SPAM frauds, fakes, and other MALWARE deliveries...

Fake 'project status report', 'New invoices', 'Confirmation letter' SPAM

FYI...

Fake 'project status report' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-i-attached-project-status.html
3 Aug 2016 - "This spam leads to Locky ransomware:
From: Keri Jarvis [Jarvis.64030@ bac.globalnet .co.uk]
Date: 2 August 2016 at 22:13
Subject: report
Hi,
I attached the project status report in order to update you about the last meeting
Best regards,
Keri Jarvis

Attached is a randomly named ZIP file containing a malicious .js script beginning with the word "report". This downloads an evil binary... (MANY locations listed)...
(Thank you to my usual source for this data). The malware phones home to:
37.139.30.95/php/upload.php (Digital Ocean, Netherlands) [hostname: belyi.myeasy .ru]
93.170.128.249/php/upload.php (Krek Ltd, Russia)
93.170.104.20/php/upload.php (Breezle LLC, Netherlands) [hostname: pundik.rus.1vm .in]
Recommended blocklist:
37.139.30.95
93.170.128.249
93.170.104.20 "

37.139.30.95: https://www.virustotal.com/en/ip-address/37.139.30.95/information/
>> https://www.virustotal.com/en/url/a...b46c88e76252a9fef73aa8b7425886210fa/analysis/
93.170.128.249: https://www.virustotal.com/en/ip-address/93.170.128.249/information/
>> https://www.virustotal.com/en/url/d...3cd86c5ced781715adeb473a77c4eb1a6b6/analysis/
93.170.104.20: https://www.virustotal.com/en/ip-address/93.170.104.20/information/
>> https://www.virustotal.com/en/url/8...60a11de217c6379f9f6cb2f5962bcd6537f/analysis/
___

Fake 'New invoices' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-as-you-directed-i-send.html
3 Aug 2016 - "Another day, another Locky ransomware run:
From: Marian Mcgowan
Date: 3 August 2016 at 11:15
Subject: Fw: New invoices
As you directed, I send the attachment containing the data about the new invoices

Attached is a randomly-named ZIP file which contains a highly obfuscated .js script which according to this Malwr analysis downloads a binary from..
blog-aida .cba .pl/2zensi7t
..when decrypted it creates a binary with a detection rate of 4/54*. That same Malwr analysis shows it phoning home to:
93.170.104.20/php/upload.php (Breezle LLC, Netherlands) [hostname: pundik.rus.1vm .in]
This IP was seen last night** and it seems that there is a concurrent Locky spam run phoning home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
89.108.127.160/php/upload.php (Agava, Russia) [hostname: srv1129.commingserv .com]
Both those IPs are in known-bad-blocks.
Recommended blocklist:
93.170.104.20
185.129.148.0/24
89.108.127.0/24 "
* https://virustotal.com/en/file/dd8d...a6b8814314a366a46758816b/analysis/1470220208/

** http://blog.dynamoo.com/2016/08/malware-spam-i-attached-project-status.html

93.170.104.20: https://www.virustotal.com/en/ip-address/95.211.144.65/information/
>> https://www.virustotal.com/en/url/8...60a11de217c6379f9f6cb2f5962bcd6537f/analysis/

185.129.148.19: https://www.virustotal.com/en/ip-address/185.129.148.19/information/
89.108.127.160: https://www.virustotal.com/en/ip-address/89.108.127.160/information/
___

Fake 'Confirmation letter' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-confirmation-letter-leads.html
3 Aug 2016 - "Another -spam- run leading to Locky ransomware..
From: Mavis Howe [Howe.4267@ croestate .com]
Date: 3 August 2016 at 13:32
Subject: Confirmation letter
Hi [redacted],
I attached the employment confirmation letter I prepared.
Please check it before you send it out.
Best regards
Mavis Howe

The name of the sender varies from email to email. The malicious attachment and payload seem very close to the one described here*."
* http://blog.dynamoo.com/2016/08/malware-spam-as-you-directed-i-send.html

:fear::fear: :mad:
 
Last edited:
Fake 'business card', 'Sheet/Document/Invoice', 'Please sign' SPAM

FYI...

Fake 'business card' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-business-card-i-have.html
4 Aug 2016 - "This spam email has a malicious attachment:
From: Glenna Johnson
Date: 4 August 2016 at 10:18
Subject: Business card
Hello [redacted],
I have attached the new business card design.
Please let me know if you need a change
King regards,
Glenna Johnson
c75b53fd1ea488ebe8eaf068fd5c9dd13f1848f4d3a7

Sender names and that long hexadecimal number with vary. Attached is a randomly-named ZIP file containing a malicious .js script beginning with "business card"... The payload appears to be Locky ransomware. This Hybrid Analysis* of the script gives plenty of detail as to what is going on. My trusted sources tell me that the list of download locations is quite short:
escapegasmech .com/048220y5
goldjinoz .com/0a3tg
platimunjinoz .ws/13fo8lnl
regeneratewert .ws/1qvvu9lu
traveltotre .in/2c4ykij7
This drops a binary with a detection rate of 8/54**. The earlier Hybrid Analysis report shows it phoning home to:
31.41.46.29/php/upload.php (Relink Ltd, Russia) [hostname: ip.cishost .ru]
185.129.148.19/php/upload.php (MWTV, Latvia)
91.219.29.35/php/upload.php (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine) [hostname: 35.29.219.91.colo.ukrservers .com]
All of those network blocks have a pretty poor reputation and I recommend that you block their entire ranges.
Recommended blocklist:
31.41.40.0/21
185.129.148.0/24
91.219.28.0/22 "
* https://www.hybrid-analysis.com/sam...f1d987f994fae4960c36516a947?environmentId=100

** https://virustotal.com/en/file/2fea...8d122fa2db00dbba620b6910/analysis/1470304914/
___

Fake 'Sheet/Document/Invoice' SPAM - .docm leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-emailing-sheet-document.html
4 Aug 2016 - "This malware-laden spam comes with a variety of subjects, for example:
Emailing: Invoice (79).xls
Emailing: Sheet (189).doc
Emailing: Sheet (3352).tiff
Emailing: Document (79).doc
Emailing: Invoice (443).doc
Emailing: Sheet (679).xls
Emailing: Document (291).pdf
There is -no- body text. Attached is a .docm file with the same prefix as the subject (e.g. Document (291).pdf.docm) which contains a macro that downloads a malicious component... (Thank you to my usual source for this). The payload is Locky ransomware and the C2 servers are those found here*."
* http://blog.dynamoo.com/2016/08/malware-spam-business-card-i-have.html
___

Fake 'Please sign' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-please-sign-receipt.html
4 Aug 2016 - "Yet another Locky campaign today..
From: Erica Hutchinson
Date: 4 August 2016 at 12:34
Subject: please sign
Dear [redacted]
Please sign the receipt attached for the arrival of new office facilities.
Best regards,
Erica Hutchinson

This drops Locky ransomware through a malicious attachment. It appears to be largely the same as found in this earlier spam run*."
* http://blog.dynamoo.com/2016/08/malware-spam-business-card-i-have.html

:fear::fear: :mad:
 
Last edited:
Zeus Panda variant, Fake Apple, Walmart Phish

FYI...

Zeus Panda variant targets Brazil - wants to steal everything
- https://www.helpnetsecurity.com/2016/08/05/zeus-panda-steals-everything/
Aug 5, 2016 - "A new Zeus Trojan variant dubbed Panda Banker has been specially crafted to target users of 10 major Brazilian banks, but also other locally popular services. 'Zeus Panda’s Brazilian configuration file has a notable local hue. Aside from including the URLs of major banks in the country, Panda’s operators are also interested in infecting users who access delivery services for a Brazilian supermarket chain, local law enforcement websites, local network security hardware vendors, Boleto payments and a loyalty program specific to Brazil-based commerce', IBM researchers* have found..."
* https://securityintelligence.com/pa...heavyweight-banking-trojan-rolls-into-brazil/
Aug 4, 2016

Top Financial Malware per Attack Volume (Source: IBM Trusteer)
> https://static.securityintelligence.com/uploads/2016/08/1h2016_families.png
___

Fake Apple ‘Thank You For Your Order’ Phish
- http://www.hoax-slayer.net/apple-store-thank-you-for-your-order-scam-email/
Aug 5, 2016 - "Email purporting to be from the Apple Store thanks you for your order of an iPhone and notes that you can click a cancel link if you did not make the order... The email is -not- from Apple and it does not reference a real Apple Store order. Instead, it is a phishing scam designed to steal your Apple ID and password, your credit card details, and other personal information:
> https://i0.wp.com/www.hoax-slayer.n.../2016/08/apple-thank-you-for-order-scam-2.jpg
According to this email, which purports to be from the Apple Store, your order of an Apple iPhone 5c is about to be dispatched. The email does not contain your shipping and billing address but rather those of a person you do not know. It also includes a ‘cancel order’ link’ . The email features the Apple logo and is quite professionally presented. However, the email is not from Apple. Instead, it is a phishing scam designed to steal your personal and financial information. When you receive the email, you may mistakenly believe that the person named as the recipient of the iPhone has hijacked your Apple Account and made purchases in your name. Therefore, your first reaction might be to click the ‘cancel’ link in the hope of dealing with the issue. If you do click-the-link, you will be taken to a fraudulent website designed to emulate the genuine Apple website. Once on the -fake- site, you will be asked to ‘login’ with your Apple ID and password. Next, you will be taken to a -bogus- ‘Cancel Order’ form that asks you to provide your credit card details and other personal and financial information. After submitting the requested information, you may be told that you have successfully cancelled the order. But, now, the criminals can steal the information that you supplied and use it to -hijack- your Apple account, commit credit card fraud in your name, and attempt to steal your identity..."
___

Walmart phish ...
- https://bgr.com/2016/08/05/walmart-phishing-hack-account-recovery-email-scam/
Aug 5, 2016 - "Over the past couple of days*, Walmart users have been seeing unsolicited password recovery emails pop up in their inboxes. There’s clearly something 'phishy' going on, but it doesn’t seem to be a simple hack: it’s likely the precursor to an ambitious phishing attack on Walmart .com users... a Walmart spokesperson confirmed that there’s an increase in password recovery emails, but doesn’t think that any accounts have been compromised — yet. Instead, Walmart thinks that a hacker is using Walmart’s password recovery system to prepare for a -future- phishing attack. Walmart’s password recovery system is like most others: input an email address, and it sends a recovery code to that email address. But unlike some others, Walmart’s system confirms or denies whether there’s a Walmart .com account associated with that email... Seeing the groundwork for a phishing attack being laid is worrying, but the steps for customers to remain safe are simple... Walmart’s spokesperson also emphasized that it’s 'very unlikely' that any user accounts have been breached so far, and all customers need to do in the future is remain vigilant. If you’re particularly concerned, you can change the email address and password associated with your Walmart account."
* https://bgr.com/2016/08/04/walmart-email-hack-phishing-password-reset/
Aug 4, 2016

:fear::fear: :mad:
 
Last edited:
Fake 'Fraud Policy, Exceeded send Limit' SPAM

FYI...

Fake 'Fraud Policy, Exceeded send Limit' SPAM - lead to Java Adwind Trojan
- https://myonlinesecurity.co.uk/the-...nue-via-fake-financial-themed-malspam-emails/
8 Aug 2016 - "We continue to be plagued daily by fake financial themed emails containing java adwind attachments. I mentioned these HERE*. We have been seeing those emails almost every day and there was nothing to update. Today’s have stepped up a notch with multiple emails, subjects and slightly different subjects and email content to previous ones. There are 2 different Java Adwind versions in these emails...
* https://myonlinesecurity.co.uk/java-adwind-trojans-via-fake-transaction-malspam-emails/
The first one of the emails looks like:
From: admin@moneygram .ae
Date: Mon 08/08/2016 06:20
Subject: Attention To All Agents (Fraud Policy)
Attachment: Antifraud-policy.zip ( extracts to 2 identical files Antifraud-Agent-User-manual.jar and Antifraud-policy..jar )
Dear Agent,
Please find attached a self-explanatory letter and the Dodd-Frank Compliance,
Fraud Policy and Procedures which will be in effect from 20th January, 2016.
Please do not hesitate to revert to us should you require any further information.
Regards,
Senzo Dlamini
Regional Operations Executive
MoneyGram International ...

The next example looks like:
From: XM Accounts & Finance <xm.accounts@ xpressmoney .com>
Date: Mon 08/08/2016 07:58
Subject: Exceeded send Limit
Attachment: Settlement Sheet – Exceeded send Limit.zip ( extracts to Sendout Limit Exceded.jar and index.jpg ( which is a logo image for xpressmoney .com )
Dear Sir/ Madam,
It came to our notice that your agent terminal exceeded it’s send limit.
As a result of this, We want you to verify your transaction report as attached.
Respond urgently if you feel there is an error during our server computation.
XM Accounts & Finance
Xpress Money Services Ltd. | 8th Floor, Al Ameri Building TECOM
P.O. Box 643996, Sheikh Zayed Road, Dubai, UAE ...

8 August 2016: Payment_Details_00H675B0017485.jar (119kb) - Current Virus total detections 30/55* Payload Security**

8 August 2016: Antifraud-Agent-User-manual.jar (235kb) - Current Virus total detections 12/55*** Payload Security[4]

This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...55a702a37b7aae6004fd9cfd/analysis/1470633115/

** https://www.hybrid-analysis.com/sam...55e55a702a37b7aae6004fd9cfd?environmentId=100
Contacted Hosts
23.231.23.176: https://www.virustotal.com/en/ip-address/23.231.23.176/information/

*** https://www.virustotal.com/en/file/...e2455fe75a2ff33e3cc31699/analysis/1470633100/

4] https://www.hybrid-analysis.com/sam...d2be2455fe75a2ff33e3cc31699?environmentId=100

:fear::fear: :mad:
 
Fake 'Documents Requested' SPAM, Facebook Scams

FYI...

Fake 'Documents Requested' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/anot...mail-address-delivers-locky-zepto-ransomware/
9 Aug 2016 - "An email with the subject of 'FW: Documents Requested' pretending to come from a random name at your own email domain with a malicious word doc attachment is another Locky/zepto ransomware dropper...
The email looks like:
From: random name at-your-own-domain
Date: Tue 09/08/2016 09:50
Subject: FW: Documents Requested
Attachment: Untitled(1).docm
Dear [ your name ] ,
Please find attached documents as requested.
Best Regards,
Lizzie

9 August 2016: Untitled(1).docm - Current Virus total detections 5/55*.. Payload security** shows a download of the encrypted Locky/zepto binary from www .fliegendergaertner .at/09uh8ny which gets converted to a working .exe file by the malicious macro in the original word doc. to give zorgins .exe
(VirusTotal 4/55***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...8633eabb229c436b3355472f/analysis/1470732585/

** https://www.reverse.it/sample/42cb8...41c8633eabb229c436b3355472f?environmentId=100
Contacted Hosts
81.19.145.43: https://www.virustotal.com/en/ip-address/81.19.145.43/information/
>> https://www.virustotal.com/en/url/9...08166ef0001e0a3e94298cc61889b6a2078/analysis/
159.203.182.129: https://www.virustotal.com/en/ip-address/159.203.182.129/information/
>> https://www.virustotal.com/en/url/3...5ba208c12feac1a4e5620910f06b64e23e6/analysis/
185.129.148.19: https://www.virustotal.com/en/ip-address/185.129.148.19/information/
>> https://www.virustotal.com/en/url/9...3976256f10bace6b66dc40d6921cce760ca/analysis/
188.166.150.176: https://www.virustotal.com/en/ip-address/188.166.150.176/information/
>> https://www.virustotal.com/en/url/e...1c7336fd048c76310270f542cbc34826e20/analysis/

*** https://www.virustotal.com/en/file/...73316e6bd5ce157d92dd9b72/analysis/1470733027/
___

Facebook Scams ...
- https://blog.malwarebytes.com/cybercrime/2016/08/new-celebrity-death-hoax-hits-facebook/
Aug 9, 2016 - "... yet another celebrity death hoax. This time, the personality in question is Will Smith’s son, Jaden. Using one of our test accounts, below is a captured screenshot of what this Facebook post would look like if a user sees it in their feed:
> https://blog.malwarebytes.com/wp-content/uploads/2016/08/fb-hoax-post.png
... (and) iwilltryeverything[DOT]site (pictured below), and clicking any of the five boxes claiming to contain the same news:
> https://blog.malwarebytes.com/wp-content/uploads/2016/08/realwheel-600x396.png
Also, clicking anywhere on the page redirects users to ads, which may not be ideal if you’re worried about malvertising. Users are then directed to a goaheadnow[DOT]press page. From here, two things can happen: one, the user may choose to scroll down and check out the video on that page or, two, the user can choose to -share- the -false- news straight away... Choosing to share the news straight away directs users to Facebook’s login page for them to enter their credentials, if they’re not logged in it already. And then, the site asks for the user permission to post on their wall:
> https://blog.malwarebytes.com/wp-content/uploads/2016/08/005.png
... As more people share and spread such false news, the likelihood of others falling for online threats like scams and malware, or signing up for something they’d regret in the end also increases.If you see the Jaden Smith death “news” in your feed, inform the sharer that it’s a -hoax- and avoid sharing it further."

iwilltryeverything[DOT]site: 192.138.19.74: https://www.virustotal.com/en/ip-address/192.138.19.74/information/
>> https://www.virustotal.com/en/url/3...cdb8750711b32ce976c045330ea4e943b86/analysis/

goaheadnow[DOT]press: 192.138.19.74

“Five Free Tickets” Facebook Scam
- http://www.hoax-slayer.net/vue-cinemas-five-free-tickets-facebook-scam/
Aug 8, 2016 - "Post being shared on Facebook claims that you can click to get 5 free tickets from UK based cinema chain Vue Cinemas. The post is fraudulent. It is not associated with Vue Cinemas and participants will never receive the promised movie tickets. The post is a -scam- designed to trick people into divulging their personal information on suspect survey websites:
> https://i2.wp.com/www.hoax-slayer.n.../vue-cinemas-free-tickets-facebook-scam-1.jpg
... the post has no connection to the UK based cinema chain and those who participate will never receive the promised tickets. The post is designed to trick you into firstly spamming your friends with the same fraudulent giveaway and then submitting your personal information via decidedly dodgy “survey” websites..."
> https://i1.wp.com/www.hoax-slayer.n.../vue-cinemas-free-tickets-facebook-scam-2.jpg

:fear::fear: :mad:
 
Last edited:
Fake 'Scanned', 'Dear client' SPAM

FYI...

Fake 'Scanned' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-new-doc-scanned-by.html
11 Aug 2016 - "This spam has a malicious attachment:
From: Ashley [Ashley747@ victimdomail .tld]
Date: 11 August 2016 at 11:13
Subject: New Doc 6-6
Scanned by CamScanner
Sent from Yahoo Mail on Android

The sender name and numbers in the subject vary, and it appears to come from within the sender's own domain (this is just a simple forgery). Attached is a malicious Word document with a name similar to New Doc 666-9.docm. A Hybrid Analysis* of one sample shows a download location of fcm-makler .de/4GBrdf6 and my sources (thank you) tell me that there are -many- others, giving the following list:
151 .ru/4GBrdf6
antonello.messina .it/4GBrdf6
fcm-makler .de/4GBrdf6
iceninegr.web.fc2 .com/4GBrdf6
mccrarys .us/4GBrdf6
momoselok .ru/4GBrdf6
sando.oboroduki .com/4GBrdf6
www .EastsideAutoSalvage .com/4GBrdf6
www .fasulo .org/4GBrdf6
www .halloweenparty.go .ro/4GBrdf6
www .tommasobovone .com/4GBrdf6
The malware is Locky ransomware, and it phones home to the following locations:
185.129.148.19/php/upload.php (MWTV, Latvia)
195.16.90.23/php/upload.php (WIBO International s.r.o., Ukraine) [hostname: vz1.hostlife .net]
136.243.237.197/php/upload.php (Hetzner, Germany)
Recommended blocklist:
185.129.148.0/24
195.16.90.23
136.243.237.197 "
* https://www.hybrid-analysis.com/sam...cc8f2f70ee6ca4fc49a03ce4114?environmentId=100
Contacted Hosts
217.119.54.192: https://www.virustotal.com/en/ip-address/217.119.54.192/information/
>> https://www.virustotal.com/en/url/1...e521cf7732a5a57da48459a7a6a9bd5da1f/analysis/
185.129.148.19: https://www.virustotal.com/en/ip-address/185.129.148.19/information/
>> https://www.virustotal.com/en/url/8...fcbf0016bf04c76c1357ce755e945a16e32/analysis/
195.16.90.23: https://www.virustotal.com/en/ip-address/195.16.90.23/information/
>>> https://www.virustotal.com/en/url/3...9dc743ecf6b7f83ba882475f16393969bf5/analysis/
136.243.237.197: https://www.virustotal.com/en/ip-address/136.243.237.197/information/
>> https://www.virustotal.com/en/url/b...8bdb3c342c0952504f358c72d084fca2e73/analysis/
___

Fake 'Dear client' SPAM - malicious link
- https://myonlinesecurity.co.uk/dear...t-of-transaction-from-your-bank-word-malspam/
11 Aug 2016 - "A series of emails saying 'Dear client! We have detected the attempt of transaction from your bank account', coming from random senders with a -link- to a malicious word doc is another one from the current bot runs... Some of the subjects seen include:
Detected suspicious transaction on your account
Locked transaction
Online Banking informs
Barclays Personal Banking
Incomplete transaction
One of the emails looks like:
From: yvvelez@ gracehill .org
Date:
Subject: Detected suspicious transaction on your account
Attachment ( link ): payment.doc
Hello!
Dear client! We have detected the attempt of transaction from your bank
account. You may find details of the transaction in the
http ://vividlightingandliving .com.au/bank-info/payment.doc
Please download this document. If this transaction was yours, please,
contact us via contacts in the loaded file. If this transaction was not
yours, notify our safety service shortly. Contacts of the safety service
may be found in the loaded file. Also, you can contact us through the
Personal Account of your bank.
Attention: if you ignore our request, your account will be blocked on
20.08.2016.

Alternative download locations from other emails include:
http ://guestlistalamode .com/bank/payment.doc: 192.185.75.239: https://www.virustotal.com/en/ip-address/192.185.75.239/information/
>> https://www.virustotal.com/en/url/0...6a5138866da0a8f62d91c53ecddd51efe50/analysis/
http ://www.1800cloud .com/infos/report.doc: 65.49.52.99: https://www.virustotal.com/en/ip-address/65.49.52.99/information/
>> https://www.virustotal.com/en/url/d...c1fa58925b3df9490498c498bc029551a04/analysis/
http ://www.monparfum .it/payments/info.doc: 80.88.88.149: https://www.virustotal.com/en/ip-address/80.88.88.149/information/
>> https://www.virustotal.com/en/url/1...c9c3c2580c454e96a07ca1262f29f67c39a/analysis/

11 August 2016: payment.doc - Current Virus total detections 2/53*. MALWR** shows a download from
http ://88.119.179.160 /1biycuhoqetzowaawneab.exe (VirusTotal 7/53***) MALWR[4]..
Update: I am informed that it appears to be 'Panda Banker' which is a banking password/credential stealer.
See Proofpoint[5] and Arbor[6] for more details of this new threat..."
5] https://www.proofpoint.com/us/threat-insight/post/panda-banker-new-banking-trojan-hits-the-market
"... Some of the Panda Banker C&C servers use Fast flux DNS, and have numerous IP addresses associated with a single malicious domain, making the malware more resistant to counter-measures..."

6] https://www.arbornetworks.com/blog/asert/let-pandas-zeus-zeus-zeus-zeus/
"... Not only is it built on a proven banking malware platform (Zeus), there are already a number of samples and botnets in the wild. In addition, Panda Banker is actively being developed with 9 distinct versions known..."

* https://www.virustotal.com/en/file/...751e0cc3fd1ab0eabce0e02b/analysis/1470917056/

** https://malwr.com/analysis/YWJhYTUxNDFmYzNlNGE1MWFlZjI0ZWM4NGYzZGJiNDU/
Hosts
88.119.179.160: https://www.virustotal.com/en/ip-address/88.119.179.160/information/
>> https://www.virustotal.com/en/url/6...9e63c255cf47854e4a4217547193d8ecf53/analysis/

*** https://www.virustotal.com/en/file/...90dddd9cba461b41ba864578/analysis/1470916592/

4] https://malwr.com/analysis/NmRlNzAyNTY2NWIzNDIwOWJmZjk3NzYzOTgwNGE0YzU/
Hosts
No hosts contacted.

vividlightingandliving .com.au: 192.185.37.232: https://www.virustotal.com/en/ip-address/192.185.37.232/information/
>> https://www.virustotal.com/en/url/c...5148d4e9aa503bae7e7628e1da22e083754/analysis/

:fear::fear: :mad:
 
Last edited:
Fake 'Xpress Money Certificate', 'scanner' SPAM, ITunes, Netflix phish

FYI...

Fake 'Xpress Money Certificate' SPAM - leads to JAVA Jacksbot
- https://myonlinesecurity.co.uk/new-xpress-money-certificate/
12 Aug 2016 - "An email with the subject of 'New Xpress Money Certificate' pretending to come from akash.kushwah@xpressmoney .com <xm.ca@ xpressmoney .com> with a zip attachment which downloads a JAVA Jacksbot... This is a slight change to the usual java.jar files that are normally attached to these emails. Today’s version has a .exe file which is actually a SFX (self extracting RAR file) which extracts to an identically named .exe file which in turn when run drops the java files and runs them. AV detections call this one a Java Jacksbot rather than the “normal” Java Adwind we have been seeing in this sort of financial malspam.
One of the emails looks like:
From: akash.kushwah@ xpressmoney .com <xm.ca@ xpressmoney .com>
Date: Thu 16/06/2016 11:09
Subject: New Xpress Money Certificate
Attachment: New Xpress Money Certificate Signed And Sealed.exe
Dear Agent,
We have attached the New Certificate with installation details , Sign the branch seal on the attach authorization for security updates.
Best regards,
AKASH KUSHWAH | Xpress Money Operations
Xpress money services Ltd| P.O. Box 170,
Tel: +971 2 6580989 |Ex: 371 | Fax: +971 2 989564 ...

12 August 2016: New Xpress Money Certificate Signed And Sealed.exe - Extracts to: New Xpress Money Certificate Signed And Sealed..exe - Current Virus total detections 29/55*. MALWR**
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...0d7652c935518eb31d03b60b/analysis/1470995213/

** https://malwr.com/analysis/MGYzMDc3YWUzODViNGM1YjliNTc5OTdmMWFkZWViYjc/
___

Fake 'scanner' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-this-e-mail-was-sent-from.html
12 Aug 2016 - "This spam comes with a malicious attachment:
Subject: Message from "CUKPR0317276"
From: scanner@ victimdomain .tld (scanner@ victimdomain .tld)
To: webmaster@ victimdomain .tld
Date: Friday, 12 August 2016, 14:00
This E-mail was sent from "CUKPR0329001" (Aficio MP C305).
Scan Date: 17.11.2015 09:08:40 (+0000)
Queries to: <scanner@ victimdomain .tld

The email appears to come from within the victim's own domain (but this is just a simple forgery). Attached is a ZIP file with a name similar to 201608120908.zip which contains a malicious .WSF script with a name similar to
doc(171)-12082016.wsf . This Hybrid Analysis* shows the script downloading a file from www .hi-segno .com/02bjJBHDs?WUubFbrItd=ratyCr (and also the same location on bonmoment.web.fc2 .com and www .homesplus .nf.net) but a trusted source tells me that the following download locations appear in different scripts... (see URL above for long list).
The malware phones home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
138.201.56.190/php/upload.php (Hetzner, Germany)
That Latvian network range is -all- bad, I recommend that you -block- the lot. The payload is Locky ransomware.
Recommended blocklist:
185.129.148.0/24
138.201.56.190 "
* https://www.hybrid-analysis.com/sam...f703459a133aa7fda1cc3bfd2e6?environmentId=100
Contacted Hosts
213.205.40.169
138.201.56.190
185.129.148.19
208.71.106.49
216.251.43.11
___

ITunes, Netflix phishing
- https://myonlinesecurity.co.uk/apple-itunes-netflix-phishing/
12 Aug 2016 - "The latest Apple/ITunes phish pretends to be confirmation of an ITunes order for Netflix.

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/Order-Receipt-NetFlix-06285490.png

The links go to
http ://hiperkarma .hu/download/g.html where you are -redirected- to
http ://margotbai .com/UnitedKingdom/Itunes/apple/ and see a page looking like this, where if you fill in the ID and password then asks for all other financial information:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/06/flyinmgstart_apple_phish.png "

hiperkarma .hu: 87.229.45.133: https://www.virustotal.com/en/ip-address/87.229.45.133/information/
>> https://www.virustotal.com/en/url/7...3c68cff88efab5a333aad7b836477f6835f/analysis/
margotbai .com: 67.212.91.221: https://www.virustotal.com/en/ip-address/67.212.91.221/information/
>> https://www.virustotal.com/en/url/d...b2c004ed7228e98f83ba9cf8f7ff6db4543/analysis/

:fear::fear: :mad:
 
Last edited:
Beware of browser hijacker, Oracle POS Breach

FYI...

Beware of browser hijacker - comes bundled with legitimate software
- https://www.helpnetsecurity.com/2016/08/12/browser-hijacker-bing-vc/
Aug 12, 2016 - "Lavians, a 'small software vendor team' is packaging its offerings with a variant of browser-hijacking malware Bing .vc. The company sells and offers for free different types of software (drivers and other kinds of utilities) on their own website*, but also on popular download sites. Unfortunately, most of them come bundled with the aforementioned malware, which installs itself into Internet Explorer, Firefox, and Chrome -without- the user’s consent..."
* http:// www. lavians .com/product/

lavians .com: 45.79.77.19: https://www.virustotal.com/en/ip-address/45.79.77.19/information/
>> https://www.virustotal.com/en/url/7...3de9a53b23c774f2a6ac6892b4756032bc3/analysis/
bing .vc: 65.75.147.228: https://www.virustotal.com/en/ip-address/65.75.147.228/information/
>> https://www.virustotal.com/en/url/5...03d77287da9dfae0b1e36339b92697b46ed/analysis/
2016-08-13
___

Visa Alert - Oracle POS Breach
- http://krebsonsecurity.com/2016/08/visa-alert-and-update-on-the-oracle-breach/
Aug 13, 2016 - "Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle‘s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices. Visa also published a list of Internet addresses that may have been involved in the Oracle breach and are thought to be closely tied to an Eastern European organized cybercrime gang:
> http://krebsonsecurity.com/wp-content/uploads/2016/08/VSA-oracle.png
The Visa alert is the first substantive document that tries to help explain what malware and which malefactors might have hit Oracle — and by extension many of Oracle’s customers... MICROS is among the top three point-of-sale vendors globally. Oracle’s MICROS division sells point-of-sale systems used at more than 330,000 cash registers worldwide. When Oracle bought MICROS in 2014, the company said MICROS’s systems were deployed at some 200,000+ food and beverage outlets, 100,000+ retail sites, and more than 30,000 hotels. In short, tens of millions of credit cards are swiped at MICROS terminals monthly, and a breach involving the theft of credentials that might have granted remote access to even just a small percentage of those systems is potentially a big and costly problem for all involved:
> http://krebsonsecurity.com/wp-content/uploads/2016/08/oraclehosp-580x476.png "

:fear::fear: :mad:
 
Last edited:
Fake 'Order Confirmation', 'Documents' SPAM

FYI...

Fake 'Order Confirmation' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-orderconfirmationesabcouk.html
15 Aug 2016 - "This -fake- financial spam does -not- come from ESAB but is instead a simple -forgery- with a malicious attachment.
From: orderconfirmation@ esab .co.uk
Date: 15 August 2016 at 10:37
Subject: Order Confirmation-7069-2714739-20160815-292650 ...

Attached is a file with a name similar to Order_Confirmation-7069-2714739-20160815-292650.docm which contains a malicious macro. There are various versions, which according to my source (thank you) download a component...
The payload is Locky ransomware with a very low detection rate* at present. It phones home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
138.201.56.190/php/upload.php (Hetzner, Germany)
46.148.26.77/php/upload.php (Infium UAB, Ukraine)
The MWTV block is -all- bad. Recommended blocklist:
185.129.148.0/24
138.201.56.190
46.148.26.77 "
* https://www.virustotal.com/en/file/...d8150d649a08e42ea2c476b6a33203e21c5/analysis/
File name: ferdoxs.exe
Detection ratio: 1/55

138.201.56.190: https://www.virustotal.com/en/ip-address/138.201.56.190/information/
>> https://www.virustotal.com/en/url/4...6c3bf9065c33b535268848b4c76d130c05b/analysis/
46.148.26.77: https://www.virustotal.com/en/ip-address/46.148.26.77/information/
>> https://www.virustotal.com/en/url/b...d29d64a12460cf05f11465947525f0cd79a/analysis/

- https://myonlinesecurity.co.uk/orde...-474623-esab-co-uk-leads-to-locky-ransomware/
15 Aug 2016 - "An email with the subject of 'Order Confirmation-9355-8379094-20160815-474623' pretending to come from orderconfirmation@ esab .co.uk with a malicious word doc attachment downloads Locky ransomware...
The email looks like:
From: orderconfirmation@ esab .co.uk
Date: Mon 15/08/2016 10:33
Subject: Order Confirmation-9355-8379094-20160815-474623
Attachment: Order Confirmation-9355-8379094-20160815-474623.docm ...

15 August 2016: Order Confirmation-9355-8379094-20160815-474623.docm - Current Virus total detections 7/56*
There are several different versions of this Locky downloader which all download an encrypted data file that is transformed by the macro to the same Locky Ransomware (virustotal 4/54*)..."
* https://www.virustotal.com/en/file/...e693df051d5b16c69c97f197/analysis/1471258818/

** https://www.virustotal.com/en/file/...d8150d649a08e42ea2c476b6a33203e21c5/analysis/
___

Fake from 'Emma Critchley' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-emma-critchley.html
15 Aug 2016 - "This -fake- financial spam has a malicious attachment. It does -not- come from Advantage Finance but is instead a simple forgery.
Subject: Emailing - 9104896607509
From: Emma Critchley (emmacritchley@ advantage-finance .co.uk)
Date: Monday, 15 August 2016, 13:28
Hi
Vicky has asked me to forward you the finance documents (Please see attached)
Many Thanks

Attached is a DOCM file with a name that matches the subject. There are various versions, all of which download Locky ransomware... This phones home to the same servers as mentioned in this post*."
* http://blog.dynamoo.com/2016/08/malware-spam-orderconfirmationesabcouk.html
___

Fake 'Documents' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-jen-jenpurple-officecom.html
15 Aug 2016 - "These -fake- financial documents have a malicious attachment:
From: Jen [Jen@ purple-office .com]
Date: 15 August 2016 at 14:10
Subject: Documents from Purple Office - IN00003993
Please find attached invoice/credit from Purple Office.
Best regards,
Purple Office

Attached is a randomly-named DOCM file which is almost definitely a variant of Locky ransomware as seen here[1] and here[2]."
1] http://blog.dynamoo.com/2016/08/malware-spam-emma-critchley.html

2] http://blog.dynamoo.com/2016/08/malware-spam-orderconfirmationesabcouk.html

- https://myonlinesecurity.co.uk/documents-from-purple-office-malspam-delivers-locky-ransomware/
15 Aug 2016
> https://malwr.com/analysis/M2RhNDAxZGI1ZTNhNDNkMmIxMTRhZGFiOGMwNWViNzI/
Hosts
80.150.6.138: https://www.virustotal.com/en/ip-address/80.150.6.138/information/
>> https://www.virustotal.com/en/url/2...e51992f4a6f67bd8e466e1b3916d65d79d7/analysis/

:fear::fear: :mad:
 
Last edited:
Fake 'Scan/Document/Receipt' SPAM, ITunes Phish

FYI...

Fake 'Scan/Document/Receipt' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/gene...-own-email-address-delivers-locky-ransomware/
16 Aug 2016 - "Today’s first Locky ransomware example is a blank/empty email with the subject saying something like 'File: Scan(86)' or 'Emailing: Document(2)' or 'Emailing: Receipt(8)' [random numbered] or other similar generic subjects pretending to come from random names at your own email domain with a zip attachment containing a random numbered WSF (script file) which downloads an encrypted Locky ransomware version that gets converted by the script file to a fully working .exe... One of the emails looks like:
From: Random names at your own email domain or company
Date: Tue 16/08/2016 10:11
Subject: File: Scan(86)
Attachment: Scan(86).zip

Body content: Totally blank/empty

16 August 2016: Scan(86): Extracts to: 572310451803.wsf - Current Virus total detections 3/56*
.. MALWR** shows a download of an encrypted file from one of these 3 locations (there will be multiple others) that is transformed by the script to eaoJlwhPcR.exe (random depending on the version you get) (VirusTotal 3/56***)
http ://zarexbytonia.cba .pl/nJHbj0266b?coHDErXiOn=ldRhoj
http ://fereastrazmeilor .go.ro/nJHbj0266b?coHDErXiOn=ldRhoj
http ://www .lefaos.50webs .com/nJHbj0266b?coHDErXiOn=ldRhoj
... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...228469bac592314937550274/analysis/1471338738/

** https://malwr.com/analysis/ODAyODBjM2YxMzYxNGQ3MGJhMGIyZWFmYjJhYmJiNTA/
Hosts
192.151.153.26
81.196.20.134
95.211.144.65

*** https://www.virustotal.com/en/file/...8b6b4e5775e4aa2e21e7aafb/analysis/1471340178/
___

ITunes Phish
- https://myonlinesecurity.co.uk/apple-itunes-phishing-copilot-premium-hd/
16 Aug 2016 - "The latest Apple/ITunes phish pretends to be confirmation of an ITunes order for CoPilot premium HD.

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/Apple_phish_copilot-1024x654.png

The links go to
http ://monthlyincomeformula .com/.GB/db/ where you are -redirected- to
http ://missclaudia .net/.GB/apple-store-refund/appsrefund/ and see a page looking like this, where -if- you fill in the ID and password then asks for all other financial information:
> https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/App_store_refund_request-1024x555.png "

monthlyincomeformula .com: 162.144.84.124: https://www.virustotal.com/en/ip-address/162.144.84.124/information/

missclaudia .net: 174.136.50.43: https://www.virustotal.com/en/ip-address/174.136.50.43/information/

:fear::fear: :mad:
 
Last edited:
Cerber ransomware, Twitter SCAM

FYI...

Cerber ransomware ...
- https://www.helpnetsecurity.com/2016/08/17/inner-workings-cerber-ransomware-campaign/
Aug 17, 2016 - "Check Point’s research team has analysed the inner workings of Cerber, the world’s biggest ransomware-as-a-service scheme:
> https://www.helpnetsecurity.com/images/posts/checkpoint-cerber2.jpg
... Cerber is set up to enable non-technical criminals to take part in the highly profitable business and run independent campaigns, using a set of command and control servers and an easy-to-use control interface available in 12 different languages... The Bitcoin is transferred to the malware developer and affiliates by flowing through thousands of Bitcoin wallets, making it almost impossible to trace individual payments... The overall profit made by Cerber in July was $195,000. The malware developer received approximately $78,000 and the rest was split between the affiliates, based on successful infections and ransom payments for each campaign. On a yearly basis, the estimated monthly profit for the ransomware author would be $946,000. 'This research provides a rare look at the nature and global targets of the growing ransomware-as-a-service industry' said Maya Horowitz, group manager, Research & Development, Check Point*. 'Cyber-attacks are no longer the sole essence of nation-state actors and of those with the technical ability to author their own tools; nowadays, they are offered to anyone and can be operated fairly easily. As a result, this industry is growing extensively, and we should all take the proper precautions and deploy relevant protections'.”
* http://blog.checkpoint.com/2016/08/16/cerberring/
"... researchers have managed to break the encryption of Cerber and provide a free decryption tool**..."
** https://www.cerberdecrypt.com/RansomwareDecryptionTool/

Exploit Kit Country Distribution Map: https://blog.checkpoint.com/wp-content/uploads/2016/08/Figure9.jpg
___

'Bogus blue verified checkmark' SCAM - on Twitter
- https://www.hotforsecurity.com/blog/beware-bogus-blue-verified-checkmark-scams-on-twitter-16373.html
Aug 17, 2016 - "... Take, for instance, this -scam- which was being played out on Twitter last week:
> https://www.hotforsecurity.com/wp-content/uploads/2016/08/twitter-verification-scam-tweet.jpeg
If you saw it in your Twitter timeline, you might very well click on the link without thinking – imagining that the account is run by Twitter. After all, it is displaying the same avatar as the one used by the legitimate @verified account. And clicking on the link *does* take you to a website which – at first glance – might look like a genuine Twitter property to those -lacking- in caution:
> https://www.hotforsecurity.com/wp-content/uploads/2016/08/twitter-verified-scam-site.jpeg
Clicking further, however, takes you to a form which should instantly set your alarm bells ringing. It asks you to enter information such as your email address and your number of followers (both pieces of information that Twitter should -already- know) as well as your username and password:
> https://www.hotforsecurity.com/wp-content/uploads/2016/08/twitter-verified-scam-site-2.jpeg
Once you fill your details in this form, they are instantly transmitted to the hackers – who can then use your credentials to hijack your account for the purposes of spam or spreading malicious links. Furthermore, if you have made the mistake of reusing your Twitter password elsewhere on the net there is a good chance that you may have other online accounts compromised by the hackers in follow-up attacks. I reported the phishing URL to Google, and I’m pleased to report that it is now being blocked by most browsers:
> https://www.hotforsecurity.com/wp-content/uploads/2016/08/chrome-block.jpeg
The offending Twitter account has also been suspended. There are a few lessons here...
Firstly, always be careful about where you enter your login credentials. Make sure that you are on the proper website by examining-the-URL-closely, and consider that one of the benefits of running a good password manager is that it will not let you easily fill in your password unless it recognises it.
Secondly, never-reuse-passwords on multiple websites. If one site gets hacked, online criminals will often try to use the same credentials to unlock your other online accounts.
Thirdly, harden your defences. Where available (as it is on Twitter) enable two-step verification or two-factor authentication to provide an additional layer of defence for your accounts. With 2SV or 2FA in place, hackers will need more than your password to break into your accounts making it – in most cases – something that they’ll simply not bother with, as they move to find softer targets."

:fear::fear: :mad:
 
Last edited:
Fake 'UPS' SPAM, Locky Ransomware via DOCM attachments

FYI...

Fake 'UPS' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/08/malware-spam-office-printer-is-having.html
18 Aug 2016 - "This -fake- UPS email has a malicious attachment. It appears to come from various countries UPS domains (e.g. ups.de, ups.co.uk), and from various senders.
From "Laurence lumb" [Laurence.lumb25@ ups .de]
Date Thu, 18 Aug 2016 17:35:21 +0530
Subject Emailing: Label
Good afternoon
The office printer is having problems so I've had to email the UPS label,
sorry for the inconvenience.
Cheers
Laurence lumb

Attached is a ZIP file with a name beginning "Label" plus a random number. This contains a malicious .WSF script file that downloads Locky ransomware... (according to my trusted source)... This dropped binary has a detection rate of 6/54*. It phones home to the following locations:
185.129.148.19/php/upload.php (MWTV, Latvia)
51.255.107.8/php/upload.php (Webhost LLC Dmitrii Podelko, Russia / OVH, France)
194.67.210.183/php/upload.php (Marosnet, Russia)
Recommended blocklist:
185.129.148.0/24
51.255.107.8
194.67.210.183 "
* https://www.virustotal.com/en/file/...027a78692c7ebbeea56337d529165f7e84e/analysis/
___

Locky Ransomware via DOCM attachments - latest Email campaigns
- https://www.fireeye.com/blog/threat-research/2016/08/locky_ransomwaredis.html
Aug 17, 2016 - "Throughout August, FireEye Labs has observed a few massive email campaigns distributing Locky ransomware. The campaigns have affected various industries, with the healthcare industry being hit the hardest based on our telemetry:
Top 10 affected industries
> https://www.fireeye.com/content/dam/fireeye-www/blog/images/Locky ransomware Rongwhachong/Fig1.png
Numerous countries are affected, with the United States, Japan, and Republic of Korea topping the list:
Top affected countries
> https://www.fireeye.com/content/dam/fireeye-www/blog/images/Locky ransomware Rongwhachong/Fig2.png
... Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August. This marks a change from the large campaigns we observed in March, where a JavaScript based downloader was generally being used to infect systems. These detection spikes and change in tactics suggest that the cybercriminals are investing more to infect systems and maximize their profits. Additionally, we have observed that the delivery of Dridex via this distribution channel seems to have stopped, or nearly so, which could explain why we are seeing the Locky uptick:
Massive DOCM related campaigns on Aug. 9, Aug. 11 and Aug. 15, 2016
> https://www.fireeye.com/content/dam/fireeye-www/blog/images/Locky ransomware Rongwhachong/Fig3.png
Our analysis showed high similarity in the macro code that was used in the Aug. 9, Aug. 11 and Aug. 15 campaigns... The volume of Locky ransomware downloaders is increasing and the tools and techniques being used in campaigns are constantly changing. In this instance, we are seeing a shift from using a JavaScript based downloader to infect victims to using the DOCM format. On top of that, cybercrime trends have shown that attackers are distributing more ransomware these days than banking trojans, as the former appears to be more lucrative. These latest campaigns are a reminder that users must be cautious when it comes to opening attachments in emails or they run the risk of becoming infected and possibly disrupting business operations."

