Page 51 of 132 FirstFirst ... 4147484950515253545561101 ... LastLast
Results 501 to 510 of 1320

Thread: SPAM frauds, fakes, and other MALWARE deliveries...

  1. #501
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Google drive SPAM ...

    FYI...

    Fake Google drive SPAM - PDF malware
    - http://myonlinesecurity.co.uk/grady-...19-73-malware/
    13 Aug 2014 - "Grady Murphy shared Google Drive:3623019-73 to submit@ < your email address>.pretending to come from Grady Murphy < random name that matches the name inside the email> , Apps Team is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... There are several different versions of this email leading to different infection sites and links, The names of the alleged Google Drive owner who wants to share with you changes with each email. There is no attachment with this one and they want you to follow the link and download the file to infect you.
    Some of the sites are
    http ://energydep .net:8080/Gdrive/GDrive025384.exe
    http ://bilingdepp .net:8080/Gdrive/GDrive917302.exe
    Email looks like:
    Accept Grady Murphy Google Drive ID:3623019-73 request clicking on the link below:
    Confirm request
    Unfortunately, this email is an automated notification, which is unable to receive replies. We’re happy to help you with any questions or concerns you may have. Please contact us directly 24/7 via google .com/support/


    13 August 2014: GDrive925483.exe (40kb) Current Virus total detections: 6/54*
    This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/2...is/1407913490/

    178.238.236.109: https://www.virustotal.com/en/ip-add...9/information/
    ___

    Fake PurelyGadgets SPAM - Word doc malware
    - http://myonlinesecurity.co.uk/order-...lware-malware/
    13 Aug 2013 - "Order id 769019 | PurelyGadgets .com pretending to come from a sender named inform at a random email address is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This email arrives written in German language and has a zip attachment that when unzipped drops what appears to be a genuine Word Doc. BUT the Doc contains a macro that will infect you, if you use an out of date or older version of word. On previewing it, or opening it in Word 2013 ( which has macros disabled by default ) it tries to tell you to enable macros so that you can read the document. Do -not- ever -enable- macros for any Microsoft office file received by email unless you are 100% sure that you know the sender and are expecting the file... If you still use an older version of Microsoft Word, then you are at risk of being infected by this... Office 2010 and Office 2013 have macros -disabled- by default...

    13 August 2014: Bestellen.zip (100 kb) : Extracts to Bestellen.Doc
    Current Virus total detections: 10/54* . All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email... when unzipping them and make sure you have “show known file extensions enabled“, And then look carefully at the unzipped file. If it says .EXE then it is a problem and should -not- be run or opened..."
    * https://www.virustotal.com/en/file/3...is/1407936811/
    ___

    UK Land Registry Spam
    - http://threattrack.tumblr.com/post/9...-registry-spam
    Aug 13, 2014 - "Subjects Seen:
    Notification of direct debit of fees
    Typical e-mail details:
    Notification Number: 4682787
    Mandate Number: LND4682787
    ###THIS IS AN AUTO NOTIFICATION EMAIL. DO NOT REPLY TO THE SENDER OF THIS EMAIL. IF YOU HAVE A QUERY PLEASE REFER TO THE INFORMATION BELOW ###
    This is notification that Land Registry will debit 1527.00 GBP from your nominated account on or as soon as possible before 18/08/2014.
    Details of fees that we shall be collecting by direct debit for the applications charged are now available to view.
    You can access these by opening attached report.
    If you have an enquiry relating to your VDD account please contact Customer Support at customersupport@ landregistry .gsi .gov.uk or call on 0844 892 1111. For all enquiries, please quote your key number.
    Thank you,
    Land Registry


    Malicious File Name and MD5:
    LND_Report_13082014.exe (4E3480ADAF846BE2073246C9879290D2)
    LND_Report_4682787.zip (EAD6A8A2A9613175112E6C75D247B0BC)


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...hd01r6pupn.png

    Tagged: UK Land Registry, Upatre

    Last edited by AplusWebMaster; 2014-08-13 at 23:11.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #502
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Citicorp SPAM, ZeroLocker ...

    FYI...

    Fake Citicorp SPAM – PDF malware
    - http://myonlinesecurity.co.uk/citico...e-pdf-malware/
    14 Aug 2014 - "Citicorp Mail Out Report Attached pretending to come from CITICorp <random name @ citicorp .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email looks like:

    From Securitas, please do not reply to this e-mail as it is auto generated.
    For any problems please e-mail derry.andrews@ securitas .uk .com


    14 August 2014 Q100515078_Mail Out Report.zip (9kb): Extracts to Q100229861_Mail Out Report.exe
    Current Virus total detections: 3/54* . This Citicorp Mail Out Report Attached is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/0...is/1408010403/
    ___

    Fake Charity Trends SPAM ...
    - http://blog.mxlab.eu/2014/08/14/back...156230_08-xls/
    Aug 14, 2014 - "... intercepted a new trojan distribution campaign by email with the subject “Oder invoice 9156230_08.xls”. This email is send from the spoofed address and has the following body:

    Dear *******@*******.co.uk,
    Please find attached invoice #9156230_08 from 13/08/2014.
    Thanks!
    Reyes Mcdaniel .
    We’re happy to help you with any questions or concerns you may have. Please contact us directly 24/7 via hxxp ://www.charitytrends .org/ContactUs.aspx


    The attached ZIP file has the name 9156230_08.zip which contains the folder Inv_3145835_453_979154.xls. In this folder the 131 kB large file Inv_3145835_453_979154.xls.scr is found. Please note that the subject line and attachment file names may change with each message.
    The trojan is known as Backdoor.Bot.ED. At the time of writing, 1 of the 53 AV engines did detect the trojan at Virus Total*..."
    * https://www.virustotal.com/en/file/4...is/1408011038/

    - http://blog.mxlab.eu/2014/08/14/fake...ntains-trojan/
    Aug 14, 2014 - "... intercept a new trojan distribution campaign by email with the subject “Thank you for your generous donation! Charity Trends .”. This email is send from the spoofed address and has the following body:

    Charity Trends®
    Dear *******@*******.com,
    Thank you for your generous donation of 2623 GBP, which we received today.
    Your generosity will make an immediate difference in the lives of many people who need your help. The funds raised will go toward them.
    You will find all information about your donation in zip archive.You are making a difference!
    Thanks again for your kindness,
    Elsa Nash ...


