2072 replies to this topic

[AplusWebMaster]

FYI...

Fake 'USPS' SPAM - delivers Sage 2 ransomware
- https://myonlinesecu...e-2-ransomware/
26 Jan 2017 - "... Sage 2 ransomware has started to use the same email template that we see daily that normally delivers Locky ransomware and Kovter Trojans HERE:
> https://myonlinesecu...nd-locky-sites/
... The only noticeable difference between the 2 campaigns (until you actually analyse the files inside the zip attachments) is the file size and file names. In the Locky/Kovter versions they were using .js files but now use lnk files... Locky /Kovter use a file name something like Delivery-Receipt-3793490.zip that extracts to another zip file Delivery-Receipt-3793490.doc..zip that eventually extracts to Delivery-Receipt-3793490.doc.lnk where the numbers change with each email received. There are numerous different download sites for the malware each day. Sage 2 ransomware uses a static named file for all emails, currently Delivery-Details.zip extracting to Delivery-Details.js - There is one download site each day... One of the emails looks like:
From: USPS Ground <uwawsne253468@ netpetar .com>
Date: Thu 26/01/2017 02:04
Subject: Delivery problem, parcel USPS #40088683
Attachment: Delivery-Details.zip
    Hello,
    Your item has arrived at Thu, 26 Jan 2017 03:04:09 +0100, but our courier
    was not able to deliver the parcel.
    You can download the shipment label attached!
    All the best.
    Leisha Marshman – USPS Support Agent.

26 January 2017: Delivery-Details.zip: Extracts to: Delivery-Details.js - Current Virus total detections 14/53*
Payload Security** shows a download from http ://affections .top/ff/55.exe (VirusTotal 14/56***) (Payload Security [4])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1485410870/

** https://www.hybrid-a...vironmentId=100

*** https://www.virustot...sis/1485413961/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
54.211.245.199

affections .top: 54.165.5.111: https://www.virustot...11/information/

Country US / Autonomous System 14618 (Amazon.com, Inc.)
> https://www.virustot...509d1/analysis/
52.203.213.69: https://www.virustot...69/information/
___

Fake 'Microsoft' SPAM - delivers malware
- https://myonlinesecu...nknown-malware/
26 Jan 2017 - "A blank/empty email pretending to come from Microsoft with a subject like 'RE: 23337 Microsoft Free 23337' with zip attachment that extracts to another zip file that in turn contains a malicious word doc...
Update: I am being told it is Ursnif banking Trojan... Update again: ... weird. This site is delivering different malware, almost at random it seems. Each visit gives a -different- file, although always the same name read.doc or read.php - currently all are 243kb but all have different file #. So far we have seen Cerber, Ursnif and the original unknown malware... The email looks like:
From: tcmf.microsoft <suard-c@ vendome .pf>
Date: Thu 26/01/2017 16:00
Subject: RE: 23337 Microsoft Free 23337
Attachment: 55554546637489.zip

Body content: totally blank/empty

> https://www.reverse....vironmentId=100
Contacted Hosts
208.67.222.222
195.5.126.248
46.150.69.43
188.27.92.82

> https://www.hybrid-a...vironmentId=100
Contacted Hosts (576)

26 January 2017: 55554546637489.zip: extracts to: 4446_ZIP.zip extracts to 4446.doc
Current Virus total detections 2/55*. Payload Security shows a download from
 http ://vvorootad .top/read.php?f=0.dat which delivers read.doc (which is -not- a doc file, although having an icon looking like a word doc, but a renamed .exe) (VirusTotal 9/57**). Payload Security***... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1485447397/

** https://www.virustot...sis/1485448703/

*** https://www.hybrid-a...vironmentId=100

vvorootad .top: 52.203.115.53: https://www.virustot...53/information/
> https://www.virustot...76629/analysis/
35.165.86.173: https://www.virustot...73/information/
> https://www.virustot...31339/analysis/
___

Spyware on a Chromebook ??
- http://www.computerw...chromebook.html
Jan 25, 2017 - "... According to Google*, it means the extension 'can enable, disable, uninstall or launch themes, extensions, and apps you have installed'. Uninstall and disable other extensions? Are you kidding me? Why does Chrome even allow this? Web browsers do -not- allow a page on one website to interact with a page on another. Why does Chrome let an extension from Developer A disable or uninstall one from Developer B? Perhaps worse, is that Chrome does not warn, at installation time, about the modification to the New Tab page. This is inexcusable. And here's a sentence I never expected to write. When it comes to extensions modifying the New Tab page, Chrome on Windows is more secure than Chrome on Chrome OS..."
* https://support.goog...er/186213?hl=en

(More detail at the computerworld URL above.)
 

  

Edited by AplusWebMaster, 26 January 2017 - 03:36 PM.

[AplusWebMaster]

FYI...

Phish - using PDF attachments
- https://blogs.techne...df-attachments/
Jan 26, 2017 - "... deceitful PDF attachments are being used in email phishing attacks that attempt to steal your email credentials. Apparently, the heightened phishing activity that we have come to expect every year during the holiday season has not subsided. Unlike in other spam campaigns, the PDF attachments we are seeing in these phishing attacks do not contain malware or exploit code. Instead, they rely on social engineering to lead you on to phishing pages, where -you- are then asked-to-divulge sensitive information...
Example 1: One example of the fraudulent PDF attachments is carried by email messages that pretend to be official communication, for instance, a quotation for a product or a service, from a legitimate company. These email messages may spoof actual people from legitimate companies in order to fake authenticity:
> https://msdnshared.b...2017/01/120.jpg
When you open the attachment, it’s an actual PDF file that is made to appear like an error message. It contains an instruction to “Open document with Microsoft Excel”. But it’s actually a link to a website:
> https://msdnshared.b...creenshot-1.png
Clicking the link opens your browser and brings you to a website, where the social engineering attack continues with a message that the document is protected because it is confidential, and therefore you need to sign in with your email credentials:
> https://msdnshared.b...creenshot-2.png
... Don’t open attachments or click-links in suspicious emails. Even if the emails came from someone you know, if you are not expecting the email, be wary about opening the attachment, because spam and phishing emails may spoof the sender..."
(More detail at the blogs.technet.microsoft URL at the top of this post.)
 

  

[AplusWebMaster]

FYI...

