Page 115 of 116 FirstFirst ... 1565105111112113114115116 LastLast
Results 1,141 to 1,150 of 1151

Thread: SPAM frauds, fakes, and other MALWARE deliveries...

  1. #1141
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Random subject SPAM

    FYI...

    Random subject SPAM - download .lnk files to malware
    - https://myonlinesecurity.co.uk/vario...ious-malwares/
    1 Feb 2017 - "... numerous versions of the emails, but they all basically function in the same way. The email has a link to a compromised site that pretends to be a doc, image or PDF file but in reality will download a .lnk file (windows shortcut file) - these run powershell & contact another site to actually download the malware. These link files have a base64 encoded section with the download link...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...em_shipped.png

    ... other emails read and look like:
    1] https://myonlinesecurity.co.uk/wp-co...nfirmation.png

    2] https://myonlinesecurity.co.uk/wp-co...-confirmed.png

    - https://www.virustotal.com/en/file/d...d127/analysis/
    File name: confirm-purchase-ordernum-3TX0S8458483-JY.pdf
    Detection ratio: 3/54
    Analysis date: 2017-02-01

    - https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    5.152.199.228

    ... different download locations, sometimes delivering exactly same malware from all locations and sometimes slightly different malware versions from each one... All these malicious emails are either designed to steal your Passwords, Bank, PayPal or other financial details along with your email or FTP (web space) log in credentials. Or they are -Ransomware- versions that encrypt your files and demand large sums of money to recover the files..."

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #1142
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'eFax' SPAM, Identity fraud hits record high, Apple phish, Netgear updates

    FYI...

    Fake 'eFax' SPAM - delivers malware
    - https://myonlinesecurity.co.uk/spoof...known-malware/
    2 Feb 2017 - "... an email with the subject of 'You received a new eFax from 516-6128936' (numbers are normally random) pretending to come from eFax <messaging@ efax .com> with a link-that-downloads a malicious word doc... Update: I am reliably informed* it downloads Hancitor & other associated malware...
    * https://twitter.com/Techhelplistcom/...35660352323584

    Screenshot: https://myonlinesecurity.co.uk/wp-co...5166128936.png

    ... The download link in the body of the email is:
    http ://akatsuki-eng .co.jp/api/get.php?id=dmljdGltQGRvbWFpbi5jb20= where the base64 encoded section is the recipients email address...

    2 February 2017: eFax_victim.doc - Current Virus total detections 3/54**. Payload Security***... DO NOT follow the advice they give to enable macros or enable editing to see the content..."
    ** https://www.virustotal.com/en/file/5...is/1486056401/

    *** https://www.hybrid-analysis.com/samp...ironmentId=100

    akatsuki-eng .co.jp: 157.7.107.124: https://www.virustotal.com/en/ip-add...4/information/
    > https://www.virustotal.com/en/url/a5...e687/analysis/

    ... Update: 3 February 2017: Today’s version has a .lnk file inside-a-zip as an attachment
    (VirusTotal 3/56[1]) connects to & downloads analytics.activeadvisory .com/007.bin
    but only from a Canadian IP range. The rest of the world appears blocked. (VirusTotal 6/56[2])
    (Payload Security[3]). This one is delivering Urnsif banking Trojan...
    1] https://www.virustotal.com/en/file/8...74ac/analysis/

    2] https://www.virustotal.com/en/file/4...is/1486120969/

    3] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    208.67.222.222
    185.77.128.246
    85.17.94.33
    172.86.121.117


    analytics.activeadvisory .com: 149.56.201.88: https://www.virustotal.com/en/ip-add...8/information/
    > https://www.virustotal.com/en/url/10...7736/analysis/
    ___

    Identity fraud hits record high
    - https://www.helpnetsecurity.com/2017...s-record-high/
    Feb 2, 2017 - "The number of identity fraud victims increased by sixteen percent (rising to 15.4 million U.S. consumers) in the last year, according to Javelin Strategy & Research*. Their study found that despite the efforts of the industry, fraudsters successfully adapted to net two million more victims this year with the amount fraudsters took rising by nearly one-billion-dollars to $16 billion..."
    > https://www.helpnetsecurity.com/imag...n-022017-1.jpg

