Jump to content


Photo

SPAM frauds, fakes, and other MALWARE deliveries...


  • Please log in to reply
1776 replies to this topic

#1751 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 21 July 2016 - 04:22 PM

FYI...

'Authorize your Twitter account' - phishing scam
- https://blog.malware...-phishing-scam/
July 21, 2016 - "... a phish targeting people who desire Twitter verification. The fake site, located at
twitterverifiy(dot)verifiy(dot)ml
... poses as an app to be authorised, but is simply out to -steal- login credentials. Take note of the rather unique spelling of “verify” in the URL, too:
> https://blog.malware...itter-phish.jpg
After hitting the “Authorize app” button, the victim is redirected off to the real Twitter website. At this point, the scammers are free to do what they like with the stolen account. One assumes the scammers behind this one aren’t really paying attention to who they send their messages to (and the screenshot cuts off the username of the spam account, so we can’t see what else they’re up to). Suffice to say, if you have your Direct Messages open to all then potentially you could receive a missive such as the one above. Verification has a specific process attached to it, and although it’s currently changing, you definitely won’t get  a blue tick next to your Username by giving permission to phish pages posing as non-existent apps. No matter who you are, now matter how involved in issues of privacy and / or security you may be, there’s always the possibility you could get caught out by a clever scam. Keep your wits about you, and steer clear of “too good to be true” offers..."
 

:ph34r: :ph34r:   :grrr:


.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1752 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 22 July 2016 - 10:16 AM

FYI...

Fake 'sorry' SPAM - malicious attachment
- http://blog.dynamoo....rry-that-i.html
22 July 2016 - "This spam has a malicious attachment:
    From: "Lizzie Carpenter"
    Subject: sales report
    Date: Fri, 22 Jul 2016 21:38:25 +0800
    I am truly sorry that I was not available at the time you called me yesterday.
    I attached the report with details on sales figures.
    Best of luck,
    Lizzie Carpenter
    SCHRODER GLOBAL REAL ESTATE SEC LTD ...


The sender is randomly generated. Attached is a ZIP file combining elements of the recipients email address and a random number, which in turn contains a malicious .wsf script beginning with "sales report". In a change from recent malware runs, the script does -not- directly download a binary from a remote location but instead has the entire binary executable Base64 encoded in the script. This executable has a detection rate of 4/54* and trusted analysis says that it is Locky ransomware, phoning home to:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (Marosnet, Russia)
176.111.63.51/upload/_dispatch.php (United Networks of Ukraine Ltd, Ukraine)
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
176.111.63.51
"
* https://virustotal.c...sis/1469197692/
___

Fake 'Fedex label' SPAM - .docm leads to Locky
- https://myonlinesecu...cky-ransomware/
22 July 2016 - "An email with the subject of 'PO5' pretending to come from Mary Leons <mary.leons@ airmenzies .com> with a malicious word doc attachment which downloads Locky ransomware... The email looks like:
From: Mary Leons <mary.leons@ airmenzies .com>
Date: Fri 22/07/2016 10:04
Subject: PO5
Attachment: 906569711935.docm
    Hi
    Please see Fedex label as attached
    Kindest Regards
    Mary Leons
    Customer Service Supervisor | Air Menzies International ...


22 July 2016: 906569711935.docm - Current Virus total detections 10/55*
.. MALWR** shows a download from http ://dillerator.chat .ru/09yhbvt4 (VirusTotal 6/53***).
Other download locations for today’s Locky version include [duplicate's removed]:

    http ://allmusic .c0.pl/09yhbvt4
allmusic .c0.pl: 95.211.144.65: https://www.virustot...65/information/
    http ://delta5.homepage.t-online .de/09yhbvt4
t-online .de:
2003:2:4:164:217:6:164:162
2003:2:2:40:62:153:159:92
217.6.164.162
: https://www.virustot...62/information/
62.153.159.92: https://www.virustot...92/information/
    http ://dillerator.chat .ru/09yhbvt4
chat .ru: 195.161.119.85: https://www.virustot...85/information/
    http ://files.igamingbusiness .co.uk/09yhbvt4
igamingbusiness .co.uk: 109.108.132.162: https://www.virustot...62/information/
    http ://fotouniek.grafi-offshore .com/09yhbvt4
grafi-offshore .com: 85.214.152.145: https://www.virustot...45/information/
    http ://hxt.50webs .com/09yhbvt4
50webs .com: 198.23.53.64: https://www.virustot...64/information/
    http ://mizosiri3.web.fc2 .com/09yhbvt4
fc2 .com: 52.41.146.181: https://www.virustot...81/information/
54.187.26.65: https://www.virustot...65/information/
    http ://okumachiryouin.yu-yake .com/09yhbvt4
yu-yake .com: 112.140.42.29: https://www.virustot...29/information/
    http ://pamm-invest .ru/09yhbvt4
pamm-invest .ru: 81.177.135.251: https://www.virustot...51/information/
    http ://tattoo-studio .nl/09yhbvt4
tattoo-studio .nl: 80.69.86.210: https://www.virustot...10/information/
    http ://www.gerichtszeichnungen .de/09yhbvt4
gerichtszeichnungen .de: 2a01:238:20a:202:1148::
81.169.145.148: https://www.virustot...48/information/
    http ://www.moran10.karoo .net/09yhbvt4
karoo .net: Could not find an IP address for this domain name.
    http ://www.silvotecna .co.cl/09yhbvt4
silvotecna .co.cl: Could not find an IP address for this domain name.
    http ://www.sirigor.republika .pl/09yhbvt4
republika .pl: 213.180.150.17: https://www.virustot...17/information/
 

... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1469178299/

** https://malwr.com/an...DdjODViYmNiOGU/
Hosts
195.161.119.85

*** https://www.virustot...sis/1469188310/
 
dillerator.chat .ru: 195.161.119.85: https://www.virustot...85/information/
>> https://www.virustot...6bb6c/analysis/
___

Fake 'Invoice/Credit/Statement' SPAM - leads to Locky
- https://myonlinesecu...leads-to-locky/
22 July 2016 - "... an email with the subject of 'VP Invoice/Credit/Statement – H10040' pretending to come from Prism Server Account <accounts@ vpplc .com> with a malicious word doc attachment which downloads Locky ransomware...
The email looks like:
From: Prism Server Account <accounts@ vpplc .com>
Date: Fri 22/07/2016 10:27
Subject: VP Invoice/Credit/Statement – H10040
Attachment: INVOICE.DOCM
    Please find document(s) attached.
    The attached file(s) are in Adobe PDF format. Use Adobe Acrobat Reader or equivalent to view the file(s)...


This attachment downloads the same Locky ransomware as described in this post* from the same locations... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://myonlinesecu...cky-ransomware/

___

HelpDesk Upgrade Outlook Web - PHISH
- https://myonlinesecu...b-app-phishing/
22 July 2016 - "... many small companies and even ISPs do outsource IT support and email to 3rd parties and an end user never really is sure who the email provider actually is... slightly more believable than many others and it is quite easy to fall for it...

Screenshot: https://myonlinesecu...il-1024x676.png

The -link- in the email goes to:
  http ://xprs.imcreator .com/free/icthelpdesk/password
... which looks like this:
> https://myonlinesecu...te-1024x535.png "

imcreator .com: 97.74.141.1: https://www.virustot....1/information/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 22 July 2016 - 12:43 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1753 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 25 July 2016 - 08:00 AM

FYI...

Fake 'Emailing: Photo - Document' SPAM - malicious attachment
- http://blog.dynamoo....25-07-2016.html
25 July 2016 - "This spam appears to come from various senders within the victim's own domain, but this is a simple forgery. It has a malicious attachment:
    From:    Rebeca [Rebeca3@ victimdomain .tld]
    Date:    25 July 2016 at 10:16
    Subject:    Emailing: Photo 25-07-2016, 34 80 10
    Your message is ready to be sent with the following file or link
    attachments:
    Photo 25-07-2016, 34 80 10 ...


Attached is a .rar archive with a name matching the subject. Inside is a malicious .js script beginning with "Photo 25-07-2016".
An alternative -variant- comes with a malicious -Word- document:
    From:    Alan [Alan306@ victimdomain .tld]
    Date:    25 July 2016 at 12:40
    Subject:    Emailing: Document 25-07-2016, 72 35 48
    Your message is ready to be sent with the following file or link
    attachments:
    Document 25-07-2016, 72 35 48 ...


The attachment is this case is a .DOCM filed named in a similar way as before. This analysis is done by my usual trusted source (thank you). These scripts and macros download a component... The payload here is Locky ransomware, and it phones home to the following addresses:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (Marosnet, Russia)
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
"

77.222.54.202: https://www.virustot...02/information/
>> https://www.virustot...cfca9/analysis/
194.1.236.126: https://www.virustot...26/information/
>> https://www.virustot...5138c/analysis/
185.117.153.176: https://www.virustot...76/information/
>> https://www.virustot...d49bd/analysis/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 25 July 2016 - 08:16 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1754 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 26 July 2016 - 06:51 AM

FYI...

Fake 'Attached Image' SPAM - leads to Locky
- http://blog.dynamoo....e-leads-to.html
26 July 2016 - "This spam appears to come from the user's own email address, but this is just a simple forgery. It has a malicious attachment.
    From:    victim@ victimdomain .tld
    To:    victim@ victimdomain .tld
    Date:    26 July 2016 at 10:27
    Subject:    Attached Image ...


Attached is a ZIP file with a name apparently made up of random numbers, containing a malicious .js script with another random number... In this example* the script downloads a malicious binary from:
www .isleofwightcomputerrepairs .talktalk .net/okp987g7v
There will be -many- other scripts with different download locations and perhaps other binaries. The file downloaded is Locky ransomware with a detection rate of 4/54**. The Hybrid Analysis*** for the dropped file shows it phoning home to:
31.41.47.41/upload/_dispatch.php (Relink Ltd, Russia)
91.234.35.216/upload/_dispatch.php (FOP Sedinkin Olexandr Valeriyovuch aka thehost.ua, Ukraine)
Recommended blocklist:
31.41.47.41
91.234.35.216
"
* https://malwr.com/an...WY0ZmFhZjEzZWY/
Hosts
62.24.202.31

** https://virustotal.c...daf25/analysis/

*** https://www.hybrid-a...vironmentId=100
Contacted Hosts
91.234.35.216
31.41.47.41


- https://myonlinesecu...-email-address/
26 July 2016 - "An email with the subject of 'Attached Image' pretending to come from your own email address with a zip attachment which downloads Locky Ransomware... One of the  emails looks like:
From: your own email address
Date: Tue 26/07/2016 10:22
Subject: Attached Image
Attachment: 0324923_02.zip ...


26 July 2016: 0324923_02.zip: Extracts to: 753707_02.js - Current Virus total detections 8/54*
.. MALWR** shows a download of xxxx from
 http ://exploromania4x4club .ro/okp987g7v?tKLWyjuj=PrkWVPasbrS which gave me lnHLopubGiz.exe (VirusTotal 5/54***).
Hybrid Analysis[4] . This is another one of the  files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1469524580/

** https://malwr.com/an...DdkMTNhNGY2OWM/
Hosts
89.42.216.118
*** https://www.virustot...sis/1469524971/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
89.42.216.118: https://www.virustot...18/information/
>> https://www.virustot...ac66e/analysis/
31.41.47.41: https://www.virustot...41/information/
91.234.35.216: https://www.virustot...16/information/
___

Fake 'list of activities' SPAM - leads to Locky
- http://blog.dynamoo....ties-leads.html
26 July 2016 - "This -fake- business spam has a malicious attachment:
    From     "Penelope Phelps"
    Date     Tue, 26 Jul 2016 23:02:43 +1100
    Subject     list of activities
    Hello,
    Attached is the list of activities to help you arrange for the coming presentation.
    Please read it carefully and write to me if you have any concern.
    Warm regards,
    Penelope Phelps
    ALLIED MINDS LTD
    Security-ID ...


The sender's name, company and 'Security-ID' vary. Attached is a ZIP file with elements of the recipient's email address in, containing a malicious .wsf script... This Malwr report* and this Hybrid Analysis** show this particular sample downloading from:
akva-sarat.nichost .ru/bokkdolx
There will be -many- other download locations in addition to this. The downloaded file is Locky ransomware with a detection rate of 8/55***. Further analysis is pending, however it is quite likely that this sample uses the -same- C2 servers as seen earlier today[4]."
* https://malwr.com/an...TdiYzRjMmY0NjQ/
Hosts
195.208.0.150

** https://www.hybrid-a...vironmentId=100
Contacted Hosts
195.208.0.150: https://www.virustot...50/information/
>> https://www.virustot...0300d/analysis/

*** https://virustotal.c...429e2/analysis/

4] http://blog.dynamoo....e-leads-to.html
___

Ransomware 2.0 ...
- http://www.techrepub...the-enterprise/
July 26, 2016 - ... profits from ransomware are making it one of the fastest growing types of malware and new versions could negatively impact entire industries, according to a Cisco report
"... Cisco used data from its customers to create the report, since there are more than 16 billion web requests that go through the Cisco system daily, with nearly 20 billion threats blocked -daily- and with more than 1.5 million unique malware samples daily, which works out to 17 new pieces of malware every second..."
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 26 July 2016 - 02:14 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1755 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 27 July 2016 - 05:33 AM

FYI...

Fake 'Sent from my Samsung' SPAM - leads to Locky
- http://blog.dynamoo....samsung_27.html
27 July 2016 - "This spam comes in a few different variations:
    From:    Lottie
    Date:    27 July 2016 at 10:38
    Subject:    scan0000510
    Sent from my Samsung device


The subject can be "SCAN", "scan" or "COPY" with a random number. Attached is a .DOCM file with a name that matches the subject. This file contains a malicious macro which downloads a component... The dropped file is Locky ransomware and it has a detection rate of 2/52*. It phones home to the following locations:
5.9.253.173/upload/_dispatch.php (Dmitry Zheltov, Russia / Hetzner, Germany)
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
(Thank you to my usual source for this data) There is nothing of value in the 5.9.253.160/27 range, and several IPs appear to have been hosting malware in the past.
Recommended blocklist:
5.9.253.160/27
178.62.232.244
"
* https://www.virustot...7dfda/analysis/

5.9.253.173: https://www.virustot...73/information/
>> https://www.virustot...5d145/analysis/
178.62.232.244: https://www.virustot...44/information/
>> https://www.virustot...e9b6e/analysis/
___

Fake 'updated details' SPAM - malicious attachment
- http://blog.dynamoo....is-updated.html
27 July 2016 - "This spam has a malicious attachment:
    Subject:     updated details
    From:     Faith Davidson (Davidson.43198@ optimaestate .com)
    Date:     Wednesday, 27 July 2016, 11:13
    Attached is the updated details about the company account you needed
    King regards
    Faith Davidson ...


The spam comes from different senders with a different hexadecimal number in it. Attached is a ZIP file with a random name, containing a malicious .wsf script. Analysis of a sample* shows the script download from:
beauty-jasmine .ru/6dc2y
There will be -many- more download locations in addition to that. It drops an executable which appears to be Locky ransomware with a detection rate of 7/55**. Analysis of this payload is pending, however the C2 servers may well be the same as found here***."
* https://www.hybrid-a...vironmentId=100
Contacted Hosts
195.208.1.120: https://www.virustot...20/information/
>> https://www.virustot...0ed8c/analysis/

** https://virustotal.c...a5de3/analysis/

*** http://blog.dynamoo....samsung_27.html
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 27 July 2016 - 02:46 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1756 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 28 July 2016 - 05:58 AM

FYI...

Fake 'invoice' SPAM - leads to Locky
- http://blog.dynamoo....k-attached.html
28 July 2016 - "This -fake- financial spam leads to malware:
    Subject:     Invoice
    From:     Kendall Harrison (Harrison.59349@ chazsmedley .com)
    Date:     Thursday, 28 July 2016, 10:33
    Hello,
    Please check the attached invoice and confirm me if I sent the right data
    Yours sincerely,
    Kendall Harrison
    320907cb16fbe856062a081d4f925b39cb3f007b8818d40dd3


The name of the sender and the hexadecimal number at the bottom varies. Attached is a randomly-named ZIP file which in the sample I analysed contains a malicious .wsf script beginning with the word "redacted". The Malwr analysis* for the partially deobfuscated script and this Hybrid Analysis** show this particular sample downloading from:
83.235.64.44/~typecent/xvsb58
This drops a malicious Locky ransomware binary with a detection rate of 7/55***. Analysis of this binary is pending.
UPDATE: Thank you to my usual source for this analysis... C2 locations:
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
193.124.180.6/upload/_dispatch.php (Marosnet, Russia)
139.59.147.0/upload/_dispatch.php (Digital Ocean, Germany)
Recommended blocklist:
178.62.232.244
193.124.180.6
139.59.147.0
"
* https://malwr.com/an...mM5Y2Q3NGQwNmM/
Hosts
83.235.64.44

** https://www.hybrid-a...vironmentId=100
Contacted Hosts
83.235.64.44: https://www.virustot...44/information/
>> https://www.virustot...fe541/analysis/

*** https://virustotal.c...23f9e/analysis/
___

Fake 'Self Billing Statement' SPAM - leads to Locky
- http://blog.dynamoo....-statement.html
28 July 2016 - "This -fake- financial spam comes with a malicious attachment:
    From     Kathryn Smith [kathryn@ powersolutions .com]
    Date     Thu, 28 Jul 2016 16:21:41 +0530
    Subject     Self Billing Statement


I do not know if there is any body text at present. Attached is a file with a name similar to 'Self Billing Statement_431.zip' which contains a similarly named malicious script (e.g. Self Billing Statement_4424.js).
Analysis by a trusted party shows that these scripts download a component...
This originally dropped this payload* since updated to this payload**, both of which are Locky ransomware.
The C2 servers to -block- are exactly the -same- as found in this earlier spam run***."
* https://www.virustot...95000/analysis/

** https://www.virustot...1f36d/analysis/

*** http://blog.dynamoo....k-attached.html
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 28 July 2016 - 07:48 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1757 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 29 July 2016 - 06:25 AM

FYI...

Fake 'Bank account record' SPAM - leads to Locky
- http://blog.dynamoo....cord-leads.html
29 July 2016 - "This -fake- financial spam leads to malware:
    Subject:     Bank account record
    From:     Stephen Ford (Ford.24850@ aworkofartcontracting .com)
    Date:     Friday, 29 July 2016, 10:56
    Good morning,
    Did you forget to finish the Bank account record?
    Read the attachment and let me know if there is anything I didn't make clear.
    Yours sincerely,
    Stephen Ford
    57ad5eceb5e68fe97525ff408e9da2ecda5a97be6743bbe0fe


The sender will vary from email to email, but the "From" name is always consistent with the one in the email. Attached is a ZIP file with a random hexadecimal number which in the sample I am looking at contains a malicious .wsf script starting with the words "account record"...

According to the Hybrid Analysis* on that script and Malwr report** on a partly deobfuscated version the script downloads a binary from:
oleanderhome .com/q59ldt5r
This dropped binary has a detection rate of 5/55*** and is presumably Locky ransomware, but automated analysis is inconclusive [1] [2]. The is also traffic to kassa.p0 .ru which is more of a puzzle and doesn't look particularly malicious****. I don't know if that is common to all scripts, but it might be worth looking out for in your traffic logs. If I get more information on this I will post it here."
* https://www.hybrid-a...vironmentId=100
Contacted Hosts
195.216.243.102
107.180.50.233


** https://malwr.com/an...DY4MzFlMTJhNGE/
Hosts
195.216.243.102: https://www.virustot...02/information/
107.180.50.233: https://www.virustot...33/information/
>> https://www.virustot...c0e6e/analysis/

*** https://virustotal.c...b0c13/analysis/

**** https://urlquery.net...d=1469786112022

1] https://www.hybrid-a...vironmentId=100

2] https://malwr.com/an...zVmOTE5MjZjMzA/

UPDATE: My trusted source (thank you) gives the following... C2 servers are the same as found here*.
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain .in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4 .biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti .ru]
Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139
"
* http://blog.dynamoo....-anonymous.html
29 July 2016
___

Fake 'Voicemail' SPAM - leads to Locky
- http://blog.dynamoo....-anonymous.html
29 July 2016 - "This -fake- voicemail spam has a malicious attachment:
    From     SureVoIP [voicemailandfax@ surevoip .co.uk]
    Date     Fri, 29 Jul 2016 17:47:41 +0700
    Subject     Voicemail from Anonymous <Anonymous> 00:02:15
    Message From "Anonymous" AnonymousCreated: Fri, 29 Jul 2016 19:45:15 +0900Duration:
    00:02:37Account: victimdomain .tld


The attachment is in the format msg_7b40ef3f-90a3-c2c7-2858-f9041f1023de.zip containing a malicious .wsf script with a name similar to account record =B5D=.wsf...
The downloaded binary is Locky ransomware, phoning home to:
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain .in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4 .biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti .ru]
Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139
"

178.62.232.244: https://www.virustot...44/information/
>> https://www.virustot...e9b6e/analysis/
91.195.12.143: https://www.virustot...43/information/
>> https://www.virustot...257dd/analysis/
91.230.211.139: https://www.virustot...39/information/
>> https://www.virustot...d29a4/analysis/
___

Recent Activity - RIG Exploit Kit
- https://atlas.arbor....index#233459834
July 28, 2016 - "... Analysis: In the wake of the disappearance of the previously successful Angler exploit kit and Nuclear Exploit Kit, cybercrime continues through other kits such as Neutrino, RIG, Sundown and others although campaign activity as recently as June has been lower volume compared to the time period when Angler and Nuclear were active... It is likely that this exploit kit traffic will increase over time, as prior users of other exploit kits migrate."
> https://blog.malware...-kit-campaigns/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 30 July 2016 - 08:47 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1758 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 01 August 2016 - 08:28 AM

FYI...

Fake 'Corrected report' SPAM - leads to Locky
- http://blog.dynamoo....w-attached.html
1 Aug 2016 - "This spam comes with a malicious attachment:
    Subject:     Corrected report
    From:     Joey Cox (Cox.48@ sodetel .net.lb)
    Date:     Monday, 1 August 2016, 13:37
    Dear webmaster,
    Please review the attached corrected annual report.
    Yours faithfully
    Joey Cox


The name of the sender will vary. Attached is a ZIP file with a random name, containing a malicious .WSF script beginning with "annual report". This attempts to download Locky ransomware (MANY locations listed)...
The dropped binary then attempts to phone home to:
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname evradikfreeopti.ru]
37.139.30.95/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname belyi.myeasy.ru]
91.219.29.48/upload/_dispatch.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
The host for that last one comes up over and over again, it's time to -block- that /22.."
Recommended blocklist:
91.230.211.139
37.139.30.95
91.219.28.0/22
"

91.230.211.139: https://www.virustot...39/information/
>> https://www.virustot...d29a4/analysis/
37.139.30.95: https://www.virustot...95/information/
>> https://www.virustot...d5508/analysis/
91.219.29.48: https://www.virustot...48/information/
>> https://www.virustot...c8257/analysis/
___

Google featured snippets abused by SEO scammers
- https://blog.malware...y-seo-scammers/
Aug 1, 2016 - "... online crooks are abusing Google’s featured snippets via compromised-websites that -redirect- to -bogus- online stores. A featured snippet is triggered when a user types in a question via a standard search. Google will display a block with a summary of the answer and a link to the site, on top of the regular search results. Because of this prominent placement, Blackhat SEO miscreants are extremely interested in featured snippets as they can capture a large amount of traffic and redirect it to any site of their choosing. In this particular case, a hacked Hungarian sports site (which has nothing to do with software or license keys) is used to game Google’s algorithm which programmatically determines that a page contains a likely answer to the user’s question. People who click-on-the-link will be -redirected- to cheapmicrosoftkey[.]com a site that offers various license keys for Microsoft products at ‘discounted’ prices. Buying from such dubious online shops is -never- a good idea as you might actually purchase stolen merchandise, or worse, get completely scammed:
> https://blog.malware...low_snippet.png
... In an added twist, if you visited the Hungarian website directly, you would be -redirected- to the Neutrino exploit kit and get infected with the CrypMIC ransomware. This is a good example of the multiple ways criminals can monetize a -hacked- site. It is quite likely in this case that the site was hacked several different times in unrelated automated attacks, perhaps even via the same vulnerability... As an end user, beware of online deals that sound too good to be true. This example is particularly tricky as people would be inclined to trust their search engine for showing them the answer to their question. We have reported this particular abuse to the Google team."
IOC:
IP: 185.139.238.210: https://www.virustot...10/information/

cheapmicrosoftkey[.]com: 185.139.238.210
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 02 August 2016 - 06:14 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1759 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 02 August 2016 - 07:38 AM

FYI...

Fake 'Paid bills' SPAM - leads to Locky
- http://blog.dynamoo....ached-last.html
2 Aug 2016 - "This -fake- financial spam has a malicious attachment:
    From:    Nathanial Lane
    Date:    2 August 2016 at 12:05
    Subject:    Paid bills
    Hello [redacted],
    Please see the attached last month’s paid bills for the company
    Best regards
    Nathanial Lane


The name of the sender varies. It appears that these are being sent out in very-high-volumes. Attached to the email message is a randomly-named ZIP file which contains a malicious .js script beginning with "sales charts".
Thank you to my usual source for this analysis: the script downloads... (from MANY locations)...
The payload is Locky ransomware, phoning home to:
37.139.30.95/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname belyi.myeasy .ru]
93.170.128.249/upload/_dispatch.php (Krek Ltd, Russia)
Recommended blocklist:
37.139.30.95
93.170.128.249
"

37.139.30.95: https://www.virustot...95/information/
>> https://www.virustot...d5508/analysis/
93.170.128.249: https://www.virustot...49/information/
Country: RU
___

Fake 'Unable to deliver' SPAM - leads to ransomware
- http://blog.dynamoo....liver-your.html
2 Aug 2016 - "This -fake- FedEx email has a malicious attachment.
    From:    FedEx International Ground [terry.mcnamara@ luxmap .com]
    Date:    2 August 2016 at 18:53
    Subject:    [REDACTED], Unable to deliver your item, #000179376
    Dear [Redacted],
    This is to confirm that one or more of your parcels has been shipped.
    Please, open email attachment to print shipment label.
    Thanks and best regards,
    Terry Mcnamara,
    Support Manager.


Attached is a ZIP file FedEx_ID_000179376.zip which contains a malicious script FedEx_ID_000179376.doc.js which is highly obfuscated but which becomes clearer when deobfuscated. This Hybrid Analysis* on the sample shows that the script downloads -ransomware- from opros.mskobr .ru but a quick examination of the code reveals several download locations:
opros.mskobr .ru
alacahukuk .com
www .ortoservis .ru
aksoypansiyon .com
samurkasgrup .com
Three of those domains are on the same IP (77.245.148.51), so we can assume that the server is completely compromised. If we extend that principle to the other servers then you might want to block traffic to:
195.208.64.20 (ROSNIIROS, Russia)
77.245.148.51 (Bilisim Teknolojileri Yazilim San. Tic. Ltd. Sti., Turkey)
5.101.153.32 (Beget Ltd, Russia)
A couple of binaries are dropped onto the system, a.exe (detection rate 2/53)** [may not be malicious] and a2.exe (detection rate 7/53)***.
The payload seems to be Nemucod/Crypted or some related ransomware.
Recommended blocklist:
195.208.64.20
77.245.148.51
5.101.153.32
"
* https://www.hybrid-a...vironmentId=100
Contacted Hosts
195.208.64.20

** https://www.virustot...sis/1470163333/

*** https://www.virustot...sis/1470163336/
___

Tech Support Scams - two for one ...
- https://blog.malware...e-price-of-one/
Aug 2, 2016 - "... Running an executable file posing as an installer for “VMC Media Player”, we were greeted by these prompts telling us we were going to be logged off:
> https://blog.malware.../warning1-1.png
..
> https://blog.malware...07/warning3.png
— and this site opening in our default browser:
> https://blog.malware.../warning2-1.png
Since yolasite .com offers users the option to track visitors to their sub-domain, we suspect this site to be built to keep track of the people that installed the “software”. We have reported this site to Yola and are awaiting a reply. This sequence of events is programmed in a simple batch file that opens the site and commands the computer to shut down in 5 minutes... Once the victims log back on, they will be confronted with this -fake- BSOD screen:
> https://blog.malware...6/07/main-2.png
The screen’s text rambles a lot about errors and Trojans and displays the phone-number they would like you to call. It also shows a seemingly unrelated prompt to “get the product key”, which we will discuss later on, and a button labeled “Microsoft Help” that opens the site www[dot]microsoft[dot]aios[dot]us:
> https://blog.malware...016/07/site.png
Here you can download remote administration tools to get ”support” for a great variety of products. We have seen complaints about the people running this site and its predecessors for at least two years. The site shows a prompt that is a bit unclear about your options:
> https://blog.malware.../07/choices.png
The listed options are YES to “Start Support Session” or NO to “Browse Support Site”, but the buttons are labeled OK and Cancel. I tested for you, and Cancel gets rid of the pop-up. And if you allow more pop-ups and click OK a few times, you will eventually get the option to download the legitimate remote administration tool TeamViewer.
And the second Tech Support Scam? Ah yes, let’s circle back to the prompt that promised us a product key:
> https://blog.malware.../getthenext.png
Click OK on that one, and you will see a download prompt for a file called license_key.exe:
> https://blog.malware...loadfromrun.png
This file has been reported to Mediafire. If you run this file, you may get some déjà vu feelings as you will see the “Thank you” prompt to notify that you will be logged off and visit another Yola site, this time it’s thankyou1234[dot]yolasite[dot]com using the URL shortener lnk.direct. Statistics of the URL shortener showed it was created 06/29/2016 and had 1143 visitors over the past month... The relatively good news about this repetition is that it will get rid of the fake BSOD for you because it alters the Winlogon Shell registry value yet again, only to replace it with -another- Tech Support Scammers -lock-screen- however. This time one that looks a lot like some of the earlier ones. A phone number and a form requesting “a product key”:
> https://blog.malware...6/07/main-3.png
Only this time it looks like you are completely -stuck- without any option. The part of the form that you would expect to fill out and the “Cancel” button are both unresponsive, so most people will end up having to use Ctrl-Alt-Del to get out of this. The name of the running processes for both rounds is fatalerror(.exe). We have dubbed the second one “Product Key” as that is the name of the folder it creates in Program Files (x86). But for the benefit of the Tech Support Scammers there is an “Easter egg” hidden in this screen. If you click -anywhere- in the 5th line (the one starting with the words “PRODUCT KEY”) you will go to this screen:
> https://blog.malware...heretheyare.png
... Summary: In what must be an attempt to drive victims crazy enough to call one of their numbers, Tech Support Scammers replace one logon lock-screen with another... save yourself the hassle and get protected."

yolasite[dot]com: 2400:cb00:2048:1::6810:69f9
2400:cb00:2048:1::6810:68f9
2400:cb00:2048:1::6810:67f9
2400:cb00:2048:1::6810:6af9
2400:cb00:2048:1::6810:6bf9

104.16.105.249: https://www.virustot...49/information/
104.16.106.249: https://www.virustot...49/information/
104.16.103.249: https://www.virustot...49/information/
104.16.107.249: https://www.virustot...49/information/
104.16.104.249: https://www.virustot...49/information/

aios[dot]us: 107.180.21.20: https://www.virustot...20/information/
>> https://www.virustot...a8b79/analysis/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 02 August 2016 - 04:50 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1760 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 03 August 2016 - 04:43 AM

FYI...

Fake 'project status report' SPAM - leads to Locky
- http://blog.dynamoo....ect-status.html
3 Aug 2016 - "This spam leads to Locky ransomware:
    From:    Keri Jarvis [Jarvis.64030@ bac.globalnet .co.uk]
    Date:    2 August 2016 at 22:13
    Subject:    report
    Hi,
    I attached the project status report in order to update you about the last meeting
    Best regards,
    Keri Jarvis


Attached is a randomly named ZIP file containing a malicious .js script beginning with the word "report". This downloads an evil binary... (MANY locations listed)...
(Thank you to my usual source for this data). The malware phones home to:
37.139.30.95/php/upload.php (Digital Ocean, Netherlands) [hostname: belyi.myeasy .ru]
93.170.128.249/php/upload.php (Krek Ltd, Russia)
93.170.104.20/php/upload.php (Breezle LLC, Netherlands) [hostname: pundik.rus.1vm .in]
Recommended blocklist:
37.139.30.95
93.170.128.249
93.170.104.20
"

37.139.30.95: https://www.virustot...95/information/
>> https://www.virustot...210fa/analysis/
93.170.128.249: https://www.virustot...49/information/
>> https://www.virustot...1a6b6/analysis/
93.170.104.20: https://www.virustot...20/information/
>> https://www.virustot...6537f/analysis/
___

Fake 'New invoices' SPAM - leads to Locky
- http://blog.dynamoo....ted-i-send.html
3 Aug 2016 - "Another day, another Locky ransomware run:
    From:    Marian Mcgowan
    Date:    3 August 2016 at 11:15
    Subject:    Fw: New invoices
    As you directed, I send the attachment containing the data about the new invoices


Attached is a randomly-named ZIP file which contains a highly obfuscated .js script which according to this Malwr analysis downloads a binary from..
blog-aida .cba .pl/2zensi7t
..when decrypted it creates a binary with a detection rate of 4/54*. That same Malwr analysis shows it phoning home to:
93.170.104.20/php/upload.php (Breezle LLC, Netherlands) [hostname: pundik.rus.1vm .in]
This IP was seen last night** and it seems that there is a concurrent Locky spam run phoning home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
89.108.127.160/php/upload.php (Agava, Russia) [hostname: srv1129.commingserv .com]
Both those IPs are in known-bad-blocks.
Recommended blocklist:
93.170.104.20
185.129.148.0/24
89.108.127.0/24
"
* https://virustotal.c...sis/1470220208/

** http://blog.dynamoo....ect-status.html

93.170.104.20: https://www.virustot...65/information/
>> https://www.virustot...6537f/analysis/

185.129.148.19: https://www.virustot...19/information/
89.108.127.160: https://www.virustot...60/information/
___

Fake 'Confirmation letter' SPAM - leads to Locky
- http://blog.dynamoo....tter-leads.html
3 Aug 2016 - "Another -spam- run leading to Locky ransomware..
    From:    Mavis Howe [Howe.4267@ croestate .com]
    Date:    3 August 2016 at 13:32
    Subject:    Confirmation letter
    Hi [redacted],
    I attached the employment confirmation letter I prepared.
    Please check it before you send it out.
    Best regards
    Mavis Howe


The name of the sender varies from email to email. The malicious attachment and payload seem very close to the one described here*."
* http://blog.dynamoo....ted-i-send.html
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 03 August 2016 - 09:01 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1761 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 04 August 2016 - 05:32 AM

FYI...

Fake 'business card' SPAM - leads to Locky
- http://blog.dynamoo....ard-i-have.html
4 Aug 2016 - "This spam email has a malicious attachment:
    From:    Glenna Johnson
    Date:    4 August 2016 at 10:18
    Subject:    Business card
    Hello [redacted],
    I have attached the new business card design.
    Please let me know if you need a change
    King regards,
    Glenna Johnson
    c75b53fd1ea488ebe8eaf068fd5c9dd13f1848f4d3a7


Sender names and that long hexadecimal number with vary. Attached is a randomly-named ZIP file containing a malicious .js script beginning with "business card"... The payload appears to be Locky ransomware. This Hybrid Analysis* of the script gives plenty of detail as to what is going on. My trusted sources tell me that the list of download locations is quite short:
escapegasmech .com/048220y5
goldjinoz .com/0a3tg
platimunjinoz .ws/13fo8lnl
regeneratewert .ws/1qvvu9lu
traveltotre .in/2c4ykij7
This drops a binary with a detection rate of 8/54**. The earlier Hybrid Analysis report shows it phoning home to:
31.41.46.29/php/upload.php (Relink Ltd, Russia) [hostname: ip.cishost .ru]
185.129.148.19/php/upload.php (MWTV, Latvia)
91.219.29.35/php/upload.php (FLP Kochenov Aleksej Vladislavovich aka uadomen .com, Ukraine) [hostname: 35.29.219.91.colo.ukrservers .com]
All of those network blocks have a pretty poor reputation and I recommend that you block their entire ranges.
Recommended blocklist:
31.41.40.0/21
185.129.148.0/24
91.219.28.0/22
"
* https://www.hybrid-a...vironmentId=100

** https://virustotal.c...sis/1470304914/
___

Fake 'Sheet/Document/Invoice' SPAM - .docm leads to Locky
- http://blog.dynamoo....t-document.html
4 Aug 2016 - "This malware-laden spam comes with a variety of subjects, for example:
Emailing: Invoice (79).xls
Emailing: Sheet (189).doc
Emailing: Sheet (3352).tiff
Emailing: Document (79).doc
Emailing: Invoice (443).doc
Emailing: Sheet (679).xls
Emailing: Document (291).pdf

There is -no- body text. Attached is a .docm file with the same prefix as the subject (e.g. Document (291).pdf.docm) which contains a macro that downloads a malicious component... (Thank you to my usual source for this). The payload is Locky ransomware and the C2 servers are those found here*."
* http://blog.dynamoo....ard-i-have.html
___

Fake 'Please sign' SPAM - leads to Locky
- http://blog.dynamoo....gn-receipt.html
4 Aug 2016 - "Yet another Locky campaign today..
    From:    Erica Hutchinson
    Date:    4 August 2016 at 12:34
    Subject:    please sign
    Dear [redacted]
    Please sign the receipt attached for the arrival of new office facilities.
    Best regards,
    Erica Hutchinson


This drops Locky ransomware through a malicious attachment. It appears to be largely the same as found in this earlier spam run*."
* http://blog.dynamoo....ard-i-have.html
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 04 August 2016 - 07:57 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1762 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 05 August 2016 - 06:01 AM

FYI...

Zeus Panda variant targets Brazil - wants to steal everything
- https://www.helpnets...als-everything/
Aug 5, 2016 - "A new Zeus Trojan variant dubbed Panda Banker has been specially crafted to target users of 10 major Brazilian banks, but also other locally popular services. 'Zeus Panda’s Brazilian configuration file has a notable local hue. Aside from including the URLs of major banks in the country, Panda’s operators are also interested in infecting users who access delivery services for a Brazilian supermarket chain, local law enforcement websites, local network security hardware vendors, Boleto payments and a loyalty program specific to Brazil-based commerce', IBM researchers* have found..."
* https://securityinte...ls-into-brazil/
Aug 4, 2016

Top Financial Malware per Attack Volume (Source: IBM Trusteer)
> https://static.secur...16_families.png
___

Fake Apple ‘Thank You For Your Order’ Phish
- http://www.hoax-slay...der-scam-email/
Aug 5, 2016 - "Email purporting to be from the Apple Store thanks you for your order of an iPhone and notes that you can click a cancel link if you did not make the order... The email is -not- from Apple and it does not reference a real Apple Store order. Instead, it is a phishing scam designed to steal your Apple ID and password, your credit card details, and other personal information:
> https://i0.wp.com/ww...rder-scam-2.jpg
According to this email, which purports to be from the Apple Store, your order of an Apple iPhone 5c is about to be dispatched. The email does not contain your shipping and billing address but rather those of a person you do not know. It also includes a ‘cancel order’ link’ . The email features the Apple logo and is quite professionally presented. However, the email is not from Apple. Instead, it is a phishing scam designed to steal your personal and financial information. When you receive the email, you may mistakenly believe that the person named as the recipient of the iPhone has hijacked your Apple Account and made purchases in your name. Therefore, your first reaction might be to click the ‘cancel’ link in the hope of dealing with the issue. If you do click-the-link, you will be taken to a fraudulent website designed to emulate the genuine Apple website. Once on the -fake- site, you will be asked to ‘login’ with your Apple ID and password. Next, you will be taken to a -bogus- ‘Cancel Order’ form that asks you to provide your credit card details and other personal and financial information. After submitting the requested information, you may be told that you have successfully cancelled the order. But, now, the criminals can steal the information that you supplied and use it to -hijack- your Apple account, commit credit card fraud in your name, and attempt to steal your identity..."
___

Walmart phish ...
- https://bgr.com/2016...ery-email-scam/
Aug 5, 2016 - "Over the past couple of days*, Walmart users have been seeing unsolicited password recovery emails pop up in their inboxes. There’s clearly something 'phishy' going on, but it doesn’t seem to be a simple hack: it’s likely the precursor to an ambitious phishing attack on Walmart .com users... a Walmart spokesperson confirmed that there’s an increase in password recovery emails, but doesn’t think that any accounts have been compromised — yet. Instead, Walmart thinks that a hacker is using Walmart’s password recovery system to prepare for a -future- phishing attack. Walmart’s password recovery system is like most others: input an email address, and it sends a recovery code to that email address. But unlike some others, Walmart’s system confirms or denies whether there’s a Walmart .com account associated with that email... Seeing the groundwork for a phishing attack being laid is worrying, but the steps for customers to remain safe are simple... Walmart’s spokesperson also emphasized that it’s 'very unlikely' that any user accounts have been breached so far, and all customers need to do in the future is remain vigilant. If you’re particularly concerned, you can change the email address and password associated with your Walmart account."
* https://bgr.com/2016...password-reset/
Aug 4, 2016
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 05 August 2016 - 03:33 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1763 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 08 August 2016 - 06:06 AM

FYI...

Fake 'Fraud Policy, Exceeded send Limit' SPAM - lead to Java Adwind Trojan
- https://myonlinesecu...malspam-emails/
8 Aug 2016 - "We continue to be plagued daily by fake financial themed emails containing java adwind attachments. I mentioned these HERE*. We have been seeing those emails almost every day and there was nothing to update. Today’s have stepped up a notch with multiple emails, subjects and slightly different subjects and email content to previous ones. There are 2 different Java Adwind versions in these emails...
* https://myonlinesecu...malspam-emails/
The first one of the  emails looks like:
From: admin@moneygram .ae
Date: Mon 08/08/2016 06:20
Subject: Attention To All Agents (Fraud Policy)
Attachment: Antifraud-policy.zip ( extracts to 2 identical files Antifraud-Agent-User-manual.jar and Antifraud-policy..jar )
Dear Agent,
Please find attached a self-explanatory letter and the Dodd-Frank Compliance,
Fraud Policy and Procedures which will be in effect from 20th January, 2016.
Please do not hesitate to revert to us should you require any further information.
Regards,
Senzo Dlamini
Regional Operations Executive
MoneyGram International ...


The next example looks like:
From: XM Accounts & Finance <xm.accounts@ xpressmoney .com>
Date: Mon 08/08/2016 07:58
Subject: Exceeded send Limit
Attachment: Settlement Sheet – Exceeded send Limit.zip ( extracts to Sendout Limit Exceded.jar and index.jpg which is a logo image for xpressmoney .com )
    Dear Sir/ Madam,
    It came to our notice that your agent terminal exceeded it’s send limit.
    As a result of this, We want you to verify your transaction report as attached.
    Respond urgently if you feel there is an error during our server computation.
    XM Accounts & Finance
    Xpress Money Services Ltd. | 8th Floor, Al Ameri Building TECOM
    P.O. Box 643996, Sheikh Zayed Road, Dubai, UAE ...


8 August 2016: Payment_Details_00H675B0017485.jar (119kb) - Current Virus total detections 30/55*  Payload Security**

8 August 2016: Antifraud-Agent-User-manual.jar (235kb) - Current Virus total detections 12/55***  Payload Security[4]

This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1470633115/

** https://www.hybrid-a...vironmentId=100
Contacted Hosts
23.231.23.176: https://www.virustot...76/information/

*** https://www.virustot...sis/1470633100/

4] https://www.hybrid-a...vironmentId=100
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 08 August 2016 - 06:10 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1764 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 09 August 2016 - 07:03 AM

FYI...

Fake 'Documents Requested' SPAM - leads to Locky
- https://myonlinesecu...pto-ransomware/
9 Aug 2016 - "An email with the subject of 'FW: Documents Requested' pretending to come from a random name at your own email domain with a malicious word doc attachment is another Locky/zepto ransomware dropper...
The email looks like:
From: random name at-your-own-domain
Date: Tue 09/08/2016 09:50
Subject: FW: Documents Requested
Attachment: Untitled(1).docm
    Dear [ your name ] ,
    Please find attached documents as requested.
    Best Regards,
    Lizzie


9 August 2016: Untitled(1).docm - Current Virus total detections 5/55*.. Payload security** shows a download of the encrypted Locky/zepto binary from www .fliegendergaertner .at/09uh8ny which gets converted to a working .exe file by the malicious macro in the original word doc. to give zorgins .exe
(VirusTotal 4/55***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1470732585/

** https://www.reverse....vironmentId=100
Contacted Hosts
81.19.145.43: https://www.virustot...43/information/
>> https://www.virustot...a2078/analysis/
159.203.182.129: https://www.virustot...29/information/
>> https://www.virustot...e23e6/analysis/
185.129.148.19: https://www.virustot...19/information/
>> https://www.virustot...760ca/analysis/
188.166.150.176: https://www.virustot...76/information/
>> https://www.virustot...26e20/analysis/

*** https://www.virustot...sis/1470733027/
___

Facebook Scams ...
- https://blog.malware...-hits-facebook/
Aug 9, 2016 - "... yet another celebrity death hoax. This time, the personality in question is Will Smith’s son, Jaden. Using one of our test accounts, below is a captured screenshot of what this Facebook post would look like if a user sees it in their feed:
> https://blog.malware...b-hoax-post.png
... (and) iwilltryeverything[DOT]site (pictured below), and clicking any of the five boxes claiming to contain the same news:
> https://blog.malware...eel-600x396.png
Also, clicking anywhere on the page redirects users to ads, which may not be ideal if you’re worried about malvertising. Users are then directed to a goaheadnow[DOT]press page. From here, two things can happen: one, the user may choose to scroll down and check out the video on that page or, two, the user can choose to -share- the -false- news straight away... Choosing to share the news straight away directs users to Facebook’s login page for them to enter their credentials, if they’re not logged in it already. And then, the site asks for the user permission to post on their wall:
> https://blog.malware...2016/08/005.png
... As more people share and spread such false news, the likelihood of others falling for online threats like scams and malware, or signing up for something they’d regret in the end also increases.If you see the Jaden Smith death “news” in your feed, inform the sharer that it’s a -hoax- and avoid sharing it further."

iwilltryeverything[DOT]site: 192.138.19.74: https://www.virustot...74/information/
>> https://www.virustot...43b86/analysis/

goaheadnow[DOT]press: 192.138.19.74

“Five Free Tickets” Facebook Scam
- http://www.hoax-slay...-facebook-scam/
Aug 8, 2016 - "Post being shared on Facebook claims that you can click to get 5 free tickets from UK based cinema chain Vue Cinemas. The post is fraudulent. It is not associated with Vue Cinemas and participants will never receive the promised movie tickets. The post is a -scam- designed to trick people into divulging their personal information on suspect survey websites:
> https://i2.wp.com/ww...book-scam-1.jpg
...  the post has no connection to the UK based cinema chain and those who participate will never receive the promised tickets. The post is designed to trick you into firstly spamming your friends with the same fraudulent giveaway and then submitting your personal information via decidedly dodgy “survey” websites..."
> https://i1.wp.com/ww...book-scam-2.jpg
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 09 August 2016 - 02:24 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1765 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 11 August 2016 - 07:59 AM

FYI...

Fake 'Scanned' SPAM - leads to Locky
- http://blog.dynamoo....scanned-by.html
11 Aug 2016 - "This spam has a malicious attachment:
    From:    Ashley [Ashley747@ victimdomail .tld]
    Date:    11 August 2016 at 11:13
    Subject:    New Doc 6-6
    Scanned by CamScanner
    Sent from Yahoo Mail on Android


The sender name and numbers in the subject vary, and it appears to come from within the sender's own domain (this is just a simple forgery). Attached is a malicious Word document with a name similar to New Doc 666-9.docm. A Hybrid Analysis* of one sample shows a download location of fcm-makler .de/4GBrdf6 and my sources (thank you) tell me that there are -many- others, giving the following list:
151 .ru/4GBrdf6
antonello.messina .it/4GBrdf6
fcm-makler .de/4GBrdf6
iceninegr.web.fc2 .com/4GBrdf6
mccrarys .us/4GBrdf6
momoselok .ru/4GBrdf6
sando.oboroduki .com/4GBrdf6
www .EastsideAutoSalvage .com/4GBrdf6
www .fasulo .org/4GBrdf6
www .halloweenparty.go .ro/4GBrdf6
www .tommasobovone .com/4GBrdf6
The malware is Locky ransomware, and it phones home to the following locations:
185.129.148.19/php/upload.php (MWTV, Latvia)
195.16.90.23/php/upload.php (WIBO International s.r.o., Ukraine) [hostname: vz1.hostlife .net]
136.243.237.197/php/upload.php (Hetzner, Germany)
Recommended blocklist:
185.129.148.0/24
195.16.90.23
136.243.237.197
"
* https://www.hybrid-a...vironmentId=100
Contacted Hosts
217.119.54.192: https://www.virustot...92/information/
>> https://www.virustot...5da1f/analysis/
185.129.148.19: https://www.virustot...19/information/
>> https://www.virustot...16e32/analysis/
195.16.90.23: https://www.virustot...23/information/
>>> https://www.virustot...69bf5/analysis/
136.243.237.197: https://www.virustot...97/information/
>> https://www.virustot...a2e73/analysis/
___

Fake 'Dear client' SPAM - malicious link
- https://myonlinesecu...k-word-malspam/
11 Aug 2016 - "A series of emails saying 'Dear client! We have detected the attempt of transaction from your bank account', coming from random senders with a -link- to a malicious word doc is another one from the current bot runs... Some of the subjects seen include:
    Detected suspicious transaction on your account
    Locked transaction
    Online Banking informs
    Barclays Personal Banking
    Incomplete transaction

One of the emails looks like:
From: yvvelez@ gracehill .org
Date:
Subject:  Detected suspicious transaction on your account
Attachment ( link ):  payment.doc
    Hello!
    Dear client! We have detected the attempt of transaction from your bank
    account. You may find details of the transaction in the
    http ://vividlightingandliving .com.au/bank-info/payment.doc
    Please download this document. If this transaction was yours, please,
    contact us via contacts in the loaded file. If this transaction was not
    yours, notify our safety service shortly. Contacts of the safety service
    may be found in the loaded file. Also, you can contact us through the
    Personal Account of your bank.
    Attention: if you ignore our request, your account will be blocked on
    20.08.2016.


Alternative download locations from other emails include:
 http ://guestlistalamode .com/bank/payment.doc: 192.185.75.239: https://www.virustot...39/information/
>> https://www.virustot...efe50/analysis/
 http ://www.1800cloud .com/infos/report.doc: 65.49.52.99: https://www.virustot...99/information/
>> https://www.virustot...51a04/analysis/
 http ://www.monparfum .it/payments/info.doc: 80.88.88.149: https://www.virustot...49/information/
>> https://www.virustot...7c39a/analysis/

11 August 2016: payment.doc - Current Virus total detections 2/53*.  MALWR** shows a download from
 http ://88.119.179.160 /1biycuhoqetzowaawneab.exe (VirusTotal 7/53***) MALWR[4]..

Update: I am informed that it appears to be 'Panda Banker' which is a banking password/credential stealer.
See Proofpoint[5] and Arbor[6] for more details of this new threat..."
5] https://www.proofpoi...hits-the-market
"... Some of the Panda Banker C&C servers use Fast flux DNS, and have numerous IP addresses associated with a single malicious domain, making the malware more resistant to counter-measures..."

6] https://www.arbornet...zeus-zeus-zeus/
"... Not only is it built on a proven banking malware platform (Zeus), there are already a number of samples and botnets in the wild. In addition, Panda Banker is actively being developed with 9 distinct versions known..."

* https://www.virustot...sis/1470917056/

** https://malwr.com/an...WM4NGYzZGJiNDU/
Hosts
88.119.179.160: https://www.virustot...60/information/
>> https://www.virustot...ecf53/analysis/

*** https://www.virustot...sis/1470916592/

4] https://malwr.com/an...zYzOTgwNGE0YzU/
Hosts
No hosts contacted.

vividlightingandliving .com.au: 192.185.37.232: https://www.virustot...32/information/
>> https://www.virustot...83754/analysis/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 11 August 2016 - 04:07 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1766 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 12 August 2016 - 06:40 AM

FYI...

Fake 'Xpress Money Certificate' SPAM - leads to JAVA Jacksbot
- https://myonlinesecu...ey-certificate/
12 Aug 2016 - "An email with the subject of 'New Xpress Money Certificate' pretending to come from akash.kushwah@xpressmoney .com <xm.ca@ xpressmoney .com> with a zip attachment which downloads a JAVA Jacksbot... This is a slight change to the usual java.jar files that are normally attached to these emails. Today’s version has a .exe file which is actually a SFX (self extracting RAR file) which extracts to an identically named .exe file which in turn when run drops the java files and runs them. AV detections call this one a Java Jacksbot rather than the “normal” Java Adwind we have been seeing in this sort of financial malspam.
One of the emails looks like:
From: akash.kushwah@ xpressmoney .com <xm.ca@ xpressmoney .com>
Date: Thu 16/06/2016 11:09
Subject: New Xpress Money Certificate
Attachment: New Xpress Money Certificate Signed And Sealed.exe
Dear Agent,
We have attached the New Certificate with installation details , Sign the branch seal on the attach authorization for security updates.
Best regards,
AKASH KUSHWAH | Xpress Money Operations
Xpress money services Ltd| P.O. Box 170,
Tel: +971 2 6580989 |Ex: 371 | Fax: +971 2 989564 ...


12 August 2016: New Xpress Money Certificate Signed And Sealed.exe - Extracts to: New Xpress Money Certificate Signed And Sealed..exe - Current Virus total detections 29/55*. MALWR**
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1470995213/

** https://malwr.com/an...TdmMWFkZWViYjc/
___

Fake 'scanner' SPAM - leads to Locky
- http://blog.dynamoo....-sent-from.html
12 Aug 2016 - "This spam comes with a malicious attachment:
    Subject:     Message from "CUKPR0317276"
    From:     scanner@ victimdomain .tld (scanner@ victimdomain .tld)
    To:     webmaster@ victimdomain .tld
    Date:     Friday, 12 August 2016, 14:00
    This E-mail was sent from "CUKPR0329001" (Aficio MP C305).
    Scan Date: 17.11.2015 09:08:40 (+0000)
    Queries to: <scanner@ victimdomain .tld


The email appears to come from within the victim's own domain (but this is just a simple forgery). Attached is a ZIP file with a name similar to 201608120908.zip which contains a malicious .WSF script with a name similar to
doc(171)-12082016.wsf . This Hybrid Analysis* shows the script downloading a file from www .hi-segno .com/02bjJBHDs?WUubFbrItd=ratyCr (and also the same location on bonmoment.web.fc2 .com and www .homesplus .nf.net) but a trusted source tells me that the following download locations appear in different scripts... (see URL above for long list).
The malware phones home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
138.201.56.190/php/upload.php (Hetzner, Germany)
That Latvian network range is -all- bad, I recommend that you -block- the lot. The payload is Locky ransomware.
Recommended blocklist:
185.129.148.0/24
138.201.56.190
"
* https://www.hybrid-a...vironmentId=100
Contacted Hosts
213.205.40.169
138.201.56.190
185.129.148.19
208.71.106.49
216.251.43.11

___

ITunes, Netflix phishing
- https://myonlinesecu...tflix-phishing/
12 Aug 2016 - "The latest Apple/ITunes phish pretends to be confirmation of an ITunes order for Netflix.

Screenshot: https://myonlinesecu...ix-06285490.png

The links go to
 http ://hiperkarma .hu/download/g.html  where you are -redirected- to
 http ://margotbai .com/UnitedKingdom/Itunes/apple/ and see a page looking like this, where if you fill in the ID and password then asks for all other financial information:
> https://myonlinesecu...apple_phish.png "

hiperkarma .hu: 87.229.45.133: https://www.virustot...33/information/
>> https://www.virustot...6835f/analysis/
margotbai .com: 67.212.91.221: https://www.virustot...21/information/
>> https://www.virustot...b4543/analysis/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 12 August 2016 - 12:43 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1767 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 13 August 2016 - 09:41 AM

FYI...

Beware of browser hijacker - comes bundled with legitimate software
- https://www.helpnets...jacker-bing-vc/
Aug 12, 2016 - "Lavians, a 'small software vendor team' is packaging its offerings with a variant of browser-hijacking malware Bing .vc. The company sells and offers for free different types of software (drivers and other kinds of utilities) on their own website*, but also on popular download sites. Unfortunately, most of them come bundled with the aforementioned malware, which installs itself into Internet Explorer, Firefox, and Chrome -without- the user’s consent..."
* http:// www. lavians .com/product/

lavians .com: 45.79.77.19: https://www.virustot...19/information/
>> https://www.virustot...32bc3/analysis/
bing .vc: 65.75.147.228: https://www.virustot...28/information/
>> https://www.virustot...b46ed/analysis/
2016-08-13
___

Visa Alert - Oracle POS Breach
- http://krebsonsecuri...-oracle-breach/
Aug 13, 2016 - "Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle‘s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices. Visa also published a list of Internet addresses that may have been involved in the Oracle breach and are thought to be closely tied to an Eastern European organized cybercrime gang:
> http://krebsonsecuri.../VSA-oracle.png
The Visa alert is the first substantive document that tries to help explain what malware and which malefactors might have hit Oracle — and by extension many of Oracle’s customers... MICROS is among the top three point-of-sale vendors globally. Oracle’s MICROS division sells point-of-sale systems used at more than 330,000 cash registers worldwide. When Oracle bought MICROS in 2014, the company said MICROS’s systems were deployed at some 200,000+ food and beverage outlets, 100,000+ retail sites, and more than 30,000 hotels. In short, tens of millions of credit cards are swiped at MICROS terminals monthly, and a breach involving the theft of credentials that might have granted remote access to even just a small percentage of those systems is potentially a big and costly problem for all involved:
> http://krebsonsecuri...osp-580x476.png "
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 13 August 2016 - 06:08 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1768 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 15 August 2016 - 06:06 AM

FYI...

Fake 'Order Confirmation' SPAM - leads to Locky
- http://blog.dynamoo....onesabcouk.html
15 Aug 2016 - "This -fake- financial spam does -not- come from ESAB but is instead a simple -forgery- with a malicious attachment.
    From:    orderconfirmation@ esab .co.uk
    Date:    15 August 2016 at 10:37
    Subject:    Order Confirmation-7069-2714739-20160815-292650 ...


Attached is a file with a name similar to Order_Confirmation-7069-2714739-20160815-292650.docm which contains a malicious macro. There are various versions, which according to my source (thank you) download a component...
The payload is Locky ransomware with a very low detection rate* at present. It phones home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
138.201.56.190/php/upload.php (Hetzner, Germany)
46.148.26.77/php/upload.php (Infium UAB, Ukraine)
The MWTV block is -all- bad. Recommended blocklist:
185.129.148.0/24
138.201.56.190
46.148.26.77
"
* https://www.virustot...e21c5/analysis/
File name: ferdoxs.exe
Detection ratio: 1/55

138.201.56.190: https://www.virustot...90/information/
>> https://www.virustot...0c05b/analysis/
46.148.26.77: https://www.virustot...77/information/
>> https://www.virustot...cd79a/analysis/

- https://myonlinesecu...cky-ransomware/
15 Aug 2016 - "An email with the subject of 'Order Confirmation-9355-8379094-20160815-474623' pretending to come from orderconfirmation@ esab .co.uk with a malicious word doc attachment downloads Locky ransomware...
The email looks like:
From: orderconfirmation@ esab .co.uk
Date: Mon 15/08/2016 10:33
Subject: Order Confirmation-9355-8379094-20160815-474623
Attachment: Order Confirmation-9355-8379094-20160815-474623.docm ...


15 August 2016: Order Confirmation-9355-8379094-20160815-474623.docm - Current Virus total detections 7/56*
There are several different versions of this Locky downloader which all download an encrypted data file that is transformed by the macro to the same Locky Ransomware (virustotal 4/54*)..."
* https://www.virustot...sis/1471258818/

** https://www.virustot...e21c5/analysis/
___

Fake from 'Emma Critchley' SPAM - leads to Locky
- http://blog.dynamoo....-critchley.html
15 Aug 2016 - "This -fake- financial spam has a malicious attachment. It does -not- come from Advantage Finance but is instead a simple forgery.
    Subject:     Emailing - 9104896607509
    From:     Emma Critchley (emmacritchley@ advantage-finance .co.uk)
    Date:     Monday, 15 August 2016, 13:28
    Hi
    Vicky has asked me to forward you the finance documents (Please see attached)
    Many Thanks 


Attached is a DOCM file with a name that matches the subject. There are various versions, all of which download Locky ransomware... This phones home to the same servers as mentioned in this post*."
* http://blog.dynamoo....onesabcouk.html
___

Fake 'Documents' SPAM - leads to Locky
- http://blog.dynamoo....-officecom.html
15 Aug 2016 - "These -fake- financial documents have a malicious attachment:
    From:    Jen [Jen@ purple-office .com]
    Date:    15 August 2016 at 14:10
    Subject:    Documents from Purple Office - IN00003993
    Please find attached invoice/credit from Purple Office.
    Best regards,
    Purple Office


Attached is a randomly-named DOCM file which is almost definitely a variant of Locky ransomware as seen here[1] and here[2]."
1] http://blog.dynamoo....-critchley.html

2] http://blog.dynamoo....onesabcouk.html

- https://myonlinesecu...cky-ransomware/
15 Aug 2016
> https://malwr.com/an...GFiOGMwNWViNzI/
Hosts
80.150.6.138: https://www.virustot...38/information/
>> https://www.virustot...d79d7/analysis/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 15 August 2016 - 11:14 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1769 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 16 August 2016 - 05:36 AM

FYI...

Fake 'Scan/Document/Receipt' SPAM - leads to Locky
- https://myonlinesecu...cky-ransomware/
16 Aug 2016 - "Today’s first Locky ransomware example is a blank/empty email with the subject saying something like 'File: Scan(86)' or 'Emailing: Document(2)' or 'Emailing: Receipt(8)' [random numbered] or other similar generic subjects pretending to come from random names at your own email domain with a zip attachment containing a random numbered WSF (script file) which downloads an encrypted Locky ransomware version that gets converted by the script file to a fully working .exe... One of the emails looks like:
From: Random names at your own email domain or company
Date: Tue 16/08/2016 10:11
Subject: File: Scan(86)
Attachment: Scan(86).zip


Body content: Totally blank/empty

16 August 2016: Scan(86): Extracts to: 572310451803.wsf - Current Virus total detections 3/56*
.. MALWR** shows a download of an encrypted file from one of these 3 locations (there will be multiple others) that is transformed by the script to eaoJlwhPcR.exe (random depending on the version you get) (VirusTotal 3/56***)
http ://zarexbytonia.cba .pl/nJHbj0266b?coHDErXiOn=ldRhoj
http ://fereastrazmeilor .go.ro/nJHbj0266b?coHDErXiOn=ldRhoj
http ://www .lefaos.50webs .com/nJHbj0266b?coHDErXiOn=ldRhoj
... This is another one of the  files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1471338738/

** https://malwr.com/an...WFmYjJhYmJiNTA/
Hosts
192.151.153.26
81.196.20.134
95.211.144.65


*** https://www.virustot...sis/1471340178/
___

ITunes Phish
- https://myonlinesecu...lot-premium-hd/
16 Aug 2016 - "The latest Apple/ITunes phish pretends to be confirmation of an ITunes order for CoPilot premium HD.

Screenshot: https://myonlinesecu...ot-1024x654.png

The links go to
 http ://monthlyincomeformula .com/.GB/db/ where you are -redirected- to
 http ://missclaudia .net/.GB/apple-store-refund/appsrefund/ and see a page looking like this, where -if- you fill in the ID and password then asks for all other financial information:
> https://myonlinesecu...st-1024x555.png "

monthlyincomeformula .com: 162.144.84.124: https://www.virustot...24/information/

missclaudia .net: 174.136.50.43: https://www.virustot...43/information/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 16 August 2016 - 06:37 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1770 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 17 August 2016 - 06:43 AM

FYI...

Cerber ransomware ...
- https://www.helpnets...mware-campaign/
Aug 17, 2016 - "Check Point’s research team has analysed the inner workings of Cerber, the world’s biggest ransomware-as-a-service scheme:
> https://www.helpnets...int-cerber2.jpg
... Cerber is set up to enable non-technical criminals to take part in the highly profitable business and run independent campaigns, using a set of command and control servers and an easy-to-use control interface available in 12 different languages... The Bitcoin is transferred to the malware developer and affiliates by flowing through thousands of Bitcoin wallets, making it almost impossible to trace individual payments... The overall profit made by Cerber in July was $195,000. The malware developer received approximately $78,000 and the rest was split between the affiliates, based on successful infections and ransom payments for each campaign. On a yearly basis, the estimated monthly profit for the ransomware author would be $946,000. 'This research provides a rare look at the nature and global targets of the growing ransomware-as-a-service industry' said Maya Horowitz, group manager, Research & Development, Check Point*. 'Cyber-attacks are no longer the sole essence of nation-state actors and of those with the technical ability to author their own tools; nowadays, they are offered to anyone and can be operated fairly easily. As a result, this industry is growing extensively, and we should all take the proper precautions and deploy relevant protections'.”
* http://blog.checkpoi.../16/cerberring/
"... researchers have managed to break the encryption of Cerber and provide a free decryption tool**..."
** https://www.cerberde...DecryptionTool/

Exploit Kit Country Distribution Map: https://blog.checkpo.../08/Figure9.jpg
___

'Bogus blue verified checkmark' SCAM - on Twitter
- https://www.hotforse...tter-16373.html
Aug 17, 2016 - "... Take, for instance, this -scam- which was being played out on Twitter last week:
> https://www.hotforse...scam-tweet.jpeg
If you saw it in your Twitter timeline, you might very well click on the link without thinking – imagining that the account is run by Twitter. After all, it is displaying the same avatar as the one used by the legitimate @verified account. And clicking on the link *does* take you to a website which – at first glance – might look like a genuine Twitter property to those -lacking- in caution:
> https://www.hotforse...-scam-site.jpeg
Clicking further, however, takes you to a form which should instantly set your alarm bells ringing. It asks you to enter information such as your email address and your number of followers (both pieces of information that Twitter should -already- know) as well as your username and password:
> https://www.hotforse...cam-site-2.jpeg
Once you fill your details in this form, they are instantly transmitted to the hackers – who can then use your credentials to hijack your account for the purposes of spam or spreading malicious links. Furthermore, if you have made the mistake of reusing your Twitter password elsewhere on the net there is a good chance that you may have other online accounts compromised by the hackers in follow-up attacks. I reported the phishing URL to Google, and I’m pleased to report that it is now being blocked by most browsers:
> https://www.hotforse...rome-block.jpeg
The offending Twitter account has also been suspended. There are a few lessons here...
Firstly, always be careful about where you enter your login credentials. Make sure that you are on the proper website by examining-the-URL-closely, and consider that one of the benefits of running a good password manager is that it will not let you easily fill in your password unless it recognises it.
Secondly, never-reuse-passwords on multiple websites. If one site gets hacked, online criminals will often try to use the same credentials to unlock your other online accounts.
Thirdly, harden your defences. Where available (as it is on Twitter) enable two-step verification or two-factor authentication to provide an additional layer of defence for your accounts. With 2SV or 2FA in place, hackers will need more than your password to break into your accounts making it – in most cases – something that they’ll simply not bother with, as they move to find softer targets."
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 17 August 2016 - 08:43 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1771 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 18 August 2016 - 09:40 AM

FYI...

Fake 'UPS' SPAM - leads to Locky
- http://blog.dynamoo....-is-having.html
18 Aug 2016 - "This -fake- UPS email has a malicious attachment. It appears to come from various countries UPS domains (e.g. ups.de, ups.co.uk), and from various senders.
    From     "Laurence lumb" [Laurence.lumb25@ ups .de]
    Date     Thu, 18 Aug 2016 17:35:21 +0530
    Subject     Emailing: Label
    Good afternoon
    The office printer is having problems so I've had to email the UPS label,
    sorry for the inconvenience.
    Cheers
    Laurence lumb


Attached is a ZIP file with a name beginning "Label" plus a random number. This contains a malicious .WSF script file that downloads Locky ransomware... (according to my trusted source)... This dropped binary has a detection rate of 6/54*. It phones home to the following locations:
185.129.148.19/php/upload.php (MWTV, Latvia)
51.255.107.8/php/upload.php (Webhost LLC Dmitrii Podelko, Russia / OVH, France)
194.67.210.183/php/upload.php (Marosnet, Russia)
Recommended blocklist:
185.129.148.0/24
51.255.107.8
194.67.210.183
"
* https://www.virustot...7e84e/analysis/
___

Locky Ransomware via DOCM attachments - latest Email campaigns
- https://www.fireeye....somwaredis.html
Aug 17, 2016 - "Throughout August, FireEye Labs has observed a few massive email campaigns distributing Locky ransomware. The campaigns have affected various industries, with the healthcare industry being hit the hardest based on our telemetry:
Top 10 affected industries
> https://www.fireeye....achong/Fig1.png
Numerous countries are affected, with the United States, Japan, and Republic of Korea topping the list:
Top affected countries
> https://www.fireeye....achong/Fig2.png
... Locky ransomware started being delivered via DOCM format email attachments more extensively beginning in August. This marks a change from the large campaigns we observed in March, where a JavaScript based downloader was generally being used to infect systems. These detection spikes and change in tactics suggest that the cybercriminals are investing more to infect systems and maximize their profits. Additionally, we have observed that the delivery of Dridex via this distribution channel seems to have stopped, or nearly so, which could explain why we are seeing the Locky uptick:
Massive DOCM related campaigns on Aug. 9, Aug. 11 and Aug. 15, 2016
> https://www.fireeye....achong/Fig3.png
Our analysis showed high similarity in the macro code that was used in the Aug. 9, Aug. 11 and Aug. 15 campaigns... The volume of Locky ransomware downloaders is increasing and the tools and techniques being used in campaigns are constantly changing. In this instance, we are seeing a shift from using a JavaScript based downloader to infect victims to using the DOCM format. On top of that, cybercrime trends have shown that attackers are distributing more ransomware these days than banking trojans, as the former appears to be more lucrative. These latest campaigns are a reminder that users must be cautious when it comes to opening attachments in emails or they run the risk of becoming infected and possibly disrupting business operations."
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 18 August 2016 - 10:11 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1772 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 19 August 2016 - 04:50 AM

FYI...

Fake 'Payment Receipt' SPAM - leads to locky
- https://myonlinesecu...cky-ransomware/
19 Aug 2016 - "... a long line of generic emails delivering Locky ransomware is an email with the subject of  'Payment Receipt' pretending to come from random companies and email addresses with a malicious word doc attachment... One of the emails looks like:
From:  Payment Receipt
Date: Fri 19/08/2016 10:43
Subject:  Payment Receipt
Attachment: PaymentReceipt.docm
    Attached is the copy of your payment receipt.


19 August 2016: PaymentReceipt.docm - Current Virus total detections 7/55*.. MALWR shows a download of an encrypted file from http ://wzukoees.homepage.t-online .de/897fyDnv which is converted by the malicious macro in the word doc to C:\DOCUME~1\User\LOCALS~1\Temp\sys48.tmp (VirusTotal 4/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1471600737/

** https://www.virustot...sis/1471600926/

t-online .de: 2003:2:4:164:217:6:164:162
2003:2:2:40:62:153:159:92

217.6.164.162: https://www.virustot...62/information/
62.153.159.92: https://www.virustot...92/information/
___

Fake 'Report' SPAM - leads to Java Adwind Trojan
- https://myonlinesecu...rs-java-adwind/
19 Aug 2016 - "We continue to see Java Adwind Trojans daily. Today’s example is a slight change to the delivery method from previous Malspam emails that have been using Moneyexpress .com or MoneyGram or other middle eastern money exchange bodies. This one is an email with the subject of 'Unclaimed Commission Report-WUBS' pretending to come from  Shiella F. Doria <shiella.doria@ westernunion .com> with a zip attachment which contains a Java.jar file & an image to make it look “respectable” and genuine. We have seen various -spoofed- Western Union malspam...

Screenshot: https://myonlinesecu...BS-1024x646.png

The image from inside the zip is:
- https://myonlinesecu...ment-Sheet.jpeg

19 August 2016: Unclaimed Commission Report.zip - Extracts to: UN-PROCESSED COMMISSION.jar
Current Virus total detections 30/56*. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1471508188/
___

Ransomware round up
- https://atlas.arbor....ndex#-198932443
Aug 18, 2016 - "... Analysis: ... ransomware developers and infrastructure providers who deliver the packages are continuing to refine their crafts. The addition of a RAT used to target potential banking elements instead of going forward with ransomware -extortion- is a smart addition. Most threat actors behind ransomware tend to utilize one flat ransom across their victim pool. However, some, notably those behind Locky, have paid attention to some of their victims and were able to extort larger sums than the original request once they identified the overall value of the victimized systems. A RAT could allow a smart threat actor to better access their target and move forward with requesting larger sums of money. However, it could simply allow threat actors to leverage more traditional capabilities by capturing banking credentials which in turn could allow them to perform fraudulent withdrawals with potentially larger payouts than had they attempted simple extortion efforts. Nemucod and Locky continue to change their overall operating procedures. The addition of ad-click and backdoor functionality to a ransomware operation can lead to additional revenue streams for threat actors, especially if the ransomware does not impact the -additional- malicious packages, allowing for them to operate unencumbered while the victim decides what course of action to take in response to the ransomware. Most ransomware is best defended against by -never- enabling-macros unless you implicitly trust the source... and maintaining up-to-date backups that are stored offline..."
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 19 August 2016 - 03:36 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1773 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 22 August 2016 - 08:02 AM

FYI...

Fake 'fax' SPAM - leads to Locky
- https://myonlinesecu...cky-ransomware/
22 Aug 2016 - "... first example of malspam word docs with macros delivering Locky ransomware is an email with the subject of 'Today’s fax' pretending to come from random names at your own email domain... The email looks like:
From: name/number at your own email domain
Date: Mon 22/08/2016 10:37
Subject: Today’s fax
Attachment: FAX_5542.DOCM


Body content:  Totally blank/empty

22 August 2016: FAX_5542.DOCM - Current Virus total detections 4/55*.. MALWR** shows a download of an encrypted file from http ://seiwa1202.web. fc2.com/HfgfvhTR5 that is converted by the malicious macro in the word doc to axilans.exe (VirusTotal 4/55***). Payload Security[4] shows this has anti-analysis protection... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1471858624/

** https://malwr.com/an...DRjMTY1N2ZlOGQ/
Hosts
208.71.106.61: https://www.virustot...61/information/
>> https://www.virustot...32839/analysis/

*** https://www.virustot...sis/1471859596/

4] https://www.hybrid-a...vironmentId=100
___

Fake 'Hello' SPAM - leads to Locky
- https://myonlinesecu...cky-ransomware/
22 Aug 2016 - "... next batch of malspam emails delivering locky ransomware is a series of emails with subjects like “Hi”, “Hi There” or “Hello” coming from random names, companies and email addresses with a zip attachment containing a WSF (Windows Scripting File)... The body has various generic phrases as the contents along the lines of:
“Please see the attached report about the monthly progress of our department”
“I am sending you the bills of the goods we delivered to you in the attachment"


22 August 2016: 5772ac1553.zip: Extracts to: export_pdf_ 2c23a43a~.js - Current Virus total detections 2/56*
.. MALWR was unable to get any content from the heavily encoded WSF file (waiting for other analysis but almost certain to be the same locations as Today’s Word version Malware delivery[1]). Payload Security** shows a load of connections to various sites... This is another one of the  files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1471860907/

** https://www.hybrid-a...vironmentId=100
Contacted Hosts
213.217.149.4
213.229.74.92
185.129.148.19
185.51.247.211
194.67.210.183
51.254.55.171
91.201.202.125


1] https://myonlinesecu...cky-ransomware/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 22 August 2016 - 08:22 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1774 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 23 August 2016 - 08:04 AM

FYI...

Fake 'Voice Message Notifications' deliver Ransomware
- https://isc.sans.edu...l?storyid=21397
2016-08-23 - "... a phone number and with modern communication channels ("Unified Communications") like Microsoft Lync or Cisco, everybody can receive a mail with a 'voice mail notification'. Even residential systems can deliver voice message notifications. Here is an example displayed in Microsoft Outlook:
> https://isc.sans.edu...t-voice-msg.gif
Today, I received a wave of emails like the following:
From: voicemail@ rootshell .be
To: [redacted]
Subject: [Vigor2820 Series] New voice mail message from 01422520472 on 2016/08/23 15:55:25
Dear [redacted]:
There is a message for you from 01422520472, on 2016/08/23 15:55:25 .
You might want to check it when you get a chance. Thanks!


The sender is spoofed with the victim domain name.... file was attached to the message... '.wav.zip' extension to lure the user. As usual, the payload is heavily obfuscated and the AV detection ratio is still very low (6/55 at 11:55:00 UTC)[1]. Vigor is UK company building ADSL residential modems[2]. This tends to think that the new wave is targeting residential customers. Here are the C2 servers (for your IDS):
89.42.39.81
213.205.40.169
51.254.55.171
194.67.210.183
185.51.247.211
185.129.148.19
91.201.202.125
"

[1] https://www.virustot...sis/1471949327/
File name: 614007286106.wsf
Detection ratio: 6/55

[2] http://www.draytek.c...gacy/vigor-2820
___

More Fake 'voice mail messages' SPAM - delivers Locky/Zepto
- https://myonlinesecu...pto-ransomware/
23 Aug 2016 - "Today’s Locky/Zepto ransomware malspam emails have come steadily in waves all day long. There have been 2 distinct different subjects and themes, one pretending to be a voice message from your own email domain or company, with the second pretending to be an audit report from a random company. The first is an email with the subject of '[Vigor2820 Series] New voice mail message' from 01443281097 on 2016/08/23 21:01:59 [random telephone number and date/time] pretending to come from voicemail @ your own email address with a zip attachment named something like 'Message_from_01443281097.wav.zip' where the attachment number matches the telephone number in the subject line. The Vigor 2820 Series is an older ADSL Router Firewall aimed at small business users, so we can quite easily see that this campaign of malware spreading is directly aimed at the small business user...

Screenshot: https://myonlinesecu...97-1024x426.png

The second campaign has a subject of 'Audit Report' coming from random senders with a content looking like the below. The name in the body of the email matches the spoofed sender. One of the  emails looks like:
From: Omer Scott <Scott.58115@ bambit .de>
Date: Tue 23/08/2016 15:3
Subject: Audit Report
Attachment: 83543cd11db.zip
    Dear lie
    The audit report you inquired is attached in the mail. Please review and transfer it to the related department.
    King regards,
    Omer Scott


23 August 2016: Message_from_01443281097.wav.zip: Extracts to: 44077640409.wsf
Current Virus total detections 23/56*.. MALWR** shows a download of an encrypted file from either
 http ://danzig.vtrbandaancha .net/HJghjb54?PqzwogvtP=xYWWDkr -or-
 http ://backyard004.web. fc2.com/HJghjb54?PqzwogvtP=xYWWDkr (in this example) which gets converted by the script to wKoYWwOtQ.exe (VirusTotal 6/56***)

23 August 2016: 83543cd11db.zip: Extracts to: audit report 316dd5a1.js
Current Virus total detections 23/56[4].. MALWR[5] shows a download of an encrypted file from either
 http ://sb-11856.fastdl-server .biz/688dak3, http ://newt150.tripod .com/idyeb9 -or-
 http ://dl.sevenseals .ru/ehaq1zw (in this example) which gets converted by the script to NCPcpOkuUfr5AA0.dll (VirusTotal 18/56[6])... This is another one of the  files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1441173827/

** https://malwr.com/an...DVhZmE2NTcxZGM/
Hosts
200.83.4.62
185.129.148.19
208.71.106.40


*** https://www.virustot...sis/1471961322/

4] https://www.virustot...sis/1441173827/

5] https://malwr.com/an...mNkNzA3MjA4NzM/
Hosts
109.230.252.172
52.52.39.236
77.221.140.226


6] https://www.virustot...sis/1471962605/
___

Fake 'Cancellation' SPAM - leads to Locky
- https://myonlinesecu...cky-ransomware/
23 Aug 2016 - "The next in the series of today’s Locky downloaders is an email with the subject of  'Cancellation' pretending to come from random senders with a zip attachment containing a JavaScript file that pretends to be a pdf... One of the emails looks like:
From: Zachary Flynn <Flynn.94@ football-stats .org>
Date: Tue 23/08/2016 19:00
Subject: Cancellation
Attachment: 2c122b8fa354.zip
    Dear rob,
    Attached is the paper concerning with the cancellation of your current credit card.
    Confirm to us for receiving.
    King regards,
    Zachary Flynn
    Account Manager ...


23 August 2016: 2c122b8fa354.zip: Extracts to: card_cancellation_pdf 5a59aad3.js
Current Virus total detections 4/56*.. MALWR** shows a download of an encrypted file from one of these locations
 http ://sopranolady7 .wang/1cntwk5 | http ://www.leuchten-modelle .de/ink36
 http ://download.apf .asso .fr/87aktsv | http ://gromasgboleslawiec .cba .pl/09n7n
... that is decrypted and transformed into P6dtp6pov8qB.dll (VirusTotal 6/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine  DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1471975535/

** https://malwr.com/an...zU0YTkzZTYyMTU/
Hosts
95.211.144.65
212.18.0.4
91.223.89.200
195.154.81.86


*** https://www.virustot...sis/1471977294/
___

File-in-the-middle Browser hijackers
- https://blog.malware...ddle-hijackers/
Aug 23, 2016 - "We are not sure if this is going to be a new trend among browser-hijackers, but it seems more than a coincidence that we found -two- browser hijackers using a very similar approach to reach their goal of taking victims to the sites of their choice. Both are using one of their own files to act as a file-in-the-middle between the user and the browser... Dotdo Audio: Dotdo is a strain of hijackers that we have discussed before for using different and more “out of bounds” methods to get the job done. I named this variant “audio” because it uses audio advertisements. But that is not our focus here. It’s the replacement of browser executables with their own that raised our interest. The installer -renames- the files firefox.exe and chrome.exe, if present, and adds a number to the filename. It then hides these renamed files and replaces them with its own files:
> https://blog.malware...8/hiddenexe.png
The screenshot above shows you the hidden and renamed Chrome file, in the same folder as the replacement. I changed the settings for hidden files so that we can see them. In a similar screenshot below we can see that the same was done for Firefox:
> https://blog.malware.../hiddenexe2.png
The browsers are -hijacked- to open with traffic-media[dot]co by altering the browser shortcuts for:
    Chrome
    Firefox
    Internet Explorer
    Opera
    Yandex
... Summary: We discussed two hijackers from very different families and using different methods, but they also had a few things in common. They want the victims to hear/see their advertisements and they used a file-in-the-middle between the browser shortcuts and the actual browser in order to alter the browsers behavior to meet their goals..."

traffic-media[dot]co: 195.154.46.150: https://www.virustot...50/information/
>> https://www.virustot...28854/analysis/
___

Email - Security battleground
- http://blog.trendmic...line-extortion/
Aug 23, 2016 - "Emails have become the battleground for the first half of the year in terms of security. It is the number one infection vector that have ushered in 2016’s biggest threats so far — ransomware and business email compromise (BEC). Ransomware infections normally start via email. Based on our findings, -71%- of the known ransomware families’ delivery method is through spam. Looking at the threat trends so far, both ransomware and BEC have proved profitable across the world:
Regional breakdown by volume of ransomware threats:
> https://blog.trendmi...61h-roundup.jpg
Regional breakdown by volume of organizations affected by BEC scams:
> https://blog.trendmi...61h-roundup.jpg
Our telemetry shows that ransomware’s scope is more widespread than BEC as it targets countries in Europe, Middle East, and Africa. The prevalence of BEC scams are higher in the North American region, with fewer countries but more targeted — attackers behind BEC scams most often impersonate and target C-level executives... 58% of the nearly 80 million ransomware threats Trend Micro blocked from January to June 2016 are email-borne ransomware. BEC scams, on the other hand, -all- arrive via email. These factors make the two threats quite formidable, as email remains a firm staple in everyday business. They both also utilize social engineering. In ransomware’s case, it’s for the user to click and run the ransomware attached to their opening email. For BECs, it’s to trick the targeted officer into thinking that their request for a money transfer is legitimate, without the usual malware payload... Knowing that these threats use email as an attack vector, companies should strengthen employee education and invest smartly in email protection. With these, the threat of ransomware and BEC attacks can be greatly reduced..."
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 23 August 2016 - 04:03 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1775 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 24 August 2016 - 05:44 AM

FYI...

Fake 'Statement' SPAM - delivers Locky
- https://myonlinesecu...cky-ransomware/
24 Aug 2016 - "This morning’s first Locky ransomware delivering malspam is an email with the subject of 'Statement' coming from random senders, companies and email addresses with a random named zip attachment  containing a JavaScript file that pretends to be a financial statement... One of the  emails looks like:
From: Ella Gonzales <Gonzales.169@ airtelbroadband .in>
Date: Wed 24/08/2016 10:34
Subject: Statement
Attachment: 25b8ae3a4d.zip
    Hi,
    The monthly financial statement is attached within the email.
    Please review it before processing.
    King regards,
    Ella Gonzales ...


24 August 2016: 25b8ae3a4d.zip: Extracts to: monthly_financial_scan aa9140e0.js
Current Virus total detections 2/56*.. MALWR** shows a download of an encrypted file from one of these locations:
 http ://rejoincomp2 .in/117uuf5h | http ://dokcool.atspace .org/jltqouz
 http ://smilehomeutsumi504.web. fc2.com/by11k6r ... that is converted by the JavaScript to o2OoILn8OHU.dll and autorun (VirusTotal 6/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1472031010/

** https://malwr.com/an...WFkNDQxNDgwYmE/
Hosts
82.197.131.109
208.71.106.49
213.229.74.92


*** https://www.virustot...sis/1472033919/
___

Fake 'Emailing: Image' SPAM - leads to Locky
- https://myonlinesecu...cky-ransomware/
24 Aug 2016 - "A blank email with the subject of 'Emailing: Image15.jpg' [random numbered] pretending to come from random senders at your own email domain or company with a zip attachment containing an encrypted  HTA file... This set of emails has a zip attachment that extracts to a HTA file... One of the  emails looks like:
From: Raymon <Raymon237@ Your email domain >
Date: Wed 24/08/2016 12:04
Subject: Emailing: Image15.jpg
Attachment: Image15.zip


Body content: Totally blank/Empty

24 August 2016: Image15.zip: Extracts to: 100966743304.hta - Current Virus total detections 2/56*
.. Payload Security** shows a download of the usual Locky encrypted file from a list of embedded URLs in the decrypted HTA/JavaScript file which is converted to xUztoLUte.exe by the instructions inside the HTA/JavaScript (VirusTotal 2/56***)... This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1472036751/

** https://www.hybrid-a...vironmentId=100
Contacted Hosts
112.140.42.29
213.205.40.169
200.83.4.62
185.129.148.19
51.254.55.171
185.51.247.211
194.67.210.183
91.226.92.208


*** https://www.virustot...sis/1472037488/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 24 August 2016 - 08:29 AM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1776 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 25 August 2016 - 04:44 AM

FYI...

Fake 'Fraud Notice' SPAM - Java Adwind Trojans
- https://myonlinesecu...c-xpress-money/
25 Aug 2016 - "... Java Adwind Trojans being delivered by various financial themed emails, we are seeing a new method of distribution of the Java Adwind Trojan using these financial themed emails with the subject of 'Request for Amendment'-XPIN- 2401200221508974 & 2401240241500561 (11) pretending to come from xm.support@ xpressmoney .com <XM SUPPORT> with a word doc attachment that contains the Java Adwind Trojan as an embedded OLE object... One of the emails looks like:
From: xm.support@ xpressmoney .com <XM SUPPORT>
Date: Request for Amendment-XPIN- 2401200221508974 & 2401240241500561 (11)
Subject: Request for Amendment-XPIN- 2401200221508974 & 2401240241500561 (11)
Attachment: Fraud Notice XM.doc
    Dear Sir/Madam,
    We would like to inform you that the transaction mentioned have been flagged from our system although the Xpress Money account is still under review. Please cancel and amend these transactions from your system at the earliest. Details of Transactions is been attached
    Thanks & Warm Regards,
    Prasanth Vasanth Pai
    Specialist Customer Support
    Xpress Money Services Ltd.
    PO Box 170, Abu Dhabi, UAE ...


Screenshot of attached word doc: https://myonlinesecu...oc-1024x419.png

25 August 2016: Fraud Notice XM.doc -  Current Virus total detections 23/56*. MALWR**
If you are unwise enough to double click the alleged pdf files that are -embedded- inside the word doc, then a JAVA.jar – Jacob.jar file will open & run (VirusTotal 23/56***)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1472103111/

** https://malwr.com/an...zVkMjc1YzJlYTQ/

*** https://www.virustot...sis/1472103307/

Earlier 'Java Adwind' posts: https://myonlinesecu.../?s=Java Adwind
___

BEC scams and ransomware
- https://www.helpnets...ware-bec-scams/
Aug 25, 2016 - "Trend Micro analyzed the trends in attacks and vulnerabilities seen throughout the first half of this year*, and found a rise and impact of attacks, such as a -172- percent increase in ransomware and $3 billion in losses due to business email compromise (BEC) scams so far in 2016..."
(More detail at the URL above.)
Charted: https://www.helpnets...ransomware1.jpg
* http://blog.trendmic...line-extortion/
Aug 23, 2016 - "... Based on our findings, 71% of the known ransomware families’ delivery method is through spam..."
* https://www.trendmic...reports/roundup
Aug 23, 2016 - "... The number of new ransomware families we saw in the first half of 2016 alone has already eclipsed the total 2015 volume by 172%. With ransomware attacks becoming more and more sophisticated and prevalent, we believe that the threat will potentially cause more damage going into the second half of the year..."
___

Tech support scams and Google Chrome tricks
- https://blog.malware...-chrome-tricks/
Aug 25, 2016 - "Tech support scams coming as phishing pages that contain -fake- alerts urging you to call for immediate assistance are common place these days. We collect -hundreds- of such URLs each day and have observed countless tricks to fool users...  for years we have been telling people to double check the URL in the address bar to know if a website is really what it claims to be. When this scam page loads it runs in full-screen mode and prevents the user from easily closing it with an infinite loop of alerts.
Now take a look at the address bar. For all intents and purposes it does look like the legitimate Microsoft website, although the ‘ru-ru’ (Russia) portion of the URL is a fail in an otherwise clever design. (There are other bits of Russian here and there in the source code, which perhaps link to the original author?):
> https://blog.malware...016/08/scam.png
... Tech support -scams- have similar alert windows except we found some that are completely made up. Putting a checkmark and clicking OK actually produces the opposite result of what you’d expect, to keep you more frustrated and ready to throw your computer out the window... It’s safe to say that browser-based tech support scams are not going anywhere any time soon. Sadly, most browsers are brought to their knees with simple bits of JavaScript and non savvy users will simply give up and call the toll free number for assistance (we forgot to mention that all this while a very annoying audio track plays in the background). Call centres located in India (for the most part) are receiving thousands of calls each day from desperate victims prime to be -defrauded- of hundreds of dollars by rogue operators playing the Microsoft technician game. Spotting those scams isn’t always easy though and that is why it’s important to expose them to show their inner workings. To learn more about tech support scams and consult our blacklist of known offenders, please check out our resource page here*."
* https://blog.malware...-support-scams/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 25 August 2016 - 02:10 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.


#1777 AplusWebMaster

AplusWebMaster

    AplusWebMaster

  • SWI Friend
  • PipPipPipPipPip
  • 10,394 posts

Posted 26 August 2016 - 10:53 AM

FYI...

Fake 'Voice Message' SPAM - delivers Locky/Zepto
- https://myonlinesecu...rs-locky-zepto/
26 Aug 2016 - "An email with the subject of 'Voice Message from Outside Caller (3m 54s) [random length]'  pretending to come from Peach Telecom <peach_necsv06@ hotmail .com> (random number after peach_necsv) with a zip attachment which downloads Locky/Zepto ransomware... One of the  emails looks like:
From: Peach Telecom <peach_necsv06@ hotmail .com>
Date: Fri 26/08/2016 12:21
Subject: Voice Message from Outside Caller (3m 54s)
Attachment: Outside Caller 08-26-2016 9aaf18b.zip
    Voice Message Arrived on Friday, Aug 26 @ 6:26 AM
    Name: Outside Caller
    Number: Unavailable
    Duration: 3m 54s ...


26 August 2016: Outside Caller 08-26-2016 9aaf18b.zip: Extracts to: 08-26-2016 36ptor06.wsf
Current Virus total detections 9/56*.. MALWR** shows a download of an encrypted file  from one of these locations:
 http ://sewarte.homepage. t-online .de/nb20gjBV?xJNXYWEr=xnGdqHz |
 http ://theramom.web. fc2 .com/nb20gjBV?xJNXYWEr=xnGdqHz |
 http ://seishinkaikenpo .com/nb20gjBV?xJNXYWEr=xnGdqHz
which is transformed by the script to LHOyUOaiiss1.dll (VirusTotal ***). All versions send info back to the control centre at http ://51.254.55.171/data/info.php ...
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1472210401/

** https://malwr.com/an...2QwYjdlOGNhMTI/
Hosts
210.157.30.70
208.71.106.46
80.150.6.138
51.254.55.171


*** https://www.virustot...sis/1472214673/
___

Fake 'P.O.' SPAM - delivers Locky
- https://myonlinesecu...cky-ransomware/
26 Aug 2016 - "The second batch of today’s Locky ransomware malspam emails is an email with the subject of
'office equipment' coming from random senders with a zip attachment... One of the  emails looks like:
From: Jillian Kirby <Kirby.84@ phantomes .com>
Date: Fri 26/08/2016 11:41
Subject: office equipment
Attachment: 609c171b94a.zip
    Dear wh,
    Please sign the attached purchase of the office equipment. We will send you back the receipt afterward.
    Best regards,
    Jillian Kirby
    Sales Manager


26 August 2016: 609c171b94a.zip: Extracts to: office_equipment ~bced3628.js
Current Virus total detections 4/56*.. MALWR** shows a download of an encrypted file from one of these locations,
 http ://onlybest76 .xyz/1rkyye | http ://all-rides .com/i0gih |
 http :// provincialpw .com/crgrapy | http ://www.mediawareonline .it/yvg6cw |
 http ://www.jansen-consultancy-machines .be/nvbd7rme that is transformed by the script to deliver AzWzM3LegeEcV6.dll (VirusTotal 14/58***). Payload Security[4].. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1472209948/

** https://malwr.com/an...WE3MDhiYmZjODA/
Hosts
195.130.132.84
104.232.35.136
160.153.54.35
173.255.129.128
212.104.43.3


*** https://www.virustot...sis/1472217004/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
160.153.54.35
212.104.43.3
188.127.249.203
138.201.191.196
51.254.55.171
91.226.92.208

___

Fake 'monthly report' SPAM - delivers Locky
- https://myonlinesecu...cky-ransomware/
26 Aug 2016 - "The third of today’s Locky ransomware malspam deliveries is an email with the subject of 'monthly report' coming from random senders, companies and email addresses with a zip attachment... One of the  emails looks like:
From: Tasha Ray <Ray.05187@ flamingjewellery .co.uk>
Date: Fri 26/08/2016 18:16
Subject: monthly report
Attachment: c1195a3663e.zip
    Good evening hyperbolasmappera,
    There were some errors in the monthly report you submitted last week.
    See the highlights in the attachment and please fix as soon as possible.
    Best regards,
    Tasha Ray
    Account Manager ... 


28 August 2016: c1195a3663e.zip: Extracts to: monthly_report_pdf (~41e8df8a).js
Current Virus total detections 6/56*.. MALWR** shows a download of an encrypted file from one of these locations:
 http ://berndburgdorf .de/5x6vdaw | http ://www.valmon .it/ndxec | http ://rejoincomp2 .in/3dv7n |
 http ://abufarha .net/80d4a1j  which is transformed by the script to lh7pIFrXtoRVDe.dll (VirusTotal 19/58***)...
This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1472235308/

** https://malwr.com/an...Tg2NmJjMGE0ZmU/
Hosts
212.40.179.94
104.232.35.136
213.205.40.169
66.147.240.193


*** https://www.virustot...sis/1472237184/
 

:ph34r: :ph34r:   :grrr:


Edited by AplusWebMaster, 26 August 2016 - 03:48 PM.

.The machine has no brain.
 ......... Use your own.
Browser check for updates here.
YOU need to defend against -all- vulnerabilities.
Hacks only need to find -1- to get in...
.





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button