:fear::fear: :mad:
 
Last edited:
Fake 'Payment Receipt', 'Report' SPAM

FYI...

Fake 'Payment Receipt' SPAM - leads to locky
- https://myonlinesecurity.co.uk/atta...ur-payment-receipt-leads-to-locky-ransomware/
19 Aug 2016 - "... a long line of generic emails delivering Locky ransomware is an email with the subject of 'Payment Receipt' pretending to come from random companies and email addresses with a malicious word doc attachment... One of the emails looks like:
From: Payment Receipt
Date: Fri 19/08/2016 10:43
Subject: Payment Receipt
Attachment: PaymentReceipt.docm
Attached is the copy of your payment receipt.

19 August 2016: PaymentReceipt.docm - Current Virus total detections 7/55*.. MALWR shows a download of an encrypted file from http ://wzukoees.homepage.t-online .de/897fyDnv which is converted by the malicious macro in the word doc to C:\DOCUME~1\User\LOCALS~1\Temp\sys48.tmp (VirusTotal 4/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...b3f35df65fb4d43d0e347d8b/analysis/1471600737/

** https://www.virustotal.com/en/file/...6319781622c2c80196afba6b/analysis/1471600926/

t-online .de: 2003:2:4:164:217:6:164:162
2003:2:2:40:62:153:159:92
217.6.164.162: https://www.virustotal.com/en/ip-address/217.6.164.162/information/
62.153.159.92: https://www.virustotal.com/en/ip-address/62.153.159.92/information/
___

Fake 'Report' SPAM - leads to Java Adwind Trojan
- https://myonlinesecurity.co.uk/unclaimed-commission-report-wubs-malspam-delivers-java-adwind/
19 Aug 2016 - "We continue to see Java Adwind Trojans daily. Today’s example is a slight change to the delivery method from previous Malspam emails that have been using Moneyexpress .com or MoneyGram or other middle eastern money exchange bodies. This one is an email with the subject of 'Unclaimed Commission Report-WUBS' pretending to come from Shiella F. Doria <shiella.doria@ westernunion .com> with a zip attachment which contains a Java.jar file & an image to make it look “respectable” and genuine. We have seen various -spoofed- Western Union malspam...

Screenshot: https://myonlinesecurity.co.uk/wp-c...Unclaimed-Commission-Report-WUBS-1024x646.png

The image from inside the zip is:
- https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/Amendment-Sheet.jpeg

19 August 2016: Unclaimed Commission Report.zip - Extracts to: UN-PROCESSED COMMISSION.jar
Current Virus total detections 30/56*. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...50f1b67ff086ecce861ab36e/analysis/1471508188/
___

Ransomware round up
- https://atlas.arbor.net/briefs/index#-198932443
Aug 18, 2016 - "... Analysis: ... ransomware developers and infrastructure providers who deliver the packages are continuing to refine their crafts. The addition of a RAT used to target potential banking elements instead of going forward with ransomware -extortion- is a smart addition. Most threat actors behind ransomware tend to utilize one flat ransom across their victim pool. However, some, notably those behind Locky, have paid attention to some of their victims and were able to extort larger sums than the original request once they identified the overall value of the victimized systems. A RAT could allow a smart threat actor to better access their target and move forward with requesting larger sums of money. However, it could simply allow threat actors to leverage more traditional capabilities by capturing banking credentials which in turn could allow them to perform fraudulent withdrawals with potentially larger payouts than had they attempted simple extortion efforts. Nemucod and Locky continue to change their overall operating procedures. The addition of ad-click and backdoor functionality to a ransomware operation can lead to additional revenue streams for threat actors, especially if the ransomware does not impact the -additional- malicious packages, allowing for them to operate unencumbered while the victim decides what course of action to take in response to the ransomware. Most ransomware is best defended against by -never- enabling-macros unless you implicitly trust the source... and maintaining up-to-date backups that are stored offline..."

:fear::fear: :mad:
 
Last edited:
Fake 'fax', 'Hello' SPAM

FYI...

Fake 'fax' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/todays-fax-malspam-word-macros-leads-to-locky-ransomware/
22 Aug 2016 - "... first example of malspam word docs with macros delivering Locky ransomware is an email with the subject of 'Today’s fax' pretending to come from random names at your own email domain... The email looks like:
From: name/number at your own email domain
Date: Mon 22/08/2016 10:37
Subject: Today’s fax
Attachment: FAX_5542.DOCM

Body content: Totally blank/empty

22 August 2016: FAX_5542.DOCM - Current Virus total detections 4/55*.. MALWR** shows a download of an encrypted file from http ://seiwa1202.web. fc2.com/HfgfvhTR5 that is converted by the malicious macro in the word doc to axilans.exe (VirusTotal 4/55***). Payload Security[4] shows this has anti-analysis protection... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...d9c3ed07477843cda37d038c/analysis/1471858624/

** https://malwr.com/analysis/MGQ0YjVmOGMzNDdlNGJiNTlmMDcxODRjMTY1N2ZlOGQ/
Hosts
208.71.106.61: https://www.virustotal.com/en/ip-address/208.71.106.61/information/
>> https://www.virustotal.com/en/url/0...89ee81af1c16ae7ad10c745d2cd25932839/analysis/

*** https://www.virustotal.com/en/file/...517543c9458aeeadad527891/analysis/1471859596/

4] https://www.hybrid-analysis.com/sam...410517543c9458aeeadad527891?environmentId=100
___

Fake 'Hello' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/hi-hi-there-hello-malspam-delivers-locky-ransomware/
22 Aug 2016 - "... next batch of malspam emails delivering locky ransomware is a series of emails with subjects like “Hi”, “Hi There” or “Hello” coming from random names, companies and email addresses with a zip attachment containing a WSF (Windows Scripting File)... The body has various generic phrases as the contents along the lines of:
“Please see the attached report about the monthly progress of our department”
“I am sending you the bills of the goods we delivered to you in the attachment"

22 August 2016: 5772ac1553.zip: Extracts to: export_pdf_ 2c23a43a~.js - Current Virus total detections 2/56*
.. MALWR was unable to get any content from the heavily encoded WSF file (waiting for other analysis but almost certain to be the same locations as Today’s Word version Malware delivery[1]). Payload Security** shows a load of connections to various sites... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...32b86612b115f29dd3565796/analysis/1471860907/

** https://www.hybrid-analysis.com/sam...aec32b86612b115f29dd3565796?environmentId=100
Contacted Hosts
213.217.149.4
213.229.74.92
185.129.148.19
185.51.247.211
194.67.210.183
51.254.55.171
91.201.202.125

1] https://myonlinesecurity.co.uk/todays-fax-malspam-word-macros-leads-to-locky-ransomware/

:fear::fear: :mad:
 
Last edited:
Fake 'Voice Message Notifications' SPAM, Browser hijackers, Email battleground

FYI...

Fake 'Voice Message Notifications' deliver Ransomware
- https://isc.sans.edu/diary.html?storyid=21397
2016-08-23 - "... a phone number and with modern communication channels ("Unified Communications") like Microsoft Lync or Cisco, everybody can receive a mail with a 'voice mail notification'. Even residential systems can deliver voice message notifications. Here is an example displayed in Microsoft Outlook:
> https://isc.sans.edu/diaryimages/images/microsoft-voice-msg.gif
Today, I received a wave of emails like the following:
From: voicemail@ rootshell .be
To: [redacted]
Subject: [Vigor2820 Series] New voice mail message from 01422520472 on 2016/08/23 15:55:25
Dear [redacted]:
There is a message for you from 01422520472, on 2016/08/23 15:55:25 .
You might want to check it when you get a chance. Thanks!

The sender is spoofed with the victim domain name.... file was attached to the message... '.wav.zip' extension to lure the user. As usual, the payload is heavily obfuscated and the AV detection ratio is still very low (6/55 at 11:55:00 UTC)[1]. Vigor is UK company building ADSL residential modems[2]. This tends to think that the new wave is targeting residential customers. Here are the C2 servers (for your IDS):
89.42.39.81
213.205.40.169
51.254.55.171
194.67.210.183
185.51.247.211
185.129.148.19
91.201.202.125 "

[1] https://www.virustotal.com/en/file/...52813e06b2ef391fa6f26b2a/analysis/1471949327/
File name: 614007286106.wsf
Detection ratio: 6/55

[2] http://www.draytek.co.uk/products/legacy/vigor-2820
___

More Fake 'voice mail messages' SPAM - delivers Locky/Zepto
- https://myonlinesecurity.co.uk/vigo...60823-210159-delivers-locky-zepto-ransomware/
23 Aug 2016 - "Today’s Locky/Zepto ransomware malspam emails have come steadily in waves all day long. There have been 2 distinct different subjects and themes, one pretending to be a voice message from your own email domain or company, with the second pretending to be an audit report from a random company. The first is an email with the subject of '[Vigor2820 Series] New voice mail message' from 01443281097 on 2016/08/23 21:01:59 [random telephone number and date/time] pretending to come from voicemail @ your own email address with a zip attachment named something like 'Message_from_01443281097.wav.zip' where the attachment number matches the telephone number in the subject line. The Vigor 2820 Series is an older ADSL Router Firewall aimed at small business users, so we can quite easily see that this campaign of malware spreading is directly aimed at the small business user...

Screenshot: https://myonlinesecurity.co.uk/wp-c...ce-mail-message-from-01443281097-1024x426.png

The second campaign has a subject of 'Audit Report' coming from random senders with a content looking like the below. The name in the body of the email matches the spoofed sender. One of the emails looks like:
From: Omer Scott <Scott.58115@ bambit .de>
Date: Tue 23/08/2016 15:3
Subject: Audit Report
Attachment: 83543cd11db.zip
Dear lie
The audit report you inquired is attached in the mail. Please review and transfer it to the related department.
King regards,
Omer Scott

23 August 2016: Message_from_01443281097.wav.zip: Extracts to: 44077640409.wsf
Current Virus total detections 23/56*.. MALWR** shows a download of an encrypted file from either
http ://danzig.vtrbandaancha .net/HJghjb54?PqzwogvtP=xYWWDkr -or-
http ://backyard004.web. fc2.com/HJghjb54?PqzwogvtP=xYWWDkr (in this example) which gets converted by the script to wKoYWwOtQ.exe (VirusTotal 6/56***)

23 August 2016: 83543cd11db.zip: Extracts to: audit report 316dd5a1.js
Current Virus total detections 23/56[4].. MALWR[5] shows a download of an encrypted file from either
http ://sb-11856.fastdl-server .biz/688dak3, http ://newt150.tripod .com/idyeb9 -or-
http ://dl.sevenseals .ru/ehaq1zw (in this example) which gets converted by the script to NCPcpOkuUfr5AA0.dll (VirusTotal 18/56[6])... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...7d7281a162181c8b430078d1/analysis/1441173827/

** https://malwr.com/analysis/NjhlMjZkY2ZmNGUwNDE4MDg4N2YwMDVhZmE2NTcxZGM/
Hosts
200.83.4.62
185.129.148.19
208.71.106.40

*** https://www.virustotal.com/en/file/...64adbd4face3efa3e1260a0a/analysis/1471961322/

4] https://www.virustotal.com/en/file/...7d7281a162181c8b430078d1/analysis/1441173827/

5] https://malwr.com/analysis/YjFiYzVkM2E0MjI5NDcwMWE5YzQ4MmNkNzA3MjA4NzM/
Hosts
109.230.252.172
52.52.39.236
77.221.140.226

6] https://www.virustotal.com/en/file/...cdcb73d3c004094cc47cd2c2/analysis/1471962605/
___

Fake 'Cancellation' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/atta...dit-card-malspam-delivering-locky-ransomware/
23 Aug 2016 - "The next in the series of today’s Locky downloaders is an email with the subject of 'Cancellation' pretending to come from random senders with a zip attachment containing a JavaScript file that pretends to be a pdf... One of the emails looks like:
From: Zachary Flynn <Flynn.94@ football-stats .org>
Date: Tue 23/08/2016 19:00
Subject: Cancellation
Attachment: 2c122b8fa354.zip
Dear rob,
Attached is the paper concerning with the cancellation of your current credit card.
Confirm to us for receiving.
King regards,
Zachary Flynn
Account Manager ...

23 August 2016: 2c122b8fa354.zip: Extracts to: card_cancellation_pdf 5a59aad3.js
Current Virus total detections 4/56*.. MALWR** shows a download of an encrypted file from one of these locations
http ://sopranolady7 .wang/1cntwk5 | http ://www.leuchten-modelle .de/ink36
http ://download.apf .asso .fr/87aktsv | http ://gromasgboleslawiec .cba .pl/09n7n
... that is decrypted and transformed into P6dtp6pov8qB.dll (VirusTotal 6/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...46037261683a49b485f8004a/analysis/1471975535/

** https://malwr.com/analysis/NDkyZGYyNTllNTY5NGFkN2E3YTM3MzU0YTkzZTYyMTU/
Hosts
95.211.144.65
212.18.0.4
91.223.89.200
195.154.81.86

*** https://www.virustotal.com/en/file/...60c221eb0a45ed5d1f6cf94f/analysis/1471977294/
___

File-in-the-middle Browser hijackers
- https://blog.malwarebytes.com/cybercrime/2016/08/file-in-the-middle-hijackers/
Aug 23, 2016 - "We are not sure if this is going to be a new trend among browser-hijackers, but it seems more than a coincidence that we found -two- browser hijackers using a very similar approach to reach their goal of taking victims to the sites of their choice. Both are using one of their own files to act as a file-in-the-middle between the user and the browser... Dotdo Audio: Dotdo is a strain of hijackers that we have discussed before for using different and more “out of bounds” methods to get the job done. I named this variant “audio” because it uses audio advertisements. But that is not our focus here. It’s the replacement of browser executables with their own that raised our interest. The installer -renames- the files firefox.exe and chrome.exe, if present, and adds a number to the filename. It then hides these renamed files and replaces them with its own files:
> https://blog.malwarebytes.com/wp-content/uploads/2016/08/hiddenexe.png
The screenshot above shows you the hidden and renamed Chrome file, in the same folder as the replacement. I changed the settings for hidden files so that we can see them. In a similar screenshot below we can see that the same was done for Firefox:
> https://blog.malwarebytes.com/wp-content/uploads/2016/08/hiddenexe2.png
The browsers are -hijacked- to open with traffic-media[dot]co by altering the browser shortcuts for:
Chrome
Firefox
Internet Explorer
Opera
Yandex
... Summary: We discussed two hijackers from very different families and using different methods, but they also had a few things in common. They want the victims to hear/see their advertisements and they used a file-in-the-middle between the browser shortcuts and the actual browser in order to alter the browsers behavior to meet their goals..."

traffic-media[dot]co: 195.154.46.150: https://www.virustotal.com/en/ip-address/195.154.46.150/information/
>> https://www.virustotal.com/en/url/d...c201e4bfe331a452973c1cc448c3d928854/analysis/
___

Email - Security battleground
- http://blog.trendmicro.com/trendlab...compromise-bec-lead-year-of-online-extortion/
Aug 23, 2016 - "Emails have become the battleground for the first half of the year in terms of security. It is the number one infection vector that have ushered in 2016’s biggest threats so far — ransomware and business email compromise (BEC). Ransomware infections normally start via email. Based on our findings, -71%- of the known ransomware families’ delivery method is through spam. Looking at the threat trends so far, both ransomware and BEC have proved profitable across the world:
Regional breakdown by volume of ransomware threats:
> https://blog.trendmicro.com/trendla...ce/files/2016/08/figure01a-20161h-roundup.jpg
Regional breakdown by volume of organizations affected by BEC scams:
> https://blog.trendmicro.com/trendla...ce/files/2016/08/figure02a-20161h-roundup.jpg
Our telemetry shows that ransomware’s scope is more widespread than BEC as it targets countries in Europe, Middle East, and Africa. The prevalence of BEC scams are higher in the North American region, with fewer countries but more targeted — attackers behind BEC scams most often impersonate and target C-level executives... 58% of the nearly 80 million ransomware threats Trend Micro blocked from January to June 2016 are email-borne ransomware. BEC scams, on the other hand, -all- arrive via email. These factors make the two threats quite formidable, as email remains a firm staple in everyday business. They both also utilize social engineering. In ransomware’s case, it’s for the user to click and run the ransomware attached to their opening email. For BECs, it’s to trick the targeted officer into thinking that their request for a money transfer is legitimate, without the usual malware payload... Knowing that these threats use email as an attack vector, companies should strengthen employee education and invest smartly in email protection. With these, the threat of ransomware and BEC attacks can be greatly reduced..."

:fear::fear: :mad:
 
Last edited:
Fake 'Statement', 'Emailing: Image' SPAM

FYI...

Fake 'Statement' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/the-...he-email-malspam-delivering-locky-ransomware/
24 Aug 2016 - "This morning’s first Locky ransomware delivering malspam is an email with the subject of 'Statement' coming from random senders, companies and email addresses with a random named zip attachment containing a JavaScript file that pretends to be a financial statement... One of the emails looks like:
From: Ella Gonzales <Gonzales.169@ airtelbroadband .in>
Date: Wed 24/08/2016 10:34
Subject: Statement
Attachment: 25b8ae3a4d.zip
Hi,
The monthly financial statement is attached within the email.
Please review it before processing.
King regards,
Ella Gonzales ...

24 August 2016: 25b8ae3a4d.zip: Extracts to: monthly_financial_scan aa9140e0.js
Current Virus total detections 2/56*.. MALWR** shows a download of an encrypted file from one of these locations:
http ://rejoincomp2 .in/117uuf5h | http ://dokcool.atspace .org/jltqouz
http ://smilehomeutsumi504.web. fc2.com/by11k6r ... that is converted by the JavaScript to o2OoILn8OHU.dll and autorun (VirusTotal 6/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...3ecdf24163fe53aed6da913d/analysis/1472031010/

** https://malwr.com/analysis/YmNjYjUxNWNjZTE4NGI0ZTk5MGYzNWFkNDQxNDgwYmE/
Hosts
82.197.131.109
208.71.106.49
213.229.74.92

*** https://www.virustotal.com/en/file/...46b22f5b89b9da6ab38a4721/analysis/1472033919/
___

Fake 'Emailing: Image' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/emai...am-using-hta-files-delivers-locky-ransomware/
24 Aug 2016 - "A blank email with the subject of 'Emailing: Image15.jpg' [random numbered] pretending to come from random senders at your own email domain or company with a zip attachment containing an encrypted HTA file... This set of emails has a zip attachment that extracts to a HTA file... One of the emails looks like:
From: Raymon <Raymon237@ Your email domain >
Date: Wed 24/08/2016 12:04
Subject: Emailing: Image15.jpg
Attachment: Image15.zip

Body content: Totally blank/Empty

24 August 2016: Image15.zip: Extracts to: 100966743304.hta - Current Virus total detections 2/56*
.. Payload Security** shows a download of the usual Locky encrypted file from a list of embedded URLs in the decrypted HTA/JavaScript file which is converted to xUztoLUte.exe by the instructions inside the HTA/JavaScript (VirusTotal 2/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustotal.com/en/file/...1fa62056e3941117c48fb727/analysis/1472036751/

** https://www.hybrid-analysis.com/sam...3491fa62056e3941117c48fb727?environmentId=100
Contacted Hosts
112.140.42.29
213.205.40.169
200.83.4.62
185.129.148.19
51.254.55.171
185.51.247.211
194.67.210.183
91.226.92.208

*** https://www.virustotal.com/en/file/...57fba332a17cebc775678f1b/analysis/1472037488/

:fear::fear: :mad:
 
Last edited:
Fake 'Fraud Notice' SPAM, BEC scams and ransomware

FYI...

Fake 'Fraud Notice' SPAM - Java Adwind Trojans
- https://myonlinesecurity.co.uk/java-adwind-embedded-in-word-doc-xpress-money/
25 Aug 2016 - "... Java Adwind Trojans being delivered by various financial themed emails, we are seeing a new method of distribution of the Java Adwind Trojan using these financial themed emails with the subject of 'Request for Amendment'-XPIN- 2401200221508974 & 2401240241500561 (11) pretending to come from xm.support@ xpressmoney .com <XM SUPPORT> with a word doc attachment that contains the Java Adwind Trojan as an embedded OLE object... One of the emails looks like:
From: xm.support@ xpressmoney .com <XM SUPPORT>
Date: Request for Amendment-XPIN- 2401200221508974 & 2401240241500561 (11)
Subject: Request for Amendment-XPIN- 2401200221508974 & 2401240241500561 (11)
Attachment: Fraud Notice XM.doc
Dear Sir/Madam,
We would like to inform you that the transaction mentioned have been flagged from our system although the Xpress Money account is still under review. Please cancel and amend these transactions from your system at the earliest. Details of Transactions is been attached
Thanks & Warm Regards,
Prasanth Vasanth Pai
Specialist Customer Support
Xpress Money Services Ltd.
PO Box 170, Abu Dhabi, UAE ...

Screenshot of attached word doc: https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/Fraud-Notice-XM_doc-1024x419.png

25 August 2016: Fraud Notice XM.doc - Current Virus total detections 23/56*. MALWR**
If you are unwise enough to double click the alleged pdf files that are -embedded- inside the word doc, then a JAVA.jar – Jacob.jar file will open & run (VirusTotal 23/56***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...30da048762670c74809e38ad/analysis/1472103111/

** https://malwr.com/analysis/ODIwOWYzYzQ3ZWEzNGFhZDgyMDYxYzVkMjc1YzJlYTQ/

*** https://www.virustotal.com/en/file/...4430ef8492a748e327d07ccc/analysis/1472103307/

Earlier 'Java Adwind' posts: https://myonlinesecurity.co.uk/?s=Java+Adwind
___

BEC scams and ransomware
- https://www.helpnetsecurity.com/2016/08/25/evolution-ransomware-bec-scams/
Aug 25, 2016 - "Trend Micro analyzed the trends in attacks and vulnerabilities seen throughout the first half of this year*, and found a rise and impact of attacks, such as a -172- percent increase in ransomware and $3 billion in losses due to business email compromise (BEC) scams so far in 2016..."
(More detail at the URL above.)
Charted: https://www.helpnetsecurity.com/images/posts/trendmicro-08-ransomware1.jpg
* http://blog.trendmicro.com/trendlab...compromise-bec-lead-year-of-online-extortion/
Aug 23, 2016 - "... Based on our findings, 71% of the known ransomware families’ delivery method is through spam..."
* https://www.trendmicro.com/vinfo/us/security/research-and-analysis/threat-reports/roundup
Aug 23, 2016 - "... The number of new ransomware families we saw in the first half of 2016 alone has already eclipsed the total 2015 volume by 172%. With ransomware attacks becoming more and more sophisticated and prevalent, we believe that the threat will potentially cause more damage going into the second half of the year..."
___

Tech support scams and Google Chrome tricks
- https://blog.malwarebytes.com/cyber.../tech-support-scams-and-google-chrome-tricks/
Aug 25, 2016 - "Tech support scams coming as phishing pages that contain -fake- alerts urging you to call for immediate assistance are common place these days. We collect -hundreds- of such URLs each day and have observed countless tricks to fool users... for years we have been telling people to double check the URL in the address bar to know if a website is really what it claims to be. When this scam page loads it runs in full-screen mode and prevents the user from easily closing it with an infinite loop of alerts.
Now take a look at the address bar. For all intents and purposes it does look like the legitimate Microsoft website, although the ‘ru-ru’ (Russia) portion of the URL is a fail in an otherwise clever design. (There are other bits of Russian here and there in the source code, which perhaps link to the original author?):
> https://blog.malwarebytes.com/wp-content/uploads/2016/08/scam.png
... Tech support -scams- have similar alert windows except we found some that are completely made up. Putting a checkmark and clicking OK actually produces the opposite result of what you’d expect, to keep you more frustrated and ready to throw your computer out the window... It’s safe to say that browser-based tech support scams are not going anywhere any time soon. Sadly, most browsers are brought to their knees with simple bits of JavaScript and non savvy users will simply give up and call the toll free number for assistance (we forgot to mention that all this while a very annoying audio track plays in the background). Call centres located in India (for the most part) are receiving thousands of calls each day from desperate victims prime to be -defrauded- of hundreds of dollars by rogue operators playing the Microsoft technician game. Spotting those scams isn’t always easy though and that is why it’s important to expose them to show their inner workings. To learn more about tech support scams and consult our blacklist of known offenders, please check out our resource page here*."
* https://blog.malwarebytes.com/threats/tech-support-scams/

:fear::fear: :mad:
 
Last edited:
Fake 'Voice Message', 'P.O.', 'monthly report' SPAM

FYI...

Fake 'Voice Message' SPAM - delivers Locky/Zepto
- https://myonlinesecurity.co.uk/voic...er-3m-54s-peach-telecom-delivers-locky-zepto/
26 Aug 2016 - "An email with the subject of 'Voice Message from Outside Caller (3m 54s) [random length]' pretending to come from Peach Telecom <peach_necsv06@ hotmail .com> (random number after peach_necsv) with a zip attachment which downloads Locky/Zepto ransomware... One of the emails looks like:
From: Peach Telecom <peach_necsv06@ hotmail .com>
Date: Fri 26/08/2016 12:21
Subject: Voice Message from Outside Caller (3m 54s)
Attachment: Outside Caller 08-26-2016 9aaf18b.zip
Voice Message Arrived on Friday, Aug 26 @ 6:26 AM
Name: Outside Caller
Number: Unavailable
Duration: 3m 54s ...

26 August 2016: Outside Caller 08-26-2016 9aaf18b.zip: Extracts to: 08-26-2016 36ptor06.wsf
Current Virus total detections 9/56*.. MALWR** shows a download of an encrypted file from one of these locations:
http ://sewarte.homepage. t-online .de/nb20gjBV?xJNXYWEr=xnGdqHz |
http ://theramom.web. fc2 .com/nb20gjBV?xJNXYWEr=xnGdqHz |
http ://seishinkaikenpo .com/nb20gjBV?xJNXYWEr=xnGdqHz
which is transformed by the script to LHOyUOaiiss1.dll (VirusTotal ***). All versions send info back to the control centre at http ://51.254.55.171/data/info.php ...
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...58899a30d9f6c5083e273ae0/analysis/1472210401/

** https://malwr.com/analysis/OTY5MGRiM2UxN2QwNGIwMGFlOTllY2QwYjdlOGNhMTI/
Hosts
210.157.30.70
208.71.106.46
80.150.6.138
51.254.55.171

*** https://www.virustotal.com/en/file/...dbab22e7f1810bc0bd0f9b7a/analysis/1472214673/
___

Fake 'P.O.' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/plea...-equipment-malspam-delivers-locky-ransomware/
26 Aug 2016 - "The second batch of today’s Locky ransomware malspam emails is an email with the subject of
'office equipment' coming from random senders with a zip attachment... One of the emails looks like:
From: Jillian Kirby <Kirby.84@ phantomes .com>
Date: Fri 26/08/2016 11:41
Subject: office equipment
Attachment: 609c171b94a.zip
Dear wh,
Please sign the attached purchase of the office equipment. We will send you back the receipt afterward.
Best regards,
Jillian Kirby
Sales Manager

26 August 2016: 609c171b94a.zip: Extracts to: office_equipment ~bced3628.js
Current Virus total detections 4/56*.. MALWR** shows a download of an encrypted file from one of these locations,
http ://onlybest76 .xyz/1rkyye | http ://all-rides .com/i0gih |
http :// provincialpw .com/crgrapy | http ://www.mediawareonline .it/yvg6cw |
http ://www.jansen-consultancy-machines .be/nvbd7rme that is transformed by the script to deliver AzWzM3LegeEcV6.dll (VirusTotal 14/58***). Payload Security[4].. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...2d2933766c9aa02814f9b10b/analysis/1472209948/

** https://malwr.com/analysis/NmUwMTAxYjIxYmE2NDczY2JkMWEwOWE3MDhiYmZjODA/
Hosts
195.130.132.84
104.232.35.136
160.153.54.35
173.255.129.128
212.104.43.3

*** https://www.virustotal.com/en/file/...0ad8cd3e7b7dfb3564ad47eb/analysis/1472217004/

4] https://www.hybrid-analysis.com/sam...c0d2d2933766c9aa02814f9b10b?environmentId=100
Contacted Hosts
160.153.54.35
212.104.43.3
188.127.249.203
138.201.191.196
51.254.55.171
91.226.92.208
___

Fake 'monthly report' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/ther...ast-week-malspam-delivering-locky-ransomware/
26 Aug 2016 - "The third of today’s Locky ransomware malspam deliveries is an email with the subject of 'monthly report' coming from random senders, companies and email addresses with a zip attachment... One of the emails looks like:
From: Tasha Ray <Ray.05187@ flamingjewellery .co.uk>
Date: Fri 26/08/2016 18:16
Subject: monthly report
Attachment: c1195a3663e.zip
Good evening hyperbolasmappera,
There were some errors in the monthly report you submitted last week.
See the highlights in the attachment and please fix as soon as possible.
Best regards,
Tasha Ray
Account Manager ...

28 August 2016: c1195a3663e.zip: Extracts to: monthly_report_pdf (~41e8df8a).js
Current Virus total detections 6/56*.. MALWR** shows a download of an encrypted file from one of these locations:
http ://berndburgdorf .de/5x6vdaw | http ://www.valmon .it/ndxec | http ://rejoincomp2 .in/3dv7n |
http ://abufarha .net/80d4a1j which is transformed by the script to lh7pIFrXtoRVDe.dll (VirusTotal 19/58***)...
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...d9bad758d716d01f67696881/analysis/1472235308/

** https://malwr.com/analysis/OGQ2NmJmMGI2ZGE1NDI5ZWE0MGYyYTg2NmJjMGE0ZmU/
Hosts
212.40.179.94
104.232.35.136
213.205.40.169
66.147.240.193

*** https://www.virustotal.com/en/file/...91a76d825e6608649ddbcf46/analysis/1472237184/

:fear::fear: :mad:
 
Last edited:
Fake 'Commission', 'invoice', 'mortgage documents' SPAM

FYI...

Fake 'Commission' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/here...you-earned-last-month-malspam-delivers-locky/
29 Aug 2016 - ".. the -Locky- onslaught continues its daily attacks with an email with the subject of 'Commission' coming from random companies and senders with a zip attachment that despite the message in the email body saying it is an Excel file actually contains a JavaScript file, although they have half tried to disguise it as an excel file commission_xls (~2a4bfa91).js ... One of the emails looks like:
From: Minerva Bridges <Bridges.033@ aprilwilkins .com>
Date: Mon 29/08/2016 10:20
Subject: Commission
Attachment: 9dc078a8d54e.zip
Good morning rob,
Here is the excel file of the commission you earned last month. Please analyze
the attachment to confirm the amount.
Regards,
Minerva Bridges

29 August 2016: 9dc078a8d54e.zip: Extracts to: commission_xls (~2a4bfa91).js - Current Virus total detections 4/56*
.. MALWR** shows a download of an encrypted file from one of these locations:
http ://xelagon.50webs .org/8rxv3 | http ://209.237.142.197/~p27j55uk/von90s
http ://ach-dziennik.cba .pl/kag7pe6 | http ://wangmewang .name/5tr5xeey which is transformed into a working Locky Ransomware file by the JavaScript file yzASo9ubY.dll (VirusTotal 9/58***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...6a63215fec7b6f851a8d506f/analysis/1472462471/

** https://malwr.com/analysis/YjBiMWMwMzA3ZTRlNGNhMmFhMTI2ZjMwMzNlMTk3OWI/
Hosts
192.151.153.26
213.229.74.92
95.211.144.65
209.237.142.197

*** https://www.virustotal.com/en/file/...c75633eae399c38b337d5c38/analysis/1472464805/
___

Fake 'invoice' SPAM - leads to ransomware
- https://myonlinesecurity.co.uk/plea...email-domain-delivers-locky-zepto-ransomware/
39 Aug 2016 - "... series of Locky/Zepto ransomware malspams... an email with the subject of 'Please find attached invoice no: 9087773449' [random numbered] pretending to come from document@ your own email domain with a zip attachment containing a WSF file... One of the emails looks like:
From: document@ your own email domain
Date: Mon 29/08/2016 10:21
Subject: Please find attached invoice no: 9087773449
Attachment: 03A137a21.zip
Attached is a Print Manager form.
Format = Portable Document Format File (PDF) ...

29 August 2016: 03A137a21.zip: Extracts to: sedFki.wsf - Current Virus total detections 7/56*
.. MALWR** shows a download of an encrypted file from one of these locations
http ://www.imaginarium .home.ro/78yhuinFYs?AUURTj=HtKvHtW
http ://abcbureautique.abc.perso. neuf .fr/78yhuinFYs?AUURTj=HtKvHtW
http ://dussartconsulting .com/78yhuinFYs?AUURTj=HtKvHtW ... which is transformed by the script file to atuBFcBCz1.dll and automatically run (VirusTotal 4/58***). All the versions post home to the control centre at http ://51.255.107.30 /data/info.php to get & store the encryption key used to encrypt your files... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...633be724fdc3f2854a195bad/analysis/1472462824/

** https://malwr.com/analysis/YzE2ZGI0Mjg3ZmI3NGEzYmFiMTc0MzUzZGRkYWIwYmE/
Hosts
86.65.123.70
81.196.20.133
91.216.107.228
51.255.107.30

*** https://www.virustotal.com/en/file/...ccacd0c012174604b946819b/analysis/1472465136/
___

Fake 'mortgage documents' SPAM - lead to Locky
- https://myonlinesecurity.co.uk/i-am...ng-to-your-department-malspam-delivers-locky/
29 Aug 2016 - "... Locky ransomware malspams... email with the subject of 'mortgage documents' with a zip attachment containing a WSF file... One of the emails looks like:
From: Edison Montgomery <Montgomery.25@ cable .net .co>
Date: Mon 29/08/2016 20:16
Subject: mortgage documents
Attachment:
Dear cazzo, I am attaching the mortgage documents relating to your department.
They need to be signed in urgent manner.
Regards,
Edison Montgomery

29 August 2016: 9aaea06c022a.zip: Extracts to: mortgage_documents.c40bf5a3.wsf
Current Virus total detections 5/56*.. MALWR** seems unable to analyse these and Payload Security has 150+ files in the queue...
Edit: Payload security*** eventually gave me www .qualityacoustic.comcastbiz .net/53ky07h2 which is an encrypted flle which gets transformed by the script to a Locky/Zepto file. Unfortunately Payload security does not give me that file... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...3a6ade4d12e720a40716bb00/analysis/1472498468/

** https://malwr.com/analysis/YWQ5NGUzMjI1MzFkNDc2MWIxZjcyM2JhNjMxOGY2ODQ/

*** https://www.hybrid-analysis.com/sam...5b73a6ade4d12e720a40716bb00?environmentId=100
Contacted Hosts
216.87.186.101
51.255.107.30
188.127.249.203
195.64.154.114
138.201.191.196
69.195.129.70
91.226.92.208
___

Locky downloaded as encrypted DLLs
- http://blog.trendmicro.com/trendlab...cky-ransomware-now-downloaded-encrypted-dlls/
Aug 29, 2016 - "... Locky has, over time, become known for using a wide variety of tactics to spread – including macros, VBScript, WSF files, and now DLLs... we encountered a new Locky variant (detected as RANSOM_LOCKY.F116HM) that used old tactics on the surface, but with some key technical changes. The emails that were used to distribute it were fairly pedestrian as far as these messages go, although it was part of a large-scale spam campaign:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2016/08/locky-dll-1.png
... Using a DLL file in this way represents an attempt to try and -evade- behavior monitoring features that are now part of modern endpoint security products. Running as a DLL prevents a new process from being started, making it harder to detect. Other ransomware families (like CrypMIC/CryptXXX) have used this tactic as well, although for Locky this is new. The use of encryption is also meant to strengthen this malware’s ability to hide itself. Without receiving the right parameters from the downloader, no actual malicious file is actually decrypted (and theoretically, detected)..."

:fear::fear: :mad:
 
Last edited:
Fake 'Body Blank/empty', 'Final pmnt', 'paycheck', 'Svr Update' SPAM, Opera breach

FYI...

Fake 'Body content Blank/empty' SPAM - leads to Locky
- https://myonlinesecurity.co.uk/blan...-your-own-email-address-delivers-locky-zepto/
30 Aug 2016 - "The latest of Today’s Locky/Zepto malspams is a -blank- empty email pretending to come from random names at your own email domain with the -subject- similar to 'document, File, Picture, Photo, Image' etc. with a zip attachment containing a WSF file... One of the emails looks like:
From: random name @ your own email domain
Date:
Subject: Photo
Attachment: PC_20160830_05_84_67_Pro.zip

Body content: Blank/empty

11 May 2016: PC_20160830_05_84_67_Pro.zip: Extracts to: XfTxmMOc.wsf - Current Virus total detections 8/56*
.. MALWR** shows a download of an encrypted file from
http ://gerochan.web. fc2 .com/987nkjh8?RlUTbYrVI=TMGiBgFtfwB amongst others which eventually gets transformed by the script file to XWYLtzfQg1.dll (VirusTotal 5/58***). C2 control which determines the encryption key is
http ://188.127.249.32 /data/info.php ... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5e5398b4e577f49ec036e1df/analysis/1472566396/

** https://malwr.com/analysis/YTE0NDY2OGVhODE1NGM5ZTkwYmI5ZGRlZTk2MTcwYjU/
Hosts
85.12.197.61
208.71.106.49
208.71.106.45
51.255.107.30
188.127.249.32

*** https://www.virustotal.com/en/file/...ea63ed607017127f4a785756/analysis/1472562174/
___

Fake 'Final payment' SPAM - leads to malware
- https://myonlinesecurity.co.uk/final-payment-request-fake-hmrc-demand-leads-to-malware/
30 Aug 2016 - "An email with the subject of 'Final payment request' pretending to come from angela.fynan@ hmrc.gsi .gov.uk <info@ hmrcgovuk121 .pw> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky or numerous Cryptolocker versions... The email looks like:
From: angela.fynan@ hmrc.gsi .gov.uk <info@ hmrcgovuk121 .pw>
Date: Tue 30/08/2016 15:08
Subject: Final payment request
Attachment: hmrc_doc_083016_848347734.docm
Date of issue 30 august 2016
Reference K 2058964946
Sir/Madam
Final payment request GBP 5,961.34.
Don’t ignore this letter – you need to pay us now if you want to stop us taking enforcement action against you.
We contacted you previously asking you to pay the above amount but you still haven’t done so. The attached statement of liability gives a breakdown of what you owe.
As you’re in the very small minority of people who haven’t paid. We’re treating your case as a priority. If you don’t pay now, we’ll take action to make you pay. The law allows us to enforce debts by seizing your goods and selling them by public auction A regional sheriff officer acting on a summary warrant will do this for us. We can charge fees for this so if you don’t act now it could cost you more money.
For more information and how to pay us please see attached statement.
We’ll continue to add interest to the original debt until you pay in full.
Debt Management
G McLean
HMRC ...

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/hmrc_final-payment-request-1024x562.png

30 August 2016: hmrc_doc_083016_848347734.docm - Current Virus total detections 4/55*
.. MALWR** shows a download from http ://ivanovimportexportltd. co.uk/4.exe (VirusTotal 4/57***) MALWR[4]
... likely to be a password stealer of some sort. Payload Security[5]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...0c39175c4faac128dd9fa712/analysis/1472565604/

** https://malwr.com/analysis/ZmE3YWRkYjg2NGQyNDQzNjkwMjkxZjJjMzNlYzBhMGM/
Hosts
137.74.172.30

*** https://www.virustotal.com/en/file/...ed49231c09c210e240520abd/analysis/1472566995/

4] https://malwr.com/analysis/NjhkNTkxMDBmZGQ3NDU2Zjg2NmQ4Y2Y3NWRlNTk5NGE/

5] https://www.reverse.it/sample/fabf4...a4d0c39175c4faac128dd9fa712?environmentId=100
Contacted Hosts
137.74.172.30
___

Fake 'paycheck' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/atta...ths-salary-in-advance-malspam-delivers-locky/
30 Aug 2016 - "... series of Malspam delivering -Locky- ransomware is an email with the subject of 'paycheck' coming from random senders, companies and email addresses with a zip attachment... One of the emails looks like:
From: Isabella Holman <Holman.114@ profilerhs .com>
Date: Tue 30/08/2016 18:38
Subject: paycheck
Attachment:
Hey gold, as you requested, attached is the paycheck for your next month�s salary in advance.
Sincerely yours,
Isabella Holman

30 August 2016: e3fa12b0575f.zip: Extracts to: paycheck_pdf_de64ad80.js - Current Virus total detections 6/54*
.. MALWR** shows a download of an encrypted file from one of these locations:
http ://malwinstall .wang/1xiolv6 | http ://specialist.homepage. t-online .de/pgtv2
http ://kikital.web. fc2 .com/amqq7aq6 | http ://solesdearequito. tripod .com/f1bii
http ://vinciunion. co.th/gfp87 that is converted by the script to a working Locky ransomware 6e8kHAmEE5.dll
that gets run automatically (VirusTotal 9/58***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...0127128ea144fec2ac6de15f/analysis/1472578893/

** https://malwr.com/analysis/NmY4ZTFmYjBlNDg1NDJjYWJiYzhiZjRjZGVjNzMyZjA/
Hosts
80.150.6.138
52.52.40.206
208.71.106.48
45.59.114.100
103.246.18.22

*** https://www.virustotal.com/en/file/...caea29cfc0e3edf326ced5f9/analysis/1472579254/
___

Fake 'Server Update' SPAM - drops Java Adwind or Jacksbot
- https://myonlinesecurity.co.uk/unit...java-jar-files-drops-java-adwind-or-jacksbot/
30 Aug 2016 - "An email with the subject of 'Unity Link New Server Update' pretending to come from xm.nl@ unitylink .com <abelen@ unitylink .com> with a zip attachment which contains an executable file 'Updated Unityink Server..exe' and an image, which drop/create various Java.jar files. This is likely to be a Java Adwind or Java Jacksbot version... One of the emails looks like:
From: xm.nl@ unitylink .com <abelen@ unitylink .com>
Date: Tue 30/08/2016 07:13
Subject: Unity Link New Server Update
Attachment: Unity Link New Server Update.zip
Dear Agent,
Find attach New update details with password, kindly sign and branch seal on the attach authorization for security updates.
Best regards,
ALAA ELDIN BEBARS
| Unity Link Operations
Unity Link services Ltd| P.O. Box 170 ...

Screenshot of image file inside zip: https://myonlinesecurity.co.uk/wp-content/uploads/2016/08/Unity-Link-New-Server-Update.png

30 August 2016: Unity Link New Server Update.zip: Extracts to: Updated Unityink Server..exe
Current Virus total detections 15/58*. MALWR**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...90ba2212f99e22dc73cd6792/analysis/1472556607/

** https://malwr.com/analysis/NmQ0YTIwOTExNDBmNDE5MjgxZTBmNmI1NzYwNjI3OGI/
___

Opera server breach ...
> https://www.opera.com/blogs/security/2016/08/opera-server-breach-incident/
Aug 26, 2016 - "Earlier this week, we detected signs of an attack where access was gained to the Opera sync system. This attack was quickly blocked. Our investigations are ongoing, but we believe some data, including some of our sync users’ passwords and account information, such as login names, may have been compromised. Although we only store encrypted (for synchronized passwords) or hashed and salted (for authentication) passwords in this system, we have reset all the Opera sync account passwords as a precaution. We have also sent emails to all Opera sync users to inform them about the incident and ask them to change-the-password for their Opera-sync-accounts. In an abundance of caution, we have encouraged users to also reset-any-passwords to third-party-sites they may have synchronized with the service. To obtain a new password for Opera sync, use the password resetting page:
- https://auth.opera.com/account/lost-password "

:fear::fear: :mad:
 
Last edited:
You must log in or register to reply here.
Back
Top