    * https://www.javelinstrategy.com/pres...-according-new
    Feb 1, 2017

    - https://krebsonsecurity.com/2017/01/...-the-dark-web/
    Jan 31, 2017 - "... Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS. Tax data can be -phished- directly from consumers via phony emails spoofing the IRS or employers. But more often, the information is stolen in bulk from employers. In a typical scenario, the thieves target people who work in HR and payroll departments at corporations, and spoof an email from a higher-up in the company asking for all employee W-2 data to be included in a single file and emailed immediately..."
    ___

    Apple 'Security Measures' - phish
    - https://myonlinesecurity.co.uk/apple...ures-phishing/
    2 Feb 2017 - "... spam run apple phishing today. The bad spelling and grammar should be enough to warn anybody that it is a fake...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...y-Measures.png

    The link-in-the-email goes to:
    http ://www .interwurlitzer .com/mc.html which redirects you to
    http ://www .bdic .ca/mardei/Itunes/apple/ where you see the typical Apple phishing page."

    interwurlitzer .com: 87.229.45.133: https://www.virustotal.com/en/ip-add...3/information/
    > https://www.virustotal.com/en/url/b3...c7f8/analysis/
    bdic .ca: 67.212.91.221: https://www.virustotal.com/en/ip-add...1/information/
    > https://www.virustotal.com/en/url/0b...3e95/analysis/
    ___

    Netgear addresses 'Password Bypass' vulns in 31 Router Models
    - http://www.darkreading.com/vulnerabi...d/d-id/1328036
    Feb 1, 2017
    - https://web.nvd.nist.gov/view/vuln/d...=CVE-2017-5521
    Last revised: 01/23/2017
    CVSS v3 Base Score: 8.1 High

    > http://kb.netgear.com/30632/Web-GUI-...-Vulnerability
    "... Firmware fixes are currently available for the following affected devices. To download the firmware release that fixes the password recovery vulnerability, click the link for your model and visit the firmware release page for instructions.."
    Last Updated: 01/27/2017

    Last edited by AplusWebMaster; 2017-02-03 at 15:28.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #1143
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'notice to Appear' SPAM, Pastebin Malware

    FYI...

    Fake 'notice to Appear' SPAM - delivers Kovter/Locky
    - https://myonlinesecurity.co.uk/spoof...ky-and-kovter/
    5 Feb 2017 - "... start of a campaign using 'New notice to Appear in Court' as the email subject. The attachments are identical to the typical .JS, .WSF, .lnk file inside a double zip. All the sites seen so far today are the -same- sites used in the USPS, FedEx, UPS current campaigns*...
    * https://myonlinesecurity.co.uk/spoof...d-locky-sites/
    ... The attachments all start with a zip named along the lines of Notice_00790613.zip which contain -another- zip Notice_00790613.doc.zip which in turn contains Notice_00790613.doc.js ... All of the sites are listed on THIS post**... All the sites contain the -same- Malware downloads of Kovter and Locky. They do get updated frequently during the day...
    ** https://myonlinesecurity.co.uk/spoof...d-locky-sites/
    ... The infection process is described very well by this Microsoft blog post***...
    *** https://blogs.technet.microsoft.com/...tion-to-locky/

    Screenshot: https://myonlinesecurity.co.uk/wp-co...r-in-Court.png

    5 February 2017: Notice_00790613.doc.js - Current Virus total detections 11/54[4].
    Payload Security[5]. Today’s eventual downloads: Locky (VirusTotal 6/56[6]). Kovter (VirusTotal 9/57[7])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    4] https://www.virustotal.com/en/file/b...is/1486286066/

    5] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts (176)
    HTTP Traffic
    97.74.144.118: https://www.virustotal.com/en/ip-add...8/information/

    50.62.117.7: https://www.virustotal.com/en/ip-add...7/information/

    107.181.187.77: https://www.virustotal.com/en/ip-add...7/information/

    6] https://www.virustotal.com/en/file/b...is/1486287187/

    7] https://www.virustotal.com/en/file/8...is/1486287513/
    ___

    Many Malware Samples found on Pastebin
    - https://isc.sans.edu/diary.html?storyid=22036
    2017-02-05

    Last edited by AplusWebMaster; 2017-02-05 at 20:42.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #1144
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'To all employee’s', 'Shipping info' SPAM

    FYI...

