SPAM frauds, fakes, and other MALWARE deliveries...

AplusWebMaster · Jan 20, 2015

Fake 'Proforma Invoice', 'Delivery Confirmation', 'Undefined transactions' SPAM

FYI...

Fake 'Proforma Invoice' SPAM - macro malware
- http://blog.dynamoo.com/2015/01/malware-spam-monika-monikagoetzbigkcouk.html
20 Jan 2015 - "This -fake- invoice leads to malware. It is not being sent by Big K Products UK Ltd, their systems have not been hacked or compromised. Instead, the email is a -forgery- designed to get you to click the malicious attachment.
From: Monika [monika.goetz@ bigk .co.uk]
Date: 20 January 2015 at 07:18
Subject: Proforma Invoice
Please find enclosed the proforma invoice for your order. Please let me know when payment has been made, so that the goods can be despatched.
Kind regards,
Monika Goetz
Sales & Marketing Co-ordinator

The document attached is Proforma.doc which is currently undetected by AV vendors. It contains a malicious macro... which attempts to download a binary from:
http ://solutronixfze .com/js/bin.exe
..which is saved to %TEMP%\324234234.exe. This has a VirusTotal detection rate of 2/56* and the Malwr report shows it attempting to phone home to:
59.148.196.153 (HKBN, Hong Kong)
74.208.11.204 (1&1, US)
These IPs have been used many times in similar recent attacks an I recommend you block them. It also drops a DLL with a VirusTotal detection rate of 2/57**. The payload appears to be the Dridex banking trojan. See also this post*** about a related spam run also in progress this morning."
* https://www.virustotal.com/en/file/...c5d19140c61a11aa0e346503/analysis/1421744001/

** https://www.virustotal.com/en/file/...7b3ace9c75fd2248aaad0a09/analysis/1421744963/

*** http://blog.dynamoo.com/2015/01/this-rather-terse-spam-comes-with.html

- http://myonlinesecurity.co.uk/proforma-invoice-monika-big-k-word-doc-malware/
20 Jan 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/Big-K-proforma-invoice.png

> https://www.virustotal.com/en/file/...f09a70b660c15fbab956eba1855024fcfbb/analysis/
___

Fake 'Barclays Online Bank [security-update]' SPAM
- http://blog.dynamoo.com/2015/01/malware-spam-barclays-important-update.html
20 Jan 2015 - "This -fake- Barclays spam leads to malware.
From: Barclays Online Bank [security-update@ barclays .com]
Date: 20 January 2015 at 14:41
Subject: Barclays - Important Update, read carefully!
Dear Customer,
Protecting the privacy of your online banking access and personal information are our primary concern.
During the last complains because of online fraud we were forced to upgrade our security measures.
We believe that Invention of security measures is the best way to beat online fraud.
Barclays Bank have employed some industrial leading models to start performing an extra security check with Your Online Banking Activities to ensure a safe and secure Online and Mobile Banking.
For security reasons we downloaded the Update Form to security Barclays webserver.
You are requested to follow the provided steps and Update Your Online Banking details, for the safety of Your Accounts.
- Please download and complete the form with the requested details: <URL redacted>
- Fill in all required fields with your accurately details (otherwise will lead to service suspension)
Warning: If you choose to ignore our request, you leave us no choice but to temporary hold on your funds.
Thank you for your patience as we work together to protect your account.
Please update your records on or before 48 hours, a failure to update your records will result in a temporary hold on your funds.
Sincerely,
Barclays Online Bank Customer Service
We apologize for any inconvenience this may have caused...

The link in the email varies, some other examples seen are:
http ://nrjchat .org/ONLINE~IMPORTANT-UPDATE/last-update.html
http ://utokatalin .ro/ONLINE-BANKING_IMPORTANT/update.html
http ://cab .gov .ph/ONLINE-IMPORTANT~UPDATE/last~update.html
Visiting these sites goes through some javascript hoops, and then leads to a ZIP file download which contains a malicious EXE that changes every time it is downloaded. The files are named in the general format update12345.zip and update54321.exe.
The file itself is an Upatre downloader, with poor detection rates [1] [2] [3].
The Malwr report shows traffic to the following URLs:
http ://202.153.35.133 :33384/2001uk11/HOME/0/51-SP3/0/
http ://202.153.35.133 :33384/2001uk11/HOME/1/0/0/
http ://clicherfort .com/mandoc/eula012.pdf
http ://202.153.35.133 :33387/2001uk11/HOME/41/7/4/
http ://essextwp .org/mandoc/ml1from1.tar
Out of these 202.153.35.133 (Excell Media Pvt Ltd, India) is one you should definitely block. This downloader drops several files including (in this case) %TEMP%\sJFcN24.exe which has a VirusTotal detection rate of just 3/57* and is identified as Dyreza.C by Norman anti-virus."
1] https://www.virustotal.com/en/file/...c65088ac8726755259962571/analysis/1421768747/

2] https://www.virustotal.com/en/file/...973cd134f8d1d90a6a8d4377/analysis/1421768757/

3] https://www.virustotal.com/en/file/...3d342f8acb601e0c21c89349/analysis/1421768766/

* https://www.virustotal.com/en/file/...3a42bdd77b8b743be27d89c4/analysis/1421770305/

202.153.35.133: https://www.virustotal.com/en/ip-address/202.153.35.133/information/

- http://myonlinesecurity.co.uk/barclays-important-update-read-carefully-fake-pdf-malware-2/
20 Jan 2015
* https://www.virustotal.com/en/file/...707551f27e2b6cf541faf6ca/analysis/1421769761/

- http://threattrack.tumblr.com/post/108646232563/barclays-important-update-spam
Jan 20, 2015
Tagged: Barclays, Upatre
___

Fake 'Delivery Confirmation' SPAM – doc malware
- http://myonlinesecurity.co.uk/mereway-kitchens-delivery-confirmation-word-doc-malware/
20 Jan 2015 - "'mereway kitchens Delivery Confirmation' pretending to come from mereway kitchens <sales.north@ mereway .co.uk> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... 2 versions of this spreading today. In one version once again the body of the email is completely -blank- ... and the malware is the same as today’s version of Proforma Invoice Monika big K – Word doc malware*. The second version also having the same malware just simply says 'Delivery Confirmation'..."
* http://myonlinesecurity.co.uk/proforma-invoice-monika-big-k-word-doc-malware/

- http://blog.dynamoo.com/2015/01/this-rather-terse-spam-comes-with.html
20 Jan 2015
1] https://www.virustotal.com/en/file/...15fbab956eba1855024fcfbb/analysis/1421745692/

2] https://www.virustotal.com/en/file/...8b80c0cf532a72acf9fe46d0/analysis/1421746148/
___

Fake 'Undefined transactions' SPAM - macro malware
- http://blog.dynamoo.com/2015/01/malware-spam-undefined-transactions.html
20 Jan 2015 - "This spam comes in a few different variants, however the body text always seems to be the same:
From: Joyce Mills
Date: 20 January 2015 at 10:30
Subject: Undefined transactions (need assistance) Ref:1647827ZM
Good morning
I have recently found several payments on statement with the incorrect reference. Amounts appear to be from your company, could you please confirm these payments are yours and were made from your company's bank account. If no then please reply me as soon as possible. Thanks.
P.S. Undefined transactions are included in the attached DOC.
Regards,
Joyce Mills
Senior Accounts Payable
PAYPOINT

The reference number is randomly generated and changes in each case, attached is a malicious Word document also containing the same reference number (e.g. 1647827ZM.doc). Also the name in the "From" field is consistent with the name on the bottom of the email, although this too seems randomly generated... I have seen two different variants of Word document in circulation, both undetected by AV vendors [1] [2] and each one contains a slightly different malicious macro... which attempt to download from the following locations:
http ://189.79.63.16 :8080/koh/mui.php
http ://203.155.18.87 :8080/koh/mui.php
This file is downloaded as 20.exe and is then copied to %TEMP%\324234234.exe. It has a VirusTotal detection rate of 2/57*. That report indicates that it attempts to phone home to:
194.146.136.1 (PE "Filipets Igor Victorovych", Ukraine)
This IP is commonly used in this type of attack, I would strongly recommend you block it. The Malwr report shows that this drops a Dridex DLL with a VirusTotal detection rate of 2/57**, which is the same DLL as seen earlier today***."
1] https://www.virustotal.com/en/file/...4a3d14ce8d638fb6d6185fd2/analysis/1421750540/

2] https://www.virustotal.com/en/file/...e92ea6a51e29b68b83739765/analysis/1421750559/

* https://www.virustotal.com/en/file/...0161f40ca02e0b50d468809a/analysis/1421750847/

** https://www.virustotal.com/en/file/...7b3ace9c75fd2248aaad0a09/analysis/1421752892/

*** http://blog.dynamoo.com/2015/01/malware-spam-monika-monikagoetzbigkcouk.html

- http://myonlinesecurity.co.uk/undefined-transactions-need-assistance-ref50236lv-word-doc-malware/
20 Jan 2015
* https://www.virustotal.com/en/file/...e92ea6a51e29b68b83739765/analysis/1421749886/
___

Fake 'IRS' SPAM - doc malware
- http://myonlinesecurity.co.uk/internal-revenue-service-complaint-company-word-doc-malware/
20 Jan 2015 - "'Complaint against your company' pretending to come from Internal Revenue Service <complaints@irs.gov> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer... The email looks like:
Dear business owner,
A criminal complaint has been filled against your company.
Your company is being accused of trying to commit tax evasion schemes.
The full text of the complaint file ( .DOC type ) can be viewed in your
Microsoft Word, complaint is attached.
AN official response from your part is required, in order to take further
action.
Please review the charges brought forward in the complaint file, and
contact us as soon as possible by :
Telephone Assistance for Businesses: Toll-Free, 1-800-829-4933
Email: complaints@ irs .gov
Thank you,
Internal Revenue Service Fraud Prevention Department

20 January 2015 : complaint20150119.doc - Current Virus total detections: 22/57*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...9ac10b41b4af40f30d6fbb12/analysis/1421772306/
___

Fake 'Bank of Canada' SPAM – PDF malware
- http://myonlinesecurity.co.uk/national-bank-canada-notice-payment-fake-pdf-malware/
20 Jan 2015 - "'National Bank of Canada Notice of payment pretending to come from sac.sbi@ sibn .bnc .ca with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
You can view and print the notice of payment using the Netscape or
Microsoft Explorer browsers, versions 6.2 and 5.5. You can export and store the
notice of payment data in your spreadsheet by choosing the attached file in
pdf format “.pdf”.
If you have received this document by mistake, please advise us immediately
and return it to us at the following E-mail address:
“sac.sbi@ sibn .bnc .ca”.
Thank you.
National Bank of Canada
600 de La Gauchetire West, 13th Floor
Montreal, Quebec H3B 4L2 ...

20 January 2015: payment_notice.zip: Extracts to: payment_notice.scr
Current Virus total detections: 13/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...8217e3713ffe6a861b1d33b6/analysis/1421783533/

:fear:

AplusWebMaster · Jan 21, 2015

Fake 'Open24 Service update', 'inTuit-QuickBooks' Phish, Flash 0-day ...

FYI...

Fake 'Open24 Service update' Phish ...
- http://myonlinesecurity.co.uk/open24-permanent-tsb-service-update-phishing/
21 Jan 2015 - "'Open24 Permanent TSB Service update' pretending to come from Open24 <serviceupdates@ gol .net .gy> is one of the latest -phish- attempts to steal your Open24.ie ( Permanent TSB) Bank, credit card and personal details. This one only wants your personal details, your credit card and bank details... -don’t- click-the-link in the email. If you do it will lead you to a website that looks at first glance like the genuine bank website but you can clearly see in the address bar, that it is fake. Some versions of this phish will ask you fill in the html (webpage) form that comes attached to the email:
Fwd: Software Upgrade
Dear Open24 Customer,
In order to help us protect our main line of defense against intruders; you will need to update your account through our secured server, in line to safe internet banking regulatory Requirements.
To proceed, simply follow the link below:
service_update
Kind regards
Open24

> Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/open24_phish1.png
When you fill in your user name and password you get sent on to a page looking like this, where the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format then you are sent to the genuine open24.ie ( permanent TSB ) bank site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/open24_phish2-1024x659.png
All of these emails use Social engineering tricks to persuade you to open the attachments (or click-the-link) that come with the email..."
___

Fake inTuit QuickBooks Phish
- https://security.intuit.com/alert.php?a=119
1/19/2015 - "People are receiving -fake- emails with the title "Profile Update". These mails are coming from turbotax_infoo01@ grr .la, which is -not- a legitimate email address. Below is a copy of the email people are receiving:
> https://security.intuit.com/images/profileupdatephish.jpg

This is the end of the -fake- email.
Steps to Take Now:
- Do -not- open the attachment in the email...
- Do not forward the email to anyone else.
- Delete the email."
___

Flash 0-Day Exploit used by Angler Exploit Kit
- https://isc.sans.edu/diary.html?storyid=19213
2015-01-21 - "The "Angler" exploit kit is a tool frequently used in drive-by download attacks to probe the browser for different vulnerabilities, and then exploit them to install malware. The exploit kit is very flexible and new exploits are added to it constantly. However, the blog post below* shows how this exploit kit is currently using an unpatched Flash 0-day to install malware. Current versions of Windows (e.g. Window 8 + IE 10) appear to be vulnerable. Windows 8.1, or Google Chrome do not appear to be vulnerable... typically we see these exploits more in targeted attacks, not in widely used exploit kits. This flaw could affect a large number of users very quickly..."
* http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html
2015-01-21 - "... Angler EK exploiting last version (16.0.0.257) of Flash..."
Update: "... tested it against the free version of Malwarebytes Anti Exploit* (a product from one of my customers). That stopped it. Well done!..."
* https://www.malwarebytes.org/antiexploit/

- http://blog.trendmicro.com/trendlabs-security-intelligence/flash-greets-2015-with-new-zero-day/
Jan 22, 2015 - "... Chrome’s version of the Flash Player plugin is sandboxed, mitigating potential effects to end users. Firefox is also immune to this threat..."
Geographic distribution of users affected by Angler
> http://blog.trendmicro.com/trendlab...stribution-of-Users-Affected-by-Angler-01.jpg

:fear:

AplusWebMaster · Jan 22, 2015

Fake 'HMRC Application' SPAM – PDF malware, 'Tesco Bank Fix' – Phish, MyFax SPAM...

FYI...

Fake 'HMRC Application' SPAM – PDF malware
- http://myonlinesecurity.co.uk/hmrc-application-fake-pdf-malware-2/
22 Jan 2015 - "'HMRC Application – [ your domain name]' pretending to come from HMRC .gov .uk <application@ hmrc .gov .uk> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This template was used in a malware run back in July 2014 and gets periodically reused HMRC Application – fake PDF malware*...
* http://myonlinesecurity.co.uk/hmrc-application-fake-pdf-malware/
The email looks like:
Please print this information, sign and send to application@ hmrc .gov .uk.
Date Created: 22 January 2015
Business name: ...
Acknowledgement reference: 3213476
VAT Registration Number is 3213476.
Repayment of Input Tax
Before the business starts to make taxable supplies they may provisionally claim repayment of VAT they are charged as input tax. The general rules about VAT, including Input Tax, Partial Exemption, are explained in VAT Notices 700 and 706, available on the HMRC website
Repayment of VAT as input tax is subject to the condition, provided for by the Value Added Tax Act 1994, Section 25(6), that HMRC may require them to refund some or all of the input tax they have claimed, if they do not make taxable supplies by way of business, or the input tax they claimed prior to a period in which they make taxable supplies in the course of business does not relate to the taxable supplies they make.
Change of Circumstances
If your client no longer intends to make taxable supplies, or there is any other change of circumstances affecting their VAT registration (including any delay in starting to make taxable supplies), they must notify HMRC within 30 days of the change.
If the application included an enquiry about:
the Flat Rate Scheme
the Annual Accounting Scheme
an Economic Operator Registration and Identification (EORI) number
HMRC will send your client more information about this separately
What next?
Your client will receive their Certificate of Registration (VAT4) in the post in due course.
Your client can find general information about VAT and a guide to record keeping requirements by following one of the links below...

22 January 2015: Application_3213476.zip (15 kb): Extracts to: Application_891724.pdf.exe
Current Virus total detections: 2/56** . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
** https://www.virustotal.com/en/file/...961106a3cec29badd523dd94/analysis/1421924288/
___

Fake 'Tesco Bank Fix' – Phish ...
- http://myonlinesecurity.co.uk/tesco-bank-fix-error-account-phishing/
22 Jan 2015 - "'Tesco Bank Fix The Error On Your Account' pretending to come from Tesco .com <info@ thf .com> warning of errors on your account is one of the latest phish attempts to steal your Tesco bank Account and your other personal details. This one wants your personal details, Tesco log in details and your credit card and bank details... -don’t- click-the-link in the email. If you do it will lead you to a website that looks at first glance like the genuine Tesco bank website but you can clearly see in the address bar, that it is fake. Some versions of this phish will ask you fill in the html ( webpage) form that comes attached to the email:
Dear Customer:
You have an incoming payment slated for your account. This transaction cannot be
completed due to errors present in your account information.
You are required to click on the Logon below to fix this problem immediately.
LOG ON
Please do not reply to this message. For questions, please call Customer Service at the
number on the back of your card. We are available 24 hours a day, 7 days a week.
Regards,
Tesco Personal Finance.

If you follow the link you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers1-1024x606.jpg
Then you get a page asking for password and Security number:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers2.jpg
After you fill in your Security number and password you get a page looking like this, where the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers3.jpg
Then they send you to this page and eventually it auto redirects you to the genuine Tesco bank site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers4.jpg
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
___

Fake (more) MyFax malware SPAM
- http://blog.dynamoo.com/2015/01/yet-more-myfax-malware-spam.html
22 Jan 2015 - "There's another batch of "MyFax" spam going around at the moment, for example:
From: MyFax [no-replay@ my-fax .com]
Date: 22 January 2015 at 15:08
Subject: Fax #4356342
Fax message
http ://[redacted]/.-NEW_RECEIVED.FAX/fax.html
Sent date: Thu, 22 Jan 2015 15:08:30 +0000

Clicking the link [don't] leads to a page like this:
> http://1.bp.blogspot.com/-k2m-UrYJxyA/VMEkOU_xYXI/AAAAAAAAGKc/POCVv8uPOwg/s1600/upatre.png
The download leads to an EXE-in-ZIP download which is a little different every time [1] [2] [3] [virustotal]. Detection rates are around 6/55.
The Malwr report shows communication with the following URLs:
http ://202.153.35.133 :51025/2201us22/HOME/0/51-SP3/0/
http ://202.153.35.133 :51025/2201us22/HOME/1/0/0/
http ://when-to-change-oil .com/mandoc/story_su22.pdf
http ://202.153.35.133 :51014/2201us22/HOME/41/7/4/
Of these 202.153.35.133 is the essential one to -block- traffic to, belonging to Excell Media Pvt Ltd in India. A file axybT95.exe is also dropped according to the report, which has a detection rate of 7/48*.
I haven't seen a huge number of these, the format of the URLs looks something like this:
http ://[redacted]/.-NEW_RECEIVED.FAX/fax.html
http ://[redacted]/NEW_FAX-MESSAGES/fax.letter.html
http ://[redacted]/_~NEW.FAX.MESSAGES/incoming.html "
1] https://www.virustotal.com/en/file/...0e49536bcf5b949864515617/analysis/1421943275/

2] https://www.virustotal.com/en/file/...887cbb4116355295ac670adb/analysis/1421943304/

3] https://www.virustotal.com/en/file/...2538d0d3d0830f9199a39d32/analysis/1421943319/

* https://www.virustotal.com/en/file/...ef70cb8ee0ea16d1ab502d40/analysis/1421944232/

- http://myonlinesecurity.co.uk/myfax-fax-5717718-fake-pdf-malware/
22 Jan 2015
* https://www.virustotal.com/en/file/...714310ab33a9ecc74e504681/analysis/1421940393/
___

Fake 'voice mail' SPAM – PDF malware
- http://myonlinesecurity.co.uk/received-voice-mail-fake-pdf-malware/
22 Jan 2015 - "'You have received a voice mail' pretending to come from Voice Mail <no-reply@ voicemail-delivery .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
You received a voice mail : VOICE 837-676-8958.wav (29 KB)
Caller-Id: 837-676-8958
Message-Id: KIUB4Y
Email-Id: [redacted]
This e-mail contains a voice message.
Download and extract the attachment to listen the message.
Sent by Microsoft Exchange Server

22 January 2015 : VOICE837-676-8958.zip (209 kb): Extracts to: VOICE8419-283-481.scr
Current Virus total detections: 1/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...1db4d8df08937804be5ddde0/analysis/1421943742/
0003_.b64.zip-1.exe

:fear:

AplusWebMaster · Jan 23, 2015

Fake 'tax return incorrect' SPAM

FYI...

Fake 'tax return incorrect' SPAM - doc malware
- http://blog.dynamoo.com/2015/01/malware-spam-2014-tax-payment-issue.html
23 Jan 2015 - "This tax-themed spam has a malicious Word document attached. It appears to come in several variants, for example:
From: Quinton
Date: 23 January 2015 at 08:18
Subject: 2014 Tax payment issue
According to your tax payments for 2014 year period we found that you gave a wrong legal address in your last tax payment. In order to avoid penalty fees on your tax dues we ask you to contact our specialist having checked the previous payment in advance (the DOC invoice attached below).
Regards
Quinton
Tax Inspector

From: Tara Morris
Date: 23 January 2015 at 09:28
Subject: Your tax return was incorrectly filled out
Attention: Accountant
This is to inform you that your legal address was filled incorrectly while completing the last tax form application for 2014 year.
In order to avoid penalty fees during the next tax period please contact our expert as soon as you check the payment details (the DOC invoice attached below).

Attached is a Word document with a random name, but always starting with "TAX_". Examples include:
TAX_42592OE.doc
TAX_381694AI.doc
TAX_59582FZ.doc
There are two different variants of this Word document that I have seen so far, neither are detected by AV vendors [1] [2] containing one of two malicious macros... that download a file 20.exe from the following URLs:
http ://37.139.47.221 :8080/koh/mui.php
http ://95.163.121.82 :8080/koh/mui.php
This file is then saved to %TEMP%\GYHjksdf.exe and has a low detection rate of 2/56 (Norman AV identifies it as Dridex). The Malwr analysis is inconclusive, other analysis is pending."
1] https://www.virustotal.com/en/file/...b79d6ade44d6c878f58897c4/analysis/1422005666/

2] https://www.virustotal.com/en/file/...43b0a34414a5cd3cc069bf62/analysis/1422005678/

37.139.47.221: https://www.virustotal.com/en/ip-address/37.139.47.221/information/

95.163.121.82: https://www.virustotal.com/en/ip-address/95.163.121.82/information/

- http://myonlinesecurity.co.uk/tax-return-incorrectly-filled-word-doc-malware/
23 Jan 2015
> https://www.virustotal.com/en/file/...43b0a34414a5cd3cc069bf62/analysis/1422004558/
TAX_38156WHH.doc
> https://www.virustotal.com/en/file/...e386923e26b88ed571e991e8/analysis/1422007893/
23.01.15_3406ICZ.xls
___

Fake 'Danske Bank' SPAM – PDF malware
- http://myonlinesecurity.co.uk/danske-bank-potentially-fraudulent-transaction-fake-pdf-malware-2/
23 Jan 2015 - "'Danske Bank – Potentially fraudulent transaction' pretending to come from Dee Hicks – Danske Bank <Dee.Hicks@ danskebank .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
We are contacting you regarding a potentially fraudulent transaction on your account.
Please check attached file for more information about this specific transaction.
Dee Hicks
Senior Account Executive
Danske Bank
Dee.Hicks@ danskebank .com
Tel. +45 33 44 46 77
CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are confidential and are intended solely for the use of the person or entity to whom the message was addressed...

23 January 2015 : bank_notice2301.zip (12kb): Extracts to: bank_notice2301.scr
Current Virus total detections: 8/55* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...bf456ceed0cf7bd666387104/analysis/1422012240/
___

Fake 'IRS Activity' SPAM - malware
- http://blog.dynamoo.com/2015/01/malware-spam-irs-fiscal-activity-531065.html
23 Jan 2015 - "This fake IRS spam actually does use the irsuk .co domain to host malware.
From: IRS [support@ irsuk .co]
Date: 23 January 2015 at 11:46
Subject: IRS Fiscal Activity 531065
Hello, [redacted].
We notify you that last year, according to the estimates of tax taxation,
we had a shortage of means.
We ask you to install the special program with new digital certificates,
what to eliminate an error.
To install the program go to the link <redacted>
Thanks
Intrenal Revenue Sevrice...

The ZIP file contains a malicious executable SetupIRS2015.exe which has a VirusTotal detection rate of 8/53*. The irsuk .co site is hosted on 89.108.88.9 (Agava Ltd, Russia). The Malwr report shows it phoning home to garbux .com (78.24.219.6 - TheFirst-RU, Russia)... A look at 89.108.88.9 shows there is only one active website on that IP address (irsuk .co), but the host on the IP identifies itself as ukirsgov .com which is a domain created on the same day (2015-01-19) but has been -suspended- due to invalid WHOIS details (somebody at csc .com), which was hosted on a Bosnian IP of 109.105.193.99 (Team Consulting d.o.o.).That IP is identified as malicious by VirusTotal with a number of bad domains and binaries**. The malware POSTS to garbux .com which Sophos identifies as a characteristic of the generically-named Troj/Agent-ALHF. Overall, automated analysis tools are not very clear about what this malware does... although you can guarantee it is nothing good.
Recommended blocklist:
89.108.88.9
78.24.219.6
109.105.193.99
irsuk .co
garbux .com
ukirsgov .com
updateimage .ru
getimgdcenter .ru
agensiaentrate .it
freeimagehost .ru "
* https://www.virustotal.com/en/file/...773ad90e509bdf90a68c019d/analysis/1422014166/

** 109.105.193.99: https://www.virustotal.com/en/ip-address/109.105.193.99/information/
___

Fake AMEX SPAM - PDF malware
- http://myonlinesecurity.co.uk/american-express-message-ready-fake-pdf-malware/
23 Jan 2015 - "'Your Message is Ready' pretending to come from American Express <secure.message@ americanexpresss .com> is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and download the malware zip...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/Amex-your-message-is-ready.png

When you follow the link you get a page saying "Get file. Your download will start in 5 seconds..." ... which then counts down to zero. You might get the -malware- automatically downloaded or you might have to click-the-direct-link [don't].
23 January 2015: bankline_document_pdf57331.zip (12 kb): Extracts to: bankline_document_pdf34929.exe
Current Virus total detections: 4/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...32f337877843bc37100564cc/analysis/1422025963/
... Behavioural information
TCP connections
202.153.35.133: https://www.virustotal.com/en/ip-address/202.153.35.133/information/
192.163.217.66: https://www.virustotal.com/en/ip-address/192.163.217.66/information/
___

Fake 'BankLine secure message' SPAM - malware
- http://blog.dynamoo.com/2015/01/malware-spam-you-have-received-new.html
23 Jan 2015 - "... these RBS BankLine spam messages are a popular mechanism for the bad guys to spread malware.
From: Bankline [secure.message@ rbs .com .uk]
Date: 23 January 2015 at 12:43
Subject: You have received a new secure message from BankLine
You have received a secure message.
Read your secure message by following the link bellow:
<redacted>
You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.
If you have concerns about the validity of this message, please contact the sender directly...

The link in the email seems to be somewhat dynamic... The landing page looks like this:
> http://4.bp.blogspot.com/-LLqihSXhTvU/VMJVxFvr-PI/AAAAAAAAGKw/rEq-NZnPuJo/s1600/fake-rbs.jpg
The link on that landing page goes to http ://animation-1 .com/js/jquery-1.41.15.js?get_message which downloads a ZIP file called Bankline_document_pdf71274.zip (or something similar) containing an executable file named something like Bankline_document_pdf24372.exe. The numbers change in each case, and indeed the executable changes slightly every time it is downloaded. The ThreatExpert report shows that it attempt to communicate with the well-known-bad-IP of 202.153.35.133 (Excell Media Pvt Ltd, India) which is associated with the Dyre banking trojan."

202.153.35.133: https://www.virustotal.com/en/ip-address/202.153.35.133/information/

:fear:

AplusWebMaster · Jan 26, 2015

Fake 'HP Scanned Image', 'Berendsen Invoice" SPAM

FYI...

Fake 'HP Scanned Image' SPAM - malware
- http://blog.dynamoo.com/2015/01/malware-spam-hp-digital-device-scanned.html
26 Jan 2015 - "This spam comes with a malicious attachment:
From: HP Digital Device [HP_Printer@ victimdomain .com]
Date: 26 January 2015 at 13:04
Subject: Scanned Image
Please open the attached document.
This document was digitally sent to you using an HP Digital Sending device...
This email has been scanned for viruses and spam...

Attached is a file ScannedImage.zip which contains a malicious executable ScannedImage.scr which has a VirusTotal detection rate of 5/56*..."
* https://www.virustotal.com/en/file/...d9f6a8965c7efab258494cbd/analysis/1422279206/

- http://myonlinesecurity.co.uk/scanned-image-fake-pdf-malware/
26 Jan 2015
> https://www.virustotal.com/en/file/...d9f6a8965c7efab258494cbd/analysis/1422279206/
___

Fake 'Berendsen Invoice" SPAM – doc malware
- http://myonlinesecurity.co.uk/berendsen-uk-ltd-invoice-60020918-117-word-doc-malware/
26 Jan 2015 - "'Berendsen UK Ltd Invoice 60020918 117' pretending to come from donotreply@berendsen.co.uk with -a malicious word doc attachment- is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Dear Sir/Madam, Please find attached your invoice dated 1st January. All queries should be directed to your branch that provides the service. This detail can be found on your invoice. Thank you...

26 January 2015: IRN001526_60020918_I_01_01.DOC (39 kb)
Current Virus total detections: 0/55* | IRN001526_60020918_I_01_01.DOC (34kb) 0/56**
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...e51d9ef36e4ccd0807863cd6/analysis/1422258625/

** https://www.virustotal.com/en/file/...94a347f52d0800c6005caeec/analysis/1422258320/

- http://blog.dynamoo.com/2015/01/malware-spam-berendsen-uk-ltd-invoice.html
26 Jan 2015
> https://www.virustotal.com/en/file/...2b31174564b6e026da6b9846/analysis/1422262884/

- http://blog.mxlab.eu/2015/01/26/ema...20918-117-contains-malicious-word-attachment/
Jan 26, 2015
> https://www.virustotal.com/en/file/...2b31174564b6e026da6b9846/analysis/1422262884/
___

Fake 'CardsOnLine natwesti' SPAM
- http://blog.dynamoo.com/2015/01/malware-spam-cardsonlinenatwesticom.html
26 Jan 2015 - "This -fake- NatWest email leads to malware:
From: CardsOnLine [CardsOnLine@ natwesti .com]
Date: 26 January 2015 at 13:06
Subject: Cards OnLine E-Statement E-Mail Notification
Body:
Dear Customer
Your July 30, 2014 E-Statement for account number xxxxxxxxxxxx6956 from Cards OnLine is now available.
For more information please check link: <redacted>
Thank you
Cards OnLine

... Users have recently been targeted through -bogus- E-Mails by fraudsters claiming to be from their bank. These E-Mails ask customers to provide their internet banking security details in order to reactivate their account or verify an E-Mail address. Please be on your guard against E-Mails that request any of your security details... Users who click-the-link see a download page similar to this:
> https://4.bp.blogspot.com/-a7BgUdoO...AAAGLE/f3cZqKKwrpA/s1600/natwest-download.png
The link in the email downloads a randomly-named file in the format security_notice55838.zip which contains a malicious binary which will have a name similar to security_notice18074.exe. This binary has a VirusTotal detection rate of 1/56* and is identified by Norman AV as Upatre..."
* https://www.virustotal.com/en/file/...b682c49acce4ca424190aa2c/analysis/1422281915/
___

Fake 'Sage Invoice' SPAM – PDF malware
- http://myonlinesecurity.co.uk/sage-re-invoice-9836956-fake-pdf-malware/
26 Jan 2015 - "'RE: Invoice #9836956' pretending to come from Sage .co .uk <no-reply@ sage .co .uk>
[random invoice numbers] with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Please remit BACs before 26/01/2015. The document attached.

The malware attached to this email is exactly the same as in today’s Scanned Image – fake PDF malware*.
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* http://myonlinesecurity.co.uk/scanned-image-fake-pdf-malware/

:fear:

AplusWebMaster · Jan 27, 2015

Whatsapp leads to Fake Flash update, Fake 'invoice' SPAM - malware

FYI...

Whatsapp leads to Fake Flash update – malware
- http://myonlinesecurity.co.uk/whatsapp-notification-leading-fake-flashplayer-update-malware/
27 Jan 2015 - "An email pretending to come from somebody you know that appears to be a Whatsapp notification is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/whatsapp_flash_update1-262x300.png

When you press the play button in the email, you get sent to a page looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/whatsapp_flash_update2-1024x739.png
... if you select the 'upgrade now' button you end up with a fake flash player update and a badly infected computer...
27 January 2015: adobe_flash_player_update.exe . Current Virus total detections: 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...d86bbf96c41518daa64a2ac6/analysis/1422376705/
___

Fake 'invoice' SPAM - malware
- http://blog.dynamoo.com/2015/01/malware-spam-eileen-meade-r-kern.html
27 Jan 2015 - "Kern Engineering & Mfg Corp. is a wholly legitimate firm, they are not sending out this spam nor have their systems been compromised in any way. Instead, this is a -forgery- which has a malicious Word document attached.
From: Eileen Meade [eileenmeade@ kerneng .com]
date: 27 January 2015 at 08:25
subject: inv.# 35261
Here is your invoice & Credit Card Receipt.
Eileen Meade
R. Kern Engineering & Mfg Corp.
Accounting
909) 664-2442
Fax 909) 664-2116

So far, I have seen two different version of the Word document, both poorly detected [1] [2] containing two different macros... These attempt to download a binary from one of the following locations:
http ://UKR-TECHTRAININGDOMAIN .COM/js/bin.exe
http ://schreinerei-ismer.homepage.t-online .de/js/bin.exe
This is saved as %TEMP%\sdfsdferfwe.exe. It has a VirusTotal detection rate of 3/57*..."
1] https://www.virustotal.com/en/file/...737a0fe1fc124eeb7695622d/analysis/1422351101/

2] https://www.virustotal.com/en/file/...52264065c3a344d61e4d0f2d/analysis/1422351116/

* https://www.virustotal.com/en/file/...55d67bfaef3685194aa66ec1/analysis/1422351532/

- http://myonlinesecurity.co.uk/eileen-meade-kern-engineering-inv-87049-word-doc-malware/
27 Jan 2015
> https://www.virustotal.com/en/file/...737a0fe1fc124eeb7695622d/analysis/1422350612/

> https://www.virustotal.com/en/file/...52264065c3a344d61e4d0f2d/analysis/1422350713/

- http://blog.mxlab.eu/2015/01/27/fak...g-inv-57949-contains-malicious-word-document/
Jan 27, 2015
> https://www.virustotal.com/en/file/...55d67bfaef3685194aa66ec1/analysis/1422351532/

216.251.43.17: https://www.virustotal.com/en/ip-address/216.251.43.17/information/

80.150.6.138: https://www.virustotal.com/en/ip-address/80.150.6.138/information/

:fear:

AplusWebMaster · Jan 28, 2015

Fake 'invoice' SPAM - doc malware, Malvertising campaign...

FYI...

Fake 'invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/windsor-flowers-invoice-1385-word-doc-malware/
28 Jan 2015 - "'Windsor Flowers Invoice 1385' pretending to come from Windsor Flowers Accounts <windsorflowersaccounts@ hotmail .com> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This email has what appears to be a genuine word doc attached which is malformed and contains a macro script virus... The email looks like:
Dear Accounts payable
Please see attached invoice 1385 for flowers within January 15.
Our bank details can be found at the bottom of the invoice.
If paying via transfer please reference our invoice number.
If you have any queries, please do not hesitate to contact me.
Many thanks in advance
Connie
Windsor Flowers
74 Leadenhall Market
London
EC3 V1LT
Tel: 020 7606 4277...

28 January 23015: Windsor Flowers Invoice 1385 Sheet1.doc (2 different versions)
Current Virus total detections: (76kb) 3/57* | (84 kb) 3/57** ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...6b77fb1c18a8cd71233bdfcf/analysis/1422442083/

** https://www.virustotal.com/en/file/...b4e0de37b6efdc32b63cf8b1/analysis/1422443094/
___

Fake 'RBS' SPAM - pdf-malware
- http://myonlinesecurity.co.uk/rbs-morning-commentary-fake-pdf-malware-2/
28 Jan 2015 - "'RBS Morning commentary' pretending to come from RBS .COM <no-replay@ rbs .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Please refer to the details below if you are having problems reading the attached file.
Please do not contact your Treasury Centre for technical issues – these should be routed to RBS FM support.The attached file is in zip format; first you have to unzip it (self-extracting archive, Adobe PDF) and then it can be viewed in Adobe Acrobat Reader 3.0 or above. If you do not have a copy of the software please contact your technical support department...

All the attachment numbers are random but all extract to same -malware- payload.
28 January 2015: attachment3532715.zip: Extracts to: attachment.exe
Current Virus total detections: 2/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...d9a5ffd9f60eea6f66376b00/analysis/1422448752/
... Behavioural information
UDP communications
134.170.185.211: https://www.virustotal.com/en/ip-address/134.170.185.211/information/
___

xHamster involved in large Malvertising campaign ...
- https://blog.malwarebytes.org/explo...ster-involved-in-large-malvertising-campaign/
Jan 27, 2015 - "... a particular large malvertising campaign in progress from popular adult site xhamster[.]com, a site that boasts half a billion visits a month. In the past two days we have noted a 1500% increase in infections starting from xHamster. Contrary to the majority of drive-by download attacks which use an exploit kit, this one is very simple and yet effective by embedding landing page and exploit within a rogue ad network... The URL linked to is a simplified landing page hosted by what looks like a rogue ad network. The landing simply consists of preparing for a Flash Player exploit... the Flash exploit itself (0 detection on VT*), again hosted on the same ad network. Depending on your version of Flash you may get the recent 0-day:
> https://blog.malwarebytes.org/wp-content/uploads/2015/01/flash-300x262.png
Upon successful exploitation, a malicious payload (Bedep) VT 2/57**, is downloaded from:
hxxp ://nertafopadertam .com/2/showthread.php
What we see post exploitation is ad fraud as described here***... While malvertising on xHamster is nothing new, this particular campaign is extremely active. Given that this adult site generates a lot of traffic, the number of infections is going to be huge."
* https://www.virustotal.com/en/file/...51f71cfefeae8f061bdf1ee8/analysis/1422391909/

** https://www.virustotal.com/en/file/...c3e3a2af2554a6ff62330f85/analysis/1422393597/

*** https://blog.malwarebytes.org/exploits-2/2015/01/new-adobe-flash-zero-day-found-in-the-wild/

:fear:

AplusWebMaster · Jan 29, 2015

Fake 'Invoice', 'BACS Transfer' SPAM

FYI...

Fake 'Invoice' SPAM - doc malware
- http://myonlinesecurity.co.uk/invoice-10413-spotless-cleaning-word-doc-malware/
29 Jan 2015 - "'Invoice #10413 from SPOTLESS CLEANING pretending to come from paulamatos@ btinternet .com with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
This message contains Invoice #10413 from SPOTLESS CLEANING. If you have questions about the contents of this message or Invoice, please contact SPOTLESS CLEANING.
SPOTLESS CLEANING
GLYNDEL HOUSE
BOWER LANE
DA4 0AJ
07956 379907

29 January 2015 : SPOTLESS CLEANING-Invoice-10413.doc - Current Virus total detections: 0/57*
... this malicious word doc with macros downloads from www .otmoorelectrical .co.uk/js/bin.exe which is saved as %temp%\hDnyDA.exe (dridex banking Trojan) which has a current detection rate of 2/57** ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...af247ce33f6296ca06db45e0/analysis/1422523082/

** https://www.virustotal.com/en/file/...778fbe202a3eac458168ceea/analysis/1422531540/
___

Fake 'BACS Transfer' SPAM - doc malware
- http://myonlinesecurity.co.uk/garth-hutchison-bacs-transfer-remittance-jsag400gbp-word-doc-malware/
29 Jan 2015 - "'Garth Hutchison BACS Transfer : Remittance for JSAG400GBP' pretending to come from Garth Hutchison <accmng2556@ blumenthal .com> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
We have arranged a BACS transfer to your bank for the following amount : 5821.00
Please find details attached.

29 January 2015 : BACS_transfer_JS87123781237.doc - Current Virus total detections: 0/57*
... same malware payload as today’s Invoice #10413 from SPOTLESS CLEANING – Word doc malware** ..."
* https://www.virustotal.com/en/file/...af247ce33f6296ca06db45e0/analysis/1422524523/

** http://myonlinesecurity.co.uk/invoice-10413-spotless-cleaning-word-doc-malware/
___

Swiss users inundated with malware-laden SPAM
- http://net-security.org/malware_news.php?id=2950
29.01.2015 - "Swiss users are being heavily targeted by a number of spam campaigns delivering the Tiny Banker (TinBa or Busy) e-banking Trojan. Starting with Tuesday, the spammy emails seem to come from email addresses opened with big Swiss free email service providers (bluewin .ch, gmx .ch) and Swiss telecom provider Orange (orange .ch), but actually originate from broadband lines located all over the world. They masquerade as emails containing images sent from iPhones, an MMS sent to the user by Orange, and an application for a job position:
> http://www.net-security.org/images/articles/swiss-spam-29012015.jpg
Unfortunately for those who fall for these tricks, the attached ZIP files contain only malware. "While most of the Tinba versions I usually come across of are utilising a Domain Generation Algorithm (DGA) to calculate the current botnet C&C domain, the version of Tinba that has been spread in Switzerland since yesterday is using hard-coded botnet C&C domains," noted Swiss security activist Raymond Hussy*. Further investigation revealed that all the sending IP addresses are Cutwail infected IPs, and the malware tries to contact four distinct C&C servers, two of which have already been sinkholed. Hussy recommends to network administrators to block traffic to and from the remaining two active domains (serfanteg .ru, midnightadvantage .ru) and the following IPs: 91.220.131.216 and 91.220.131.61. "In general, 91.220.131.0/24 looks quite suspect. So you may want to block the whole netblock," he pointed out, adding that it would also be a good idea to block filenames with multiple file extentions on their email gateway."
* https://www.abuse.ch/?p=9095

91.220.131.61: https://www.virustotal.com/en/ip-address/91.220.131.61/information/

91.220.131.216: https://www.virustotal.com/en/ip-address/91.220.131.216/information/

:fear:

AplusWebMaster · Jan 30, 2015

Fake 'BACS Transfer', Fake BBB SPAM ...

FYI...

Fake 'BACS Transfer' SPAM - doc malware
- http://blog.dynamoo.com/2015/01/malware-spam-bacs-transfer-remittance.html
30 Jan 2015 - "So far I have only seen one sample of this..
From "Garth Hutchison"
Date 21/01/2015 11:50
Subject BACS Transfer : Remittance for JSAG400GBP
We have arranged a BACS transfer to your bank for the following amount : 5821.00
Please find details attached.

Attached is a malicious Word document BACS_transfer_JS87123781237.doc [VT 1/57*] which contains a macro... which downloads a file from:
http ://stylishseychelles .com/js/bin.exe
This is then saved as %TEMP%\iHGdsf.exe. This has a VirusTotal detection rate of 6/57** identifying it as a Dridex download... Sources indicate that this malware phones home to the following IPs which I recommend you block:
92.63.88.108
143.107.17.183
5.39.99.18
136.243.237.218 "
* https://www.virustotal.com/en/file/...77c51529e101a5a53c631de7/analysis/1422618493/

** https://www.virustotal.com/en/file/...bc681f897eb67bf0fd6e6406/analysis/1422618468/
___

Fake BBB SPAM - PDF malware
- http://myonlinesecurity.co.uk/bbb-sbq-form-2508ref61-959-0-4-fake-pdf-malware/
30 Jan 2015 - "'BBB SBQ Form #2508(Ref#61-959-0-4)' pretending to come from Admin <no-replay@ bbbl .org> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/BBB.png

30 January 2015: SBQForm-57675.zip ( 13kb) : Extracts to: doc-PDF.exe
Current Virus total detections: 8/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...efa3d1078e6e140403192a1f/analysis/1422628270/
... Behavioural information
TCP connections
46.165.223.77: https://www.virustotal.com/en/ip-address/46.165.223.77/information/
31.170.162.203: https://www.virustotal.com/en/ip-address/31.170.162.203/information/
UDP communications
134.170.185.211: https://www.virustotal.com/en/ip-address/134.170.185.211/information/
208.91.197.54: https://www.virustotal.com/en/ip-address/208.91.197.54/information/
208.97.25.20: https://www.virustotal.com/en/ip-address/208.97.25.20/information/
___

Fake 'RE-CONFIRM' SPAM - malware
- http://myonlinesecurity.co.uk/re-confirm-p-oxx1ll112-malware/
30 Jan 2015 - "'RE-CONFIRM P.O©{XX1ll112}' pretending to come from sensaire@ emirates .net .ae with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/RE-CONFIRM-P.O©XX1ll112.png

30 January 2015: Purchase order(1).zip: Extracts to: Purchase order.exe
Current Virus total detections: 12/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper file with an icon saying A instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...fbadcbf3f730556ad95c6255/analysis/1422633004/
___

Fake 'Apple Termination' – Phish ...
- http://myonlinesecurity.co.uk/apple-termination-phishing/
30 Jan 2015 - "'Apple Termination' pretending to come from Apple Account <support@ apple-messages .com> is one of the latest -phish- attempts to steal your Apple Account and your Bank, credit card and personal details. This one only wants your personal details, Apple log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details as well...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/Apple-Termination.png

If you follow the link you see a webpage looking like with a pre-filled in box with your email address in it:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/verify_apple_ID.png
When you fill in your user name and password you get a page looking like this ( split into sections), where the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/verify_apple_ID_3.png
... these emails use Social engineering tricks to persuade you to open the attachments that come with the email... whether it is a straight forward attempt, like this one, to steal your personal, bank, credit card or email and social networking log in details..."
___

Fake 'Tesco Bank' – Phish ...
- http://myonlinesecurity.co.uk/latest-estatement-ready-tesco-bank-phishing/
30 Jan 2015 - "'Latest estatement is ready – Tesco Bank' pretending to come from savings@ tescobank .com <pol@ tesco .com> is one of the latest -phish- attempts to steal your Tesco bank Account and your other personal details. This one only wants your personal details, Tesco log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details as well... a website that looks at first glance like the genuine Tesco bank website but you can clearly see in the address bar, that it is -fake-. Some versions of this phish will ask you fill in the html (webpage) form that comes attached to the email.
Certain restriction has been placed on your tesco bank online services
View your eDocument attached to proceed
Tesco Bank is a retail bank in the United Kingdom which was formed in 1997,
and which has been wholly owned by Tesco PLC since 2008
©Tesco Personal Finance plc 2014 / ©Tesco Personal Finance Compare Limited 2014.

If you open the attached html form you see this message:
Your Latest Tesco Bank Saving Account Statement is ready.
Certain restriction has been placed on your tesco bank online service
You would be required to re – activate your online banking access to proceed
Activate Your Online Access

If you follow that link you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers1.jpg
Then you get a page asking for password and Security number:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers2.jpg
After you fill in your Security number and password you get a page looking like this, where the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers3.jpg
Then they send you to this page and eventually it auto redirects you to the genuine Tesco bank site:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/tesco_vouchers4.jpg
All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."

:fear::fear:

AplusWebMaster · Jan 31, 2015

Super Bowl Phishing -and- SPAM ...

FYI...

Super Bowl Phishing -and- SPAM ...
- https://isc.sans.edu/diary.html?storyid=19261
2015-01-31 - "Beware of Super Bowl spam that may come to your email inbox this weekend. The big game is Sunday and the spam and phishing emails are -pouring- in complete with helpful -links- back-ended by malware and/or credential harvesting:
> https://isc.sans.edu/diaryimages/images/superbowl.PNG
... worth a reminder to friends and family if they see any emails about the Super Bowl that appears to be too-good-to-be-true - delete it..."

:fear::fear:

AplusWebMaster · Feb 2, 2015

Fake 'Facebook Account' SPAM, 'Apple ID' Phish ...

FYI...

Fake 'Facebook Account' SPAM - PDF malware
- http://myonlinesecurity.co.uk/facebook-account-suspended-fake-pdf-malware/
2 Feb 2015 - "'Facebook Account Suspended' pretending to come from Facebook <noreply@ mail .fb .com> is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and follow the link and run the downloaded file... Google seems to be -ignoring- the report to take down this url so far today or are far too busy complaining about Microsoft and other program makers not issuing patches inside the 90 day time period that Google insist on, to do something really useful in actually protecting users from malware like this one... The email looks like:

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/facebook-account-suspended.png

2 February 2015 : TermsPolicies.pdf.exe - Current Virus total detections: 11/57*
This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...28509c083637a8498d3e81dc/analysis/1422881129/
___

Fake 'Your Apple ID' - Phish ...
- http://myonlinesecurity.co.uk/apple-idwas-used-restore-device-one-icloud-backups-phishing/
2 Feb 2015 - "'Your Apple ID,was used to restore a device from one of your iCloud backups' pretending to come from Apple iTunes <orders@ tunes .co .uk> is one of the latest phish attempts to steal your Apple Account and your Bank, credit card and personal details. This one only wants your personal details, Apple log in details and your credit card and bank details. Many of them are also designed to specifically steal your email, facebook and other social network log in details as well... The original email looks like this It will NEVER be a genuine email from Apple or any other company so don’t ever click-the-link in the email. If you do it will lead you to a website that looks at first glance like the genuine Apple website but you can clearly see in the address bar, that it is -fake-. Some versions of this phish will ask you fill in the html (webpage) form that comes attached to the email. This one has a short url link ( https ://tr .im/JxUNR) in the email which -redirects- you... When you fill in your user name and password you get a page looking very similar to this one ( split into sections), where the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
(Screenshots available at the myonlinesecurity URL at the top of this post.)
___

Facebook porn video trojan affects 110K users in 2 days
- http://www.theinquirer.net/inquirer...ideo-trojan-affects-110-000-users-in-two-days
Feb 02 2015 - "A TROJAN that has spread itself by posting links to a pornographic video has affected over 110,000 Facebook users in just 48 hours. The malware spreads from the account of previously infected users of the social network, tagging around 20 of their friends. If someone opens the link contained in the post, they will get a preview of a porn video which eventually stops and asks for a fake Flash player to be downloaded which contains the malware. The malware was uncovered by a security researcher called Mohammad Reza Faghan, who posted information about it on security mailing list archive Seclists.org*... the Trojan is different from previous examples seen on Facebook, which sent messages on behalf of the victim to a number of the victim's friends. Upon infection of those friends, the malware could go one step further and infect the friends of the initial friends. In the new technique, however, the malware has more visibility to the potential victims as it tags the friends of the victim in the malicious post. The malware is thought to be able to hijack keyboard and mouse movements if executed successfully once landing on a victim's machine."
* http://seclists.org/fulldisclosure/2015/Jan/131
___

Fake Chrome update Spam drops CTB Locker/Critroni Ransomware
- https://blog.malwarebytes.org/socia...ate-spam-drops-ctb-lockercritroni-ransomware/
Feb 2, 2015 - "Beware of emails appearing to come from Google warning you that “Your version of Google Chrome is potentially vulnerable and out of date”. In this latest spam wave, cyber crooks are tricking users into downloading the well-known browser, except that it’s a dangerous Trojan that will encrypt your personal files and demand a hefty ransom to decrypt them back:
> https://blog.malwarebytes.org/wp-content/uploads/2015/02/spam.png
The payload is not attached to the email but instead gets downloaded from various websites that appear to have been compromised... Running “ChromeSetup.exe” will not install Google Chrome. Instead the Windows wallpaper will change to this:
> https://blog.malwarebytes.org/wp-content/uploads/2015/02/encrypted1.png
This is not just a fake warning. The files on the systems are -indeed- encrypted:
> https://blog.malwarebytes.org/wp-content/uploads/2015/02/encrypted4.png
The bad guys demand a ransom that can be paid using Bitcoins:
> https://blog.malwarebytes.org/wp-content/uploads/2015/02/encrypted8.png
... The problem with ransomware is that while the active Trojans can be removed, it is much more difficult and sometimes impossible to recover the encrypted files. The folks at BleepingComputer* have some tips on how to restore your encrypted files. However, as is often the case, prevention is critical to avoid a nasty ransomware infection..."
* http://www.bleepingcomputer.com/virus-removal/ctb-locker-ransomware-information#shadow

- http://net-security.org/malware_news.php?id=2952
03.02.2015
> http://www.net-security.org/images/articles/chrome-mal-03022015.jpg

:fear::fear:

AplusWebMaster · Feb 3, 2015

Fake 'CIT' SPAM, 'Barclays Debit Card' – Phish ...

FYI...

Fake 'CIT' SPAM – doc malware
- http://myonlinesecurity.co.uk/cit-inv-15000375-po-sp14161-word-doc-malware/
3 Feb 2015 - "'CIT Inv# 15000375 for PO# SP14161' pretending to come from Circor <_CIG-EDI@ CIRCOR .COM> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/CIT-Inv-15000375-for-PO-SP14161.png

3 February 2015: FOPRT01.DOC - Current Virus total detections: 1/57*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...bdab8b8a56d581e3948dca23/analysis/1422951071/

- http://blog.dynamoo.com/2015/02/malware-spam-circor-cig-edicircorcom.html
3 Feb 2015
"... Recommended blocklist:
143.107.17.183
92.63.88.108 "
___

Fake 'Barclays Your Debit Card' – Phish ...
- http://myonlinesecurity.co.uk/barclays-debit-card-notification-phishing/
3 Feb 2015 - "'Your Debit Card Notification' pretending to come from Barclays Bank Plc is one of the latest phish attempts to steal your Barclays Bank, debit card and personal details. This one only wants your Barclays log in details. Many of them are also designed to specifically steal your email, facebook and other social network log in details as well... The website at gardendecore .pl have cleaned up the phishing pages and hopefully plugged the security holes or vulnerabilities that let the bad guys get in in the first place. If you follow the link you see a webpage looking like the genuine Barclays log in page:

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Barclays_phish_-feb_2015.png

When you fill in the required details there, the phishers then send you on to the next page where they ask you to fill in your name, details and passcodes, the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and that the credit card numbers have the correct number of digits and format. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."
___

Fake 'Garrett' SPAM - malware
- http://myonlinesecurity.co.uk/pulsar-instruments-plc-garrett-courtright-copy-07441489933-malware/
3 Feb 2015 - "'Garrett Courtright Copy from +07441489933' pretending to come from Garrett Courtright <ophidian@ nagsgolf .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Fax: +07441489933
Date: 2015/01/18 16:43:04 CST
Pages: 1
Reference number: Y67969682C281D
Filename: pulsar_instruments_plc57.zip
Pulsar Instruments Plc
Garrett Courtright

3 February 2015 : pulsar_instruments_plc57.zip: Extracts to: pulsar_instruments_plc57.scr
Current Virus total detections: 7/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...f16dbb9a88c96343f46818b3/analysis/1422985036/
... Behavioural information
TCP connections
213.186.33.2: https://www.virustotal.com/en/ip-address/213.186.33.2/information/
5.178.43.10: https://www.virustotal.com/en/ip-address/5.178.43.10/information/
___

Fake 'Halifax' SPAM – Phish ...
- http://myonlinesecurity.co.uk/update-account-details-halifax-phishing/
3 Feb 2015 - "'Update your account details' pretending to come from Halifax Online Banking <securitynews@halifax.co.uk> is one of the latest phish attempts to steal your Bank, credit card and personal details. An alternative email says 'We’re improving your Halifax account' also pretending to come from Halifax Online Banking <securitynews@ halifax .co .uk>. This one wants all your personal details including email address and password and your credit card and bank details. Many of them are also designed to specifically steal your facebook and other social network log in details as well... don’t -ever- open or fill in the html (webpage) form that comes attached to the email... If you do it will lead you to a website that looks at first glance like the genuine bank website but you can clearly see in the address bar, that it is -fake-. Some versions of this phish will ask you to follow a link in the body of the email to a phishing site. Both of today’s emails have different phish sites in the attached html files but otherwise the attachments are identical.

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/halifax_phish_email_2.png
-or-
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/halifax_phish_email_1.png

If you open the attached html file you see a webpage looking like this (split in 2 to get it all):
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/halifax1-1024x587.png

> http://myonlinesecurity.co.uk/wp-content/uploads/2015/01/halifax21-1024x620.png

... these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."

:fear:

AplusWebMaster · Feb 4, 2015

Fake 'USPS Delivery' SPAM, -iOS- Spyware App, Apps on Google Play - Adware! ...

FYI...

Fake 'USPS Delivery' SPAM – doc malware
- http://myonlinesecurity.co.uk/usps-delivery-notification-word-doc-malware/
4 Feb 2015 - "'USPS Delivery Notification' pretending to come from USPS <no-reply@ usps .gov> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/USPS-Delivery-Notification-1024x614.png

4 February 2015: label_54633541.doc - Current Virus total detections: 2/55*
... The basic rule is NEVER open any attachment to an email, unless you are expecting it... Never just blindly click on the file in your email..."
* https://www.virustotal.com/en/file/...705bb49612a5d1b2be0c2fb5/analysis/1423064590/
___

Pawn Storm Update: -iOS- Espionage App Found
- http://blog.trendmicro.com/trendlab...ce/pawn-storm-update-ios-espionage-app-found/
Feb 4, 2015 - "... spyware specifically designed for espionage on -iOS- devices. While spyware targeting -Apple- users is highly notable by itself, this particular spyware is also involved in a targeted attack... Operation Pawn Storm is an active economic and political cyber-espionage operation that targets a wide range of entities, like the military, governments, defense industries, and the media. The actors of Pawn Storm tend to first move a lot of pawns in the hopes they come close to their actual, high profile targets. When they finally successfully infect a high profile target, they might decide to move their next pawn forward: advanced espionage malware... The iOS malware we found is among those advanced malware. We believe the iOS malware gets installed on already compromised systems, and it is very similar to next stage SEDNIT malware we have found for Microsoft Windows’ systems... The obvious goal of the SEDNIT-related spyware is to steal personal data, record audio, make screenshots, and send them to a remote command-and-control (C&C) server. As of this publishing, the C&C server contacted by the iOS malware is -live- ...
C&C Communication: Besides collecting information from the iOS device, the app sends the information out via HTTP. It uses POST request to send messages, and GET request to receive commands... The exact methods of installing these malware is unknown. However, we do know that the iOS device doesn’t have to be jailbroken per se. We have seen one instance wherein a lure involving XAgent simply says “Tap Here to Install the Application.” The app uses Apple’s ad hoc provisioning, which is a standard distribution method of Apple for iOS App developers. Through ad hoc provisioning, the malware can be installed simply by clicking-on-a-link, such as in the picture below:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/01/pwnstrm10.png
There may be other methods of infection that are used to install this particular malware. One possible scenario is infecting an iPhone* after connecting it to a compromised -or- infected Windows laptop via a USB cable...
* http://blog.trendmicro.com/trendlab...ttacks-data-encryption-not-found-in-ios-apps/
The hashes of the related files are:
05298a48e4ca6d9778b32259c8ae74527be33815
176e92e7cfc0e57be83e901c36ba17b255ba0b1b
30e4decd68808cb607c2aba4aa69fb5fdb598c64 ..."

- http://arstechnica.com/security/201...ern-governments-journalists-hits-ios-devices/
Feb 4 2015
___

Apps on Google Play Pose As Games - Infect Millions with Adware
- https://blog.avast.com/2015/02/03/a...mes-and-infect-millions-of-users-with-adware/
Feb 3, 2015 - "A couple of days ago, a user posted a comment on our forum* regarding apps harboring adware that can be found on Google Play. This didn’t seem like anything spectacular at the beginning, but once I took a closer look it turned out that this malware was a bit bigger than I initially thought. First of all, the apps are on Google Play, meaning that they have a huge target audience – in English speaking and other language regions as well. Second, the apps were already downloaded by millions of users and third, I was surprised that the adware lead to some legitimate companies:
> https://blog.avast.com/wp-content/uploads/2015/02/Durak-game-GP.png
The Durak card game app was the most widespread of the malicious apps with 5–10 million installations according to Google Play:
> https://blog.avast.com/wp-content/uploads/2015/02/Durak-1-player-2-player-rules-300x168.png
When you install Durak, it seems to be a completely normal and well working gaming app. This was the same for the other apps, which included an IQ test and a history app. This impression remains until you reboot your device and wait for a couple of days. After a week, you might start to feel there is something wrong with your device. Some of the apps wait up to 30 days until they show their true colors. After 30 days, I guess not many people would know which app is causing abnormal behavior on their phone, right? Each time you unlock your device an ad is presented to you, warning you about a problem, e.g. that your device is infected, out of date or full of porn. This, of course, is a complete lie. You are then asked to take action, however, if you approve you get re-directed to harmful threats on fake pages, like dubious app stores and apps that attempt to send premium SMS behind your back or to apps that simply collect too much of your data for comfort while offering you no additional value.
> https://blog.avast.com/wp-content/uploads/2015/02/Threats-detected-malcious-apps-300x261.jpg
An even bigger surprise was that users were sometimes directed to security apps on Google Play. These security apps are, of course, harmless, but would security providers really want to promote their apps via adware? Even if you install the security apps, the undesirable ads popping up on your phone don‘t stop. This kind of threat can be considered good social engineering. Most people won‘t be able to find the source of the problem and will face fake ads each time they unlock their device. I believe that most people will trust that there is a problem that can be solved with one of the apps advertised “solutions” and will follow the recommended steps, which may lead to an investment into unwanted apps from -untrusted- sources... the apps’ descriptions should make users -skeptical- about the legitimacy of the apps. Both in English and in other languages such as German, were written poorly: “A card game called ‘Durak‘ – one of the most common and well known game“. The apps‘ secure hash algorithm (SHA256) is the following:
BDFBF9DE49E71331FFDFD04839B2B0810802F8C8BB9BE93B5A7E370958762836 9502DFC2D14C962CF1A1A9CDF01BD56416E60DAFC088BC54C177096D033410ED FCF88C8268A7AC97BF10C323EB2828E2025FEEA13CDC6554770E7591CDED462D "

* https://forum.avast.com/?topic=165003.0
___

Data Integrity: The Core of Security
- http://www.securityweek.com/data-integrity-core-security
Feb 4, 2015 - "... Companies spend huge sums of money every year to maintain a security perimeter designed to fend off cyber and insider threats. According to Gartner*, worldwide spending on information security will reach $71.1 billion in 2014, an increase of 7.9 percent over 2013. Total information security spending will grow a further 8.2 percent in 2015 to reach $76.9 billion. Other Gartner figures show that in 2013, average budget allocations for information security were 5.1% of the overall IT budget, up 8.5% from 2012. However, the majority of investments are aimed at bolstering traditional perimeter security defenses, which is a losing battle... if we can prevent data from leaving the organization or being modified, protecting against network breaches becomes less critical. Unfortunately, data is often left unsecured... When it comes to information security, 100 percent protection in unattainable. However, by supplementing traditional perimeter defense mechanisms with data integrity principals, organizations can significantly reduce their exposure to Sony scale data breaches."
* http://www.gartner.com/newsroom/id/2828722
___

YouTube dumps Flash for HTML5
- http://www.infoworld.com/article/2877283/web-development/youtube-dumps-flash-for-html5.html
Jan 30, 2015 - "In a blow to proprietary rich Internet plug-ins, YouTube, which had been a stalwart supporter of Adobe’s Flash plug-in technology, revealed this week that it now -defaults- to the HTML5 <video> tag. The move shows HTML5's continued march toward Web dominance... Late Apple founder Steve Jobs probably did the most to the further the decline by refusing to support Flash on the company’s wildly popular iOS handheld devices. In fact, Flash shows a downward trajectory on W3Techs' report* on the number of websites using Adobe’s multimedia platform. It has -dropped- to 11.9 percent this month versus more than 15 percent a year ago. The numbers are far worse for Microsoft’s late-arriving Flash rival, Silverlight..."
* http://w3techs.com/technologies/details/cp-flash/all/all

:fear: :spider:

AplusWebMaster · Feb 5, 2015

Fake HSBC, Fake FedEx SPAM, Barclays – Phish ...

FYI...

Fake HSBC SPAM - PDF malware
- http://myonlinesecurity.co.uk/hsbc-payment-advice-fake-pdf-malware/
5 Feb 2015 - "'HSBC Payment Advice' pretending to come from HSBC <no-replay@ hsbci .co .uk> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Sir/Madam
Upon your request, attached please find payment e-Advice for your
reference.
Yours faithfully
HSBC
We maintain strict security standards and procedures to prevent
unauthorised access to information about you. HSBC will never contact
you by e-mail or otherwise to ask you to validate personal information
such as your user ID, password, or account numbers. If you receive such
a request, please call our Direct Financial Services hotline.
Please do not reply to this e-mail. Should you wish to contact us,
please send your e-mail to commercialbanking@ hsbc .co .uk and we will
respond to you.
Note: it is important that you do not provide your account or credit
card numbers, or convey any confidential information or banking
instructions, in your reply mail.
Copyright. The Hongkong and Shanghai Banking Corporation Limited 2005.
All rights reserved...

5 February 2015: HSBC-69695.zip: Extracts to: CashPro.exe
Current Virus total detections: 4/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...c953fbcf81ec729c72dadd35/analysis/1423139205/
... Behavioural information
TCP connections
216.146.43.70: https://www.virustotal.com/en/ip-address/216.146.43.70/information/
93.157.100.56: https://www.virustotal.com/en/ip-address/93.157.100.56/information/
178.47.141.100: https://www.virustotal.com/en/ip-address/178.47.141.100/information/
___

Fake FedEx SPAM - malicious script
- http://blog.dynamoo.com/2015/02/malware-spam-unable-to-deliver-your.html
5 Feb 2015 - "This -fake- FedEx spam has a malicious script attached.
From: FedEx 2Day A.M.
Date: 5 February 2015 at 15:01
Subject: PETRO, Unable to deliver your item, #0000220741
Dear Petro,
We could not deliver your item.
You can review complete details of your order in the find attached.
Yours sincerely,
Marion Bacon,
Delivery Manager.
(C) 2014 FedEx. The content of this message is protected by copyright and trademark laws.

Attached is a file FedEx_0000220741.zip which contains a malicious javascript which is highly obfuscated... but it is a bit clearer when deobfuscated... This script has a moderate detection rate of 9/56*, and downloads a file from:
http ://freesmsmantra .com/document.php?id=5451565E140110160B0824140110160B08000D160107104A070B09&rnd=3252631
Which is saved as %TEMP%\11827407.exe. This has a low detection rate of 3/56**. Automated analysis tools... don't give much of a clue as it has been hardened against analysis."
* https://www.virustotal.com/en/file/...1738da11c64bd5b259b48e12/analysis/1423149508/

** https://www.virustotal.com/en/file/...2d82a73fa6ab65874abd66db/analysis/1423148815/

50.31.134.98: https://www.virustotal.com/en/ip-address/50.31.134.98/information/
___

Fake Barclays SPAM – Phish ...
- http://myonlinesecurity.co.uk/new-barclays-service-important-notice-phishing/
5 Feb 2015 - "'New Barclays Service Important Notice' pretending to come from Barclays Service [mailto:secure@ barclaysalertid .com] is one of the latest phish attempts to steal your Barclays Bank details. We have been seeing a quite large increase in Barclays phishing emails over the last week or so. Today’s version is particularly well done with a domain that will fool a lot of people...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/barclaycard_phishing-email_1.png

If you follow-the-link, you see a webpage looking like:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Barclays_phish1.png
You then get:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Barclays_phish_check.png
Then you get this page which tries to convince you that various African IP addresses have accessed your account and scare you into going further:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Barclays_phish2.png
You then get the processing/checking screen again before being sent on to:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Barclays_phish3-1024x646.png
Where they ask you to fill in your name, details and passcodes, the phishers try to validate your details to make sure that you are entering “genuine ” information. They make sure that the bank account numbers have the correct number of digits and format. And then once again to the processing/checking screen before you are sent on to the final page where they say they will send you a new pinsentry device by post:
> http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Barclays_phish4-1024x603.png
All of these emails use Social engineering tricks to persuade you to open-the-attachments that come with the email..."

:fear:

AplusWebMaster · Feb 6, 2015

Something evil on 5.196.143.0/28, 5.196.141.24/29, Fake 'CashPro Online' SPAM ...

FYI...

Something evil on 5.196.143.0/28 and 5.196.141.24/29 ...
- http://blog.dynamoo.com/2015/02/something-evil-on-5196143028-and.html
6 Feb 2015 - "... interesting blog post from Cyphort* got me digging into that part of the infection chain using nonsense .eu domains. It uncovered a whole series of IPs and domains that have been used to spread Cryptowall (possibly other malware too), hosted in the 5.196.143.0/28 and 5.196.141.24/29 ranges (and possibly more). These are OVH IP ranges, suballocated to a customer called Verelox .com. I think that Verelox is a legitimate but very small web host that has suffered a major compromise of their servers. The first range is 5.196.141.24/29 which has apparently compromised servers at:
5.196.141.24, 5.196.141.25, 5.196.141.26, 5.196.141.27
... The second range is 5.196.143.0/28 with apparently -compromised- servers at:
5.196.143.3, 5.196.143.4, 5.196.143.5, 5.196.143.6, 5.196.143.7, 5.196.143.8, 5.196.143.10, 5.196.143.11,
5.196.143.12, 5.196.143.13
In addition to this, some of these domains use nameservers on the following IP addresses:
168.235.70.106
168.235.69.219
These are allocated to Ramnode LLC in the US. I would suggest that they are under the control of the bad guys and are worth -blocking- traffic to.
Note that Cyphort identify these C&C servers for the malware:
asthalproperties .com:4444
pratikconsultancy .com:8080
The following IPs and domain names all seem to be connected and I would recommend -blocking- at least the IP addresses and domains... other domains look like they are probably throwaway ones:
5.196.143.0/28
5.196.141.24/29
168.235.69.219
168.235.70.106
asthalproperties .com
pratikconsultancy .com ..."
(More detail at the dynamoo URL at the top of this post.)

* http://www.cyphort.com/gopego-malvertising-cryptowall/
___

Fake 'CashPro Online' SPAM – PDF malware
- http://myonlinesecurity.co.uk/cashpro-online-digital-certificate-fake-pdf-malware/
6 Feb 2015 - "'Your CashPro Online Digital Certificate' pretending to come from CashPro Online <no-replay@ cashpro .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Dear CashPro Customer,
This email is being sent to inform you that you have been granted a new
digital certificate for use with Bank of America CashPro Online.
Please open the attachment and you will be guided through a simple
process to install your new digital certificate.
If you have any questions or concerns, please contact the Bank of
America technical help desk.
Thank you for your business,
Bank of America
CashPro Online Security Team
Please do not reply to this email .
Copyright 2015 Bank of America Merrill Lynch. All rights reserved.
CashPro is a registered trademark of Bank of America Corporation.

6 February 2015: docs-20276.zip: Extracts to: docs.exe
Current Virus total detections: 3/56* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...d1be7e81db40407d4a92af01/analysis/1423239330/
... Behavioural information
TCP connections
91.198.22.70: https://www.virustotal.com/en/ip-address/91.198.22.70/information/
178.47.141.100: https://www.virustotal.com/en/ip-address/178.47.141.100/information/
192.185.35.92: https://www.virustotal.com/en/ip-address/192.185.35.92/information/
71.18.62.202: https://www.virustotal.com/en/ip-address/71.18.62.202/information/
UDP communications
77.72.174.163: https://www.virustotal.com/en/ip-address/77.72.174.163/information/

- http://threattrack.tumblr.com/post/110256192178/bank-of-america-cashpro-spam
Feb 6, 2014
docs.exe (1D38C362198AD67329FDF58B4743165E)
Tagged: bank of america, cashpro, Upatre

:fear::fear:

AplusWebMaster · Feb 9, 2015

Fake 'Lloyds new message', 'Lloyds new debit' SPAM – malware

FYI...

Fake 'Lloyds new message' SPAM – PDF malware
- http://myonlinesecurity.co.uk/lloyds-new-message-fake-pdf-malware/
9 Feb 2015 - "'You have a new message pretending to come from Lloyds Commercial Banking <GrpLloydslinkHelpdesk@ lloydsbanking .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Lloyds Commercial Logo
We want you to recognise a fraudulent email if you receive one. Lloyds Bank will always greet you personally using your title and surname and, where you hold an existing account with us, the last four digits of your account number: XXXX1328.
Dear Lloyds Link Customer,
You have a new message
There’s a new message for you, messages contain information about your account, so it’s important to view them.
If you’ve chosen to use a shared email address, please note that anyone who has access to your email account will be able to view your messages.
Please check attached message for more details.
Subject
Date
Account details
Account number
Important information about your account
09 Feb 2015
Lloyds Commercial
XXXX1328
Please note: this message is important and needs your immediate attention. Please check attached file straightaway to view it.
Yours sincerely
Signature image of Nicholas Williams - Consumer Digital Director
Nicholas Williams,
Consumer Digital Director
Please do not reply to this email as this address is not manned and cannot receive any replies.
Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales, number 2065. Telephone: 020 7626 1500.
Lloyds Bank plc is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under registration number 119278.

9 February 2015: ImportantMessage.zip: Extracts to: ImportantMessage.scr
Current Virus total detections: 6/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...884e1c50ee9a6e9ab4d6becd/analysis/1423485253/
... Behavioural information
TCP connections
216.146.43.70: https://www.virustotal.com/en/ip-address/216.146.43.70/information/
94.41.208.125: https://www.virustotal.com/en/ip-address/94.41.208.125/information/
198.23.48.157: https://www.virustotal.com/en/ip-address/198.23.48.157/information/
UDP communications
77.72.174.165: https://www.virustotal.com/en/ip-address/77.72.174.165/information/
77.72.174.164: https://www.virustotal.com/en/ip-address/77.72.174.164/information/
___

Fake 'Lloyds new debit' SPAM - PDF malware
- http://myonlinesecurity.co.uk/lloyds-received-new-debit-fake-pdf-malware/
9 Feb 2014 - "'You have received a new debit' pretending to come from Payments Admin <paymentsadmin@ lloydstsb .co .uk> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... The email looks like:
Monday 09 February 2014
This is an automatically generated email by the Lloyds TSB PLC
LloydsLink online payments Service to inform you that you have receive a
NEW Payment.
The details of the payment are attached.
This e-mail (including any attachments) is private and confidential and
may contain privileged material. If you have received this e-mail in
error, please notify the sender and delete it (including any
attachments) immediately. You must not copy, distribute, disclose or use
any of the information in it or any attachments.

9 February 2015 : details#00390702.zip: Extracts to: details.exe
Current Virus total detections: 6/57* . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...5a081f23dd69d03a98dd34ca/analysis/1423485121/
... Behavioural information
TCP connections
216.146.43.70: https://www.virustotal.com/en/ip-address/216.146.43.70/information/
94.41.208.125: https://www.virustotal.com/en/ip-address/94.41.208.125/information/
91.103.216.71: https://www.virustotal.com/en/ip-address/91.103.216.71/information/
UDP communications
77.72.174.167: https://www.virustotal.com/en/ip-address/77.72.174.167/information/
77.72.174.166: https://www.virustotal.com/en/ip-address/77.72.174.166/information/

:fear:

AplusWebMaster · Feb 10, 2015

Fake 'Amazon Order', 'Purchase Order' SPAM ...

FYI...

Fake 'Amazon Order' SPAM – malware
- http://myonlinesecurity.co.uk/amazon-order-details-malware/
10 Feb 2015 - "'Amazon Order Details' pretending to come from Amazon.com > <delivers@ amazon .com> with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment... This one is a lazy attempt to spread the malware using an old email from last year saying Order R:121216 Placed on June 28, 2014...

Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Amazon-Order-Details-1024x422.png

Todays Date: order_report.zip: Extracts to: order_report_238974983274928374892374982.exe
Current Virus total detections: 2/57* ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...688187b1a20c94f87076b0ef/analysis/1423571463/
___

Fake 'Purchase Order' SPAM - malware
- http://blog.dynamoo.com/2015/02/malware-spam-megtrade-groups.html
10 Feb 2015 - "This spam comes with a malicious attachment:
From: Megtrade groups [venkianch@ gmail .com]
Reply-To: venkanch@ gmail .com
Date: 10 February 2015 at 15:47
Subject: RE: Purchase Order Copy
Hello Vendor,
I just got back from business trip, Please find attached our purchasing order let us know price so as to confirm sample with your company.
You give us your payment terms but note our company payment policy 30% prepayment after confirming proforma invoice from you and the balance against copy of B/L.
Kindly treat as urgent and send invoice, I await to have your urgent reply to proceed.
Thanks & Best regards,
Mr Venkianch
Managing Director
NZ Megtrade Groups Ltd ... Download Attachment As zip

Unusually, this email does -not- appear to be sent out by a botnet but has been sent through -Gmail-. The link in the email goes www .ebayonline .com .ng/download/ohafi/jfred/Purchase%20Order%20Copy_pdf.7z where it downloads a file Purchase Order Copy_pdf.7z which (if you have 7-Zip installed) uncompresses to the trickily-named:
(1) Purchase Order Copy.pdf ___________________
(2) Delivery Time and Packing.pdf _______________________ _____ Adobe Reader.pdf
... or in .exe
As you might expect, this is malicious in nature and has a VirusTotal detection rate of 34/57*. The Malwr analysis** indicates that this installs a -keylogger- among other things."
* https://www.virustotal.com/en/file/...7833c7d6f79d3b83b88f6761/analysis/1423585487/

** https://malwr.com/analysis/NmFjMWRhZWQyYjVmNDNlNjlmY2ZmMzdkMDRmYTM2NzI/

:fear:

AplusWebMaster · Feb 11, 2015

Fake 'e-invoice', 'Outstanding Invoice' SPAM

FYI...

Fake 'e-invoice' SPAM
- http://blog.dynamoo.com/2015/02/malware-spam-your-latest-e-invoice-from.html
11 Feb 2015 - "This -fake- invoice spam has a malicious attachment:
From: Lydia Oneal
Date: 11 February 2015 at 09:14
Subject: Your latest e-invoice from HSBC HLDGS
Dear Valued Customer,
Please find attached your latest invoice that has been posted to your online account. You’ll be pleased to know that your normal payment terms still apply as detailed on your invoice.
Rest assured, we operate a secure system, so we can confirm that the invoice DOC originates from HSBC HLDGS and is authenticated with a digital signature.
Thank you for using e-invoicing with HSBC HLDGS - the smarter, faster, greener way of processing invoices.
This message and any attachment are confidential and may be privileged or otherwise protected from disclosure.
If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system.
If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person.

The company name and the name of the sender varies, but most of the body text remains identical. Some sample subjects are:
Your latest e-invoice from HSBC HLDGS
Your latest e-invoice from MAVEN INCOME & GROWTH VCT 3 PLC
Your latest e-invoice from DDD GROUP PLC
Your latest e-invoice from BAILLIE GIFFORD SHIN NIPPON
Your latest e-invoice from ACAL
Your latest e-invoice from PARAGON DIAMONDS LTD
Your latest e-invoice from TULLETT PREBON PLC
Your latest e-invoice from MERSEY DOCKS & HARBOUR CO
Your latest e-invoice from HOLDERS TECHNOLOGY
Your latest e-invoice from LED INTL HLDGS LTD
Your latest e-invoice from HALOS
Your latest e-invoice from ACORN INCOME FUND
The word document is randomly-named, for example 256IFV.doc, 19093WZ.doc and 097DVN.doc. There are three different versions of this malicious document, all with low detection rates [1] [2] [3] containing a slightly different macro in each case... The malware probably drops a Dridex DLL, although I have not been able to obtain this.
Recommended blocklist:
85.143.166.72
92.63.88.97
205.185.119.159
78.129.153.18
5.14.26.146
136.243.237.222
185.48.56.62
95.163.121.216 "
1] https://www.virustotal.com/en/file/...4920a2acd7096e646054d598/analysis/1423650591/

2] https://www.virustotal.com/en/file/...47a71d590dddf147b433a976/analysis/1423650604/

3] https://www.virustotal.com/en/file/...96536ad3ec3b4d31da77dc65/analysis/1423650615/

- http://myonlinesecurity.co.uk/latest-e-invoice-word-doc-malware/
11 Feb 2015
Screenshot: http://myonlinesecurity.co.uk/wp-co...latest-e-invoice-from-FINNAUST-MINING-PLC.png
___

Fake 'Outstanding Invoice' SPAM - malware
- http://blog.dynamoo.com/2015/02/malware-spam-gail-walker.html
11 Feb 2015 - "This fake invoice does -NOT- come from MBL Seminars, they are -not- sending this spam nor have their systems been compromised. Instead, this is a -forgery- with a malicious attachment.
From: Gail Walker [gail@ mblseminars .com]
Date: 11 February 2015 at 09:52
Subject: Outstanding Invoice 271741
Dear Customer
Payment for your Season Ticket was due by 31 January 2015 and has not yet been received. A copy of the invoice is attached.
By way of a reminder, the Season Ticket entitles all members of your organisation to save up to 50% on our public seminars and webinars. Since being a Season Ticket Holder your organisation has saved £728.50.
Please arrange for payment by return by BACS, cheque, or credit card. If payment has been arranged and just not reached us yet then please ignore this email.
If you have any queries, please do not hesitate to contact us.
Regards
Gail Walker
MBL (Seminars) Limited ...

So far I have seen two different malicious Word documents (there may be more) with low detection rates [1] [2] containing a different macro each... This file is saved as %TEMP%\dsHHH.exe. It has a VirusTotal detection rate of 10/57*... It also drops a DLL with a detection rate of 3/57** which is probably Dridex.
Recommended blocklist:
37.139.47.105
5.39.99.18
136.243.237.218
66.110.179.66
78.140.164.160
109.234.38.70 "
1] https://www.virustotal.com/en/file/...aeb41affd27bd5a704f62fd4/analysis/1423653571/

2] https://www.virustotal.com/en/file/...d78d691274a5fe27a7fbb9a3/analysis/1423653583/

* https://www.virustotal.com/en/file/...04746411d3ffbd7d5337220e/analysis/1423653592/

** https://www.virustotal.com/en/file/...26f18a22f49be0e8f9f7901e/analysis/1423654973/

- http://myonlinesecurity.co.uk/gail-...-outstanding-invoice-271741-word-doc-malware/
11 Feb 2015
Screenshot: http://myonlinesecurity.co.uk/wp-content/uploads/2015/02/Outstanding-Invoice-271741.png

:fear:

AplusWebMaster · Feb 12, 2015

Fake BBB SPAM, Fake 'INVOICE' SPAM - malware, Ransomware phish ...

FYI...

Fake BBB SPAM - malware
- http://blog.dynamoo.com/2015/02/malware-spam-bbb-accreditation-services.html
12 Feb 2012 - "This -fake- BBB email has a malicious attachment.
From: BBB Accreditation Services [no-replay@ newyork .bbb .org]
Date: Thu, 12 Feb 2015 10:50:01 +0000
Subject: BBB SBQ Form
Thank you for supporting your Better Business Bureau (BBB).
As a service to BBB Accredited Businesses, we try to ensure that the information we provide to potential customers is as accurate as possible. In order for us to provide the correct information to the public, we ask that you review the information that we have on file for your company.
We encourage you to print this SBQ Form, answer the questions and respond to us. (Adobe PDF)
Please look carefully at your telephone and fax numbers on this sheet, and let us know any and all numbers used for your business (including 800, 900, rollover, and remote call forwarding). Our automated system is driven by telephone/fax numbers, so having accurate information is critical for consumers to find information about your business easily.
Thank you again for your support, and we look forward to receiving this updated information.
Sincerely,
Accreditation Services

Attached is a file SQB Form.zip which contains a malicious executable SQB Form.exe. This has a VirusTotal detection rate of 4/57*. Automated analysis tools... show that attempts to connect to these following legitimate IPs and domains to determine the IP address and current time:
134.170.185.211: https://www.virustotal.com/en/ip-address/134.170.185.211/information/
time.microsoft.akadns .net
checkip.dyndns .org
Of these, checkip.dyndns .org is worth monitoring as it is often an indicator of infection.
The Anubis report also shows a DNS query to semiyun .com on 95.173.170.227*** (Netinternet, Turkey). Also the Malwr report shows connections to the following URLs:
http ://92.240.99.70:12112/1202uk11/HOME/0/51-SP:/0/ELHBEDIBEHGBEHK
http ://92.240.99.70:12112/1202uk11/HOME/41/7/4/
http ://semiyun .com/mandoc/previewa.pdf
Of these, 92.240.99.70 (Ukrainian High Technologies Ltd, Ukraine) looks like the C&C server and this should definitely be -blocked-. A file jeoQxZ5.exe is also dropped with a detection rate of 6/57**. This is most likely the Dyre banking trojan..."
* https://www.virustotal.com/en/file/...4605e03f65c3977919e32a6c/analysis/1423739716/

** https://www.virustotal.com/en/file/...7c59cfe89becd34b20a4bd25/analysis/1423741855/

*** 95.173.170.227: https://www.virustotal.com/en/ip-address/95.173.170.227/information/
___

Fake 'invoice :reminder' SPAM - leads to CVE-2012-0158 exploit
- http://blog.dynamoo.com/2015/02/invoice-reminder-spam-leads-to-cve-2012.html
12 Feb 2015 - "This spam has a malicious attachment:
From: Hajime Daichi
Date: 12 February 2015 at 15:59
Subject: invoice :reminder
Greetings.
Please find attached invoice copy for a transfer of USD29,900.00 payed to
your company account yesterday.
You can save, view and print this SWIFT message at your convenience.
Please email should you require any additional information on this
transaction.
We thank you for your continued patronage.
Corp. Office / Showroom:
# 8-2-293/82/A/706/1,
Road No. 36, Jubilee Hills,
HYDERABAD - 500 033.
Tel: +91 40 2355 4474 / 77
Fax:+91 40 2355 4466
E-mail: info@ valueline .in
Branches : VIZAG | VIJAYAWADA | BANGALORE | MUMBA

Attached is a file INVOICE.doc which is actually not a DOC at all, but an RTF file. A scan of the file at VirusTotal indicates that it is malicious, with a detection rate of 6/57*. Those detections indicate that this is exploitng CVE-2012-0158 aka MS12-027, a security flaw patched almost three years ago. So if you keep your patches up-to-date, there's a good chance you will be OK. But if you are running an ancient version of Microsoft Office (for example Office 2000, 2002 or XP) then you could be in trouble. The Malwr report for this is quite enlightening, showing the malware downloading another document from directxex .net/7783ed117ba0d69e/wisdomjacobs.exe. This has a detection rate of 14/57** and the Malwr report for this indicates that among other things it installs a -keylogger- confirmed by the ThreatExpert report.
The domain directxex .net [Google Safebrowsing***] has an unsavoury reputation, and although it is currently hiding behind a Cloudflare IP, it actually appears to be hosted on an OVH France IP of 5.135.127.68. I definitely recommend that you -block- traffic to directxex .net."
* https://www.virustotal.com/en/file/...f2d7cb9fb8154a78da4b7228/analysis/1423764503/

** https://www.virustotal.com/en/file/...e4ab59ea8e55ea68d106affb/analysis/1423765263/

*** https://www.google.com/safebrowsing/diagnostic?site=directxex.net
"... listed for suspicious activity 122 time(s) over the past 90 days...

> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0158 - 9.3 (HIGH)
___

Fake 'INVOICE' SPAM - malware
- http://blog.dynamoo.com/2015/02/malware-spam-minuteman-press-west-loop.html
12 Feb 2015 - "This -fake- invoice comes with a malicious attachment. It does not come from Minuteman Press, their systems have not been compromised in any way. Instead this is a simple email -forgery-.
From: Minuteman Press West Loop [westloop@ minutemanpress .com]
Reply-To: westloop@ minutemanpress .com
Date: 12 February 2015 at 09:00
Subject: INVOICE 1398 - FEB 4 2015
(Please see attached file: INVOICE 1398 - FEB 4 2015.DOC)
Thank you for your business.
Julio Lopez | Design Manager | Minuteman Press West Loop
1326 W. Washington Blvd. | Chicago, IL 60607
p 312.291.8966 | f 312.929.2472 |

I have seen just a single sample with an attachment INVOICE 1398 - FEB 4 2015.doc, although usually there are two or more variants so you may see slightly different ones. The DOC file has a VirusTotal detection rate of 0/57* and contains this malicious macro which downloads a second component from:
http ://ecinteriordesign .com/js/bin.exe
This is then saved as %TEMP%\\IHJfffFF.exe and has a detection rate of 7/57**. Automated analysis tools... show attempted connections to:
37.139.47.105
78.140.164.160
41.56.49.36
104.232.34.68
210.181.222.118
The Malwr report shows that it drops a DLL with an MD5 of 9001023d93beccd6c28ba67cbbc10cec which had a low detection rate at VT when it was checked a couple of hours ago***."
* https://www.virustotal.com/en/file/...b3cc4c94dd037a6f9aa577a4/analysis/1423734590/

** https://www.virustotal.com/en/file/...98902adda8cfc786866fac5d/analysis/1423734603/

*** https://www.virustotal.com/en/file/...d503d9efa29871ecb286480fc8c4ffdd7c7/analysis/
___

CTB-Locker Ransomware Spoofs Chrome and Facebook Emails as Lures, Linked to Phishing
- http://blog.trendmicro.com/trendlab...-facebook-emails-as-lures-linked-to-phishing/
Feb 12, 2015 - "... We are seeing another wave of CTB-Locker -ransomware- making their way into the wild. What’s highly notable about this current batch of crypto-ransomware is that they are using “big names” like Facebook and Google Chrome as social engineering lures.
The New Lures: We observed that the CTB-Locker ransomware arrives through spammed emails pretending to be from Google Chrome and Facebook. The -fake- Google Chrome email pretends to be a notification about updating the recipient’s Chrome browser. Upon clicking-the-link, the user will be directed to a site hosting the malware. The malware uses a Google Chrome -icon- to disguise itself as a legitimate installer package. This is actually a variant detected as TROJ_CRYPCTB.YUX.
Fake Google Chrome email:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-1.png
Another lure used by cybercriminals is Facebook. The email arrives as an account suspension notificaiton. The email instructs the user to click on an embedded link. This link will lead to the download of the malware:
Fake Facebook email:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-2.png
The malware uses a .PDF icon to disguise itself as a legitimate file. This malware is detected as TROJ_CRYPCTB.NSA. Our findings show that -both- variants are hosted in -compromised- sites. And interestingly enough, each variant is hosted on a group of compromised sites that is linked to one IP address. Connections to Phishing: Digging deeper into these compromised sites, we discovered that some of these URLs are associated with phishing spam, specifically those using -PayPal- as their lure.
Fake PayPal email:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-3.png
The spammed email arrives with the subject, “Take Action PayPal.” The email instructs the recipient to log in to their PayPal account to settle an issue by clicking-a-link in the email. Upon clicking, the link redirects to a phishing site. The site asks not only for the user’s login credentials, but other important, sensitive information like contact details and credit card information.
Fake PayPal site:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-4.png
Information requested by the phishing site:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-5.png
Once the user completes all the information, the site then redirects the person to the legitimate PayPal login page. To avoid suspicion, it uses the excuse of needing to log in -again- for the changes to fully reflect in the PayPal account. Using the same URLs as those of the CTB-Locker malware suggests that the threat actors distributing the ransomware are also dabbling in phishing... CTB-Locker variants included language support for four languages: English, German, Italian, and Dutch. This new batch of ransomware now supports seven languages, namely, French, Spanish, Latvian, German, Dutch, Italian, and English.
Ransom message:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-6.png
... The malware also now arrives in a Windows installer package. The two new variants identified were wrapped in an installer using using NSIS. Cybercriminals leverage NSIS, which is an open source installer like InstallShield, to make analysis difficult. When executed, the malware drops an encrypted version of the CRYPCTB malware and a library (.DLL) file. The library file will decrypt and execute the ransomware. After the routine, the library file will delete itself. In a surprising move, the cybercriminals adjusted the ransom payment for the decryption of files to 2 BTC, a fee lower than the 3 BTC ransom fee of previous variants. The malware also uses new set of Tor Addresses to communicate with the affected system... the added languages are all for countries based in Europe. This suggests that these variants may be targeting the EMEA region...
Top countries affected by CRYPCTB malware family:
> http://blog.trendmicro.com/trendlabs-security-intelligence/files/2015/02/CTB-L-72.jpg
... Conclusion: From what we’ve seen, the threat actors focused more on improving their chances of spreading the malware than improving the design of the code itself. Once the malware is in the system, it can be very challenging to recover the files without getting their help. As we have mentioned in previous entries, it might be tempting to give in and pay the ransom fee to get back encrypted files. However, there is no guarantee that the cybercriminals will actually honor the exchange. At the very worst, the victim is left with no files and no money..."

:fear:

AplusWebMaster · Feb 13, 2015

Fake 'Remittance', 'PURCHASE ORDER' SPAM...

FYI...

Fake 'Remittance' SPAM - malware
- http://blog.dynamoo.com/2015/02/malware-spam-remittance-xx12345678.html
13 Feb 2015 - "This -spam- comes from randomly-named companies, with slightly different body text and different subject in each case. Here is an example:
From: Gale Barlow
Date: 13 February 2015 at 12:30
Subject: Remittance IN56583285
Dear Sir/Madam,
I hope you are OK. I am writing you to let you know that total amount specified in the contract has been paid into your bank account on the 12th of February at 15:25 via BACS payment system and should reach the destination (beneficiary's) account within 3 working days.
To see full payment details please refer to the remittance advice note attached to the letter.
Any queries? Please reply back with your questions and you will receive a prompt and qualitative response as soon as possible. Please do not hesitate to write us.
Gale Barlow
Accounts Manager
4D PHARMA PLC
Boyd Huffman
Accounts Payable
GETECH GROUP

There is a malicious Word document attached to the email, so far I have only seen one version of this but usually there are two or more. The document itself has a low detection rate of 1/57* and it contains a malicious macro which downloads a file from the following location:
http ://62.76.188.221 /aksjdderwd/asdbwk/dhoei.exe
This is saved as %TEMP%\dsHHH.exe and has a detection rate of 7/57**, identifed as a Dridex downloader. Automated analysis tools... show a variety of activities, including communications with the following IPs:
85.143.166.72 (Pirix, Russia)
46.19.143.151 (Private Layer, Switzerland)
193.206.162.92 (Universita degli Studi dell'Insubria, Italy)
92.63.88.87 (MWTV, Latvia)
78.129.153.18 (iomart, UK)
205.185.119.159 (Frantech Solutions, US)
The malware then drops a Dridex DLL with a detection rate of 3/52*** and mysteriously drops another Dridex downloader with a detection rate of 6/57****. The Malwr report for that indicates there is some attempting traffic to nonexistent domains.
Recommended blocklist:
85.143.166.72
46.19.143.151
193.206.162.92
92.63.88.87
78.129.153.18
205.185.119.159 "
* https://www.virustotal.com/en/file/...76357d88ef77c936c1ec109a/analysis/1423835743/

** https://www.virustotal.com/en/file/...27abdd2893ff566b80e86ea8/analysis/1423835772/

*** https://www.virustotal.com/en/file/...b7259c71946aa2d3cdd816cf/analysis/1423836506/

**** https://www.virustotal.com/en/file/...7f696509a7f57e2abbafbdef/analysis/1423836488/
___

Fake 'PURCHASE ORDER' SPAM - doc malware
- http://myonlinesecurity.co.uk/aliso...imited-purchase-order-34663-word-doc-malware/
13 Feb 2013 - "'Alison Longworth PURCHASE ORDER (34663)' pretending to come from Alison Longworth <ALongworth@ usluk .com> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment...

Screenshot: http://myonlinesecurity.co.uk/wp-co...-Sealants-UK-Limited-PURCHASE-ORDER-34663.png

13 February 2015 : 2600_001.doc - Current Virus total detections: 0/46*
... which downloads stroygp .ru/js/bin.exe which is a -dridex- banking trojan and has a virus total detection rate of 9/57**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...21ef2658708eb81069ae2a85/analysis/1423834978/

** https://www.virustotal.com/en/file/...d3d62a6110a81a691a5cab56/analysis/1423836333/
... Behavioural information
TCP connections
37.139.47.105: https://www.virustotal.com/en/ip-address/37.139.47.105/information/
210.181.222.118: https://www.virustotal.com/en/ip-address/210.181.222.118/information/
86.104.134.156: https://www.virustotal.com/en/ip-address/86.104.134.156/information/
___

Something evil on 95.163.121.0/24
- http://blog.dynamoo.com/2015/02/something-evil-on-95163121024-digital.html
13 Feb 2015 - "I've written about DINETHOSTING* aka Digital Network JSC many times before, and frankly their entire IP range is a sea of crap, and I have a whole load of blocks in the 95.163.64.0/18 range (including the entirity of 95.163.64.0/10). This latest sea of badness seems to be suballocated to a customer using the 95.163.121.0/24 block.
* http://blog.dynamoo.com/search/label/DINETHOSTING
inetnum: 95.163.121.0 - 95.163.121.255
netname: RU-CLOUDAVT-NET
descr: LLC ABT Cloud Network
country: RU ...
descr: Digital Network JSC
descr: Moscow, Russia ...
Just looking at blog posts, I can see badness occurring in the recent past... That's quite a high concentration of bad servers in a relatively small block. A quick look at what is currently hosted indicates (IMHO) nothing of value, and I would recommend blocking the entire 95.163.121.0/24 range as a precaution."
___

Fake Email 'Internet Fax' SPAM - trojan
- http://blog.mxlab.eu/2015/02/13/email-internet-fax-job-contains-trojan/
Feb 13, 2015 - "... intercepted a new trojan distribution campaign by email with the subject “Internet Fax Job”. This email is send from the spoofed address “Fax job <no-replay@ fax-job .com>” and has the following body:
Image data has been attached.

The attached file Docs.zip contains the 26 kB large file Docs.exe. The trojan is known as UDS

angerousObject.Multi.Generic, TrojanDownloader:Win32/Upatre.AW, HEUR/QVM19.1.Malware.Gen or Win32.Trojan.Inject.Auto. At the time of writing, 7 of the 57 AV engines did detect the trojan at Virus Total*..."
* https://www.virustotal.com/en/file/...7c5eeabfe05539bc5bfcb9e9880de593349/analysis/
___

Google International Lottery Spam
- http://threattrack.tumblr.com/post/110812572283/google-international-lottery-spam
12 Feb 2015 - "Subjects Seen:
GOOGLE int
Typical e-mail details:
Congratulations on your victory in the international lottery GOOGLE INT and win in the amount of 10,000 euro.
For winning fill out the form and send it to us investing in response.

Malicious File Name and MD5:
form.exe (433DF3A8CD60E501EE0CB5B4849D82DC)

Screenshot: https://gs1.wac.edgecastcdn.net/801...871a8f8d5/tumblr_inline_njnzco42TJ1r6pupn.png

Tagged: Google, Lottery, Upatre

- http://myonlinesecurity.co.uk/congr...national-lottery-google-int-fake-pdf-malware/
12 Feb 2015
> https://www.virustotal.com/en/file/...e0c311fee14677f4e926420d/analysis/1423755189/
... Behavioural information
TCP connections
216.146.43.70: https://www.virustotal.com/en/ip-address/216.146.43.70/information/
92.240.99.70: https://www.virustotal.com/en/ip-address/92.240.99.70/information/
46.30.212.195: https://www.virustotal.com/en/ip-address/46.30.212.195/information/
UDP communications
198.27.81.168: https://www.virustotal.com/en/ip-address/198.27.81.168/information/
192.95.17.62: https://www.virustotal.com/en/ip-address/192.95.17.62/information/

:fear:

SPAM frauds, fakes, and other MALWARE deliveries...

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member