    The attached ZIP file has the name DON_9683272_90.zip and contains the folder DON_4356984_08_14_14. Indside this folder, the 102 kB large file DON_4356_45984_08_14_14.scr will be found. Please note that the subject line and attachment file names may change with each message. The trojan is known as Trojan/Win32.Zbot, Win32:Malware-gen, HEUR/Malware.QVM20.Gen or Mal/Generic-S... 4/54 VirusTotal*..."
    * https://www.virustotal.com/en/file/3...is/1408011666/
    ___

    Fake Citibank SPAM - PDF malware
    - http://myonlinesecurity.co.uk/citiba...e-pdf-malware/
    14 Aug 2014 - "'Citibank RE: Account documents' have been uploaded pretending to come from Citibank <noreply@ citibank .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email looks like"
    citibank .com
    RE: Account Documents
    To: <REDACTED>
    Case: C4055427
    Your Documents have been uploaded to dropbox. In order to download / view Please click here to download / view .
    All web filed documents (with the exception of downloaded accounts templates) are available to view / download for 10 days after their original submission. Once accepted, these changes will be displayed on the public record...


    14 August 2014 Document-7119.zip ; Extracts to Document-7119.scr ;
    Current Virus total detections: 0/54* . This 'Citibank RE: Account documents have been uploaded' is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/1...is/1408029154/
    ___

    ZeroLocker
    - http://www.webroot.com/blog/2014/08/14/zero-locker/
    Aug 14, 2014 - "... we saw FireEye and Fox-IT provide the ability to decrypt files encrypted by older crpytolocker variants. They used the command and control servers seized by the FBI during operation Tovar. Since they have access to those RSA keys they essentially have the password required for every single file encrypted by a Cryptolocker variant that used Evgeniy Bogachev’s botnet. That is a major portion of the traditional​ red GUI cryptolocker that became famous... since the emergence of their tool to decrypt files for free, there has been a new encrypting ransomware going around that aims at scamming you into thinking this is a similar helpful tool – except that it demands something all -scams- do - payment:
    > https://www.webroot.com/blog/wp-cont...8/blograrw.bmp
    This newest edition to the ever popular business model that is encrypting ransomware doesn’t really have many improvements over the others we’ve already seen. Using -Bitcoin- for payment is standard now. This variant doesn’t show the GUI untill all encryption is completed and the computer is suddenly restarted. Upon restart this window is presented and threatens that you will lose all your files if you close or remove it. The payment structure is right where industry average is – PAINFUL. This specific variant we analyzed does not delete the VSS (Volume Shadow Service) and you can get all your files back by using programs like Shadow Explorer... expect issues like this to be fixed once this malware is adopted by more botnets for widespread distribution... remember that with encrypting ransomware the best protection is going to be a good backup solution. This can be either through the cloud or offline external storage. Keeping it up to date is key so as not to lose productivity..."
    ___

    Suspicious login message Faked, distributes Backdoor
    - http://blog.trendmicro.com/trendlabs...utes-backdoor/
    Aug 14, 2014 - "Legitimate services are often used by cybercriminals to try and make their attacks more convincing. Recently, I spotted attacks that used services and platforms like Google Drive and Dropbox in order to look less suspicious to unwary users. I received a spammed message like the one shown right below that supposedly came from Gmail itself. It warned me that someone logged into my account from an unknown device. However, all of the links in it pointed to a Google Drive URL:
    Sample spam email:
    > http://blog.trendmicro.com/trendlabs.../08/login3.png
    Even though the email message is -similar- to a legitimate Gmail message, a careful user will note that the displayed e-mail address and the supposed source address did -not- match. Further examination of the email’s headers indicates that the email was, in fact, sent via a website’s mail form... all the links provided in the email actually go to an HTML file hosted on Google Drive. This HTML file is used to detect the operating system and browser of the user... Further code also differentiates what payloads are delivered based on the user’s browser. This is what the user would see (here, running Firefox):
    Fake plugin download page:
    > http://blog.trendmicro.com/trendlabs.../08/login2.png
    ... while the HTML code can differentiate between different configurations, a relatively limited number of payloads are actually delivered. These are detected as BKDR_PERCS.A. This -backdoor- steals email credentials and user names and passwords. It also logs -keystrokes- as part of its information theft routines. As a backdoor, it can also accept remote commands from the attackers... The actual malicious payloads are hosted on Google Drive as well. The attackers upload new files to be used in this attack on a fairly regular basis, although the behavior remains the same... As these files are located on legitimate services, they are also sent via HTTPS, which helps evade some web filtering techniques. In addition, it used a -compromised- website’s mailer system and an IPv6 address, which can also evade email reputation services..."
    (More detail at the trendmicro URL at the top.)
    ___

    Beware of Risky Ads on Tumblr
    - https://blog.malwarebytes.org/malver...ads-on-tumblr/
    Aug 14, 2014 - "Online users have come to rely on social media and social networking sites to also update them on current events and commentaries, general news, and what’s happening just down the street and around the corner. Twitter and Facebook are the first go-to sites for most when it comes to real-time news updates. For some, Tumblr.

    dailynewsz[dot]tumblr[dot]com

    We found the above site posting what appears as news clips but not on a daily basis, as indicated in the URL, unfortunately. According to Google Translate, the site uses both Swahili and Urdu. This site serves ads on its default page and on individual posts. So every time someone shares one, the ads are shared with it. Below is a screenshot of a post:
    > https://blog.malwarebytes.org/wp-con...newsz-post.png
    Online advertisement is a major source of revenue. Unfortunately, normal ads can easily become malvertisements, serving as a go-between for users and sites hosting -malicious- software. For this particular Tumblr page, it uses the ad network Yllix Media. Google Safe Browsing profiled its official website here*. Other third-party sites either blacklist** the domain or flag it as untrustworthy*** due to its history of leading users to infected sites. As of this writing, the ads are benign, but we may never know several months from now if this will still be the case... we encourage you to use ad blockers, such as AdBlock Plus (ABP) or NoScript (for Mozilla-based browsers only), if you don’t want ads to appear on sites you visit..."
    * https://safebrowsing.clients.google....ite=yllix.com/

    ** http://labs.sucuri.net/?blacklist=yllix.com

    *** https://www.mywot.com/en/scorecard/yllix.com

    Last edited by AplusWebMaster; 2014-08-15 at 00:53.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #503
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Barclays, VOIP SPAM ...

    FYI...