    Fake 'To all employee’s' SPAM - delivers malware
    - https://myonlinesecurity.co.uk/fw-to...livers-dridex/
    6 Feb 2017 - "... an email with the subject of 'FW: To all employee’s' pretending to come from Administrator <Administrator@ administrator .delivery> with a malicious word doc attachment... not 100% certain this is Dridex, Payload Security is unable to save to webservice on the Word Macro or the downloaded .exe file. The other samples doing that today are Dridex, so it looks like the Dridex gang have added some sort of anti-sandbox protection to itself...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...-employees.png

    6 February 2017: EmployeeConfidential.doc - Current Virus total detections 2/54*
    Payload Security** was unable to 'save to webservice'. VirusTotal comments gave me the download location:
    http ://fistnote .com/images/k6kkGcHpPi7m5iJprQPxPcoiVhmT7.exe (VirusTotal 11/55***). Payload Security again was unable to save to webservice Zip file attached... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/3...is/1486399875/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    *** https://www.virustotal.com/en/file/4...is/1486399137/

    fistnote .com: 208.56.226.20: https://www.virustotal.com/en/ip-add...0/information/
    > https://www.virustotal.com/en/url/1d...957b/analysis/
    ___

    Fake 'Shipping info' SPAM - delivers malware via macro word docs
    - https://myonlinesecurity.co.uk/spoof...cro-word-docs/
    6 Feb 2017 - "An email with the subject of 'Shipping information for parcel 3627458' pretending to come from USPS <shipping@ usps-service .com> with a malicious word doc attachment delivers hancitor which downloads Zloader and Pony which will download -more- malware... The email looks like:
    From: USPS <shipping@ usps-service .com>
    Date:
    Subject: Shipping information for parcel 3627458
    Attachment:
    Our courrier was not able to deliver your parcel because nobody was present at your address.
    Someone must always be present on the delivery day, to sign for receiving the parcel.
    Shipping type: USPS Next Day Box size: Large Box ( 2-5kg ) Date : Feb 6th 2017
    You can reschedule the delivery over the phone, but you will have to confirm the information on the delivery invoice.
    Another delivery can be arranged, by calling the number on the delivery invoice we left at your address and confirming the shipping information, including the address and tracking number.
    A scanned copy of the delivery invoice can also be downloaded by visiting the USPS website:
    https ://tools.usps .com/web/pages/view.invoice?id=3627458&dest=submit@...
    In the exceptional case that a new delivery is not rescheduled in 24 hours, the shipment will be cancelled and the package will be returned to the sender.
    Thanks for shipping with USPS ...


    6 February 2017: USPS_invoice_submit.doc - Current Virus total detections 4/54*
    Payload Security**... The download link-in-the-body of the email is:
    http ://fam-life .jp/api/get.php?id=c3VibWl0QHRoZXNweWtpbGxlci5jby51aw== where the base64 encoded section is the recipients email address. The downloaded word doc is created by adding the recipients name, or at least the bit before the @ in the email address... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/e...is/1486405685/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    fam-life .jp: 157.7.107.28: https://www.virustotal.com/en/ip-add...8/information/
    > https://www.virustotal.com/en/url/80...02da/analysis/

    Last edited by AplusWebMaster; 2017-02-07 at 00:37.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #1145
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake sex lure, 'Your order Canceled' SPAM

    FYI...

    Fake sex lure SPAM - delivers ransomware
    - https://myonlinesecurity.co.uk/get-l...rs-ransomware/
    7 Feb 2017 - "The sex lures in an email always work. Curiosity is just too much for some recipients... an email with the subject of 'get laid tonight' pretending to come from Alice Olsen <Alice.Olsen@ mail .com> with a very enticingly named zip attachment 'ourSexPhoto.zip' containing an .exe file with a definite sexy or pornographic lure 'byAliceforyouOurSexPhotosiwantyou .exe'... One of the emails looks like:
    From: Alice Olsen <Alice.Olsen@ mail .com>
    Date: Mon 06/02/2017 22:42
    Subject: get laid tonight
    Attachment: ourSexPhoto.zip
    Iam Thinking Of You ! My photos after our party


    7 February 2017: ourSexPhoto.zip: Extracts to: byAliceforyouOurSexPhotosiwantyou.exe
    Current Virus total detections 8/56*. Payload Security**... VT is differing between Sage ransomware and generic malware detections. Payload Security is inconclusive. Returns from Anti-Virus submissions vary between Generic Ransomware and Yakes Trojan... we can pretty much assume it is -ransomware- but there is some doubt which one... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/3...is/1486431675/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100
    ___

    Fake 'Your order Canceled' SPAM - delivers sage ransomware
    - https://myonlinesecurity.co.uk/your-...ge-ransomware/
    7 Feb 2017 - "... an email with the subject of 'Your order Canceled. fraud' pretending to come from Security Service <security-service@ mail .com> with a zip attachment containing an .exe file. The bad spelling should be enough to alert recipients... 'looks like a new version of Sage with updated decryption and what to do instructions... Drops a vbs file that gives -audio- alerts telling you that your files are encrypted:
    “Attention! Attention! This is not a test!
    All you documents, data bases and other important files were encrypted and Windows can not restore them without special software.User action is required as soon as possible to recover the file”

    It also changes Bcdedit to prevent system recovery and of course deletes all shadow copies... One of the emails looks like:
    From: Security Service <security-service@ mail .com>
    Date: Tue 07/02/2017 18:19
    Subject: Your order Canceled. fraud
    Attachment:
    Your order has been canceled.
    Your credit card is invalid.
    For an explanation of the reason you have 3 days.
    By discharging is distributed 3 days, your card will be blocked.
    All the details in the attached documents.


    7 February 2017: Your.orderCanceled.fraud.zip Extracts to: Your.order10988322.Canceled. fraud.2017-01-15.exe
    Current Virus total detections 9/57*. Payload Security**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/f...is/1486490294/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    91.214.114.197

    Last edited by AplusWebMaster; 2017-02-07 at 21:53.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #1146
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'Confidential documents', 'Final payment' SPAM

    FYI...

    Fake 'Confidential documents' SPAM - delivers Trickbot
    - https://myonlinesecurity.co.uk/confi...anking-trojan/
    9 Feb 2017 - "... An email with the subject of 'Confidential documents' pretending to come from random names @ anz .com with a malicious word doc attachment delivers Trickbot banking Trojan... The email looks like:
    From: Kathy.Hilton@ anz .com
    Date: Thu 09/02/2017 01:45
    Subject: Confidential documents
    Attachment: ANZ_message00207.doc
    Please review attached document.
    Kathy.Hilton@ anz .com
    Australia and New Zealand Bank
    1800-575-892 office
    1800-640-855 cell
    Investments in securities and insurance products are:
    NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
    CONFIDENTIAL NOTICE ...


    9 February 2017: ANZ_message00207.doc - Current Virus total detections 6/54*
    Payload Security**. Neither show anything definite, but searching around gave me these links to VirusTotal reports from the same campaign:
    > https://virustotal.com/en/file/03f75...4461/analysis/
    Behavioural information > TCP connections
    78.47.139.102: https://www.virustotal.com/en/ip-add...2/information/
    47.18.17.114: https://www.virustotal.com/en/ip-add...4/information/
    13.107.4.50: https://www.virustotal.com/en/ip-add...0/information/
    213.25.134.75: https://www.virustotal.com/en/ip-add...5/information/
    > https://virustotal.com/en/file/8b90a...46a5/analysis/
    > https://virustotal.com/en/file/0456c...49d0/analysis/
    Download sites appear to be:
    - andiamoluggage .com/skin/frontend/holloway.png
    - andiamoluggage .com/skin/frontend/fortis/ahjakacbakawda.png
    - andiamoluggage .com/skin/install/not16.png
    All of which are NOT png (image files) but renamed .exe files... Thanks to @Techhelplist[1]...
    1] https://twitter.com/Techhelplistcom/...68826676899840
    ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/a...is/1486618849/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    andiamoluggage .com: 173.254.28.82: https://www.virustotal.com/en/ip-add...2/information/
    > https://www.virustotal.com/en/url/e3...9bd0/analysis/
    ___

    Fake 'Final payment' SPAM - delivers malware
    - https://myonlinesecurity.co.uk/spoof...-zbot-malware/
    9 Feb 2017 - "An email with the subject of 'Final payment request' pretending to come from MatthewPeters@ hmrc.gsi .gov.uk with a malicious word doc attachment delivers what looks like a Zbot variant... The email looks like:
    From: MatthewPeters@hmrc.gsi.gov.uk” <info@ nestpensions63 .top>
    Date: Thu, 9 Feb 2017 13:24:00 +0100
    Subject: Final payment request
    Attachment: debt_93498438747.doc
    Date of issue 09 February 2017
    Reference K2135700006
    Don’t ignore this letter – you need to pay us now if you want to stop us taking enforcement action against you.
    We contacted you previously asking you to pay the above amount but you still haven’t done so. The attached statement of liability gives a breakdown of what you owe.
    As you’re in the very small minority of people who haven’t paid. We’re treating your case as a priority. If you don’t pay now, we’ll take action to make you pay. The law allows us to enforce debts by seizing your goods and selling them by public auction A regional sheriff officer acting on a summary warrant will do this for us. We can charge fees for this so if you don’t act now it could cost you more money.
    For more information and how to pay us please see attached statement.
    We’ll continue to add interest to the original debt until you pay in full.
    Debt Management ...


