Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
FYI...
Fake 'Payment Receipt' SPAM - leads to locky
- https://myonlinesecu...cky-ransomware/
19 Aug 2016 - "... a long line of generic emails delivering Locky ransomware is an email with the subject of 'Payment Receipt' pretending to come from random companies and email addresses with a malicious word doc attachment... One of the emails looks like:
From: Payment Receipt
Date: Fri 19/08/2016 10:43
Subject: Payment Receipt
Attachment: PaymentReceipt.docm
Attached is the copy of your payment receipt.
19 August 2016: PaymentReceipt.docm - Current Virus total detections 7/55*.. MALWR shows a download of an encrypted file from http ://wzukoees.homepage.t-online .de/897fyDnv which is converted by the malicious macro in the word doc to C:\DOCUME~1\User\LOCALS~1\Temp\sys48.tmp (VirusTotal 4/56**)... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1471600737/
** https://www.virustot...sis/1471600926/
t-online .de: 2003:2:4:164:217:6:164:162
2003:2:2:40:62:153:159:92
217.6.164.162: https://www.virustot...62/information/
62.153.159.92: https://www.virustot...92/information/
___
Fake 'Report' SPAM - leads to Java Adwind Trojan
- https://myonlinesecu...rs-java-adwind/
19 Aug 2016 - "We continue to see Java Adwind Trojans daily. Today’s example is a slight change to the delivery method from previous Malspam emails that have been using Moneyexpress .com or MoneyGram or other middle eastern money exchange bodies. This one is an email with the subject of 'Unclaimed Commission Report-WUBS' pretending to come from Shiella F. Doria <shiella.doria@ westernunion .com> with a zip attachment which contains a Java.jar file & an image to make it look “respectable” and genuine. We have seen various -spoofed- Western Union malspam...
Screenshot: https://myonlinesecu...BS-1024x646.png
The image from inside the zip is:
- https://myonlinesecu...ment-Sheet.jpeg
19 August 2016: Unclaimed Commission Report.zip - Extracts to: UN-PROCESSED COMMISSION.jar
Current Virus total detections 30/56*. This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC/PDF/JPG or other common file instead of the .EXE/.JS file it really is, so making it much more likely for you to accidentally open it and be infected... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1471508188/
___
Ransomware round up
- https://atlas.arbor....ndex#-198932443
Aug 18, 2016 - "... Analysis: ... ransomware developers and infrastructure providers who deliver the packages are continuing to refine their crafts. The addition of a RAT used to target potential banking elements instead of going forward with ransomware -extortion- is a smart addition. Most threat actors behind ransomware tend to utilize one flat ransom across their victim pool. However, some, notably those behind Locky, have paid attention to some of their victims and were able to extort larger sums than the original request once they identified the overall value of the victimized systems. A RAT could allow a smart threat actor to better access their target and move forward with requesting larger sums of money. However, it could simply allow threat actors to leverage more traditional capabilities by capturing banking credentials which in turn could allow them to perform fraudulent withdrawals with potentially larger payouts than had they attempted simple extortion efforts. Nemucod and Locky continue to change their overall operating procedures. The addition of ad-click and backdoor functionality to a ransomware operation can lead to additional revenue streams for threat actors, especially if the ransomware does not impact the -additional- malicious packages, allowing for them to operate unencumbered while the victim decides what course of action to take in response to the ransomware. Most ransomware is best defended against by -never- enabling-macros unless you implicitly trust the source... and maintaining up-to-date backups that are stored offline..."
Edited by AplusWebMaster, 19 August 2016 - 02:41 PM.