    Fake Barclays SPAM - Trojan.Ransom.ED
    - http://blog.mxlab.eu/2014/08/15/fake...jan-ransom-ed/
    Aug 15, 2014 - "... intercepted a new trojan distribution campaign by email with the subject “Your transaction is completed”. This email is send from the spoofed address “Barclays.NET” <support@ barclays .net>” and has the following body:
    Transaction is completed. 8678 GBP has been successfully transfered.
    If the transaction was made by mistake please contact our customer service.
    Payment receipt is attached.
    *** This is an automatically generated email, please do not reply ***
    Barclays.Net 2013 Corporation. All rights reserved.


    The attached ZIP file has the name Payment receipt 1534465.zip and contains the 70 kB large file Payment receipt 8821991.exe (note: file name may vary with each email). The trojan is known as Trojan.Ransom.ED or Mal/Generic-S. At the time of writing, 2 of the 54 engines did detect the trojan at Virus Total*..."
    * https://www.virustotal.com/en/file/b...is/1408097500/
    ___

    Fake VOIP SPAM - Word macro script
    - http://blog.mxlab.eu/2014/08/15/fake...-macro-script/
    Aug 15, 2014 - "... intercepted a campaign by email with the subject “Your Order No 355253536 | Mob Inc.” which includes a malicious Word document that allows the installation of a trojan downloader using the macro functionality from Word. This email is send from the spoofed addresses and has the following body:
    Thank you for ordering from VOIP Inc.
    This message is to inform you that your order has been received and is currently being processed.
    Your order reference is 488910845598.
    You will need this in all correspondence.
    This receipt is NOT proof of purchase.
    We will send a printed invoice by mail to your billing address.
    You have chosen to pay by credit card. Your card will be charged for the amount
    of 805.74 USD and “VOIP Inc.”
    will appear next to the charge on your statement.
    Your purchase information appears below in the file.


    The attached ZIP file has the name Order.zip and contains the 41 kB large file Order.Doc. The Order.Doc is a genuine Word document but the file contains a malicious macro feature. Once opening the Word document, instructions are given on how to enable the content and activate the -malicious- macro script... The downloader is known as W97M/Downloader, MO97:Downloader-DU, VBA/TrojanDownloader.Agent.AL, Trojan-Downloader:W32/Agent.DVCR, Trojan-Downloader.VBA.Agent or Trojan.Mdropper. At the time of writing, 8 of the 53 AV engines did detect the trojan downloader at Virus Total*..."
    * https://www.virustotal.com/en/file/a...is/1408099896/

    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #504
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Companies House, Scotiabank SPAM ...

    FYI...

    Fake Companies House Spam
    - http://threattrack.tumblr.com/post/9...al-return-spam
    Aug 19, 2014 - "Subjects Seen:
    (AR01) Annual Return received
    Typical e-mail details:
    Thank you for completing a submission Reference # (9586474).
    (AR01) Annual Return
    Your unique submission number is 9586474
    Please quote this number in any communications with Companies House.
    Check attachment to confirm acceptance or rejection of this filing.


    Malicious File Name and MD5:
    AR01_021434.scr (3324B40B5D213BEC291F9F86F0D80F64)
    AR01_021434.zip (7D65D78B6E35843B6FF3C4C46BAAC37A)


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...ubX1r6pupn.png

    Tagged: Companies House, Upatre
    ___

    JPMorgan Chase Secure Message Spam
    - http://threattrack.tumblr.com/post/9...e-message-spam
    Aug 19, 2014 - "Subjects Seen:
    Daily Report - August 19, 2014
    Typical e-mail details:
    This is a secure, encrypted message.
    Desktop Users:
    Open the attachment (message_zdm.html) and follow the instructions.
    Mobile Users:
    Voltage secure mail is not currently supported on mobile devices. If you experience issues, please access your secure message from a fully functional browser.


    Malicious URLs:
    192.241.124.71 /securemail/jpmchase.com/formpostdir/Java/Java_update.exe

    Malicious File Name and MD5:
    message_zdm.html (550CB01F07DB2363437C8627697C6B1F)
    Java_update.exe (38d75db0a575891506b1ff0484a03cd0)


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...VOT1r6pupn.png

    192.241.124.71: https://www.virustotal.com/en/ip-add...1/information/

    Tagged: JPMorgan, Chase, Dyreza
    ___

    - http://myonlinesecurity.co.uk/jpmorg...-2014-malware/
    Aug 19 2014 - "'JPMorgan Chase & Co Daily Report – August 19, 2014' pretending to come from various names at @ jpmorgan .com is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... email looks like:

    Screenshot: http://myonlinesecurity.co.uk/wp-con...st-19-2014.png

    ... the html attachment that comes with the email l0oks like the below and clicking the link hidden behind the Click to read message button leads to a fake Java_update.exe
    > http://myonlinesecurity.co.uk/wp-con...-19-2014_2.png
    Todays Date: Java_update.exe .. Current Virus total detections: 5/53*
    All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email... careful when unzipping them and make sure you have “show known file extensions enabled“, And then look carefully at the unzipped file. If it says .EXE then it is a problem and should -not- be run or opened..."
    * https://www.virustotal.com/en/file/0...2a96/analysis/
    ___

    Fake Evernote extension serves Ads
    - https://blog.malwarebytes.org/intell...dvertisements/
    Aug 19, 2014 - "... a Multiplug PUP that installs a -fake- Evernote browser extension. Fellow researchers can find the link to this sample on VirusTotal here*...
    > https://blog.malwarebytes.org/wp-con.../cert_info.png
    When you execute the PUP, it silently installs a web extension for the Google Chrome, Torch, and Comodo Dragon browsers. The extension takes the form of three obfuscated JavaScript files and one HTML file. The picture shows these files installed in Chrome’s extension directory on a Windows 7 PC.
    > https://blog.malwarebytes.org/wp-con..._ext_files.png
    ... The extension that’s installed is called “Evernote Web,” just like the real extension from Evernote.com. When taking a look at the Chrome extensions page, we can see the extension installed there with the ID “lbfehkoinhhcknnbdgnnmjhiladcgbol,” just like the real Evernote Web extension.
    > https://blog.malwarebytes.org/wp-con...8/evernote.png
    Clicking “Visit website” directs the user to the chrome webstore page for the actual Evernote Web extension. Chrome believes the real extension is installed, as verified by the Launch App button. When clicking this button with the fake extension installed, nothing happens, whereas normally the user is met with an Evernote log in screen.
    > https://blog.malwarebytes.org/wp-con...rome_store.png
    On the surface, it may seem like the pop ups and advertisements are coming from the websites themselves, but are in fact from the fake Evernote web extension.
    Fortunately, removing the extension is a simple task. For Chrome users, simply visit the extensions page and click the picture of a garbage can, and you’re done. You also might want to run a free scan using your Antivirus or Anti-malware programs (like Malwarebytes Anti-Malware) to make sure there wasn’t anything -else- added while you had the extension."
    * https://www.virustotal.com/en/file/6...fbf4/analysis/
    ___

