SPAM frauds, fakes, and other MALWARE deliveries...

AplusWebMaster · Jul 21, 2014

Something evil on 188.120.198.1 ...

FYI...

Something evil on 188.120.198.1 - (IP4ISP / LuckyNet, Czech Republic)
- http://blog.dynamoo.com/2014/07/something-evil-on-1881201981-ip4isp.html
21 July 2014 - "... Cushion Redirect sites closely related to this attack a few weeks ago* but this time hosted on 188.120.198.1 (IP4ISP / LuckyNet, Czech Republic). You can see the -redirect- in action in this URLquery report** and VirusTotal*** has a clear indication of badness on this IP. All the sites are -hijacked- subdomains of legitimate domains, a peculiar mix of pornography and Dora the Explorer... the most effective way of securing your network is to permablock 188.120.198.1.
Recommended blocklist:
188.120.198.1
e-meskiesprawy24 .com.pl
dora-explorer .co.uk
adultvideoz .net
alsancakescort .org
anadoluyakasiescort .asia"
* http://blog.dynamoo.com/2014/07/something-evil-on-3718714057-ovh-france.html

** http://urlquery.net/report.php?id=1405937345878

*** 188.120.198.1: https://www.virustotal.com/en-gb/ip-address/188.120.198.1/information/
___

Facebook video scam leaves unamusing Trojan
- http://net-security.org/malware_news.php?id=2814
21.07.2014 - "... video spreading on Facebook leaves a not-so-hilarious Trojan in its wake on users’ computers, according to research by Bitdefender. The malware, believed to originate from Albania, can access a large amount of data from the user’s internet browser. The scam begins with what appears to be a funny video of a Facebook friend. Once the video is clicked on, users are directed to a fake YouTube page, which then -redirects- them to a malicious Flash Player.exe for an Adobe update... Malware writers faked the number of views so the video seems to have been watched by over a million users... In an attempt to bypass security, the hackers got their hands on over 60 bit.ly API keys that helped them generate shortened URLs. The unique links are then spread on Facebook timelines. As API keys are randomly selected, blacklisting a couple does not stop the scam from spreading. Bitdefender has notified bit.ly of the issue. The malware writers used an add-on framework that allows their code to function on several browsers. With Google Chrome, the malicious YouTube video -redirects- users to a fake FlashPlayer install. The file, detected by Bitdefender as Trojan.Agent.BDYV, drops a password-protected archive on the computer and a .bat file, designed to run the executable in the archive after providing the password as a parameter. With Firefox, the page prompts for a malicious add-on install. On both browsers, the add-on tags 20 Facebook friends at a time and injects ad services into the page. The extension also fiddles with some of the social network’s functionalities so that users can't delete the malicious posts from their timeline and activity log..."
___

Bank of America - Activity Alert Spam
- http://threattrack.tumblr.com/post/92440887228/bank-of-america-activity-alert-spam
July 21, 2014 - "Subjects Seen:
Activity Alert: A Check Exceeded Your Requested Alert Limit
Typical e-mail details:
Activity Alert
A check exceeded your requested alert limit
We’re letting you know a check written from your account went over the limit you set for this alert.
For more details please check attached file

Malicious File Name and MD5:
report072114_349578904357.exe (23E32D6A9A881754F1260899CB07AC55)
report072114_349578904357.zip (4FE1365C55AA0C402384F068CDA7DF8E)

Screenshot: https://gs1.wac.edgecastcdn.net/801...7e6090d69/tumblr_inline_n92lonNlop1r6pupn.png

Tagged: Bank of America, Upatre

- http://myonlinesecurity.co.uk/activity-alert-check-exceeded-requested-alert-limit-fake-pdf-malware/
21 July 2014
> https://www.virustotal.com/en/file/...d1fb7e89e6edfe085f8a71f7/analysis/1405960609/
___

Bitly API key and MSNBC unvalidated redirects
- http://community.websense.com/blogs...-api-key-and-msnbc-unvalidated-redirects.aspx
21 Jul 2014 - "... observed a -spam/fraud- campaign whereby a user is -redirected- from a real news site to a -fake- news site. In this case the real site is msnbc.com, which belongs to the well-known cable and satellite channel MSNBC. We have discovered that cyber criminals appear to have gained access to the publicly available MSNBC Bitly API key. This is being abused to create custom URL shorteners. Websense Security Labs has been tracking fraudulent sites of this kind since 2012, but this was the first time that a redirection technique of this type was observed. Executive Summary: The various methods used by this group include:
- Use of publicly available Bitly API key for redirection
- Use of a famous news site to redirect to a fake news site
- Four redirection steps from real news site to fake news site
- Spreading the link through Google and Yahoo groups and spam mail
Here is the -fake- news site to which the user is directed, hosted on a legitimate-looking host of hxxp ://fcxnws .com/:
> http://community.websense.com/cfs-f...tylabs/4011.fake-news-site.jpg_2D00_550x0.jpg
So far, Websense Security Labs has identified that the spam is spread through Google and Yahoo groups, and email. Example post on Google groups:
> http://community.websense.com/cfs-f...itylabs/1263.google-groups.jpg_2D00_550x0.jpg
Example post on Yahoo groups:
> http://community.websense.com/cfs-f...ritylabs/2821.yahoo-groups.jpg_2D00_550x0.jpg
... Bitly is a service to shorten URLs into a more user-friendly format. Shortened URLs are very convenient as they are easier to exchange due to their length, and can improve the look of a message. Businesses can set up their own 'short domains' and change their DNS settings to Bitly's servers. Each Bitly customer has their own API key that they can use to generate short URLs from full URLs. If the API key relates to an account that has set up their own short domain, the custom short domain will be used when generating a short URL... Bitly are currently blocking the redirection page at the time of writing. Kudos to them.
>> http://community.websense.com/cfs-f...labs/7206.blocked-by-bitly.jpg_2D00_550x0.jpg
... Websense Security Labs identified other websites that keep their Bitly API key in public view. Exposing your Bitly API key is a risk if you have a short domain, as it allows anybody to generate short URLs on your short domain that redirect to anywhere of that person's choosing. This can make it appear as if your business is the one redirecting to malware/phishing/fraud etc. Fortunately, there's not much more that anybody can do with an API key as any account-related or link editing features can only be accessed after an OAuth login. All requests to the Bitly API should be done on the website's back end, on the server-side. This means that the API key will never be seen by public users on the front end and your API key remains safe. You can read about Bitly's API best practices here: http://dev.bitly.com/best_practices.html . URL shorteners are very useful, but come with their own security risks and should be used with caution from a developer and from a user point of view."

:fear:

AplusWebMaster · Jul 22, 2014

Facebook SCAMs, Tumblr SPAM apps...

FYI...

Facebook SCAM - 'Actual Footage Missile MH-17'
- http://www.hoax-slayer.com/footage-missile-mh-17-survey-scam.shtml
July 22, 2014 - "Facebook message claims that users can see actual footage of the missile fired at downed Malaysian Airlines flight MH17 by pro-Russian militants. The promised video does not exist. The message is a -scam- designed to trick people into spamming their friends with the same fake material and participating in -bogus- online surveys. If this message comes your way, do not click any links that it contains.
> http://www.hoax-slayer.com/images/footage-missile-mh-17-survey-scam-1.jpg
This message, which is being distributed on Facebook, promises users actual footage showing the missile that destroyed Malaysian Airlines flight MH17. The message invites users to click a link to view the footage... The supposed video is just a trick to get you to click the link in the message. In fact, the message is a typical 'shocking video' survey scam. If you click the link in the message, you will be taken to a fake Facebook Page that supposedly hosts the video. The fake page comes complete with equally fake user comments... scammers quickly exploit every high-profile disaster and the MH17 tragedy is no exception. In coming days and weeks, be wary of any message that asks you to click a link to access video or breaking news pertaining to MH17..."
___

Facebook Scam leads to Nuclear Exploit Kit
- http://www.symantec.com/connect/fr/blogs/facebook-scam-leads-nuclear-exploit-kit
22 July 2014 - "... The “EXPOSED: Mom Makes $8,000/Month” scam, which we observed recently, redirected users to the Nuclear exploit kit. This particular scam has since been removed by Facebook..."
Regions affected by Nuclear exploit kit
> http://www.symantec.com/connect/sites/default/files/users/user-2551621/Facebook Scam 4.png
___

Spammy Tumblr Apps and Stalker Hunting
- http://blog.malwarebytes.org/fraud-scam/2014/07/spammy-tumblr-apps-and-stalker-hunting/
July 22, 2014 - "... the latest one currently bouncing around the popular social network. You’ll notice it apes the template of the site in the linked blog [1] – same spam posts, same spam application name – although the website for this one looks fairly slick. It’s possible this one is closely related to the February spamrun, as the same Bit.ly user account created shortening URLs for both. Here’s the spam popping up on various blogs:
> http://cdn.blog.malwarebytes.org/wp-content/uploads/2014/07/tumbstalk1.jpg
Below is the site it leads to, located at reviewsloft(dot)com/a/?3
> http://cdn.blog.malwarebytes.org/wp-content/uploads/2014/07/tumbstalk2.jpg
... Once the install is done, they’ll show the inevitable surveys to the end-user to make some money. As before, a bit.ly link is used... With this current spamrun we can see that we’re hitting about 19,000 in 12 days, with around 2,000 clicks listed as coming from Tumblr and the rest classed as “unknown”. Not a huge amount of information to go on, then, but a good reminder that people continue to fall for this type of scam which has been around for the longest time. As a final note, the -rogue- application will continue to post to your Tumblr until you go into your user settings and remove the app... follow the instructions listed on the Tumblr account security page*. At that point, the spam posts can stop..."
* https://www.tumblr.com/docs/en/account_security

1] http://blog.malwarebytes.org/fraud-...spams-my-top-followers-posts-to-tumblr-users/
___

Fake Credit Applicaiton – PDF malware
- http://myonlinesecurity.co.uk/fw-credit-applicaiton-fake-pdf-malware/
22 July 2014 - "Fw: Credit Application is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
... Please see credit application for West Star Environmental.
The job we have for them is for $ 46,214.00
Thank you,
From: Jimmy Robertson
Sent: Tue, 22 Jul 2014 11:57:13 +0100
Subject: Credit Applicaiton
Good Afternoon,
Here is our credit application. If you should require further information please feel free to contact me.
Jimmy Robertson
West Star Environmental, Inc.
4770 W. Jennifer
Fresno, CA 93722 ...

22 July 2014: SWF_CREDIT_APPLICATION.pdf.zip (10kb) Extracts to SWF_CREDIT_APPLICATION.pdf.scr... Current Virus total detections: 5/53*
This Fw: Credit Applicaiton is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...0323f0ee0565a438c6aecc1c/analysis/1406038205/
___

Over 30 financial institutions defrauded by phone apps used to intercept passwords
- http://www.reuters.com/article/2014/07/22/cybersecurity-banks-apps-idUSL2N0PX02T20140722
Jul 22, 2014 - "More than 30 financial institutions in six countries have been defrauded by sophisticated criminal software that convinces bank customers to install -rogue- smartphone programs... Though many of the elements of the malicious software, including the interception of one-time passwords sent to phones, have been used elsewhere, the latest criminal campaign is unusual in that it combines many different techniques and leaves few traces... Banks in Austria, Sweden, Switzerland and Japan have all been hit, with damages somewhere in the millions of dollars... The least sophisticated part of the gang's work so far appears to be in the delivery of the software, according to a report by Trend Micro researchers*. Emails that appear to be from major retailers come with attachments that, when opened, prompt the user to download a malicious attachment of an unusual type, called a control panel item. If users do not click again, they are safe. If they do, the software goes to work and hides itself out of view of most antivirus protection. When an infected user later tries to visit the website of one of the targeted banks, the software redirects them to a -fake- site, which asks for login details and then prompts the user to download a smartphone app. That app later intercepts the one-time passwords, giving the gang both that data as well as the login information, enough to clean out an account..."
* http://blog.trendmicro.com/trendlabs-security-intelligence/finding-holes-operation-emmental/
___

Scams exploit MH17 Disaster
- http://www.hoax-slayer.com/m17-scams.shtml
July 21, 2014 - "... callous criminals waste no time in exploiting disasters such as air-crashes, terrorist attacks, storms, or tsunamis. The MH17 missile attack tragedy is no exception. In coming days and weeks, Internet users should be wary of scam attacks that attempt to trick people into following links or opening attachments in messages that are supposedly related to MH17... callous criminals waste no time in exploiting disasters such as air-crashes, terrorist attacks, storms, or tsunamis. The MH17 missile attack tragedy is no exception. In coming days and weeks, Internet users should be wary of scam attacks that attempt to trick people into following links or opening attachments in messages that are supposedly related to MH17... after clicking such a link, you are told that, before you proceed, you must share the post, participate in a survey, install an app or browser extension, or download a video player update or other software, close the page immediately..."

- http://blog.trendmicro.com/trendlab...riminals-hitchhike-on-the-news-of-mh17-crash/
July 18, 2014
___

Facebook SCAM - Mercedes Benz CLA 45' Giveaway
- http://www.hoax-slayer.com/mercedes-benz-giveaway-like-farming-scam.shtml
July 21, 2014 - "Facebook Page claims that users can win a 'Mercedes Benz CLA 45 just by liking the page, liking and sharing a promotional post... The Page is -bogus- and the competitions that it promotes are not legitimate. There are no winners and no cars are being given away. This is a like-farming scam designed to fraudulently increase the number of likes garnered by the Page. Facebook Pages with high like-numbers can later be used to perpetrate further scams to a large audience. Alternatively, the Pages may be sold on the black market to other scammers...
> http://www.hoax-slayer.com/images/mercedes-benz-giveaway-like-farming-scam-1.jpg
According to a 'Competitions' Facebook Page that is currently being promoted across the network, you could win one of 6 Mercedes Benz CLA 45's just by liking the Page, liking and sharing a Page post... The scammers may also use the bogus Pages to perpetrate advance fee scams... the like-heavy Pages can be sold via a lucrative black market to other scammers who will repurpose it to further their own goals..."

:fear:

AplusWebMaster · Jul 23, 2014

Fake Facebook mails, Fake BBB email ...

FYI...

Fake Facebook mails lead to Pharma Spam
- http://blog.malwarebytes.org/fraud-scam/2014/07/fake-facebook-mails-lead-to-pharma-spam/
July 23, 2014 - "... it may look as though something has gone wrong with your Facebook account, but it’s just a ruse to convince you to -click- the provided link. The message reads:
“[Name], your messages will be deleted soon responsibly
You haven’t been to Facebook for a few days, and a lot happened while you were away.
Your messages will be deleted soon.”

Clicking either the View Messages or Go to Facebook button will result in the clicker hitting a php page on a .com(dot)au URL, before being redirected to a Canadian Pharmarcy page:
> http://cdn.blog.malwarebytes.org/wp-content/uploads/2014/07/fbpharma.jpg
... we do not recommend purchasing random pills from websites you’ve discovered via -fake- Facebook spam mails. No matter how urgent-sounding or laced with impending doom a mail sounds, always consider that the sender simply wants you to click through with as much speed and as little thought as possible..."
___

Fake BBB complaint email – malware
- http://myonlinesecurity.co.uk/better-business-bureau-complaint-malware/
23 July 2014 - "Better Business Bureau complaint is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This version is slightly different to the usual BBB complaints emails because there is -no- attachment and they want you to click the link to download the gameover -zeus- malware binary directly:
July 23, 2014
Case# 5942415: Joe Russell
Dear Company:
As you are aware, the Better Business Bureau contacted you regarding the above-named complainant, seeking a response to this complaint. Your position is available online.
The following URL (website address) below will take you directly to this complaint and you will be able to view the response directly on our website:
http ://newyork.app.bbb .org/complaint/view/5942415/b/194439957f
< http ://castlestrategies .net/css/new_7g1.exe>
The complainant has been notified of your response.
The BBB believes that your response adequately addresses the disputed issues and/or has exhibited a good faith effort to resolve the complaint. The complaint will close as “Administratively Judged Resolved” and our records will be updated...

23 July 2014: new_7g1.exe Current Virus total detections: 2/53*
... it appears to come from a friend or is more targeted..."
* https://www.virustotal.com/en/file/...ceb83946998e58fffd5c5743/analysis/1406137574/

184.168.152.4: https://www.virustotal.com/en-gb/ip-address/184.168.152.4/information/

- http://threattrack.tumblr.com/post/92655470813/at-t-wireless-bill-spam
23 July 2014
___

Live SSH Brute Force Logs and New Kippo Client
- https://isc.sans.edu/diary.html?storyid=18433
2014-07-23 - "... a new feature we have been working on for a while, that will display live statistics on passwords used by SSH brute forcing bots. In addition, we also updated our script that will allow you to contribute data to this effort. Right now, we are supporting the kippo honeypot to collect data. This script will submit usernames, passwords and the IP address of the attacker to our system... For data we are collecting so far, see:
- https://isc.sans.edu/ssh.html
... some of the passwords these scripts try out are not necessarily trivial, but they may be common enough to be worth while brute forcing targets."
___

Fake "Redirected message" SPAM ...
- http://blog.dynamoo.com/2014/07/birminghammail-paul-fulford-redirected.html
23 July 2014 - "This spam pretends to be from a journalist called Paul Fulford at the Birmingham Mail. However, it isn't.. it is a forgery with a malicious attachment.
Date: Wed, 23 Jul 2014 20:59:48 +0800 [08:59:48 EDT]
From: Birminghammail [paul.fulford@ birminghammail .co.uk]
Subject: Redirected message
Dear [redacted]!
Please find attached the original letter received by our system.

I only have two samples of this, the originating IP addresses are:
1.34.211.10 (HINET, Taiwan)
117.212.18.140 (BSNL, India)
Poor Mr Fulford thinks that his email has been hacked.. it hasn't...
> https://3.bp.blogspot.com/-CS2tc0xddLQ/U8_M6a1cWuI/AAAAAAAADYM/vr-gnibfdsU/s1600/fulford.png
Attached is an archive file 1.zip which contains a malicious executable original_letter_234389_193.scr.exe... The Malwr report* shows that this part reaches out to the following IPs:
37.139.47.103
37.139.47.117
Both of these belong to Comfortel Ltd in Russia. From there another file 2.exe is download which has a VT detection rate of just 3/53**. The Malwr report is inconclusive.
I'm not familiar with the Russian host, but having two bad IPs in close proximity makes me think that you probably want to block at least 37.139.47.0/24 or the whole 37.139.40.0/21 (almost all sites are in the /24 anyway). This netblock contains a mix of what look like legitimate Russian-language sites and obvious phishing sites."
* https://malwr.com/analysis/NGI0MWVmMjBkNmNiNDM0ZGE2YmM1ZmZjNTA0YzBiNzI/

** https://www.virustotal.com/en-gb/fi...edddd9f4fa66e6df6c33e0ea/analysis/1406127100/

- http://myonlinesecurity.co.uk/redirected-message-malware/
23 July 2014
> https://www.virustotal.com/en/file/...57f2f93243817b7fbdb2132d/analysis/1406126658/
___

Fake invoice 4904541 July SPAM – PDF malware
- http://myonlinesecurity.co.uk/invoice-4904541-july-fake-pdf-malware/
23 July 2014 - "invoice 4904541 July is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... A very plain simple email that just says:
This email contains an invoice file attachment

23 July 2014: invoice_4904541.zip (46 kb): Extracts to invoice_32990192.exe
Current Virus total detections: 3/53* ...This invoice 4904541 July is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is..."
* https://www.virustotal.com/en-gb/fi...9a8ddab3c28b66d054fe2be4/analysis/1406127329/
___

Some WSJ systems taken offline after cyber attack
- http://www.reuters.com/article/2014/07/23/us-wallstreetjournal-cybercrime-idUSKBN0FS03N20140723
2014.07.23 - "Computer systems containing the Wall Street Journal's news graphics were -hacked- by outside parties, according to the paper's publisher Dow Jones & Co. The systems have been taken offline to prevent the spread of attacks, but Journal officials have not found any damage to the graphics, the newspaper said citing people at the Wall Street Journal familiar with the matter. A hacker who goes by the Twitter handle of 'w0rm' allegedly posted tweets and screenshots claiming to have hacked the Journal's website and offered to sell user information and credentials needed to control the server..."

:fear:

AplusWebMaster · Jul 24, 2014

Fake Remittance, Fake Voicemail SPAM ...

FYI...

Fake Remittance Advisory SPAM – malware
- http://myonlinesecurity.co.uk/remittance-advisory-email-malware/
24 july 2014 - "Remittance Advisory Email is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email... This email doesn’t have an attachment but has a link in the body for you to click on & download the malware:
Thursday 24 July 2014
This is a Remitter Advice following the submission of a payment instruction by Lloyds Bank Plc.
Please review the details of the payment here.
<http ://dentairemalin .com/images/report934875438jdfg8i45jg_07242014.exe>
Lloyds Banking Group plc...

24 July 2014: report934875438jdfg8i45jg_07242014.exe
Current Virus total detections: 5/53* ..."
* https://www.virustotal.com/en-gb/fi...77826d6ac8d047d29c7d73c2/analysis/1406204716/

- http://centralops.net/co/DomainDossier.aspx
canonical name dentairemalin.com.
addresses 217.16.10.2 ...

217.16.10.2: https://www.virustotal.com/en-gb/ip-address/217.16.10.2/information/

- http://blog.dynamoo.com/2014/07/natwest-you-have-received-secure.html
24 July 2014

- http://threattrack.tumblr.com/post/92729183098/lloyds-bak-remittance-spam
July 24, 2014
Tagged: lloyds tsb, Dyreza
___

Fake VoiceMail SPAM
- http://blog.dynamoo.com/2014/07/you-have-received-new-voicemail-spam.html
24 July 2014 - "This tired old malware spam is doing the rounds again.
From: Voice Mail [voicemail_sender@local]
Subject: You have received a new VoiceMail
Date: Thu, 24 Jul 2014 17:31:25 +0700 [06:31:25 EDT]
You have received a voice mail message.
Message length is 00:03:27.

As you might expect, the attachment VoiceMail.zip does not contain a voice mail at all, but it is a malicious executable VoiceMail.scr which has a a VirusTotal detection rate of 3/53*. The CAMAS report** and Anubis report*** shows the malware downloading an encrypted file from the followng locations:
egozentrica .com/wp-content/uploads/2014/07/tor2800_2.7z
reneerlaw .com/wp-content/uploads/2014/07/tor2800_2.7z
Blocking those sites may give some protection against this malware."
* https://www.virustotal.com/en-gb/fi...8d4c8416281ab360a0b0806c/analysis/1406214495/

** http://camas.comodo.com/cgi-bin/sub...ef73d622c3a56dfff8ae68d4c8416281ab360a0b0806c

*** http://anubis.iseclab.org/?action=result&task_id=16f0f5360ab511ef43da70c6b7629f80b&format=html

50.115.19.181: https://www.virustotal.com/en-gb/ip-address/50.115.19.181/information/

82.98.151.154: https://www.virustotal.com/en-gb/ip-address/82.98.151.154/information/
___

CNN News Spam
- http://threattrack.tumblr.com/post/92738436913/cnn-malaysian-airlines-breaking-news-spam
July 24, 2014 - "Subjects Seen:
CNN Breaking News - Malaysian Boing 777
Typical e-mail details:
Ukraine recognizes that hit a Malaysian Boing 777
Malaysia Airlines flight 17 shot down in Ukraine.
FULL STORY

Malicious URLs:
firstfiresystems .com/images/CNN_breaking_news_read_now.exe
Malicious File Name and MD5:
CNN_breaking_news_read_now.exe (57D5055223344CF8814DCFC33E18D7E6)

Screenshot: https://gs1.wac.edgecastcdn.net/801...2acc0c8f8/tumblr_inline_n984xyrrEN1r6pupn.png

Tagged: CNN, Malaysian Airlines, Dyreza, MH17

208.69.121.22: https://www.virustotal.com/en-gb/ip-address/208.69.121.22/information/

:fear::fear:

AplusWebMaster · Jul 25, 2014

Fake Tax Notice, Virgin Media, Tiffany, eFax SPAM ...

FYI...

Fake Tax Notice SPAM
- http://blog.dynamoo.com/2014/07/hmrc-tax-notice-july-2014-spam.html
25 July 2014 - "This fake HMRC tax notice comes with a malicious attachment:
Date: Fri, 25 Jul 2014 16:48:37 +0900 [03:48:37 EDT]
From: HMRC Revenue&Customs [Rosanne@ hmrc .gov.uk]
Reply-To: Legal Aid Agency [re-HN-WFCLL-OECGTZ@ hmrc .gov.uk]
Dear [redacted] ,
Please be advised that one or more Tax Notices (P6, P6B) have been issued.
For the latest information on your Tax Notices (P6, P6B) please open attached report.
Document Reference: 34320-289...

Screenshot: https://4.bp.blogspot.com/-ifAUEhlycgw/U9Ip0IQ3ITI/AAAAAAAADao/w3bL3pLZq_s/s1600/hmrc.png

Attached is a file P6_rep_34320-289.zip which unZips to a folder called P6_rep(9432)_84632_732.doc which contains a malicious executable P6_rep(9432)_84632_732.doc.scr which has a VirusTotal detection rate of 4/53*. The CAMAS report** shows that a second component is downloaded from 37.139.47.167/bt/2.exe which in turn has a VirusTotal detection rate of 5/52***. The IP address of 37.139.47.167 is in the same /24 as the two other IPs mentioned here [1]. I would very strongly recommend blocking traffic to at least 37.139.47.0/24 or the whole 37.139.40.0/21 range (although there do seem to be some legitimate Russian-language sites in there)..."
* https://www.virustotal.com/en-gb/fi...b8ab2812eeb92638ce475692/analysis/1406281395/

** http://camas.comodo.com/cgi-bin/sub...ac834133ee6f0ef66c1abb8ab2812eeb92638ce475692

*** https://www.virustotal.com/en-gb/fi...e34a1f8e76c0a98f55688691/analysis/1406281708/

1] http://blog.dynamoo.com/2014/07/birminghammail-paul-fulford-redirected.html
___

Fake Virgin Media SPAM - PDF malware
- http://myonlinesecurity.co.uk/help-...-automated-billing-reminder-fake-pdf-malware/
25 July 2014 - "Help & Advice – Virgin Media Business Virgin Media Automated Billing Reminder pretending to come from Virginmedia Business <services@ virginmediabusiness .co.uk>is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer...
> https://t2.gstatic.com/images?q=tbn...neyspears.com/2008/12/12/Virgin Media Web.jpg
This e-mail has been sent you by Virgin Media to inform you that we were
unable to process your most recent payment of bill. This might be due to
one of the following reasons:
A recent change in your personal information such as Name or address.
Your Credit or Debit card has expired.
Insufficient funds in your account.
Cancellation of Direct Debit agreement.
Your Card issuer did not authorize this transaction.
To avoid Service interruption you will need to update your billing profile, failure to update your profile may lead in service cancellation and termination.
Please fulfill attached form and send it back to our email adress...

25 July 2014: form_19927-267.zip (85 kb): Extracts to billing_form91_4352-2105.pdf.scr
Current Virus total detections: 5/53* ... another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...c34759ace4fae17adeb0ad74/analysis/1406293502/
___

Fake Tiffany SPAM...
- http://blog.dynamoo.com/2014/07/tiffany-co-invoice-0625859-july-spam.html
25 July 2014 - "This fake Tiffany & Co email has a malicious attachment:
Date: Fri, 25 Jul 2014 17:32:38 +0800 [05:32:38 EDT]
From: "J.Parker" [rcaukomti@ tiffany .co.uk]
Subject: invoice 0625859 July
Kindly open to see export License and payment invoice attached, meanwhile we sent the balance payment yesterday.
Please confirm if it has settled in your account or you can call if there is any problem.
Thanks
J.parker
Tiffany & Co.

Attached to the message is an archive invoice copy.zip which contains a folder invoice copy in which there is a malicious file invoice copy.exe which has a VirusTotal detection rate of 9/51*. The CAMAS report** shows that the malware downloads components..."
* https://www.virustotal.com/en-gb/fi...1840741ab8811ff0ea747d57/analysis/1406295906/

** http://camas.comodo.com/cgi-bin/sub...e4c0a1882dbde76cf49a11840741ab8811ff0ea747d57
___

Fake "eFax message" SPAM
- http://blog.dynamoo.com/2014/07/efax-message-spam.html
25 July 2014 - "Another tired old spam template leading to malware:

Screenshot: https://3.bp.blogspot.com/-bsCXYAlIvBE/U9JmEHWaW7I/AAAAAAAADbM/v1u9RviID8o/s1600/efax.png

In this case the link in the email goes to verzaoficial .com/css/fax_390392029_072514.exe which downloads a file with a VirusTotal detection rate of just 1/45*. Automated analysis [pdf] is fairly inconclusive as to what it does."
* https://www.virustotal.com/en-gb/fi...b3bbb1990e7d07cb652495e8/analysis/1406297301/

:fear::fear:

AplusWebMaster · Jul 26, 2014

Something evil on 198.27.110.192/26 ...

FYI...

Something evil on 198.27.110.192/26 ...
- http://blog.dynamoo.com/2014/07/please-send-pi-spam-something-evil-on.html
26 July 2014 - "... seems to refer to a Proforma Invoice rather than Π - but in fact the attachment is malware.
Date: Fri, 25 Jul 2014 22:50:14 -0700 [01:50:14 EDT]
From: OLINMETALS TRADING CO
Subject: PLEASE SEND PI
Greetings,
Regarding our previous conversation about our urgent purchase, kindly
find attached PI and let us know if the quantity can fit in 40ft
container.
kindly revise the Proforma invoice so that we can proceed with an
advance payment as agreed.
We look forward to your urgent response with revised proforma invoice.
Thks & Rgds,
OLINMETALS TRADING CO., LTD ...

... the attachment Order.zip contains a malicious executable klopppp890.exe which has a VirusTotal detection rate of 18/53*... malware phones home to walex2.ddob .us/sddob/gate.php on 198.27.110.200 (OVH Canada reassigned to Big Kesh, LLC, US). Looking at the domains registered on 198.27.110.200 and the surrounding IPs there do seem to be a lot of malicious ones being used as malware C&Cs... I think this is enough evidence to block the entire 198.27.110.192/26 as a precaution (although there do appear to be a small number of legitimate sites too)...
Recommended blocklist:
198.27.110.192/26
xiga .us
ddob .us "
(More detail at the dynamoo URL above.)
* https://www.virustotal.com/en-gb/fi...e18c8e77592cbae0212425e3/analysis/1406366678/

Diagnostic page for AS16276 (OVH)
- https://www.google.com/safebrowsing/diagnostic?site=AS:16276
"... over the past 90 days, 3231 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2014-07-26, and the last time suspicious content was found was on 2014-07-26... Over the past 90 days, we found 483 site(s) on this network... that appeared to function as intermediaries for the infection of 1070 other site(s)... this network has hosted sites that have distributed malicious software in the past 90 days. We found 930 site(s)... that infected 219349 other site(s)."
___

Fake Order Notification SPAM - PDF malware
- http://myonlinesecurity.co.uk/notification-order-fake-pdf-malware/
26 July 2014 - "Notification of order is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... using an old trick to attempt to disguise the file name & fool you into thinking it is a genuine PDF by inserting loads of spaces between the pdf & the .exe:
Dear Customer
We have received your order and it’ll be processed for 2 business days.
Your credit card will be charged for 803 USD.
You can find specification of the invoice and delivery details: http ://link.vpn .by/?id=157562
Yours truly,
Absalon Holmes
FG Charter Travel Company

Todays Date: bill.2563034.zip (53 kb): Extracts to bill.2563034.PDF____________.exe
Current Virus total detections: 1/53* . This Notification of order is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is..."
* https://www.virustotal.com/en-gb/fi...258658c0b0907809f0cf783b/analysis/1406396500/

178.124.137.170: https://www.virustotal.com/en-gb/ip-address/178.124.137.170/information/

:fear::fear:

AplusWebMaster · Jul 28, 2014

Something evil on 88.198.252.168/29 ...

FYI...

Something evil on 88.198.252.168/29 - Ransomware
- http://blog.dynamoo.com/2014/07/something-evil-on-8819825216829.html
28 July 2014 - "88.198.252.168/29 (Hetzner, Germany) is infected with a whole bunch of ransomware landing pages, like this:
Screenshot: https://4.bp.blogspot.com/-ABIdWQUvq6k/U9ZYCTzYJKI/AAAAAAAADbg/cNayOJkGeWo/s1600/locker.png

In the past this IP range has been used to host a number of legitimate Austrian sites, but at the moment it appears to be hosting -ransomware- landing pages exclusively. The domains in use are a combination of crappy .in domains registered to a series of -fake- addresses, plus a bunch of subdomains of legitimate domains that have been hijacked. What is interesting about these hijacked domians is that they all use afraid .org as namerservers. This hijacking at afraid .org is because these particular domain users are using the free afraid .org service which allows anyone to create a subdomain of your domain and point is where they like (explained in this FAQ*). The bad news is that this sort of -hijacking- is a quick way to ruin your domain's reputation... Blocking these landing pages will probably not stop a PC from becoming infected with ransomware, but monitoring or blocking the following list may give you some intelligence as to what is happening on your own network.
Recommended blocklist:
88.198.252.168/29
fernandocoelho .net.br
duk66 .com
cerone .com.ar
gigliotti .com.ar
clawmap .com
lareferencedentaire .com
izaksuljkic .tk..."
(Complete list @ the dynamoo URL above.)
* https://freedns.afraid.org/faq/#14

Diagnostic page for AS24940 (HETZNER-AS)
- https://www.google.com/safebrowsing/diagnostic?site=AS:24940
"... Of the 327849 site(s) we tested on this network over the past 90 days, 2634 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2014-07-28, and the last time suspicious content was found was on 2014-07-28... Over the past 90 days, we found 328 site(s) on this network... that appeared to function as intermediaries for the infection of 2189 other site(s)... this network has hosted sites that have distributed malicious software in the past 90 days. We found 377 site(s)... that infected 4506 other site(s)..."
___

Fake Delivery fail SPAM – PDF malware
- http://myonlinesecurity.co.uk/delivery-failure-july-28-2014-bn_3647007-fake-pdf-malware/
28 July 2014 - "Delivery failure , July 28, 2014 BN_3647007 pretending to come from UKmail Express is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...
> http://printhut.co.uk/wp-content/uploads/2013/07/uk_mail_logo.jpg
An urgent service package has come to the local post office. Delivery was rescheduled because our courier was not able to deliver the package [RECEIVER NOT PRESENT].
You can find more information including contact details regarding your package in the attached file.
Privacy Policy and
Copyright © 2014 UKMail Group plc

28 July 2014: BN_2118176.zip (83 kb) : Extracts to report_form2_28-07-2014.pdf.scr
Current Virus total detections: 2/54* . This Delivery failure , July 28, 2014 BN_3647007 is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...00258eb2dc472ec19a94f717/analysis/1406549984/
___

Fake skipped invoice SPAM – word doc malware
- http://myonlinesecurity.co.uk/skipped-invoice-fake-word-doc-malware/
28 July 2014 - "skipped invoice is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...
HI Richie,
Attached is invoice #2223 651.45 from May missed in check received.
I am out of the office tomorrow and Monday so I’m emailing & begging for payment to make month end.
Thanks & have a great weekend!
Katherine Sargent / Credit Manager
Pacemaker Steel and Piping Co., Inc. ...

28 July 2014: invoice_28.07.zip ( 11kb) : Extracts to invoice_28.07.doc.exe
Current Virus total detections: 5/54* . This skipped invoice is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper word.doc file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...e3662977c96e47c2bc08db4f/analysis/1406569801/

178.63.240.112: https://www.virustotal.com/en/ip-address/178.63.240.112/information/
___

Fake Amazon order SPAM
- http://blog.dynamoo.com/2014/07/amazoncouk-your-amazon-order-spam.html
28 July 2014 - "This fake Amazon spam comes with a malicious attachment:
Screenshot: https://2.bp.blogspot.com/-JqukbICRlFw/U9aZqUTBwZI/AAAAAAAADbw/c3eyH0LKGrg/s1600/amazon.png

Attached is a file Order-239-1744919-1697181.zip which in turn contains a malicious executable Order details 001-8821901-992107.exe which has a VirusTotal detection rate of 18/54*. The Comodo CAMAS analysis** shows that the malware reaches out to a familiar set of URLs*** to download further components... recommend blocking the following domains:
zag .com.ua
daisyblue .ru
ricebox .biz
brandsalted .com
fbcashmethod .ru
expositoresrollup .es
madrasahhusainiyahkl .com
sexyfoxy .ts6.ru
huework .com
siliconharbourng .com
martijnvanhout .nl "
* https://www.virustotal.com/en-gb/fi...6406243de8753809cbbc5ac2/analysis/1406572004/

** http://camas.comodo.com/cgi-bin/sub...a82995679570389fbf0936406243de8753809cbbc5ac2

*** http://blog.dynamoo.com/2014/07/tiffany-co-invoice-0625859-july-spam.html

:fear: :sad:

AplusWebMaster · Jul 29, 2014

Something evil on 31.210.96.155, ...156, ...157 and ...158

FYI...

Something evil on 31.210.96.155, ...156, ...157 and ...158 (31.210.96.152/29)
- http://blog.dynamoo.com/2014/07/something-evil-on-3121096155-3121096156.html
29 July 2014 - "I don't know quite what the exploit kit of the month is here, but the IP addresses 31.210.96.155, 31.210.96.156, 31.210.96.157 and 31.210.96.158 are currently serving up malware using -hijacked- GoDaddy domains, and are targeting victim websites by altering their .htaccess files** to intercept traffic coming from search engines such as Google. These IP addresses have been used for malware for some time*...VirusTotal reports for these IPs are pretty poor [1] [2] [3] [4]. I assume that they form part of an allocation 31.210.96.152/29 which I would very strongly recommend blocking that range... these appear to be subdomains of -hijacked- GoDaddy domains... I would recommend permablocking the following IP range and temporarily blocking the following domains:
31.210.96.152/29 ..."
(Long list at the dynamoo URL above.)
* http://c-apt-ure.blogspot.co.uk/2014/06/two-years-later.html

** http://www.symantec.com/connect/blogs/trojanmilicenso-infection-through-htaccess-redirection

1] 31.210.96.155: https://www.virustotal.com/en-gb/ip-address/31.210.96.155/information/
2] 31.210.96.156: https://www.virustotal.com/en-gb/ip-address/31.210.96.156/information/
3] 31.210.96.157: https://www.virustotal.com/en-gb/ip-address/31.210.96.157/information/
4] 31.210.96.158: https://www.virustotal.com/en-gb/ip-address/31.210.96.158/information/

:fear::fear:

AplusWebMaster · Jul 30, 2014

Fake documents, Fake Amazon SPAM ...

FYI...

Fake 'documents ready for download' SPAM – PDF malware
- http://myonlinesecurity.co.uk/documents-ready-download-fake-pdf-malware/
30 July 2014 - "Your documents are ready for download is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
Your documents 6419165973846 are ready , please sign them and email them back.
Thank you
John Garret
Level III Account Management
817-768-8742 office
817-874-8795 cell
johngarret@ natwest .com
Investments in securities and insurance products are:
NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
The security of personal information about you is our priority. We protect this information by maintaining physical, electronic, and procedural safeguards that meet applicable law. We train our employees in the proper handling of personal information. When we use other companies to provide services for us, we require them to protect the confidentiality of personal information they receive...

30 July 2014: Documents_3922929617733.rar (10 kb) : Extracts to Documents.scr
Current Virus total detections: 2/53* . This Your documents are ready for download is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en-gb/fi...a9fcd73f383917eaeade8ed9/analysis/1406710734/
___

Fake "Amazon order" SPAM
- http://blog.dynamoo.com/2014/07/amazoncouk-your-amazon-order-spam_30.html
30 July 2014 - "Another -fake- Amazon spam with a malicious payload:

Screenshot: https://4.bp.blogspot.com/-zOkh76LGgdk/U9j-Nnjd49I/AAAAAAAADcY/wGaN7utyHfg/s1600/amazon4.png

There's a ZIP file attached (in this case Order-853-9908013-4362599.zip) which unzips to a folder Order details with a malicious file ORDER-992-5188991-000933.exe which has a VirusTotal detection rate of 9/53*. The Comodo CAMAS report** shows that it downloads a further component...
This second executable has a VT detection rate of 5/54***..."
(Long recommended blocklist at the dynamoo URL above.)
* https://www.virustotal.com/en-gb/fi...986a791a8d35633ec2b7f226/analysis/1406729013/

** http://camas.comodo.com/cgi-bin/sub...0f281241b33a643d6deb4986a791a8d35633ec2b7f226

*** https://www.virustotal.com/en-gb/fi...ff78d442f06e63f2f381779c/analysis/1406729311/
___

Fake Order status 30.07.2014.xls – XLS malware
- http://myonlinesecurity.co.uk/order-status-540130-30-07-2014-xls-fake-xls-malware/
30 July 2014 - "Order status -540130 30.07.2014.xls is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... An email received coming from a -random- name with -no- company details and a totally blank body and a subject of Order status -540130 30.07.2014.xls ( different order numbers ) with a zip attachment
30 July 2014 : 540130-30.07.2014.zip ( 47 kb) : Extracts to order-8301138-30.07.2014.xls.exe
Current Virus total detections: 9/54* . This Order status -540130 30.07.2014.xls is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper Excel spreadsheet file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...0fb378ab085398cd7c33ec50/analysis/1406736903/
___

Fake "Payslip" SPAM
- http://blog.dynamoo.com/2014/07/payslip-spam.html
30 July 2014 - "... terseness works with this kind of message:
From: Richard Mason [richardm254@ gmail .com]
Date: 30 July 2014 21:23
Subject: Payslip
Please find attached the payment slip.
Attached is a file swift copy-Payment-Slip-$70,000.html which when it is opened up in your browser comes up with a popup box.
> https://3.bp.blogspot.com/-G4xRic3PZb4/U9liJUQc5lI/AAAAAAAADco/eFJZQpx9YJI/s1600/js.png

Clicking OK downloads an executable from www.greenexpress .ge/swift//payslip.exe which you are presumably meant to run. It's a bit of an odd way to do it, so perhaps there's a reason. The HTML is simple enough..
> https://3.bp.blogspot.com/-TfUbI6lM0Sw/U9lmBNjobKI/AAAAAAAADc8/0F3omwn40kk/s1600/js2.png
..but why bother doing it this way at all? Well, it makes it just a bit harder for email security software to find the link because the attachment is Base 64 encoded... The malware itself has a VirusTotal detection rate of 31/53*... Automated analysis tools seem to time out or crash, which indicates that the malware is hardened against analysis, but the VT report does see traffic with a pattern that might be blockable if you have a webfilter..."
* https://www.virustotal.com/en-gb/fi...2a62efff0b20b4b6d4ceec84/analysis/1406754444/

198.50.169.4: https://www.virustotal.com/en-gb/ip-address/198.50.169.4/information/
___

New Crypto-Ransomware in the wild
- http://blog.trendmicro.com/trendlabs-security-intelligence/new-crypto-ransomware-emerge-in-the-wild/
July 30, 2014 - "... new crypto-ransomware variants that use new methods of encryption and evasion... 'Cryptoblocker' will not drop any text files instructing the victim on how to decrypt the files. Rather, it displays the dialog box below. Entering a transaction ID in the text box will trigger a message stating that the “transaction was sent and will be verified soon.”:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2014/07/cryptob1.jpg
... This malware does not use CryptoAPIs, a marked difference from other ransomware. CryptoAPIs are used to make RSA keys, which were not used with this particular malware. This is an interesting detail considering RSA keys would make decrypting files more difficult. Instead, we found that the advanced encryption standard (AES) is found in the malware code. A closer look also reveals that the compiler notes were still intact upon unpacking the code... Based on feedback from the Trend Micro Smart Protection Network, the US is the top affected country, followed by France and Japan. Spain and Italy round up the top five affected countries.
Countries affected by Cryptoblocker:
> http://blog.trendmicro.com/trendlab...e/files/2014/07/Cryptolocker-Infection-01.jpg
... These ransomware variants prove that despite significant takedowns, cybercriminals will continue to find ways to victimize users. Users should remain cautious when dealing with unfamiliar files, emails, or URL links. While it might be tempting to pay the ransom for encrypted files, there is no guarantee that the cybercriminals will decrypt the ransomed files..."

:fear:

AplusWebMaster · Jul 31, 2014

Backoff... Malware

FYI...

Backoff... Malware
Backoff Point-of-Sale Malware
- https://www.us-cert.gov/ncas/alerts/TA14-212A
July 31, 2014 - "... malicious actors are using publicly available tools to locate businesses that use remote desktop applications. Remote desktop solutions like Microsoft's Remote Desktop [1] Apple Remote Desktop,[2] Chrome Remote Desktop,[3] Splashtop 2,[4] Pulseway[5], and LogMEIn Join.Me[6] offer the convenience and efficiency of connecting to a computer from a remote location. Once these applications are located, the suspects attempted to brute force the login feature of the remote desktop solution. After gaining access to what was often administrator or privileged access accounts, the suspects were then able to deploy the point-of-sale (PoS) malware and subsequently exfiltrate consumer payment data via an encrypted POST request. USSS, NCCIC/US-CERT and Trustwave Spiderlabs have been working together to characterize newly identified malware dubbed "Backoff", associated with several PoS data breach investigations. At the time of discovery and analysis, the malware variants had low to -zero- percent anti-virus detection rates, which means that fully updated anti-virus engines on fully patched computers could -not- identify the malware as -malicious- ..."
Description: “Backoff” is a family of PoS malware and has been discovered recently. The malware family has been witnessed on at least three separate forensic investigations. Researchers have identified three primary variants to the “Backoff” malware including 1.4, 1.55 (“backoff”, “goo”, “MAY”, “net”), and 1.56 (“LAST”). These variations have been seen as far back as October 2013 and continue to operate as of July 2014. In total, the malware typically consists of the following four capabilities. An exception is the earliest witnessed variant (1.4) which does not include keylogging functionality. Additionally, 1.55 ‘net’ removed the explorer.exe injection component:
- Scraping memory for track data
- Logging keystrokes
- Command & control (C2) communication
- Injecting -malicious- stub into explorer.exe
The malicious stub that is -injected- into explorer.exe is responsible for persistence in the event the malicious executable crashes or is forcefully stopped. The malware is responsible for scraping memory from running processes on the victim machine and searching for track data. Keylogging functionality is also present in most recent variants of “Backoff”. Additionally, the malware has a C2 component that is responsible for uploading discovered data, updating the malware, downloading/executing further malware, and uninstalling the malware.
Impact: The impact of a compromised PoS system can affect both the businesses and consumer by exposing customer data such as names, mailing addresses, credit/debit card numbers, phone numbers, and e-mail addresses to criminal elements. These breaches can impact a business’ brand and reputation, while consumers’ information can be used to make fraudulent purchases or risk compromise of bank accounts. It is critical to safeguard your corporate networks and web servers to prevent any unnecessary exposure to compromise or to mitigate any damage that could be occurring now.
Solution: At the time this advisory is released, the variants of the “Backoff’ malware family are largely -undetected- by anti-virus (AV) vendors. However, shortly following the publication of this technical analysis, AV companies will quickly begin detecting the existing variants. It’s important to maintain up-to-date AV signatures and engines as new threats such as this are continually being added to your AV solution...
(More detail at the us-cert URL above.)
___

- http://blog.trendmicro.com/trendlabs-security-intelligence/new-pos-malware-backoff-targets-us/
Aug 6, 2014
Heat map of malicious communications found in affected US states
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2014/08/heatmap31.jpg

- http://atlas.arbor.net/briefs/index#1443301999
High Severity
7 Aug 2014

:fear::fear:

AplusWebMaster · Jul 31, 2014

Fake New fax, Fake Evernote SPAM ...

FYI...

Fake "New fax" SPAM - using goo .gl shortening service
- http://blog.dynamoo.com/2014/07/new-fax-spam-using-googl-shortening.html
31 July 2014 - "Here are a couple of variations of a fax -spam- using the goo .gl shortening service:
From: Fax [fax@ victimdomain]
Date: 31 July 2014 11:23
Subject: You've received a new fax
New fax at SCAN5735232 from EPSON by https ://victimdomain
Scan date: Thu, 31 Jul 2014 19:23:11 +0900
Number of pages: 2
Resolution: 400x400 DPI
You can download your fax message at:
https ://goo.gl /1rBYjl
(Google Disk Drive is a file hosting service operated by Google, Inc.)
------------------------------
From: FAX [fax@ qcom .co.uk]
Reply-to: FAX [fax@ qcom .co.uk]
fax@ localhost
Date: 31 July 2014 10:53
Subject: You have received a new fax message
You have received fax from EPS76185555 at victimdomain
Scan date: Thu, 31 Jul 2014 16:53:10 +0700
Number of page(s): 2
Resolution: 400x400 DPI
Download file at google disk drive service - dropbox.
https ://goo .gl/t8jteI ...

There seems to be an uptick of goo.gl spam.. if you receive something like this you can report it to goo.gl/spam-report as malware... I've seen three different URLs... Obviously, this is a ZIP file. It contains a malicious executable Document-95722.scr which has a VirusTotal detection rate of just 1/54*. The CAMAS report** shows that the malware reaches out to the following locations to download further components:
andribus .com/images/images.rar
owenscrandall .com/images/images.rar
Incidentally, if you add a "+" to the end of the goo.gl URL you can see how many people have clicked through. For example:
> https://1.bp.blogspot.com/-XGnNezE_8BI/U9on1yFs3VI/AAAAAAAADdQ/LReRBZvJpFQ/s1600/goo-gl.png
164 clicks isn't a lot, but there are multiple URLs in use.
Recommended blocklist:
andribus .com
owenscrandall .com
esys-comm .ro
autoescuelajoaquin .com
pinkfeatherproductions .com "
* https://www.virustotal.com/en-gb/fi...3efe90114f61c27883e995cc/analysis/1406804074/

** http://camas.comodo.com/cgi-bin/sub...b70da26d323da0c266a2b3efe90114f61c27883e995cc
___

Fake Evernote "File has been sent" SPAM
- http://blog.dynamoo.com/2014/07/evernote-file-has-been-sent-spam.html
31 July 2014 - "I've never understood Evernote. Something to do with elephants I think. But this spam isn't from them anyway..
Date: Thu, 31 Jul 2014 12:26:53 +0200 [06:26:53 EDT]
From: EVERNOTE [lcresknpwz@ business .telecomitalia .it]
Subject: File has been sent [redacted]
DSC_9426679.jpg attached to the letter
Copyright 2014 Evernote Corporation. All rights reserved

The file attached is actually DSC_9426679.zip and not .jpg, containing a malicious executable DSC_8832966.exe with a VirusTotal detection rate of 7/53*. The CAMAS report** shows that the malware attempts to download an additional component... These download locations are the same as yesterday's Amazon spam run***. The downloaded file has a VT detection rate of 3/53****. The recommended blocklist is the same as yesterday."
* https://www.virustotal.com/en-gb/fi...0154cbaaaefb5316d1a785dd/analysis/1406813029/

** http://camas.comodo.com/cgi-bin/sub...82068c2bca8d9f7de7f1d0154cbaaaefb5316d1a785dd

*** http://blog.dynamoo.com/2014/07/amazoncouk-your-amazon-order-spam_30.html

**** https://www.virustotal.com/en-gb/fi...bc2f2d83cdd2b89deb120366/analysis/1406813571/
___

ADP Payroll Spam
- http://threattrack.tumblr.com/post/93406211803/adp-payroll-spam
Juky 31, 2014 - "Subjects Seen:
ACH Notification
Typical e-mail details:
Attached is a summary of Origination activity for 07/31/2014
Download it from Google Disk Drive Inc.:
goo .gl/mp4Vh3
If you need assistance please contact us via e-mail during regular business hours.
Thank you for your cooperation.

Malicious URLs:
espressomachinesinfo .com/wp-includes/images/Document-83265.zip
Malicious File Name and MD5:
Document-83265.scr (3603D5B08D83130414B264FAF3EE41E1)

Screenshot: https://gs1.wac.edgecastcdn.net/801...d44f2491f/tumblr_inline_n9kz19SPvX1r6pupn.png

Tagged: ADP, Upatre

72.29.66.41: https://www.virustotal.com/en-gb/ip-address/72.29.66.41/information/
___

Fake Xerox WorkCentre SPAM
- http://blog.dynamoo.com/2014/07/scanned-image-from-xerox-workcentre-spam.html
31 July 2014 - "This is a thoroughly old school spam with a malicious attachment.
Date: Thu, 31 Jul 2014 18:16:08 +0000 [14:16:08 EDT]
From: Local Scan [scan.614@ victimdomain]
Subject: Scanned Image from a Xerox WorkCentre
You have a received a new image from Xerox WorkCentre.
Sent by: victimdomain
Number of Images: 5
Attachment File Type: ZIP [PDF]
WorkCentre Pro Location: Machine location not set
Device Name: victimdomain
Attached file is scanned image in PDF format...

Guess what.. it isn't an image at all, but a ZIP file with the unusual name of Image_[_var=partorderb].zip which contain a malicious executable Image_07312014.scr, scoring a measly 1/54* at VirusTotal. The Comodo CAMAS report** shows that the malware downloads components... There are some further clues in the VirusTotal comments* as to what the malware does. Sophos has also seen the 94.23.247.202 (OVH, France) IP before***.
Recommended blocklist:
94.23.247.202
globe-runners .com
lucantaru .it
mediamaster-2000 .de
ig-engenharia .com
upscalebeauty .com
lagrimas.tuars .com "
* https://www.virustotal.com/en-gb/fi...35cb6681d0dc468affa02a7a/analysis/1406832159/

** http://camas.comodo.com/cgi-bin/sub...d66fdbfda40c7935900a035cb6681d0dc468affa02a7a

*** http://www.sophos.com/en-us/threat-...pyware/Troj~Agent-AHXK/detailed-analysis.aspx

94.23.247.202: https://www.virustotal.com/en-gb/ip-address/94.23.247.202/information/

:fear: :sad:

AplusWebMaster · Aug 1, 2014

Fake NatWest SPAM ...

FYI...

Fake NatWest SPAM - uses goo.gl links to spread malware
- http://blog.dynamoo.com/2014/08/natwest-you-have-new-secure-message.html
1 Aug 2014 - "This fake NatWest bank message uses the Goo.gl URL shortener to spread malware:

Screenshot: https://2.bp.blogspot.com/-KGgo-AsFrI8/U9tjUZWdXOI/AAAAAAAADdg/yg3nw8reghk/s1600/natwest.png

The link in the email goes to goo .gl/dGDi7l and the downloads a ZIP file from berkleyequine .com/wp-includes/images/Documents-43632.zip, containing a malicious executable Documents-43632.scr which has a VirusTotal detection rate of just 1/54*. The CAMAS** report shows that the malware calls out to the following URLs;
94.23.247.202 /0108uk1/SANDBOXA/0/51-SP2/0/
94.23.247.202 /0108uk1/SANDBOXA/1/0/0/
94.23.247.202 /0108hk1/SANDBOXA/1/0/0/
94.23.247.202 /0108ok1/SANDBOXA/1/0/0/
acanthe .be/css/01u1.rar
dirbeen .com/misc/01u1.rar
porfintengoweb .com/css/heap_61_id3.rar
sso-unidadfinanzas .com/images/heap_61_id3.rar
theothersmag .com/covers/opened.rar
firstfiresystems.com/css/slimbox/opened.rar
The characteristics of this malware are very similar to this one seen yesterday***, and you can be assured that there are other goo .gl URLs and download locations in addition to the one listed here... Google don't make it easy to report spammy links and they are awfully slow to respond to reports, but their reporting form is at goo.gl/spam-report if you want to try it...
Recommended blocklist:
94.23.247.202
acanthe .be
dirbeen .com
porfintengoweb .com
sso-unidadfinanzas .com
theothersmag .com
firstfiresystems .com
berkleyequine .com "
* https://www.virustotal.com/en-gb/fi...6c20a183c25d38adb8372e48/analysis/1406886192/

** http://camas.comodo.com/cgi-bin/sub...736cb20909489182d3cef6c20a183c25d38adb8372e48

*** http://blog.dynamoo.com/2014/07/new-fax-spam-using-googl-shortening.html

94.23.247.202: https://www.virustotal.com/en/ip-address/94.23.247.202/information/
___

Fake NYC Homicide Suspect SPAM - using goo .gl shortener to spread malware
- http://blog.dynamoo.com/2014/08/new-york-city-police-homicide-suspect.html
1 Aug 2014 - "... This spam is slightly unusual..
From: ALERT@ nyc .gov [ALERT@ static-23-106-230-77.ipcom.comunitel .net]
Date: 1 August 2014 10:43
Subject: Homicide Suspect
Bulletin Headline: HOMICIDE SUSPECT
Sending Agency: New York City Police
Sending Location: NY - New York - New York City Police
Bulletin Case#: 14-10078
Bulletin Author: BARILLAS #9075
Sending User #: 94265
APBnet Version: 287320
The bulletin is a pdf file. To download please follow the link below (Google Disk Drive service):
https ://goo .gl/RwNKEA ...

The link in the email is goo .gl/RwNKEA which goes to unionlawgroup .com/wp-content/images/Documents-43632.zip which is exactly the same payload as used in this spam*...
Blocking unionlawgroup .com is probably a good idea."
* http://blog.dynamoo.com/2014/08/natwest-you-have-new-secure-message.html

50.63.221.1: https://www.virustotal.com/en/ip-address/50.63.221.1/information/

- http://threattrack.tumblr.com/post/93497640483/nypd-homicide-suspect-spam
Aug 1, 2014
78.46.78.137: https://www.virustotal.com/en/ip-address/78.46.78.137/information/
___

Fake Payroll Received by Intuit – PDF malware
- http://myonlinesecurity.co.uk/payroll-received-intuit-fake-pdf-malware/
1 Aug 2014 - "Payroll Received by Intuit pretending to come from Intuit Payroll Services <IntuitPayrollServices@ payrollservices. intuit .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
Dear [customer]
We received your payroll on August 01, 2014 at 09:00 AM EST.
Attached is a copy of your Remittance. Please click on the attachment in order to view it.
Please note the deadlines and status instructions below:
If your payroll is received BEFORE 5 p.m., your Direct Deposit employees will be paid two (2) banking days from the date received or on your paycheck date, whichever is later.
If your payroll is received AFTER 5 p.m., your employees will be paid three (3) banking days from the date received or on your paycheck date, whichever is later.
YOUR BANK ACCOUNT WILL BE DEBITED THE DAY BEFORE YOUR CHECKDATE.
Funds are typically withdrawn before normal banking hours so please make sure you have sufficient funds available by 12 a.m. on the date funds are to be withdrawn.
Intuit must receive your payroll by 5 p.m., two banking days before your paycheck date or your employees will not be paid on time.
Intuit does not process payrolls on weekends or federal banking holidays. A list of federal banking holidays can be viewed at the Federal Reserve website.
Thank you for your business.
Sincerely,
Intuit Payroll Services...

1 August 2014: Remittance.zip (10kb): Extracts to Remittance.scr
Current Virus total detections: 5/52* ... This Payroll Received by Intuit is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...15f79c61a303f86c9dd002a4/analysis/1406908230/

Payroll Received by Intuit
- https://security.intuit.com/alert.php?a=109
8/1/14 - "... receiving -fake- emails with the title 'Payroll Received by Intuit'..."
___

Fake Corporate eFax SPAM ...
- http://blog.dynamoo.com/2014/08/corporate-efax-message-from-unknown-3.html
1 Aug 2014 - "This somewhat mangled spam has a malicious attachment:
Date: Fri, 1 Aug 2014 09:45:45 -0700 [12:45:45 EDT]
From: eFax Corporate [message@ inbound .efax .com]
Subject: Corporate eFax message from "unknown" - 3 page(s)
You have received a 3 page fax at 2014-08-01 10:55:05. * The
reference number for this fax is p2_did1-4724072401-8195088665-159. Thank you for
using the eFax Corporate service! 2014 j2 Global, Inc. All rights reserved. eFax
Corporate is a registered trademark of j2 Global, Inc. This account is subject to the
terms listed in the eFax Corporate Customer Agreement.

Attached is an archive file Fax_912_391233111_941.zip which in turn contains a malicious executable Fax_912_391233111_941.scr which has a VirusTotal detection rate of 10/54*. The Comodo CAMAS report** shows the malware reaching out to the following locations:
94.23.247.202 /0108us1/SANDBOXA/0/51-SP2/0/
94.23.247.202 /0108us1/SANDBOXA/1/0/0/
theyungdrungbon .com/wp-includes/images/0108us1.zip
101romanticcheapdates .com/wp-includes/images/0108us1.zip
Recommended blocklist:
94.23.247.202
theyungdrungbon .com
101romanticcheapdates .com "
* https://www.virustotal.com/en-gb/fi...4fe838594aaa2239c5d4c58d/analysis/1406919623/

** http://camas.comodo.com/cgi-bin/sub...ad74d93a356445b0fce3a4fe838594aaa2239c5d4c58d

94.23.247.202: https://www.virustotal.com/en/ip-address/94.23.247.202/information/
___

Fake Googlebots increasingly used to launch DDoS Attacks
- http://atlas.arbor.net/briefs/index#683046610
Elevated Severity
31 Jul 2014 - "Spoofed Googlebots, Google's search bot software, are increasingly being used to launch application-layer DDoS attacks.
Analysis: The fake Googlebots have also been observed scraping sites, sending spam, and hacking as well. These bots could prove an effective tool, as even well-protected companies with appropriate blocking rules still allow for Google. However, the fake Googlebots are easily identified, as legitimate Googlebots come from a predetermined IP address range. [ http://threatpost.com/phony-googlebots-becoming-a-real-ddos-attack-tool/107317 ] "

:fear:

AplusWebMaster · Aug 4, 2014

Fake "Sup", Fake IRS SPAM, Phish: Barclays ...

FYI...

Fake "Sup" snowshoe SPAM - from 208.71.174.32/27
- http://blog.dynamoo.com/2014/08/sup-snowshoe-spam-from-208711743227.html
4 Aug 2014 - "Here's a strange spam I've been tracking for a couple of days:
Date: Sun, 03 Aug 2014 20:56:48 -0700 [08/03/14 23:56:48 EDT]
From: Olive [olive@ platesat .us]
Subject: Sup ...

The "IMG" is invalid and shows a placeholder.. making you think that it is broken, but in fact it is triggering the "unsubscribe" link in the email. So.. the email automatically unsubscribes its victims? Not exactly. A look at the root directory of www .gonename .us (143.95.38.234 = petyrbaelish .asmallorange .com)... The presence of unsubscribe.dat and unsubscribe.php is a characteristic of Maxprog MaxBulk Mailer which like all mailing list applications can be used for good or evil. MaxBulk Mailer does have an unsubscribe option which stores names the unsubsribe.dat file (hardly secure, I know), and what appears to be happening in this case is the the HTML has been altered slightly to make -everyone- unsubscribe... At the time of writing, over 6800 email addresses have been validated for further spamming, a number that is increasing quite rapidly. Emails are held in plaintext and can be harvested by anyone... No doubt the people who opened this email can look forward to a whole set of additonal spam in their inboxes. All the sending IPs are in the 208.71.174.32/27 range (Network Data Center Host Inc, US). Each IP has a .us domain hosted on it, but the WHOIS details for each domain appear to be -fake- . This attack started last week with a different range of sending addresses in the 188.165.94.176/28 (OVH, France / VertVPS, Canada) range sending victims to a spamvertised site of www .morehex .us which was configured in the same way. All those sites have now been -suspended- . Email subjects in that case were:
What's up?
Hey Sister
G'day
Whoever is running these spam servers has taken enormous pains to hide their identity, and they are also well-resourced enough to be able to rent server farms for a short period until they get terminated... Looking more deeply into the /27 also yields some more domains, all of which have fake or anonymous WHOIS details..
Recommended blocklist:
208.71.174.32/27
gonename .us "
(More detail at the dynamoo uRL above.)
___

Fake BoA SPAM leads to Cryptowall
- http://blog.dynamoo.com/2014/08/bank-of-america-important-documents-spam.html
4 Aug 2014 - "This -fake- BofA spam has a malicious payload:
Date: Mon, 4 Aug 2014 19:57:07 +0800 [07:57:07 EDT]
From: Andrea Talbot [Andrea.Talbot@ bofa .com]
Subject: RE: Important Documents
Please check attached documents regarding your Bofa account.
Andrea Talbot
Bank Of America
817-298-4679 office
817-180-2340 cell Andrea.Talbot@ bofa .com ...

Attached to the message is an archive AccountDocuments.zip which in turn contains the malicious executable AccountDocuments.scr which has a VirusTotal detection rate of 6/54* and the comments indicate that this is a variant of Cryptowall. The Comodo CAMAS report shows that it phones home..
Recommended blocklist:
94.23.247.202
dirbeen .com
ibuildchoppers .com "
* https://www.virustotal.com/en/file/...f6ab3058626880519e2b2f6f/analysis/1407179338/

** http://camas.comodo.com/cgi-bin/sub...e8f82d9e9f36c8faeaffbf6ab3058626880519e2b2f6f

94.23.247.202: https://www.virustotal.com/en/ip-address/94.23.247.202/information/
___

Fake IRS SPAM – 'Fiscal Activity 71363' .doc malware
- http://myonlinesecurity.co.uk/irs-notification-fiscal-activity-71363-word-doc-malware/
4 Aug 2014 - "IRS Notification – Fiscal Activity 71363. pretending to come from International Taxpayer Service <lhopkins@ wm .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers... current bunch of malwares being spread by attempting to use a genuine Word Doc with an embedded macro. This one, once again tries to contact http ://moviebernie1996 .ru/u.exe and download the zbot which has a current virus total detection rate of 5/54*. If you still use an older version of Microsoft Word, then you are at risk of being infected by this. Modern versions, that is 2010 and 2013 have macros disabled by default and are set to display in read only mode by default... aimed at US tax payers who are living or working in UK, because the Address and phone number in the email belong to the American Embassy in London:
> http://www.irs.gov/static_assets/img/logo.png
Here is a report on your early 2014 Federal Tax return report.
Kindly download the attachment to view your report and start
filling for 2014 return as early as second week of July.
Thanks
Internal Revenue Service
24/31 Grosvenor Square
London W1K 6AH
United Kingdom
Tel.Fax.: [44] (207) 672-2808 ...

4 August 2014: Fiscal Activity.Doc Current Virus total detections: 7/52*
This IRS Notification – Fiscal Activity 71363. is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper word file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...22566840bae5cd2659797b2e/analysis/1407132830/
___

Fake BT Digital SPAM
- http://blog.dynamoo.com/2014/08/important-bt-digital-file-spam.html
4 Aug 2014 - "This -fake- BT spam has a malicious attachment:

Screenshot: https://1.bp.blogspot.com/-M2q0aceA...AAADfU/oA8bQYERhKE/s1600/bt-digital-vault.png

The attachment is BT_Digital_Vault_File.zip which contains a malicious executable BT_Digital_Vault_File.exe which has a VirusTotal detection rate of 5/54*... Comodo CAMAS report** ...
Recommended blocklist:
94.23.247.202
amhzconsultancy .com
sintesismark .com
bianconeandwilinsky .com
osteoarthritisblog .com
hopeisnull .comuf .com
grenzland-classic .de "
* https://www.virustotal.com/en-gb/fi...1170680d6a7efd53c296ada8/analysis/1407158959/

** http://camas.comodo.com/cgi-bin/sub...3ed56d531312ad338ac1a1170680d6a7efd53c296ada8

94.23.247.202: https://www.virustotal.com/en/ip-address/94.23.247.202/information/
___

Fake Invoice 2014080420 SPAM
- http://blog.dynamoo.com/2014/08/invoice-2014080420-spam.html
4 Aug 2014 - "This spam has a malicious attachment:
Date: Mon, 04 Aug 2014 20:29:43 +0900 [07:29:43 EDT]
From: Accounts Dept [tolvan.rover@ btinternet .com]
Subject: Invoice 2014080420 dynamoo
This email contains an invoice file for June 2014 - July 2014. Please pay invoice in full in 3 business days and reply to us...

There is an attachment INV_2014080420.zip containing a folder invoice_june2014-july2014.xls which in turn contains a malicious executable invoice_june2014-july2014.xls.scr which has a VirusTotal detection rate of 6/52*. Automated analysis tools are inconclusive..."
* https://www.virustotal.com/en-gb/fi...d73faaabddd9969aff4a6f34/analysis/1407159727/
___

Phish: Booking .com
- http://blog.malwarebytes.org/fraud-scam/2014/08/real-hotel-booking-info-used-in-holiday-phish/
4 Aug 2014 - "... it contained all of their genuine hotel booking information for starters – and claimed to be sent from Booking .com, which happens to be the company they booked their stay through. The information included:
* Correct reservation dates
* Correct hotel name
* Personal information such as name, home address
* Correct invoice amount
The email didn’t stop there – it also asked for payment information (CVV number) and asked for a payment to be -wired- to (what appears to be) a bank in Poland (despite the hotel being in Spain). While it isn’t unusual for payments to show in one location when the hotel is in another – depending on how you do it or which third party you book through, you may find your cash wings its way to an entirely different location – it is a little unusual to see wiring money mentioned and this likely set off alarm bells. The scammers also asked for a scanned copy of the wire transfer deposit – this is often used in 419 / wire scams, because they’ll take the scan to the place where the money it sent and pretend to be the victim or a relative before wandering off with a tidy stack of notes. The outlook on this one right now seems to be that the hotel has been targeted in some way rather than the booking website, and likely involves social engineering. If you do have a trip planned and receive -emails- about -payments- , phone the hotel and / or booking agents -directly- instead of replying – as you can see, these mails are 100% accurate and will probably brush aside many “But what about…” -scam- flags recipients would ordinarily raise. Another type of email -scam- to steer clear of, then..."
___

Backdoor Techniques in Targeted Attacks
- http://blog.trendmicro.com/trendlabs-security-intelligence/backdoor-techniques-in-targeted-attacks/
Aug 4, 2014 - "Backdoors are an essential part of targeted attacks, as they allow an external threat actor to exercise control over any compromised machines. These allow the threat actor to collect information.. various targeted attacks have showed that a wide variety of tactics are used by backdoors to carry out their routines, as well as remain -undetected- by network administrators and security products... Using free services for C&C functions is not new; we noted just recently how Dropbox was being used in a similar way... resources to help deal with targeted attacks can be found in our targeted attacks hub*."
* http://about-threats.trendmicro.com/us/threat-intelligence/targeted-attacks/
___

Fake IRS e-Help Desk Spam
- http://threattrack.tumblr.com/post/93788458323/irs-e-help-desk-spam
Aug 4, 2014 - "Subjects Seen:
E-mail Receipt Confirmation - Ticket#SD3784695 [/i]
Typical e-mail details:
The IRS e-help Desk has received your email on 06/20/14. A case has been opened in response to your question or issue.
Your case ID is : SD3784695
Details about this case has been attached.
If additional contact is necessary, please reference this case ID.
You will receive a reply within two business days.
Thank you for contacting the IRS e-help Desk...

Malicious File Name and MD5:
SD08042014.scr (8AB01278965D09ACA5F2CE175756DB8C)
SD3784695.zip (108D153B71D2E8C66A2FA54F13317E18)

Screenshot: https://gs1.wac.edgecastcdn.net/801...adf329410/tumblr_inline_n9sk7qmd3R1r6pupn.png

Tagged: IRS, Upatre
___

Fake iTunes Order Acknowledgment Spam
- http://threattrack.tumblr.com/post/93789175793/itunes-order-acknowledgment-spam
Aug 4, 2014
"Screenshot: https://gs1.wac.edgecastcdn.net/801...f21a2112c/tumblr_inline_n9skm8SCM11r6pupn.png
Subjects Seen:
Order Number: W6269799
Typical e-mail details:
Dear Apple Member,
Thank you for shopping Apple.com. Please review your order details below and retain this email for your records. You will receive a shipping confirmation email once your order has shipped.
For more information please check attached PDF invoice.

Malicious File Name and MD5:
W6269799.scr (8AB01278965D09ACA5F2CE175756DB8C)
W6269799.zip (1B14810142A86D7F2B63D4E23F586274)

Tagged: iTunes, Upatre
___

Phish: Barclays - "Your account might be compromised"
- http://myonlinesecurity.co.uk/account-might-compromised-barclays-phishing/
4 Aug 2014 - "Your account might be compromised pretending to come from Barclays Current Accounts <barclays@ securesuite .net> is one of a series of currently spreading emails that are intended to get your bank log in details. They ask you to open the attached zip & fill in the html form inside it. That of course will end up with you having your bank, credit card and email details -stolen- and used by criminals. -If- you fill in the form, it then sends you on to a genuine Barclays log in page, where you don’t realise that you have filled in a form & details were sent -elsewhere- ...
Dear Customer,
We recently have determined that different computers have logged in your Barclays
account, and multiple password failures were present before the logons.
For your security we have temporary suspended your account.
Please download the document attached to this email and fill carefully.
If you do not restore your account by August 05, we will be forced to suspend
your account indefinitely, as it may have been used for fraudulent purposes.
Do not ignore this message is for your security.
We apologize for any inconvenience.
Yours sincerely,
Jessica M. Klaus,
IT Assistant,
Barclays Current Accounts...

:fear::fear:

AplusWebMaster · Aug 5, 2014

Fake iTunes SPAM, Phish: Gumtree ...

FYI...

Fake iTunes Order SPAM - PDF malware
- http://myonlinesecurity.co.uk/itunes-order-number-w8057748-fake-pdf-malware/
5 Aug 2014 - "iTunes Order Number : W8057748 pretending to come from iTunes <store@apple.com>is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
iTunes Order Acknowledgment
Order Number: W8057748
Ordered on August 04, 2014
Dear Apple Member,
Thank you for shopping Apple.com. Please review your order details below and retain this email for your records. You will receive a shipping confirmation email once your order has shipped.
For more information please check attached PDF invoice...

5 August 2014: W8057748.zip (10kb): Extracts to W08042014.scr
Current Virus total detections: 25/54* . This iTunes Order Number : W8057748 is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...e3faca7585bcd9ed897e8262/analysis/1407216005/

- http://threattrack.tumblr.com/post/93789175793/itunes-order-acknowledgment-spam
4 Aug 2014
Screenshot: https://gs1.wac.edgecastcdn.net/801...f21a2112c/tumblr_inline_n9skm8SCM11r6pupn.png
___

Dyreza / Pushdo outbreak - QuickBooks, Dun & BradStreet and iTunes themed emails
- http://stopmalvertising.com/spam-sc...-dun-bradstreet-and-itunes-themed-emails.html
5 Aug 2014 - "Yesterday we received several unsolicited emails appearing to be either from QuickBooks, Dun & BradStreet and iTunes. The emails respectively arrive with the subject line "Payment Overdue", "New Company Complaint - 4086489" and "Order Number: W0666513". All emails come with an attachment that the recipient is invited to open. Each file inside the ZIP archive poses as a -PDF- no matter what their file extension is. That’s why you need to make sure that Windows Explorer is configured to show file extensions and -never- trust a file by its icon. The first stage payload of each mail is -Upatre- , its unique objective is to load malware on the compromised computer. Although the executable is named differently, the Upatre payload of the QuickBooks invoice and the Dun & BradStreet complaint share the same MD5 hash. In every single case Upatre downloads Dyreza, a Trojan banker and the spambot Pushdo, a dropper for Cutwail. The Pushdo sample is identical in the three spam campaigns. The Dyreza sample from the iTunes campaign is different to the two other campaigns..."
___

Fake Order confirmation SPAM - PDF malware
- http://myonlinesecurity.co.uk/order-confirmation-fake-pdf-malware/
5 Aug 2014 - ""Order confirmation pretending to come from Scott Powell is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
Attached is a list of items we have recently supplied that require the prices to be confirmed.
Regards
Scott Powell

5 August 2014 Order 9680748.zip (44kb) : Extracts to Order 2661788.exe
Current Virus total detections: 1/51* ... This Order confirmation is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...08cbda5ae8294e2f2b563869/analysis/1407237866/
___

Fake Invoice June2014-July2014 SPAM
- http://blog.dynamoo.com/2014/08/invoice-20146308660-june-2014-july-2014.html
5 Aug 2014 - "This -spam- is very like this one*, but has a different payload:
Date: Tue, 05 Aug 2014 17:18:39 +0700 [06:18:39 EDT]
From: Accounts Dept [optique@ hotmail .com]
Subject: Invoice 20146308660 June 2014 - July 2014 dynamoo
This email contains an invoice file for June 2014 - July 2014. Please pay invoice in full in 3 business days and reply to us.

Attached is an archive ID_20146308660.zip which contains a folder invoice__details_June-July.xls which in turn contains a malicious executable invoice__details_June-July.xls.scr which has a VirusTotal detection rate of just 2/54**. According to the CAMAS report***, the malware then downloads a further component... This second stage has a VirusTotal detection rate of 9/54****. Automated analysis tools are inconclusive..."
(Long 'Recommended blocklist' at the dynamoo URL above.)
* http://blog.dynamoo.com/2014/08/invoice-2014080420-spam.html

** https://www.virustotal.com/en-gb/fi...b13ff7e46412a8fa791e997b/analysis/1407242827/

*** http://camas.comodo.com/cgi-bin/sub...2c0cd469dddae67102effb13ff7e46412a8fa791e997b

**** https://www.virustotal.com/en-gb/fi...d7c9e4c03c0cf8915e85f403/analysis/1407244040/
___

Phish: Gumtree 'Account Locked' Scam
- http://www.hoax-slayer.com/gumtree-phishing-scam.shtml
Aug 5, 2014 - "Email purporting to be from online buying and selling website Gumtree claims that you Gumtree account has been locked for security reasons and you must proceed with a verification process to restore access. The email is -not- from Gumtree. It is a phishing scam designed to trick you into giving your personal and financial information to Internet criminals.

Screenshot: http://www.hoax-slayer.com/images/gumtree-phishing-scam-1.jpg

According to this email, which claims to be from online buying and selling portal Gumtree, your Gumtree account has been locked for security reasons. The email urges you to download a file to start a verification process that will restore account access... Clicking the link in the scam email will download a .zip file that contains a .html file. Clicking the .html file will open a -fake- Gumtree login page in your browser. -If- you enter you login details on the fake page, you may then be taken to a second page that asks you to provide address and ID information as well as credit card details... information submitted on the -bogus- webpages will be collected by criminals and used for financial fraud and identity theft. The criminals may also use the stolen information to hijack your Gumtree account and use it for further fraudulent activities..."

:fear:

AplusWebMaster · Aug 6, 2014

Fake email SPAM - attachment malware

FYI...

Fake email SPAM - Word Doc attachment malware
- http://myonlinesecurity.co.uk/change-percent-word-doc-malware/
6 Aug 2014 - "'Change in percent' pretending to come from mnmorgan@ tribune .com is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email addresses are either faked or belong to users with infected computers or servers, that various bots have compromised. Since posting this, I have received several other copies of the -malware- email from different senders and all with different names and phone numbers in the body... once again a genuine word doc with an embedded macro that acts as a downloader to download a full blown zbot from http ://bernisuperfilm .ru/uupdate2.exe* which has a current virus total detection rate of 3/54** ... Office 2010 and Office 2013 have macros disabled by default and are set to display in read only mode by default. That -stops- any -macros- or embedded programs from running... Email reads:
Hi [redacted]
Yield reduced. We ask you for information to the attached document to pass to your superiors.
Riojas Imelda
Tel./Fax.: +44 171 6825484

6 August 2014: Information.zip : Extracts to Information.doc
Current Virus total detections: 2/44*** ... accidentally open it and be infected...."
* 77.28.100.73: https://www.virustotal.com/en-gb/ip-address/77.28.100.73/information/

** https://www.virustotal.com/en/file/...86ddcea96aed45063af976ab/analysis/1407273243/

*** https://www.virustotal.com/en-gb/fi...bd780c24fffe4e4ad3bbb7ab/analysis/1407295528/
___

Fake 'Benefit Elections' SPAM – PDF malware
- http://myonlinesecurity.co.uk/benefit-elections-fake-pdf-malware/
6 Aug 2014 - "'Benefit Elections' pretending to come from Landon.Carter@ adp .com is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
Please review the attached CBE form, If you require changes to the options shown, please contact me right away so that we may address your concerns. We will record your elections in our system and provide you a final Client Confirmation Statement for your review.
Please sign and send it back.
Regards,
ADP TotalSource Benefits Team

6 August 2014 : CBEform.zip ( 8kb) : Extracts to CBEform.exe
Current Virus total detections: 0/54* ... This 'Benefit Elections' is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...148e689bfb8356db6ed97e52/analysis/1407339197/
___

Fake Companies House SPAM
- http://blog.dynamoo.com/2014/08/companies-house-case-4620571-spam.html
6 Aug 2014 - "This -fake- Companies House spam has a malicious attachment:
Date: Wed, 6 Aug 2014 19:45:59 +0700 [08:45:59 EDT]
From: Companies House [WebFiling@ companieshouse .gov .uk]
Subject: RE: Case 4620571
The submission number is: 4620571
For more details please check attached file.
Please quote this number in any communications with Companies House.
All Web Filed documents are available to view / download for 10 days after their
original submission. However it is not possible to view copies of accounts that
were downloaded as templates.
Companies House Executive Agency may use information it holds to prevent
and detect fraud. We may also share such information, for the same purpose,
with other Organizations that handle public funds...

Attached is a file Case_4620571.zip which in turn contains a malicious executable Case_4620571.scr which has a VirusTotal detection rate of 11/53*. Automated analysis tools... show that the malware reaches out to... locations which are good candidates for blocking:
64.191.43.150
94.23.247.202
feelgoodframesstore .com
beeprana .com
upscalebeauty .com "
* https://www.virustotal.com/en-gb/fi...7e660dce2660039cd0151644/analysis/1407338507/

94.23.247.202: https://www.virustotal.com/en-gb/ip-address/94.23.247.202/information/
___

US-based Tech Support SCAMS ...
- http://blog.malwarebytes.org/fraud-scam/2014/08/beware-of-us-based-tech-support-scams/
Aug 6, 2014 - "... last month, we stumbled upon -fake- warning pages urging users to call a number for ‘emergency tech support’. When we rang the number, we were surprised to hear that the technician sounded American. It turned out that their company was based in ‘the sunshine state‘ of Florida, USA... The following are fraudulent sites that display a warning message and play -sound- effects with the goal of scaring the user and making them believe that their computer is infected:
> http://cdn.blog.malwarebytes.org/wp-content/uploads/2014/07/aredwarning.png
...
> http://cdn.blog.malwarebytes.org/wp-content/uploads/2014/07/othererror.png
... There is an ongoing and strong affiliate campaign pushing these warnings. You may come across them as you are browsing the net...
A -bogus- sales pitch: Upon seeing the warning message, many people may feel as though there is really something wrong with their machine. In fact, the pages themselves are designed in such a way that you cannot close them by clicking the ‘X’. Instead you need to forcefully ‘kill’ the browser either via TaskManager or other Windows utilities. Those who take the bait will call the 1-800 number to speak with a technician and this is where their real troubles begin. The warning page is essentially a launchpad for the technician to talk about online threats, giving examples of recent attacks and eventually scare the user... This is -not- true of course. Microsoft has stated many times that “You will -never- receive a legitimate call from Microsoft or our partners to charge you for computer fixes*“.
* http://www.microsoft.com/security/online-privacy/avoid-phone-scams.aspx
... US-based companies are much less likely to cold-call people because of the risks of getting caught, not to mention the fact that this practice has such a bad reputation...
> http://cdn.blog.malwarebytes.org/wp-content/uploads/2014/07/flag.png
... The technician was friendly, spoke proper English and the work was done in a timely and efficient manner. But, what these victims may not see and what we decided to expose here, is how some dishonest tech support companies have trained their staff to fabricate lies in order to -scare- their prospect customers into paying a lot of money for a service they may actually -not- need. At the end of the day, this is a tough issue because there are a lot of people out there (especially the elderly) that do need some assistance with their computers and often don’t have many options to get it. If they look for it online, chances are that they will get ripped off..."
(More detail at the malwarebytes URL at the top.)
___

Revenue and Customs Notice Spam
- http://threattrack.tumblr.com/post/93966679578/hm-revenue-and-customs-notice-of-underreported-income
Aug 6, 2014 - "Subjects Seen:
Notice of Underreported Income
Typical e-mail details:
Taxpayer ID: ufwsd-000005925000UK
Tax Type: Income Tax
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax income statement on HM Revenue and Customs ( HMRC )
Please complete the attached form
HM Revenue and Customs

Malicious File Name and MD5:
ufwsd-000004421455UK.scr (A888BD28BE24D6A59D132B66E5E1AEBB)
ufwsd-000005925000UK.zip (33809621F99D44BEBC07E7D9B2D092C9)

Screenshot: https://gs1.wac.edgecastcdn.net/801...dd6293087/tumblr_inline_n9vy9kTNKT1r6pupn.png

Tagged: HMRC, Upatre
___

Hacks amass over a Billion internet passwords
- http://www.nytimes.com/2014/08/06/t...an-a-billion-stolen-internet-credentials.html
Aug 5, 2014 - "A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses..."
- https://isc.sans.edu/diary.html?storyid=18487
2014-08-06 - "Some of it may be hype. But no matter if 500 Million, 1.5 Billion or even 3.5 Billion passwords have been lost... given all the password leaks we had over the last couple years it is pretty fair to assume that at least -one- of your passwords has been compromised at some point..."
- http://krebsonsecurity.com/2014/08/qa-on-the-reported-theft-of-1-2b-email-accounts/
6 Aug 2014 - "... Q: Should I be concerned about this? A: ... If you are the type of person who re-uses passwords at multiple sites — including email accounts — then the answer is yes. If you re-use your email password at another site and that other site gets -hacked- there is an excellent chance that cyber crooks are plundering your inbox and using it to spam your friends and family to spread malware and to perpetuate the cybercrime food chain... Your email account may be worth far more than you imagine:
> http://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1-600x333.jpg

:fear:

AplusWebMaster · Aug 6, 2014

FireEye/Fox-IT - free keys to unlock CryptoLocker

FYI...

FireEye and Fox-IT - free keys designed to unlock systems infected by CryptoLocker
>> https://www.decryptcryptolocker.com/
Aug 6, 2014 - "Please provide your email address [1] and an encrypted file [2] that has been encrypted by CryptoLocker. This portal will then email you a master decryption key along with a download link to our recovery program that can be used together with the master decryption key to repair all encrypted files on your system.
- Please note that each infected system will require its own unique master decryption key. So in case you have multiple systems compromised by CryptoLocker, you will need to repeat this procedure per compromised system.
- Notes:
[1] Email addresses will not be used for marketing purposes, nor will they be in any way stored by FireEye or Fox‑IT.
[2] You should only upload encrypted files that do not contain any sensitive or personally identifiable information..."

- http://www.fireeye.com/blog/corpora...-information-for-cryptolocker-decryption.html
Aug 6, 2014
- http://www.fireeye.com/blog/wp-content/uploads/2014/08/crypto2.png

- https://www.fox-it.com/en/press-releases/fireeye-fox-announce-new-service-help-cryptolocker-victims/
6 Aug 2014

:bigthumb:

AplusWebMaster · Aug 7, 2014

Fake CDS SPAM...

FYI...

Fake CDS invoice SPAM
- http://blog.dynamoo.com/2014/08/cds-group-cdsgroupcouk-fake-invoice-spam.html
7 Aug 2014 - "This spam email pretends to be from the CDS Group. CDS are a wholly legitimate company and are NOT sending these emails, and their computer systems have NOT been compromised. However, the emails do contain a malicious attachment and should be deleted... CDS have a notice about these emails on their site*. This is a sample email:

Screenshot: https://3.bp.blogspot.com/-aOVkMDDBd-M/U-NbqEXZXDI/AAAAAAAADiM/hTwhU4I-cL0/s1600/cds.png

Attached is a archive file CDS_241-28195.zip which contains a folder invoice_cdsgroup_799543.xls which in turn contains a malicious executable invoice_cdsgroup_799543.xls.scr which has a very low detection rate at VirusTotal of 3/54**. Automated analysis tools are inconclusive at the moment..."
* http://www.cdsgroup.co.uk/cyber-crime.html

** https://www.virustotal.com/en-gb/fi...da6c033e462c589a6af39342/analysis/1407408295/

- http://threattrack.tumblr.com/post/94065865938/cds-invoice-spam
Aug 7 2014
- https://gs1.wac.edgecastcdn.net/801...814022e18/tumblr_inline_n9xwd605XI1r6pupn.png
Tagged: cds, Lerspeng
___

Vawtrak sites to block
- http://blog.dynamoo.com/2014/08/vawtrak-sites-to-block.html
7 Aug 2014 - "I found these domains and IPs today while investigating a machine apparently infected with Vawtrak* (aka Tepfer), most of them seem to be active:
http ://80.243.184.239 /posting.php
http ://80.243.184.239 /viewforum.php
http ://146.185.233.97 /posting.php
http ://146.185.233.97 /viewforum.php
http ://ipubling .com/posting.php
http ://ipubling .com/viewforum.php
http ://magroxis .com/posting.php
http ://magroxis .com/viewforum.php
http ://maxigolon .com/viewforum.php
http ://terekilpane .com/viewforum.php
Some of these domains are associated with the email address ctouma2@ gmail .com. You could block the sites individually, but because the sites are not isolated, I would personally recommend using the following blocklist:
146.185.233.0/24
80.243.184.224/27
The 146.185.233.0/24 range is allocted to "Cherepanova" in Russia. 80.243.184.224/27 is Redstation in the UK."
* http://about-threats.trendmicro.com/malware.aspx?language=au&name=BKDR_VAWTRAK.YZY

:fear:

AplusWebMaster · Aug 8, 2014

Fake RBS SPAM, AmEx PHISH, Resume SPAM ...

FYI...

Fake RBS SPAM
- http://blog.dynamoo.com/2014/08/rbs-re-incident-im03393549-spam.html
8 Aug 2014 - "This fake RBS spam has a malicious attachment:
Date: Thu, 24 Jul 2014 09:33:37 GMT [07/24/14 05:33:37 EDT]
From: Annie Wallace[Annie.Wallace@ rbs .co.uk]
Subject: RE: Incident IM03393549
Good Afternoon ,
Attached are more details regarding your account incident. Please extract the attached
content and check the details.
Please be advised we have raised this as a high priority incident and will endeavour to
resolve it as soon as possible. The incident reference for this is IM03393549.
We would let you know once this issue has been resolved, but with any further questions
or issues, please let me know.
Kind Regards, ...

