Fake 'Bank' SPAM - PDF malware
20 Feb 2015 - "'Lloyds Bank – Pendeford Securities – Please Read Action Required/PI Documents/ Region code East 2/ 9147056/' pretending to come from RSTNAME} Woodruff <Arron.Woodruff@ lloydsbanking .com> with a zip attachment is another one from the current bot runs... The email looks like:
Please find attached our document pack for the above customer. Once completed please return via email to the below address.
If you have any queries relating to the above feel free to contact us at MN2Lloydsbanking@ lloydsbanking .com
Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 0128078. Telephone: 0845 603 1637
Lloyds Bank plc, Bank of Scotland plc are authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority.
Cheltenham & Gloucester plc is authorised and regulated by the Financial Conduct Authority.
Halifax is a division of Bank of Scotland plc. Cheltenham & Gloucester Savings is a division of Lloyds Bank plc.
HBOS plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC272200.
This e-mail (including any attachments) is private and confidential and may contain privileged material. If you have received this e-mail in error, please notify the sender and delete it (including any attachments) immediately. You must not copy, distribute, disclose or use any of the information in it or any attachments. Telephone calls may be monitored or recorded...
The malware attached to this email is the same malware as in today’s other Upatre "delivery supply only quotation 16822 in total"* – fake PDF malware . If previous days are anything to go by, we -will- see -numerous- different emails all containing the same upatre malware and all with different file names..."
20 Feb 2015 - "'supply only quotation 16822 in total' pretending to come from wendy@ burwoodsupply .co .uk with a zip attachment is another one from the current bot runs... The email looks like:
Attached are 1 quotes so far they are in excel format so they can be altered if necessary (I normally only send the quotes in PDF so they can’t be altered but Mike asked me not to do this).
The rest to follow tomorrow a.m.
ECY Armco Barley Castle Lane, Appleton Thorn, Warrington, Cheshire, WA4 4RB t: +44(0)1925 860000 f: +44(0)1925 861111
This email is confidential. It may also be privileged or otherwise protected by work product immunity or other legal rules. If you are not the intended recipient please notify the sender. Please delete the message from all places in your computer where it is stored...
20 February 2015: quotes.zip: Extracts to: quotes.exe
Current Virus total detections: 2/57** . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
... Behavioural information
Fake 'NYC Parking Fine' SPAM - malware
Feb 20, 2015 - "Email purporting to be from the NYC Department of Finance thanks you for paying $7900 in parking fines via your credit card and suggests you open an -attached- file to view details... claims to be from the NYC Department of Finance... Opening the attached .zip file will reveal a malicious .exe file. If you then click-the-.exe file, -malware- may be installed on your computer. The exact type of malware varies..."
Lenovo - vulnerable to HTTPS Spoofing
Feb 20, 2015 - "Lenovo consumer personal computers employing the pre-installed Superfish Visual Discovery software contain a critical vulnerability through a compromised root CA certificate. Exploitation of this vulnerability could allow a remote attacker to read -all- encrypted web browser traffic (HTTPS), successfully impersonate (spoof) any website, or perform other attacks on the affected system. US-CERT recommends users and administrators review Vulnerability Note VU#529496* and US-CERT Alert TA15-051A** for additional information and mitigation details."
Feb 20, 2015 - "... Solution: The CERT/CC is currently unaware of any official solutions to this problem and recommends the following workarounds.
- Uninstall Komodia Redirector SDK and associated root CA certificates
- Uninstall any software that includes the Komodia Redirector and SSL Digestor libraries..."
Feb 20, 2015 - "... Solution: Uninstall Superfish VisualDiscovery and associated root CA certificate
- Uninstall any software that includes the Komodia Redirector and SSL Digestor libraries. In the case of Lenovo PCs, this includes Superfish Visual Discovery.
It is also necessary to remove affected root CA certificates. Simply uninstalling the software does not remove the certificate. Microsoft provides guidance on  deleting (link is external) and  managing (link is external) certificates in the Windows certificate store. In the case of Superfish Visual Discovery, the offending trusted root certification authority certificate is issued to “Superfish, Inc.”
Mozilla provides similar  guidance for their software, including the Firefox and Thunderbird certificate stores."
Feb 20, 2015 - "... To find out if you are affected, you can visit:
- https://filippo.io/Badfish/ "
Edited by AplusWebMaster, 23 February 2015 - 05:09 AM.