    9 February 2017: debt_93498438747.doc - Current Virus total detections 7/53*
    Payload Security** shows a download from http ://jsmkitchensandbedrooms .co.uk/explo.exe
    (VirusTotal 4/57***) - Payload Security[4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/a...is/1486645244/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100
    94.199.185.21
    172.227.109.213
    185.162.9.59


    *** https://www.virustotal.com/en/file/c...is/1486642865/

    4] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    104.85.50.185
    178.77.110.129
    185.162.9.59


    jsmkitchensandbedrooms .co.uk: 94.199.185.21: https://www.virustotal.com/en/ip-add...1/information/
    > https://www.virustotal.com/en/url/f4...cd55/analysis/

    Last edited by AplusWebMaster; 2017-02-09 at 17:12.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #1147
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'Xpress Money', 'Secure Message' SPAM, Safeguard Account Update – phish

    FYI...

    Fake 'Xpress Money' SPAM - delivers java adwind
    - https://myonlinesecurity.co.uk/spoof...s-java-adwind/
    14 Feb 2017 - "... fake financial themed emails containing java adwind or Java Jacksbot attachments... previously mentioned many of these HERE[1]...
    1] https://myonlinesecurity.co.uk/?s=java+adwind
    ... The email looks like:
    From: elizabethst2.mel@ xpressmoney .com
    Date: Mon 13/02/2017 23:45
    Subject: Fwd: Reference: Xpress Money compliant report
    Attachment: XPRESS MONEY UPTHRONI DATA.zip (contains 2 identical although differently named java.jar files)
    Dear Agent,
    The attached Compliant report was issued yesterday online by a customer about you. We will need your feedback as soon as possible before 24hours or your terminal will be blocked.
    Regards
    Nasir Usuman
    Regional Compliance Manager Pakistan & Afghanistan
    Global Compliance, Xpress Money ...


    14 February 2017: XPRESS MONEY REFERENCES FOLLOW UP.jar.jar (287 kb) - Current Virus total detections 8/57*
    Payload Security**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/f...is/1487047920/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100
    ___

    Fake 'Secure Message' SPAM - delivers malware
    - https://myonlinesecurity.co.uk/rbc-r...ivers-malware/
    14 Feb 2017 - "An email with the subject of 'Secure Message' pretending to come from RBC Royal Bank but actually coming from a -fake- domain imitating the RBC <service@ rbcroyalbanksecuremessage .com> with a malicious word doc attachment delivers an unknown malware...
    The domain in the email address rbcroyalbanksecuremessage .com was registered today by criminals using privacy protection by Godaddy and hosted on Rackspace...

    rbcroyalbanksecuremessage .com: 104.130.159.40: https://www.virustotal.com/en/ip-add...0/information/
    23.253.233.16: https://www.virustotal.com/en/ip-add...6/information/

    The email looks like:
    From: RBC Royal Bank <service@rbcroyalbanksecuremessage .com>
    Date: Tue 14/02/2017 17:13
    Subject: Secure Message
    Attachment: SecureMessage.doc
    Secure Message
    This is an automated message send by Royal Bank Secure Messaging Server. To ensure both you and the RBC Royal Bank comply with current legislation, this message has been encrypted. Please check attached documents for more information. Note: You should not store confidential information unless it is encrypted.
    CONFIDENTIALITY NOTICE:The contents of this email message and any attachments are intended solely for the addressee(s)and may contain confidential and/or privileged information and may be legally protected from disclosure...


    14 February 2017: SecureMessage.doc - Current Virus total detections 4/55*
    Payload Security**.. neither give any real indication what it downloads..
    Update: Thanks to help from another researcher***.. It downloads
    http ://sungkrorsang .com/jerohnimo.png which of course is -not- a png (image file) but a renamed .exe that the macro will rename & autorun. VirusTotal 10/59[4] | Payload Security[5]...
    sungkrorsang .com: 61.19.252.134: https://www.virustotal.com/en/ip-add...4/information/
    > https://www.virustotal.com/en/url/a1...1b8e/analysis/
    ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/e...is/1487094048/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    *** https://twitter.com/GossiTheDog/stat...65160254996480

    4] https://www.virustotal.com/en/file/b...is/1487095755/

    5] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    78.47.139.102
    47.18.17.114
    213.25.134.75
    219.93.24.2
    192.189.25.143

    ___

    Safeguard Account Update – phish
    - https://myonlinesecurity.co.uk/hsbc-...date-phishing/
    14 Feb 2017 - "Another Banking phish. This time HSBC. What makes this “slightly” more believable is the url the phishing email leads to http ://hsbc-verify .org.uk/ - which is a very plausible web address...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...hing-email.png

    The link goes to http ://hsbc-verify .org.uk/ where you see a webpage like this*, which leads to a typical set of phishing pages asking for all your bank, credit card and personal details, so they can empty your bank and credit card accounts and take over your identity completely:
    * https://myonlinesecurity.co.uk/wp-co...sbc_verify.png
    ... registrars are not taking enough precautions and allowing dodgy domain names to be registered to non existent people..."

    hsbc-verify .org.uk: 91.218.247.93: https://www.virustotal.com/en/ip-add...3/information/
    > https://www.virustotal.com/en/url/7f...52f2/analysis/

    Last edited by AplusWebMaster; 2017-02-14 at 20:47.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #1148
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'Secure Message' SPAM, Hijacked domains

    FYI...

    Fake 'Secure Message' SPAM - delivers Trickbot
    - https://myonlinesecurity.co.uk/spoof...vers-trickbot/
    15 Feb 2017 - "An email with the subject of 'Secure Message' pretending to come from HM Revenue & Customs with a malicious word doc attachment delivers Trickbot banking Trojan... The sending domain for these malspam emails was hmrcgovsec .co.uk which was registered -today- by criminals via Godaddy. Godaddy have jumped on this very quickly & suspended the domain within a few minutes of the first batch being sent...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...spam-email.png

    hmrcgovsec .co.uk: 172.99.114.9: https://www.virustotal.com/en/ip-add...9/information/

    15 February 2017: SecureCommunication.doc - Current Virus total detections 4/55*
    Payload Security**.. as usual nothing is showing the download location or what actual malware this is...
    Update: I am reliably informed*** the download location is:
    http ://fistnote .com/images/CV6amPf8jsgJeHVgLX.png which of course is renamed .exe and -not- an image file
    (Payload Security[4]) (VirusTotal 9/56[5]) (VirusTotal 2/64[6])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/f...is/1487167293/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    *** https://twitter.com/GossiTheDog/stat...71728112508928

    4] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    78.47.139.102
    47.18.17.114
    213.25.134.75
    219.93.24.2
    192.189.25.143


    5] https://www.virustotal.com/en/file/5...is/1487168128/

    6] https://www.virustotal.com/en/url/d1...92e5/analysis/

    fistnote .com: 208.56.226.20: https://www.virustotal.com/en/ip-add...0/information/
    > https://www.virustotal.com/en/url/d1...92e5/analysis/

    - http://blog.dynamoo.com/2017/02/malw...e-message.html
    15 Feb 2017 - "... Attached is a file RBCSecureMessage.doc which contains some sort of macro-based malware. It displays the following page to entice victims to disable their security settings:
    > https://1.bp.blogspot.com/-FqntNZLfb...0/fake-rbc.png
    ... The domain rbc-secure-message .com is -fake- and has been registered solely for this purpose of malware distribution. In all the samples I saw, the sending IP was 64.91.248.146 (Liquidweb, US) but it does look like all these IPs in the neighbourhood are involved in the same activity:
    64.91.248.137
    64.91.248.146
    64.91.248.148
    64.91.248.150
    I recommend you block 64.91.248.128/27 at your email gateway to be sure."
    ___

    Personaliazed SPAM - uses hijacked domains
    - http://blog.dynamoo.com/2017/02/high...am-making.html
    15 Feb 2017 - "This spam email contained not only the intended victim's name, but also their home address and an apparently valid mobile telephone number:
    Sent: 14 February 2017 13:52
    To: [redacted]
    From: <customer@ localpoolrepair .com>
    Subject: Mr [Redacted] Your order G29804772-064 confirmation
    Dear Mr [redacted],
    Thank you for placing an order with us.
    For your reference your order number is G29804772-064.
    Please note this is an automated email. Please do not reply to this email.
    Get your order G29804772-064 details
    Your order has been placed and items in stock will be sent to the address shown below. Please check all the details of the order to ensure they are correct as we will be unable to make changes once the order has been processed. You will have been notified at the point of order if an item is out of stock already with expected delivery date.
    Delivery Address [address redacted] [telephone number redacted]
    Delivery Method: Standard Delivery
    Your Order Information
    Prices include VAT at 20%
    Customer Service Feedback
    We are always working to improve the products and service we provide to our customers - we do this through a continual review of the product range, and ongoing training of our Customer Service Team. We continually strive to improve our levels of service and we welcome feedback from our customers regarding your buying experience and the product you receive...


    The data in the spam was identifiable as being a few -years- old. The intended victim does not appear on the haveibeenpwned.com database. My assumption is that this information has been harvested from an undisclosed data breach. I was not able to extract the final payload, however the infection path is as follows:
    http ://bebracelet .com/customerarea/notification-processing-G29804772-064.doc
    --> http ://customer.abudusolicitors .com/customerarea/notification-processing-G29804772-064.doc
    --> https ://customer.affiliate-labs .net/customerarea/notification-processing-G29804772-064.zip
    ... So we have hijacked legitimate domains with presumably a neutral or good reputation, and we have valid SPF records. This means that the spam will have decent deliverability. And then the spam itself addresses the victim by name and has personal details presumably stolen in a data breach. Could you trust yourself not to click-the-link?
    Recommended blocklist (email)
    188.214.88.0/24
    Recommended blocklist (web)
    5.152.199.228: https://www.virustotal.com/en/ip-add...8/information/
    185.130.207.37: https://www.virustotal.com/en/ip-add...7/information/ - Country code - ZZ
    185.141.165.204: https://www.virustotal.com/en/ip-add...4/information/ - Country code - ZZ "

    Last edited by AplusWebMaster; 2017-02-16 at 13:43.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #1149
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'Company Complaint' SPAM

    FYI...

    Fake 'Company Complaint' SPAM - delivers Trickbot
    - https://myonlinesecurity.co.uk/spoof...vers-trickbot/
    16 Feb 2017 - "An email with the subject of 'ID 8d6ba737-775e8bdc-f95f16f3-1b460259 – Company Complaint' pretending to come from Companies House <no-reply@ companieshousecomplaints .uk> with a malicious word doc attachment delivers Trickbot...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...-Complaint.png

    If you open the word doc you see a screen looking like this*. DO NOT enable macros or content or enable editing, you -will- be infected:
    * https://myonlinesecurity.co.uk/wp-co...e-document.png

    16 February 2017: 8d6ba737-775e8bdc-f95f16f3-1b460259.doc - Current Virus total detections 4/55*
    Payload Security**.. Neither shows the download but it looks like the download location for the trickbot payload is
    http ://www.sungkrorsang .com/hustonweare.png which is -not- an image file but a renamed .exe (VirusTotal 12/57***) (Payload Security[4])... As usual the domain sending these was registered by criminals today 16 February 2017 using Godaddy, with what are certain to be -fake- details:
    canonical name: companieshousecomplaints .uk
    addresses: 104.130.246.14
    23.253.233.18
    104.130.246.9 ..
    104.239.201.9

    ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/d...is/1487245555/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    *** https://www.virustotal.com/en/file/1...is/1487246635/

    4] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    78.47.139.102
    58.52.155.163
    217.29.220.255
    200.120.214.150
    77.222.42.240


    sungkrorsang .com: 61.19.252.134: https://www.virustotal.com/en/ip-add...4/information/
    > https://www.virustotal.com/en/url/47...bb92/analysis/

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #1150
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,477

    Thumbs down Fake 'Urgent Compliance', 'Western Union', 'Secure Bank Documents' SPAM

    FYI...

    Fake 'Urgent Compliance' SPAM - delivers java adwind
    - https://myonlinesecurity.co.uk/spoof...s-java-adwind/
    20 Feb 2017 - "... previously mentioned many of these HERE[1]... a slightly different subject and email content to previous ones. They can’t seem to decide if it should be Xpress money or Western Union, so they decided to have an email body with a Western Union Content but pretend to send from Xpress money. I am also getting some from Spoofed Western Union Addresses...
    1] https://myonlinesecurity.co.uk/?s=java+adwind
    ... The email looks like:
    From: elizabethst2 .mel@ xpressmoney .com
    Date: Mon 20/02/2017 00:47
    Subject: Urgent Compliance, Status of transfer
    Attachment: Details.zip
    Dear agent,
    Please kindly check the status of this transaction. The remitter
    demands for the payment record, because the beneficiary denied the
    payment that He didn’t receive this money.
    So Please kindly check this transaction if it was paid,please arrange us the
    receipt of transaction
    Regards,
    Senzo Dlamini
    Regional Ops Executive
    WesternUnion International ...


