absence_modern-doe_byte.php (report here*) hosted on:
    124.42.68.12 (Langfang University, China)
    190.93.23.10 (Greendot, Trinidad and Tobago)
    The following partial blocklist covers these two IPs, but I recommend you also apply this larger blocklist of related sites** as well.
    124.42.68.12
    190.93.23.10
    ..."
    * http://urlquery.net/report.php?id=3082461

    ** http://blog.dynamoo.com/2013/06/malw...ock-12613.html
    ___

    Fake "'Anonymous' sent you a payment" emails...
    - http://security.intuit.com/alert.php?a=83
    6/12/13 - " People are receiving fake emails with the title "X sent you a payment (where X is a person's name)." Below is a copy of the email people are receiving:
    Screenshot: http://security.intuit.com/images/paymentnetwork.jpg
    This is the end of the fake email.
    Steps to Take Now
    Do -not- open the attachment in the email...
    Delete the email..."

    Last edited by AplusWebMaster; 2013-06-13 at 02:44.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #209
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake eFax Corporate SPAM

    FYI...

    Fake eFax Corporate SPAM...
    - http://threattrack.tumblr.com/post/5...corporate-spam
    June 13, 2013 - "Subjects Seen:
    Corporate eFax message from “unknown” - 4 page(s)
    Typical e-mail details:
    You have received a 4 page fax at 2013-06-10 11:52:46 EST.
    * The reference number for this fax [removed] .
    Please visit efaxcorporate .com/corp/twa/page/customerSupport if you have any questions regarding this message or your service. You may also e-mail our corporate support department at corporatesupport @mail .efax .com.
    Thank you for using the eFax Corporate service!


    Malicious URLs
    50.63.46.110 /erected/index.html
    74.91.143.180 /frosting/index.html
    weedguardplus .net/news/pictures_hints_causes.php


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...ZRg1qz4rgp.png
    ___

    - http://tools.cisco.com/security/cent...utbreak.x?i=77
    Fake Scanned Document Attachment Email Messages - 2013 Jun 13
    Fake Secure Message Notification Email Messages - 2013 Jun 13
    Malicious Attachment Email Messages - 2013 Jun 13
    Fake Product Order Quotation E-mail Messages - 2013 Jun 13
    Fake Money Transfer Notification E-mail Messages - 2013 Jun 13
    Fake Product Order E-mail Messages - 2013 Jun 13
    Fake Bill Payment Notification Email Messages - 2013 Jun 13
    Fake Bill Payment Notification Email Messages - 2013 Jun 13
    Fake Bank Payment Request Notification E-mail Messages - 2013 Jun 13
    (More detail and links at the cisco URL above.)

    Last edited by AplusWebMaster; 2013-06-14 at 02:18.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #210
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake LinkedIn, UPS SPAM...

    FYI...

    Fake LinkedIn SPAM...
    - http://threattrack.tumblr.com/post/5...nvitation-spam
    June 14, 2013 - "Subjects Seen:
    Invitation to connect on LinkedIn
    Typical e-mail details:
    Hattie Fitzgerald, wants to connect with you on LinkedIn.

    Malicious URLs
    50.63.46.110 /jotted/index.html
    audio-mastering-music .com/news/pictures_hints_causes.php?jnlp=bd187af1d0
    audio-mastering-music .com/news/pictures_hints_causes.php?rwiezly=qzxqjh&rzvaax=abldjf
    audio-mastering-music .com/news/pictures_hints_causes.php?pf=2w:1l:1n:1f:1j&ze=2w:31:1g:1n:1m:2v:33:1g:31:1f&x=1f&xu=s&ma=o&jopa=1715713


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...IOr1qz4rgp.png
    ___

    Fake UPS Package Pickup Spam
    - http://threattrack.tumblr.com/post/5...ge-pickup-spam
    June 14, 2013 - "Subjects Seen:
    UPS - Your package is available for pickup ( Parcel [removed] )
    Typical e-mail details:
    The courier company was not able to deliver your parcel by your address.
    Cause: Error in shipping address.
    You may pickup the parcel at our post office.
    Please attention!
    For mode details and shipping label please see the attached file.
    Print this label to get this package at our post office.
    Please do not reply to this e-mail, it is an unmonitored mailbox!
    Thank you,
    UPS Logistics Services.


    Malicious URLs
    bestseoamerica .com/ponyb/gate.php
    austinremoterecording .com/ponyb/gate.php
    audiomasteringsearch .com/ponyb/gate.php
    audiomasteringmeistro .com/ponyb/gate.php
    sistersnstyle .co/4bnsSjBb.exe
    destinationgreece .com/7tW.exe
    villa-anastasia-crete .com/JWHvdgW.exe
    kahrobaa .com/14VkWHU0 .exe


    Malicious File Name and MD5:
    UPS_Label_<random>.zip (05c33cfcf22c5736c4a162f6d7c2eeac)
    UPS-Label_Parcel_<random>.exe (bc48d3e736c66f577636ed486a990eeb)

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...KRF1qz4rgp.png

    Last edited by AplusWebMaster; 2013-06-14 at 19:36.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •