Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
FYI...
Fake 'Credit Note' SPAM - JS malware leads to ransomware
- https://myonlinesecu...-to-ransomware/
22 Mar 2016 - "An email with the subject of 'Credit Note CN-73290' from On Semiconductor Corp for [redacted] (0312) pretending to come from Accounts <message-service@ post.xero .com> with a zip attachment is another one from the current bot runs which downloads ransomware... These don’t look like either Locky or Teslacrypt ransomware so it appears that another gang of bad actors are using the same email templates as the 2 prolific malspammers to spread their version of ransomware. One example of the email looks like:
From: Accounts <message-service@ post.xero .com>
Date: Tue, 22 Mar 2016 04:38:32
Subject: Credit Note CN-73290 from On Semiconductor Corp for [victim company ] (0312)
Attachment: Credit Note CN-73290.zip
Hi Kris,
Attached is your credit note CN-73290 for 52611.30 AUD.
This has been allocated against invoice number
If you have any questions, please let us know.
Thanks,
McKesson Corporation ...
22 March 2016: Credit Note CN-73290.zip: Extracts to: Credit Note CN-64451.js
.. Current Virus total detections 2/56*. MALWR** shows a download of some sort of ransomware from
http ://www .frontlinecarloans .com.au/public/js/bin.exe (VirusTotal 6/56***) (Hybrid Analysis [1]) (MALWR [2])
... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1458611843/
** https://malwr.com/an...zhjNzI3OWEyY2E/
Hosts
103.4.18.250: https://www.virustot...50/information/
>> https://www.virustot...2af2b/analysis/
104.27.151.145
23.99.222.162
*** https://www.virustot...sis/1458626108/
TCP connections
104.27.151.145
1] https://www.hybrid-a...environmentId=4
Contacted Hosts
104.27.150.145
2] https://malwr.com/an...GUwMDBlMmMwYzk/
Hosts
104.27.150.145
23.101.187.68
104.27.151.145
___
Fake 'Blank 2' SPAM - word macro malware leads to Dridex
- https://myonlinesecu...eads-to-dridex/
22 Mar 2016 - "An email with a completely blank / empty body with the subject of 'Blank 2' pretending to come from Steve Gale <steve1gales@ gmail .com> with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs... The email looks like:
From: Steve Gale <steve1gales@ gmail .com>
Date: Tue 22/03/2016 09:19
Subject: Blank 2
Attachment: Blank 2.docm
Body content: completely empty
22 March 2016: Blank 2.docm - Current Virus total detections 6/56*
.. MALWR** shows a download from http ://www .lightningstars .in/system/logs/87h76hghuhi.exe (VirusTotal 5/56***)
which is inconclusive but looks like Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1458638302/
** https://malwr.com/an...TNmZjFmMmVjOTM/
Hosts
162.144.73.194: https://www.virustot...94/information/
>> https://www.virustot...7f32f/analysis/
*** https://www.virustot...sis/1458637560/
___
Fake 'Statement' SPAM - JS malware leads to Locky Ransomware
- https://myonlinesecu...cky-ransomware/
22 Mar 2016 - "An email with the subject of 'FW: Statement S#327763' [random numbered] pretending to come from random names and email addresses with a zip attachment is another one from the current bot runs which downloads Locky Ransomware... One example of the emails looks like:
From: Luis Wagner <WagnerLuis4446@ newthoughtcenterofhawaii .com>
Date: Tue 22/03/2016 09:03
Subject: FW: Statement S#327763
Dear ans,
Please find attached the statement (S#327763) that matches back to your invoices.
Can you please sign and return.
Best regards,
Luis Wagner
Business Development Director
22 March 2016: statement_ans_327763.zip: Extracts to -3- .JS files - 2 are identical & 1 different
.. Current Virus total detections [1] [2]: MALWR* shows -both- download Locky Ransomware from
http ://alexsolenni .it/pol4dsf (VirusTotal 3/57**). This zip file contains -3- js files and an -unknown- file that when examined is actually empty... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
1] https://www.virustot...sis/1458641040/
2] https://www.virustot...sis/1458641075/
* https://malwr.com/an...GJmNGIzODA0ODI/
Hosts
178.237.15.128: https://www.virustot...28/information/
92.63.87.106: https://www.virustot...06/information/
** https://www.virustot...sis/1458641975/
TCP connections
92.63.87.106
___
Fake 'HP' SPAM - RTF macro malware leads to Dridex
- https://myonlinesecu...eads-to-dridex/
22 Mar 2016 - "An email that appears to come from HP (Hewlett Packard Enterprises) with the subject of 'Urgent: F400572 HARGREAVES LANSDOWN PLC/ HPE' coming from random names and email addresses with a malicious word doc RTF attachment is another one from the current bot runs...