    20 February 2017: Urgent Compliance.jar - Current Virus total detections 6/58*
    Payload Security**.. The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/f...is/1487576150/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100
    ___

    Fake 'Western Union' SPAM - delivers java adwind
    - https://myonlinesecurity.co.uk/spoof...s-java-adwind/
    20 Feb 2017 - "... -fake- financial themed emails containing java adwind or Java Jacksbot attachments... previously mentioned many of these HERE[1]...
    1] https://myonlinesecurity.co.uk/?s=java+adwind
    ... the email contains a genuine PDF file with an-embedded-link that downloads the java Adwind zip. The zip contains -2- different sized and named java files. The link in the pdf goes to:
    http ://www.greavy .com/wp-includes/certificates/CERTIFICATE%20DETAILS%20AND%20WUPOS%20UPDATE%20MANUAL.zip
    which extracts to -2- java.jar files hoping that if one fails the second will get you. Although both are detected as Java Adwind on Virus Total, the Payload Security reports does show different behaviour for each file...
    New E-maual and updated payout procedures.jar (507kb) VirusTotal 6/58* | Payload Security**

    WU certificate and agent updated branch details..jar (333kb) VirusTotal 8/57*** | Payload Security[4]

    The email looks like:
    From: Western Union IT Dept. <wu.it-dept@ outlook .com>
    Date: Mon 20/02/2017 02:37
    Subject: WUPOS Agent Upgrade For All Branches.
    Attachment: Details.zip
    Dear All,
    Western Union ,IT Department data is posting upgrade for new version of WUPOS.Please download attachment by clicking the link.as seen below, run the file and go ahead of checking western union intermediate screen
    Before doing that please read directives in attachments then map the Western Union user ID in the Symex application and proceed. Please let me know if you face any issue.
    Thanks & Regards, IT Department Western Union...


    The pdf looks like:
    > https://myonlinesecurity.co.uk/wp-co...pos-update.png
    ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/7...is/1487577130/

    ** https://www.hybrid-analysis.com/samp...ironmentId=100

    *** https://www.virustotal.com/en/file/6...is/1487577144/

    4] https://www.hybrid-analysis.com/samp...ironmentId=100
    Contacted Hosts
    83.243.41.200

    greavy .com: 180.240.134.105: https://www.virustotal.com/en/ip-add...5/information/
    > https://www.virustotal.com/en/url/05...83b4/analysis/
    ___

    Fake 'Secure Bank Documents' SPAM - delivers Trickbot
    - https://myonlinesecurity.co.uk/spoof...anking-trojan/
    20 Feb 2017 - "... an email with the subject of 'Important – Secure Bank Documents'... pretending to come from Lloyds Bank <no-reply@ lloydsbanksecuredocs .com> delivers Trickbot banking Trojan...

    Screenshot: https://myonlinesecurity.co.uk/wp-co...-documents.png

    20 February 2017: BACs.doc - Current Virus total detections 7/55*
    I am informed about 2 known download locations for the Trickbot malware:
    www .sungkrorsang .com/hostelfrost.png and wp .pilbauer .com/wp-content/uploads/lordsofsteel.png
    There probably are many more. VirusTotal 11/57*... The sending email Address lloydsbanksecuredocs .com was registered by criminals -today- using Godaddy and Privacy protection. It is -not- a genuine Lloyds bank web site or web address.. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
    * https://www.virustotal.com/en/file/2...is/1487606754/

    ** https://www.virustotal.com/en/file/6...is/1487607471/

    lloydsbanksecuredocs .com: 45.55.36.38
    159.203.126.233
    159.203.117.63
    159.203.115.143
    159.203.170.214


    sungkrorsang .com: 61.19.252.134: https://www.virustotal.com/en/ip-add...4/information/
    > https://www.virustotal.com/en/url/27...4e02/analysis/

    pilbauer .com: 178.217.244.53: https://www.virustotal.com/en/ip-add...3/information/

    Last edited by AplusWebMaster; 2017-02-20 at 19:57.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •