SPAM frauds, fakes, and other MALWARE deliveries...

AplusWebMaster · Nov 1, 2016

Fake 'Transaction declined', 'New Fax', 'Your Invoice' SPAM, Win 0-day, Malvertising

FYI...

Fake 'Transaction declined' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/malspam-email-transaction-declined-delivers-locky/
1 Nov 2016 - "... Locky downloader... an email with the subject of 'Transaction declined' coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with transaction-details_ containing a VBS file that pretends to be a PDF... One of the emails looks like:
From: Elena Cooper <Cooper52780@ centraldetraducao .com>
Date: Thu 01/09/2016 19:22
Subject: Transaction declined
Attachment: transaction-details_e78be58f7.zip
Dear [redacted],
This is to inform that the transaction you made yesterday is declined.
Please look through the attachment for the verification of the card details.
Best Regards,
Elena Cooper

Manual decoding of this slightly obfuscated vbs script shows Download locations are:
http ://17173wang .com/f6w0p
http ://cdxybg .com/iribzm
http ://51qudu .com/mqy2pj4
http ://sonsytaint .com/4mgxlrf
http ://koranjebus .net/4rwg5
1 November 2016: paytransaction-details_e78be58f7.zip: Extracts to: transaction_details_39B163E4_PDF.vbs
delivers [VirusTotal 8/55*].. f6w0p [VirusTotal 7/55**]. Neither MALWR nor Payload Security[3] seem able to actually get the download locations or any payload in these VBS files... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...c99b1da567baaa3d6db6bbe1/analysis/1477997125/

** https://www.virustotal.com/en/file/...03d4fb59419ec9973ee12a66/analysis/1477997325/

3] https://www.hybrid-analysis.com/sam...93dc99b1da567baaa3d6db6bbe1?environmentId=100

17173wang .com: 120.27.107.115: https://www.virustotal.com/en/ip-address/120.27.107.115/information/
cdxybg .com: 125.88.190.31: https://www.virustotal.com/en/ip-address/125.88.190.31/information/
51qudu .com: 118.123.18.92: https://www.virustotal.com/en/ip-address/118.123.18.92/information/
sonsytaint .com: 67.171.65.64: https://www.virustotal.com/en/ip-address/67.171.65.64/information/
138.201.244.4: https://www.virustotal.com/en/ip-address/138.201.244.4/information/
koranjebus .net: 67.171.65.64: https://www.virustotal.com/en/ip-address/67.171.65.64/information/
138.201.244.4: https://www.virustotal.com/en/ip-address/138.201.244.4/information/

- http://blog.dynamoo.com/2016/11/malware-spam-this-is-to-inform-that.html
1 Nov 2016 - "This -fake- financial spam leads to Locky ransomware:
Subject: Transaction declined
From: Chandra Frye
Date: Tuesday, 1 November 2016, 10:48
Dear [redacted],
This is to inform that the transaction you made yesterday is declined.
Please look through the attachment for the verification of the card details.
Best Regards,
Chandra Frye

The name of the sender will vary. Attached is a ZIP file (e.g. transaction-details_4688d047f.zip) containing a malicious VBS script (e.g. transaction_details_63EC6F26_PDF.vbs)... communicates with the URLs below, but you can be sure that there are many more examples:
51qudu .com/mqy2pj4
bjzst .cn/qgq4dx
danapardaz .net/zrr8rtz
litchloper .com/66qpos7m
creaciones-alraune .es/dx8a5
adasia .my/f5qyi10
alecrim50 .pt/g28w495t
zizzhaida .com/a0s9b
silscrub .net/07ifycb
Hybrid Analysis is inconclusive*.
If I get hold of the C2s or other download locations then I will post them here."
* https://www.hybrid-analysis.com/sam...ba02a4233ccae7a0b4ac05b0b8e?environmentId=100
UPDATE: My usual reliable source tells me that these are all the download locations...
(Long list of domain-names at the dynamoo URL above.)
... These are the C2s:
91.234.32.202/linuxsucks .php (FOP Sedinkin Olexandr Valeriyovuch aka thehost .ua, Ukraine)
81.177.22.164/linuxsucks .php (NETPLACE, Russia)
Recommended blocklist:
91.234.32.202
81.177.22.164 "
___

Fake 'New Fax' SPAM - leads to TrickBot
- http://blog.dynamoo.com/2016/11/malware-spam-new-fax-message.html
1 Nov 2016 - "This -fake- fax leads to TrickBot which appears to be similar to the Dyre banking trojan that we saw a lot of last year..

Screenshot: https://3.bp.blogspot.com/-DtzfLWMD...GQlp8rT8kGq23QCLcB/s1600/confidential-fax.png

Attached is a Word document (in this case Internal_Fax.doc) which has a pretty low detection rate at VirusTotal of 5/54*. Both the Malwr report** and Hybrid Analysis*** give some clues as to what is going on, but in fact the Malwr report comes out with a binary download location of:
www .tessaban .com/img/safafaasfasdddd.exe
This is a -hacked- legitimate website. Downloading that file manually and resubmitting it gives two rather more interesting Malwr[4] and Hybrid Analysis reports[5] give the following suspect traffic:
91.219.28.77 (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine)
193.9.28.24 (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine)
37.1.209.51 (3NT Solutions LLP, UK)
138.201.44.28 (Philip Diver, Australia / Hetzner, Germany)
23.23.107.79 (Amazon EC2, US)
... 3NT Solutions (aka Inferno Solutions/inferno .name) are very, very bad news and I would recommend blocking any IPs you can find for this outfit... If we excise the domestic IPs and blackhole the 3NT/Inferno/uadomen .com ranges we get a recommended blocklist of:
37.1.208.0/21
46.22.211.0/24
91.219.28.0/22
104.250.138.192/27
138.201.44.28
188.116.23.98
188.138.1.53
193.9.28.0/24
However, there's more to this... The original email message is actually signed by local-fax .com and it turns out that this domain was created just -today- with anonymous registration details. The sending IP was 104.130.246.8 (Rackspace, US) and it also turns out that this is widely blacklisted and is probably worth blocking. All the samples I have seen show a consistent MD5 of e6d2863e97523d2f0e398545989666e4 for the attachment, and all the recipients I have seen begin with the letter "a" curiously..."
* https://virustotal.com/en/file/8e36...92944fd0898eb3924df07c8b8aad4c38347/analysis/

** https://malwr.com/analysis/NjliZDdmZmZiNzc5NGNjM2IyMDBjNTdlMjk1NGEzZjQ/
Hosts
61.19.247.54
78.47.139.102
54.197.246.207
64.182.208.181
66.171.248.178
188.40.53.51
91.219.28.77
193.9.28.24

*** https://www.hybrid-analysis.com/sam...898eb3924df07c8b8aad4c38347?environmentId=100

4] https://malwr.com/analysis/MWQxYWFiMjg1NzhkNGIxYjhmMWUwYTRjODQ1YjRjMzU/
Hosts
78.47.139.102
23.23.107.79
64.182.208.182
64.182.208.184
64.182.208.183
64.182.208.181
66.171.248.178
188.40.53.51
91.219.28.77
193.9.28.24
37.1.209.51

5] https://www.hybrid-analysis.com/sam...8b67a98bf82548a951f468f629b?environmentId=100
Contacted Hosts
91.219.28.77
193.9.28.24
37.1.209.51
138.201.44.28

- https://myonlinesecurity.co.uk/malspam-email-gds-new-fax-message-delivers-malware/
1 Nov 2016 - "An email with the subject of 'GDS – New Fax Message' pretending to come from GDS Fax <service@ gov-fax. co .uk> with a malicious word doc containing macros which downloads what looks like Trickbot banking Trojan...

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/11/gds-new-fax-message-1024x555.png

1 November 2016: gvt_uk_01112016.doc - Current Virus total detections 3/54*
MALWR** shows a download from http ://www .tessaban .com/img/safafaasfasdddd.exe (VirusTotal 10/56***)
Payload Security [1] [2] Dynamoos blog[3] gives details of a slightly different email delivering the same word docs & malware payload... The basic rule is NEVER open any attachment to an email, unless you are expecting it...."
* https://www.virustotal.com/en/file/...5848dec65a46ca53a2b04ba3/analysis/1477997908/

** https://malwr.com/analysis/ZTI2ZjM1OWM1NjA3NDExZDk0ZTBjOTg4YWQxYzM2Mzc/
Hosts
61.19.247.54
78.47.139.102
54.243.164.241
64.182.208.182
66.171.248.178
188.40.53.51
91.219.28.77
193.9.28.24
37.1.209.51

*** https://www.virustotal.com/en/file/...7a98bf82548a951f468f629b/analysis/1478011826/

1] https://www.hybrid-analysis.com/sam...0485848dec65a46ca53a2b04ba3?environmentId=100

2] https://www.hybrid-analysis.com/sam...8b67a98bf82548a951f468f629b?environmentId=100
Contacted Hosts
91.219.28.77
193.9.28.24
37.1.209.51
138.201.44.28

3] http://blog.dynamoo.com/2016/11/malware-spam-new-fax-message.html
___

Fake 'Your Invoice' SPAM - delivers yet more Locky
- https://myonlinesecurity.co.uk/mals...639-delivers-yet-more-locky-ransomware-today/
1 Nov 2016 - "... Locky downloader... an email with the subject of 'Your Invoice: SIPUS16-953639' (random numbers) coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with SIPUS16 containing a wsf file... One of the emails looks like:
From: invoicing@ costruzionieimpianti .com
Date: Tue 01/11/2016 15:47
Subject: Your Invoice: SIPUS16-953639
Attachment: SIPUS16-953639.zip
Dear Sirs,
Please find your invoice enclosed. We kindly ask you to respect our payment terms.
For questions please contact our sales office.
Kind regards,
Dorema UK Ltd.

1 November 2016: SIPUS16-953639.zip: Extracts to: INV_NO_79980148.wsf - Current Virus total detections 11/55*
.. MALWR** shows a download of an encrypted file from
http ://bappeda .palangkaraya .go.id/87yfhc?xFqceIrSlI=MNKhDTrM
which is transformed by the script to GdxPTYAwwe1.dll (VirusTotal 12/56***). Same malware and delivery method as this earlier malspam run[4] using fake invoices... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...88c4189f25fedf6c2244e16a/analysis/1478009132/

** https://malwr.com/analysis/YzFkZTIzNTdmZDhhNGZhZDllMDZkMzJkNTE5YjEzNWU/
Hosts
180.250.3.118
185.82.217.88
51.255.107.20

*** https://www.virustotal.com/en/file/...2696ac259c0e72874aa2fed9/analysis/1477647176/

4] https://myonlinesecurity.co.uk/mals...come-from-infoyour-own-domain-delivers-locky/
___

Windows 0-day vuln - CVE-2016-7855
- https://www.helpnetsecurity.com/2016/11/01/google-warns-actively-exploited-windows-zero-day/
Nov 1, 2016 - "Google has disclosed to the public the existence of a Windows zero-day vulnerability (CVE-2016-7855*) that is being actively exploited in the wild... The same vulnerability has been shared with both Microsoft and Adobe on October 21st, as it also affected Flash Player. But while Adobe has already pushed out an update with the patch[1], Microsoft has not been so quick.
1] https://helpx.adobe.com/security/products/flash-player/apsb16-36.html
... They have advised users to update Flash and implement the Microsoft patch as soon as it is made available..."
>> https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html

* https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7855
11/01/2016 - "... as exploited in the wild in October 2016.
___

HookAds malvertising ...
- https://blog.malwarebytes.com/cybercrime/exploits/2016/11/the-hookads-malvertising-campaign/
Nov 1, 2016 - "... we wrote about a new piece of malware called ‘Trick Bot‘ which we caught in a malvertising attack via a high trafficked adult website. In the meantime, we uncovered -another- malvertising campaign that started at least in mid August, and which leverages decoy adult portals to spread malware. Internally, we call it the 'HookAds campaign' based on a string found within the delivery URL... upstream traffic to those adult sites also shows a pattern of malvertising via the usual suspects... much of the traffic sent to HookAds comes from malvertising on top adult sites that generate millions of visits a month... We estimate that at least one million visitors to adult websites were exposed to this particular campaign. Adult traffic is funneled to one of several decoy adult websites where an -iframe- to adult banner is injected dynamically. The ad is served from a third-party server which performs -cloaking- in order to detect whether this is legitimate new traffic or not...
The fake ad server infrastructure grew during the past few months and our honeypots caught 3 sequential IP addresses that host over a hundred rogue ad domains. All of these domains have been registered with the intention of looking like advertising platforms. While some domains were used for long periods of time, most switched every day or so to let a new one in:
> https://blog.malwarebytes.com/wp-content/uploads/2016/10/206.png
185.51.244.206 / 185.51.244.207 / 185.51.244.208
... The Flash exploit RIG-v uses is protected by SWFLOCK, an online obfuscator/cryptor for Flash files (other EKs like Magnitude use DoSWF)...
Conclusion: The HookAds malvertising campaign is -still- running at the time of writing this post, with new rogue ad domains getting registered each day. We are blocking the malicious IP range to protect our customers and Malwarebytes Anti-Exploit users are also shielded against the RIG exploit kit..."
IOCs
IPs:
185.51.244.206
185.51.244.207
185.51.244.208 ..."
(More detail at the malwarebytes URL above.)

:fear::fear:

AplusWebMaster · Nov 2, 2016

Fake 'Transactions', 'part 4', 'Companies House', 'Blank body' SPAM, Sundown EK

FYI...

Fake 'Transactions' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/email-malspam-transactions-delivers-locky/
2 Nov 2016 - "... Locky downloader... an email with the subject of 'Transactions' coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with last_transactions_ containing a VBS file that pretends to be a PDF... One of the emails looks like:
From: Berry Rutledge <Rutledge35@ shakedownbarvail .com>
Date: Wed 02/11/2016 09:32
Subject: Transactions
Attachment: last_transactions_fb079ee.zip
Hi [redacted]
[random name]called me yesterday updating about the transactions on company’s account from last month.
Examine the attached transaction record. Please let me know if you need more help.
Best Regards,
Berry Rutledge

2 November 2016: last_transactions_fb079ee.zip: Extracts to: last_transactions_2EA31C0_PDF.vbs
Current Virus total detections 9/54*. Manual analysis of the vbs shows a download of a file from one of these locations:
http ://bddja .com/p0u44p8z | http ://akira-sushi34 .ru/przgzq | http ://3rock .ie/qdq1fv4c
http ://cokealong .com/0l609 | http ://fiveclean .com/14msj3
which is renamed by the script to a dll and autorun (VirusTotal 7/55**). Neither MALWR nor Payload Security*** ever seem able to display the download URLs or obtain any payload form these VBS scripts, although manual analysis shows it very easily with minimal de-obfuscation of the VBS code...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...8b7b5dbd61a0f009cbac72d2/analysis/1478080807/

** https://www.virustotal.com/en/file/...adab230e0858a43cf95d57c9/analysis/1478083429/

*** https://www.hybrid-analysis.com/sam...8518b7b5dbd61a0f009cbac72d2?environmentId=100
___

Fake 'part 4' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/malspam-email-part-4-as-promised-delivers-locky/
2 Nov 2016 - "... Locky downloader... an email with the subject of 'part 4' (random numbers between 0 & 9) coming as usual from random companies, names and email addresses with a random named zip attachment containing a WSF file... One of the emails looks like:
From: TRACIE MACALLISTER <traciemacallister@ perceptualproductions .com>
Date: Thu 01/09/2016 19:22
Subject: part 4
Attachment: JLJEWM918399.zip
As promised
TRACIE

2 November 2016: JLJEWM918399.zip: Extracts to: PTKBJH1522.wsf - Current Virus total detections 12/54*
MALWR** shows a download of an encrypted file from
http ://aifgroup .jp/43ftybb8?eOcQFhG=ytopbCntxmF which is transformed by the script to BdJXwnO1.dll
(VirusTotal 12/56***). C2 are
http ://194.28.87.26 /linuxsucks.php | http ://51.255.107.20 /linuxsucks.php
http ://194.1.239.152 /linuxsucks.php
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...691ad5f3a041e3434db7aeb4/analysis/1478081153/

** https://malwr.com/analysis/ZDI2ZjEyYWQ5YTM4NDk3OTk4ODBlMDVlNmI3YmI3NjE/
Hosts
122.200.219.36
194.28.87.26
51.255.107.20
194.1.239.152

*** https://www.virustotal.com/en/file/...b00922856fb992eb08a9d12f/analysis/1478084176/
___

Fake 'Companies House' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/mals...y-complaint-delivers-trickbot-banking-trojan/
2 Nov 2016 - "An email with the subject of 'Companies House – new company complaint' pretending to come from Companies House <noreply@ companieshouses .co.uk> with a malicious word doc with macros delivers Trickbot banking Trojan...

Screenshot: https://myonlinesecurity.co.uk/wp-c...nies-House-new-company-complaint-1024x553.png

2 September 2016: Complaint.doc - Current Virus total detections 4/54*
Payload security** shows a download of sweezy.exe from futuras .com/img/dododocdoc.exe (VirusTotal 6/57***)...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...d078b67b006e17e12f9eb407/analysis/1478089229/

** https://www.hybrid-analysis.com/sam...026d078b67b006e17e12f9eb407?environmentId=100
Contacted Hosts
203.199.134.21
78.47.139.102
193.107.111.164
91.219.28.58
193.124.177.117
91.219.28.77
193.9.28.24

*** https://www.virustotal.com/en/file/...ed3ea1888981536da8dd9c6d/analysis/1478089108/

- http://blog.dynamoo.com/2016/11/malware-spam-companies-house-new.html
2 Nov 2016 - "This fake Companies House spam leads to TrickBot malware... Unlike recent Locky spam runs, this TrickBot run has gone to a lot of effort to look authentic:

Screenshot: https://2.bp.blogspot.com/-wBSmA67_...OlncYom626O2NIACLcB/s1600/companies-house.png

The sender is either noreply@ companies-house .me.uk or noreply@ companieshouses .co.uk - both those domains have actually been registered by the spammers with -fake- WHOIS details... All the emails that I have seen have been sent via servers at 172.99.84.190 and 172.99.88.226 (a Rackspace customer apparently called OnMetal v2 IAD PROD). I recommend that you -block- email traffic from those IPs.
Attached is a Word document Complaint.doc (MD5 21AEA31907D50EE6F894B15A8939A48F) [VT 7/55[2]] which according to this Hybrid Analysis[1] downloads a binary from:
futuras .com/img/dododocdoc.exe
This is saved as sweezy.exe and has a detection rate of 7/57[3]. At present that download location is down, probably due to exceeding bandwidth quota. The Hybrid Analysis identifies several C2s which overlap with this TrickBot run from yesterday[4]:
78.47.139.102 (Unknown customer of Hetzner, Germany)
91.219.28.58 (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine)
91.219.28.77 (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine)
193.9.28.24 (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine)
193.107.111.164 (PP "Kremen Alliance", Ukraine)
193.124.177.117 (MAROSNET, Russia)
The uadomen .com IP ranges (as discussed yesterday) are a sea of badness and I recommend you block traffic to them.
Recommended blocklist:
78.47.139.96/28
91.219.28.0/22
193.9.28.0/24
193.107.111.164
193.124.177.117 "
1] https://www.hybrid-analysis.com/sam...026d078b67b006e17e12f9eb407?environmentId=100
Contacted Hosts
203.199.134.21
78.47.139.102
193.107.111.164
91.219.28.58
193.124.177.117
91.219.28.77
193.9.28.24

2] https://virustotal.com/en/file/985e...e87b0e0a026d078b67b006e17e12f9eb407/analysis/

3] https://www.virustotal.com/en/file/...d871c5be842ed3ea1888981536da8dd9c6d/analysis/

4] http://blog.dynamoo.com/2016/11/malware-spam-new-fax-message.html
___

Fake 'DSCF6693' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/blank-malspam-email-dscf6693-pdf-delivers-locky/
1 Nov 2016 - "... Locky downloader... a totally -blank- email with the subject of 'DSCF6693.pdf' (random numbers) coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with DSCF that matches the subject containing a wsf file... One of the emails looks like:
From: ROXIE LANGBAINE <roxie.3506@ madebuynana .nl>
Date: Tue 01/11/2016 19:51
Subject: DSCF6693.pdf
Attachment: DSCF6693.zip

Body content: totally blank/empty

1 November 2016: DSCF6693.zip: Extracts to: DSCF1121.wsf - Current Virus total detections 8/54*
MALWR** shows a download of a file from
http ://el-sklep .com/76vvyt?JazeMXLjl=JXhbIC which is transformed by the script to YHvwcTj1.dll
(VirusTotal 5/57***). C2 are
http ://194.28.87.26 /linuxsucks.php | http ://51.255.107.20 /linuxsucks.php
http ://qiklchkunuhhbrk .org/linuxsucks.php | http ://194.1.239.152 /linuxsucks.php ...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...781717de7033ea5f9422560c/analysis/1477646733/

** https://malwr.com/analysis/NTQzZWMxMDNhNzA5NDdhZWIwNTM1MTdiMTdmZWI5ZDc/
Hosts
88.198.110.138
194.28.87.26
51.255.107.20
194.1.239.152
69.195.129.70

*** https://www.virustotal.com/en/file/...6aa91403858d25805df98d93/analysis/1478031176/
___

Sundown EK ...
- http://blog.talosintel.com/2016/10/sundown-ek.html
Oct 31, 2016 - "... IOC - Subdomains not included due to usage of domain wildcarding during campaign
Conclusion: The last couple of months have lead to major shifts in the exploit kit landscape with major players disappearing rapidly. We are now in a place where only a handful of exploit kits remain active and kits that would have previously been part of a second tier of EKs have started to rise to prominence. Sundown is a far more widely distributed exploit kit than was initially thought. Even though it doesn't have a huge footprint from an infrastructure perspective, there are lots of users interacting with these kits."
- https://blogs.cisco.com/wp-content/uploads/sundown_ips.txt
109.236.87.40
109.236.92.187
217.23.7.27
93.190.139.250
217.23.7.26
212.92.127.207
185.106.120.86
185.104.8.168
185.104.8.167
185.104.8.166

:fear::fear:

AplusWebMaster · Nov 3, 2016

Fake 'Urgent payment', More Locky, 'Summons', 'Bill', 'Order' SPAM

FYI...

Fake 'Urgent payment' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-urgent-payment-request.html
3 Nov 2016 - "This spam comes from random senders, the name in the "From" field always matches the fake email signature. The number of exclamation marks varies, and the payload is Locky ransomware.
Subject: !!! Urgent payment request
From: erika.whitwell@ hillcrestlife .org (erika.whitwell@ hillcrestlife .org)
Date: Thursday, 3 November 2016, 10:01
ERIKA WHITWELL ...

Attached is a file with a long name made of random numbers (e.g. 5148202750-2115939053-201611153218-5476.zip) which contains a similarly-named malicious javascript file (e.g. 8357243996-7378883150-201611233647-0661.js)...
UPDATE: This Hybrid Analysis* shows the script downloading from:
dornovametoda .sk/jhb6576?jPUTusVX=GXNaiircxm
There will be lots of other download locations too. That same report shows the malware phoning come to the following C2 servers (that overlaps somewhat with those found here):
194.28.87.26/message.php (Hostpro Ltd, Ukraine)
93.170.123.119/message.php (PE Gornostay Mikhailo Ivanovich aka time-host.net, Ukraine)
109.234.34.227/message.php (McHost .Ru, Russia)
Recommended blocklist:
194.28.87.26
93.170.123.119
109.234.34.0/24 "
* https://www.hybrid-analysis.com/sam...28db66377815743e9c7e9fbf4c1?environmentId=100
Contacted Hosts
81.0.217.3
194.28.87.26
93.170.123.119
109.234.34.227
54.192.185.153

- https://myonlinesecurity.co.uk/urgent-payment-request-malspam-email-delivers-even-more-locky/
3 Nov 2016 - "... Locky downloader... an email with the subject of '!! Urgent payment request' coming as usual from random companies, names and email addresses with a random named zip attachment containing a .js file... One of the emails looks like:
From: christi.hayton@ artemisridge .com
Date: Thu 01/09/2016 19:22
Subject: !! Urgent payment request
Attachment: ea05237624050-3072993672-201611145320-0296.zip
CHRISTI HAYTON Telefon: +49 1743 / 51-9283 Fax: +49 1743 / 5166-9283 ...

3 November 2016: 5237624050-3072993672-201611145320-0296.zip
Extracts to: 2119873724-8372344101-201611211525-3816.js - Current Virus total detections 8/55*
MALWR** shows a download of an encrypted file from
http ://centinel .ca/jhb6576?rigWApln=iwDykXRT which is converted by the script to lpFtmm1.dll (VirusTotal 9/56***)
C2 http ://194.28.87.26 /message.php . Payload Security[4] shows additional C2... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...be5fc22a2c3a5fd78a1d6e22/analysis/1478165027/

** https://malwr.com/analysis/ZmY0ZmM2YjY1NDcyNGI0NGJmMmQzMTc5NWI0MzI3Nzg/
Hosts
64.34.157.170
194.28.87.26

*** https://www.virustotal.com/en/file/...ed8328459c239c6f3b4dec86/analysis/1478166325/

4] https://www.hybrid-analysis.com/sam...906be5fc22a2c3a5fd78a1d6e22?environmentId=100
Contacted Hosts
64.34.157.170
109.234.34.227
93.170.123.119
194.28.87.26
54.192.48.225
___

More Locky ...
- http://blog.dynamoo.com/2016/11/moar-locky-2016-11-03.html
3 Nov 2016 - "... Locky runs overnight... here is a data dump of download locations and C2s (at the bottom) from my usual reliable source:
(Long list of domain-names at the dynamoo URL above.)
... C2s:
51.255.107.20 /message .php (Webhost LLC Dmitrii Podelko, Russia / OVH, Germany)
85.143.215.209 /message.php (PrdmService LLC / Comfortel Ltd / Trader soft LLC, Russia)
91.230.211.103 /message .php (Optibit LLC, Russia)
91.239.232.171 /message .php (Hostpro Ltd, Ukraine)
93.170.123.119 /message.php (PE Gornostay Mikhailo Ivanovich aka time-host.net, Ukraine)
194.28.87.26 /message.php (Hostpro Ltd, Ukraine)
51.255.107.20 /linuxsucks.php (Webhost LLC Dmitrii Podelko, Russia / OVH, Germany)
194.1.239.152 /linuxsucks.php (Internet Hosting Ltd aka majorhost.net, Russia)
194.28.87.26 /linuxsucks.php (Hostpro Ltd, Ukraine)
Recommended blocklist:
51.255.107.20
85.143.215.209
91.230.211.103
91.239.232.171
93.170.123.119
194.1.239.152
194.28.87.26 "
___

Fake 'Summons' SPAM - delivers malware
- https://myonlinesecurity.co.uk/spoofed-email-from-the-crown-prosecution-service-delivers-malware/
3 Nov 2016 - "... updated run of the old 'You’ve been witness summoned to court / You are hereby summoned to appear to court to give evidence' is spreading today... Once you insert the “captcha” numbers into the submit box and press submit, you get a random numbered zip file that extracts to a js.file...

Screenshot: https://myonlinesecurity.co.uk/wp-c...1/Your-queue-REF-number-18UP6M78-1024x781.png

3 November 2016: 66504.zip: Extracts to: Case Details.js - Current Virus total detections 3/55*
MALWR** shows a download of a file from
http ://rudarskiinstituttuzla .ba/modules/mod_stat/bidkemjarf/localbbrs.exe (VirusTotal 4/57***)
Payload Security[4]... earlier this week, this sort of -spoofed- UK Government emails were used to deliver Trickbot banking Trojan. This malware payload looks somewhat different to those: MALWR[5].. Payload Security[6] analysis of downloaded malware... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...7d35b5fa4bad63374de919ad/analysis/1478169130/

** https://malwr.com/analysis/N2U3Y2Q0MDczODc5NDI5ZTkxYWNiM2VmOTlmYzUzZWE/
Hosts
176.9.10.243

*** https://www.virustotal.com/en/file/...f93e8896f809e2ad44a36684/analysis/1478169467/

4] https://www.hybrid-analysis.com/sam...ae37d35b5fa4bad63374de919ad?environmentId=100
Contacted Hosts
176.9.10.243
208.118.235.148
148.163.112.203
148.163.112.203

5] https://malwr.com/analysis/NWYyZGU0ODZmZmI2NDgwY2FhYjAxMmEzZTg1NmM4NTU/

6] https://www.hybrid-analysis.com/sam...edef93e8896f809e2ad44a36684?environmentId=100
Contacted Hosts
208.118.235.148
148.163.112.203
___

Fake 'Bill' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/pay-your-maintenance-bill-malspam-delivers-locky/
3 Nov 2016 - "... Locky downloader... an email telling you to pay your maintenance bill with the subject of 'Bill' coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with november_bill_ containing a VBS file that pretends to be a PDF... One of the emails looks like:
From: Ericka Oneill <Oneill000@ soundsolutionsrecording .com>
Date: Thu 03/11/2016 13:40
Subject: Bill
Attachment: november_bill_450e7d7f0.zip
Dear [redacted]
To continue using our maintenance service, please pay for last month’s fee by 4th of November.
The bill is attached in the email.
Please keep it for later purposes.
King Regards,
Ericka Oneill

3 November 2016: november_bill_450e7d7f0.zip: Extracts to: TN E3E6314.vbs - Current Virus total detections 8/55*
Manual analysis shows a download of a file from one of these locations:
http ://aurora.cdl-sc .org.br/gj789z
http ://davidart .com.tw/haa4vt4u
http ://artlab .co.il/hgm0chod
http ://dingeabyss .com/1jawie
http ://sehyokette.net/1t6ywcjb
... which is renamed by the script to a DLL (VirusTotal 8/57**). Payload Security***... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...3230a33039c7873d95c50ccb/analysis/1478181547/

** https://www.virustotal.com/en/file/...06345c2eacd3353bd224b27a/analysis/1478181696/

*** https://www.hybrid-analysis.com/sam...83d3230a33039c7873d95c50ccb?environmentId=100
Contacted Hosts
220.229.238.7
130.208.19.136
188.127.237.66
195.123.211.65
___

Fake 'Order' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/order-903644-acknowledgement-malspam-delivers-locky/
3 Nov 2016 - "... Locky downloader... an email with the subject of 'Order 903644 (Acknowledgement)' [random numbers] coming as usual from random companies, names and email addresses with a zip attachment that starts with several random letters then a series of numbers that matches the subject order number containing a VBS file... One of the emails looks like:
From: CORA FRANZKE <eml@ durellaw .com>
Date: Thu 03/11/2016 14:50
Subject: Order 903644 (Acknowledgement)
Attachment: jf903644.zip
Please find document attached

3 November 2016: jf903644.zip: Extracts to: KUnyn699-32121.vbs - Current Virus total detections 5/55*
Payload Security**...Manual analysis shows a download of a file from one of these locations
albakrawe-uae .com/i9jnrc
cosywall .pl/i9jnrc
eldamennska .is/i9jnrc
irk.24abcd .ru/i9jnrc
schuhdowdy .net/i9jnrc
teriisawa .com/i9jnrc
(VirusTotal 11/56***). C2 are 109.234.35.230 | 176.103.56.119 /message.php. This also uses the Tor network... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...07f691c952ff1e2bea232e68/analysis/1478185057/

** https://www.hybrid-analysis.com/sam...d5907f691c952ff1e2bea232e68?environmentId=100
Contacted Hosts
192.186.246.98
109.234.35.230
176.103.56.119
54.240.184.221
80.239.137.72

*** https://www.virustotal.com/en/file/...358bffd3a56158fcf7e3997e/analysis/1478192229/

:fear::fear:

AplusWebMaster · Nov 4, 2016

Fake 'Please verify', 'Payroll Payslip' SPAM

FYI...

Fake 'Please verify' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/i-ha...cal-document-you-sent-malspam-delivers-locky/
4 Nov 2016 - "... Locky downloader... an email that pretends to be about proofreading the technical document you sent with the subject of 'Please verify' coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with tech_doc_ containing a VBS file... very similar to recent Locky malspam[1] where the download is an actual executable file, not an encrypted file needing decoding, although called a txt file. The VBS just -renames- it to the -dll- name... Payload Security report[2]...
1] https://myonlinesecurity.co.uk/please-review-malspam-delivers-locky-thor-version/
One of the emails looks like:
From: Coleen Barr <Barr84@ homedesigners171 .com>
Date: Fri 04/11/2016 09:49
Subject: Please verify
Attachment: tech_doc_dc405d482.zip
Hey [redacted], as you requested, I have proofread the technical document you sent.
There are some confused parts in it.
Please verify the parts highlighted in the attached document.
Best Wishes,
Coleen Barr

4 November 2016: tech_doc_dc405d482.zip: Extracts to: NRV4MO04.vbs - Current Virus total detections 10/55*
Manual analysis shows a download of a file from one of these locations:
http ://good-gamess .ru/qz7at0 | http ://astrotranspersonal .com.ar/rhiup3j | http ://goldendogs .nl/s6ymz2k
http ://bahutnorma .net/2pceo6 | http ://rangyinby .com/3ixr99t (VirusTotal 7/57**)...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...685e7fe8fd5f3761e84c130e/analysis/1478253546/

** https://www.virustotal.com/en/file/...4957e16f4bd5d7a905b5def1/analysis/1478253708/

2] https://www.hybrid-analysis.com/sam...00a0edfe5219d3383faef1a5587?environmentId=100
___

Fake 'Payroll Payslip' SPAM - delivers Java Adwind
- https://myonlinesecurity.co.uk/spoo...-reply-malspam-delivers-java-adwind-jacksbot/
4 Nov 2016 - "... fake financial themed emails containing java adwind/Java Jacksbot Trojan attachments... can only be active or infect you -if- you have Sun/Oracle Java installed... The email looks like:
From: wu.paymaster@ westernunion .com <postmaster@ fanavaelecomp .com>
Date: Fri 04/11/2016 06:37
Subject: Payroll Payslip (NO-REPLY)
Attachment: Details.zip
Dear agent,
Attached is your payslip for the payroll period of 01 October 2016 to 01 November 2016.To view your Payslip, simply type in your Personal Password when asked for a password. If you did not submit your personal password, just type in your last name followed by the birthday (Format: MMddyyyy) and the last four (4) digits of your employee id number when asked for a password (e.g., ocampo011320141234). Please make sure to use lowercase letters, no spaces and no special characters when typing your password, name suffix is also part of your lastname...
Sincerely,
Accounting Department

4 November 2016: Payrol Payslip.jar (323 kb) - Current Virus total detections 17/56* - Payload Security**...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...e4672b6cd5f5fc844d297b62/analysis/1478239741/

** https://www.hybrid-analysis.com/sam...a35e4672b6cd5f5fc844d297b62?environmentId=100
Contacted Hosts
216.107.152.224

:fear::fear:

AplusWebMaster · Nov 7, 2016

Fake 'Financial documents', 'Scanned image', 'Scan' SPAM, AMEX phish

FYI...

Fake 'Financial documents' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-financial-documents-leads.html
7 Nov 2016 - "The never-ending Locky ransomware onslaught continues. This -fake- financial spam has a malicious attachment:
Subject: Financial documents
From: Judy Herman
To: [redacted]
Date: Monday, 7 November 2016, 10:53
Hi [redacted],
These financial documents need to be uploaded on the system.
Please let me know if you experience any technical problems.
Best Wishes,
Judy Herman

Sender names will probably vary. In the sample I saw there was an attachment named fin_docs_f73856f4.zip containing a malicious script NRV_A194008F_.vbs ... This particular script (and there will be others like it) attempts to download from:
http ://coachatelier .nl/lg8s2
http ://bechsautomobiler .dk/m8idi9j
http ://desertkingwaterproofing .com/ma4562
http ://zapashydro .net/6sgto2bd
http ://owkcon .com/6xgohg6i
According to this Hybrid Analysis*, the malware then phones home to:
195.123.211.229 /message .php [hostname: panteleev.zomro .com] (Layer6 Networks, Bulgaria / ITLDC, Latvia)
185.67.0.102 /message .php [hostname: endgo .ru] (Hostpro Ltd. / hostpro .com.ua, Ukraine)
188.65.211.181 /message .php (Knopp, Russia)
Recommended blocklist:
195.123.211.229
185.67.0.102
188.65.211.181 "
* https://www.hybrid-analysis.com/sam...c15e82a71d88d4f4934c5a6d198?environmentId=100
Contacted Hosts
141.138.169.200
195.123.211.229
185.67.0.102
188.65.211.181

- https://myonlinesecurity.co.uk/financial-documents-malspam-delivers-locky/
7 Nov 2016 - "... Locky downloader... an email with the subject of 'Financial documents' coming as usual from random companies, names and email addresses with a semi-random named zip attachment starting with fin_docs_ containing a VBS file... One of the emails looks like:
From: Delbert Mckay <Mckay8375@ purrfectsports .com>
Date: Mon 07/11/2016 10:57
Subject: Financial documents
Attachment: fin_docs_c605c39a.zip
Hi [redacted]
These financial documents need to be uploaded on the system.
Please let me know if you experience any technical problems.
Best Wishes,
Delbert Mckay

7 November 2016: fin_docs_c605c39a.zip: Extracts to: NRV_3O63MI_.vbs - Current Virus total detections 5/54*
Payload Security** shows downloads of a file from the same locations which is renamed by the script to qltoUhLp0.dll (VirusTotal 9/57***). C2 are:
188.65.211.181 | 185.67.0.102 | 195.123.211.229 .. all use /message.php ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...76761c2980f608981eeee280/analysis/1478516808/

** https://www.hybrid-analysis.com/sam...d1a76761c2980f608981eeee280?environmentId=100
Contacted Hosts
213.176.241.230
188.65.211.181
185.67.0.102
195.123.211.229

*** https://www.virustotal.com/en/file/...fbdbd6959da7083f9e1771d0/analysis/1478517111/
___

Fake 'Scanned image' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoo...your-own-email-domain-malspam-delivers-locky/
7 Nov 2016 - "... Locky downloader... an email with the subject of 'Scanned image' from MX2310U@ your-own email domain pretending to come from office@ your-own email domain with a semi-random named zip attachment in the form of office@ your-own email domain _random numbers.zip containing a .JS file... One of the emails looks like:
From: office@ ...
Date: Mon 07/11/2016 14:16
Subject: Scanned image from MX2310U@ ...
Attachment: office@ ...zip
Reply to: office@ ... <office@ ...>
Device Name: MX2310U@ ...
Device Model: MX-2310U
Location: Reception
File Format: PDF MMR(G4)
Resolution: 200dpi x 200dpi
Attached file is scanned image in PDF format...

7 November 2016: office@ ...zip: Extracts to: JYF16212-1319.js - Current Virus total detections 8/53*
Payload Security** shows a download of an encrypted file from henrytye .com /hgf65g?ymWrOm=LeFqAxKmfIY
which is renamed by the script to bRewBexBO1.dll ...
C2: 81.177.180.53 /message.php and 176.103.56.120 /message.php. Unfortunately the free web version of Payload Security does not give the actual downloaded file... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...3aef68f7e4f8ba533aec6317/analysis/1478531957/

** https://www.hybrid-analysis.com/sam...b413aef68f7e4f8ba533aec6317?environmentId=100
Contacted Hosts
103.6.196.80
81.177.27.222
176.103.56.120
81.177.180.53
52.34.245.108
52.222.171.240
___

Fake 'Scan' SPAM - more Locky
- https://myonlinesecurity.co.uk/sent-with-genius-scan-for-ios-malspam-delivers-even-more-locky/
7 Nov 2016 - "... Locky downloader... an email with the subject of '[Scan] 2016-1107 17:29:49' coming as usual from random companies, names and email addresses with a zip attachment named after todays date and a time containing a wsf file... One of the emails looks like:
From: MAURICIO BLUM <mauricio.blum.72@ tullochcapital .com>
Date: Mon 07/11/2016 22:30
Subject: [Scan] 2016-1107 17:29:49
Attachment: 2016-1107 17-29-49.zip
Sent with Genius Scan for iOS.

7 November 2016: 2016-1107 17-29-49.zip: Extracts to: UNA516807-3039.wsf - Current Virus total detections 8/55*
MALWR** and Payload Security*** both show a download of an encrypted file from
http ://futuregroup .cz/98ynhce?IspgpFMAU=eJftALCrAxBwhich is converted by the script to
cflaTvC1.dll (VirusTotal 11/56[4]). C2: http ://81.177.27.222 /message.php and 176.103.56.120 /message.php ...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5c6f28ffe9a2dbab67d0aada/analysis/1478558924/

** https://malwr.com/analysis/YTBhZmU3ZjJhZTA4NDFlMDgwZGVmODMxMjBhZTU3OGU/
Hosts
85.207.99.25
81.177.27.222

*** https://www.reverse.it/sample/09340...6b85c6f28ffe9a2dbab67d0aada?environmentId=100
Contacted Hosts
85.207.99.25
81.177.27.222
176.103.56.120
52.222.157.74

4] https://www.virustotal.com/en/file/...1cef07a0d917bfae3be7324a/analysis/1478556970/
___

Fake 'American Express' phish
- https://myonlinesecurity.co.uk/impo...our-cardmembership-american-express-phishing/
7 Nov 2016 - "... American Express phishing email...

Screenshot: https://i1.wp.com/myonlinesecurity....g-Your-CardMembership.png?fit=1223,1033&ssl=1

... shows a website that looks like this included in a frame so it is never actually on your computer at all.
(I had to split the screenshot into 2 parts to get all the information they want, Which is a lot more than normal.)
>> https://i0.wp.com/myonlinesecurity....16/11/GENAU03002117.png?resize=1024,625&ssl=1

>>> https://i0.wp.com/myonlinesecurity....GENAU03002117_part2.png?resize=1024,548&ssl=1

... It will NEVER be a genuine email from American Express or any other bank or credit card company so don’t ever follow the links or fill in the html (webpage) form that comes attached to the email... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or click-the-link in the email.."

:fear::fear:

AplusWebMaster · Nov 8, 2016

Fake 'Parcel2Go', 'Statement', 'Suspicious movements', 'Order' SPAM

FYI...

Fake 'Parcel2Go' SPAM - delivers malware
- https://myonlinesecurity.co.uk/25024552-parcel2go-delivery-announce-delivers-malware/
8 Nov 2016 - "An email with the subject of '#25024552 Parcel2go delivery announce' (random numbers) pretending to come from random senders with a -link- to Google Drive that downloads a malicious word doc delivers malware... The link is still live at the time of posting despite being reported yesterday to Google...

Screenshot: https://i2.wp.com/myonlinesecurity....o-delivery-announce.png?resize=1024,743&ssl=1

8 November 2016: parchel2go567313.doc - Current Virus total detections 3/54*
Both MALWR** and Payload Security*** show a connection to & download from
http ://findserviceapp .com.br/mr6.exe but only Payload Security actually managed to retrieve the malware but doesn’t describe it as malicious, only describing it as informative... (VirusTotal 6/56[4])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...012a377b48d01e2428e1a2e6/analysis/1478535435/

** https://malwr.com/analysis/ZDkxODRlYmM1MDQ1NDZjZDllZTc4NzE2ZGRlOWY5MTA/
Hosts
192.185.208.115

*** https://www.hybrid-analysis.com/sam...2f8012a377b48d01e2428e1a2e6?environmentId=100
Contacted Hosts
192.185.208.115

4] https://www.virustotal.com/en/file/...9764f08e5054a52997241e3d/analysis/1478602406/
___

Fake 'Statement' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-statement-leads-to-locky.html
8 Nov 2016 - "Another terse fake financial spam leading to Locky ransomware:
Subject: Statement
From: accounts@ somedomain .tld
Date: Tuesday, 8 November 2016, 10:59
For your Information.

The sender domain varies. Attached is a ZIP file with a name similar to Statement PDF - 56765041263.zip which in turn contains a malicious WSF script... named in a format similar to SLM245260-0214.wsf. Hybrid Analysis* of this one sample shows a download occurring from:
gpstrackerbali .com/67j5hg?LzQWruaaLHv=dIYfuCrkfcG
There will no doubt be many other locations, if I get more information then I will post it here. The script drops a DLL with a detection rate of 14/56** and the malware appears to phone home to:
185.118.66.90 /message.php (vpsville.ru, Russia)
158.69.223.5 /message.php (OVH, Canada)
Recommended blocklist:
185.118.66.90
158.69.223.5 "
* https://www.hybrid-analysis.com/sam...8447552057820078616a0c867ac?environmentId=100
Contacted Hosts
219.83.68.90
185.118.66.90
158.69.223.5
52.34.245.108
52.85.209.44

** https://virustotal.com/en/file/7e6c...5ab5cf8615951084a5960007/analysis/1478605400/

- https://myonlinesecurity.co.uk/stat...-from-accounts-random-senders-delivers-locky/
8 Nov 2016 - "... Locky downloader... an email with the subject of 'Statement' coming from accounts@ random companies, names and email addresses with a semi-random named zip attachment starting with Statement PDF containing a WSF file... One of the emails looks like:
From: accounts@ energycontrol .gr
Date: Tue 08/11/2016 10:58
Subject: Statement
Attachment: Statement PDF – 9022558992.zip
For your Information.

8 November 2016: Statement PDF – 9022558992.zip: Extracts to: SLM245260-0214.wsf - Current Virus total detections 9/55*
Payload Security** shows a download of an encrypted file from
http ://gpstrackerbali .com/67j5hg?LzQWruaaLHv=dIYfuCrkfcG which is converted by the script to
GMbsdHBsIX1.dll (VirusTotal 14/56***)... A list of alternative download sites so far discovered by another researcher[4] has been posted on pastebin[5]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...7552057820078616a0c867ac/analysis/1478604149/

** https://www.hybrid-analysis.com/sam...8447552057820078616a0c867ac?environmentId=100
Contacted Hosts
219.83.68.90
185.118.66.90
158.69.223.5
52.34.245.108
52.85.209.44

*** https://www.virustotal.com/en/file/...5ab5cf8615951084a5960007/analysis/1478604056/

4] https://twitter.com/Racco42/status/795949000352497664

5] http://pastebin.com/VGvZafjs
___

Fake 'Suspicious movements' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/susp...ffice-of-personnel-management-delivers-locky/
8 Nov 2016 - "... Locky downloader... an email that pretends to be a notification from U.S. Office of Personnel Management with the subject of 'Suspicious movements' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of pdf_recipients name_random numbers.zip containing a .JS file... One of the emails looks like:
From: Cristobal Johns <Johns.Cristobal@ autoimmunkrankheit .de>
Date: Tue 08/11/2016 12:17
Subject: Suspicious movements
Attachment: pdf_forum_534e144e2.zip
Dear[redacted], Angel from the bank notified us about the suspicious movements on out account.
Examine the attached scanned record. If you need more information, feel free to contact me.
—
King regards,
Cristobal Johns
Account Manager ...
U.S. Office of Personnel Management
1265 E Street, NW
Washington, DC 20415-1000

8 November 2016: pdf_forum_534e144e2.zip: Extracts to: NRV_AM00I_.js - Current Virus total detections 6/55*
MALWR** shows a download of a file from http ://dowfrecap .net/3muv7 which is renamed by the script to a DLL and autorun (VirusTotal 9/57***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...e877b7aa81d044ed07ff332b/analysis/1478607538/

** https://malwr.com/analysis/YmJmMjg2Y2E5NTc4NGFhMzk4MDgzNzhhMDYzN2Q0Nzk/
Hosts
67.171.65.64

*** https://www.virustotal.com/en/file/...13f1985ebb9a72114a1f0ba6/analysis/1478609031/

- http://blog.dynamoo.com/2016/11/malware-spam-suspicious-movements-leads.html
8 Nov 216 - "This fake financial spam leads to Locky ransomware:
Subject: Suspicious movements
From: Marlene Parrish
Date: Tuesday, 8 November 2016, 12:52
Dear [redacted], Leroy from the bank notified us about the suspicious movements on out account.
Examine the attached scanned record. If you need more information, feel free to contact me.
---
King regards,
Marlene Parrish
Account Manager...
U.S. Office of Personnel Management
1189 E Street, NW
Washington, DC 20415-1000

The names, addresses and telephone numbers will vary from message to message. Attached is a ZIP file (e.g. pdf_recipient_3608c4a.zip) which contains a malicious javascript (e.g. NRV_J51E8_.js)... That particular script downloads a malicious component from one of the following locations:
vexerrais .net/6sbdh
centinel .ca/wkr1j6n
3-50-90 .ru/u4y5t
alpermetalsanayi .com/vuvls
flurrbinh .net/6mz3c5q
There will probably be other download locations. This Hybrid Analysis* and this Malwr report** show the Locky ransomware in action. This version of Locky does not appear to use C2 servers, but instead drops a malicious DLL with an MD5 of 75e6faf192d00b296d89df2cd56c454a and a detection rate of 9/56***."
* https://www.hybrid-analysis.com/sam...457ceb045a51be40dba641cc169?environmentId=100
Contacted Hosts
67.171.65.64
52.34.245.108
52.85.184.253

** https://malwr.com/analysis/NGFjZjIxNDVkNmY2NDNiZWFlMDE4ZjI1YzEwMTZmNzc/
Hosts
213.176.241.230

*** https://virustotal.com/en/file/79d4...c53ebe566345db044d9c6bc6/analysis/1478613989/
___

Fake 'Order' SPAM - more Locky
- https://myonlinesecurity.co.uk/order-88222889-malspam-delivers-even-more-locky/
8 Nov 2016 - "... Locky onslaught continues... an email with the extremely generic subject of 'Order 88222889 (random numbers)' coming as usual from random companies, names and email addresses with a random named zip attachment containing a WSF file... One of the emails looks like:
From: TUAN LILLIE <eml@ woolleymarket .com>
Date: Tue 08/11/2016 16:12
Subject: Order 88222889
Attachment: jAlR88222889.zip
Please find document attached

8 November 2016: jAlR88222889.zip: Extracts to: XWZ429433-2034.wsf - Current Virus total detections 10/55*
MALWR** shows a download of an encrypted file from
http ://inzt .net/67j5hg?nrxLhJ=HYkWYO -or- http ://all-kaigo .com/67j5hg?nrxLhJ=HYkWYO
which is converted by the script to woxUgKy2.dll (VirusTotal 12/56***). C2: http ://158.69.223.5 /message.php...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...97cf3aa9f7b060d1ba968613/analysis/1478621842/

** https://malwr.com/analysis/YTMzZjdhYmYyOWE0NDk3YTgwN2JkOWE2NjM2YmI5NTE/
Hosts
219.94.203.182
193.24.220.4
185.118.66.90
158.69.223.5

*** https://www.virustotal.com/en/file/...2696ac259c0e72874aa2fed9/analysis/1477647176/

:fear::fear:

AplusWebMaster · Nov 9, 2016

Fake 'Amazon order', 'FedEx', 'Account suspended', 'E-bill' SPAM

FYI...

Fake 'Amazon order' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-your-amazoncom-order-has.html
9 Nov 2016 - "Overnight there has been a massive -fake- Amazon spam run leading to Locky ransomware:
From: Amazon Inc [auto-shipping27@ amazon .com]
Date: 8 November 2016 at 23:10
Subject: Your Amazon .com order has dispatched (#021-3323415-8170076)
Dear Customer,
Greetings from Amazon.com,
We are writing to let you know that the following item has been sent using DHL Express.
For more information about delivery estimates and any open orders, please visit...
Your order #021-3323415-8170076 (received November 8, 2016)
Your right to cancel ...

All the versions I have seen contain those same formatting errors. Details vary from message to message (e.g. carrier, reference numbers). Attached is a malicious ZIP file (e.g. ORDER-608-0848796-6857907.zip) containing a malicious javascript file (e.g. F-9295287522-9444213500-201611165156-2601.js)... My usual source (thank you) tells me that the various scripts download a component...
(Long list of domain-names at the dynamoo URL above.)
... It appears to drop a malicious DLL with a detection rate of 32/56*. The following C2 servers have been identified:
85.143.212.23 /message.php (PrdmService LLC, Russia)
158.69.223.5 /message.php (OVH, Canada)
UPDATE: According to the Hybrid Analysis** the dropped Locky binary actually has an MD5 of ad6fb318002df4ffc80795cc31d529b4 and a detection rate of 28/56***.
Recommended blocklist:
85.143.212.23
158.69.223.5 "
* https://virustotal.com/en/file/7e6c...61de15d16d15ab5cf8615951084a5960007/analysis/

** https://www.hybrid-analysis.com/sam...445d944423ce048ee9eb6f61ea9?environmentId=100
Contacted Hosts
5.9.189.68
85.143.212.23
158.69.223.5
52.34.245.108
52.222.157.37
61.213.151.43

*** https://virustotal.com/en/file/57a0...4e12a5edf3652bb2d9b2077d/analysis/1478684633/

- https://myonlinesecurity.co.uk/your-amazon-com-order-has-dispatched-malspam-delivers-locky/
8 Nov 2016 - "... Locky downloader... an email with the subject of 'Your Amazon .com order has dispatched (#324-3101580-5413719) [random numbers]' pretending to come from Amazon .com <auto-shipping6@ amazon .com>... The js file inside the zip and the downloaded Locky file are identical to this slightly earlier malspam run[1]...
1] https://myonlinesecurity.co.uk/fax-transmission-malspam-delivers-locky/
One of the emails looks like:
From: Amazon .com <auto-shipping6@ amazon .com>
Date: Thu 01/09/2016 19:22
Subject: Your Amazon .com order has dispatched (#324-3101580-5413719)
Attachment: ORDER-324-3101580-5413719.zip
Dear Customer,
Greetings from Amazon .com,
We are writing to let you know that the following item has been sent using DHL Express.
For more information about delivery estimates and any open orders, please visit...
Your order #324-3101580-5413719 (received November 8, 2016)
Your right to cancel...

1] 8 November 2016: F-9456818814-1332384076-201611050929-1010.zip: Extracts to: F-8526972159-4046871521-201611111127-2039.js
Current Virus total detections 12/55*. MALWR** shows a download of an encrypted file from
http ://masiled .es/7845gf?ukORpqyil=ukORpqyil which is converted by the script to
ukORpqyil1.dll (VirusTotal 14/57***). C2 http ://158.69.223.5 /message.php... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...acdedd8de81f1ac205b04de7/analysis/1478643166/

** https://malwr.com/analysis/MWMwYzNkNjI0NGMzNDhkYmE0MDhmOGM3YWVkZjJlNTQ/
Hosts
185.76.77.219
158.69.223.5

*** https://www.virustotal.com/en/file/...4e12a5edf3652bb2d9b2077d/analysis/1478643306/
___

Fake 'FedEx' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/fede...rcel-malspam-now-delivering-locky-ransomware/
9 JNov 2016 - "... Locky downloader... an email with the subject of 'We could not deliver your parcel, #551196' (random numbers) pretending to come from -FedEx- Standard Overnight with a malicious word doc downloading Locky... The email looks like:
From: FedEx Standard Overnight <cbrecareers@ cbre .com>
Date: Wed 09/11/2016 07:50
Subject: We could not deliver your parcel, #551196
Attachment: FedEx.doc
Hello,
We could not deliver your item. Please, download Delivery Label attached to this email.
Kaja Helscher – Area Manager FedEx , CA
Regards

9 November 2016: FedEx.doc - Current Virus total detections 18/55*
Payload Security** shows a download from http ://perfectionbm .top/ll/ldd.php which is saved as 0.7055475 and autorun by the macro (VirusTotal 9/55***). Payload Security[4]. C2 are 51.255.107.6 /message.php and
81.177.27.222 /message.php... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...ff0bb0651e6434c45e79c387/analysis/1478674872/

** https://www.hybrid-analysis.com/sam...efaff0bb0651e6434c45e79c387?environmentId=100
Contacted Hosts
46.22.220.32
51.255.107.6
81.177.27.222

*** https://www.virustotal.com/en/file/...01ebd32071bb9af8e1b5bb55/analysis/1478676422/

4] https://www.hybrid-analysis.com/sam...a8201ebd32071bb9af8e1b5bb55?environmentId=100
Contacted Hosts
51.255.107.6
81.177.27.222
___

Fake 'Account temporarily suspended' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/account-temporarily-suspended-malspam-delivers-locky/
9 Nov 2016 - "... Locky downloader... an email with the subject of 'Account temporarily suspended' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of recipients name_random numbers.zip containing a .JS file... One of the emails looks like:
From: Ethan Talley <Talley.Ethan@ glycomicscenter .com>
Date: Wed 09/11/2016 09:43
Subject: Account temporarily suspended
Attachment: ea00ba32a5.zip
Dear Customer.
You have exceeded the limit of operations on your credit card.
Thus, we have temporarily blocked your account.
The full itemization of transactions and instructions are given in the document attached to this message.
Best regards.

9 November 2016: hp_printer_e1b837ff1.zip: Extracts to: 6011290KI.js - Current Virus total detections 8/55*
MALWR** shows a download of a file from http ://locook .com/n8kacjjc which is renamed by the script to hC0VoiB2fRYyoJt8.dll (VirusTotal 9/57***). Payload security[4] shows C2 81.177.26.136 | 185.118.164.125
95.46.8.109 /message.php... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...623c1488d877bcaa178b70e1/analysis/1478684678/

** https://malwr.com/analysis/YmE0OTAyYjU2NWRkNGY2ZmIzZDVkM2MwODRlODM5YTQ/
Hosts
123.57.33.148

*** https://www.virustotal.com/en/file/...ff3097b0f76435903965ed32/analysis/1478685279/

4] https://www.hybrid-analysis.com/sam...934623c1488d877bcaa178b70e1?environmentId=100
Contacted Hosts
123.57.33.148
67.171.65.64
81.177.26.136
185.118.164.125
95.46.8.109

- http://blog.dynamoo.com/2016/11/malware-spam-account-temporarily.html
9 Nov 2016 - "This -fake- financial spam leads to Locky ransomware:
From: Nicole Roman
Date: 9 November 2016 at 10:44
Subject: Account temporarily suspended
Dear Customer.
You have exceeded the limit of operations on your credit card.
Thus, we have temporarily blocked your account.
The full itemization of transactions and instructions are given in the document attached to this message.
Best regards.

The name of the sender varies. In the sample I looked at, the attachment was named after the recipient plus a random number, containing a randomly-named malicious .js script... That particular script attempts to download a binary... This Hybrid Analysis* and this Malwr report** show a DLL being dropped with an MD5 of f86d98b1a67952f290c550db1c0bdcbc and a detection rate of 9/56***..."
* https://www.hybrid-analysis.com/sam...2f11a7ef368ef4b4b8995956973?environmentId=100
Contacted Hosts
67.171.65.64
52.32.150.180
54.230.197.17
63.245.215.95
52.35.54.251

** https://malwr.com/analysis/MWIzNjZiZjYyZWY2NGExZGI0YzU2ZTY3MDMzNzA4NGQ/
Hosts
67.171.65.64

*** https://virustotal.com/en/file/a5ec...93fae40963e8aa679c9108b7/analysis/1478689362/
___

Fake 'E-bill' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-shell-fuel-card-e-bill.html
9 Nov 2016 - "This spam has an interestingly malformed subject, however the attachment leads to Locky ransomware:
Subject: Shell Fuel Card E-bill 8089620 for Account (rnd(B,S,F,H,A,D,C,N,M,L)}}776324 08/11/2016
From: KELLY MOORHOUSE (kelly.moorhouse@ edbn .org)
Date: Wednesday, 9 November 2016, 12:52
KELLY MOORHOUSE
Last & Tricker Partnership
3 Lower Brook Mews
Lower Brook Street
Ipswich Suffolk IP4 1RA
T: 01473 252961 F: 01473 233709 M: 07778464004 ...

Sender names vary, but the error in the subject persists in all versions. Attached is a ZIP file with a name beginning with "ebill" (e.g. ebill209962.zip) which contains a malicious .WSF script (e.g. 18EQ13378042.wsf)... For one sample script, the Hybrid Analysis* and Malwr report** indicate a binary is downloaded from one of the following locations:
alamanconsulting .at/0ftce4?aGiszrIV=gRLYYDHSna
naka-dent .mobi/0ftce4?aGiszrIV=gRLYYDHSna
This drops a malicious DLL with an MD5 of c1b0b1fb4aa56418ef48421c58ad1b58 and a detection rate of 13/56***.
85.143.212.23 /message.php (PrdmService LLC, Russia)
158.69.223.5 /message.php (OVH, Canada)
These are the same C2s as seen here[4]."
* https://www.hybrid-analysis.com/sam...b5a00a42258512d3c8294f90743?environmentId=100
Contacted Hosts
185.98.7.100
120.136.10.80
85.143.212.23
158.69.223.5
52.32.150.180
52.85.184.199

** https://malwr.com/analysis/ZGI5ZGEyYTFiMTIyNDNjOTg4ZmZhNmNjMGM5YmRjMTU/
Hosts
185.98.7.100
120.136.10.80
85.143.212.23
158.69.223.5

*** https://virustotal.com/en/file/32a2...0da46cf4c22cc29e7f412141/analysis/1478698613/

4] http://blog.dynamoo.com/2016/11/malware-spam-your-amazoncom-order-has.html

:fear::fear:

AplusWebMaster · Nov 10, 2016

Fake 'Receipt', 'Document' SPAM

FYI...

Fake 'Receipt' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/lock...-in-blank-email-from-spoofed-gmail-addresses/
10 Nov 2016 - "... Locky downloader... a -Blank- email with the subject of 'Receipt 93-241363' (random numbers) pretending to come from random names @ Gmail.com with a zip attachment containing a WSF file... One of the emails looks like:
From: brianna.simister@ gmail .com
Date: Thu 10/11/2016 10:14
Subject: Receipt 93-241363
Attachment: Receipt 93-241363.zip

Body content: Totally empty/Blank

10 November 2016: Receipt 93-241363.zip: Extracts to: FGNTHQ253308.wsf - Current Virus total detections 8/55*
MALWR** shows a download of an encrypted file from http ://livinghealthyworld .com/845yfgh?nivGYcwhUYT=mCDCzF
which is converted by the script to idJsCdj1.dll (VirusTotal 8/55***). C2 http ://107.181.174.34 /message.php...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...e80dce6970869b8f129f5d19/analysis/1478772972/

** https://malwr.com/analysis/ZTRmMTQ2ZjZhMWM2NGUyNTkyNTNlZTE5MmU2ZGU0ZDE/
Hosts
104.37.35.78
107.181.174.34

*** https://www.virustotal.com/en/file/...4e3564b70335a89fd51419b3/analysis/1478773545/
___

Fake 'Document' SPAM - more Locky
- https://myonlinesecurity.co.uk/lock...-in-blank-email-from-spoofed-gmail-addresses/
10 Nov 2016 - "... Locky downloader... a -blank- email with the subject of 'Document from Amparo' (random names) pretending to come from random names @ Gmail .com with a zip attachment containing a WSF file... One of the emails looks like:
From: Amparo ormerod <Amparo734987@ gmail .com>
Date: Thu 10/11/2016 14:38
Subject: Document from Amparo
Attachment: DOC-20161110-WA000458.zip

Body content: Totally empty/blank

10 November 2016: DOC-20161110-WA000458.zip: Extracts to: RPPMS171825.wsf - Current Virus total detections 8/55*
Payload Security** shows a download of an encrypted file from
project-group .pro/845yfgh?eKSrkxbtC=rewwnkHmjMh which is converted by the script to idJsCdj1.dll
(VirusTotal 11/56***). C2 107.181.174.34 /message.php and others... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...48b0abeeb9613f1308c35b10/analysis/1478793348/

** https://www.hybrid-analysis.com/sam...c9a48b0abeeb9613f1308c35b10?environmentId=100
Contacted Hosts
185.43.5.211
188.127.237.175
86.110.117.244
107.181.174.34
85.143.212.23
69.195.129.70
52.84.13.31
74.216.233.251
52.35.54.251
71.19.173.112
165.254.32.128
23.4.187.27

*** https://www.virustotal.com/en/file/...8f5c902e27ae36a00551ca2e/analysis/1478794808/
___

Ransomware doesn’t mean 'game over'
- https://blog.malwarebytes.com/101/2016/11/ransomware-doesnt-mean-game-over/
Nov 10, 2016 - "... Over the course of just a few years, this threat has evolved from an annoying pop-up to a screen freezer that utilizes disturbing imagery to a sophisticated malicious program that encrypts important files. New technologies are popping up all the time that combat the ransomware issue, however most (if not all) require active protection -before- you get infected. But what do you do if your company has already been infected?... at least in the criminal’s eyes, once a user gets infected, there is no recovery option other than paying the ransom. Also, victims actually pay-the-ransom directly to the criminal, cutting out any need for middlemen or having to sell piles of stolen credit card information on darknet forums... It’s likely that the future of ransomware will include things like blackmail (threats to post trade secrets or company intel online or releasing customer information), more aggressive infection and AV evasion techniques, and better target identification—all techniques that we know how to combat. However, while the news of how to stop the malware is spreading, millions of people are still going to get infected because they didn’t 'get the memo'...
> Option 1: Backups: ... make -sure- you keep some kind of file history enabled in your -backup- solution so you can revert to a previous backup if necessary. Also, utilize off-site and/or cloud backups[1] rather than storing everything on a network drive, since many ransomware families are capable of reaching through mapped connections and connected drives to encrypt files outside of the victim HD...
1] http://www.csoonline.com/article/30...r-backups-protect-you-against-ransomware.html
> Option 2: Decryption: ... If you get hit once, your files are encrypted and there is nothing you can do about it — or so many people think. Thanks to the diligent efforts of our information security community, there are actually many decryptors available online[2]. This software, when matched with the correct ransomware family, can decrypt files for free...
2] https://www.nomoreransom.org/
> Option 3: Negotiate: ... At the end of the day, the bad guys just want to get paid, which means that historically they have been open to negotiating and returning a few files for a smaller amount of profit. To be absolutely clear, I do -not- endorse or support paying cybercriminals the ransom. However, it has to be understood that for some folks, the loss of files would be far more damaging than just paying the ransom fee...
> Conclusion: So there you have it, the three methods, outside of utilizing modern anti-ransomware security software to prevent infection, that can help you recover from a ransomware attack. They might not be absolute solutions, but anything is better than losing valuable data to cybercriminals. Maybe knowing how disappointing the recovery methods are for a ransomware attack will motivate some folks to actually use proactive protection and anti-ransomware technology, which remains the best option for fighting ransomware infection* -not- allowing the malware to encrypt your files in the first place."
* https://www.malwarebytes.com/pdf/in...graphic.pdf?utm_source=blog&utm_medium=social

:fear::fear:

AplusWebMaster · Nov 11, 2016

Fake 'Tech Support Order', 'Blank or NO subject', 'Virtual card' SPAM

FYI...

Fake 'Tech Support Order' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/locky-delivered-by-malspam-technical-support-order/
11 Nov 2016 - "... Locky downloader... an email with the subject of 'Order' pretending to come from Technical Support at random companies, and email addresses with zip attachment in the format of order_ < recipients name >.zip containing a .js file... One of the emails looks like:
From: Technical Support <Hogan.Terrance@ dl0349 .screaming .net>
Date: Fri 11/11/2016 11:42
Subject: Order
Attachment: order_scans.zip
Dear Customer
The item you’ve ordered is on delay due to the unknown problem regarding your bank account you paid from.
Please check you data in the attachment as soon as you can.
Best Wishes,
Terrance Hogan
Technical Support

11 November 2016: order_scans.zip: Extracts to: -91Q99QFW2H2-.js - Current Virus total detections 7/55*
Manual analysis shows a download of a file from one of these locations:
http ://g2el .com/grj2qqih | http ://gusi .biz/gu7h38t | http ://nsrcconsulting .com/dumu1sl
http ://thirlnak .net/5crdsr | http ://scupwail .com/5ghkmmf which is renamed by the script and autorun
(VirusTotal 10/57**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...777260ab1fc60e3e499f6b4f/analysis/1478866769/

** https://www.virustotal.com/en/file/...9ee11f9aec55e8b9c97f7be8/analysis/1478865179/

g2el .com: 167.88.3.113: https://www.virustotal.com/en/ip-address/167.88.3.113/information/
gusi .biz: 88.85.81.9: https://www.virustotal.com/en/ip-address/88.85.81.9/information/
nsrcconsulting .com: 113.197.39.189: https://www.virustotal.com/en/ip-address/113.197.39.189/information/
thirlnak .net: 67.171.65.64: https://www.virustotal.com/en/ip-address/67.171.65.64/information/
213.176.241.230: https://www.virustotal.com/en/ip-address/213.176.241.230/information/
scupwail .com: 213.176.241.230
67.171.65.64
___

Blank or NO subject SPAM - malformed/broken email delivers Locky
- https://myonlinesecurity.co.uk/locky-delivered-by-damaged-malformed-broken-malspam-with-no-subject/
11 Nov 2016 - "... Locky downloader... a damaged/malformed/broken email with either a -blank- subject line or the subject of <no subject> coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of todays date and loads of random numbers containing a .JS file. Despite the delivered email being malformed or damaged, the actual attachment works fine and will encrypt your computer if you open or run the .js file inside the zip...

Screenshot: https://i1.wp.com/myonlinesecurity..../broken_locky_email.png?resize=1024,965&ssl=1

11 November 2016: 20161111174617885403.zip: Extracts to: 201611111333125461862851.js
Current Virus total detections 10/55*. MALWR** shows a download of an encrypted file from
http ://ibluegreen .com/487ygfh?hpuarlLJK=hpuarlLJK which is converted by the script to hpuarlLJK1.dll
(VirusTotal 9/57***). C2: http ://85.143.212.23 /message.php ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...d115477afca22ebd62ebbdab/analysis/1478868610/

** https://malwr.com/analysis/ODM5YmZkNDg4ODJhNGU4OWE4MmJjNDRlYjBjMDMzZGQ/
Hosts
222.231.31.195: https://www.virustotal.com/en/ip-address/222.231.31.195/information/
85.143.212.23: https://www.virustotal.com/en/ip-address/85.143.212.23/information/

*** https://www.virustotal.com/en/file/...dcef7d84bfe102a428b14cea/analysis/1478867406/
___

Fake 'Virtual card' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/locky-delivered-by-virtual-card-malspam/
11 Nov 2016 - "... Locky downloader... an email with the subject of 'Virtual card' coming as usual from random companies, names and email addresses with a zip attachment in the format of virtualcard_recipient name.zip containing a .js file... One of the emails looks like:
From: Carmella Sandoval <Sandoval.Carmella@ usstidewater .org>
Date:Fri 11/11/2016 18:37
Subject: Virtual card
Attachment: virtualcard_wellsybolujou.zip
Dear Client! A virtual card you have ordered is now ready but not active.
In order to activate it, please open the attached document and specify your personal data when it’s possible.

11 November 2016: virtualcard_wellsybolujou.zip: Extracts to: 6KO1G7XU-3827P1594ZITKI6G51.js
Current Virus total detections 7/55*. Manual analysis shows a download of a file from one of these locations:
spoiltgirlsclub .com/x6usth1 | eddermiaul .net/2yr5egml | mangdesign .com/ud7gv4 | hzcysw .net/u1qmyaw
darbyreis .com/39hv30q9 which is renamed by the script (VirusTotal 11/57**)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...f04bdbac325ad7a6d7e1401c/analysis/1478889495/

** https://www.virustotal.com/en/file/...e7ae5bb3b9ee7ab038864476/analysis/1478889911/

spoiltgirlsclub .com: 64.69.219.91: https://www.virustotal.com/en/ip-address/64.69.219.91/information/
eddermiaul .net: 213.176.241.230: https://www.virustotal.com/en/ip-address/213.176.241.230/information/
67.171.65.64: https://www.virustotal.com/en/ip-address/67.171.65.64/information/
mangdesign .com: 121.40.24.159: https://www.virustotal.com/en/ip-address/121.40.24.159/information/
hzcysw .net: 116.255.152.112: https://www.virustotal.com/en/ip-address/116.255.152.112/information/
darbyreis .com: 213.176.241.230
67.171.65.64
___

Malicious SPAM volume hits two year high
- https://www.helpnetsecurity.com/2016/11/11/malicious-spam-volume/
Nov 11, 2016 - "According to the Kaspersky Lab Spam and Phishing in Q3 report*, the company’s products blocked 73,066,751 attempts to attack users with malicious attachments. This is the largest amount of malicious spam since the beginning of 2014 and is a 37 percent increase compared to the previous quarter. The majority of those attachments were ransomware Trojan downloaders:
> https://www.helpnetsecurity.com/images/posts/kaspersky-112016-spam.jpg
... the percentage of spam in global email traffic in September hit an all-time high for the year so far at 61.25 percent..."
* https://securelist.com/analysis/quarterly-spam-reports/76570/spam-and-phishing-in-q3-2016/
Proportion of spam in email traffic
> https://cdn.securelist.com/files/2016/11/spam_q3_2016_eng_11.png
Sources of spam by country
>> https://cdn.securelist.com/files/2016/11/spam_q3_2016_eng_12.png
Countries -targeted- by malicious mailshots
>>> https://cdn.securelist.com/files/2016/11/spam_q3_2016_eng_15.png
___

Ransomware doesn’t mean 'game over'
- https://blog.malwarebytes.com/101/2016/11/ransomware-doesnt-mean-game-over/
Nov 10, 2016 - "... Over the course of just a few years, this threat has evolved from an annoying pop-up to a screen freezer that utilizes disturbing imagery to a sophisticated malicious program that encrypts important files. New technologies are popping up all the time that combat the ransomware issue, however most (if not all) require active protection -before- you get infected. But what do you do if your company has already been infected?... at least in the criminal’s eyes, once a user gets infected, there is no recovery option other than paying the ransom. Also, victims actually pay-the-ransom directly to the criminal, cutting out any need for middlemen or having to sell piles of stolen credit card information on darknet forums... It’s likely that the future of ransomware will include things like blackmail (threats to post trade secrets or company intel online or releasing customer information), more aggressive infection and AV evasion techniques, and better target identification—all techniques that we know how to combat. However, while the news of how to stop the malware is spreading, millions of people are still going to get infected because they didn’t 'get the memo'...
> Option 1: Backups: ... make -sure- you keep some kind of file history enabled in your -backup- solution so you can revert to a previous backup if necessary. Also, utilize off-site and/or cloud backups[1] rather than storing everything on a network drive, since many ransomware families are capable of reaching through mapped connections and connected drives to encrypt files outside of the victim HD...
1] http://www.csoonline.com/article/30...r-backups-protect-you-against-ransomware.html
> Option 2: Decryption: ... If you get hit once, your files are encrypted and there is nothing you can do about it — or so many people think. Thanks to the diligent efforts of our information security community, there are actually many decryptors available online[2]. This software, when matched with the correct ransomware family, can decrypt files for free...
2] https://www.nomoreransom.org/
> Option 3: Negotiate: ... At the end of the day, the bad guys just want to get paid, which means that historically they have been open to negotiating and returning a few files for a smaller amount of profit. To be absolutely clear, I do -not- endorse or support paying cybercriminals the ransom. However, it has to be understood that for some folks, the loss of files would be far more damaging than just paying the ransom fee...
> Conclusion: So there you have it, the three methods, outside of utilizing modern anti-ransomware security software to prevent infection, that can help you recover from a ransomware attack. They might not be absolute solutions, but anything is better than losing valuable data to cybercriminals. Maybe knowing how disappointing the recovery methods are for a ransomware attack will motivate some folks to actually use proactive protection and anti-ransomware technology, which remains the best option for fighting ransomware infection -not- allowing the malware to encrypt your files in the first place."

:fear::fear:

AplusWebMaster · Nov 12, 2016

Fake -Blank- SPAM

FYI...

Fake -Blank- SPAM - delivers Locky
- https://myonlinesecurity.co.uk/locky-delivered-by-blank-email-with-double-zipped-attachment/
12 Nov 2016 - "... Locky downloader... a blank email with the subject of '18026 sandra' pretending to come from r.gaffney@ mmu. ac.uk with a zip attachment containing -another- zip that eventually extracts to a .JS file that delivers Locky... One of the emails looks like:
From: r.gaffney@ mmu. ac.uk
Date: Thu 01/09/2016 19:22
Subject: 18026 sandra
Attachment: MESSAGE_43437218629_sandra.zip

Body content: completely empty/blank

12 November 2016: MESSAGE_43437218629_sandra.zip: which extracts to ALERT_23367_ZIP.zip which in turn extracts to: ALERT_23367.js - Current Virus total detections 7/54*
Payload Security shows a download of a file from www .parametersnj .top/user.php?f=1.dat which gave user.exe
(VirusTotal 3/57**). Payload Security***. C2 107.181.174.34 | 85.143.212.23 | 185.82.217.29 | 107.181.174.34
all using /message.php... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...cba4c8d74b45bb8dd6df87b8/analysis/1478957028/

** https://www.virustotal.com/en/file/...c3ee190d09f04bd92d82a08e/analysis/1478957725/

*** https://www.hybrid-analysis.com/sam...306c3ee190d09f04bd92d82a08e?environmentId=100
Contacted Hosts
107.181.174.34
85.143.212.23
185.82.217.29
52.32.150.180
52.222.171.99
35.160.111.237
77.109.131.232

:fear::fear:

AplusWebMaster · Nov 15, 2016

Fake 'EFax' SPAM

FYI...

Fake 'EFax' SPAM - delivers Trickbot banking Trojan
- https://myonlinesecurity.co.uk/tric...-to-come-from-scanner-your-own-email-address/
15 Nov 2016 - "An email pretending to be an EFax delivery message with the subject of 'You have recevied a message' pretending to come from Fax Scanner <scanner@ victim domain .tld> with a malicious word doc delivers the latest Trickbot banking Trojan...

Screenshot: https://i1.wp.com/myonlinesecurity....canner-spoofed-efax.png?resize=1024,373&ssl=1

15 November 2016: Message efax system-1332.doc - Current Virus total detections 4/54*
Payload Security shows a download from ‘http :// www .tessaban .com/admin/images/ldjslfjsnot.png’ which is renamed by the macro script to wer5.exe and autorun (Payload Security **) (VirusTotal 9/56***)
tessaban .com 61.19.247.54 has been used for malware spreading for some time now and really needs blocking
[1] [2] [3] [4]... DO NOT follow the advice they give to enable macros or enable editing to see the content...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...9b41f7dd83cad731d2917684/analysis/1479191384/

** https://www.hybrid-analysis.com/sam...2336ab081af7d6b0ea072df717d?environmentId=100
Contacted Hosts
78.47.139.102
193.107.111.164
81.177.13.236
185.86.77.224

*** https://www.virustotal.com/en/file/...6ab081af7d6b0ea072df717d/analysis/1479185920/

1] https://virustotal.com/en/url/d517f...d550fb954d274e0ca964077a/analysis/1479194525/

2] http://95.34.115.158/report.php?id=1478197500549
IP: 61.19.247.54

3] https://virustotal.com/en/url/3e835...1e373a864ccaffa27dfdefd0/analysis/1479194687/

4] http://95.34.115.158/report.php?id=1479194667714
IP: 61.19.247.54

:fear::fear:

AplusWebMaster · Nov 16, 2016

Fake 'MoneyGram', 'QuickBooks' SPAM, 'Tax Refund' Phish

FYI...

Fake 'MoneyGram' SPAM - deliver java jacksbot
- https://myonlinesecurity.co.uk/java-jacksbot-delivered-by-spoofed-moneygram-international-malspam/
16 Nov 2016 - "... -fake- financial themed emails containing java adwind or Java Jacksbot attachments... The email looks like:
From: GGCC Payment Discrepancy <GGCCPaymentDiscrepancy@ gmail .com>
Date: Wed 16/11/2016 06:08
Subject: Second request of Confirmation of payment, ref 3748155
Attachment: REVIEW AND RELEASE TRANSACTION.zip (contains 2 identical java.jar files Branch Spreadsheet.jar and Cash Report.jar)
Good afternoon,
We need your assistance in obtaining documents for this transaction. The customer claims the funds were not received and we are conducting an investigation. Please provide the following documents:
Receive documents
Customers identification (if available)
Any other information the agent may have
Attached are the transaction details.
In order to satisfy the customers claim we must receive the documentation no later than 18th November 2016. Failure to do so may result in a debit to your account. Please notify us immediately should you encounter any delays.
*Also be sure to include the reference number in the subject field/body of email to avoid duplicate emails.*
Thank you,
Ilona Karamon
Resolution Assurance Analyst I
MoneyGram International
P: 18003285678 ext: 582134
MoneyGram International
KBC, Konstruktorska 13
Warsaw, 02-673 Poland ...

16 November 2016: Branch Spreadsheet.jar (323 kb) - Current Virus total detections 22/56*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...0887724e8cdc743abd605efb/analysis/1479280071/
___

Fake 'QuickBooks' SPAM - delivers Dridex
- https://myonlinesecurity.co.uk/drid...oks-invoice-00482-imitating-random-companies/
16 Nov 2016 - "... an email with the subject of 'Invoice 00482' from Orrell Filtration Ltd (random companies) with a -link- in the email body to download a zip file that downloads Dridex banking Trojan... which delivers Invoice 00482.zip which extracts to Invoice 00482.js...

Screenshot: https://i2.wp.com/myonlinesecurity....rell-Filtration-Ltd.png?resize=1024,688&ssl=1

16 November 2016: Invoice 00482.zip: Extracts to: Invoice 00482.js - Current Virus total detections 2/54*
Payload Security** shows a download of a file from www .rtbh.bravepages .com/images/Manual.pdf which is -not- a pdf but a renamed .exe file which in turn is renamed by the script to GYGMgcC.exe (VirusTotal 10/56***). (Payload Security[4])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...a4e70517981e91693b4f9cfd/analysis/1479298844/

** https://www.hybrid-analysis.com/sam...180a4e70517981e91693b4f9cfd?environmentId=100
Contacted Hosts
69.27.174.10
45.124.64.220
110.138.108.142
72.249.45.71
216.234.115.137

*** https://www.virustotal.com/en/file/...3b226a7ed01559860274233b/analysis/1479299700/

4] https://www.hybrid-analysis.com/sam...2b93b226a7ed01559860274233b?environmentId=100
Contacted Hosts
45.124.64.220
110.138.108.142
72.249.45.71
216.234.115.137
___

Fake 'Tax Refund' Phish
- http://blog.dynamoo.com/2016/11/phishing-office-365-tax-refund-service.html
16 Nov 2016 - "Microsoft Office 365 offering a tax refund service? Really? No, of course not, it's a phishing scam..

Screenshot: https://4.bp.blogspot.com/-pDmYR6qA...vauuYUy08vscKiWwCLcB/s1600/office-365-tax.png

The link in the email leads to updatemicrosoftonline .com on 89.248.168.13 (Quasi Networks LTD, Seychelles). Despite the email and the domain name it leads to an HMRC-themed phishing page:
> https://1.bp.blogspot.com/-TXxXnPQl...IcHIW0mFXClfFSyOnk-wCLcB/s1600/hmrc-phish.png
This multi-phish page has -twelve- UK banks set up on it:
Barclays, Halifax, HSBC, Lloyds Bank, NatWest, Royal Bank of Scotland, Santander, TSB, Metro Bank, Clydesdale Bank, The Co-Operative Bank, Tesco Bank..
Clicking on any of the links goes to a pretty convincing looking phish page, personalised for each bank and carefully extracting all the information they need for account theft. The screenshots below are the sequence if you choose TSB bank:
> https://4.bp.blogspot.com/-iciyhkhy...vhZfThPKHBwQ-dRkspgCLcB/s1600/tsb-phish-1.png
(More examples shown at the 1st dynamoo URL at the top.)
... Once you have entered all the information, the process appears to -fail- and you are directed to a genuine HMRC site instead. A list of sites found in 89.248.168.0/24 can be found... I suggest that the entire network range looks questionable and should be -blocked-."
___

'Mega' attacks on the Rise
- http://fortune.com/2016/11/15/akamai-ddos-report/
Nov 15, 2016 - "... hackers knocking websites offline with massive floods of Internet traffic is nothing new. But the pattern of these so-called DDoS attacks (for “distributed denial of service”) is changing, according to a new report* from internet provider Akamai...
* https://content.akamai.com/pg7426-pr-soti-report.html
... the overall number of DDoS attacks has not risen significantly in 2016, but that the force of these attacks is increasing. Akamai says it confronted 19 “mega attacks” in the third quarter of this year, including the two biggest it has ever encountered in history... The prime targets for the -19- “mega” attacks, which Akamai defines as those that reach over 100 Gbps, were media and entertainment companies, though gaming and software firms were also hit. The two record-breaking attacks, reaching 623 Gbps and 555 Gbps, were directed at security blogger Brian Krebs. The attacks succeeded in taking down Krebs’ website until Jigsaw, a unit of Google’s parent company Alphabet... deployed its Project Shield service to deflect the attack. The reason for this recent surge in mega attacks is tied to security defects in the 'Internet of things'. This involves hackers taking over millions of everyday devices connected to the Internet — especially DVRs, security cameras and home routers — and conscripting them to be part of a botnet army, known as Mirai. Mirai gained widespread notoriety in October, after hackers briefly used it to obstruct consumers’ access to popular sites like Amazon and Twitter, and many of the devices under its control are still compromised. As Akamai suggests, the 'Internet of Things' problem may just be beginning..."

:fear::fear:

AplusWebMaster · Nov 17, 2016

Fake 'Sage Invoice', 'Please check' SPAM, AMEX Phish

FYI...

Fake 'Sage Invoice' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/trickbot-banking-trojan-delivered-by-spoofed-sage-outdated-invoice/
17 Nov 2016 - "An email with the subject of ' pretending to come from 'Sage Invoice' with a malicious word doc delivers Trickbot banking Trojan... sageinvoices .com / sage-invoice .com /sage-invoices .com are all newly created -yesterday- ... domains sending these emails include:
Sage Invoice <service@ sage-invoices .com>
Sage Invoice <service@ sage-invoice .com>
Sage Invoice <service@ sageinvoice .com> ...

Screenshot: https://i0.wp.com/myonlinesecurity....tdated-sage-invoice.png?resize=1024,689&ssl=1

17 November 2016: SageInvoice.doc - Current Virus total detections 3/54*
Payload Security** shows a download from http ://delexdart .com/images/gfjfgklmslifdsfnln.png which is not a png file but a renamed .exe file which is renamed by the macro to scsadmin.exe and auto run using PowerShell (VirusTotal ***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...23ce04841a623aaed4681da2/analysis/1479380615/

** https://www.hybrid-analysis.com/sam...e6023ce04841a623aaed4681da2?environmentId=100
Contacted Hosts
182.50.132.43
78.47.139.102
193.107.111.164
81.177.13.236
185.86.77.224

*** https://www.virustotal.com/en/file/...943dcabcee364f627afb4f91/analysis/1479381072/

sage-invoices .com: 50.63.202.56: https://www.virustotal.com/en/ip-address/50.63.202.56/information/
sage-invoice .com: 184.168.221.34: https://www.virustotal.com/en/ip-address/184.168.221.34/information/
sageinvoice .com: 50.63.202.34: https://www.virustotal.com/en/ip-address/50.63.202.34/information/
//

- http://blog.dynamoo.com/2016/11/malware-spam-sage-invoice-servicesage.html
17 Nov 2016 - "This -fake- financial spam leads to Trickbot banking trojan...

Screenshot: https://3.bp.blogspot.com/-swzy7zLG...MYUFix1yxQCQfiGUACLcB/s1600/sage-trickbot.png

Attached is a malicious Word document named SageInvoice.doc with a detection rate of 3/54*. Hybrid Analysis** shows malicious network traffic to:
substan.merahost .ru/petrov.bin [185.86.77.224] (Mulgin Alexander Sergeevich aka gmhost .com.ua, Ukraine)
A malicious file scsnsys.exe is dropped with a detection rate of 8/53***.
The domain sage-invoices .com has been registered by criminals for this action, presumably to allow encrypted end-to-end communication... I recommend that you -block- traffic from that domain or check your filters to see who may have it.
Recommended blocklist:
sage-invoices .com
185.86.77.0/24 "
* https://virustotal.com/en/file/79ff...286217c21309c897e6b530603d48dea0369/analysis/

** https://www.hybrid-analysis.com/sam...1309c897e6b530603d48dea0369?environmentId=100
Contacted Hosts
61.19.247.54
78.47.139.102
193.107.111.164
81.177.13.236
185.86.77.224

*** https://virustotal.com/en/file/528a...da0ec024d24943dcabcee364f627afb4f91/analysis/
___

Fake 'Please check' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/plea...pam-tries-to-deliver-trickbot-banking-trojan/
17 Nov 2016 - "... an email with the subject of 'Please check the information-3878358' (random numbers) pretending to come from random names at your-own-email-domain that tries to deliver Trickbot banking Trojan... tessaban .com 61.19.247.54 has been used for malware spreading for some time now and really needs blocking [1]...
1] https://virustotal.com/en/url/d517f...d550fb954d274e0ca964077a/analysis/1479194525/
One of the emails looks like:
From: Brigitte Guidry <Brigitte.Guidry@ victim domain .tld >
Date: Thu 17/11/2016 02:48
Subject: Please check the information-3878358
Attachment: invoice_2222.zip
Hi,
I have attached an invoice-4654 for you.
Regards,
Brigitte Guidry

17 November 2016: invoice_2222.zip: Extracts to: invoice_1711.js - Current Virus total detections 2/54*
MALWR** shows an attempted download of a file from http ://www .tessaban .com/admin/images/ospspps.png currently giving a 404 not found which should be renamed by the script to an .exe file... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...cbe2d203e1dc128fa4d511e8/analysis/1479370770/

** https://malwr.com/analysis/YjU2ZGMzNTU3OWQzNDQ5ZmI0NTU5Njk0ZmZiNWQxYzI/
Hosts
61.19.247.54: https://www.virustotal.com/en/ip-address/61.19.247.54/information/
> https://virustotal.com/en/url/d517f...77c06f513e1d550fb954d274e0ca964077a/analysis/
___

Fake AMEX Phish
- https://myonlinesecurity.co.uk/please-activate-your-personal-security-key-american-express-phishing/
17 Nov 2016 - "... The subject is 'Please activate your Personal Security Key' coming from American Express
<welcome@ amex-mails .com>. Additional sending addresses so far found include:
Amex-mails .com | amexmails .com | amex-emails .com | amexmails .com
were -all- registered -today- by surprise, surprise: Godaddy .com. They currently do not have an IP number associated with them. When they were received, the emails came from:
172.99.87.130 - San Antonio Texas US AS27357 Rackspace Hosting ...
The weird thing is the emails appear -blank- when opened in Outlook, but using view source I can see the email in its full glory, including the links-to-click to get to the-phishing-site... A screenshot of the html is:
> https://i1.wp.com/myonlinesecurity....erican_express_safe_key.png?fit=678,913&ssl=1
Alternative links in emails go to:
http :// amexsafekeys .com | http ://americanexpressafekey .com | http ://amex-mails .com
| http:// amexmails .com
aexpsafekeys .com was registered -yesterday- 16 November 2016 and hosted on these IP addresses:
95.163.127.249 | 188.227.18.142 which look like they belong to a -Russian- network.
http ://amexsafekeys .com was also registered -yesterday- by the same Russian name and hosted on same IP addresses: 188.227.18.142 | 95.163.127.249
http ://americanexpressafekey .com also registered -yesterday- same IP addresses. Following the link to aexpsafekeys .com, you get a typical phishing page like this, where they want all the usual information about you, your family and bank/credit cards etc.:
> https://i2.wp.com/myonlinesecurity....x_phishing_safe_key.png?resize=1024,603&ssl=1 "

95.163.127.249: https://www.virustotal.com/en/ip-address/95.163.127.249/information/
> https://www.virustotal.com/en/url/4...a73312feb311bfb81654e0d1023f21c2a5d/analysis/
188.227.18.142: https://www.virustotal.com/en/ip-address/188.227.18.142/information/
> https://www.virustotal.com/en/url/4...a73312feb311bfb81654e0d1023f21c2a5d/analysis/

104.168.87.178: https://www.virustotal.com/en/ip-address/104.168.87.178/information/
> https://www.virustotal.com/en/url/4...a73312feb311bfb81654e0d1023f21c2a5d/analysis/

:fear::fear:

AplusWebMaster · Nov 18, 2016

Fake 'Western Union' SPAM

FYI...

Fake 'Western Union' SPAM - delivers jacksbot Trojan
- https://myonlinesecurity.co.uk/java...lspam-final-warning-for-sending-limit-breach/
18 Nov 2016 - "... an email with the subject of 'FINAL WARNING FOR SENDING LIMIT BREACH' pretending to come from Western Union – Agent Support Team <emeagentsupports.westernunion@ gmail .com> delivers java Adwind / Java Jacksbot...

Screenshot: https://i0.wp.com/myonlinesecurity....NDING-LIMIT-BREACH..png?resize=1024,624&ssl=1

18 November 2016: Exceeded Limit Spreadsheet.exe - Current Virus total detections 15/57*
Payload Security** shows lots of files being dropped/extracted from this file which is renamed by itself to winlogin.exe and in turn drops a multitude of identical xml files and a java.jar file which is Java Jacksbot (VirusTotal 23/56***)... All 3 links (there is one behind the image) go to:
http ://webkamagi .com/admin/images/Send Limit Exceeded.html where you see this screenshot that starts off with a circle and the words scanning and ends up looking like this that auto-downloads a file from:
http ://gicfamily .org/admin/file/Exceeded%20Limit%20Spreadsheet.exe (if for some reason it doesn’t auto-download then the download button delivers the malware):
> https://i1.wp.com/myonlinesecurity.co.uk/wp-content/uploads/2016/11/nortonscan.png?w=863&ssl=1
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...0c3536385ec0926e913d32d4/analysis/1479432563/

** https://www.hybrid-analysis.com/sam...7c20c3536385ec0926e913d32d4?environmentId=100
Contacted Hosts
216.107.152.224

*** https://www.virustotal.com/en/file/...20d558fc5c99b864ce7f7288/analysis/1479453441/
___

Ransomware hits record levels
- https://www.helpnetsecurity.com/2016/11/18/encryption-ransomware-hits-record-levels/
Nov 18, 2016 - "The amount of phishing emails containing a form of ransomware grew to 97.25 percent during the third quarter of 2016 up from 92 percent in Q1:
> https://www.helpnetsecurity.com/images/posts/phishme-112016-1.jpg
PhishMe’s Q3 2016 Malware Review identified three major trends previously recorded throughout 2016, but have come to full fruition in the last few months:
Locky continues to dominate: While numerous encryption ransomware varieties have been identified in 2016, Locky has demonstrated adaptability and longevity.
Ransomware encryption: The proportion of phishing emails analyzed that delivered some form of ransomware has grown to 97.25 percent, leaving only 2.75 percent of phishing emails to deliver all other forms of malware utilities. Increase in deployment of ‘quiet malware’: PhishMe identified an increase in the deployment of remote access Trojan malware like jRAT, suggesting that these threat actors intend to remain within their victims’ networks for a long time. During the third quarter of 2016, PhishMe Intelligence conducted 689 malware analyses, showing a significant increase over the 559 analyses conducted during Q2 2016. Research reveals that the increase is due, in large part, to the consistent deployment of the Locky encryption ransomware. Locky executables were the most commonly-identified file type during the third quarter, with threat actors constantly evolving the ransomware to focus on keeping this malware’s delivery process as effective as possible...
> https://www.helpnetsecurity.com/images/posts/phishme-112016-2.jpg
While ransomware dominates the headlines, PhishMe’s Q3 Malware Review reveals that other forms of malicious software delivered using remote access Trojans, keyloggers and botnets still represent a significant hazard in 2016. Unlike ransomware, so-called ‘quiet malware’ is designed to avoid detection while maintaining a presence within the affected organization for extended periods of time. While only 2.75 percent of phishing emails delivered non-ransomware malware, the diversity of unique malware samples delivered by these emails far exceeded that of the more numerous ransomware delivery campaigns..."
> http://phishme.com/2016-q3-malware-review/

:fear::fear:

AplusWebMaster · Nov 21, 2016

Fake 'Spam mailout', 'Amazon', 'LogMein' SPAM, Evil network

FYI...

Fake 'Spam mailout' SPAM - delievers Locky
- https://myonlinesecurity.co.uk/lock...isp-you-have-been-sending-spam-notifications/
21 Nov 2016 - "... Locky downloader... an email pretending to come from an ISP, saying that you have been sending spam with the subject of 'Spam mailout' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the form of logs_recipients name.zip... Locky has changed the encrypted file extension to .aesir - See:
- https://myonlinesecurity.co.uk/locky-changed-to-use-aesir-file-extension-and-changed-c2-format/
"... Locky has changed the encrypted file extension to .aesir as well as the C2 to “/information.cgi”. I am also informed there is a slight change to the name of the ransomware notification file that they drop on your desktop. It appears to now be _[number]-INSTRUCTION.html "
One of the emails looks like:
From: Lula Mcmahon <Mcmahon.Lula@ mtsallstream .net>
Date:Mon 21/11/2016 07:37
Subject: Spam mailout
Attachment: logs_hajighasem1c.zip
Dear hajighasem1c
We’ve been receiving spam mailout from your address recently.
Contents and logging of such messages are in the attachment.
Please look into it and contact us.
Best Regards,
Lula Mcmahon
ISP Support ...

21 November 2016: logs_hajighasem1c.zip: Extracts to: M9JJW0NTAD20O3-D53D73LEXZG60.js
Current Virus total detections 6/55*. Payload Security** and MALWR*** shows a download of an encrypted file from:
iproaction .com/utg8md which is renamed by the script to 2INuijvClpaC.dll (VirusTotal 6/57[4]). C2 have changed in these & they now post to 46.8.29.175 /information.cgi. Other C2's in the Payload security report...
... difficult to see the changed extension to .aesir until you look at:
- https://www.hybrid-analysis.com/sam...6705487b23bc2df7e3d51469ba0?environmentId=100
and scroll down to Installation/Persistance and then dropped files...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...4015dca64c15a8c5f4dd045d/analysis/1479717501/

** https://www.hybrid-analysis.com/sam...e274015dca64c15a8c5f4dd045d?environmentId=100
Contacted Hosts
194.28.173.247
213.32.66.16
91.219.28.51
46.8.29.175
52.32.150.180
54.192.46.61
95.101.81.97

*** https://malwr.com/analysis/YzU5ODQxMzQyZTI3NDhkMzgzZTc0ZDE0ZTdkZmYyY2U/
Hosts
194.28.173.247

4] https://www.virustotal.com/en/file/...4e70ca9082d61a54c7aec6f3/analysis/1479718456/
___

Fake 'Amazon' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/locky-delivered-by-spoofed-your-amazon-com-order-has-dispatched/
21 Nov 2016 - "... email with the subject of 'Your Amazon .com order has dispatched (#713-7377848-7745100)
(random numbers) pretending to come from Amazon Inc <auto-shipping4@ amazon .com> with a zip attachment matching the subject. It looks like -Locky has- changed the encrypted file extension to .aesir as well as the C2 to “/information.cgi”... One of the emails looks like:
From: Amazon Inc <auto-shipping4 @amazon .com>
Date: Mon 21/11/2016 09:40
Subject: Your Amazon .com order has dispatched (#713-7377848-7745100)
Attachment: ORDER-713-7377848-7745100.zip
Dear Customer,
Greetings from Amazon .com,
We are writing to let you know that the following item has been sent using Royal Mail.
For more information about delivery estimates and any open orders, please visit...
Your order #713-7377848-7745100 (received November 20, 2016)
Note: this e-mail was sent from a notification-only e-mail address that can=
not accept incoming e-mail. Please do not reply to this message.=20
Thank you for shopping at Amazon .com ...

21 November 2016: ORDER-713-7377848-7745100.zip: Extracts to: KBDGUB350132.js
Current Virus total detections 11/55*. MALWR** shows a download of an encrypted file from
http ://jmltda .cl/hfvg623?wCTlMeE=wCTlMeE which is renamed by the script to wCTlMeE1.dll
(VirusTotal 9/57***). C2 are http :// 89.108.73.124 /information.cgi | http :// 91.211.119.98 /information.cgi
http ://185.75.46.73 /information.cgi. Payload Security [4]shows the same... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5487b23bc2df7e3d51469ba0/analysis/1479721475/

** https://malwr.com/analysis/YzI3OTk0NmJkZGRiNDlkY2EyZGQzMjdiMGRlMWMzZjY/
Hosts
186.103.213.249
91.211.119.98
185.75.46.73
89.108.73.124

*** https://www.virustotal.com/en/file/...4eb26f828e160a5c977388b1/analysis/1479721490/

4] https://www.hybrid-analysis.com/sam...6705487b23bc2df7e3d51469ba0?environmentId=100
Contacted Hosts
186.103.213.249
89.108.73.124
91.211.119.98
185.75.46.73
52.42.26.69
54.192.46.93
35.160.111.237
___

Fake 'LogMein' SPAM - leads to Hancitor/Vawtrak
- http://blog.dynamoo.com/2016/11/malware-spam-your-logmeincom.html
21 Nov 2016 - "This -fake- financial spam leads to malware:
From: billing@ secure-lgm .com
Date: 21 November 2016 at 18:35
Subject: Your LogMein.com subscription has expired!
Dear client,
You are receiving this message because your subscription for LogMeIn Central has expired.
We were not able to charge you with the due amount because your credit card was declined.
You can download the bill directly from the LogMeIn website ...
Please use another credit card or payment method in order to avoid complete service interruption.
Event type: Credit Card Declined
Account email: [redacted] .com
At: 21/11/2016...
© LogMeIn Inc

The link in the email actually goes to a page at reg .vn /en/view_bill.php?id=encoded-email-address (where the last part is the email address in Base 64 encoding). It downloads a malicious document lgm_bill69290.doc with a current detection rate of 8/55*. Automated analysis [1] [2] shows malicious network traffic... A malicious executable is dropped with a detection rate of 7/57**. The payload appears to be Hancitor/Vawtrak. The domain secure-lgm .com appears to have been created for the purposes of sending the email... probably fake WHOIS details...
Recommended blocklist:
95.215.111.222
newaronma .com
libinvestusa .com "
* https://www.virustotal.com/en/file/...e94b6484045adb783e90406367ae20a83ac/analysis/

1] https://malwr.com/analysis/NGZlMzFkMzYzZTZmNDcyNWE2ODM4ODNhNTQ1ZGM4YmQ/
Hosts
95.215.111.222
54.197.251.22
69.89.31.104

2] https://www.hybrid-analysis.com/sam...045adb783e90406367ae20a83ac?environmentId=100
Contacted Hosts
95.215.111.222
54.235.212.238
69.89.31.104

** https://www.virustotal.com/en/file/...c31389be62b5187a72c1edac0df17447dbe/analysis/
inst.exe
___

Something evil on 64.20.51.16/29...
- http://blog.dynamoo.com/2016/11/something-evil-on-6420511629-customer.html
21 Nov 2016 - "I wrote about this evil network on 64.20.51.16/29 (a customer of Interserver, Inc) over a year ago*, identifying it as a hotbed of fraud. Usually these bad networks don't hang around for very long, but in this case it seems to be -very- persistent. This time it came to notice from a terse spam with a PDF attached:
From: Lisa Liang [ineedu98@ hanmail .net]
To: me@ yahoo .com
Date: 20 November 2016 at 23:23
Subject: 11/21/2016 Amended
FYI

Attached is a file Amended copy.pdf which when you open it (-not- recommended) looks blurry with "VIEW" in big red letters... The link-in-the-email goes to bit .ly/2fJbyol - if you put the "+" on the end of a Bitly link then you can see the number of -clickthroughs- and what the landing page is (www .serviceupgrade .tech/pdf.php in this case)... Clicking through gives you a login page for "Adobe PDF Online" which is of course a generic -phishing- page... Analysis of the 64.20.51.16/29 range finds -193- sites historically connected with it marked as being -phishing- or some other -malicious- activity. There are at least -284- sites currently within that range, of which the following are -both- hosted in that range currently and are malicious... 11% of the total sites in the range have been tagged by SURBL or Google as being -bad- and to be honest there are probably a LOT more but those services haven't caught up yet. In any case, there seems to be nothing of value in 64.20.51.16/29 and I strongly recommend that you -block- traffic to the entire range."
* http://blog.dynamoo.com/2015/09/evil-network-6420511629-interserver-inc.html

i.e.: serviceupgrade .tech: 64.20.51.22: https://www.virustotal.com/en/ip-address/64.20.51.22/information/
>> https://www.virustotal.com/en/url/7...195bc3b1ad4fc79725760f6ee3c448e6402/analysis/

:fear::fear:

AplusWebMaster · Nov 22, 2016

Fake 'Delivery status', 'Invoice', 'Documents Requested', 'tax bill', 'DocuSign' SPAM

FYI...

Fake 'Delivery status' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/locky-aesir-delivered-by-delivery-status-malspam/
22 Nov 2016 - "... Locky downloader... an email with the subject of 'Delivery status' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of document_recipients name .zip... One of the emails looks like:
From: Jocelyn Sears <Sears.Jocelyn@ teklinks .net>
Date: Tue 22/11/2016 07:20
Subject: Delivery status
Attachment: document_mrilw.zip
Dear Client! Our delivery department could not accept your operation due to a problem with your current account.
In order to avoid falling into arrears and getting charged, please fill out the document in the attachment as soon as possible and send it to us.

22 November 2016: document_mrilw.zip: Extracts to: R9SZO3SDB89J399GW52V80-N2AXBG71NVG2XT.js
Current Virus total detections 10/55*. MALWR** shows a download of a file from
http ://sadhekoala .com/lvqh1 which is converted by the script to 7wYxQEPdqwq.dll (VirusTotal 5/56***).
Payload Security [4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...c73f46dc2cf391c67bf20737/analysis/1479802918/

** https://malwr.com/analysis/MTU1NGMyYWM3NWFmNGE1YjljN2U3MjAxOWVkMDMyNzk/
Hosts
67.171.65.64

*** https://www.virustotal.com/en/file/...13742652c656f9c4e461292c/analysis/1479803154/

4] https://www.hybrid-analysis.com/sam...93ec73f46dc2cf391c67bf20737?environmentId=100
Contacted Hosts
67.171.65.64
188.120.250.138
213.32.66.16
91.201.202.130
95.213.186.93
52.32.150.180
52.85.184.60
35.160.111.237

- http://blog.dynamoo.com/2016/11/malware-spam-delivery-status-leads-to.html
22 Nov 2016 - "This -fake- financial spam leads to Locky ransomware:
Subject: Delivery status
From: Gilbert Hancock
Date: Tuesday, 22 November 2016, 8:51
Dear Client! Our delivery department could not accept your operation due to a problem with your current account.
In order to avoid falling into arrears and getting charged, please fill out the document in the attachment as soon as possible and send it to us.

In the sample I analysed there was an attachment named document_recipientname.zip (i.e. the first part of the recipient's email address was in the name), containing a malicious javascript with a random name. This particular script (and there are probably many others) attempts to download a component... According to this Malwr analysis*, a malicious DLL is dropped with an MD5 of ebf03567c2a907705a026ff0821d8e63 and a detection rate of 6/55**. The Hybrid Analysis*** reveals the following C2 locations:
91.201.202.130 /information.cgi [hostname: dominfo.dp .ua] (FLP Anoprienko Artem Arkadevich aka host-ua.com, Ukraine)
95.213.186.93 /information.cgi [hostname: djaksa.airplexalator .com] (Selectel, Russia)
188.120.250.138 /information.cgi [hostname: olezhkakovtonyuk.fvds .ru] (TheFirst-RU, Russia)
213.32.66.16 /information.cgi (OVH, France)
For those Russian and Ukranian networks I would be tempted to block the entire /24 at least, but this is my minimum recommended blocklist:
91.201.202.130
95.213.186.93
188.120.250.138
213.32.66.16 "
* https://malwr.com/analysis/ZWYyZWY1YTI2Zjk1NDgwYzk0ZGIwZTIzNTQ4NTgzZDA/
Hosts
187.45.240.4

** https://virustotal.com/en/file/22cf...777e8855474e9f40db1c4788/analysis/1479806600/

*** https://www.hybrid-analysis.com/sam...47fa8b79ce1d5d744059b400da2?environmentId=100
Contacted Hosts
187.45.240.4
188.120.250.138
91.201.202.130
213.32.66.16
95.213.186.93
52.32.150.180
52.85.184.195
___

Fake 'Invoice' SPAM - delivers Locky
- http://blog.dynamoo.com/2016/11/malware-spam-invoice-123456-from-random.html
22 Nov 2016 - "This -fake- financial spam appears to come from a random sender in the victim's-own-domain, but this is just a simple forgery. The payload is Locky ransomware.
Subject: Invoice 5639438
From: random sender (random.sender@ victimdomain .tld)
Date: Tuesday, 22 November 2016, 8:43
Attached is the document 'Invoice 5639438'.

The reference number varies from email to email, but is consistent in the subject, body and the name of the attachment (e.g. Invoice 5639438.zip). This ZIP file contains a malicious WSF script (e.g. Invoice 7868933153.wsf)... According the the Malwr analysis*, that script downloads from:
manage .parafx .com/98y4h?AdIXigNCmu=UdJVux
There are no doubt many other locations. That same analysis shows a DLL being dropped with an MD5 of de5d8250edf98262f335cd87fe6f6740 and a detection rate of 9/56**. The Hybrid Analysis*** of the same sample shows the malware contacting the following C2 locations:
89.108.73.124 /information.cgi (Agava, Russia)
91.211.119.98 /information.cgi (Zharkov Mukola Mukolayovuch aka 0x2a.com.ua, Ukraine)
94.242.55.81 /information.cgi (RNet, Russia)
Recommended blocklist:
89.108.73.0/24
91.211.119.98
94.242.55.81 "
* https://malwr.com/analysis/YTdlYzE1NWUzNWNiNGJkMGIxN2YwNzk5YmRkZTQ1YmE/
Hosts
69.57.3.3
91.211.119.98

** https://virustotal.com/en/file/1c31...e624cd66a0501225579f0b8f892210a1ba1/analysis/

*** https://www.hybrid-analysis.com/sam...3397773cd980be0527e82e2f172?environmentId=100
Contacted Hosts
69.57.3.3
94.242.55.81
89.108.73.124
91.211.119.98
35.160.111.237
___

Fake 'Documents Requested' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/docu...ames-at-your-own-email-domain-delivers-locky/
22 Nov 2016 - "... Locky downloader... an email with the subject of 'Documents Requested' pretending to come from random names at your-own-email-domain... One of the emails looks like:
From: Darlene <Darlene2@ victim domain .uk>
Date: Tue 22/11/2016 11:26
Subject: Documents Requested
Attachment: doc(598).zip
Dear [redacted]
Please find attached documents as requested.
Best Regards,
Darlene

22 November 2016: doc(598).zip: Extracts to: 9932613_EUZCK_6312135.wsf - Current Virus total detections 12/53*
Payload Security**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...850f9a878a8e3eb18e057cc4/analysis/1479814057/

** https://www.hybrid-analysis.com/sam...d03850f9a878a8e3eb18e057cc4?environmentId=100
Contacted Hosts
72.51.24.224
94.242.55.81
95.46.114.205
54.240.162.83
35.160.111.237
___

Fake 'tax bill' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/your-tax-bill-debt-due-date-is-today-malspam-delivers-locky-aesir/
22 Nov 2016 - "... Locky downloader... an email pretending to be a tax bill with the subject of 'Please note' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of tax_recipients name.zip... One of the emails looks like:
From: Lance Barron <Barron.Lance@ dramaticallybetterhealth .com>
Date: Tue 22/11/2016 17:41
Subject: Please note
Attachment: tax_goal.zip
Dear goal
Your tax bill debt due date is today . Please fulfill the debt.
All the information and payment instructions can be found in the attached document.
Best Wishes,
Lance Barron
Tax Collector ...

22 November 2016: tax_goal.zip: Extracts to: 6WMK287O33R4XN6.js - Current Virus total detections 6/55*
MALWR** shows a download of an encrypted file from:
http ://govorokhm .ru/huz9ex2sd8 which is converted by the script to xHVh9Aflvj4.dll (VirusTotal 9/57***)
Payload Security [4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...6b3e3bc979deed9c94fac7ce/analysis/1479836521/

** https://malwr.com/analysis/MTU1NGMyYWM3NWFmNGE1YjljN2U3MjAxOWVkMDMyNzk/
Hosts
67.171.65.64

*** https://www.virustotal.com/en/file/...124044eeb2a3ec69d16bb226/analysis/1479839432/

4] https://www.hybrid-analysis.com/sam...34b6b3e3bc979deed9c94fac7ce?environmentId=100
Contacted Hosts
94.142.140.191
195.123.209.8
213.32.66.16
95.213.186.93
52.42.26.69
54.240.162.83
35.160.111.237
___

Fake 'DocuSign' SPAM - delivers ASN1 ransomware
- https://myonlinesecurity.co.uk/spoo...malspam-attempts-to-download-asn1-ransomware/
21 Nov 2016 - "An email with the subject of 'You have a new Encrypted Document' pretending to come from DocuSign <service@ docusigndocuments .com> with a malicious macro enabled word doc tries to download ASN1 ransomware... These do -not- come from the genuine DocuSign company. docusigndocuments .com and the other domains listed have been registered -today- and hosted at Godaddy .com with what are probably -fake- details...
The three domains and sending email addresses also used in this malspam ransomware attempt are:
DocuSign <service@ DOCUSIGN-DOCUMENT .COM>
DocuSign <service@ docusigndocument .com>
DocuSign <service@ docusigndocuments .com> ...

Screenshot: https://i0.wp.com/myonlinesecurity....encrypted-_document.png?resize=1024,560&ssl=1

The enclosed word doc looks like:
> https://i0.wp.com/myonlinesecurity..../encrypted_document.png?resize=1024,911&ssl=1

21 November 2016: EncryptedDocument.doc - Current Virus total detections 18/54*
Both MALWR** & Payload Security*** show it tries to download
http ://majesticbrass .com/1061911a3e0a74827a76bbd7bfe16d20.exe which is currently giving a 404 not found. This site was used in an similar ransomware attack at the end of last week[4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...fb63ceb3b06338fd9ab17966/analysis/1479766715/

** https://malwr.com/analysis/Y2M1YWNlYjVlN2FmNGQ2Njg2OTg5MjMyNjFhYWFkN2I/
Hosts
64.176.31.64
184.51.0.241

*** https://www.hybrid-analysis.com/sam...91cfb63ceb3b06338fd9ab17966?environmentId=100
Contacted Hosts
64.176.31.64

4] https://myonlinesecurity.co.uk/unkn...-have-received-a-new-secure-document-malspam/

64.176.31.64: https://www.virustotal.com/en/ip-address/64.176.31.64/information/
> https://www.virustotal.com/en/url/6...7f4a3b6ae5f98ac8dd81c5915e15d645cb0/analysis/
2016-11-22

:fear::fear:

AplusWebMaster · Nov 23, 2016

Fake 'Pay Attention', 'Bill', 'Scanned Documents', 'LETTER', 'subpoena' SPAM

FYI...

Fake 'Pay Attention' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-please-pay-attention-leads.html
23 Nov 2016 - "This -fake- financial spam leads to Locky ransomware:
Subject: Please Pay Attention
From: Bill Rivera
Date: Wednesday, 23 November 2016, 9:45
Dear [redacted], we have received your payment but the amount was not full.
Probably, this occurred due to taxes we take from the amount.
All the details are in the attachment - please check it out.

The name of the sender will vary. In the sample I analysed, a ZIP file was attached with a filename beginning
lastpayment_ followed by the first part of the recipients email address. This archive contains a randomly-named malicious .JS script... According to this Malwr report* a malicious DLL is dropped with an MD5 of def0d0070d4aed411b84ebd713fd8b92 and a detection rate of 6/56**. The Hybrid Analysis*** clearly shows the ransomware in action and shows it communicating with the following URLs:
95.213.186.93 /information.cgi [hostname: djaksa.airplexalator .com] (Selectel, Russia)
195.123.209.8 /information.cgi [hostname: kostya234.itldc-customer .net] (Layer6, Latvia)
213.32.66.16 /information.cgi (OVH, France)
Recommended blocklist:
95.213.186.93
195.123.209.8
213.32.66.16 "
* https://malwr.com/analysis/MWY5ZDY1MDk2YjBmNDE1NmFkNzY0MWMwN2UyMTMzYWQ/
Hosts
31.204.153.171

** https://virustotal.com/en/file/8ccd...725e1ac5bf6d2a73c2463eb2/analysis/1479896120/

*** https://www.hybrid-analysis.com/sam...cd529cbe3151e3573840f581d09?environmentId=100
Contacted Hosts
31.204.153.171
213.32.66.16
195.123.209.8
95.213.186.93
52.34.245.108
54.240.162.85
92.122.214.10

- https://myonlinesecurity.co.uk/plea...-paid-the-full-amount-malspam-delivers-locky/
23 Nov 2016 - "... Locky downloader... an email pretending to tell you that you haven’t paid the full amount, with the subject of 'Please Pay Attention' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of lastpayment_recipient name.zip... One of the emails looks like:
From: Gabriela Diaz <Diaz.Gabriela@ deepredmedia .com>
Date: Wed 23/11/2016 08:27
Subject: Please Pay Attention
Attachment: lastpayment_lickit.zip
Dear lickit, we have received your payment but the amount was not full.
Probably, this occurred due to taxes we take from the amount.
All the details are in the attachment – please check it out.

23 November 2016: payment_history_64b96be.zip: Extracts to: 2BE46B4PX7ZU28.js
Current Virus total detections 7/55*. MALWR** shows a download of an encrypted file from
http ://risewh .com/pg31nkp which is renamed by the script to
W0heF8ZofNrqpj9Z .dll (VirusTotal 5/56***). Payload Security[4]...
Other download sites include:
risewh .com/pg31nkp
jinxlaze .com/rysuuttn
naturalnepodlogi .cba .pl/utnnyduqa
offerrat .com/12mi44q
pineysprat .com/zqdjx ...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...9f5b0eafec31f7af792fad2f/analysis/1479894064/

** https://malwr.com/analysis/ZGViZTZlNTFkMjY3NDE5ZWEwZTY3NTUyNTU3YTE3MzQ/
Hosts
202.103.25.79

*** https://www.virustotal.com/en/file/...bcae34c6e07475667d8b6275/analysis/1479894314/

4] https://www.hybrid-analysis.com/sam...5679f5b0eafec31f7af792fad2f?environmentId=100
Contacted Hosts
202.103.25.79
213.32.66.16
95.213.186.93
195.123.209.8
52.42.26.69
54.240.162.221
___

Fake 'Bill' SPAM - delivers more Locky
- https://myonlinesecurity.co.uk/rand...ur-own-email-domain-delivers-even-more-locky/
23 Nov 2016 - "... Locky downloader... a -blank/empty- email with the subject of 'Bill-85548' (random numbers) pretending to come from random names at your-own-email-address/company or domain with a totally random numbered zip attachment... One of the emails looks like:
From: paris hymer <paris.hymer@ victim domain .co .uk>
Date: Thu 01/09/2016 19:22
Subject: paris hymer ...
Attachment: 7c8b9b79dd4ef599dd5d0c6db9b2d530.zip

Body content: totally blank

23 November 2016: 7c8b9b79dd4ef599dd5d0c6db9b2d530.zip: Extracts to: qivrlftajqpvl4kfverdv6vu8ecbwdxe.js
Current Virus total detections 10/55*. MALWR** shows a download of an encrypted file from
http ://parenclub-devilsenangels .nl/08yhrf3?ELghUu=ELghUu which is converted by the script to
ELghUu1.dll (VirusTotal 8/55***). Payload Security[4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...af47b5b0e9f85758a8ea59af/analysis/1479893531/

** https://malwr.com/analysis/MGM2OWFmMzU5YmE3NDM4YmE2YTBlNzFjMzYyZGI5YTI/
Hosts
195.211.74.100
94.242.55.81
80.87.202.49

*** https://www.virustotal.com/en/file/...68583562d60fe673dafb3d0c/analysis/1479895272/

4] https://www.hybrid-analysis.com/sam...f45af47b5b0e9f85758a8ea59af?environmentId=100
Contacted Hosts
195.211.74.100
80.87.202.49
94.242.55.81
95.46.114.205

- http://blog.dynamoo.com/2016/11/moar-locky-bill-12345-from-victims-own.html
23 Nov 2016 - "This spam has no-body-text and appears to come from within the sender's-own-domain. It leads to Locky ransomware. For example:
From: julia newenham [julia.newenham@ victimdomain .tld]
Date: 23 November 2016 at 10:44
Subject: Bill-76137

There is a randomly-named ZIP (e.g. 589af1aa1aaf4cb9ce571fced687b8ac.zip) containing a randomly-named malicious javascript... A malicious DLL is dropped with an MD5 of 4e207b30c5eae01fa136f3d89d59bbbe and
a detection rate of 9/56*. The malware then communicates with:
80.87.202.49 /information.cgi (JSC Server, Russia)
94.242.55.81 /information.cgi (RNet, Russia)
95.46.114.205 /information.cgi (PE Gornostay Mikhailo Ivanovich aka time-host .net, Ukraine)
Recommended blocklist:
80.87.202.49
94.242.55.81
95.46.114.205 "
* https://virustotal.com/en/file/675c...3c1688bef6d68583562d60fe673dafb3d0c/analysis/
___

Fake 'Scanned Documents' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/tric...hp_printer-at-your-own-email-address-malspam/
23 Nov 2016 - "An email with the subject of 'Scanned Documents' pretending to come from HP Digital Device <HP_Printer@ victim domain .tld> with a malicious macro enabled word doc delivers Trickbot banking Trojan...
The email looks like:
From: HP Digital Device <HP_Printer@ victim domain .tld>
Date: Wed 23/11/2016 04:27
Subject: Scanned Documents
Attachment: Scan552.doc
Please open the attached document.
This document was digitally sent to you using an HP Digital Sending device.
This email has been scanned for viruses and spam.

23 November 2016: Scan552.doc - Current Virus total detections 11/51*
Payload Security**.. shows downloads from http ://wingsbiotech .com/images/kjcoiejceiwejf.png
which is -not- an image file but a renamed .exe that the macro renames to newfle.exe and autoruns
(VirusTotal 12/56***)... DO NOT follow the advice they give to enable macros or enable editing to see the content...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...9d3726d7c5e1d89d0b070818/analysis/1479879729/

** https://www.hybrid-analysis.com/sam...c2f9d3726d7c5e1d89d0b070818?environmentId=100
Contacted Hosts
69.89.31.134
78.47.139.102
193.107.111.164
37.1.213.189
185.86.77.224

*** https://www.virustotal.com/en/file/...d6c5974a7552675f6401c494/analysis/1479882669/
___

Fake 'LETTER' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/more...our-own-email-address-delivering-locky-aesir/
23 Nov 2015 - "... Locky downloader... an email with the subject of 'Emailing: LETTER 5.pdf' (random numbers) pretending to come from random names at your-own-email-domain... One of the emails looks like:
From: queen <queen.gaffney@ victim domain .tld >
Date: Wed 23/11/2016 13:39
Subject: Emailing: LETTER 5.pdf
Attachment: LETTER 5.zip
Please find attachment.
—
This email has been checked for viruses by Avast antivirus software.

23 November 2016: LETTER 5.zip: Extracts to: fnpqatfwistcg4r3ccoanyajwkqjlgq7.js
Current Virus total detections 13/55*... Payload Security** shows a download of an encrypted file from
http ://paulking .it/08yhrf3?yRLXgsuxJ=yRLXgsuxJ which is converted by the script to yRLXgsuxJ1.dll
(VirusTotal 7/57***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...9b197346cfa5da863bfb46fc/analysis/1479908406/

** https://www.hybrid-analysis.com/sam...1e19b197346cfa5da863bfb46fc?environmentId=100
Contacted Hosts
151.1.182.231
95.46.114.205
82.146.32.92
91.107.107.165
52.32.150.180
54.240.162.106

*** https://www.virustotal.com/en/file/...4a559b0f75339d9e5b78081c/analysis/1479909224/
___

Fake 'subpoena' SPAM - leads to malware
- http://blog.dynamoo.com/2016/11/malware-spam-financial-records-subpoena.html
23 Nov 2016 - "This spam purports to come from Michael T Diver who is a real Oklahoma attorney, but it doesn't really and is just a simple forgery:
From: MICHAEL T. DIVER [michael -at- lawfirmofoklahoma .com]
Date: 23 November 2016 at 15:24
Subject: RE:RE: financial records subpoena
See you in court !!!
Subpoena for server
Thank you,
MICHAEL T. DIVER ...

The telephone number and also potentially the email address are genuine, but they are certainly not being sent from this law firm. The link-in-the-email goes to a legitimate but -hacked- Vietnamese site at techsmart .vn/backup2/get.php?id=[base64-encoded-part] (the last bit is a Base 64 representation of the victim's email address). In testing the payload site was -down- but previous emails of this type have lead to the Vawtrak banking trojan."

techsmart .vn: 103.18.6.140: https://www.virustotal.com/en/ip-address/103.18.6.140/information/
___

Fake 'Payment confirmation' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoofed-standard-bank-payment-confirmation-delivers-locky-aesir/
23 Nov 2016 - "... Locky downloader... an email with the subject of 'Payment confirmation 7477' (random numbers) pretending to come from Standard Bank <ibsupport@ standardbank .co .za>...

Screenshot: https://i1.wp.com/myonlinesecurity....ayment-confirmation.png?resize=1024,716&ssl=1

23 November 2016: PaymentConfirmation7477.zip: Extracts to: wbxz7lyfob8mwyygqstzfffj7aere8wz.js
Current Virus total detections 13/54*. MALWR** shows a download of an encrypted file from
http ://rdyy .cn/08yhrf3?OYxgQhzazR=OYxgQhzazR which is converted by the script to OYxgQhzazR1.dll
(VirusTotal 12/56***). Payload Security[4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...1dfb85c38866b09e574eb366/analysis/1479919853/

** https://malwr.com/analysis/MzZmNWE5NWI0NzM1NDgyNGJiYjMxMTIxMTA5MzViNGQ/
Hosts
103.28.44.206
82.146.32.92
91.107.107.165
95.46.114.205

*** https://www.virustotal.com/en/file/...4a559b0f75339d9e5b78081c/analysis/1479919518/

4] https://www.hybrid-analysis.com/sam...ee01dfb85c38866b09e574eb366?environmentId=100
Contacted Hosts
103.28.44.206
91.107.107.165
82.146.32.92
95.46.114.205
___

Fake 'Attention Required' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/atte...ceipt-malspam-delivers-even-more-locky-today/
23 Nov 2016 - "... Locky malware... with the subject of 'Attention Required' coming as usual from random companies, names and email addresses with a semi-random named zip attachment in the format of receipt_recipient.name.zip... One of the emails looks like:
From: Angela Holmes <Holmes.Angela@ murilobertini .com>
Date: Wed 23/11/2016 16:14
Subject: Attention Required
Attachment: receipt_xerox.805.zip
Dear xerox.805, our HR Department told us they haven’t received the receipt you’d promised to send them.
Fines may apply from the third party. We are sending you the details in the attachment.
Please check it out when possible.

23 November 2016: receipt_xerox.805.zip: Extracts to: Z8B105E8IK89A9HX.js - Current Virus total detections 15/55*
MALWR** shows a download of a file from http ://orantpamir .net/el3w488r9 which is converted by the script to
fWk6epu1.dll (VirusTotal 9/57***). Payload Security[4]...
Manual analysis shows these download locations
orantpamir .net/el3w488r9
oimeferio .net/sl60vci
websdns .com/k0ais
gigabothosting .com/kiltoonxqa
gpsfiles .nl/lywk0py
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...cbb78819612f0e8fe6505204/analysis/1479921317/

** https://malwr.com/analysis/ZGEyYjJkMWYyZWY2NDYzMTg1N2ZmNGQ1YTg0NTA1NjI/
Hosts
67.171.65.64

*** https://www.virustotal.com/en/file/...f2121f1f1979c076710d9de4/analysis/1479921871/

4] https://www.hybrid-analysis.com/sam...5decbb78819612f0e8fe6505204?environmentId=100
Contacted Hosts
67.171.65.64
95.46.8.175
46.8.29.176
52.32.150.180
54.240.162.221
52.35.54.251

:fear::fear:

AplusWebMaster · Nov 25, 2016

Fake 'Important Info', -blank/body-, 'New voice mail' SPAM, Moar Locky

FYI...

Fake 'Important Info' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-important-information.html
25 Nov 2016 - "This spam leads to Locky ransomware:
Subject: Important Information
From: Etta Figueroa
Date: Friday, 25 November 2016, 10:28
Dear [redacted], your payment was not processed due to the problem with credentials.
Payment details are in the attached document.
Please check it out as soon as possible.

The name of the sender varies. Attached is a ZIP file beginning with payment_ and then the first part of the victim's email address. This analysis comes from my trusted usual source (thank you!). It contains a randomly-named malicious javascript that downloads a component... The malware then phones home to:
213.32.66.16 /information.cgi (OVH, France)
89.108.118.180 /information.cgi (Datalogika / Agava, Russia)
91.201.42.83 /information.cgi [hostname: aportom .com] (RuWeb, Russia)
Recommended blocklist:
213.32.66.16
89.108.118.180
91.201.42.83 "

- https://myonlinesecurity.co.uk/impo...-processed-malspam-delivers-more-locky-zzzzz/
25 Nov 2016 - "... Locky downloader... an email with the subject of 'Important Information' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of payment_recipient’s name.zip... One of the emails looks like:
From: Clay Clarke <Clarke.Clay@ static .vnpt .vn>
Date: Thu 01/09/2016 19:22
Subject: Important Information
Attachment: payment_montag.zip
Dear montag, your payment was not processed due to the problem with credentials.
Payment details are in the attached document.
Please check it out as soon as possible.

25 November 2016: payment_montag.zip: Extracts to: HQ5q97uu9s2.js - Current Virus total detections 8/54*
Payload Security**. MALWR*** shows a download of an encrypted file from
http ://thinx .net/rkp2tpxlrg which is converted by the script to Oe3cTld33aTOQyLh.tdb (VirusTotal 15/56[4]). The tdb file is actually a dll file that is run by rundll32 but given a different extension to attempt to fool anyone having a quick look at it. We describe this here[5] and Bleeping computer[6] has a good write up about the use of non standard file extensions by Locky... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...781717de7033ea5f9422560c/analysis/1477646733/

** https://www.hybrid-analysis.com/sam...02d6227d4f9f826c5c0d6256ebe?environmentId=100
Contacted Hosts
107.180.41.245
213.32.66.16
91.201.42.83
54.240.162.31
35.160.111.237

*** https://malwr.com/analysis/M2IyNmIwYTBkZjdjNDViMWEyZDJkNjYwNTc0OTEzNjc/
Hosts
133.130.109.98
185.154.13.79
83.217.11.193

4] https://www.virustotal.com/en/file/...19ddd61cfaf799d00dd33efe/analysis/1480069873/

5] https://myonlinesecurity.co.uk/locky-changed-again-to-use-zzzzz-file-extensions/

6] http://www.bleepingcomputer.com/new...putting-us-to-sleep-with-the-zzzzz-extension/
___

Fake -blank/body- SPAM - more Locky
- https://myonlinesecurity.co.uk/blank-email-with-random-subjects-delivers-even-more-locky-zzzzz/
25 Nov 2016 - "... Locky downloader... a -blank- email with the subject of (random number recipient name) coming or pretending to come from recipient name_olive at random email addresses with a semi-random named zip attachment in the format of INFO_random number_recipients name.zip that contains another zip file... One of the emails looks like:
From: derekolive@ blueyonder .co.uk
Date: Fri 25/11/2016 08:10
Subject: 57051 derek
Attachment: INFO_052297_derek.zip

Body content: Totally Blank/empty

25 November 2016: INFO_052297_derek.zip: which extracts to MONEY_14189_ZIP.zip which in turn Extracts to:
MONEY_14189.js. Current Virus total detections 3/55*. MALWR** shows a download of a file from
http ://www .vollyuper .top/admin.php?f=2.dat which gave MALWR rad68D08.tmp (VirusTotal 4/57***)...
Update: the same series of emails with these .js files also have -other- links that are currently downloading Cerber ransomware. These sites include:
http ://otreytl .bid/search.php?f=x1.dat | http ://hqtrssx .top/search.php?f=x2.dat (VirusTotal 5/57[4])
(Payload Security [5]). (MALWR [6])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...618e117b9adeab44bb5fa2da/analysis/1480061873/

** https://malwr.com/analysis/M2IyNmIwYTBkZjdjNDViMWEyZDJkNjYwNTc0OTEzNjc/
Hosts
133.130.109.98
185.154.13.79
83.217.11.193

*** https://www.virustotal.com/en/file/...e0af82ae4de2e66578d761df/analysis/1480062381/

4] https://www.virustotal.com/en/file/...e0af82ae4de2e66578d761df/analysis/1480062381/

5] https://www.hybrid-analysis.com/sam...927e153dd7f30ce1dae16bca919?environmentId=100
Contacted Hosts
63.55.11.0-31
15.93.12.0-31
194.165.16.0-255
194.165.17.0-255
194.165.18.0-255
194.165.19.0-167

6] https://malwr.com/analysis/YTA1YmY2NWExOGRmNGQ4ZWEyZTk4ZjEyNzc5MjE2OTA/
Hosts
63.55.11.0-31
15.93.12.0-31
194.165.16.0-255
194.165.17.0-255
194.165.18.0-255
194.165.19.0-255
___

Moar Locky 2016-11-25
- http://blog.dynamoo.com/2016/11/moar-locky-2016-11-25.html
25 Nov 2016 - "This data comes from my trusted usual source, so far I have only seen a single example. This morning's spam run has a -subject- with one of the following words:
DOC, DOCUMENT, FAX, IMG, LABEL, ORD, PHOTO, PIC, SCAN, SHEET

..plus a four digit random number. Attached is a ZIP file with a name mating the subject, containing a randomly-named malicious javascript that attempts to download a component... The payload is Locky ransomware, phoning home to:
185.118.167.144 /information.cgi [hostname: bogdankarpenko1998.pserver .ru] (Chelyabinsk-Signal, Russia)
91.142.90.55 /information.cgi (Miran, Russia)
Recommended blocklist:
185.118.167.144
91.142.90.55 "
___

Fake 'New voice mail' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/11/malware-spam-vigor2820-series-new-voice.html
25 Nov 2016 - "This -fake- voicemail spam leads to Locky ransomware and appears to come from within the victim's own domain, but this is just a simple forgery.
Subject: [Vigor2820 Series] New voice mail message from 01435773591 on 2016/11/25 18:29:39
From: voicemail@ victimdomain .tld
To: victim@ victimdomain .tld
Date: Friday, 25 November 2016, 12:58
Dear webmaster :
There is a message for you from 01435773591, on 2016/11/25 18:29:39 .
You might want to check it when you get a chance.Thanks!