The attachment is IM03393549.zip containing a malicious executable IM008082014.scr which has a VirusTotal detection rate of 15/42*. The CAMAS report** shows that the malware connects to the following locations to download additional components:
94.23.247.202/n0808uk/SANDBOXA/0/51-SP2/0/
94.23.247.202/n0808uk/SANDBOXA/1/0/0/
quesoslaespecialdechia .com/Scripts/n0808uk.zip
energysavingproductsinfo .com/wp-content/uploads/2014/08/n0808uk.zip
The exact nature of the malware is not known, but it is most likely a banking Trojan or Cryptowall.
Recommended blocklist:
94.23.247.202
quesoslaespecialdechia .com
energysavingproductsinfo .com "
* https://www.virustotal.com/en-gb/fi...9b01b426a4663b54ab14b0a3/analysis/1407490764/

** http://camas.comodo.com/cgi-bin/sub...7d06b884947331ca263fe9b01b426a4663b54ab14b0a3
___

Fake Resume SPAM - malicious attachment
- http://blog.dynamoo.com/2014/08/fw-resume-spam-has-malicious-attachment.html
8 Aug 2014 - "This terse spam is malicious:
Date: Fri, 8 Aug 2014 05:57:02 +0700 [08/07/14 18:57:02 EDT]
From: Janette Sheehan [Janette.Sheehan@ linkedin .com]
Subject: FW: Resume
Attached is my resume, let me know if its ok.
Thanks,
Janette Sheehan

Attached is an archive Resume.zip which in turn contains a malicious executable Resume.scr. This has a VirusTotal detection rate of 24/54*. The CAMAS report** shows that the malware attempts to phone home to the following locations:
94.23.247.202 /0708stat/SANDBOXA/0/51-SP2/0/
94.23.247.202 /0708stat/SANDBOXA/1/0/0/
hngdecor .com/wp-content/uploads/2013/10/cw2800.zip
welfareofmankind .com/underconst/css/cw2800.zip
Recommended blocklist:
94.23.247.202
hngdecor .com
welfareofmankind .com "
* https://www.virustotal.com/en-gb/fi...cd75b93e858b27ebf5a55d5b/analysis/1407493005/

** http://camas.comodo.com/cgi-bin/sub...6a4eb81224dad93d7129bcd75b93e858b27ebf5a55d5b

94.23.247.202: https://www.virustotal.com/en-gb/ip-address/94.23.247.202/information/
___

Fake HMRC tax SPAM - PDF malware
- http://myonlinesecurity.co.uk/hmrc-...4dew-nasm-cbcg-rc6-received-fake-pdf-malware/
7 Aug 2014 - "HMRC taxes application with reference 4DEW NASM CBCG RC6 received pretending to come from noreply@ taxreg .hmrc .gov .uk is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
The application with reference number 4DEW NASM CBCG RC6 submitted by you or your agent to register for HM Revenue & Customs (HMRC) taxes has been received and will now be verified. HMRC will contact you if further information is needed.
The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Vodafone in partnership with Symantec. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

7 August 2014: 4DEW NASM CBCG RC6.zip (8kb) Extracts to 4DEW NASM CBCG RC6.scr
Current Virus total detections: 0/54* . This HMRC taxes application with reference 4DEW NASM CBCG RC6 received is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...9b01b426a4663b54ab14b0a3/analysis/1407447014/
___

AmericanExpress - PHISH
- http://blog.dynamoo.com/2014/08/security-concern-on-your.html
8 Aug 2014 - "This -fake- AmEx spam appears to lead to a phishing site on multiple URLs:

Screenshot: https://3.bp.blogspot.com/-bC41J5WRhtM/U-TX8pXaqxI/AAAAAAAADig/pMBuwt4hrfk/s1600/amex-phish.png

In this case the link goes to a phishing site... but there seem to be a bunch of them at the moment... IPs in use are:
91.219.29.35 (FLP Kochenov Aleksej Vladislavovich, Ukraine)
188.240.32.75 (SC CH-NET SRL, Romania)
I recommend blocking these IPs (
91.219.29.35
188.240.32.75 "

91.219.29.35: https://www.virustotal.com/en/ip-address/91.219.29.35/information/

188.240.32.75: https://www.virustotal.com/en/ip-address/188.240.32.75/information/

- http://myonlinesecurity.co.uk/american-express-safe-key-phishing/
8 Aug 2014
___

Fake e-on energy SPAM - PDF malware
- http://myonlinesecurity.co.uk/e-energy-unable-process-recent-bill-payment-fake-pdf-malware/
8 Aug 2014 - "e-on energy Unable to process your most recent bill payment pretending to come from E ON Energy <noreply@ eonenergy .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email reads:
... Dear customer,
This e-mail has been sent to you to inform you that we were unable to process your most recent payment of bill.
Please check attached file for more detailed information on this transaction.
IMPORTANT: The actual delivery date may vary from the Delivery By date estimate. Please make sure that there are sufficient available funds in your account to cover your payment beginning a few days before Delivery By date estimate and keep such funds available until the payment is deducted from your account.
If we fail to process a payment in accordance with your properly completed instructions, we will reimburse you any late-payment-related fees.
We apologize for any inconvenience this may cause.

8 August 2014: e-ON-Energy-Bill.zip (15kb) : Extracts to e-ON-Energy-Bill.exe
Current Virus total detections: 7/54* . This e-on energy Unable to process your most recent bill payment is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...bcf95522629c49104dbcd87f/analysis/1407509103/

:fear:

AplusWebMaster · Aug 11, 2014

Fake BoA, Citi SPAM ...

FYI...

Fake BoA SPAM - PDF malware
- http://myonlinesecurity.co.uk/bank-...eeded-requested-alert-limit-fake-pdf-malware/
11 Aug 2014 - "Bank of America Alert: A Check Exceeded Your Requested Alert Limit pretending to come from Bank of America Alert <onlinebanking@ ealerts.bankofamerica .com> is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... Email looks like:
Activity Alert
A check exceeded your requested alert limit
We’re letting you know a check written from your account went over the limit you set for this alert.
For more details please check attached file
Amount: $32,095.35
Check number: 00000006756
Transaction date: 08/11/2014
You can sign in to Online or Mobile Banking to review this activity...
Security Checkpoint
To confirm the authenticity of messages from us, always look for this Security Checkpoint.
Remember: Always look for your SiteKey® before entering your Passcode. We’ll ask you for your Online ID and Passcode when you sign in.
This is a service email from Bank of America. Please note that you may receive service emails in accordance with your Bank of America service agreements..

11 August 2014: report081114_6897454147412.zip(10kb) : Extracts to report081114_6897454147412.exe
Current Virus total detections: 2/54* ... This Bank of America Alert: A Check Exceeded Your Requested Alert Limit is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...a58c95ac7ebd23e69a15a93a/analysis/1407773230/
___

Citi Corp Spam
- http://threattrack.tumblr.com/post/94443758323/citi-corp-application-approved-spam
Aug 11, 2014 - "Subjects Seen:
RE: Application Approved
Typical e-mail details:
Your documents are ready , please sign them and email them back.
Thank you
Henri Foley
Level III Account Management

Malicious File Name and MD5:
application _apprd_93447836734346.exe (CAD7B09903F7646EC37E4014DD6E70E4)
application _apprd_93447836734346.zip (0B4A28D6737B9E27E7BF5B98DBBE6B84)

Screenshot: https://gs1.wac.edgecastcdn.net/801...c2ef4bb0e/tumblr_inline_na5hr0GBaE1r6pupn.png

Tagged: Citi, Upatre
___

Public Wi-Fi is safe?? ...
- http://nakedsecurity.sophos.com/2014/08/11/most-people-think-public-wi-fi-is-safe-seriously/
11 Aug 2014 - "... most people still don't understand the potential dangers of public and/or free Wi-Fi, despite doom and gloom headlines about the dangers, which include these:
- A US trio who attacked companies by wardriving - i.e., driving around, scanning for poorly protected wireless networks. Between that and breaking in to install keyloggers, they bilked companies of a total of $3 million (£1.8 million).
- An unsecured Wi-Fi home connection that led to a heavily-armed police SWAT team raiding the wrong home, including breaking down the door of a house, smashing windows and tossing a flashbang stun grenade into a living room.
- Facebook accounts of five US politicians being hijacked after they accessed a free, open, wireless Wi-Fi network.
And those are just a tiny selection of the cherries on that bountiful Wi-Fi tree. Of course, there is also the problem of protecting privacy on public Wi-Fi. In just the past year, we learned that businesses are using Wi-Fi to build shopper profiles on us, and in-flight WiFi providers have been helping feds spy on us..."
(More detail at the sophos URL above.)
Sophos - wireless security myths Video 4:26: https://www.youtube.com/watch?v=W-NNq9qoORw

:fear:

AplusWebMaster · Aug 12, 2014

Netflix Phish, Fake Order SPAM ...

FYI...

Fake Netflix email / Phish
- http://myonlinesecurity.co.uk/netflix-account-requires-validation-nvf-837-phishing/
12 Aug 2014 - "Your Netflix Account Requires Validation [NVF-837] is an attempt to get access to your Netflix Account... The phishing website in this example is so closely named to the genuine Netflix site, that almost anybody could be fooled by it http ://netflix-validate .com
Email looks like:
Dear Customer,
We recently failed to validate your payment information we hold on record for your account, therefore we need to ask you to complete a brief validation process in order to verify your billing and payment details. Click here to verify your accountFailure to complete the validation process will result in a suspension of your netflix membership.We take every step needed to automatically validate our users, unfortunately in this case we were unable to verify your details. The process will only take a couple of minutes and will allow us to maintain our high standard of account security.
Netflix Support Team ...

Following the link in this Your Netflix Account Requires Validation email or other spoofed emails takes you to a website that looks exactly like the real Netflix site... then through loads of steps to input a lot of private and personal information, including billing address, date of birth and then to an update payment page, where they want credit card and bank details. Not only will this information enable them to use your Netflix account, but also your Bank Account, credit card details, Email details, webspace..."

192.99.188.111: https://www.virustotal.com/en/ip-address/192.99.188.111/information/

Diagnostic page for AS16276 (OVH)
- https://www.google.com/safebrowsing/diagnostic?site=AS:16276
"... over the past 90 days, 2638 site(s)... served content that resulted in malicious software being downloaded and installed without user consent. The last time Google tested a site on this network was on 2014-08-11, and the last time suspicious content was found was on 2014-08-11... we found 373 site(s) on this network.. that appeared to function as intermediaries for the infection of 821 other site(s)... We found 745 site(s)... that infected 65282 other site(s)..."
___

Fake Order SPAM
- http://myonlinesecurity.co.uk/order-take-8753884-fake-pdf-malware/
12 Aug 2014 - "Order take 8753884 is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This email with subject of Order take < random numbers> arrives with just a subject and no email content except an attachment. It appears to come from various random names at various random companies.

12 August 2014: order 1530875.zip (37 kb) : Extracts to Order-8991617.exe
Current Virus total detections: 1/54* . This Order take 8753884 is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...f126f9921d3c003644eb5eb2/analysis/1407832220/
___

Fake new picture or video SPAM – PDF malware
- http://myonlinesecurity.co.uk/new-picture-video-message-fake-pdf-malware/
12 Aug 2014 - "A new picture or video message pretending to come from getmyphoto@ vodafone .co.uk is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This one wants you to download the -malware- via a tiny URL link in the email, there is no actual attachment. Email looks like:
You have received a picture message from mobile phone number +447584905118
GET MY FOTO
Please note, the free reply expires three days after the original message is sent from the Vodafone network.
Vodafone Service

12 August 2014: f679RqP75G.exe - Current Virus total detections: 0/53*
This 'A new picture or video message' is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...6007a286d95c24cd4700bd40/analysis/1407835450/
___

Fake IRS phish...
- http://myonlinesecurity.co.uk/irs-get-refund-card/
12 Aug 2014 - "IRS Get Refund On Your Card pretending to come from IRS <refund@ irs .gov> is one of the phishing attempts to get your bank and credit card information. Email looks like:
We are writing to you because your federal Tax payment (ID: 66116572), recently sent is available for refund.
For your security, new charges on the accounts listed above may be declined. If applicable, you should advise any Additional Card Member(s) on your account that their new charges may also be declined.
For more information, please visit the following link
– https ://sa.www4.irs .gov/irfof/lang/en/irfofgetstatus.jsp?reenter=true
Your prompt response regarding this matter is appreciated.
Sincerely,
IRS Refund Team

Following the link in this 'IRS Get Refund On Your Card' email or -other- spoofed emails takes you to a website that looks exactly like the real IRS site... then through loads of steps to input a lot of private and personal information, including billing address, date of birth and then to an update payment page, where they want credit card and bank details... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or follow links in them..."

:fear::fear:

SPAM frauds, fakes, and other MALWARE deliveries...

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member