Netflix Scam delivers Ransomware
- http://blog.trendmic...ers-ransomware/
Jan 29, 2017 - "Netflix has a 93 million-strong subscriber base in more than 190 countries, so it’s unsurprising that cybercriminals want a piece of the pie. Among their modus operandi: stealing user credentials that can be monetized in the underground, exploiting vulnerabilities, and more recently infecting systems with Trojans capable of pilfering the user’s financial and personal information. What other purposes can stolen Netflix credential serve? Offer them up as bargaining chip to fellow cybercriminals, for instance. Or more nefariously, use them as lure to trick certain users into installing malware (and turn a profit in the process).
If you’re planning to free ride your way into binge-watching your favorite shows on Netflix, think again. Your computer’s files may end up getting held hostage instead. We came across a -ransomware- (detected by Trend Micro as RANSOM_ NETIX.A) luring Windows/PC users with a Netflix account via a login generator, one of the tools typically used in software and account membership piracy. These programs are usually found on suspicious websites sharing cracked applications and access to premium/paid web-based services:
(The ransom note displayed as wallpaper in the affected system)
> https://blog.trendmi...ransomware1.jpg
(One of the ransom notes with instructions to victims)
> https://blog.trendmi...ransomware2.jpg
(Fake Netflix Login Generator)
> https://blog.trendmi...ransomware3.jpg
(The prompt window after clicking “Generate Login”)
> https://blog.trendmi...ransomware4.jpg
The ransomware starts as an executable (Netflix Login Generator v1.1.exe) that drops another copy of itself (netprotocol.exe) and then executed afterwards. Clicking the “Generate Login” button leads to another prompt window that purportedly has the login information of a genuine Netflix account. RANSOM_NETIX.A uses these fake prompts/windows as distraction while it performs its encryption routine on 39 file types under the C:\Users directory... The ransomware employs AES-256 encryption algorithm and appends the encrypted files with the .se extension. The ransom notes demand $100 worth of Bitcoin (0.18 BTC) from its victims... Interestingly, the ransomware terminates itself if the system is -not- running Windows 7 or Windows 10... This highlights the significance for end users to keep their subscription accounts safe from crooks. Keep to your service provider’s security recommendations. More importantly, practice good security habits: beware of -emails- you receive pretending to be legitimate, regularly update your credentials, use two-factor authentication, and download -only- from official sources... Does getting your important files encrypted worth the piracy? Netflix’s premium plan costs around $12 per month, and allows content to be streamed in four devices at the same time. Compare that with $100 you need to pay in order to get your files decrypted. Getting them back isn’t guaranteed either, as other ransomware families have shown... Bad guys need only hack a modicum of weakness for which no patch is available — the human psyche. Social engineering is a vital component in this scam, so users should be smarter: don’t download -or- click-ads promising the impossible. If the deal sounds too good to be true, it usually is."
 

  

Edited by AplusWebMaster, 30 January 2017 - 02:06 PM.

[AplusWebMaster]

FYI...

Random subject SPAM - download .lnk files to malware
- https://myonlinesecu...rious-malwares/
1 Feb 2017 - "... numerous versions of the emails, but they all basically function in the same way. The email has a link to a compromised site that pretends to be a doc, image or PDF file but in reality will download a .lnk file (windows shortcut file) - these run powershell & contact another site to actually download the malware. These link files have a base64 encoded section with the download link...

Screenshot: https://myonlinesecu...tem_shipped.png

... other emails read and look like:
1] https://myonlinesecu...onfirmation.png

2] https://myonlinesecu...r-confirmed.png

- https://www.virustot...8d127/analysis/
File name: confirm-purchase-ordernum-3TX0S8458483-JY.pdf
Detection ratio: 3/54
Analysis date: 2017-02-01

- https://www.hybrid-a...vironmentId=100
Contacted Hosts
5.152.199.228

... different download locations, sometimes delivering exactly same malware from all locations and sometimes slightly different malware versions from each one... All these malicious emails are either designed to steal your Passwords, Bank, PayPal or other financial details along with your email or FTP (web space) log in credentials. Or they are -Ransomware- versions that encrypt your files and demand large sums of money to recover the files..."
 

  

[AplusWebMaster]

FYI...

Fake 'eFax' SPAM - delivers malware
- https://myonlinesecu...nknown-malware/
2 Feb 2017 - "... an email with the subject of 'You received a new eFax from 516-6128936' (numbers are normally random) pretending to come from eFax <messaging@ efax .com> with a link-that-downloads a malicious word doc... Update: I am reliably informed* it downloads Hancitor & other associated malware...
* https://twitter.com/...235660352323584

Screenshot: https://myonlinesecu...-5166128936.png

... The download link in the body of the email is:
 http ://akatsuki-eng .co.jp/api/get.php?id=dmljdGltQGRvbWFpbi5jb20=  where the base64 encoded section is the recipients email address...

2 February 2017: eFax_victim.doc - Current Virus total detections 3/54**. Payload Security***... DO NOT follow the advice they give to enable macros or enable editing to see the content..."
** https://www.virustot...sis/1486056401/

*** https://www.hybrid-a...vironmentId=100

akatsuki-eng .co.jp: 157.7.107.124: https://www.virustot...24/information/
> https://www.virustot...4e687/analysis/

... Update: 3 February 2017: Today’s version has a .lnk file inside-a-zip as an attachment
(VirusTotal 3/56[1]) connects to & downloads analytics.activeadvisory .com/007.bin
 but only from a Canadian IP range. The rest of the world appears blocked. (VirusTotal 6/56[2])
(Payload Security[3]). This one is delivering Urnsif banking Trojan...
1] https://www.virustot...474ac/analysis/

2] https://www.virustot...sis/1486120969/

3] https://www.hybrid-a...vironmentId=100
Contacted Hosts
208.67.222.222
185.77.128.246
85.17.94.33
172.86.121.117

 

analytics.activeadvisory .com: 149.56.201.88: https://www.virustot...88/information/
> https://www.virustot...a7736/analysis/
___

Identity fraud hits record high
- https://www.helpnets...ts-record-high/
Feb 2, 2017 - "The number of identity fraud victims increased by sixteen percent (rising to 15.4 million U.S. consumers) in the last year, according to Javelin Strategy & Research*. Their study found that despite the efforts of the industry, fraudsters successfully adapted to net two million more victims this year with the amount fraudsters took rising by nearly one-billion-dollars to $16 billion..."
> https://www.helpnets...in-022017-1.jpg