    Fake Scotiabank SPAM – PDF malware
    - http://myonlinesecurity.co.uk/scotia...e-pdf-malware/
    18 Aug 2014 - "Scotiabank New Instructions for International and local transfers pretending to come from Mallerlyn Bido <mallerlyn.bido@ scotiabank .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
    Dear Clients
    Hereby we inform you that starting next Tuesday, August 19 all instructions of local and international transfers that are sent to our institution must be completed by a transfer form specifically allocated for the purpose, which will be replacing the letter instruction tend to complete.
    This new document has been implemented to meet international requirements and simultaneously control to make their operations safer.
    We take this opportunity to inform you that the operations of International Transfers can be made ​​via our internet platform banking the need to complete these types of forms.
    Annex find the forms that apply to transfers in USD and EUR as well as the form used for ACH transfers manuals with some notes to use as a guide to complete. These templates can be saved for you with your details for future use.(See attached file: Outgoing Global.doc Form) (See attached file: Outgoing JPM.doc Form) (See attached file: Form ACH..doc) ...
    Best regards,
    Mallerlyn Bido | Gerente Soporte al Cliente | BSC ...


    18 August 2014: New Instructions for International and Local transfers.zip ( 8kb) :
    Extracts to New Instructions for International and Local transfers.exe
    Current Virus total detections: 3/52* . This Scotiabank New Instructions for International and local transfers is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/2...is/1408393889/

    Last edited by AplusWebMaster; 2014-08-20 at 02:49.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #505
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Cryptolocker on YouTube, Fake Order SPAM ...

    FYI...

    Cryptolocker flogged on YouTube
    - http://www.theregister.co.uk/2014/08...ed_on_youtube/
    20 Aug 2014 - "Cryptolocker is being flogged over YouTube by vxers who have bought advertising space... researchers made the discovery while monitoring YouTube and website banners for instances where malware writers had actually purchased space to foist their wares on -unpatched- web users. The duo who will present at the upcoming Virus Bulletin 2014 conference in Seattle wrote in a paper advertisement networks was a viable way to flog virus and trojans. "We conclude that ad networks could be leveraged to aid, or even be substituted for current exploit kits," they said. Purchased ad space was a cheap and effective means of foisting browser malware allowing attackers to filter victims by language, location, and interests, VB reported. Malware contained in ads could be obfuscated and then unleashed once conditions like operating systems, browser versions and other elements were met.
    > http://regmedia.co.uk/2014/08/19/tghfgh55.png
    CryptoLocker surfaced in September distributed through Gameover ZeuS. It encrypted important files such as images and documents on compromised Windows machines before demanding that victim pay up to $500 in BitCoins within 72 hours for the private keys necessary to unlock files. CryptoLocker used AES symmetric cryptography to encrypt the files and encrypted the AES key with an RSA-2048 bit public key generated on its server side. It came as -malvertisers- were caught flinging malware over Yahoo! ad networks*...
    > http://regmedia.co.uk/2014/08/19/fghji87y6t.png
    ... Many excess ad spaces were flogged through affiliates which may accept advertisements without checking the authenticity of the buyer nor the code to be run. Even those that do could end up foisting malware if they failed to detect an attackers' code alterations made after the purchase in order to quietly slip in the malware. The research pair said there was very little advertising networks could do to prevent the attacks."
    * http://www.theregister.co.uk/2014/08...oo_ad_network/

    > https://www.virusbtn.com/conference/...tovNavaraj.xml
    ___

    Fake Order SPAM – PDF malware
    - http://myonlinesecurity.co.uk/order-pdf-malware/
    20 Aug 2014 - "'Order – PDF' which comes as an email with a subject of order-6539-8.20.2014.pdf ( where the number is random & the date changes daily is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... These emails have no body content and just a subject of order-6539-8.20.2014.pdf ( the number is random ) They appear to come from a load of common first names with weird characters form the second part of the alleged senders... previous post about this type of attack:
    - http://myonlinesecurity.co.uk/infect...hments-emails/
    Today’s version although it pretends to be a PDF file is actually a zip file that probably either use some unknown exploit to extract it or the bad actors sending today’s malware have misconfigured the botnet sending it and it won’t automatically extract at all so users will be safe...
    20 August 2014: order-6539-8.20.2014.pdf (84 kb) Extracts to order 8.20.2014.exe
    Current Virus total detections for pdf is : 2/50* . Current Virus total detections for the extracted .exe : 2/53** . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/f...is/1408523288/

    ** https://www.virustotal.com/en/file/3...is/1408523722/
    ___

    'Reveton' ransomware adds powerful password stealer
    - https://www.computerworld.com/s/arti...ssword_stealer
    Aug 20, 2014 - ""A type of malware called Reveton, which -falsely- warns users they've broken the law and demands payment of a fine, has been -upgraded- with powerful password stealing functions, according to Avast*. Reveton is in a class of nasty programs known as "ransomware," which includes the notorious Cryptolocker program that encrypts a computer's files. The FBI issued a warning about Reveton in August 2012 after its Internet Crime Complaint Center was flooded with complaints. The malware often infects computers via drive-by download when a person visits a website rigged to automatically exploit software vulnerabilities. Users are helpless after the computer is locked, with Reveton demanding a few hundred dollars as ransom payable various web-money services... The version of Reveton analyzed by Avast also has another password stealer from the Papras family of malware. It's not as effective as Pony but can disable security programs, the company wrote on its blog*. This particular sample of Reveton was pre-programmed to search a web browser's history and cookies to see if the user had visited online sites of 17 German banks... Around February 2013, an ethnic Russian man was arrested in Dubai upon request of Spanish police for allegedly coordinating Reveton campaigns, netting... US$1.3 million. Ten other people were also arrested on money laundering charges for allegedly laundering the proceeds and transferring funds to Russia, according to Trend Micro**."
    * http://blog.avast.com/2014/08/19/rev...ously-evolved/