Screenshot: https://myonlinesecu...PE-1024x906.png
5 March 2016: fillout_DAINV13955_derek.rtf - Current Virus total detections 1/57*
.. MALWR** shows a download from http ://connect.act-sat-bootcamp .com/dana/home.php
which gave me hpe.jpg (which is -renamed- .exe file and not any sort of image file) (VirusTotal 3/57***)
Detections are inconclusive but likely to be Dridex banking Trojan... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1458642936/
** https://malwr.com/an...jNjMTI2MjdhM2U/
Hosts
91.240.86.234: https://www.virustot...34/information/
>> https://www.virustot...b1072/analysis/
*** https://www.virustot...sis/1458642865/
___
Fake 'bodily injury' SPAM - JS malware leads to ransomware
- https://myonlinesecu...-to-ransomware/
22 Mar 2016 - "An email with the subject of 'You are being accused with bodily injury (Case: 02172723)' [random numbered] coming from random names and email addresses with a zip attachment is another one from the current bot runs which downloads what looks like Teslacrypt ransomware...
Screenshot: https://myonlinesecu...23-1024x447.png
5 March 2016: post_scan_02172723.zip: Extracts to: post_pgfEUf.js - Current Virus total detections 5/57*
.. MALWR** shows a download of what looks like Teslacrypt but might just be Locky from
http ://isityouereqq .com/80.exe?1(VirusTotal 5/57***) -Both- Locky and Teslacrypt have used the -same- servers and -same- file names over the last few weeks... This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a DOC or other normal file instead of the .exe/JS file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...sis/1458652839/
** https://malwr.com/an...zU1OTgxZjQwOGM/
Hosts
185.118.142.154: https://www.virustot...54/information/
*** https://www.virustot...sis/1458654208/
___
'Re-activate your Online Banking' – NatWest PHISH
- https://myonlinesecu...-bank-phishing/
22 Mar 2016 - "There are a few major common subjects in a phishing-attempt. Lots of them are either PayPal or your Bank or Credit Card, with a message saying some thing like:
Urgent: Your card has been stopped !
There have been unauthorised or suspicious attempts to log in to your account, please verify
Your account has exceeded its limit and needs to be verified
Your account will be suspended !
You have received a secure message from < your bank>
We are unable to verify your account information
Update Personal Information
Urgent Account Review Notification
We recently noticed one or more attempts to log in to your PayPal account from a foreign IP address
Confirmation of Order
Re-activate your Online Banking
The original email looks like this:
Screenshot: https://myonlinesecu...ng-1024x554.png
... the site the link goes to http ://linkage .org.uk//new_website/online/personal-natwest/Log-in.php
where a pop up asks you to download what appears to be the genuine Trusteer rapport security software:
> https://myonlinesecu...up-1024x547.png
... if you close then pop up & then fill in the email address and password [DON'T] you get a typical phishing page that looks very similar to a genuine Nat west bank page, if you don’t look carefully at the URL in the browser address bar... All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email or click-the-link in the email..."
linkage .org.uk: 37.61.235.162: https://www.virustot...62/information/
>> https://www.virustot...96afb/analysis/
___
“Copyright Violation” > Facebook Phish
- https://blog.malware...facebook-phish/
Mar 22, 2016 - "... we’ve spotted a phishing-scam using them as a launchpad for data theft. The name of the game is worrying the potential victim into clicking-on-the-supplied-link, with a curious mix of copyright violations and account verification. Here’s an example:
> https://blog.malware...fbcopyscam1.png
As you may have guessed, Facebook doesn’t issue copyright notices then direct you to apps pages. The 'Apps page' on offer here is a 'Get Verified' effort, complete with request for name, email/phone, password, profile link and 'comments':
> https://blog.malware...fbcopyscam2.jpg
We reported the page to Facebook, and it is now offline:
> https://blog.malware...fbcopyscam3.jpg
'Verify your account' -scams- are fairly old, but throwing tall tales of copyright issues into the mix for that extra sheen of panic isn’t quite as common. Always do your best to keep your logins safe and, if in doubt, go to the site owners directly..
–never- enter your credentials into a -link- sent your way in -random- Facebook messages."
Edited by AplusWebMaster, 22 March 2016 - 09:48 AM.
