SPAM frauds, fakes, and other MALWARE deliveries...

AplusWebMaster · Nov 30, 2016

Fake 'Urgent bill', 'Attached Image' SPAM

FYI...

Fake 'Urgent bill' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/urgent-bill-has-invalid-account-number-malspam-delivers-locky/
30 Nov 2016 - "... Locky downloader... an email with the subject of 'Urgent' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of unpaid_recipient’s name.zip... One of the emails looks like:
From: Adolfo Alexander <Alexander.Adolfo@ escondidohistory .org>
Date: Wed 30/11/2016 09:06
Subject: Urgent
Attachment: unpaid_forum.zip
Dear forum, our accountant informed me that in the bill you processed, the invalid account number had been specified.
Please be guided by instructions in the attachment to fix it up.

30 November 2016: unpaid_forum.zip: Extracts to: -snk-284042943.js - Current Virus total detections 10/55*
MALWR** shows a download of an encrypted file from http ://revaitsolutions .com/ij1driqioc which is converted by the script to K3GepPJAfH.tdb (VirusTotal 5/57***). Payload Security[4]. The tdb file is actually a dll file that is run by rundll32 but given a different extension... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...3ecfc1caeda3a35c37e76c7d/analysis/1480496588/

** https://malwr.com/analysis/MmFiNzdjMTcyZjhlNGQ1ZmJkNWE4YmE3ODJmZGYyMWI/
Hosts
166.62.28.127

*** https://www.virustotal.com/en/file/...4b9f9933ddc3a3fd3942cc9b/analysis/1480498073/

4] https://www.hybrid-analysis.com/sam...11b3ecfc1caeda3a35c37e76c7d?environmentId=100
Contacted Hosts
166.62.28.127
185.75.46.138
91.201.41.145
91.142.90.46
52.42.26.69
54.240.162.193
52.35.54.251
___

Fake 'Attached Image' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/atta...m-canonyour-own-email-address-delivers-locky/
30 Nov 2016 - "A -blank- email with the subject of 'Attached Image' pretending to come from canon@ your-own-email-domain with a malicious word doc attachment delivers Locky... The email looks like:
From: canon@ thespykiller .co.uk
Date: Wed 30/11/2016 09:23
Subject: Attached Image
Attachment: 6479_005.docm

Body content: Totally blank/empty

30 November 2016: 6479_005.docm - Current Virus total detections 9/55*
Both MALWR** and Payload Security*** show a download from satherm .pt/873nf3g which is converted by the macro to ajufr51.dll (VirusTotal 5/57[4]). Manual analysis shows an attempt to download from
http ://travelinsider .com.au/021ygs7 which is currently giving me a 404. There are normally 5 or 6 download locations buried inside the macro or scrpt files with these Locky versions.
C2 http ://91.142.90.61 /information.cgi | 95.213.195.123 /information.cgi... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...1418bd2ba2800dc495cdd55b/analysis/1480498411/

** https://malwr.com/analysis/MjEwOGQ3YTJhYWU3NGMwZWJmYTg2Mjg0NmRjZWQzNTQ/
Hosts
80.172.235.175
91.142.90.61

*** https://www.hybrid-analysis.com/sam...4aa1418bd2ba2800dc495cdd55b?environmentId=100
Contacted Hosts
80.172.235.175
95.213.195.123
91.142.90.61
2.16.4.33
52.42.26.69
54.240.162.55
52.35.54.251
91.198.174.192
91.198.174.208

4] https://www.virustotal.com/en/file/...62dd9a613e7a86ebc5d447b1/analysis/1480499902/
___

Forced install - Chrome extension...
- https://blog.malwarebytes.com/cybercrime/2016/11/forced-into-installing-a-chrome-extension/
Nov 29, 2016 - "We have found a number of websites whose sole purpose is to try and force an extension on anyone visiting that site with Chrome. Most often, you can likely land on one of these sites after a -redirect- from a crack, keygen, or adult entertainment site... site runs a JavaScript producing this dialog box, telling you you’ll have to 'Add Extension to Leave':
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/prompt1.png
Clicking “Cancel” once changes it to add a tick box marked “Prevent this page from creating additional dialogs”:
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/warning2w.png
Thinking that this is the ticket out of the page, you will tick that box and click “OK”. At this point, your tab will go into “Full Screen” mode, and you can see which extension they want you to install:
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/warning3w.png
The app is called Veritasi and a big arrow pointing to the “Add extension” button is displayed on the site. Clicking the said button initiates the installation of the app:
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/warning4.png
When I looked up Veritasi, we noticed it was added to the “Web Store” the same day we found it and it’s supposedly meant to improve your sound quality online:
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/soundimprove.png
A similar extension was found and described by Botcrawl.com who classified it as adware. It has the permission “Read and change all your data on the websites you visit”, which is not unusual for a browser extension, but it’s all what -adware- needs to do its job:
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/permissionsw.png
If your Windows machine gets stuck on a site like this, use the Ctrl-Alt-Del key combination to invoke the Task Manager. Use “End Process” on every active “chrome.exe” process until the browser shuts down. When you restart Chrome, it will ask if you want to “Restore” the open tabs. I would recommend -not- to, unless it’s really necessary. We have sent in an abuse report and blocked the sites involved to protect as many possible victims as we could..."
> https://blog.malwarebytes.com/wp-content/uploads/2016/11/abuse.png
... A full removal guide can be found on our forums*..."
* https://forums.malwarebytes.org/topic/191194-removal-instructions-for-veritasi/

:fear::fear:

AplusWebMaster · Dec 1, 2016

Fake 'efax', 'Invoices' SPAM, Cybercrime raids

FYI...

Fake 'efax' SPAM - delivers Dridex
- https://myonlinesecurity.co.uk/efax-message-from-unknown-2-pages-delivers-an-unknown-malware/
1 Dec 2016 - "... an email with the subject of 'efax message from unknown – 2 page(s)' pretending to come from eFax <message@ inbound-efax-au .org> with a link-to-download-a-zip-file that extracts to 2 identical .js files named fax page 1 and fax page 2...

Screenshot: https://i2.wp.com/myonlinesecurity....rom-unknown-2-pages.png?resize=1024,773&ssl=1

1 December 2016: Fax.zip: Extracts to: Fax_page1.js - Current Virus total detections 3/55*
MALWR** shows a download of a file from ‘http ://mohdsuhaimy .com/wp-content/uploads/2006/06/background.png’ which is -not- a png (image file) but a -renamed- .exe which is renamed back by the script to an .exe file (VirusTotal 15/57***). (Payload Security [4]). Previously this trick & delivery method has delivered Trickbot banking Trojan. However this binary looks different and gives some indication of ransomware behaviour...
Update: I am reliably informed that this is Dridex Banking Trojan... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...ffe116c7cd5797e1f525c570/analysis/1480579221/

** https://malwr.com/analysis/NDdiMjI1M2FhMGE3NGI1ZmIwZjc4ZDJhYmMwMWZjYWU/
Hosts
173.247.245.31

*** https://www.virustotal.com/en/file/...3ef1d96224dcdfd69a676a19/analysis/1480579728/

4] https://www.hybrid-analysis.com/sam...1cdffe116c7cd5797e1f525c570?environmentId=100
Contacted Hosts
173.247.245.31
111.69.33.166
104.236.219.229
185.8.165.33
___

Fake 'Invoices' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/more...le-that-pretends-to-be-a-docm-delivers-locky/
1 Dec 2016 - "... Locky downloader... an email with the subject of 'E-Mailed Invoices Invoice_87313391' (random numbers) coming or pretending to come from random companies, names and email addresses with what appears to be a word docm attachment - In reality this attachment is a standard zip file that has been erroneously named as a word macro doc. It will not open in word or any other word processing program. This zip contains a VBS file. Trying to open the alleged word doc in Word gives this error message:
> https://i2.wp.com/myonlinesecurity.co.uk/wp-content/uploads/2016/12/word-cannot-open.png?w=524&ssl=1
... One of the emails looks like:
From: WAUGH, HORACIO <HORACIO.WAUGH@ originalyin .ca>
Date: Thu 01/12/2016 09:23
Subject: E-Mailed Invoices Invoice_87313391
Attachment: Invoice_87313391.docm
Please find attached your latest purchase invoice...
Any queries with either the quantity or price MUST be notified immediately to the department below.
Yours sincerely, Sales Ledger Department...
This email has been scanned by the Symantec Email Security.cloud service...

1 December 2016: Invoice_87313391.docm (actually a zip file): Extracts to: fGDpAMD-0438.vbs
Current Virus total detections on docm(zip) VirusTotal on VBS 20/55*. Payload Security** shows a download of an encrypted file from speckftp .de/978t6rve which is converted by the script to nhbzalOHj.343 (VirusTotal 37/56***)
Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 etc or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...d104709a1c3fcf7d29b838aa/analysis/1480587704/
fGDpAMD-0438.vbs

** https://www.hybrid-analysis.com/sam...e5416725259634261862283fe92?environmentId=100
Contacted Hosts
87.106.247.11
95.213.195.123
91.142.90.61
54.240.162.180

*** https://www.virustotal.com/en/file/...f9fa656b551a03d73315c5fd/analysis/1480587701/
___

Fake 'Invoice' SPAM - links to Dridex
- https://myonlinesecurity.co.uk/invo...post-xero-org-delivers-dridex-banking-trojan/
1 Dec 2016 - "... an email with the subject of 'Invoice INV-01823 (Amended)' from Fleurs (random numbers and random companies) coming from Accounts <messaging-service@ post-xero .org>. There is no zip attachment but a -link- in the email to download a zip... post-xero .org is a newly created domain that is registered to a Chinese entity with probably -fake- details. It appears to be hosted on OVH in France... One of the emails looks like:
From: Accounts <messaging-service@ post-xero .org>
Date: Thu 01/12/2016 08:02
Subject: Invoice INV-01823 (Amended) from Fleurs
Attachment: link-in-email to INV-01823.zip
Dear Customer, Please find attached invoice INV-01823 (Amended) for 421.59 GBP. This invoice was sent too early in error. The payment date should be 7th December 2016. Kindly accept our apologies for the oversight and for any inconvenience caused. The amount outstanding of 421.59 GBP is due on 07 Dec 2016. View and pay your bill:
https ://in.xero .com/vjNPxBRausdmfvsgnZKOMWvyHsISTwYm If you have any questions, please do not hesitate to contact us. Kind regards, Accounts Department ...

The link in the body does -not- go to xero .com which is a legitimate small business accounting software but to a criminal controlled site on SharePoint: ‘https :// ryandixon-my.sharepoint .com personal/judy_dixonconstructionwa_com_au/_layouts/15/guestaccess.aspx?guestaccesstoken=k9xc1qR8YuAKTF6D2%2bMExORcjRIY3nQj8RB7WhdXaSw%3d&docid=09d01294b7e434b2aad87127682150354&rev=1’

1 December 2016: INV-01823.zip: Extracts to: INV-01823.js - Current Virus total detections 6/54*
.. where comments show this downloads the same Dridex banking Trojan from the -same- locations as described in THIS earlier post:
> https://myonlinesecurity.co.uk/efax-message-from-unknown-2-pages-delivers-an-unknown-malware/
The basic rule is NEVER open any attachment to an email [OR click-on-links in the body] unless you are expecting it..."
* https://www.virustotal.com/en/file/...ffe116c7cd5797e1f525c570/analysis/1480587854/
INV-01823.js

post-xero .org: 46.105.101.84: https://www.virustotal.com/en/ip-address/46.105.101.84/information/

ryandixon-my.sharepoint .com: 104.146.222.33: https://www.virustotal.com/en/ip-address/104.146.222.33/information/
>> https://www.virustotal.com/en/url/f...8c55a73312c406e63d12061ea251aa7e61f/analysis/
1/68
___

Fake 'Payment Information' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/paym...to-specify-insurance-payments-delivers-locky/
1 Dec 2016 - "... Locky downloader... an email with the subject of 'Payment Information' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of P_recipient’s name.zip... One of the emails looks like:
From: Helga Hull <Hull.Helga@ dreamactunion .org>
Date: Thu 01/12/2016 18:23
Subject: Payment Information
Attachment: P_rek.zip
Good afternoon. Thank you for sending the bill.
Unfortunately, you have forgotten to specify insurance payments.
So, we cannot accept the payment without them.
All details are in the attachment.

1 December 2016: P_rek.zip: Extracts to: -6dt874p53077.js - Current Virus total detections 16/55*
MALWR** shows a download of an encrypted file from http ://trewincefarm .co.uk/xlyy7 which is converted by the script to 0UBE8YF7q1BcN.zk (VirusTotal 11/57***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5bba634bb787321db9672cfa/analysis/1480616575/

** https://malwr.com/analysis/Njg0ZmViNDdjN2RlNGUxZTk1MDljMDc4MWI5ZWVmYjU/
Hosts
82.211.96.24

*** https://www.virustotal.com/en/file/...dc1f0817b33b9b70126ea45e/analysis/1480617465/

4] https://www.hybrid-analysis.com/sam...a965bba634bb787321db9672cfa?environmentId=100
Contacted Hosts
82.211.96.24
91.201.41.145
46.8.29.155
31.41.47.50
52.32.150.180
54.240.162.129
35.160.111.237
___

Worldwide cyber-crime network hit in coordinated raids
- http://www.reuters.com/article/us-germany-cyber-idUSKBN13Q4Z6
Dec 1, 2016 - "One of the world's biggest networks of hijacked computers, which is suspected of being used to attack online banking customers, has been taken down following police swoops in 10 countries, German police said on Thursday. In an internationally coordinated campaign, authorities carried out the raids on Wednesday, seized servers and website domains and arrested suspected leaders of a criminal organization, said police and prosecutors in northern Germany. Officials said they had seized 39 servers and several hundred thousand domains, depriving criminals of control of more than 50,000 computers in Germany alone. These hijacked computers were used to form a 'botnet' to knock out other websites. Two people who are believed to have been the administrators of the botnet infrastructure known as 'AVALANCHE' were arrested in Ukraine, investigators said. Another person was arrested in Berlin, officials added. The strike came in the same week that hackers tried to create the world's biggest botnet, or an army of zombie computers, by infecting the routers of 900,000 Deutsche Telekom (DTEGn.DE) with malicious software. The attack failed but froze the routers, causing outages in homes, businesses and government offices across Germany on Sunday and Monday, Deutsche Telekom executives said. Police said criminals had used the 'AVALANCHE' botnet targeted in Wednesday's international raids since 2009 to send phishing and spam emails. More than a million emails were sent per week with malicious attachments or links. When users opened the attachment or clicked on the link, their infected computers became part of the botnet. Investigators said the suspects had operated the commandeered network and made it available to other criminal groups, who had used it to send spam and phishing mails, defraud online banking user and to spread ransomware, a form of online extortion scheme. Officials estimated worldwide damages at upward of several hundred million euros. Authorities have identified 16 suspected leaders of the organization from 10 different countries. A court in Verden, northern Germany, has issued arrest warrants for seven people on suspicion of forming a criminal organization, commercial computer fraud and other criminal offences. The raids came after more than four years of intensive investigation by specialists in 41 countries."

:fear::fear:

AplusWebMaster · Dec 2, 2016

Fake 'Pay Attention', 'Emailing' SPAM

FYI...

Fake 'Pay Attention' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/plea...n-the-service-receipt-malspam-delivers-locky/
2 Dec 2016 - "... Locky downloader... an email with the subject of 'Please Pay Attention' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of SCAN_recipient’s name.zip... One of the emails looks like:
From: Claud Hopper <Hopper.Claud@ jvaclub .com>
Date: Fri 02/12/2016 09:35
Subject: Please Pay Attention
Attachment: SCAN_ard.zip
Greetings! Informing you that the contractor requires including VAT in the service receipt.
Sending the new invoice and payment details in the attached file.
Please open and study it as soon as possible – we need your decision.

2 December 2016: SCAN_ard.zip: Extracts to: -uvk3166985727v.js - Current Virus total detections 8/55*
MALWR** shows a download of an encrypted file from http ://supermarkety24 .pl/levsyp8vp which is converted by the script to 5viAGx9N.zk (VirusTotal 8/56***) | Payload Security[4] | Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...411a8f1316dddc49716f138f/analysis/1480674917/

** https://malwr.com/analysis/Njg0ZmViNDdjN2RlNGUxZTk1MDljMDc4MWI5ZWVmYjU/
Hosts
82.211.96.24

*** https://www.virustotal.com/en/file/...18b1d029abd6f45b1b8bf79b/analysis/1480676872/

4] https://www.hybrid-analysis.com/sam...b02411a8f1316dddc49716f138f?environmentId=100
Contacted Hosts
193.106.106.169
95.46.98.25
91.201.41.145
46.8.29.173
___

Fake 'Emailing..." SPAM - delivers Locky
- https://myonlinesecurity.co.uk/emai...mes-at-your-own-email-address-delivers-locky/
2 Dec 2016 - "An email with the subject of 'Emailing: EPS000007' (random numbers) pretending to come from random names at your-own-email-address with a malicious word doc attachment delivers Locky... The email looks like:
From: edmund <edmund.simister@ malware-research .co.uk>
Date: Fri 02/12/2016 12:39
Subject: Emailing: EPS000007
Attachment: EPS000007.docm
Please find attachment.
—
This email has been checked for viruses by Avast antivirus software...

2 December 2016: EPS000007.docm - Current Virus total detections 10/56*
MALWR** shows a download of an encrypted file from http ://solid-consulting .nl/74t3nf4gv4 which is converted by the macro to likyir1.exe (VirusTotal 8/57***). Payload security[4]. C2: http ://195.19.192.99 /information.cgi
Other download locations seen on manual analysis of the macro include:
solid-consulting .nl/74t3nf4gv4 | taikosushibar .com.br/74t3nf4gv4 | tatooshsfds .com/74t3nf4gv4
sudeepgurtu .com/74t3nf4gv4 ... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...404638878692794ceaec7b8c/analysis/1480682348/

** https://malwr.com/analysis/MWJmZDk3MjI4NmMxNDBlMGI2MzRjOTdlMzg0YjlmYjA/
Hosts
149.210.133.178
195.19.192.99

*** https://www.virustotal.com/en/file/...9d71444f075f87712107a7fa/analysis/1480680017/

4] https://www.hybrid-analysis.com/sam...071404638878692794ceaec7b8c?environmentId=100
Contacted Hosts
149.210.133.178
195.19.192.99
91.142.90.61
31.41.47.50
52.34.245.108
54.240.162.246
___

Fake 'Attached Document' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/atta...m-canonyour-own-email-address-delivers-locky/
2 Dec 2016 - "A -blank- email with the subject of 'Attached Document' pretending to come from canon@ your-own-email-domain with a malicious word doc attachment delivers Locky. This series of malspam emails contain the same macro downloaders and end up delivering the -same- Locky payload as described in THIS* earlier post where they used an Epson scanner/printer... The email looks like:
From: canon@ my onlinesecurity .co.uk
Date: Fri 02/12/2016 15:52
Subject: Attached Document
Attachment: 0160_004.docm

Body content: Totally blank/empty

* https://myonlinesecurity.co.uk/emai...mes-at-your-own-email-address-delivers-locky/
2 Dec 2016

:fear::fear:

AplusWebMaster · Dec 5, 2016

Fake blank body, 'No subject', 'Consider This', 'Sage invoice', 'Shipping status SPAM

FYI...

Fake blank body SPAM - delivers Locky
- https://myonlinesecurity.co.uk/blan...51220160-or-041220161-malspam-delivers-locky/
5 Dec 2016 - "... Locky downloader... a completely -blank- email with the subject consisting of random numbers coming or pretending to come from random companies, names and email addresses with a zip attachment that matches the subject line numbers. I have received about 1500 copies of this malspam overnight. All the ones that I have seen start with either 051220160 or 041220161... One of the emails looks like:
From: Monica clare <Monica.clare85349@ fit4elegance .com>
Date: Mon 05/12/2016 00:47
Subject: 051220160746377790277
Attachment: 051220160746377790277.zip

Body content: totally blank/empty

5 December 2016: 051220160746377790277.zip: Extracts to: 201612031200123557933004.vbs
Current Virus total detections 14/55*. Payload Security** shows a download of an encrypted file from
http ://natashacollis .com/8765r which is converted by the script to yqUePnct.343 (VirusTotal 11/53***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...3e702d22c7dc7248dff54499/analysis/1480911167/

** https://www.hybrid-analysis.com/sam...58b3e702d22c7dc7248dff54499?environmentId=100
46.16.59.177
91.142.90.61

*** https://www.virustotal.com/en/file/...5798f33abbbbb5407a8174bf/analysis/1480922615/
___

Fake 'No subject' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malware-spam-emailing-9376924272-no.html
5 Dec 2016 - "This spam comes in a few different variants, and it leads to Locky ransomware encrypting files with an extension '.osiris'. The more word version comes from random senders with a subject like _9376_924272 or some other randomly-numbered sequence. Attached to that is an XLS file of the same name and it includes this body text:
Your message is ready to be sent with the following file or link
attachments:
_9376_924272
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.

The second version has no body text and the subject No subject or (No subject). The XLS file is named in a format incorporating the date, e.g. 2016120517082126121298.xls . The macro in the malicious Excel file downloads a component...
(Long list of domain-names at the dynamoo URL above.)
... You can see some of the things done in these two Malwr reports [1] [2]. The Locky ransomware dropped then phones home to one of the following locations:
185.82.217.28 /checkupdate [hostname: olezhkakovtony11.example .com] (ITL, Bulgaria)
91.142.90.61 /checkupdate (Miran, Russia)
195.19.192.99 /checkupdate (OOO EkaComp, Russia)
Recommended blocklist:
185.82.217.28
91.142.90.61
195.19.192.99 "
1] https://malwr.com/analysis/YTQzZjMwNjI5NTI2NDNlNTg5OTA3YzlmYTg3YzBjZjA/
Hosts
66.96.147.105
91.142.90.61

2] https://malwr.com/analysis/ZWVhM2RjNWUxNjYyNGMzYjhjMjcwZjAyNDQ4N2IzNjU/
Hosts
94.152.38.41
185.82.217.28

- https://myonlinesecurity.co.uk/blank-email-with-no-subject-xls-attachment-delivers-locky/
5 Dec 2016 - "... Locky downloader... another -blank- email with no-subject coming or pretending to come from random companies, names and email addresses with an XLS spreadsheet attachment... One of the emails looks like:
From: Rolf titterington <Rolf.titterington91@ prestonlegacy .com>
Date: Mon 05/12/2016 09:44
Subject: no subject
Attachment: 2016120502434302394842.xls

Body content: empty

5 December 2016: 2016120502434302394842.xls - Current Virus total detections 16/55*
MALWR** shows a download of an encrypted file from http ://soulscooter .com/87t34f which is converted by the script to shtefans1.spe (VirusTotal 6/56***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to. I am informed that Locky is now using .Osiris file extensions on the encrypted files... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5bba634bb787321db9672cfa/analysis/1480616575/

** https://malwr.com/analysis/MzA4NDllNjZmYmFhNGU1MGFlMThhNGI1YWU5MDQ3NTk/
Hosts
212.97.132.199
195.19.192.99
91.142.90.61
185.82.217.28

*** https://www.virustotal.com/en/file/...63d27208b3b1ca38a18c4a1d/analysis/1480932128/

4] https://www.hybrid-analysis.com/sam...b263045114956fc2bd4befad404?environmentId=100
___

Fake 'Consider This' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malware-spam-please-consider-this-leads.html
5 Dec 2016 - "This -fake- financial spam leads to malware:
From: Aimee Guy
Date: 5 December 2016 at 13:32
Subject: Please Consider This
Dear [redacted],
Our accountants have noticed a mistake in the payment bill #DEC-5956047.
The full information regarding the mistake, and further recommendations are in the attached document.
Please confirm the amount and let us know if you have any questions.

Attached is a ZIP file with a name somewhat matching the reference in the email, containing a malicious VBS script with a filename made up in part of the date. The scripts download another component...
(Long list of domain-names at the dynamoo URL above.)
... It drops a payload with an MD5 of 529789f27eb971ff822989a5247474ce and a current detection rate of just 1/54*. The malware then phones home to the following locations:
91.142.90.61 /information.cgi [hostname: smtp-server1 .ru] (Miran, Russia)
195.19.192.99 /information.cgi (EkaComp, Russia)
These IPs were also used in this earlier attack**.
Recommended blocklist:
185.82.217.28
91.142.90.61
195.19.192.99 "
* https://virustotal.com/en/file/6a18...e67cfe69d3b1e56e1a10f1d33afc5ac473e/analysis/

** http://blog.dynamoo.com/2016/12/malware-spam-emailing-9376924272-no.html
___

Fake 'Sage invoice' SPAM - delivers Dridex
- https://myonlinesecurity.co.uk/spoofed-sage-outdated-invoice-delivers-dridex-banking-trojan/
5 Dec 2016 - "... an email with the subject of 'Outdated invoice' coming or pretending to come from Sage invoice <no-reply@ sage-uk .org> . There is no zip attachment with this Dridex delivery today, but a-link-in-the-body to download an invoice.zip from a hacked/compromised/fraudulently set up sharepoint site... from a site set up by the criminals to malspam the Dridex banking Trojan. The site is registered to a Chinese entity and hosted on an OVH server in France (SAGE-UK .ORG 46.105.101.84 ns3060005.ip-188-165-252.eu). One of the emails looks like:
From: Sage invoice <no-reply@ sage-uk .org>
Date: Mon 05/12/2016 12:48
Subject: Outdated invoice
Attachment: link in email to download invoice.zip
Software for business
Sage Account & Payroll
You have an outdated invoice from Sage Accounting that is ready for payment. To find out more details on this invoice, please follow the link below to download your account invoice:
https ://invoice.sage .co.uk/Account?864394=xUzlmOHtPY
If we have any information about you which is incorrect or if there are any changes to your details please let us know so that we could keep our records accurate...

5 December 2016: Invoice.zip: Extracts to: Invoice.js - Current Virus total detections 3/53*
Payload Security** shows a download from ‘http ://neelkanthelevators .com/images/about1.png’ (VirusTotal 10/56***). Payload Security[4]. This is -not- a png (image file) but a -renamed- .exe file, which the script renames to LzG7FzcEz.exe and runs... The basic rule is NEVER open any attachment to an email [OR click-a-link in it] unless you are expecting it..."
* https://www.virustotal.com/en/file/...5c936411959e3b65dcf9bc83/analysis/1480944742/

** https://www.hybrid-analysis.com/sam...0a05c936411959e3b65dcf9bc83?environmentId=100
Contacted Hosts
104.219.248.77
195.154.92.54
185.8.165.33
104.236.219.229
91.201.40.33

*** https://www.virustotal.com/en/file/...00819b15863b556b1a5d6c2afdc85721a54/analysis/

4] https://www.hybrid-analysis.com/sam...863b556b1a5d6c2afdc85721a54?environmentId=100
Contacted Hosts
195.154.92.54
185.8.165.33
104.236.219.229
91.201.40.33

46.105.101.84: https://www.virustotal.com/en/ip-address/46.105.101.84/information/
___

Fake 'Shipping status' SPAM - delivers Vawtrak malware
- http://blog.dynamoo.com/2016/12/malware-spam-shipping-status-changed.html
5 Dec 2016 - "This -fake- UPS spam has a malicious attachment:
From: UPS Quantum View [ups@ ups-service .com]
Date: 5 December 2016 at 17:38
Subject: Shipping status changed for your parcel # 1996466
Your parcel has arrived, but we were unable to successfully deliver it because no person was present at the destination address.
There must be someone present at the destination address, on the delivery day, to receive the parcel.
Shipping type: UPS 3 Day Select
Box size: UPS EXPRESS BOX
Date : Nov 14th 2016
You can reschedule the delivery over the phone, but you will have to confirm the information on the delivery invoice.
The delivery invoice can be downloaded from our website ...
Thank you for shipping with UPS
Copyright © 1994-2016 United Parcel Service of America, Inc. All rights reserved.

The link-in-the-email actually goes to a URL vantaiduonganh .vn/api/get.php?id= plus a Base 64 encoded part of the URL (e.g. aGVscGRlc2tAZmJpLmdvdg==) and it downloads a Word document with the recipients email address included in it. This type of malware is typically seen using hacked but legitimate Vietnamese sites for this stage in the infection chain. This DOC file contains a malicious macro, the Malwr report* indicates that it downloads components from:
parkovka-rostov .ru/inst.exe
stela-krasnodar .ru/wp-content/uploads/pm22.dll
Those two locations are legitimate -hacked- sites. This has a detection rate of 7/56** plus a DLL with a detection rate of 37/56***. The malware appears to be Hancitor/Pony/Vawtrak, phoning home to:
cothenperci .ru/borjomi/gate.php
madingtoftling .com/ls5/forum.php
Both of these are hosted on the same IP address of 185.31.160.11 (Planetahost, Russia)... malicious domains are also hosted on the same IP...
(List of domain-names at the dynamoo URL above.
... Recommended blocklist:
185.31.160.11
parkovka-rostov .ru
stela-krasnodar .ru "
* https://malwr.com/analysis/YmM1OGI0Mjk0MzU5NDJiNDkxNzk1MDM1OTg2MmYyM2I/
Hosts
54.243.91.166
185.31.160.11
77.222.42.115
81.177.165.101

** https://www.virustotal.com/en/file/...a30eb59e8cf67121f4912355/analysis/1480963673/

*** https://www.virustotal.com/en/file/...1e935910942645c23ec2acb8/analysis/1480964472/
___

Fake 'Urgent Data' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/urgent-data-the-error-occurred-during-payment-malspam-delivers-locky/
5 Dec 2016 - "... Locky downloader... an email with the subject of 'Urgent Data' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of payment random numbers.zip... One of the emails looks like:
From: Consuelo Wells <Wells.Consuelo@ skriverconsult .ch>
Date: Mon 05/12/2016 20:20
Subject: Urgent Data
Attachment: payment9095450.zip
Dear [redacted],
The error occurred during payment. Sending you details of the transaction.
Please pay the remaining amount as soon as possible.
King Regards,
Consuelo Wells

5 December 2016: payment9095450.zip: Extracts to: ~3X072I792ZJ.js - Current Virus total detections 4/55*
MALWR** shows a download of an encrypted file from http ://prosperer .mg/3n7uihwc0p which is converted by the script to yQC6CSDVn.zk (VirusTotal 5/57***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...034329bc10f9b9b432a6ab7c/analysis/1480969517/

** https://malwr.com/analysis/YTdkZmVjNDU2YTA2NDQ3NjkwMjUwMDY5NzE0ZDFkOGE/
Hosts
212.83.148.70
46.4.63.6

*** https://www.virustotal.com/en/file/...46dcc7f5d85673cda2e6dd49/analysis/1480970106/

4] https://www.hybrid-analysis.com/sam...cd5034329bc10f9b9b432a6ab7c?environmentId=100
Contacted Hosts
212.83.148.70
46.4.63.6
185.146.168.13
95.46.114.147

:fear::fear:

AplusWebMaster · Dec 6, 2016

Fake 'PO', 'Recent order' SPAM, Amazon, 'AppIe ID' phish

FYI...

Fake 'PO' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/inv-1465095170-for-po-0ac27757-malspam-delivers-locky/
6 Dec 2016 - "An email with the subject of 'Inv# 1465095170 for PO# 0AC27757' (random numbers) pretending to come from random senders with a malicious word doc spreadsheet attachment delivers Locky osiris... The email looks like:
From: From: pettengell, judith <judith.pettengell@ ds54 .com>
Date: Tue 06/12/2016 12:18
Subject: Inv# 1465095170 for PO# 0AC27757
Attachment: 0AC27757_1465095170.docm
Please do not respond to this email address. For questions/inquires, please
contact our Accounts Receivable Department.
This email has been scanned by the MessageLabs outbound
Email Security System for CIRCOR International Inc...

6 December 2016: 0AC27757_1465095170.docm - Current Virus total detections 8/51*
MALWR** shows a download of an encrypted file from http ://union1 .cn/0bgsvtr3 which is converted by the script to dipund1.rap (VirusTotal 9/56***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it to...
C2 http ://185.115.140.210 /checkupdate | http ://91.142.90.46 /checkupdate | http ://213.32.66.16 /checkupdate ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...1fe3a58a67b6fc1b5602c37d/analysis/1481027450/

** https://malwr.com/analysis/MmNkMTBmZTllY2EwNGYzZThlOGJkZDUzYTMyNTQ0YTk/
Hosts
139.129.41.209
185.66.12.43
91.142.90.46
185.115.140.210
213.32.66.16

*** https://www.virustotal.com/en/file/...cfe0febb59c90289d7c8ca05/analysis/1481027967/

4] https://www.reverse.it/sample/f8f22...1691fe3a58a67b6fc1b5602c37d?environmentId=100
___

Fake 'Recent order' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/recent-order-malspam-delivers-locky/
6 Dec 2016 - "... an email with the subject of 'Recent order' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of order random numbers.zip which delivers Locky ransomware... One of the emails looks like:
From: Jocelyn Dodson <Dodson.Jocelyn@ netpalouse .com>
Date: Tue 06/12/2016 09:29
Subject: Recent order
Attachment: order3202227.zip
Dear adkins,
The counteragent has conducted the checking and found no confirmed payment for the recent order...
All details are in the attachment.
Feel free to email us if you have any inquiry.
King Regards,
Jocelyn Dodson

6 December 2016: order3202227.zip Extracts to: ~8FX934T59F85.js - Current Virus total detections 6/54*
MALWR** shows a download of an encrypted file from http ://steffweb .dk/bkjybit which is converted by the script to AEyjwjkWiBbl6.zk (VirusTotal 7/57***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...2843268ef43628358eafcd7c/analysis/1481018575/

** https://malwr.com/analysis/ZmU5MGNkMjc2MTYwNDRiYmIzNTQ5YmQ3OWQwMWQxMjQ/
Hosts
94.231.108.252

*** https://www.virustotal.com/en/file/...d25daf678dcdf0a31f8ca2b30819a26173b/analysis/

4] https://www.hybrid-analysis.com/sam...f3a2843268ef43628358eafcd7c?environmentId=100
Contacted Hosts
94.231.108.252
91.203.5.176
85.143.213.71
176.112.219.101
95.46.114.147
___

Amazon - phish
- https://myonlinesecurity.co.uk/new-...mazon-for-order-502-2849265-1928845-phishing/
6 Dec 2016 - "'New Return Requested on Amazon for order 502-2849265-1928845' pretending to come from Amazon .co.uk <annazon@ amazonaws .co.uk> is one of the latest -phish- attempts to steal your Amazon Account. This one only wants your Amazon log in details... The link leads to http ://tolmasoft .ru/ViewListingAccount-dvk@ [redacted].co.uk.html...

Screenshot: https://i0.wp.com/myonlinesecurity....ishing_site_login-1.png?resize=1024,608&ssl=1

When you fill in your user name and password you get immediately -redirected- to the genuine Amazon.co.uk home page, where you think that you have logged in properly. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email..."

tolmasoft .ru: 5.187.1.187: https://www.virustotal.com/en/ip-address/5.187.1.187/information/
___

'AppIe ID' phish
- http://blog.dynamoo.com/2016/12/sms-phish-your-appie-id-is-due-to.html
6 Dec 2016 - "This SMS spam is actually a phishing message:

Screenshot: https://2.bp.blogspot.com/-OF33yrXO...WXGClQvWuoBhuFi_ZGwCLcB/s1600/apple-phish.png

This is one of those odd SMSes that doesn't seem to come from an actual number. If you follow through the link you end up on a straightforward Apple phishing page:
> https://2.bp.blogspot.com/-wsiOA1HP...JA6KDHI3YX6U1v8wnVgCLcB/s1600/apple-phish.jpg

The website appieid-support .com is hosted on 108.167.141.128 which is a customer of WebsiteWelcome... no-doubt-fake WHOIS details... The domain was created just today. Avoid."

108.167.141.128: https://www.virustotal.com/en/ip-address/108.167.141.128/information/
>> https://www.virustotal.com/en/url/0...9d1a6170f37dc076a9054b4e03a64926b4d/analysis/

:fear::fear:

AplusWebMaster · Dec 7, 2016

Fake 'Invoices', 'Card Receipt' SPAM, Stegano EK, AdGholas malvertising

FYI...

Fake 'Invoices' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/thre...4287-564-are-not-paid-malspam-delivers-locky/
7 Dec 2016 - "... an email with the subject of 'Invoices' pretending to come from random companies, names and email addresses with a semi-random named zip attachment which delivers Locky ransomware... One of the emails looks like:
From: Margery Hinton <Hinton.Margery@ bluelinedesignoh .com>
Date: Wed 07/12/2016 10:10
Subject: Invoices
Attachment: invoices0660953.zip
Dear zowm,
By today, three invoices (4282, $284; 4283, $99; 4287, $564) are not paid.
Starting tomorrow, fines will be charged. Please make appropriate payments.
All details are in the attachment.
Best Regards,
Margery Hinton
Sales Director

7 December 2016: invoices0660953.zip: Extracts to: ~8G9Z5BP2U18O48QKC6O54YE4.js
Current Virus total detections 2/55* Payload Security** shows a download of an encrypted file from
sagaoil .ro/jv5f0mrnea which is converted by the script to BQODhCNNx.zk ... Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...2b53614c5e5d45026a175f64/analysis/1481105284/

** https://www.hybrid-analysis.com/sam...f9b2b53614c5e5d45026a175f64?environmentId=100
Contacted Hosts
123.232.111.58
91.210.80.80
85.143.213.71
91.203.5.176
176.112.219.101
194.67.215.228
52.34.245.108
52.222.157.179
___

Fake 'Card Receipt' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoofed-aquaid-card-receipt-malspm-delivers-locky-osiris/
7 Dec 2016 - "An email spoofing Aquaid with the subject of 'Card Receipt' coming from random senders with a malicious word doc attachment delivers Locky Osiris...

Screenshot: https://i1.wp.com/myonlinesecurity....eipt-spoofed-aquaid.png?resize=1024,673&ssl=1

7 December 2016: CARD547 8914860.docm - Current Virus total detections 12/56*
MALWR** shows a download of an encrypted file from http ://unilite .ro/hfycn33 which is converted by the script to spircent1.mda (Payload Security ***) (virusTotal 10/54[4]). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5aed813a42c5e8b8c3918284/analysis/1481104682/

** https://malwr.com/analysis/ZGIzNTQ1ZmYzNjM2NDdhNmJmYjNhN2E3NWNlODEwYWM/
Hosts
188.213.21.75
91.142.90.46
213.32.66.16

*** https://www.hybrid-analysis.com/sam...33c5aed813a42c5e8b8c3918284?environmentId=100
Contacted Hosts
188.213.21.75
91.142.90.46
88.214.236.182
213.32.66.16
52.42.26.69
52.222.157.29
52.35.54.251

4] https://www.virustotal.com/en/file/...07f7678cdffee4ad3b9fc7dc/analysis/1481105595/
___

Stegano EK hiding in pixels of malicious ads
- http://www.welivesecurity.com/2016/...gano-exploit-kit-hiding-pixels-malicious-ads/
Dec 6, 2016 - "Millions of readers who visited popular news websites have been targeted by a series of malicious ads -redirecting- to an exploit kit exploiting several -Flash- vulnerabilities. Since at least the beginning of October, users might have encountered ads promoting applications calling themselves 'Browser Defence' and 'Broxu' using banners similar to the ones below:
1] http://www.welivesecurity.com/wp-content/uploads/2016/12/1-xlch3.png
...
2] http://www.welivesecurity.com/wp-content/uploads/2016/12/2-y0vbp.png
These advertisement banners were stored on a remote domain with the URL hxxps ://browser-defence .com and hxxps ://broxu .com. Without requiring any user interaction, the initial script reports information about the victim’s machine to the attacker’s remote server. Based on server-side logic, the target is then served either a clean image or its almost imperceptibly modified malicious evil twin. The malicious version of the graphic has a script encoded in its alpha channel, which defines the transparency of each pixel... After successful redirection, the landing page checks the userAgent looking for Internet Explorer, loads a Flash file, and sets the FlashVars parameters via an encrypted JSON file. The landing page also serves as a middleman for the Flash and the server via ExternalInterface and provides basic encryption and decryption functions. The Flash file has another Flash file embedded inside and, similarly to the -Neutrino- exploit kit, it comes with three different exploits based on the Flash version... Conclusion: The Stegano exploit kit has been trying to fly under the radar since at least 2014. Its authors have put quite some effort into implementing several techniques to achieve self-concealment. In one of the most recent campaigns we detected, which we traced back at least to the beginning of October 2016, they had been distributing the kit through advertisement banners using steganography and performing several checks to confirm that they were not being monitored. In the event of successful exploitation, the vulnerable victims’ systems had been left exposed to -further- compromise by various malicious payloads including backdoors, spyware and banking Trojans. Exploitation by the Stegano kit, or any other known exploit kit for that matter, can often be avoided by running fully patched software and by using a reliable, updated internet security solution..."
(More detail at the welivesecurity/ESET URL above.)

browser-defence .com: Could not find an IP address for this domain name...

broxu .com: 162.255.119.66: https://www.virustotal.com/en/ip-address/162.255.119.66/information/
>> https://www.virustotal.com/en/url/a...965f5347367a1f65419b5cddeb95f9ee098/analysis/
___

AdGholas malvertising ...
- https://blog.malwarebytes.com/cybercrime/exploits/2016/12/adgholas-malvertising-business-as-usual/
Dec 6, 2016 - "... A group identified as AdGholas* by Proofpoint which has been involved in the stealthiest attacks we have seen in recent history, was caught again and exposed by Eset**... The last bit of activity from AdGholas after the Proofpoint exposé was July 20th of this year. However, according to our telemetry, less than two months later the group was back at it with some of the -largest- malvertising attacks we have ever documented... The interesting aspect about this malvertising campaign is that the US was -not- one of the targets. Instead we saw Canada, the UK, Australia, Spain, Italy, and Switzerland as the most active geolocations. We observed most attacks happen in Canada and the UK as seen below on this heat map:
> https://blog.malwarebytes.com/wp-content/uploads/2016/12/heatmap.png
Despite not targeting the US, the latest AdGholas campaign has once again reached epic proportions and unsuspecting users visiting top trusted portals like Yahoo or MSN (not to mention many top level publishers) were exposed to malvertising and malware if they were not protected..."
* https://www.proofpoint.com/us/threa...-and-file-whitelisting-to-hide-in-plain-sight

** http://www.welivesecurity.com/2016/...gano-exploit-kit-hiding-pixels-malicious-ads/

:fear::fear:

AplusWebMaster · Dec 8, 2016

Fake 'Emailing', 'Order', 'Scan' SPAM, Tax refund - phish

FYI...

Fake 'Emailing' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/emailing-mx62edo-08-12-2016-documents-your-own-email-address/
8 Dec 2016 - "An email with the subject of 'Emailing: MX62EDO 08.12.2016' pretending to come from documents@ your-own-email-address with a malicious word doc delivers Locky Osiris... The email looks like:
From: documents@ thespykiller .co.uk
Date: Thu 08/12/2016 10:05
Subject: Emailing: MX62EDO 08.12.2016
Attachment:
Your message is ready to be sent with the following file or link
attachments:
MX62EDO 08.12.2016
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
This email has been checked for viruses by Avast antivirus software...

8 December 2016: MX62EDO 08.12.2016.docm - Current Virus total detections 10/54*
MALWR** shows a download of an encrypted file from http ://netfun .be/hb74 which is converted by the script to clsooach1.feds (VirusTotal 11/56***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...ba7cb094c8d0bf743bc3bb79/analysis/1481192959/

** https://malwr.com/analysis/NmZhYjk5MjIyNzUwNDQ1ZTk0MTRkZWJkODUyYTU2NzU/
Hosts
81.4.68.175
176.121.14.95

*** https://www.virustotal.com/en/file/...0c3ee243e002d1f79026e3f3/analysis/1481193005/

4] https://www.hybrid-analysis.com/sam...f3708e5f273c6053dc974926f78?environmentId=100
Contacted Hosts
188.93.230.41
185.127.24.247
213.32.66.16
91.142.90.46
176.121.14.95
52.42.26.69
52.222.157.29
___

Fake 'Order' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/more...ndom-reference-number-malspam-delivers-locky/
8 Dec 2016 - "... an email with the subject of 'Order #0850834' (random numbers) coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment matching the subject line which delivers Locky ransomware... One of the emails looks like:
From: Latoya Byrd <Byrd.Latoya@ flceo .com>
Date: Thu 08/12/2016 11:29
Subject: Order #0850834
Attachment: order-0850834.zip
Hello ard, your order #0850834 ...
Sending you the receipt. Please pay it prior to next week.
The receipt is in the attachment.
Best Wishes,
Latoya Byrd
Delivery Manager

8 December 2016: order-0850834.zip: Extracts to: ~5Z36TWQXK9014CO228K8V0C.js
Current Virus total detections 6/55*. MALWR** shows a download of an encrypted file from
http ://file4hosti .info/ne92o1u which is converted by the script to 7JpjNVpwmyeHv.zk (VirusTotal 4/53***).
Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...0941deb6f72a5fe4caf0a767/analysis/1481196535/

** https://malwr.com/analysis/YTMwODJkZWJmMWZmNGQ3NmExMTQ4NTUxMjVjODQ0ZWY/
Hosts
107.172.55.203

*** https://www.virustotal.com/en/file/...fb062f236a37d33ecda41db7/analysis/1481197588/

4] https://www.hybrid-analysis.com/sam...3300941deb6f72a5fe4caf0a767?environmentId=100
Contacted Hosts
104.168.87.215
107.172.55.203
178.159.42.248
185.46.11.236
52.34.245.108
52.32.150.180
35.160.111.237
91.198.174.192
91.198.174.208
54.239.168.21
___

Fake 'Scan' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/scan-from-a-samsung-mfp-malspam-delivers-locky-osiris/
8 Dec 2016 - "... an email with the subject of 'Scan' from a Samsung MFP coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of Untitled_date_random numbers.zip which delivers Locky ransomware... One of the emails looks like:
From: GARRY MENZIES <garry.menzies.1825@ pricemarketresearch .com>
Date: Wed 07/12/2016 21:41
Subject: Travel expense sheet
Attachment: Untitled_07122016_46160.zip
Regards
Garry
Please open the attached document. It was scanned and sent to you using a
Samsung MFP. For more information on Samsung products and solutions, please
visit ...
This message has been scanned for malware by Websense...

8 December 2016: Untitled_07122016_46160.zip: Extracts to: N396390423.jse - Current Virus total detections 19/55*
MALWR** shows a download of an encrypted file from http ://raivel .pt/45gdfgf?SEOtErERwE=yLVujYkT which is converted by the script to XtPmJmcsvIP1.dll (VirusTotal 24/56***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries... DLL files... rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...08e5f273c6053dc974926f78/analysis/1481168279/

** https://malwr.com/analysis/YTE5NDM2Yjc0MzNkNGQ4M2IyYTU5MzQ0YTM3YThkMjY/
Hosts
188.93.230.41
91.142.90.46

*** https://www.virustotal.com/en/file/...4b5cc1877acf0bef9aaad55ff73990fe217/analysis/

4] https://www.hybrid-analysis.com/sam...f3708e5f273c6053dc974926f78?environmentId=100
Contacted Hosts
188.93.230.41
185.127.24.247
213.32.66.16
91.142.90.46
176.121.14.95
52.42.26.69
52.222.157.29
___

Tax refund - phish
- https://myonlinesecurity.co.uk/tax-refund-overpayment-33216-dvla-vehicle-licensing-agency-phishing/
8 Dec 2016 - "... DVLA Vehicle Licensing Agency phishing email trying to get your information...

Screenshot: https://i2.wp.com/myonlinesecurity....ency-phishing-email.png?resize=1024,712&ssl=1

If you follow the links you end up on an identical copy of the gov .uk site asking for usual identity and financial details:
> https://i1.wp.com/myonlinesecurity....cle-tax-refund-site.png?resize=1024,533&ssl=1
Phishing sites so far discovered include (email links go to a site which -redirects- you to other sites):
- https ://cissdemexico .com/.2DriverLicence2ADM2/2y2Driving2e2Licences2acc2/24w823w82Driving2w25and22w2Transport2w826w2gov28uk25/23Lega2r28obligations62Apply2refund2x82driving24/Refund.php
- https ://chadena .com/.cha/
- https ://fyfe-interiors .com/.lol/
- https ://partnersinsharing .com/.124DL828ADM825/2384x48390Driving9019x319Licences0638cbd419/7836Lega523x92148obligations639Apply915x3420/517x9427c481Driving827x5and32v0417Transport71x5638x319gov31uk24/Refund "

cissdemexico .com: 162.211.127.202: https://www.virustotal.com/en/ip-address/162.211.127.202/information/

chadena .com: 109.163.208.100: https://www.virustotal.com/en/ip-address/109.163.208.100/information/

fyfe-interiors .com: 202.129.244.101: https://www.virustotal.com/en/ip-address/202.129.244.101/information/

partnersinsharing .com: 69.16.221.200: https://www.virustotal.com/en/ip-address/69.16.221.200/information/

:fear::fear:

AplusWebMaster · Dec 9, 2016

Fake 'Firewall Software', 'See attached' SPAM, 400,000 phish

FYI...

Fake 'Firewall Software' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malware-spam-firewall-software-leads-to.html
9 Dec 2016 - "This spam appears to come from multiple senders and leads to Locky ransomware:
From: Herman Middleton
Date: 9 December 2016 at 07:40
Subject: Firewall Software
Hey [redacted], it is Herman. You've asked me to order new firewall software for our office computers.
Done and ready. Here, in the attachment, is the full invoice of the software counteragent.
Please check it out.
King Regards,
Herman Middleton
IT Support Manager

Attached is a ZIP file with a name like f_license_5330349.zip which contains a randomly named .js script which is very highly obfuscated. The Hybrid Analysis* and Malwr report** show that the script analysed downloads a component from welte .pl/mupze (there will probably be dozens of other locations) and appears to drop a DLL with a detection rate of 4/56***. That Hybrid Analysis also detections C2 traffic to:
107.181.187.97 /checkupdate [hostname: saluk1.example .com] (Total Server Solutions, US)
51.254.141.213 /checkupdate (OVH, France)
It's worth mentioning perhaps that other Locky C2 servers seen in the past 12 hours are as follows:
91.142.90.46 /checkupdate [hostname: mrn46.powerfulsecurities .com] (Miran, Russia)
195.123.209.23 /checkupdate [hostame: prujio .com] (Layer6, Latvia)
185.127.24.247 /checkupdate [hostname: free.example .com] (Informtehtrans, Russia)
176.121.14.95 /checkupdate (Rinet LLC, Ukraine)
185.46.11.236 /checkupdate (Agava, Russia)
178.159.42.248 /checkupdate (Dunaevskiy Denis Leonidovich / Zomro, Ukraine)
Although some of these are from different sub-groups of Locky pushers, let's stick them all together for the sake of convenience. Note that there are at least a couple of bad /24 blocks in there.
Recommended blocklist:
51.254.141.213
91.142.90.46
107.181.187.97
176.121.14.95
178.159.42.248
185.46.11.0/24
185.127.24.247
195.123.209.0/24 "
* https://www.hybrid-analysis.com/sam...a6e1d0b3e1b3df4e524e4992f90?environmentId=100
Contacted Hosts
79.96.68.245
107.181.187.97
178.159.42.248
51.254.141.213
54.239.168.239
91.198.174.192
91.198.174.208

** https://malwr.com/analysis/ZGI2MDNlZTU4NDMzNDBlMGIyZDA0ZjQ1MmM2ODI0MTQ/
Hosts
79.96.68.245

*** https://virustotal.com/en/file/fb5c...6f45dd139fbea13ab1d1597f/analysis/1481273887/

- https://myonlinesecurity.co.uk/firewall-software-malspam-delivers-locky/
9 Dec 2016 - "... an email with the subject of 'Firewall Software' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of f_license_numbers.zip which delivers Locky ransomware... One of the emails looks like:
From: Curtis Jarvis <Jarvis.Curtis@ irishcitytours .com>
Date: Fri 09/12/2016 07:22
Subject: Firewall Software
Attachment: f_license_5875331.zip
Hey emis2000, it is Curtis. You’ve asked me to order new firewall software for our office computers.
Done and ready. Here, in the attachment, is the full invoice of the software counteragent.
Please check it out.
King Regards,
Curtis Jarvis
IT Support Manager

9 December 2016: f_license_5875331.zip: Extracts to: ~S911UGV716O1J3CSTB471C.js
Current Virus total detections 16/55*. MALWR** shows a download of an encrypted file from
http ://www .pgringette .ca/a8crrwrc2t which is converted by the script to z7dWO4eQFUHRtg.zk (VirusTotal 4/57***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5bba634bb787321db9672cfa/analysis/1480616575/

** https://malwr.com/analysis/NWE4MjY5YmYzZmE3NGI2ZDlmOTg3MjEwMDhkMTFmYmM/
Hosts
69.28.199.160

*** https://www.virustotal.com/en/file/...ca2790beed1d02b2c1307394/analysis/1481268678/
___

Fake 'See attached' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoo...l-call-you-in-10-mins-malspam-delivers-locky/
9 Dec 2016 - "An email spoofing the Business Advisory Service Ltd with the subject of 'See attached – I will call you in 10 mins' (random times) with a malicious Excel XLS spreadsheet attachment delivers Locky Osiris ransomware...

Screenshot: https://i1.wp.com/myonlinesecurity....rvice-malspam-email.png?resize=1024,547&ssl=1

9 December 2016: Invoice_392618_final.xlsm - Current Virus total detections *
MALWR** shows a download of an encrypted file from http ://djelixir .com/34f43 which is converted by the script to XtPmJmcsvIP1.dll (VirusTotal 10/56***). Payload Security [4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
*

** https://malwr.com/analysis/MDdmOWU2YTUxYjIzNDY1ZjhjOGU0OTU2NDA1NmNmYjk/
Hosts
108.174.153.189
185.102.136.67

*** https://www.virustotal.com/en/file/...9b4224b6557975dbcc96633f/analysis/1481278691/

4] https://www.hybrid-analysis.com/sam...e6fc40e864498e885a9d4a486d3?environmentId=100
Contacted Hosts
108.174.153.189
185.102.136.67
176.121.14.95
31.202.128.199
52.34.245.108
54.239.168.194
___

Another 'Apple phish' ...
- https://myonlinesecurity.co.uk/your-account-information-had-been-changed-apple-phishing/
9 Dec 2016 - "... mass Apple phish today, telling you that you have added ghost00@ hotmail .com as a new rescue email address for your Apple ID and you need to verify it... received about 200 so far this morning, some of which are getting past spam filters...

Screenshot: https://i0.wp.com/myonlinesecurity....hotmail_apple-phish.png?resize=1024,588&ssl=1

The links in the body go to:
http ://opelpart .hu/media/system/swf/o.html
which -redirects- to numerous sites including:
http ://ushindicounselling .ca/winter/Itunes/apple/
http ://volleyballsaskatoon .ca/winter/Itunes/apple/
... There will no doubt be lots of other sites active in this phishing campaign... follow-the-link [DON'T] you see a webpage looking like this screenshot (taken form a previous example):
> https://i1.wp.com/myonlinesecurity....apple_phish_website.png?resize=1024,565&ssl=1 "

opelpart .hu: 87.229.45.133: https://www.virustotal.com/en/ip-address/87.229.45.133/information/
ushindicounselling .ca: 67.212.91.221
volleyballsaskatoon .ca: 67.212.91.221: https://www.virustotal.com/en/ip-address/67.212.91.221/information/
___

Phish in-the-cloud ...
- http://www.darkreading.com/endpoint...twice-the-profit-for-attackers/d/d-id/1327673
Dec 8, 2016 - "Everything else has gone to the cloud, so why not faux emails* and their malicious payloads?... phishing emails have become a way to infect desktops and servers with ransomware, which infosec professionals continually cite as their biggest ongoing concern and defense priority..."
* http://blog.imperva.com/2016/12/can-the-phishing-menace-be-reined-in.html
Dec 6, 2016 - "Phishing is the starting point for most data breaches... cybercriminals are lowering the cost of phishing by enabling Phishing as-a-Service (PhaaS) using compromised web servers..."
> http://imperva.typepad.com/.a/6a01156f8c7ad8970c01b8d2432c51970c-800wi
___

400,000 phishing sites - every month in 2016
- https://www.helpnetsecurity.com/2016/12/07/phishing-sites-observed-2016/
Dec 7, 2016 - "84 percent of phishing sites observed in 2016 existed for less than 24 hours, with an average life cycle of under 15 hours... data collected by Webroot*:
> https://www.helpnetsecurity.com/images/posts/phishing-122016-1.jpg "

* https://www.webroot.com/blog/2016/12/07/all-phishing-scams-want-for-christmas/
Dec 7, 2016 - "... Webroot has observed an average of over 400,000 phishing sites each month... Google, PayPal, Yahoo, and Apple are heavily targeted for attacks. Cybercriminals know to impersonate sites that people trust and use regularly... Google was impersonated in 21 percent of -all- phishing sites between January and September 2016, making it the most heavily targeted. Emails to avoid:
With the holiday season in full swing and the New Year fast approaching, hackers are up to their old tricks... we should all be wary of emails containing UPS, USPS, and FedEx shipping alerts; 401k/benefit enrollment notices; and miscellaneous tax documents from now through the end of January..."

:fear::fear:

AplusWebMaster · Dec 12, 2016

Fake 'Invoice', 'New(910)', 'Software License', 'Amazon', 'Order' SPAM

FYI...

Fake 'Invoice' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malwares-spam-invoice-number-947781.html
12 Dec 2016 - "This fake financial spam comes from -multiple- senders and leads to Locky ransomware:
From: AUTUMN RHINES
Date: 12 December 2016 at 10:40
Subject: Invoice number: 947781
Please find attached a copy of your invoice...

The name of the sender varies, as does the fake invoice number. Attached is a .DOCM file with a filename matching that invoice number. Typical detection rates for the DOCM file are 13/56*. Automated analysis of a couple of these files [1] [2]... show the macro downloading a component from miel-maroc.com/874ghv3 (there are probably many more locations). A DLL is dropped with a current detection rate of 11/57**. All those analyses indicate that this is Locky ransomware (Osiris variant), phoning home to:
176.121.14.95 /checkupdate (Rinet LLC, Ukraine)
88.214.236.218 /checkupdate (Overoptic Systems, UK / Russia)
91.219.31.14 /checkupdate (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine)
Recommended blocklist:
176.121.14.95
88.214.236.218
91.219.31.14 "
* https://virustotal.com/en/file/3ce3...33d78e70b112e1d8b5decace3b7d0077759/analysis/

1] https://malwr.com/analysis/NzVmODQ1N2U3NzllNGM5NDk5ZTE0YmUwMTkwNDM5Y2U/
Hosts
5.153.23.8
176.121.14.95
88.214.236.218
91.219.31.14

2] https://malwr.com/analysis/YzViZjg5ZTVkM2EwNDVmMGEyOGQyNTE4MWU3NzMxMjA/
Hosts
5.153.23.8
176.121.14.95
91.219.31.14

** https://virustotal.com/en/file/9efd...b06551cec8821fcce12c7a704718a3643df/analysis/
___

Fake 'New(910)' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malware-spam-new910-leads-to-locky.html
12 Dec 2016 - "This spam leads to Locky ransomware:
From: Savannah [Savannah807@ victimdomain .tld]
Reply-To: Savannah [Savannah807@ victimdomain .tld]
Date: 12 December 2016 at 09:50
Subject: New(910)
Scanned by CamScanner
Sent from Yahoo Mail on Android

The spam appears to come from a sender within the victim's-own-domain, but this is just a simple forgery. The attachment name is a .DOCM file matching the name in the subject. Automated analysis [1] [2] indicates that it works in a similar way to this other Locky ransomware run today*."
1] https://malwr.com/analysis/ODYwMGRjMDA3OTEzNDY0Zjk5YWJhYzQ5YjQwMDJhMGU/
Hosts
208.113.172.228
176.121.14.95

2] https://www.hybrid-analysis.com/sam...22df4c66f2dae5fa56b8468318e?environmentId=100
Contacted Hosts
208.113.172.228
91.219.31.14
35.163.57.6
52.222.171.57
35.160.111.237

* http://blog.dynamoo.com/2016/12/malwares-spam-invoice-number-947781.html
___

Fake 'Software License' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/software-license-malspam-delivers-locky/
12 Dec 2016 - "... an email with the subject of 'Software License' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of softlic_0600353.zip which delivers Locky ransomware... One of the emails looks like:
From: Deloris Santos <Santos.Deloris@ terebinthtreeportraits .com>
Date: Mon 12/12/2016 09:59
Subject: Software License
Attachment: softlic_0600353.zip
Hello scans, it is Deloris.
Sending you the scan of the software license agreement (Order #0600353).
It is in the attachment. Please look into it ASAP.
Best Regards,
Deloris Santos

12 December 2016: softlic_0600353.zip: ~50Y70PZ821IW1H6QS6R5K4P.wsf - Current Virus total detections 5/55*
Racco42** has posted a list of found download sites on pastebin***... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...b9861cd4cd959fa16cf010eb/analysis/1481540340/

** https://twitter.com/Racco42/status/808280355895529473

*** http://pastebin.com/cCeYpZsd
... C2:
POST http ://185.46.11.236/ checkupdate
POST http ://91.200.14.109/ checkupdate
POST http ://93.170.104.23 /checkupdate
POST http ://95.213.224.117 /checkupdate

185.46.11.236: https://www.virustotal.com/en/ip-address/185.46.11.236/information/ - RU
91.200.14.109: https://www.virustotal.com/en/ip-address/91.200.14.109/information/ - UA
93.170.104.23: https://www.virustotal.com/en/ip-address/93.170.104.23/information/ - NL
95.213.224.117: https://www.virustotal.com/en/ip-address/95.213.224.117/information/ - RU
___

Fake 'Amazon Transactions' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoo...1-18_to_2016-11-20-delivers-locky-ransomware/
12 Dec 2016 - "Following on from the continual series of spoofed FedEx Locky downloaders detailed in this POST[1]... using the same method have changed to a very bad imitation of Amazon .co.uk with an email with the subject of 'Transactions_Report__by_users_from_2016-11-18_to_2016-11-20' pretending to come from EGCTechServer <nf@ ammaazon .co.uk> with a malicious word doc attachment continues to deliver Locky ransomware...
1] https://myonlinesecurity.co.uk/fede...rcel-malspam-now-delivering-locky-ransomware/
9 Nov 2016

Screenhot: https://i2.wp.com/myonlinesecurity..../2016/12/ammazon-locky-email.png?w=1254&ssl=1

12 December 2016: Your_requested_Report_is_attached_Here.doc - Current Virus total detections 20/56*
Payload Security** contacts http ://triumphantul .top/2/ldd.php (185.101.218.162)... which actually downloads
http ://triumphantul .top/2/565.exe (VirusTotal 4/57***) which is the same Locky version that they malspammed out on Sunday 11 Dec 2016... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...66fb07aee26780bb41f0fd0d/analysis/1481530568/

** https://www.hybrid-analysis.com/sam...4c706f2b2d32ac9cc455be59d0e?environmentId=100

*** https://www.virustotal.com/en/file/...66fb07aee26780bb41f0fd0d/analysis/1481450464/

185.101.218.162: https://www.virustotal.com/en/ip-address/185.101.218.162/information/
> https://www.virustotal.com/en/url/5...c0560272e23820f738ef8ce6e2c29df9478/analysis/
> https://www.virustotal.com/en/url/e...6a96f3d742689376a7aa07007329bad496f/analysis/ | 2016-12-11
___

Fake 'Order' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/order-confirmation-81110319-hexstone-ltd-delivers-locky-ransomware/
12 Dec 2016 - "... an email -spoofing- Hexstone Ltd with the subject of 'Order Confirmation 81110319 Hexstone Ltd' (random numbers)... pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of Ord81110319.dzip which delivers Locky ransomware... One of the emails looks like:
From: Leonor rede <Leonor6@ fiveoaks .com>
Date: Mon 12/12/2016 16:23
Subject: Order Confirmation 81110319 Hexstone Ltd
Attachment: Ord81110319.dzip
This message is intended only for the individual or entity to which it is
addressed and may contain information that is private and confidential. If
you are not the intended recipient, you are hereby notified that any
dissemination, distribution or copying of this communication and its
attachments is strictly prohibited.

12 December 2016: Ord81110319.dzip: Extracts to: Receipt(546).jse - Current Virus total detections 12/54*
Payload Security** shows a download of an encrypted file from
http ://indigenouspromotions .com.au /874ghv3?qSzzdCEa=EIWRey which is converted by the script to fQuANqFwqs1.dll (VirusTotal 16/56***)... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...67cc93178796a0e877ea35a1/analysis/1481560496/

** https://www.hybrid-analysis.com/sam...e3c67cc93178796a0e877ea35a1?environmentId=100
Contacted Hosts
111.67.22.192
176.121.14.95
52.32.150.180
54.239.168.239
52.35.54.251

*** https://www.virustotal.com/en/file/...32ebc49bc8160ddc415919946f39fc0b265/analysis/
...adaa.exe

:fear::fear:

AplusWebMaster · Dec 13, 2016

Fake 'documents', 'Intuit invoice', 'fax', 'picture', 'Fixed invoices' SPAM

FYI...

Fake 'documents' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/total-gas-power-documents-malspam-delivers-locky/
13 Dec 2016 - "... an email with the subject of 'Total Gas & Power documents 0/5' (random numbers) pretending to come from totadonotreply@ netsend .biz with a semi-random named zip attachment in the format of 3000566547_invoice_139920043-09.zip which delivers Locky ransomware. The dates on the emails are 12 days old...

Screenshot: https://i0.wp.com/myonlinesecurity....12/Total-Gas-Power-documents.png?w=1258&ssl=1

13 December 2016: 3000566547_invoice_139920043-09.zip: Extracts to: 3000566547_invoice_139920047-55.jse
Current Virus total detections 9/55*. MALWR** shows a download of an encrypted file from
http ://94.127.33.126 /knby545?bVoaEKQ=DtsfPK which is converted by the script to JWvpjx1.dll (VirusTotal 10/57***). Payload Security[4]... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...e337dcd36bfc381e949db2f9/analysis/1481622006/

** https://malwr.com/analysis/MDgyOTYxNDdkYmQ2NDczMDkxMTc1N2M0NWQ4NDE5M2Y/
Hosts
94.127.33.126
176.121.14.95

*** https://www.virustotal.com/en/file/...98a40996ef61b931a563fdac/analysis/1481622948/

4] https://www.hybrid-analysis.com/sam...4ffe337dcd36bfc381e949db2f9?environmentId=100
Contacted Hosts
94.127.33.126
109.234.34.212
52.39.24.163
35.160.111.237
___

Fake 'Intuit invoice' SPAM - delivers Dridex
- https://myonlinesecurity.co.uk/spoo...dom-companies-delivers-dridex-banking-trojan/
13 Dec 2016 - "... an email -spoofing- Intuit/QuickBooks with the subject of 'Invoice 00341 from Gas Safety Plus' (random numbers and random companies) pretending to come from the random company in subject line <notification@ global-intuit .com> with zip attachment which delivers Dridex banking Trojan... All the ones I have seen seem to be actually coming from various IP numbers on the OVH SAS network using fake, spoofed or newly registered domain identifications:
193.70.50.59
193.70.117.190
176.31.130.77
176.31.130.74
51.254.63.185
91.121.114.211
92.222.182.70
94.23.58.107 ...
Some of the subject lines & companies include:
Invoice 00476 from Gaswise (Lincoln) Ltd
Invoice 00845 from Moss Florist
Invoice 00668 from Linda Leary Estate Agents
Invoice 00475 from Urban Merchants, Your Fine Food Supplier
Invoice 00969 from Ballon Wise ...
One of the emails looks like:
From: Gas Safety Plus <notification@ global-intuit .com>
Date: Thu 01/09/2016 19:22
Subject: Invoice 00341 from Gas Safety Plus
Attachment: link-in-email body
Gas Safety Plus
Invoice 00341
Due date 14/12/2016
Balance due 335.00
View invoice
Dear Customer, Here’s your invoice. We appereciate your prompt payment. Thank’s for your business! Gas Safety Plus
Intuit. Inc. All right reserved...

13 December 2016: Invoice.zip: Extracts to: Invoice.js - Current Virus total detections 16/55*.
MALWR** shows a download from http ://195.238.172.213 /~iceskate/images/manual.pdf which is -not- a pdf but a renamed .exe file It gets renamed by the script to PPqFp2Bl32.exe and autorun (VirusTotal 9/57***). Payload Security[4]...
The -links- in the email body goes to a hacked/compromised fraudulently set up sharepoint address:
“https ://telstrastorecorio-my.sharepoint .com/personal/rebecca_telstrashopcorio_com_au/_layouts/15/guestaccess.aspx?guestaccesstoken=nlZdrO0WUpP2BvOovx5%2bkQFaMQk87jAFOPGDI79ApoA%3d&docid=0508e7d01f6e144528e3b4e23521272d1&rev=1”
... Never just blindly click on the link/file in your email..."
* https://www.virustotal.com/en/file/...5bba634bb787321db9672cfa/analysis/1480616575/

** https://malwr.com/analysis/NGI1NDAyODY1ZDZlNDU2YjhmZWEwOGNiYTZkZTlhMjM/
Hosts
188.165.230.126
195.238.172.213

*** https://www.virustotal.com/en/file/...88c6f2559c733907ab34f804/analysis/1481626327/

4] https://www.hybrid-analysis.com/sam...cb088c6f2559c733907ab34f804?environmentId=100
Contacted Hosts
82.196.5.27
109.74.9.119
192.188.58.163

telstrastorecorio-my.sharepoint .com: 104.146.164.28: https://www.virustotal.com/en/ip-address/104.146.164.28/information/
___

Fake 'fax' SPAM - leads to malware
- https://myonlinesecurity.co.uk/blan...vodafone-es-malspam-delivers-unknown-malware/
13 Dec 2016 - "... a -blank- email with the subject of 'fax copia' coming or pretending to come from 910663334@ fax.vodafone .es with a semi-random named zip attachment in the format of 201612130917585473299351.zip
(which is date_randomnumbers.zip) which delivers... Sharik Trojan... Other subjects include:
Confirmacion
datos ...
One of the emails looks like:
From: from910663334@ fax.vodafone .es
Date: Tue 13/12/2016 08:47shows
Subject: fax copia
Attachment: 201612130917585473299351.zip

Body content: totally empty/blank

13 December 2016: 201612130917585473299351.zip: Extracts to: 201612130913339837772661.pdf.exe
Current Virus total detections 6/56*. Payload Security** shows several connections which confirms Sharik...
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...478074c373468bba3b9a9cee/analysis/1481619230/

** https://www.hybrid-analysis.com/sam...c5b478074c373468bba3b9a9cee?environmentId=100
Contacted Hosts
146.0.72.73
172.227.109.213
___

Fake 'picture' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/a-picture-for-you-malspam-delivers-locky-ransomware/
13 Dec 2016 - "... an email with the subject of 'a picture for you' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of 2016-12-1640.zip which delivers Locky ransomware. other subjects in this malspam run include:
a image for you
a photos for you ...
One of the emails looks like:
From: Delia <Delia.6@ mountainbikecup .dk>
Date: Tue 13/12/2016 15:22
Subject: a picture for you
Attachment: 2016-12-1640.zip
resized

13 December 2016:2016-12-1640.zip: Extracts to: 2016-12-14473.jse - Current Virus total detections 11/50*
MALWR** shows a download of an encrypted file from http ://jrgolfbuddy .com/knby545?MoxfoYUn=neDsPVdRB which is converted by the script to GDJpPJ1.dll (VirusTotal 9/56***). Payload Security[4]. C2 http ://176.121.14.95 /checkupdate
The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...b36e68c88e092754dc68908b/analysis/1481643767/

** https://malwr.com/analysis/MzgwN2M0ZmZjZDZiNDVmMGE5ZTczYzQyMWYwYmQ4ZWQ/
Hosts
192.185.225.117
176.121.14.95

*** https://www.virustotal.com/en/file/...152a72323ca6ebdc5d8d98b9/analysis/1481643297/

4] https://www.hybrid-analysis.com/sam...c0fb36e68c88e092754dc68908b?environmentId=100
Contacted Hosts
192.185.225.117
176.121.14.95
35.163.57.6
52.85.184.150
35.160.111.237
___

Fake 'Fixed invoices' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/fixed-invoices-malspam-delivers-locky/
13 Dec 2016 - "... an email with the subject of 'Fixed invoices'... pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of inv4665150.zip which delivers Locky ransomware... One of the emails looks like:
From: Julia Weiss <Weiss.Julia@ interfacialsolutions .com>
Date: Tue 13/12/2016 20:28
Subject: Fixed invoices
Attachment: inv4665150.zip
Dear [redacted],
Sorry for mistakes in the invoice. The number is 362, the amount came to $289.26.
Please check out the details in the attachment.
Best Regards,
Julia Weiss

13 December 2016: inv4665150.zip: Extracts to: ~_C4RM8B_~.wsf - Current Virus total detections 2/54*
... Payload Security**... does show locky ransomware and C2 sites... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...772245c772a9f1c6536960c1/analysis/1481661940/

** https://www.hybrid-analysis.com/sam...36c772245c772a9f1c6536960c1?environmentId=100
Contacted Hosts
104.168.87.215
54.187.5.20
213.32.113.203
52.34.245.108
52.35.54.251
91.198.174.192
91.198.174.208

:fear::fear:

AplusWebMaster · Dec 14, 2016

Fake 'Confirmation', 'Certificate', 'e-fax' SPAM

FYI...

Fake 'Confirmation' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoo...oking-confirmation-delivers-locky-ransomware/
14 Dec 2016 - "An email -spoofing- Kirklees Council with the subject of 'Booking Confirmation' pretending to come from random senders with a malicious word doc attachment delivers Locky ransomware... The email looks like:
From: jewell nethercote <jewell.nethercote@ luciafranca .com>
Date: Wed 14/12/2016 08:06
Subject: Booking Confirmation
Attachment: BookingConfirmation_331225_aberkinnuji@ thespykiller .co.uk.docm
Booking Confirmation
This email and any attachments are confidential. If you have received it in error – notify the sender immediately, delete it from your system, and do not use, copy or disclose the information in any way. Kirklees Council monitors all emails sent or received.

14 December 2016: BookingConfirmation_331225_aberkinnuji@ thespykiller .co.uk.docm
Current Virus total detections 13/56*. MALWR** shows a download of an encrypted file from
http ://eastoncorporatefinance .com/nbv364 which is converted by the script to sonmoga2.rudf (VirusTotal 7/57***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes tdb or .zk. or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...ee90cdf571554090168583d9/analysis/1481706521/

** https://malwr.com/analysis/ZmQyMjMzYTkzMWU5NDIxZmI4YmVjZGJlNTBjYTEzYjY/
Hosts
217.160.231.206
176.121.14.95

*** https://www.virustotal.com/en/file/...5f808bf3013888bc65cfd87b/analysis/1481706902/

4] https://www.hybrid-analysis.com/sam...ea4ee90cdf571554090168583d9?environmentId=100
Contacted Hosts
217.160.231.206
176.121.14.95
185.117.72.105
52.34.245.108
52.85.184.150
35.160.111.237
___

Fake 'Certificate' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/parcel-certificate-malspam-delivers-locky-ransomware/
14 Dec 2016 - "... an email with the subject of 'Parcel Certificate' pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of par_cert_5444211.zip which delivers Locky ransomware... One of the emails looks like:
From: Effie Bush <Bush.Effie@ adkime .com>
Date: Wed 14/12/2016 09:41
Subject: Parcel Certificate
Attachment: par_cert_5444211.zip
Dear hyperbolasmappera,
Please check the parcel certificate I am sending you in the attachment.
Order number is 477-F. Quite urgent, so please review it.
Best Regards,
Effie Bush

14 December 2016: par_cert_5444211.zip: Extracts to: ~_9UZONB_~.wsf - Current Virus total detections 3/54*
Payload Security** shows a download of an encrypted file from http ://ziskant .com/kqnioulnfj which is converted by the script to hIzFvc4Ek.zk (VirusTotal 4/56***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...11938cffc9fb4876b0628cf4/analysis/1481708404/

** https://www.hybrid-analysis.com/sam...75411938cffc9fb4876b0628cf4?environmentId=100
Contacted Hosts
62.210.89.38
185.129.148.56
86.110.117.155
213.32.113.203
35.160.111.237

*** https://www.virustotal.com/en/file/...67eda5444706fa47cbcf0dae/analysis/1481709795/
___

Fake 'e-fax' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/spoofed-e-fax-message-delivers-trickbot-banking-trojan/
14 Dec 2016 - "An email with the subject of 'eFax message from +611300786102 – 4 page(s), Caller-ID: +611300786102' (random numbers) pretending to come from eFax <inbound@ efax .delivery> with a malicious word doc attachment delivers Trickbot banking Trojan...

Screenshot: https://i2.wp.com/myonlinesecurity..../2016/12/spoofed-e-fax-email.png?w=1308&ssl=1

14 December 2016: InboundMessage.doc - Current Virus total detections 10/53*
Payload Security** shows a download from ‘http ://cendereci .com/dasphdasodasopjdaspjdasdasa.png’ which is -not- a png (image file) but -renamed- .exe (VirusTotal 41/57***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...73c6ef376aaaf6618f1c6de3/analysis/1481698402/

** https://www.hybrid-analysis.com/sam...e3273c6ef376aaaf6618f1c6de3?environmentId=100
Contacted Hosts
85.159.66.172
23.21.228.240
36.37.176.6
202.5.50.55

*** https://www.virustotal.com/en/file/...17e3fb2c722560336d378fd76a8f22f78f8/analysis/

:fear::fear:

AplusWebMaster · Dec 15, 2016

Fake 'Amount Payable', 'Order Receipt' SPAM, Yahoo hack

FYI...

Fake 'Amount Payable' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malware-spam-amount-payable-leads-to.html
15 Dec 2016 - "This -fake- financial spam leads to Locky ransomware:
From: Lynn Drake
Date: 15 December 2016 at 09:55
Subject: Amount Payable
Dear [redacted],
The amount payable has come to $38.29. All details are in the attachment.
Please open the file when possible.
Best Regards,
Lynn Drake

The name of the sender will vary, although the dollar amount seems consistent in all the samples I have seen. Attached is a file with a name similar to doc_6937209.zip which contains an apparently randomly-named script in a format similar to ~_ZJR8WZ_~.js... highly obfuscated script... Typical detection rates for the script are around 16/54*. There are many different scripts, downloading a component...
(Long list of domain-names at the dynamoo URL above.)
According to this Malwr analysis**, a DLL is dropped with a detection rate of 18/55***. This Hybrid Analysis[4] shows the Locky infection clearly and identifies some C2s, combining this with another source gives the following list of C2 servers:
86.110.117.155 /checkupdate (Rustelekom, Russia)
185.129.148.56 /checkupdate (MWTV, Latvia)
185.17.120.166 /checkupdate (Rustelekom, Russia)
MWTV is a known-bad-host, so I recommend blocking the entire /24.
Recommended blocklist:
86.110.117.155
185.129.148.0/24
185.17.120.166 "
* https://virustotal.com/en/file/bd02...66473caec5d26104c56d07c7/analysis/1481796164/

** https://malwr.com/analysis/MzY2YzNhZGExZWFiNDdmODk2N2YwMjgxNzFiYTMxYjk/
Hosts
92.48.111.60

*** https://virustotal.com/en/file/d46b...2f1605bf21be8b10cd6d6099/analysis/1481796614/

4] https://www.hybrid-analysis.com/sam...5eb66473caec5d26104c56d07c7?environmentId=100
Contacted Hosts
92.48.111.60
185.129.148.56
86.110.117.155
52.42.26.69
52.85.184.67
52.35.54.251
___

Fake 'Order Receipt' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/more-order-receipt-malspam-delivers-locky-ransomware/
15 Dec 2016 - "... an email with the subject of 'Order Receipt' pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format which delivers Locky ransomware... One of the emails looks like:
From: Joshua Mooney <Mooney.Joshua@ ricket .net>
Date: Thu 15/12/2016 10:54
Subject: Order Receipt
Attachment: scan9022222.zip
Dear enrico,
Thank you for making your order in our store!
The payment receipt and crucial payment information are in the attached document.
King Regards,
Joshua Mooney
Sales Manager

15 December 2016: scan9022222.zip: Extracts to: ~_4RYT3KP_~.js - Current Virus total detections 6/54*
MALWR** shows a download of an encrypted file from http ://www.bds-1 .com/gfftte3uv which is converted by the script to RJJvCX8vggvNw4PW.zk (VirusTotal 4/56***). Payload Security[4]. Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...23d3778ffd05a43c11e78fe5/analysis/1481799202/

** https://malwr.com/analysis/NjUxOTUxM2QzYWZmNDgyOWFiYTBjYmY1YTYwZWZlNTA/
Hosts
64.71.33.107

*** https://www.virustotal.com/en/file/...c39dec9d5eabfef45f52d57d/analysis/1481804458/

4] https://www.hybrid-analysis.com/sam...f0323d3778ffd05a43c11e78fe5?environmentId=100
Contacted Hosts
64.71.33.107
185.17.120.166
185.129.148.56
178.209.51.223
52.42.26.69
52.85.184.195
35.160.111.237
91.198.174.192
91.198.174.208
___

One -billion- users affected - Yahoo hack
- https://www.helpnetsecurity.com/2016/12/15/one-billion-yahoo-hack/
Dec 15, 2016 - "Yahoo has revealed that it’s been the victim of -another- hack and massive data breach that resulted in the compromise of information of a -billion- users... Outside forensic experts that have been called in to help with the investigation believe that this breach happened in August 2013, and that it’s likely -not- been performed by the same attackers as the 2014 breach disclosed this September. In addition to this, the company says that attackers have accessed the company’s proprietary code, which allowed them to learn how to -forge-cookies- and to, therefore, be able to access user accounts -without- a password... Yahoo says that they were unable to identify the intrusion associated with this latest data theft, but that it seems that data associated with more than one -billion- user accounts has been stolen..."
* https://help.yahoo.com/kb/account/SLN27925.html?impressions=true
Dec 14, 2016

:fear::fear:

AplusWebMaster · Dec 16, 2016

Fake 'document', 'Subscription', 'Processing Problem' SPAM, Malvertising

FYI...

Fake 'document' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoo...alspam-delivers-locky-ransomware-again-today/
16 Dec 2016 - "Another -blank/empty- email with the subject of 'Attached document' pretending to come from copier@ your-own-email-address with a malicious word doc attachment delivers Locky ransomware... The email looks like:
From: copier@ your-own-email-address
Date: Fri 16/12/2016 09:57
Subject: Attached document
Attachment: 3867_002.docm

Body content: Completely empty/Blank

16 December 2016: 3867_002.docm - Current Virus total detections 12/56*
Payload Security** shows a download of an encrypted file from http ://fiddlefire .net/hjg766′ which is converted by the script to loppsa2.aww ... Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...05bd4be86e688438b3d3e44e/analysis/1481882199/

** https://www.hybrid-analysis.com/sam...98505bd4be86e688438b3d3e44e?environmentId=100
Contacted Hosts
69.161.143.24
37.235.50.29
176.121.14.95
86.110.117.155
83.220.172.182
52.88.7.60
91.198.174.192
91.198.174.208
___

Fake 'Subscription' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/subscription-details-malspam-delivers-locky-ransomware/
16 Dec 2016 - "... an email with the subject of 'Subscription Details' pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of user0989063.zip which delivers Locky ransomware... One of the emails looks like:
From: Cyril Levy <Levy.Cyril@ dragonflystudiosalon .com>
Date: Fri 16/12/2016 10:49
Subject: Subscription Details
Attachment: user0989063.zip
Dear mammoth, thank for you for subscribing to our service!
All payment and ID details are in the attachment.

16 December 2016: user0989063.zip: Extracts to: ~_P1EJYA_~.js - Current Virus total detections 4/55*
Payload Security** shows a download of an encrypted file from http ://rondurkin .com/c6w5pscmc which is converted by the script to jex1N6oXpYUpIQ.zk (VirusTotal 5/56***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5c21c69d637e20ecb231d08e/analysis/1481885511/

** https://www.hybrid-analysis.com/sam...a965bba634bb787321db9672cfa?environmentId=100
Contacted Hosts
82.211.96.24
91.201.41.145
31.41.47.50
46.8.29.155
52.34.245.108
54.240.162.137

*** https://www.virustotal.com/en/file/...bd4c72755ccc31eb46a70992/analysis/1481886225/
___

Fake 'Processing Problem' SPAM - leads to Locky
- http://blog.dynamoo.com/2016/12/malware-spam-payment-processing-problem.html
15 Dec 2016 - "This -fake- financial spam leads to Locky ransomware:
From: Juliet Langley
Date: 15 December 2016 at 23:17
Subject: Payment Processing Problem
Dear [redacted],
We have to inform you that a problem occured when processing your last payment (code: 3132224-M, $789.$63).
The receipt is in the attachment. Please study it and contact us.
King Regards,
Juliet Langley

The name of the sender will vary as will the reference number and dollar amounts. Attached is a ZIP file with a name somewhat matching the reference (e.g. MPay3132224.zip) containing in turn a malicious Javascript with a name similar to ~_AB1C2D_~.js... the scripts download a component...
(Long list of domain-names at the dynamoo URL above.)
The malware then phones home to the following locations:
185.129.148.56 /checkupdate (MWTV, Latvia)
178.209.51.223 /checkupdate [hostname: 454.SW.multiservers.xyz] (EDIS, Switzerland)
37.235.50.119 /checkupdate [hostname: 454.2.SW.multiservers.xyz] (EDIS, Switzerland)
Recommended blocklist:
185.129.148.0/24
178.209.51.223
37.235.50.119 "

- https://myonlinesecurity.co.uk/payment-processing-problem-malspam-delivers-locky/
15 Dec 2016 - "... an email with the subject of 'Payment Processing Problem' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment in the format of MPay7197337.zip which delivers Locky ransomware... One of the emails looks like:
From: Kristie Soto <Soto.Kristie@ kadgraphics .com>
Date: Thu 15/12/2016 22:33
Subject: Payment Processing Problem
Attachment: MPay7197337.zip
Dear adkins,
We have to inform you that a problem occured when processing your last payment (code: 7197337-M, $454.$86).
The receipt is in the attachment. Please study it and contact us.
King Regards,
Kristie Soto

15 December 2016: MPay7197337.zip: Extracts to: ~_7XXTOQ_~.js - Current Virus total detections 3/55*
Payload Security** shows a download of an encrypted file from http ://ustadhanif .com/q0w93lkrvp
which is converted by the script to HNUsEBnh.zk (VirusTotal 6/57***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...428c8375a312269bcbe43825/analysis/1481842328/

** https://www.hybrid-analysis.com/sam...b7f428c8375a312269bcbe43825?environmentId=100
Contacted Hosts
208.75.151.108
37.235.50.119
52.85.184.150

*** https://www.virustotal.com/en/file/...3ba0442e716bdf32b7011a18/analysis/1481843139/
___

Malvertising compromises routers instead of computers
- https://www.helpnetsecurity.com/2016/12/16/malvertising-campaign-compromises-routers/
Dec 16, 2016 - "The DNSChanger exploit kit is back and more effective than ever, and is being used in a widespread malvertising attack whose goal is to compromise small/home office routers. According to Proofpoint* researchers, the attacker’s current main goal is to change DNS records on the target router, so that it queries the attacker’s rogue DNS servers, and the users are served with ads that will earn the attackers money:
> https://www.helpnetsecurity.com/images/posts/dnschanger-attack.jpg
... Using ad-blocking software should also minimize the risk of getting hit through this and other malvertising campaigns. According to Kafeine**, the current one is successfully targeting Chrome browser users on Windows desktops and Android devices. Also, this is not the first time that attackers are successfully using steganography to deliver and run malicious code. Earlier this month, ESET researchers flagged a malvertising campaign that redirected users to the Stegano exploit kit through malicious code hidden in the pixels of the bad ads/banners."
* https://www.proofpoint.com/us/threa...r-attack-malvertising-windows-android-devices
"... Since the end of October, we have seen an improved version of the “DNSChanger EK” ** used in ongoing malvertising campaigns. DNSChanger attacks internet routers via potential victims’ web browsers; the EK does not rely on browser or device vulnerabilities but rather vulnerabilities in the victims' home or small office (SOHO) routers. Most often, DNSChanger works through the Chrome browser on Windows desktops and Android devices. However, once routers are compromised, all users connecting to the router, regardless of their operating system or browser, are vulnerable to attack and further malvertising..."
** http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html

:fear::fear:

AplusWebMaster · Dec 19, 2016

Fake 'Payslip', 'LogMeIn' SPAM

FYI...

Fake 'Payslip' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/payslip-for-the-month-dec-2016-malspam-delivers-locky/
19 Dec 2016 - "An email with the subject of 'Payslip for the month Dec 2016' pretending to come from random senders with a malicious word doc attachment delivers Locky ransomware... The email looks like:
From: JASMINE DICKEY <jasmine.dickey@ ejmbcommercial .com>
Date: Mon 19/12/2016 09:50
Subject: Payslip for the month Dec 2016.
Attachment: Payslip_Dec_2016_5490254.doc
Dear customer,
We are sending your payslip for the month Dec 2016 as an attachment with this mail.
Note: This is an auto-generated mail. Please do not reply.

19 December 2016: Payslip_Dec_2016_5490254.doc - Current Virus total detections 11/53*
Payload Security** shows a download of an encrypted file from http ://routerpanyoso.50webs .com/8hrnv3 which is converted by the script to shtrina2.ero (VirusTotal 12/55***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...efb3cf9485bd8b2a9c1a02fc/analysis/1482144602/

** https://www.hybrid-analysis.com/sam...e4defb3cf9485bd8b2a9c1a02fc?environmentId=100
Contacted Hosts
162.210.101.94
193.201.225.124
46.148.26.82
188.127.237.76
176.121.14.95
52.39.24.163
52.85.184.92
91.198.174.192
13.82.139.29
91.198.174.192
91.198.174.208

*** https://www.virustotal.com/en/file/...bebb877aed1031c987ca16d3/analysis/1482144877/

- http://blog.dynamoo.com/2016/12/malware-spam-payslip-for-month-dec-2016.html
19 Dec 2016 - "This -fake- financial spam leads to Locky ransomware:
From: PATRICA GROVES
Date: 19 December 2016 at 10:12
Subject: Payslip for the month Dec 2016.
Dear customer,
We are sending your payslip for the month Dec 2016 as an attachment with this mail.
Note: This is an auto-generated mail. Please do not reply.

The name of the sender will vary. Attached is a malicious Word document with a name like Payslip_Dec_2016_6946345.doc which has a VirusTotal detection rate of 12/55*. This Hybrid Analysis** clearly shows Locky ransomware in action when the document is opened. According to my usual reliable source, the various versions of this download a component...
(Long list of domain-names shown at the dynamoo URL above.)
... The malware then phones home to one of the following locations:
176.121.14.95 /checkupdate (Rinet LLC, Ukraine)
193.201.225.124 /checkupdate (PE Tetyana Mysyk, Ukraine)
188.127.237.76 /checkupdate (SmartApe, Russia)
46.148.26.82 /checkupdate (Infium, Latvia / Ukraine)
A DLL is dropped with a detection rate of 12/52*.
Recommended blocklist:
176.121.14.95
193.201.225.124
188.127.237.76
46.148.26.82 "
* https://virustotal.com/en/file/17e8...e070c8f2e11bfaa0c0600533/analysis/1482147232/

** https://www.hybrid-analysis.com/sam...6e3e070c8f2e11bfaa0c0600533?environmentId=100
Contacted Hosts
193.201.225.124
188.127.237.76
46.148.26.82
176.121.14.95
52.85.184.12

*** https://virustotal.com/en/file/a2e9...8f5b3da6a07bebb877aed1031c987ca16d3/analysis/
___

Fake 'LogMeIn' SPAM - delivers malware
- https://myonlinesecurity.co.uk/logmein-account-notification-ip-blocked-malspam-delivers-malware/
19 Dec 2016 - "The email looks like:
From: LogMeIn.com Auto-Mailer <noreply@ ssl-logmein .com>
Date: Mon 19/12/2016 17:10
Subject: LogMeIn Account Notification – Ip blocked
Attachment: -Link-in-email-body- downloads notification_recipients_name.doc
Your IP has been blocked from using the LogMeIn website after too many failed log-in attempts.
Account holder: keith@[redacted]
Event: IP blocked
At: Mon, 19 Dec 2016 19:09:37 +0200
To clear the IP address lockout, please follow the instructions...

Screenshot: https://i0.wp.com/myonlinesecurity.co.uk/wp-content/uploads/2016/12/offfice-enable-editing.png

19 December 2016: notification_keith.doc - Current Virus total detections 3/54*
Payload Security **. The link-in-the-email is to http ://www .celf .jp/wp-content/themes/i-max/api/get.php?id=recipients email address encoded in base 64... The domain ssl-logmein .com was registered -today- 19 December 2016 via a Chinese registrar to a Bulgarian entity (IP address listed as 1.1.1.1). The emails are actually coming via a botnet of infected/compromised computers and servers... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...085ba96f7ca7f210d6780c14/analysis/1482167739/
Trojan:W97...

** https://www.hybrid-analysis.com/sam...811085ba96f7ca7f210d6780c14?environmentId=100
Contacted Hosts
23.21.228.240
80.78.251.134
212.24.98.247

ssl-logmein .com: 1.1.1.1: https://www.virustotal.com/en/ip-address/1.1.1.1/information/
> https://www.virustotal.com/en/url/9...df449fd8bd8703f6f2dbbf3849f59e7a4a5/analysis/

:fear::fear:

AplusWebMaster · Dec 20, 2016

Fake 'printing', 'Scan' SPAM

FYI...

Fake 'printing' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoofed-moonbake-inc-for-printing-malspam-delivers-locky-ransomware/
20 Dec 2016 - "An email spoofing Moonbake Inc with the subject of 'for printing' coming from random sender with a malicious Excel XLS spreadsheet attachment delivers Locky... One of the email looks like:
From: HILLARY TATEHAM <hillary.tateham@ stonelawassociates .Com>
Date: Tue 20/12/2016 09:47
Subject: for printing
Attachment: Certificate_2373.xls
Hi,
For printing.
Thank you so much.
HILLARY TATEHAM Cristobal HRD/Admin Officer
Moonbake Inc. 14 Langka St., Golden Acres Talon 1
Las Piñas City, Philippines ...

20 December 2016: Certificate_2373.xls - Current Virus total detections 5/56*
Payload Security** shows a download of an encrypted file from http ://yorkshire-pm .com/hjv56 which is converted by the script to momerk2.vip (VirusTotal 9/55***). Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do. Manual analysis shows these download locations:
yorkshire-pm .com/hjv56
isriir .com/hjv56
noosnegah .com/hjv56 ...
DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...5fd5598abc1ecaac099b9603/analysis/1482227222/

** https://www.hybrid-analysis.com/sam...98b5fd5598abc1ecaac099b9603?environmentId=100
Contacted Hosts
103.11.101.46
91.223.180.3
188.127.239.48
193.201.225.124
54.239.168.79

*** https://www.virustotal.com/en/file/...b665c1ec90d894772926f893/analysis/1482228007/
___

Fake 'Scan' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/spoofed-lumax-industries-ltd-scan-malspam-delivers-locky/
20 Dec 2016 - "... an email spoofing Lumax Industries Ltd. with the subject of 'Scan' pretending to come from random companies, names and email addresses with a random named zip attachment which delivers Locky ransomware...

Screenshot: https://i0.wp.com/myonlinesecurity....poofed-lumax-industries-email.png?w=896&ssl=1

20 December 2016: 07cff4edf9a.zip: Extracts to: r9a2aa5cdfcbabe8bbbfc598cd334abb.wsf
Current Virus total detections 9/55*. Payload Security** shows a download of an encrypted file from
http ://www.judo-hattingen .de /hjv56?lktttKC=koHaQOx which is converted by the script to pYmpJfsNiM1.dll which unfortunately the free web version of Payload security does not make available for download... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...65136e584a9cad43d3dba21e/analysis/1482248792/

** https://www.hybrid-analysis.com/sam...a8965136e584a9cad43d3dba21e?environmentId=100
Contacted Hosts
91.250.102.57
176.121.14.95
193.201.225.124
52.32.150.180
52.85.184.12

:fear::fear:

AplusWebMaster · Dec 21, 2016

Fake 'Secure Comm', 'Photo' SPAM

FYI...

Fake 'Secure Comm' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/spoofed-commbank-secure-communication-delivers-malware/
21 Dec 2016 - "An email spoofing CommBank with the subject of 'Secure Communication' coming from < secure.message@ commbanksecureemail .com > with a malicious word doc attachment delivers Trickbot banking Trojan...

Screenshot: https://i1.wp.com/myonlinesecurity....bank-secure-message.png?resize=1024,805&ssl=1

21 December 2016: Message.doc - Current Virus total detections 14/54*
Payload Security** shows a downloadfrom http ://onsitepcinc .com/images/344bzhmyVYyWz7NqRpfuunqXxjkseLhdmy.png which is -not- a png (image file) but a renamed .exe that is renamed by the script to wynrajo.exe (VirusTotal 22/56***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...b4195fb1d195c60a6762ddcf/analysis/1482306465/

** https://www.hybrid-analysis.com/sam...48fb4195fb1d195c60a6762ddcf?environmentId=100
Contacted Hosts
65.108.116.221
78.47.139.102
36.37.176.6
201.236.219.180
144.76.249.26

*** https://www.virustotal.com/en/file/...0a8441f1b945103d6e79714a/analysis/1482314962/
___

Fake 'Photo' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/photo-from-random-girl-malspam-delivers-locky/
21 Dec 2016 - "... another -blank- empty email with the subject of 'Photo' from {random Girl’s name} pretending to come from names and email addresses with a semi-random named zip attachment in the format of IMG-date-WA1234.zip which delivers Locky ransomware... One of the emails looks like:
From: Glenna <Glennaherron3424@ syprotek .com>
Date: Wed 21/12/2016 09:32
Subject: Photo from Glenna
Attachment: IMG-20161221-WA4646.zip

Body content: totally blank/Empty

21 December 2016: IMG-20161221-WA4646.zip: Extracts to: A87D1FCF.wsf - Current Virus total detections 8/55*
Payload Security**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...b98028228d981f83b44ea3f5/analysis/1482312946/

** https://www.hybrid-analysis.com/sam...314b98028228d981f83b44ea3f5?environmentId=100
Contacted Hosts
103.232.120.79
176.121.14.95
52.42.26.69
54.240.162.130
52.35.54.251

:fear::fear:

AplusWebMaster · Dec 22, 2016

Fake 'scanned copy', 'Bestbuy' SPAM

FYI...

Fake 'scanned copy' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/scanned-copy-malspam-should-deliver-locky-ransomware/
22 Dec 2016 - "... another -blank/empty- email with the subject of 'scanned copy' pretending to come from random names and email addresses with a semi-random named zip attachment in the format of HP0000000937.zip delivers Locky ransomware... One of the emails looks like:
From: jeanne whitehorne <jeanne.whitehorne@ owdv .net>
Date: Thu 22/12/2016 03:55
Subject: scanned copy
Attachment: HP0000000937.zip

Body content: totally blank/empty

22 December 2016: HP0000000937.zip: Extracts to: JFF38A.vbs - Current Virus total detections 8/55*
Payload Security** shows a download of an encrypted file from http ://www .dvdpostal .net/result ... Locky has recently started to use non standard file extensions on the binaries. Sometimes they are numbers like 342, 343, 552 or sometimes .tdb or .zk or any other 2, 3 or 4 character or number extension. All of these are actually DLL files that rundll32.exe will run via the macro or VBS/JS/WSF scripting file telling it what to do... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...83a46013db4f728401d9be68/analysis/1482379501/

** https://www.hybrid-analysis.com/sam...c0c83a46013db4f728401d9be68?environmentId=100
Contacted Hosts
213.0.77.6
176.121.14.95
52.88.7.60
54.240.162.173
35.160.111.237
___

Fake 'Bestbuy' SPAM - delivers malware
- https://myonlinesecurity.co.uk/your...th-december-malspam-tries-to-deliver-malware/
22 Dec 2016 - "... an email with the subject of 'Your Bestbuy item is due for delivery on 22th December' pretending to come from random names at yahoo .com with a random named zip attachment which tries to deliver some sort of malware. This zip file extracts to another zip file before it extracts to the .js file... One of the emails looks like:
From: josecastillo2344@ yahoo .com
Date: Thu 22/12/2016 08:56
Subject: Your Bestbuy item is due for delivery on 22th December
Attachment: ECIOPZiodlxc.zip
On the morning 22th of December you’ll be delivered a window and you’ll have the possibility to track your request on its way to your address.
Please make sure someone is available to sign for your delivery.
Pack delivery info and your contact data is in the file attached to this letter.
If you will be out, it’s not a problem: you have a range of ‘in-flight’ options like changing your delivery time collecting from the nearest DPD Pickup Shop, asking us to deliver to one of your frients or arranging to have your item delivered to a safe place at your work address.

22 December 2016: ECIOPZiodlxc.zip: Extracts to: ECIOPZiodlxc.js - Current Virus total detections 3/54*
Payload Security** shows a download of an encrypted file from http ://optimastop .eu/castle/map which is currently giving me a 403 forbidden. It does show it wants to use BITS transfer and it is possible that a standard http get is blocked... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...9b2337882a63236bd15ef285/analysis/1482399844/
Troj.Downloader.Js...

** https://www.hybrid-analysis.com/sam...f119b2337882a63236bd15ef285?environmentId=100

:fear::fear:

AplusWebMaster · Dec 23, 2016

Tech support phone SCAM, Fake 'eFax' SPAM

FYI...

Tech support phone SCAM
- http://blog.dynamoo.com/2016/12/02085258899-tech-support-scam-using.html
23 Dec 2016 - "If these people ring you DO -NOT- GIVE THEM ACCESS TO YOUR PC and either hang up - or waste their time like I do. It seems there are some prolific technical support scammers ringing from 02085258899 pretending to be from BT. They had a very heavy Indian accent, and they have made many silent calls to my telephone number before today. They -claim- that hackers are accessing my router. I wasted 37 minutes of their time, these are some of the steps to watch out for..
1. They get you to open a command prompt and type ASSOC which brings up a big long list of file associations, in particular they seem interested in one that says .ZFSendToTarget=CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}
2. Then they get you to bring up the Event Viewer by typing EVENTVWR and then clicking "Custom Views" and "Administrative Events". This is a log file that will always show a whole bunch of meaningless errors (such as network faults). It's quite normal for this to look quite bad to the untrained eye.
3. Then in order they try to get you to connect to the following services to take remote control of your PC: www .anydesk .com, www .teamviewer .com and www .supremofree .com. All of these are legitimate services, but I have to confess I'd never heard of the last one.. so I will add it to my corporate blacklist.
4. When those didn't work they tried directing me to a proxy at hide .me/proxy and www .hide .me/proxy (the same thing I know) which is probably another candidate for blocking.
Of course, once they have access to your PC they will try to convince you that you need to -pay- them some money for technical support. Be warned, that they can render-your-PC-unusable if you don't pay, and they can also steal confidential data. Despite how many times they may tell you they are from BT, they are not.. they are simply fraudsters."
___

Fake 'eFax' SPAM - delivers malware
- https://myonlinesecurity.co.uk/spoo...ail-address-malspam-delivers-unknown-malware/
22 Dec 2016 - "... another email spoofing eFax with the subject of 'You have recevied a message' pretending to come from faxscanner scanner@ your-own-email-address with a semi-random named zip attachment in the format of Message efax system-1701.zip which delivers an unknown malware. Indications are that this could be Trickbot or could be Dridex banking Trojan... One of the emails looks like:
From: Fax Scanner <scanner @ your-email-address>
Date: Thu 22/12/2016 20:51
Subject: You have recevied a message
Attachment: Message efax system-1701.zip
You have received a message on efax.
Please download and open document attached.
Scanner eFax system.

22 December 2016: Message efax system-1701.zip: Extracts to: Message efax system-2817.js
Current Virus total detections 4/53*. Payload Security** shows a download of ntntoto1].png (but doesn’t give the download url) which is renamed by the script to QE7JlpDt.exe (VirusTotal 29/56***). The js file is heavily obfuscated and almost impossible to human read and decrypt. Update: MALWR[4] gave me ‘http ://glendaleoffice .com/js/ntntoto.png’ as the download location... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...bf4705d287c21dd7c54e89e9/analysis/1482441908/

** https://www.hybrid-analysis.com/sam...4afbf4705d287c21dd7c54e89e9?environmentId=100
Contacted Hosts
78.47.139.102
36.37.176.6
201.236.219.180

*** https://www.virustotal.com/en/file/...475d5861ad0aa6b7eeac7eb5f5c518d9c29/analysis/

4] https://malwr.com/analysis/MGQ1ZTFiZWEwMjFlNDkyMjk3NWEwZDgwMDIxODEwMmU/
Hosts
69.67.54.86
78.47.139.102
54.243.154.49
45.76.25.15
167.114.174.158
188.40.53.51
36.37.176.6
192.189.25.143

glendaleoffice .com: 69.67.54.86: https://www.virustotal.com/en/ip-address/69.67.54.86/information/
> https://www.virustotal.com/en/url/4...c24901b9d34f1917b2536a1c0fb6195d12e/analysis/

:fear::fear:

AplusWebMaster · Dec 27, 2016

Fake 'USPS', 'FedEx' SPAM

FYI...

Fake 'USPS' SPAM - delivers Locky, Kovter, other malware
- https://myonlinesecurity.co.uk/spoo...es-to-deliver-locky-kovter-and-other-malware/
27 Dec 2016 - "... malware gang spoofing FedEx, USPS and every other courier, delivery or postal service, sending thousands of 'Courier was not able to deliver your parcel' and hundreds of variants or similar subjects like 'USPS issue #06914074: unable to delivery parcel'... Some subjects seen, all have random numbers, include:
USPS issue #06914074: unable to delivery parcel
Parcel #006514814 shipment problem, please review
USPS parcel #3150281 delivery problem
Courier was not able to deliver your parcel (ID006976677, USPS)
Parcel 05836911 delivery notification, USPS
... malware downloaders spoofing USPS pretending to be a message saying cannot deliver the parcel. These deliver Locky ransomware and Kovter Trojans amongst others...

27 December 2016: Delivery-Details-06914074.zip: Extracts to: Delivery-Details-06914074.doc.wsf
Current Virus total detections 7/55*. Payload Security** shows a download from
http ://boardedhallgreen .com/counter/?a=1HHDb3PbzDuGitWA7eW5oQFLzRjd1VzqhJ&m=3254807&i=Y5rzyqa6RhRlpx-dpPoqiXX2fW4GipPhNOTHtfBNJDBj6eEd6iZ3Yj9wAD7akn77R5LBqqvQvXIlyx_kYmBdyl0Bi12Qqds7
which gives counter.js (VirusTotal 1/55***) that in turn downloads from
http ://baltasmenulis .lt/counter/?i=Y5rzyqa6RhRlpx-dpPoqiXX2fW4GipPhNOTHtfBNJDBj6eEd6iZ3Yj9wAD7akn77R5LBqqvQvXIlyx_kYmBdyl0Bi12Qqds7&a=1HHDb3PbzDuGitWA7eW5oQFLzRjd1VzqhJ&r=01 (and 02 – 05).
The script tries the first in the list & then moves down until it gets a reply from the server. You never see the first downloaded file ( counter.js on your computer, that is run directly from temp internet files ). It downloads 01 first, then 02, then 03 until you get to 05. If any site doesn’t have the file, then it moves to the next site in the list for that particular file. Each site on the list has a full set of the files. but it is rare for the site giving counter.js to actually download from itself, normally that downloads from a different site on the list. All the files (apart from the original counter.js) pretend to be png (image files). They are actually all renamed .exe files or in the case of number 3, a -renamed- php script. Both of the innocent files are misused to run the malware. This is a very noisy malware set that contacts 4 domains and -179- hosts. View the network section on the Payload Security report[4] for more details... One of the emails looks like:
From: USPS Priority Delivery <steven.kent@ confedampa .org>
Date: Tue 27/12/2016 06:57
Subject: USPS issue #06914074: unable to delivery parcel
Attachment: Delivery-Details-06914074.zip
Dear Customer,
Your item has arrived at December 25, but our courier was not able to deliver the parcel.
You can download the shipment label attached!
Thank you for your assistance in this matter,
Steven Kent,
USPS Chief Delivery Manager.

The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustotal.com/en/file/...b91cbacfedc5c6abc6b6f9fb/analysis/1482822876/

** https://www.hybrid-analysis.com/sam...43eb91cbacfedc5c6abc6b6f9fb?environmentId=100

*** https://www.virustotal.com/en/file/...7dc42063820993458fb49a21/analysis/1482824922/

4] https://www.hybrid-analysis.com/sam...f9fb?environmentId=100#sample-network-traffic
Contacted Hosts (179)
___

Fake 'FedEx' SPAM - delivers Locky and other malware
- https://myonlinesecurity.co.uk/more...delivering-locky-and-multiple-other-malwares/
25 Dec 2016

> https://www.hybrid-analysis.com/sam...de8e?environmentId=100#sample-network-traffic
Contacted Hosts (170)

:fear::fear:

AplusWebMaster · Dec 28, 2016

Fake 'FedEx/USPS' SPAM

FYI...

Fake 'FedEx/USPS' SPAM - Kovter/Locky sites
- https://myonlinesecurity.co.uk/spoofed-fedex-and-usps-kovter-and-locky-sites/
28 Dec 2016 - "Following on from these [FEDEX(1)] [USPS(2)] posts describing the Spoofed FedEx and USPS (and other delivery services from time to time). I will endeavour to keep up to date with a list of current sites involved in the spreading of this malware. I will also show the command used that day to obtain the malware. I will add each days new sites to the lists, but please remember that old sites are -reused-daily- until taken down by their hosts. -All- the sites used in this malware spreading campaign are -hacked/compromised- sites.
1] https://myonlinesecurity.co.uk/more...delivering-locky-and-multiple-other-malwares/

2] https://myonlinesecurity.co.uk/spoo...es-to-deliver-locky-kovter-and-other-malware/

The script tries the first in the list & then moves down until it gets a reply from the server. You never see the first downloaded file (counter.js by searching on your computer, that is run directly from temp internet files). Counter.js then downloads a different -variant- of counter.js which in turn downloads 01 first, then 02, then 03 until you get to 05. If any site doesn’t have the file, then it moves to the next site in the list for that particular file. Each site on the list has a full set of the files. but it is rare for the site delivering counter.js to actually download from itself, normally that downloads from a different site on the list. All the files (apart from the -original- counter.js) pretend to be png (image files). They are actually all renamed .exe files or a renamed php script listing the files to be encrypted. Counter.js contains the list of sites to download from, which includes many of the sites listed in the original WSF, JS, VBS or other scripting file and normally one or 2 extra ones. to get the -second- counter.js you need to change the &r=01 at the end of the url to &m=01 (or 02-05). This -second- counter.js contains -additional- sites to download from which frequently includes sites from the previous days lists that are not already included in the WSF or first counter.js.
I only accidentally found out about the second /3rd /4th /5th counter.js when I made a mistake in manually decoding the original wsf file (and the original counter.js) and mistyped/miscopied the &r= and used &m= instead. Obviously it is a belt and braces approach to making sure the actual malware gets downloaded to a victim’s computer when urls or sites are known about and -blocked- by an antivirus or web filter service.

25 December 2016: (Payload Security report [3]) Contacted Hosts (170)
3spension .com: 116.127.123.32: https://www.virustotal.com/en/ip-address/116.127.123.32/information/
minebleue .com: 213.186.33.87: https://www.virustotal.com/en/ip-address/213.186.33.87/information/
chaitanyaimpex .org: 43.255.154.44: https://www.virustotal.com/en/ip-address/43.255.154.44/information/
grancaffe .net: 94.23.64.40: https://www.virustotal.com/en/ip-address/94.23.64.40/information/
break-first .com: 87.98.144.123: https://www.virustotal.com/en/ip-address/87.98.144.123/information/
www .meizumalaysia .com: 103.51.41.205: https://www.virustotal.com/en/ip-address/103.51.41.205/information/
dreamoutloudcenter .org: 184.168.234.1: https://www.virustotal.com/en/ip-address/184.168.234.1/information/
megrelis-avocat .com: 213.186.33.82: https://www.virustotal.com/en/ip-address/213.186.33.82/information/

/counter/?a=1DtntZgmur6occ1CY29PJzvAzLsjCXMuyD&m=9488599&i=e5J5zaa6WhR1MYhBZ8L8Rmw2RWRVmbtna9Y_vLRIrGW2mVxU7SBYLhBH9Gj5Mr942yUp7kFWRWAOGtmJ5aqexWRDrTq_rGixe_a-gmVCMQ
/counter/?i=e5J5zaa6WhR1MYhBZ8L8Rmw2RWRVmbtna9Y_vLRIrGW2mVxU7SBYLhBH9Gj5Mr942yUp7kFWRWAOGtmJ5aqexWRDrTq_rGixe_a-gmVCMQ&a=1DtntZgmur6occ1CY29PJzvAzLsjCXMuyD&r=01

27 December 2016: (Payload Security report[4]) Contacted Hosts (179)
lacasadeicuochi .it: 185.2.4.12: https://www.virustotal.com/en/ip-address/185.2.4.12/information/
boardedhallgreen .com: 184.168.230.1: https://www.virustotal.com/en/ip-address/184.168.230.1/information/
www .memoodgetactive.det.nsw .edu.au: 153.107.134.124: https://www.virustotal.com/en/ip-address/153.107.134.124/information/
rebecook .fr: 213.186.33.104: https://www.virustotal.com/en/ip-address/213.186.33.104/information/
peachaid .com: 107.180.26.91: https://www.virustotal.com/en/ip-address/107.180.26.91/information/
kidsgalaxy .fr: 213.186.33.18: https://www.virustotal.com/en/ip-address/213.186.33.18/information/
baltasmenulis .lt: 185.5.53.28: https://www.virustotal.com/en/ip-address/185.5.53.28/information/
artss .org: 166.62.27.56: https://www.virustotal.com/en/ip-address/166.62.27.56/information/

/counter/?a=1HHDb3PbzDuGitWA7eW5oQFLzRjd1VzqhJ&m=3254807&i=Y5rzyqa6RhRlpx-dpPoqiXX2fW4GipPhNOTHtfBNJDBj6eEd6iZ3Yj9wAD7akn77R5LBqqvQvXIlyx_kYmBdyl0Bi12Qqds7
/counter/?i=Y5rzyqa6RhRlpx-dpPoqiXX2fW4GipPhNOTHtfBNJDBj6eEd6iZ3Yj9wAD7akn77R5LBqqvQvXIlyx_kYmBdyl0Bi12Qqds7&a=1HHDb3PbzDuGitWA7eW5oQFLzRjd1VzqhJ&r=01

28 December 2016: (Payload Security report[5]) Contacted Hosts (174)
thanepoliceschool .com: 166.62.27.146: https://www.virustotal.com/en/ip-address/166.62.27.146/information/
chimie.iset-liege .be: 213.186.33.17: https://www.virustotal.com/en/ip-address/213.186.33.17/information/
partnersforcleanstreams .org: 192.186.205.128: https://www.virustotal.com/en/ip-address/192.186.205.128/information/

/counter/?a=1N1rEZQQ9Z3Ju6jggwn7hFU1jXytBTcK7r&m=8429816&i=LXEfbBQo_qDv_k77jrIae7y_BHSSQ_IZeneRTOoRmdDa4RlnJqaUKIl03HhN683DsUx-hkDi_OiCy0bOPjhZTiYm8RSQDBkfCerE
/counter/?i=LXEfbBQo_qDv_k77jrIae7y_BHSSQ_IZeneRTOoRmdDa4RlnJqaUKIl03HhN683DsUx-hkDi_OiCy0bOPjhZTiYm8RSQDBkfCerE&a=1N1rEZQQ9Z3Ju6jggwn7hFU1jXytBTcK7r&r=01 "

3] https://www.hybrid-analysis.com/sam...e82241ca057dffeba4d276ede8e?environmentId=100

4] https://www.hybrid-analysis.com/sam...43eb91cbacfedc5c6abc6b6f9fb?environmentId=100

5] https://www.hybrid-analysis.com/sam...0f51d2a0f14116d902a68a97eb3?environmentId=100
___

29 December 2016: (Payload Security report[6]) Contacted Hosts (169)
cobycaresfoundation .org: 72.47.244.92: https://www.virustotal.com/en/ip-address/72.47.244.92/information/
dev.zodia-q .com: 153.121.37.174: https://www.virustotal.com/en/ip-address/153.121.37.174/information/
shark1.idhost .kz: 82.200.247.240: https://www.virustotal.com/en/ip-address/82.200.247.240/information/
italysfinestdesign .it: 217.72.102.152: https://www.virustotal.com/en/ip-address/217.72.102.152/information/
salutgaudi .com: 185.2.4.20: https://www.virustotal.com/en/ip-address/185.2.4.20/information/
zodia-q .com: 153.121.37.174: https://www.virustotal.com/en/ip-address/153.121.37.174/information/

/counter/?a=13h8Y8z3WfiDFYG7jEWgsqZmPL94z22ca1&m=2365622&i=a5P5yqa6RhR1p80JYSnJbDP0I9KOXtIPtIhrFT4SHyIIqBAg-BghzAkZFkHS2tXw5C3mJYnrwuc1MpOfvGWZGd_STcfaml86P_kj5gA

/counter/?i=a5P5yqa6RhR1p80JYSnJbDP0I9KOXtIPtIhrFT4SHyIIqBAg-BghzAkZFkHS2tXw5C3mJYnrwuc1MpOfvGWZGd_STcfaml86P_kj5gA&a=13h8Y8z3WfiDFYG7jEWgsqZmPL94z22ca1&r=01

> 2nd version today (Payload Security Report[7]) Contacted Hosts (7)

/counter/?=&i=a5P71qa6RhRlpLdtPLsJBpD0aKRuq7EtvIQrHyyE-zmVoG37HDoS-OmdfAXYY-Y0RtEcCwavHQyucNU4JL_PpGxvv0l-mxt00fo&a=16TqYh72RpopqiWR97WGMNtTGTazWFYBg1&r=01

/counter/?a=16TqYh72RpopqiWR97WGMNtTGTazWFYBg1&m=4831333&i=a5P71qa6RhRlpLdtPLsJBpD0aKRuq7EtvIQrHyyE-zmVoG37HDoS-OmdfAXYY-Y0RtEcCwavHQyucNU4JL_PpGxvv0l-mxt00fo

6] https://www.hybrid-analysis.com/sam...2e495ebf5f70a1d1ad499f608fc?environmentId=100

7] https://www.hybrid-analysis.com/sam...8c7bf3df120afe3fed52a9f42ef?environmentId=100

:fear::fear:

SPAM frauds, fakes, and other MALWARE deliveries...

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member