* https://www.javelins...t-according-new
Feb 1, 2017

- https://krebsonsecur...n-the-dark-web/
Jan 31, 2017 - "... Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS. Tax data can be -phished- directly from consumers via phony emails spoofing the IRS or employers. But more often, the information is stolen in bulk from employers. In a typical scenario, the thieves target people who work in HR and payroll departments at corporations, and spoof an email from a higher-up in the company asking for all employee W-2 data to be included in a single file and emailed immediately..."
___

W-2 Phishing SCAM - targets schools, Restaurants, Hospitals... Others
- https://www.irs.gov/...oups-and-others
Feb. 2, 2017 - "... W-2 scammers are coupling their efforts to steal employee W-2 information with an older scheme on -wire-transfers- that is victimizing some organizations -twice- ... When employers report W-2 thefts immediately to the IRS, the agency can take steps to help protect employees from tax-related identity theft. The IRS, state tax agencies and the tax industry, working together as the Security Summit, have enacted numerous safeguards in 2016 and 2017 to identify fraudulent returns filed through scams like this. As the Summit partners make progress, cybercriminals need more data to mimic real tax returns.
> Here’s how the scam works: Cybercriminals use various -spoofing- techniques to disguise an email to make it appear as if it is from an organization executive. The email is sent to an employee in the payroll or human resources departments, requesting a list of all employees and their Forms W-2. This -scam- is sometimes referred to as business email compromise (BEC) or business email spoofing (BES). The Security Summit partners urge all employers to be vigilant. The W-2 scam, which first appeared last year, is circulating earlier in the tax season and to a broader cross-section of organizations, including school districts, tribal casinos, chain restaurants, temporary staffing agencies, healthcare and shipping and freight. Those businesses that received the scam email last year also are reportedly receiving it again this-year...
New Twist to W-2 Scam: Companies Also Being Asked to Wire Money
In the latest twist, the cybercriminal follows up with an “executive” email to the payroll or comptroller and asks that a wire transfer also be made to a certain account. Although not tax related, the wire transfer scam is being coupled with the W-2 scam email, and some companies have lost both employees’ W-2s and thousands of dollars due to wire transfers. The IRS, states and tax industry urge all employers to share information with their payroll, finance and human resources employees about this W-2 and wire-transfer-scam. Employers should consider creating an internal policy, if one is lacking, on the distribution of employee W-2 information and conducting wire transfers..."
___

Apple 'Security Measures' - phish
- https://myonlinesecu...sures-phishing/
2 Feb 2017 - "... spam run apple phishing today. The bad spelling and grammar should be enough to warn anybody that it is a fake...

Screenshot: https://myonlinesecu...ty-Measures.png

The link-in-the-email goes to:
 http ://www .interwurlitzer .com/mc.html which redirects you to
 http ://www .bdic .ca/mardei/Itunes/apple/ where you see the typical Apple phishing page."

interwurlitzer .com: 87.229.45.133: https://www.virustot...33/information/
> https://www.virustot...ac7f8/analysis/
bdic .ca: 67.212.91.221: https://www.virustot...21/information/
> https://www.virustot...23e95/analysis/
___

Netgear addresses 'Password Bypass' vulns in 31 Router Models
- http://www.darkreadi.../d/d-id/1328036
Feb 1, 2017
- https://web.nvd.nist...d=CVE-2017-5521
Last revised: 01/23/2017
CVSS v3 Base Score: 8.1 High

> http://kb.netgear.co...y-Vulnerability
"... Firmware fixes are currently available for the following affected devices. To download the firmware release that fixes the password recovery vulnerability, click the link for your model and visit the firmware release page for instructions.."
Last Updated: 01/27/2017
 

  

Edited by AplusWebMaster, 03 February 2017 - 02:18 PM.

[AplusWebMaster]

FYI...

Fake 'notice to Appear' SPAM - delivers Kovter/Locky
- https://myonlinesecu...cky-and-kovter/
5 Feb 2017 - "... start of a campaign using 'New notice to Appear in Court' as the email subject. The attachments are identical to the typical .JS, .WSF, .lnk file inside a double zip. All the sites seen so far today are the -same- sites used in the USPS, FedEx, UPS current campaigns*...
* https://myonlinesecu...nd-locky-sites/
... The attachments all start with a zip named along the lines of Notice_00790613.zip which contain -another- zip Notice_00790613.doc.zip which in turn contains Notice_00790613.doc.js ... All of the sites are listed on THIS post**... All the sites contain the -same- Malware downloads of Kovter and Locky. They do get updated frequently during the day...
** https://myonlinesecu...nd-locky-sites/
... The infection process is described very well by this Microsoft blog post***...
*** https://blogs.techne...ition-to-locky/

Screenshot: https://myonlinesecu...ar-in-Court.png

5 February 2017: Notice_00790613.doc.js - Current Virus total detections 11/54[4].
Payload Security[5]. Today’s eventual downloads: Locky (VirusTotal 6/56[6]). Kovter (VirusTotal 9/57[7])... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
4] https://www.virustot...sis/1486286066/

5] https://www.hybrid-a...vironmentId=100
Contacted Hosts (176)
HTTP Traffic
97.74.144.118: https://www.virustot...18/information/

50.62.117.7: https://www.virustot....7/information/

107.181.187.77: https://www.virustot...77/information/

6] https://www.virustot...sis/1486287187/

7] https://www.virustot...sis/1486287513/
___

Many Malware Samples found on Pastebin
- https://isc.sans.edu...l?storyid=22036
2017-02-05
 

  

Edited by AplusWebMaster, 05 February 2017 - 12:41 PM.

[AplusWebMaster]

FYI...

Fake 'To all employee’s' SPAM - delivers malware
- https://myonlinesecu...elivers-dridex/
6 Feb 2017 - "... an email with the subject of 'FW: To all employee’s' pretending to come from Administrator <Administrator@ administrator .delivery> with a malicious word doc attachment... not 100% certain this is Dridex, Payload Security is unable to save to webservice on the Word Macro or the downloaded .exe file. The other samples doing that today are Dridex, so it looks like the Dridex gang have added some sort of anti-sandbox protection to itself...

Screenshot: https://myonlinesecu...l-employees.png

6 February 2017: EmployeeConfidential.doc - Current Virus total detections 2/54*
Payload Security** was unable to 'save to webservice'. VirusTotal comments gave me the download location:
  http ://fistnote .com/images/k6kkGcHpPi7m5iJprQPxPcoiVhmT7.exe (VirusTotal 11/55***). Payload Security again was unable to save to webservice Zip file attached... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1486399875/

** https://www.hybrid-a...vironmentId=100

*** https://www.virustot...sis/1486399137/

fistnote .com: 208.56.226.20: https://www.virustot...20/information/
> https://www.virustot...a957b/analysis/
___

Fake 'Shipping info' SPAM - delivers malware via macro word docs
- https://myonlinesecu...acro-word-docs/
6 Feb 2017 - "An email with the subject of 'Shipping information for parcel 3627458' pretending to come from USPS <shipping@ usps-service .com> with a malicious word doc attachment delivers hancitor which downloads Zloader and Pony which will download -more- malware... The email looks like:
From: USPS <shipping@ usps-service .com>
Date:
Subject: Shipping information for parcel 3627458
Attachment:
    Our courrier was not able to deliver your parcel because nobody was present at your address.
    Someone must always be present on the delivery day, to sign for receiving the parcel.
    Shipping type: USPS Next Day Box size: Large Box ( 2-5kg ) Date : Feb 6th 2017
    You can reschedule the delivery over the phone, but you will have to confirm the information on the delivery invoice.
    Another delivery can be arranged, by calling the number on the delivery invoice we left at your address and confirming the shipping information, including the address and tracking number.
    A scanned copy of the delivery invoice can also be downloaded by visiting the USPS website:
    https ://tools.usps .com/web/pages/view.invoice?id=3627458&dest=submit@...
    In the exceptional case that a new delivery is not rescheduled in 24 hours, the shipment will be cancelled and the package will be returned to the sender.
    Thanks for shipping with USPS ...

6 February 2017: USPS_invoice_submit.doc - Current Virus total detections 4/54*
Payload Security**... The download link-in-the-body of the email is:
 http ://fam-life .jp/api/get.php?id=c3VibWl0QHRoZXNweWtpbGxlci5jby51aw==  where the base64 encoded section is the recipients email address. The downloaded word doc is created by adding the recipients name, or at least the bit before the @ in the email address... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1486405685/

** https://www.hybrid-a...vironmentId=100

fam-life .jp: 157.7.107.28: https://www.virustot...28/information/
> https://www.virustot...102da/analysis/
 

  

Edited by AplusWebMaster, 06 February 2017 - 04:32 PM.

[AplusWebMaster]

FYI...

Fake sex lure SPAM - delivers ransomware
- https://myonlinesecu...ers-ransomware/
7 Feb 2017 - "The sex lures in an email always work. Curiosity is just too much for some recipients... an email with the subject of 'get laid tonight'  pretending to come from Alice Olsen <Alice.Olsen@ mail .com> with a very enticingly named zip attachment 'ourSexPhoto.zip' containing an .exe file with a definite sexy or pornographic lure 'byAliceforyouOurSexPhotosiwantyou .exe'... One of the emails looks like:
From: Alice Olsen <Alice.Olsen@ mail .com>
Date: Mon 06/02/2017 22:42
Subject: get laid tonight
Attachment: ourSexPhoto.zip
    Iam Thinking Of You ! My photos after our party

7 February 2017: ourSexPhoto.zip: Extracts to: byAliceforyouOurSexPhotosiwantyou.exe
Current Virus total detections 8/56*. Payload Security**... VT is differing between Sage ransomware and generic malware detections. Payload Security is inconclusive. Returns from Anti-Virus submissions vary between Generic Ransomware and Yakes Trojan... we can pretty much assume it is -ransomware- but there is some doubt which one... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1486431675/

** https://www.hybrid-a...vironmentId=100
___

Fake 'Your order Canceled' SPAM - delivers sage ransomware
- https://myonlinesecu...age-ransomware/
7 Feb 2017 - "... an email with the subject of 'Your order Canceled. fraud' pretending to come from Security Service <security-service@ mail .com> with a zip attachment containing an .exe file. The bad spelling should be enough to alert recipients... 'looks like a new version of Sage with updated decryption and what to do instructions... Drops a vbs file that gives -audio- alerts telling you that your files are encrypted:
    “Attention! Attention! This is not a test!
     All you documents, data bases and other important files were encrypted and Windows can not restore them without special software.User action is required as soon as possible to recover the file”
It also changes Bcdedit to prevent system recovery and of course deletes all shadow copies... One of the  emails looks like:
From: Security Service <security-service@ mail .com>
Date: Tue 07/02/2017 18:19
Subject: Your order Canceled. fraud
Attachment:
    Your order has been canceled.
    Your credit card is invalid.
    For an explanation of the reason you have 3 days.
    By discharging is distributed 3 days, your card will be blocked.
    All the details in the attached documents.

7 February 2017: Your.orderCanceled.fraud.zip Extracts to: Your.order10988322.Canceled. fraud.2017-01-15.exe
Current Virus total detections 9/57*. Payload Security**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1486490294/

** https://www.hybrid-a...vironmentId=100
Contacted Hosts
91.214.114.197
 

  

Edited by AplusWebMaster, 07 February 2017 - 01:51 PM.

[AplusWebMaster]

FYI...

Fake 'Confidential documents' SPAM - delivers Trickbot
- https://myonlinesecu...banking-trojan/
9 Feb 2017 - "... An email with the subject of 'Confidential documents' pretending to come from random names @ anz .com with a malicious word doc attachment delivers Trickbot banking Trojan... The email looks like:
From: Kathy.Hilton@ anz .com
Date: Thu 09/02/2017 01:45
Subject: Confidential documents
Attachment: ANZ_message00207.doc
    Please review attached document.
    Kathy.Hilton@ anz .com
    Australia and New Zealand Bank
    1800-575-892 office
    1800-640-855 cell
    Investments in securities and insurance products are:
    NOT FDIC-INSURED/NO BANK-GUARANTEES/MAY LOSE VALUE
    CONFIDENTIAL NOTICE ...

9 February 2017: ANZ_message00207.doc - Current Virus total detections 6/54*
Payload Security**. Neither show anything definite, but searching around gave me these links to VirusTotal reports from the same campaign:
> https://virustotal.c...54461/analysis/
Behavioural information > TCP connections
78.47.139.102: https://www.virustot...02/information/
47.18.17.114: https://www.virustot...14/information/
13.107.4.50: https://www.virustot...50/information/
213.25.134.75: https://www.virustot...75/information/
> https://virustotal.c...946a5/analysis/
> https://virustotal.c...f49d0/analysis/
Download sites appear to be:
- andiamoluggage .com/skin/frontend/holloway.png
- andiamoluggage .com/skin/frontend/fortis/ahjakacbakawda.png
- andiamoluggage .com/skin/install/not16.png
All of which are NOT png (image files) but renamed .exe files... Thanks to @Techhelplist[1]...
1] https://twitter.com/...468826676899840
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1486618849/

** https://www.hybrid-a...vironmentId=100

andiamoluggage .com: 173.254.28.82: https://www.virustot...82/information/
> https://www.virustot...b9bd0/analysis/
___

Fake 'Final payment' SPAM - delivers malware
- https://myonlinesecu...e-zbot-malware/
9 Feb 2017 - "An email with the subject of 'Final payment request' pretending to come from MatthewPeters@ hmrc.gsi .gov.uk with a malicious word doc attachment delivers what looks like a Zbot variant... The email looks like:
From: MatthewPeters@hmrc.gsi.gov.uk” <info@ nestpensions63 .top>
Date: Thu, 9 Feb 2017 13:24:00 +0100
Subject: Final payment request
Attachment: debt_93498438747.doc
    Date of issue 09 February 2017
    Reference K2135700006
    Don’t ignore this letter – you need to pay us now if you want to stop us taking enforcement action against you.
    We contacted you previously asking you to pay the above amount but you still haven’t done so. The attached statement of liability gives a breakdown of what you owe.
    As you’re in the very small minority of people who haven’t paid. We’re treating your case as a priority. If you don’t pay now, we’ll take action to make you pay. The law allows us to enforce debts by seizing your goods and selling them by public auction A regional sheriff officer acting on a summary warrant will do this for us. We can charge fees for this so if you don’t act now it could cost you more money.
    For more information and how to pay us please see attached statement.
    We’ll continue to add interest to the original debt until you pay in full.
    Debt Management ...

9 February 2017: debt_93498438747.doc - Current Virus total detections 7/53*
Payload Security** shows a download from http ://jsmkitchensandbedrooms .co.uk/explo.exe
(VirusTotal 4/57***) - Payload Security[4]... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1486645244/

** https://www.hybrid-a...vironmentId=100
94.199.185.21
172.227.109.213
185.162.9.59

*** https://www.virustot...sis/1486642865/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
104.85.50.185
178.77.110.129
185.162.9.59

jsmkitchensandbedrooms .co.uk: 94.199.185.21: https://www.virustot...21/information/
> https://www.virustot...1cd55/analysis/
___

MacDownloader malware targets defense industry
- https://blog.malware...fense-industry/
Feb 9, 2017 - "... this -malware- appears to be the work of Iranian hackers and is targeting US defense contractors, such as Lockheed Martin, Sierra Nevada Corporation, Raytheon, and Boeing. The malware was first found on a -spearphishing- site, claiming to offer 'Special Programs and Courses' to interns at these companies. The site showed a 'broken video' using the common trick of claiming that Adobe Flash Player was outdated and offering a link to a 'Flash installer':
> https://blog.malware...-PM-600x472.png
To those who know better, this doesn’t really look much like an actual Adobe Flash Player installer, but many people won’t realize that. There are some other red flags as well, such as some odd phrasing and other errors in the text shown. The biggest red flag, though, is the name of the application shown in the menu bar next to the Apple menu. As can be seen from the screenshot above, it claims to be Bitdefender Adware Removal Tool. This is the first sign of a serious split personality issue in this malware, which can’t seem to decide whether it’s a Flash installer or an anti-adware program. Interestingly, if the user clicks the Close button here the malware quits without doing anything else. If the user chooses to proceed with the “update,” the malware will then show a rather odd window for what is supposed to be a Flash updater: a claim to have detected malware:
> https://blog.malware...r-2-600x276.png
... there are some issues with phrasing and spacing in the text of this alert, not to mention the fact that a Flash updater should -not- be scanning your system like anti-virus software... This malware continues the recent malware trends on macOS. In the past year, nearly all true Mac malware (as opposed to adware) has been 1) lame and 2) targeted... This malware is no different, as it is being used to target US defense contractors via spearphishing, a technique in which links to specially-crafted malicious sites are sent to targeted individuals or groups via e-mail or other messaging services. The majority of Mac users will never see this malware and one would hope that most of those who do would not be fooled by the clumsy behavior. Still, it doesn’t take many to fall for the tricks employed by this malware to get access to sensitive accounts within an organization, which can be used to -pwn- the entire company."
 

  

Edited by AplusWebMaster, 09 February 2017 - 12:58 PM.

[AplusWebMaster]

FYI...

Fake 'Xpress Money' SPAM - delivers java adwind
- https://myonlinesecu...rs-java-adwind/
14 Feb 2017 - "... fake financial themed emails containing java adwind or Java Jacksbot attachments... previously mentioned many of these HERE[1]...
1] https://myonlinesecu.../?s=java adwind
... The email looks like:
From: elizabethst2.mel@ xpressmoney .com
Date: Mon 13/02/2017 23:45
Subject: Fwd: Reference: Xpress Money compliant report
Attachment: XPRESS MONEY UPTHRONI DATA.zip (contains 2 identical although differently named java.jar files)
    Dear Agent,
    The attached Compliant report was issued yesterday online by a customer about you. We will need your feedback as soon as possible before 24hours or your terminal will be blocked.
    Regards
    Nasir Usuman
    Regional Compliance Manager Pakistan & Afghanistan
    Global Compliance, Xpress Money ...

14 February 2017: XPRESS MONEY REFERENCES FOLLOW UP.jar.jar (287 kb) - Current Virus total detections 8/57*
Payload Security**... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487047920/

** https://www.hybrid-a...vironmentId=100
___

Fake 'Secure Message' SPAM - delivers malware
- https://myonlinesecu...livers-malware/
14 Feb 2017 - "An email with the subject of 'Secure Message' pretending to come from  RBC Royal Bank but actually coming from a -fake- domain imitating the RBC <service@ rbcroyalbanksecuremessage .com> with a malicious word doc attachment delivers an unknown malware...
The domain in the email address rbcroyalbanksecuremessage .com was registered today by criminals using privacy protection by Godaddy and hosted on Rackspace...

rbcroyalbanksecuremessage .com: 104.130.159.40: https://www.virustot...40/information/
23.253.233.16: https://www.virustot...16/information/

The email looks like:
From: RBC Royal Bank <service@rbcroyalbanksecuremessage .com>
Date: Tue 14/02/2017 17:13
Subject: Secure Message
Attachment: SecureMessage.doc
Secure Message
This is an automated message send by Royal Bank Secure Messaging Server. To ensure both you and the RBC Royal Bank comply with current legislation, this message has been encrypted. Please check attached documents for more information. Note: You should not store confidential information unless it is encrypted.
CONFIDENTIALITY NOTICE:The contents of this email message and any attachments are intended solely for the addressee(s)and may contain confidential and/or privileged information and may be legally protected from disclosure...

14 February 2017: SecureMessage.doc - Current Virus total detections 4/55*
Payload Security**.. neither give any real indication what it downloads..
Update: Thanks to help from another researcher***.. It downloads
 http ://sungkrorsang .com/jerohnimo.png which of course is -not- a png (image file) but a renamed .exe that the macro will rename & autorun. VirusTotal 10/59[4] | Payload Security[5]...
 sungkrorsang .com: 61.19.252.134: https://www.virustot...34/information/
> https://www.virustot...01b8e/analysis/
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487094048/

** https://www.hybrid-a...vironmentId=100

*** https://twitter.com/...565160254996480

4] https://www.virustot...sis/1487095755/

5] https://www.hybrid-a...vironmentId=100
Contacted Hosts
78.47.139.102
47.18.17.114
213.25.134.75
219.93.24.2
192.189.25.143
___

Safeguard Account Update – phish
- https://myonlinesecu...pdate-phishing/
14 Feb 2017 - "Another Banking phish. This time HSBC. What makes this “slightly” more believable is the url the phishing email leads to http ://hsbc-verify .org.uk/ - which is a very plausible web address...

Screenshot: https://myonlinesecu...shing-email.png

The link goes to http ://hsbc-verify .org.uk/  where you see a webpage like this*, which leads to a typical set of phishing pages asking for all your bank, credit card and personal details, so they can empty your bank and credit card accounts and take over your identity completely:
* https://myonlinesecu...hsbc_verify.png
... registrars are not taking enough precautions and allowing dodgy domain names to be registered to non existent people..."

hsbc-verify .org.uk: 91.218.247.93: https://www.virustot...93/information/
> https://www.virustot...952f2/analysis/
 

  

Edited by AplusWebMaster, 14 February 2017 - 12:36 PM.

[AplusWebMaster]

FYI...

Fake 'Secure Message' SPAM - delivers Trickbot
- https://myonlinesecu...ivers-trickbot/
15 Feb 2017 - "An email with the subject of 'Secure Message'  pretending to come from HM Revenue & Customs with a malicious word doc attachment delivers Trickbot banking Trojan... The sending domain for these malspam emails was hmrcgovsec .co.uk which was registered -today- by criminals via Godaddy. Godaddy have jumped on this very quickly & suspended the domain within a few minutes of the first batch being sent...

Screenshot: https://myonlinesecu...lspam-email.png

hmrcgovsec .co.uk: 172.99.114.9: https://www.virustot....9/information/

15 February 2017: SecureCommunication.doc - Current Virus total detections 4/55*
Payload Security**..  as usual nothing is showing the download location or what actual malware this is...
Update: I am reliably informed*** the download location is:
 http ://fistnote .com/images/CV6amPf8jsgJeHVgLX.png which of course is renamed .exe and -not- an image file
(Payload Security[4]) (VirusTotal 9/56[5]) (VirusTotal 2/64[6])... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487167293/

** https://www.hybrid-a...vironmentId=100

*** https://twitter.com/...871728112508928

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
78.47.139.102
47.18.17.114
213.25.134.75
219.93.24.2
192.189.25.143

5] https://www.virustot...sis/1487168128/

6] https://www.virustot...692e5/analysis/

fistnote .com: 208.56.226.20: https://www.virustot...20/information/
> https://www.virustot...692e5/analysis/

- http://blog.dynamoo....re-message.html
15 Feb 2017 - "... Attached is a file RBCSecureMessage.doc which contains some sort of macro-based malware. It displays the following page to entice victims to disable their security settings:
> https://1.bp.blogspo...00/fake-rbc.png
... The domain rbc-secure-message .com is -fake- and has been registered solely for this purpose of malware distribution. In all the samples I saw, the sending IP was 64.91.248.146 (Liquidweb, US) but it does look like all these IPs in the neighbourhood are involved in the same activity:
64.91.248.137
64.91.248.146
64.91.248.148
64.91.248.150
I recommend you block 64.91.248.128/27 at your email gateway to be sure."
___

Personaliazed SPAM - uses hijacked domains
- http://blog.dynamoo....pam-making.html
15 Feb 2017 - "This spam email contained not only the intended victim's name, but also their home address and an apparently valid mobile telephone number:
    Sent: 14 February 2017 13:52
    To: [redacted]
    From: <customer@ localpoolrepair .com>
    Subject: Mr [Redacted] Your order G29804772-064 confirmation
    Dear Mr [redacted],
    Thank you for placing an order with us.
    For your reference your order number is G29804772-064.
    Please note this is an automated email. Please do not reply to this email.
    Get your order G29804772-064 details
Your order has been placed and items in stock will be sent to the address shown below. Please check all the details of the order to ensure they are correct as we will be unable to make changes once the order has been processed. You will have been notified at the point of order if an item is out of stock already with expected delivery date.
Delivery Address [address redacted] [telephone number redacted]
Delivery Method: Standard Delivery
Your Order Information
Prices include VAT at 20%
Customer Service Feedback
We are always working to improve the products and service we provide to our customers - we do this through a continual review of the product range, and ongoing training of our Customer Service Team. We continually strive to improve our levels of service and we welcome feedback from our customers regarding your buying experience and the product you receive...

The data in the spam was identifiable as being a few -years- old. The intended victim does not appear on the haveibeenpwned.com database. My assumption is that this information has been harvested from an undisclosed data breach. I was not able to extract the final payload, however the infection path is as follows:
 http ://bebracelet .com/customerarea/notification-processing-G29804772-064.doc
--> http ://customer.abudusolicitors .com/customerarea/notification-processing-G29804772-064.doc
--> https ://customer.affiliate-labs .net/customerarea/notification-processing-G29804772-064.zip
... So we have hijacked legitimate domains with presumably a neutral or good reputation, and we have valid SPF records. This means that the spam will have decent deliverability. And then the spam itself addresses the victim by name and has personal details presumably stolen in a data breach. Could you trust yourself not to click-the-link?
Recommended blocklist (email)
188.214.88.0/24
Recommended blocklist (web)
5.152.199.228: https://www.virustot...28/information/
185.130.207.37: https://www.virustot...37/information/- Country code - ZZ
185.141.165.204: https://www.virustot...04/information/- Country code - ZZ "
 

  

Edited by AplusWebMaster, 16 February 2017 - 05:40 AM.

[AplusWebMaster]

FYI...

Fake 'Company Complaint' SPAM - delivers Trickbot
- https://myonlinesecu...ivers-trickbot/
16 Feb 2017 - "An email with the subject of 'ID 8d6ba737-775e8bdc-f95f16f3-1b460259 – Company Complaint' pretending to come from Companies House <no-reply@ companieshousecomplaints .uk> with a malicious word doc attachment delivers Trickbot...

Screenshot: https://myonlinesecu...y-Complaint.png

If you open the word doc you see a screen looking like this*. DO NOT enable macros or content or enable editing, you -will- be infected:
* https://myonlinesecu...re-document.png

16 February 2017: 8d6ba737-775e8bdc-f95f16f3-1b460259.doc - Current Virus total detections 4/55*
Payload Security**.. Neither shows the download but it looks like the download location for the trickbot payload is
 http ://www.sungkrorsang .com/hustonweare.png which is -not- an image file but a renamed .exe  (VirusTotal 12/57***) (Payload Security[4])... As usual the domain sending these was registered by criminals today 16 February 2017 using Godaddy, with what are certain to be -fake- details:
canonical name: companieshousecomplaints .uk
addresses: 104.130.246.14
23.253.233.18
104.130.246.9 ..
104.239.201.9
... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487245555/

** https://www.hybrid-a...vironmentId=100

*** https://www.virustot...sis/1487246635/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
78.47.139.102
58.52.155.163
217.29.220.255
200.120.214.150
77.222.42.240

sungkrorsang .com: 61.19.252.134: https://www.virustot...34/information/
> https://www.virustot...0bb92/analysis/
 

  

[AplusWebMaster]

FYI...

Fake 'Urgent Compliance' SPAM - delivers java adwind
- https://myonlinesecu...rs-java-adwind/
20 Feb 2017 - "... previously mentioned many of these HERE[1]... a slightly different subject and email content to previous ones. They can’t seem to decide if it should be Xpress money or Western Union, so they decided to have an email body with a Western Union Content but pretend to send from Xpress money. I am also getting some from Spoofed Western Union Addresses...
1] https://myonlinesecu.../?s=java adwind
... The email looks like:
From: elizabethst2 .mel@ xpressmoney .com
Date: Mon 20/02/2017 00:47
Subject: Urgent Compliance, Status of transfer
Attachment: Details.zip
    Dear agent,
    Please kindly check the status of  this transaction. The remitter
    demands for the payment record, because the beneficiary denied the
    payment that He didn’t receive this money.
    So Please kindly check this transaction if it was paid,please arrange us the
    receipt of transaction
    Regards,
    Senzo Dlamini
    Regional Ops Executive
    WesternUnion International ...

20 February 2017: Urgent Compliance.jar - Current Virus total detections 6/58*
Payload Security**.. The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487576150/

** https://www.hybrid-a...vironmentId=100
___

Fake 'Western Union' SPAM - delivers java adwind
- https://myonlinesecu...rs-java-adwind/
20 Feb 2017 - "... -fake- financial themed emails containing java adwind or Java Jacksbot attachments... previously mentioned many of these HERE[1]...
1] https://myonlinesecu.../?s=java adwind
... the email contains a genuine PDF file with an-embedded-link that downloads the java Adwind zip. The zip contains -2- different sized and named java files. The link in the pdf goes to:
 http ://www.greavy .com/wp-includes/certificates/CERTIFICATE%20DETAILS%20AND%20WUPOS%20UPDATE%20MANUAL.zip
which extracts to -2- java.jar files hoping that if one fails the second will get you. Although both are detected as Java Adwind on Virus Total, the Payload Security reports does show different behaviour for each file...
New E-maual and updated payout procedures.jar (507kb)  VirusTotal 6/58* | Payload Security**

WU certificate and agent updated branch details..jar (333kb) VirusTotal 8/57*** | Payload Security[4]

The email looks like:
From: Western Union IT Dept. <wu.it-dept@ outlook .com>
Date: Mon 20/02/2017 02:37
Subject: WUPOS Agent Upgrade For All Branches.
Attachment: Details.zip
    Dear All,
    Western Union ,IT Department  data is posting upgrade for new version of WUPOS.Please  download attachment by clicking the link.as seen below, run the file and go ahead of checking western union intermediate screen
    Before doing that please read directives in attachments then map the Western Union user ID in the Symex application and proceed. Please let me know if you face any issue.
    Thanks & Regards, IT Department Western Union...

The pdf looks like:
> https://myonlinesecu...upos-update.png
... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487577130/

** https://www.hybrid-a...vironmentId=100

*** https://www.virustot...sis/1487577144/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
83.243.41.200

greavy .com: 180.240.134.105: https://www.virustot...05/information/
> https://www.virustot...a83b4/analysis/
___

Fake 'Secure Bank Documents' SPAM - delivers Trickbot
- https://myonlinesecu...banking-trojan/
20 Feb 2017 - "... an email with the subject of 'Important – Secure Bank Documents'... pretending to come from Lloyds Bank <no-reply@ lloydsbanksecuredocs .com> delivers Trickbot banking Trojan...

Screenshot: https://myonlinesecu...e-documents.png

20 February 2017: BACs.doc - Current Virus total detections 7/55*
I am informed about 2 known download locations for the Trickbot malware:
 www .sungkrorsang .com/hostelfrost.png and wp .pilbauer .com/wp-content/uploads/lordsofsteel.png
There probably are many more. VirusTotal 11/57*...The sending email Address lloydsbanksecuredocs .com was registered by criminals -today- using Godaddy and Privacy protection. It is -not- a genuine Lloyds bank web site or web address.. DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487606754/

** https://www.virustot...sis/1487607471/

lloydsbanksecuredocs .com: 45.55.36.38
159.203.126.233
159.203.117.63
159.203.115.143
159.203.170.214

sungkrorsang .com: 61.19.252.134: https://www.virustot...34/information/
> https://www.virustot...84e02/analysis/

pilbauer .com: 178.217.244.53: https://www.virustot...53/information/
 

  

Edited by AplusWebMaster, 20 February 2017 - 11:55 AM.

[AplusWebMaster]

FYI...

Rogue Chrome extension - tech support scam
- https://blog.malware...h-support-scam/
Feb 21, 2017 - "... Google Chrome... no surprise to see it being more and more targeted these days. In particular, less than reputable -ad- networks are contributing to the distribution of malicious Chrome extensions via very deceptive means... Google Chrome users are profiled based on the user-agent string they show whenever they visit a website. Rather than redirecting them to an exploit kit, they are often redirected to fake software updates, scams, or rogue browser extensions... Once installed, this extension ensures it stays in hiding by using a 1×1 pixel image as its logo... and by hooking chrome://extensions and chrome://settings such that any attempt to access those is automatically redirected to chrome://apps. That makes it much more difficult for the average user to see what extensions they have, let alone uninstalling one of them... 'wouldn’t be complete without a tech support scam which it seems one can’t avoid these days. If the user clicked on a new tab or typed a ‘forbidden’ keyword, the redirection chain would then deliver a -fake- Microsoft warning:
> https://blog.malware...017/02/TSS1.png
... We detect and remove this one as Rogue.ForcedExtension.
IOCs:
Fake extension: pakistance .club: 104.27.185.37: https://www.virustot...37/information/
104.27.184.37: https://www.virustot...37/information/
lfbmleejnobidmafhlihokngmlpbjfgo
Backend server (ad fraud/malvertising):
amserver .info: 104.31.70.128: https://www.virustot...28/information/
104.31.71.128: https://www.virustot...28/information/
qma0.2dn .xyz: 173.208.199.163: https://www.virustot...63/information/
Tech support scam:
microsoft-official-warning .info: 66.23.230.31: https://www.virustot...31/information/
___

Fake 'Western Union' SPAM - delivers java adwind
- https://myonlinesecu...er-java-adwind/
21 Feb 2017 - "... -fake- financial themed emails containing java adwind or Java Jacksbot attachments. I have previously mentioned many of these HERE[1]. We have been seeing these sort of emails almost every day...
1] https://myonlinesecu.../?s=java adwind
The java Adwind versions are exactly the same as Yesterday’s versions detailed HERE[2]. The zip once again contains -2- different sized and named java files, although named differently to yesterday’s versions, they are identical.
2] https://myonlinesecu...rs-java-adwind/

Screenshot: https://myonlinesecu...-rtra-rules.png

DETAILS OF PROHIBITED INDIVIDUALS SCREENED FOR THIS TRANSACTION AND MTCN.jar (507kb)  VirusTotal 8/58*
Payload Security**

WESTERN UNION RTRA RULES AND REFUND IN FULL..jar (333kb) VirusTotal 8/57*** | Payload Security[4]

... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1487577130/

** https://www.hybrid-a...vironmentId=100

*** https://www.virustot...sis/1487577144/

4] https://www.hybrid-a...vironmentId=100
Contacted Hosts
83.243.41.200
___

BoA 'Access Locked' - phish
- https://myonlinesecu...-phishing-scam/
21 Feb 2017 - "A slightly different phishing scam for a change. The phishing site is a FTP site which is very unusual...

Screenshot: https://myonlinesecu...rily-Locked.png

The link-in-the-email goes to: ftp ://121.170.178.35 /License/logon.htm
where you see a site looking like:
> https://myonlinesecu..._FTP_signon.png "

121.170.178.35: https://www.virustot...35/information/
> https://www.virustot...e2497/analysis/
___

'TurboTax' - phish
- https://myonlinesecu...pdate-phishing/
21 Feb 2017 - "Another phishing scam, this time TurboTax:

Screenshot: https://myonlinesecu...ount-Update.png

The link goes to http ://whitesandscampground .com/images/www.turbotax.com/index.html where you see this page, asking for all the usual details to steal your identity as well as all your bank and credit card accounts and all your money:
> https://myonlinesecu...ishing-page.png "

whitesandscampground .com: 205.204.89.214: https://www.virustot...14/information/
> https://www.virustot...d26d6/analysis/
 

  

Edited by AplusWebMaster, 21 February 2017 - 03:54 PM.

[AplusWebMaster]

FYI...

Fake 'Secure Bank Comm' SPAM - delivers Trickbot
- https://myonlinesecu...banking-trojan/
22 Feb 2017 - "An email with the subject of 'Important – Secure Bank Communication' coming from either Canada Revenue Agency <no-reply@ secure-gc .ca> or Canada Revenue Agency <no-reply@ securegcemail .ca> with a malicious word doc attachment delivers Trickbot banking Trojan...

Screenshot: https://myonlinesecu...-secure-doc.png

22 February 2017: SecureDoc.doc - Current Virus total detections 2/55[1] 2/55[2]
Payload Security [1A] [2A] none of which are showing the download location of the actual Trickbot itself, although it is on Virus Total 20/58[3]. I am informed[4] the download location is
 www .TPSCI .COM/pngg/granionulos.png -or- http ://www .sungkrorsang .com/fileFTP/granionulos.png
which of course is -not- an image file but a renamed .exe... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
1] https://www.virustot...sis/1487783258/

2] https://www.virustot...b072b/analysis/

1A] https://www.hybrid-a...vironmentId=100

2A] https://www.hybrid-a...vironmentId=100

3] https://www.virustot...23427/analysis/

4] https://twitter.com/...453695299518464

TPSCI .COM: 203.121.180.74: https://www.virustot...74/information/
> https://www.virustot...ce0cb/analysis/

sungkrorsang .com: 61.19.252.134: https://www.virustot...34/information/
> https://www.virustot...da633/analysis/
___

Dropbox phish
- https://myonlinesecu...opbox-phishing/
22 Feb 2017 - "Another phishing email, this time spoofing -Dropbox- where you land on a page with lots of different email providers and the evil scum doing these phishes will pop up the appropriate one for you to enter all your details, pretending that  you can now sign into dropbox using your email address. After giving the details you get sent to the genuine DropBox site:

Screenshot: https://myonlinesecu...shing_email.png

The -link- goes to http ://www.pedraforte .net/js/index/klnkjfe/dropbox/dropbox/ (there might be other sites, there usually are with these scams) where you see a page looking like:
> https://myonlinesecu...ox_phishing.png
Select -any- of the links and you get:
> https://myonlinesecu...x_phishing1.png "

pedraforte .net: 192.185.217.111: https://www.virustot...11/information/
> https://www.virustot...5552e/analysis/
 

  

Edited by AplusWebMaster, 22 February 2017 - 02:07 PM.