The number in the message will vary, but is consistent throughout. Attached is a ZIP file referencing the same number, e.g. Message_from_01435773591.wav.zip which contains a malicious Javascript... This Malwr analysis* shows behaviour consistent with Locky ransomware... The C2s to block are the same as here**, namely:
185.118.167.144 /information.cgi [hostname: bogdankarpenko1998.pserver .ru] (Chelyabinsk-Signal, Russia)
91.142.90.55 /information.cgi (Miran, Russia)
Recommended blocklist:
185.118.167.144
91.142.90.55 "
* https://malwr.com/analysis/YWU1NzQ4MmJhNGRlNGJmNGFmMjBhZGVmNTdlMzQ4NWU/
Hosts
92.60.224.52
185.118.167.144
91.142.90.55
** http://blog.dynamoo.com/2016/11/moar-locky-2016-11-25.html
___

Locky hidden in image file hitting Facebook, LinkedIn
- https://www.helpnetsecurity.com/2016/11/25/locky-image-file-facebook-linkedin/
Nov 25, 2016 - "Malware masquerading as an image file is still spreading on Facebook, LinkedIn, and other social networks. Check Point researchers have apparently discovered how cyber crooks are embedding malware in graphic and image files, and how they are executing the malicious code within these images to infect social media users with Locky ransomware variants... As they are searching for a solution, the Check Point research team advises* users not-to-open-any-image they have received from another user and have downloaded on their machine... A video demonstration of the attack can be viewed below:
> https://youtu.be/sGlrLFo43pY "

* http://blog.checkpoint.com/2016/11/...overs-new-method-distributing-malware-images/
2016/11/24 - "... attackers have built a new capability to embed malicious code into an image file and successfully upload it to the social media website. The attackers exploit a misconfiguration on the social media infrastructure to deliberately force their victims to download the image file. This results in infection of the users’ device as soon as the end-user -clicks- on the downloaded file..."

:fear::fear:

AplusWebMaster · Nov 28, 2016

Fake 'Purchase Order', 'Urgent Alert', 'Bill', 'Message' SPAM

FYI...

Fake 'Purchase Order' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoo...treplysouth-staffordshire-com-delivers-locky/
28 Nov 2016 - "... Locky downloader... an email with the subject of 'Purchase Order No. 90373' (random numbers) coming or pretending to come donotreply@ south-staffordshire .com with a semi-random named zip attachment that matches the subject line... One of the emails looks like:
From: donotreply@ south-staffordshire .com
Date: Mon 28/11/2016 09:45
Subject: Purchase Order No. 90373
Attachment: PO90373.zip
Please find attached Purchase Order No. 90373.
PLEASE DO NOT REPLY TO THIS ADDRESS.
If you have any queries in regards to your Purchase Order, please contact your requestor, Reinaldo horrocks on 01922 062460 ext 5580...

28 November 2016: payment_history_64b96be.zip: Extracts to: 93410605.wsf - Current Virus total detections 8/55*
MALWR* is not giving any payload or download sites. Payload Security*** shows a download of an encrypted file from
restauranttajmahal .ca/87nft3?iNKevOML=ChKIolivpc which is converted by the script to a dll and autorun.
Unfortunately Payload Security does not show or make the dll available for download in the free web version... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...aed650aa877d1c82ab2a6ceb/analysis/1480327255/

** https://malwr.com/analysis/M2U1OTFhODIxODhkNGY5NmIyYTVhZjQ5ZDI4MWEwMDY/

*** https://www.hybrid-analysis.com/sam...699aed650aa877d1c82ab2a6ceb?environmentId=100
Contacted Hosts
76.74.128.120
185.115.140.210
185.118.67.162
213.32.90.193
52.34.245.108
54.240.162.88
___

Fake 'Urgent Alert' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/urge...atm-withdrawal-from-your-card-delivers-locky/
28 Nov 2016 - "... Locky downloader... an email with the subject of 'Urgent Alert' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of ATM_recipients name.zip... One of the emails looks like:
From: Tami Soto <Soto.Tami@ lelycentereast .com>
Date: Mon 28/11/2016 09:22
Subject: Urgent Alert
Attachment: ATM_etgord34truew.zip
Dear etgord34truew, we have detected a suspicious money ATM withdrawal from your card.
For your security, we have temporarily blocked the card.
All the details are in the attachment. Please open it when possible.

28 November 2016: ATM_etgord34truew.zip: Extracts to: HQ6za5d7.js - Current Virus total detections 7/53*
MALWR** shows a download of an encrypted file from http ://dodowiz .com/ynux4ac
which is converted by the script to x3NzzWXgCcwO.tdb (VirusTotal 6/52***). The tdb file is actually a dll file that is run by rundll32 but given a different extension to attempt to fool anyone having a quick look at it. We describe this here[4] and Bleeping computer[5] has a good write up about the use of non standard file extensions by Locky
(Payload Security [6])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...43c3faaaf0d1f3b0b835f481/analysis/1480324767/

** https://malwr.com/analysis/ZDdlZTNiZWRmZTU4NDE5ZDk3MTFiODk1MzY1YTIyZDc/
Hosts
183.98.152.2

*** https://www.virustotal.com/en/file/...d37040615cccc851a8bc6ccf/analysis/1480329111/

4] https://myonlinesecurity.co.uk/locky-changed-again-to-use-zzzzz-file-extensions/

5] http://www.bleepingcomputer.com/new...putting-us-to-sleep-with-the-zzzzz-extension/

6] https://www.hybrid-analysis.com/sam...0cf43c3faaaf0d1f3b0b835f481?environmentId=100
Contacted Hosts
213.176.241.230
213.32.66.16
91.201.42.83
185.146.171.180
52.32.150.180
54.240.162.86
52.35.54.251
___

Fake 'Bill' SPAM - more Locky
- https://myonlinesecurity.co.uk/more...-spoofed-to-come-from-your-own-email-address/
28 Nov 2016 - "... Locky downloader... another blank/empty malspam pretending to come from random names at your-own-email-address with the subject of 'Bill-4491989' (random numbers) with a random named zip attachment. All these emails have a To: line of resort@ doggiespalace .com with a hidden bcc: to your email address... One of the emails looks like:
From: earlene mitchel <earlene.mitchel@ your-own-email-domain .co.uk>
Date: Mon 28/11/2016 12:07
Subject: Bill-4491989
To: resort@ doggiespalace .com
Attachment: d58e224b0e2266fb80b74c3b46f03fd1.zip

Body content: totally blank/empty

28 November 2016: d58e224b0e2266fb80b74c3b46f03fd1.zip: Extracts to: 64621603.wsf
Current Virus total detections 8/50*. MALWR is unable to get any malware or download sites. Payload Security** shows a download of an encrypted file from sinmotor .com/87nft3?XztYNBph=nhYXdz which is converted by the script to MxoWCE1.dll (VirusTotal 9/56***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...32b36ce2a021ed58ba910cc7/analysis/1480329075/

** https://www.hybrid-analysis.com/sam...bac32b36ce2a021ed58ba910cc7?environmentId=100
Contacted Hosts
61.7.236.41
213.32.90.193
185.115.140.210
185.118.67.162
2.16.4.42
52.32.150.180
54.240.162.245
35.160.111.237

*** https://www.virustotal.com/en/file/...fd165b315325fb8dc95bb90a/analysis/1480333048/
___

Fake 'Message' SPAM - more Locky
- https://myonlinesecurity.co.uk/even-more-locky-spoofed-to-come-from-your-own-email-address/
28 Nov 2016 - "... Locky downloader... another malspam pretending to come from donotreply at your-own-email-address that pretends to be an email from a scanner/printer with the subject of 'Message from RNP0024D5D73B3A' (random numbers) with a semi-random named zip attachment in the format of todays date random numbers_random numbers.zip... One of the emails looks like:
From: donotreply@ your-own-email-address .co.uk
Date: Mon 28/11/2016 11:30
Subject: Message from “RNP0024D5D73B3A”
Attachment: 201611281559326883_0033.zip
This E-mail was sent from “RNP0024D5D73B3A” (Aficio MP 2352).
Scan Date: Mon, 28 Nov 2016 15:59:32 +0430)
Queries to: {redacted}

28 November 2016: 201611281559326883_0033.zip: Extracts to: 95130643.wsf - Current Virus total detections 6/55*
Payload Security** shows a download of an encrypted file from somersetautotints .co.uk/87nft3?viqtJpG=zELkPdJaI which is converted by the script to lkVpqyuH1.dll which VirusTotal 9/56*** shows is the same file as this concurrent malspam run[4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...d2598cab10907290ae9363d0/analysis/1480336074/

** https://www.hybrid-analysis.com/sam...b7dd2598cab10907290ae9363d0?environmentId=100
Contacted Hosts
5.133.180.146
213.32.90.193
54.240.162.123
91.198.174.192
91.198.174.208

*** https://www.virustotal.com/en/file/...30b80e2aaebfd165b315325fb8dc95bb90a/analysis/

4] https://myonlinesecurity.co.uk/more...-spoofed-to-come-from-your-own-email-address/

:fear::fear:

AplusWebMaster · Nov 29, 2016

Fake 'XLS Invoice', 'For Your Consideration', 'Insufficient funds' SPAM, Apple phish

FYI...

Fake 'XLS Invoice' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/plea...oice-spoofing-ansell-lighting-delivers-locky/
29 Nov 2016 - "An email with the subject of 'Please find attached a XLS Invoice 293192' (random numbers) pretending to come from creditcontrol@ random companies with a malicious Excel XLS spreadsheet attachment delivers Locky... The email looks like:
From: creditcontrol@ riversideglass .com
Date: Tue 29/11/2016 08:01
Subject: Please find attached a XLS Invoice 293192
Attachment: INVOICE.TAM_293192_20161129_C415186AD.xls
Please find attached your Invoice for Goods/Services recently delivered. If you have any questions, then pleasedo not hesitate in contacting us.Karen Lightfoot -Credit Controller, Ansell Lighting ...

29 November 2016: INVOICE.TAM_293192_20161129_C415186AD.xls - Current Virus total detections 9/56*
Payload Security** shows a download from thegarageteam .gr/087gbdv4 which is an encrypted file that gets converted by the macro to luswiacs1.dll. Unfortunately Payload Security does not make this file available in the free web version. MALWR*** did give the dll (VirusTotal 9/57[4])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...10be9ee7692ecd81928f984a/analysis/1480406523/

** https://www.hybrid-analysis.com/sam...d1810be9ee7692ecd81928f984a?environmentId=100
Contacted Hosts
178.32.154.18
95.213.195.123
213.32.90.193
185.115.140.210
52.34.245.108
54.240.162.84
35.160.111.237

*** https://malwr.com/analysis/NTMwNjg4YzY0ZmQ2NDIxZWE5OTg5ZTM5ZmJlYjc3ZTY/
Hosts
178.32.154.18
213.32.90.193
95.213.195.123
185.115.140.210

4] https://www.virustotal.com/en/file/...e9437fd5f609f0e1da87a797/analysis/1480407357/
___

Fake 'For Your Consideration' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/for-your-consideration-malspam-delivers-locky/
29 Nov 2016 - "... Locky downloader... an email with the subject of 'For Your Consideration' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of unpaid_recipient’s name.zip... One of the emails looks like:
From: Elliott Osborn <Osborn.Elliott@ airtelbroadband .in>
Date: Tue 29/11/2016 11:22
Subject: For Your Consideration
Attachment: unpaid_evf.zip
Greetings! You paid for yesterday’s invoice – the total sum was $4636.
Unfortunately, you hadn’t included the item #47089-14743 of $688.
Please transfer the remainder as soon as possible.
All details are in the attachment. Please check it out to see whether we are right.

29 November 2016: unpaid_evf.zip: Extracts to: -snk-7030904.js - Current Virus total detections 12/55*
MALWR** shows a download of an encrypted file from one of these 2 locations
http ://tytswirl .com/u2asa61 and http ://kalbould .wa .gov.au/n9zz5r8 which is converted by the script to AddoClgYDJ4J3F.tdb (VirusTotal 6/57***). The tdb file is actually a dll file that is run by rundll32 but given a different extension... Payload Security[4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...cf4a3a0f6cae8dc789510be5/analysis/1480418735/

** https://malwr.com/analysis/MmNjODJjOGM5NzViNDBkNmFiMTc5OWU3MzQ5NWJhM2Q/
Hosts
103.9.65.107
67.171.65.64

*** https://www.virustotal.com/en/file/...08e3285571bae75906255400/analysis/1480419080/

4] https://www.hybrid-analysis.com/sam...955cf4a3a0f6cae8dc789510be5?environmentId=100
Contacted Hosts
103.9.65.107
67.171.65.64
52.42.26.69
54.240.162.193
___

Fake 'File COPY' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/can-...for-payment-thank-you-malspam-delivers-locky/
29 Nov 2016 - "An email with the subject of 'File COPY.29112016.94400.XLS Sent 29/11/2016' (random numbers) pretending to come from random senders with a malicious Excel XLS spreadsheet attachment delivers Locky ransomware... The email looks like:
From: ALLGREEN-USSING, RODOLFO <RODOLFO.ALLGREEN-USSING@ PARFEMY-ELNINO .SK>
Date: Tue 29/11/2016 13:23
Subject: File COPY.29112016.94400.XLS Sent 29/11/2016
Attachment: COPY.29112016.94400.XLS
can you please pass this invoice for payment thank you...

29 November 2016: COPY.29112016.94400.XLS - Current Virus total detections 9/55*
Payload Security** shows a download of an encrypted file from steffweb .dk/087gbdv4 which is converted by the macro to luswiacs1.dll (VirusTotal 10/56***). Although the Locky dll file -name- is the same as today’s earlier XLS malspam[1] run the file itself is different...
1] https://myonlinesecurity.co.uk/plea...oice-spoofing-ansell-lighting-delivers-locky/
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...4d0e7deaee7b203e597b4e84/analysis/1480430599/

** https://www.hybrid-analysis.com/sam...4924d0e7deaee7b203e597b4e84?environmentId=100
Contacted Hosts
94.231.108.252

*** https://www.virustotal.com/en/file/...ace908415ac92e7b094275df8da9a9d9124/analysis/
___

Fake 'eFax' SPAM - drops Nymaim variant
- http://blog.dynamoo.com/2016/11/fake-efax-spam-uses-hacked-sharepoint.html
29 Nov 2016 - "This -fake -fax leads to a malicious ZIP file:

Screenshot: https://4.bp.blogspot.com/-wZb3FWqA..._CuYEpmz69Ih7AS90USWVFfU3gCLcB/s1600/efax.png

The link in the email goes to a -hacked- Sharepoint account, in this case:
https ://supremeselfstorage-my.sharepoint .com/personal/andrew_supremeselfstorage_com_au/_layouts/15/guestaccess.aspx?guestaccesstoken=GTQPc%2brKLAsKHba4nXtvl0hXrBsUmCUxoYGuu9msk0U%3d&docid=0c4b96dfd3319496a8feb1a56d88de679&rev=1
It seems to belong to a legitimate company, but maybe one that has suffered an Office 365 compromise[2]. The ZIP file it leads to is named Fax_11292016.zip (there may be other versions) containing two identical -scripts- named:
Fax_11292016_page1.js
Fax_11292016_page2.js
... Hybrid Analysis* of the script indicates this is Nymaim[3] downloading a component from:
siliguribarassociation .org/images/staffs/documetns.png
A malicious EXE is dropped with an MD5 of bdf952b2388bf429097b771746395a4c and a detection rate of 9/56**. The malware then phones home to:
stengeling .com/20aml/index.php
The domain stengeling .com appears to have been -created- for this malware and has -anonymous- registration details. It is apparently -multihomed- on the following IPs:
4.77.129.110, 18.17.224.92, 31.209.107.100, 37.15.90.12, 43.132.208.7, 45.249.111.213, 52.61.200.235
61.25.216.8, 67.25.164.206, 74.174.194.169, 88.214.198.162, 92.74.29.236, 111.241.115.90, 115.249.171.24
119.71.196.177, 135.55.94.211, 143.99.241.18, 147.89.60.135, 156.180.11.60, 162.74.9.51, 168.227.171.254
176.114.21.171, 184.131.179.44, 207.77.174.212
Each of those IPs appears to be a -hacked- legitimate host, with a high turnover of IPs. Those IPs appear to be associated with the following domains that may be worth blocking:
butestsis .com
sievecnda .com
specsotch .com
crileliste .com
stengeling .com "
* https://www.hybrid-analysis.com/sam...367f7c4cbd9192d464b68f8a382?environmentId=100
Contacted Hosts
216.158.76.73
115.249.171.24
45.249.111.213
168.227.171.254
31.209.107.100

** https://www.virustotal.com/en/file/...3979e16b1a3a7aa5480504c827e12756c60/analysis/

2] https://support.microsoft.com/en-us/kb/2551603

3] http://cyber.verint.com/nymaim-malware-variant/
___

Fake 'Insufficient funds' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/insufficient-funds-malspam-delivers-locky/
28 Nov 2016 - "... Locky.. an email with the subject of 'Insufficient funds' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of payment-recipient name.zip... One of the emails looks like:
From: Ruby Quinn <Quinn.Ruby@ villatk .gr>
Date: Mon 28/11/2016 20:58
Subject: Travel expense sheet
Attachment: payment-gold.zip
Dear gold,
Your bill payment was rejected due to insufficient funds on your account.
Payment details are given in the attachment.

28 November 2016: payment-gold.zip: Extracts to: -snk-007064018.js - Current Virus total detections 14/55*
MALWR** shows a download of an encrypted file from http ://leyuego .com/ejxgf1iy which is converted by the script to Ddrh0VO4W20.tdb (VirusTotal 7/57***). The tdb file is actually a dll file that is run by rundll32 but given a different extension to attempt to fool anyone having a quick look at it. We describe this here[4] and Bleeping computer[5] has a good write up about the use of non standard file extensions by Locky (Payload Security [6])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...aa13b4add2d052c9f36bb475/analysis/1480370317/

** https://malwr.com/analysis/NWU1NTBkODBhNWE3NDY2ZTlhMWNkNjYxM2I0MjkyN2E/
Hosts
121.201.23.80

*** https://www.virustotal.com/en/file/...77f9b3f527d9c8344efd631e/analysis/1480371353/

4] https://myonlinesecurity.co.uk/locky-changed-again-to-use-zzzzz-file-extensions/

5] http://www.bleepingcomputer.com/new...putting-us-to-sleep-with-the-zzzzz-extension/

6] https://www.reverse.it/sample/7eca0...ce3aa13b4add2d052c9f36bb475?environmentId=100
Contacted Hosts
121.201.23.80
185.12.95.92
213.32.66.16
85.143.214.58
52.34.245.108
54.240.162.4
35.160.111.237
___

Apple ID – Phish
- https://myonlinesecurity.co.uk/reset-your-password-or-unlock-your-apple-id-phishing/
29 Nov 2016 - "... mass Apple phish... received about 200 so far this morning. Many of which are getting past spam filters because they seem to have found some sending addresses that aren’t yet listed in spam databases and that don’t use SPF /DKIM /DMARC so authentication checks don’t fail. Most mail servers are set up to ignore lack of mail authentication, rather than automatically delete or quarantine...

Screenshot: https://i0.wp.com/myonlinesecurity....11_2016_apple_phish.png?resize=1024,644&ssl=1

The links in the body go to
http ://k4dot .biz/admindb/gi.html which -redirects- to http ://tkmarketingsolutions .com/skynet/Itunes/apple/

k4dot .biz: 161.58.203.203: https://www.virustotal.com/en/ip-address/161.58.203.203/information/
tkmarketingsolutions .com: 67.212.91.221: https://www.virustotal.com/en/ip-address/67.212.91.221/information/

... follow the link you see a webpage looking like:
> https://i1.wp.com/myonlinesecurity....apple_phish_website.png?resize=1024,565&ssl=1
... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."

:fear::fear:

SPAM frauds, fakes, and other MALWARE deliveries...

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member