    ** http://blog.trendmicro.com/trendlabs...vity-nabbed-2/
    ___

    Linux Trojan makes the jump to Windows
    - http://www.theinquirer.net/inquirer/...ump-to-windows
    Aug 20 2014 - "... the original malware known as "Linux.Dnsamp" is a Distributed Denial of Service (DDoS) Trojan, which, according to the company blog*, transfers between Linux machines, altering the startup scripts, collecting and sending machine configuration data to the hackers' server and then running silently waiting for orders. Now it appears that the same hackers have ported the Trojan to run in Windows as "Trojan.Dnsamp.1"**. The Windows version gains entry to the system under the guise of a Windows Service Test called "My Test 1". It is then saved in the system folder of the infected machine under the name "vmware-vmx.exe". When triggered, just like its Linux counterpart, the Trojan sends system information back to the hackers' central server and then awaits the signal to start a DDoS attack or start downloading other malicious programs... Although the threat of malware is an everyday hazard to most computer users, to find an attack on Linux is much rarer, and to find any kind of malware that has been ported from one operating system to another is almost unheard of... Project Shield***, an initative designed to help smaller web servers fight off DDoS attacks."
    * http://news.drweb.com/show/?i=5760&c=23&lng=en&p=1

    ** http://news.drweb.com/show/?i=5903&lng=en&c=14

    *** https://projectshield.withgoogle.com/en/

    Last edited by AplusWebMaster; 2014-08-20 at 22:29.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #506
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Tech Support SCAMS online...

    FYI...

    Tech Support SCAMS rip big brand security software with fake warnings
    - https://blog.malwarebytes.org/fraud-...fake-warnings/
    Aug 21 2014 - "... bogus tech support. If you are looking to download one of the popular antivirus or anti-malware product on the market, watch out before you click.
    > https://blog.malwarebytes.org/wp-con...Vs-965x395.png
    Lookalike pages: Fraudsters have set up -fake- download pages that look incredibly like the authentic ones... Hijacked software: Each page links to a download, which of course is -not- the actual software...
    > https://blog.malwarebytes.org/wp-con...7/software.png
    The purpose of these fake programs is to trick people into thinking something is wrong with their computers:
    > https://blog.malwarebytes.org/wp-con...4/07/error.png
    The fake pages are hosted here:
    hzzzp ://onlineinstanthelp .com/antivirus-download.html
    hzzzp ://onlineinstanthelp .com/norton-us/download.html
    hzzzp ://onlineinstanthelp .com/mcafee-us/download.html
    hzzzp ://onlineinstanthelp .com/avg-us/download.html
    hzzzp ://onlineinstanthelp .com/malwarebytes-us/download.html
    hzzzp ://onlineinstanthelp .com/winzip-us/download.html
    hzzzp ://onlineinstanthelp .com/lavasoft-us/download.html
    The company providing ‘support’ is: wefixbrowsers .com ... We are reporting the sites to the registrar and passing on the LogMeIn codes so that interested parties can take appropriate actions. To avoid these -fake- installers, users should always go to the company’s official website..."
    (More detail at the malwarebytes URL at the top.)

    wefixbrowsers .com / 23.91.123.204: https://www.virustotal.com/en/ip-add...4/information/

    onlineinstanthelp .com / 118.139.186.35: https://www.virustotal.com/en/ip-add...5/information/
    ___

    Fake HMRC SPAM - malware
    - http://myonlinesecurity.co.uk/helpin...onile-malware/
    21 Aug 2014 - "'Helping your Business onile' pretending to come from 'HMRC Business Help and Education Emails' is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email looks like:

    Screenshot: http://myonlinesecurity.co.uk/wp-con...ness-onile.png

    21 August 2014 Credit_file_961529461.zip ( 50 kb)... Current Virus total detections: 1/51*
    ... targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day. Be very careful when unzipping them and make sure you have “show known file extensions enabled“, And then look carefully at the unzipped file. If it says .EXE then it is a problem and should -not- be run or opened..."
    * https://www.virustotal.com/en/file/0...is/1408620337/
    ___

    Fake Credit reference SPAM - word Doc malware
    - http://myonlinesecurity.co.uk/re-cre...d-doc-malware/
    21 Aug 2014 - "'RE: Credit reference file request.(108278994)' is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
    Dear <REDACTED>
    You have obtain a copy of your credit reference file.
    We’re happy to help you with any questions or concerns you may have. Please contact us directly 24/7 .
    Lynn Buck.


    21 August 2014: Credit_file_108278994.zip (52 kb): Extracts to Credit reference file.doc.scr
    Current Virus total detections: 2/52*
    21 August 2014: Credit_file_642094175.zip (85kb): Extracts to credit_reference_file.xls.scr
    Current Virus total detections: 2/52*
    This 'RE: Credit reference file request.(108278994)' is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper word file instead of the .scr executable file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/4...is/1408613742/
    ___

    JPMorgan customers targeted in phishing campaign
    - http://www.reuters.com/article/2014/...0GL20R20140821
    Aug 21, 2014 - "Fraudsters are targeting JPMorgan Chase & Co customers in an email "phishing" campaign that is unusual because it attempts to collect credentials for that bank and also infect PCs with a virus for stealing passwords from -other- institutions. The campaign, dubbed "Smash and Grab," was launched on Tuesday with a widely distributed email that urged recipients to click to view a secure message from JPMorgan, according to security researchers with corporate email provider Proofpoint Inc. JPMorgan, the No. 1 U.S. bank by assets, confirmed that spammers had launched a phishing campaign targeting its customers... the bank believes most of the spam was stopped by fraud filters at large Internet providers, adding that the email looked realistic because the attackers apparently used a screen grab from an authentic email sent by the bank. Users who click on a malicious link are asked to enter credentials for accessing accounts with JPMorgan. Even if they did not comply, the site attempted to automatically install the Dyre banking Trojan* on their PCs, according to Proofpoint. Dyre is a recently discovered piece of malware that seeks credentials from customers of Bank of America Corp, Citigroup Inc and the Royal Bank of Scotland Group PLC, according to email security firm Phishme."
    * http://blog.malcovery.com/blog/dyre-...u-need-to-know

    > https://www.brainyquote.com/quotes/q...nfr122731.html
    "Distrust and caution are the parents of security" - Ben Franklin

    Last edited by AplusWebMaster; 2014-08-21 at 23:29.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #507
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down WordPress attacks, Fake ADP SPAM ...

    FYI...

    WordPress attacks exploiting XMLRPC
    - http://myonlinesecurity.co.uk/ongoin...oiting-xmlrpc/
    Aug 22, 2014 - "We are experiencing Ongoing WordPress attacks exploiting XMLRPC. There appears to be a massive attack on WordPress sites today. So far I have had almost -1600- blocked attacks against ONE of my WordPress sites... Anybody using WordPress should make sure that they are plugged and use a good security system to prevent or -block- these attacks. It appears to be using the attack mentioned in this post:
    > http://blog.sucuri.net/2014/07/new-b...wordpress.html
    ... -None- of the current wordpress security plugins will -block- this and you need to make sure that you have a strong random password on your admin account. The -only- way to block them is on the perimeter, that is use a firewall that blocks the offending IP numbers that are responsible for the attacks. They are all coming from other compromised servers or hacked users computers..."
    (More detail at the URL's above.)
    ___

    Fake ADP 'Anti-Fraud Secure Update' SPAM – PDF malware
    - http://myonlinesecurity.co.uk/adp-au...e-pdf-malware/
    22 Aug 2014 - "'ADP: August 22, 2014 Anti-Fraud Secure Update' pretending to come from ADP_Netsecure@ adp .com is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email looks like:
    Dear Valued ADP Client,
    We are pleased to announce that ADP Payroll System released secure upgrades to your computer.
    A new version of secure update is available.
    Our development division strongly recommends you to download this software update.
    It contains new features:
    The certificate will be attached to the computer of the account holder, which disables any fraud activity
    Any irregular activity on your account is detected by our safety centre
    Download the attachment. Update will be automatically installed by double click.
    We value our partnership with you and take pride in the confidence that you place in us to process payroll on your behalf. As always, your ADP Service Team is happy to assist with any questions you may have...


    22 August 2014 : 2014 Anti-Fraud Secure Update_08222014.zip (9kb)
    Extracts to 2014 Anti-Fraud Secure Update_08222014.exe
    Current Virus total detections: 3/54* . This 'ADP: August 22, 2014 Anti-Fraud Secure Update' is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/8...is/1408710186/

    - http://threattrack.tumblr.com/post/9...ud-update-spam
    22 Aug 2014 - "Subjects Seen:
    ADP: August 22, 2014 Anti-Fraud Secure Update
    Typical e-mail details:

    Screenshot: https://gs1.wac.edgecastcdn.net/8019...a8i1r6pupn.png

    Malicious File Name and MD5:
    2014 Anti-Fraud Secure Update_08222014.scr (840B3B6A714F7330706F0C19F99D5EB8)
    2014 Anti-Fraud Secure Update_08222014.zip (AB0D93E0952BDCE45D6E6494DF4D94AD)


    Tagged: ADP, Upatre
    ___

    "FlashPack" - add-on targets Japanese users, leads To exploit kit
    - http://blog.trendmicro.com/trendlabs...o-exploit-kit/
    Aug 21, 2014 - "... In order to affect users, this particular exploit kit does -not- rely on spammed messages or compromised websites: instead, it uses a compromised website add-on. This particular add-on is used by site owners who want to add social media sharing buttons on their sites. All the site owner would have to do is add several lines of JavaScript code to their site’s design template. This code is freely available from the website of the add-on. The added script adds an overlay like this to the site’s pages:
    Added share buttons:
    > http://blog.trendmicro.com/trendlabs...08/toolbar.png
    To do this, a JavaScript file on the home page of the add-on is loaded. This alone should raise red flags: it means that the site owner is loading scripts from an external server -not- under their control. It’s one thing if it loads scripts on trusted sites like Google, Facebook, or other well-known names; it’s another thing to load scripts on little-known servers with no name to protect. As it turns out, this script is being used for malicious purposes. On certain sites, instead of the original add-on script, the user is redirected to the script of FlashPack... loading the s.js file directly will simply load the “correct” script for the add-on. One site which, if found in the Referer header, will trigger the exploit kit is a well-known free blogging site in Japan. The exploit kit delivers various Flash -exploits- to -targeted- users... At least approximately 58,000 users have been affected by this attack, with more than 87% of these coming from Japan. The landing pages of the exploit kit are hosted in servers in the Czech Republic, the Netherlands, and Russia.
    Number of hits by country from August 1 to 17
    > http://blog.trendmicro.com/trendlabs...Country-01.jpg
    How can users and site owners prevent these attacks? Site owners should be very cautious about adding add-ons to their site that rely on externally hosted scripts. As shown in this attack, they are trivial to use in malicious activities. In addition, they can slow the site down as well. Alternatives that host the script on the same server as the site itself are preferable. This incident illustrates for end users the importance of keeping-software-patched. The vulnerability we mentioned above has been fixed for half-a-year. Various auto-update mechanisms exist which can keep Flash up-to-date..."

    Last edited by AplusWebMaster; 2014-08-22 at 22:08.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #508
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down My Photos SPAM - malware...

    FYI...

    My Photos SPAM - malware
    - http://myonlinesecurity.co.uk/photos-malware/
    23 Aug 2014 - "'My Photos' is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Very simple email with content just saying 'Please find attached photos of my birthday party.' This one is particularly nasty and dangerous because it doesn’t give any outward signs of infection. It downloads an auto-configure script from http ://construtoralondres.zip .net/JScript32.log which then attempts to send all traffic through a proxy server http ://supermercadorleves.ddns .net which then filters out UK banking traffic to another proxy where they can steal all your banking log on and account information. Each UK bank is sent to a -different- proxy where the sites are set up to intercept traffic to the genuine UK bank site. That way, you think that you are on the genuine UK bank site and you actually are, but the proxy between you and the bank can read -everything- you type or do on the bank site. You have absolutely no idea that this is happening & you still get a padlock in the address bar to say that you are on a safe site.

    23 August 2014: My Photos.zip ( 8kb): Extracts to My Photos.exe
    Current Virus total detections: 10/50* . All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day. Be very careful when unzipping them and make sure you have “show known file extensions enabled“, and then look carefully at the unzipped file. If it says .EXE then it is a problem and should -not- be run or opened."
    * https://www.virustotal.com/en/file/8...is/1408799346/

    zip .net / 200.147.99.195: https://www.virustotal.com/en/ip-add...5/information/
    - http://quttera.com/detailed_report/zip.net
    Submission date: Aug 24 16:53:51 2014
    Server IP address: 200.147.99.195
    "Warning: This Website Is Blacklisted!..."

    ddns .net / 8.23.224.108: https://www.virustotal.com/en/ip-add...8/information/
    - http://quttera.com/detailed_report/ddns.net
    Submission date: Aug 24 16:46:40 2014
    Server IP address: 8.23.224.108
    "Alert: Suspicious Content Detected On This Website!..."
    ___

    Sony PlayStation Network taken down by attack
    - http://www.reuters.com/article/2014/...0GP02620140825
    Aug 24, 2014 - "Sony Corp said on Sunday its PlayStation Network was taken down by a denial of service-style attack and the FBI was investigating the diversion of a flight carrying a top Sony executive amid reports of a claim that explosives were on board. The company said in a posting on its PlayStation blog that no personal information of the network was accessed in the attack, which overwhelmed the system with heavy traffic..."

    - http://www.reuters.com/article/2014/...0GP02620140825
    Aug 25, 2014 - "Sony Corp's PlayStation Network was back online on Monday following a cyber attack that took it down over the weekend, which coincided with a bomb scare on a commercial flight carrying a top Sony executive in the United States. Sony said on its PlayStation blog that its PlayStation network had been taken down by a denial of service-style attack, which overwhelmed the system with traffic, but did not intrude onto the network or access any of its 53 million users' information..."

    Last edited by AplusWebMaster; 2014-08-25 at 14:14.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #509
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Invoice, Fax SPAM ...

    FYI...

    Fake Invoice SPAM - PDF Malware
    - http://myonlinesecurity.co.uk/please...e-pdf-malware/
    25 Aug 2014 - "'Please find attached Invoice No.' < random number> pretending to come from portadown.372@eel .co.uk is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... These emails are -not- being sent from eel .co.uk or edmundson-electrical .co.uk, As far as we can determine they have not been hacked or their website or email system compromised. The bad guys have just decided to use Edmundson Electrical Ltd as a way to persuade you to open the attachment and become infected. It is a follow on campaign from this Broadoak toiletries attack:
    > http://myonlinesecurity.co.uk/invoic...e-pdf-malware/
    Once again this email template has several different sized malwares attached to it and it appears random which version you get... Email looks like:
    WALSALL
    MAHON RD IND EST. PORTADOWN
    CO. ARMAGH BT62 3EH
    T:028 3833 5316
    F:028 3833 8453
    Please find attached Invoice No. 3036 – 8340637
    Best
    Branch Manager
    Registered Office: PO Box 1 Knutsford Cheshire WA16 6AY ...


    25 August 2014: 3036 – 8340637.zip (44kb): Extracts to Invoice 372 – 667911.exe
    Current Virus total detections: 2/55*
    25 August 2014: 0463 – 485325.zip (47kb): Extracts to Invoice 829 – 991882.exe
    Current Virus total detections: 2/51**
    This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/e...is/1408955315/

    ** https://www.virustotal.com/en/file/c...is/1408955404/
    ___

    Fake Fax SPAM - pdf malware
    - http://myonlinesecurity.co.uk/fax-ar...e-pdf-malware/
    25 Aug 2014 - "'A fax has arrived from remote ID ’866-905-0884' pretnding to come from RFaxSMTP MTGm <RIGHTFAX@ mtgmfaxmail .bankofamerica .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email looks like:
    A fax has arrived from remote ID ’866-905-0884′.
    ————————————————————
    Transmission Record
    Received from remote ID: ’866-905-0884′
    Inbound user ID derek, routing code 669164574
    Result: (0/352;0/0) Successful Send
    Page record: 1 – 2
    Elapsed time: 00:39 on channel 34 ...


    25 August 2014: Fax_Remote_ID.zip ( 13kb) : Extracts to Fax_Remote_ID.scr
    Current Virus total detections: 0/55* . This 'A fax has arrived from remote ID 866-905-0884' is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/3...is/1408971894/
    ___

    Bank of America Activity Alert Spam
    - http://threattrack.tumblr.com/post/9...ity-alert-spam
    Aug 25, 2014 - "Subjects Seen:
    Bank of America Alert: A Check Exceeded Your Requested Alert Limit
    Typical e-mail details:
    Activity Alert
    A check exceeded your requested alert limit
    We’re letting you know a check written from your account went over the limit you set for this alert.
    For more details please check attached file


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...u861r6pupn.png

    Malicious File Name and MD5:
    report08252014_6897454147412.vcr (7ED898AA2A8B247F7C7A46D71B125EA8)
    report08252014_6897454147412.zip (FF4C74D80D3C7125962D7316F570A7FF)


    Tagged: Bank of America, Upatre
    ___

    Facebook Work From Home SCAM
    - http://www.hoax-slayer.com/facebook-...ram-scam.shtml
    Aug 25, 2014 - "Message claims that Facebook has launched a new 'Work From Home' program that will allow users to make money from the comfort of their own homes... The message is a scam. Facebook has not launched such a program and has no connection to the scheme. The link in the message takes you to a fake Facebook Page that tries to trick you into paying four dollars for a dodgy 'Facebook Millionaire' kit. Fine print on the signup form indicates that your credit card will be charged $94 per month for continued access. Do -not- be tempted to participate in this -bogus- program.
    > http://www.hoax-slayer.com/images/fa...ram-scam-1.jpg
    ... It claims that people can potentially make thousands of dollars per month but warns that only a limited number of 'positions' are available... If this message comes your way, do -not- click any links it contains..."
    ___

    Fake ADP SPAM - PDF malware
    - http://myonlinesecurity.co.uk/adp-in...e-pdf-malware/
    25 Aug 2014 - "'ADP Invoice for week ending 08/22/2014 Invoice: 447589545' pretending to come from Billing.Address.Updates@ ADP .com is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
    Your most recent ADP invoice is attached for your review. If you have any questions regarding this invoice, please contact your ADP service team at the number or e-mail address provided on the invoice for assistance.
    Thank you for choosing ADP for your business solutions.
    Important: Please do not respond to this message. It is generated from an unattended mailbox.


    25 August 2014: invoice_447589545.zip (10kb): Extracts top invoice_447589545.exe
    Current Virus total detections: 2/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
    * https://www.virustotal.com/en/file/5...is/1408992097/
    ___

    BoA Merrill Lynch CashPro Spam
    - http://threattrack.tumblr.com/post/9...h-cashpro-spam
    Aug 25, 2014 - "Subjects Seen:
    Bank of America Merrill Lynch: Completion of request for ACH CashPro
    Typical e-mail details:
    You have received a secure message from Bank of America Merrill Lynch
    Read your secure message by opening the attachment, securedoc.html. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it in a Web browser.
    If you have concerns about the validity of this message, contact the sender directly.
    First time users - will need to register after opening the attachment.


    Malicious URLs:
    161.58.101.183/handler/jxpiinstall.exe

    Malicious File Name and MD5:
    securedoc.html (D6E1DD6973F8FAA730941A19770C97F2)
    jxpiinstall.exe (C3110BFDD8536DC627336D7F7A6CC2E7)


    Screenshot: https://gs1.wac.edgecastcdn.net/8019...agN1r6pupn.png

    Tagged: Bank of America, Merrill Lynch, tuscas

    161.58.101.183: https://www.virustotal.com/en/ip-add...3/information/

    Last edited by AplusWebMaster; 2014-08-26 at 02:11.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #510
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    6,881

    Thumbs down Fake Vodafone SPAM, SourceForge sub-domain redirects to Flash-Pack-Exploit-Kit

    FYI...

    Fake Vodafone SPAM
    - http://blog.dynamoo.com/2014/08/voda...ware-spam.html
    26 Aug 2014 - "This -fake- Vodafone spam comes with a malicious attachment. There is not body text as such, the header reads:
    From: Vodafone MMS service [mms813562@ vodafone .co.uk]
    Date: 26 August 2014 12:00
    Subject: IMG Id 813562-PictQbmR TYPE--MMS


    The version I had was mangled and the attachment was just called noname which required a bit of work to turn into a ZIP file IMG Id 813562-PicYbgRr TYPE--MMS.zip which in turn contains a malicious executable Picture Id 550125-PicSfdce TYPE-MMS.exe This .EXE file has a VirusTotal detection rate of 3/55*. The malware then attempts to download additional components... This second component has a VirusTotal detection rate of 3/53**... I would recommend the following blocklist:
    192.254.186.106 ..."
    (More detail at the dynamoo URL above.)
    * https://www.virustotal.com/en-gb/fil...is/1409051519/

    ** https://www.virustotal.com/en-gb/fil...is/1409052175/

    192.254.186.106: https://www.virustotal.com/en/ip-add...6/information/
    ___

    Phishers hook Facebook Users via SMS
    - https://blog.malwarebytes.org/fraud-...users-via-sms/
    Aug 26, 2014 - "If you happen to receive an SMS message from a potentially unknown recipient with the following text—
    wtf f***** remove this pic from Facebook. http ://bit[dot]do/fbnudephotos
    ... much like the fellow on the screenshot:
    > https://blog.malwarebytes.org/wp-con...014/08/SMS.png
    ...then you’ve been targeted by a phishing campaign. The bit .do link is the shortened URL for a publicly available HTML page hosted on a Dropbox account. It looks like this:
    > https://blog.malwarebytes.org/wp-con...dbox-phish.png
    All links but one – the 'Get Facebook for iPhone and browse faster' link – lead to a 404 page. The aforementioned link leads to the actual iTunes app download page. The full code of the page is actually hex encoded and executed by the unescape () function... Once users provide their Facebook credentials to the page, these are then posted to a .PHP page hosted on 193[dot]107[dot]17[dot]68, which we found out to be quite a popular location for hosting malware. While this happens at the background, users are directed to the following screenshot which serves as humour, if not a “Gotcha!” after a successful con:
    > https://blog.malwarebytes.org/wp-con...08/unibrow.png
    ... Individuals or groups with bad intent have been using SMS as a way to -scam- people, either for their money or for their information. Senior Security Researcher Jérôme Segura have published a post entitled “SMS Scams: How To Defend Yourself”* back in 2013, which I recommend you... read as well. His thoughts on this kind of fraud remains relevant to this date..."
    * https://blog.malwarebytes.org/intell...fend-yourself/

    193.107.17.68: https://www.virustotal.com/en/ip-add...8/information/
    ___

    Vacation SCAMS ...
    - https://blog.malwarebytes.org/fraud-...at-the-border/
    Aug 26, 2014 - "... common travel scams and things to be wary of right now... First up, we have an Infographic over at the Just the flight blog which details 40 tourist scams to avoid*, along with common locations for said scams:
    * http://www.justtheflight.co.uk/blog/...is-summer.html
    ... Whether you’re being driven to fake hotels by taxi drivers in on the act, looking at bogus takeaway menus slipped under your hotel door, accosted by pretend policemen or trying to catch a fake baby (no really) thrown in your general direction by a scammer working with pickpockets... Next up, we have some advice on the South China Morning Post in relation to travelling alone**, which includes tips and advice alongside links to additional information. Well worth a look if you’re planning on upping sticks and going solo:
    ** http://www.scmp.com/magazines/48hrs/...ngle-traveller
    Finally, there’s a device which can be placed inside jewelry and perform numerous functions while on the move, including sending alert messages*** in case of emergency:
    *** http://www.bust.com/this-stylish-jew...-you-safe.html
    Wherever you go, you can be sure con-jobs and fakeouts lie in wait and the sensible traveler will do a little background reading before wandering off to parts unknown. It pays to keep your wits about you whether at home or abroad..."
    (More at the malwarebytes URL at the top.)
    ___

    SourceForge sub-domain redirects to Flash-Pack-Exploit-Kit
    - https://blog.malwarebytes.org/exploi...k-exploit-kit/
    Aug 25, 2014 - "We have talked about SourceForge before on this blog, in particular when they were associated with -bundled- software... take a look at an infected sub-domain hosted on SourceForge responsible for a drive-by download attack... This calls to stat-count .dnsdynamic .com a domain previously identified* as a source of malicious activity. This one is no different...
    * https://www.virustotal.com/en/domain...m/information/
    ... You may recognize the URL landing for the Flash Pack Exploit Kit. There is an interesting series of -redirections- ... The last URL is a Flash file, VT detection here:
    > https://www.virustotal.com/en/file/6...is/1408996053/
    ... A Flash file with a peculiar name for its classes:
    > https://www.virustotal.com/en/file/3...is/1408979154/
    The payload (VT results**) is detected by Malwarebytes Anti-Malware as Trojan.Agent.ED... We have spotted similar redirections to the Flash Pack exploit kit in other popular sites as well. Whether is it part of a larger campaign is hard to say but it is particularly active at the moment. Drive-by download attacks are the number -one- vector for malware infections. Legitimate websites often fall victim to malicious -injections- stealing incoming traffic and sending it to booby-trapped pages. Within seconds, an unpatched computer could get infected with a nasty piece of malware..."
    (More detail at the malwarebytes URL at the top.)
    ** https://www.virustotal.com/en/file/5...is/1408996125/

    dnsdynamic .com - 84.45.76.100: https://www.virustotal.com/en/ip-add...0/information/

    Last edited by AplusWebMaster; 2014-08-26 at 21:48.
    The machine has no brain.
    ......... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •