FYI...
Fake 'RBS' SPAM - delivers malware
- https://myonlinesecu...livers-malware/
11 Apr 2017 - "An email with the subject of 'FW: Important BACs documents' pretending to come from RBS BACs <GRGBACspaymentsdelivery@ rbsdocuments .co.uk> with a malicious word doc spreadsheet attachment delivers malware... it appears to be Trickbot banking Trojan...
Screenshot: https://myonlinesecu...04/rbs_bacs.png
RBS_BACs_11042017.doc - Current Virus total detections 3/54*. Payload Security currently is not responding for me. MALWR** shows nothing relevant.
I am informed that it uses PowerShell to download http ://hitecmetal .com.my/images/NGVN4LNyaCV6amPf8jsgJeHVgLX.png which of course is -not- a png but a renamed .exe file (VirusTotal 11/60***) which even more suggests ursnif or Trickbot banking Trojans... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1491904361/
** https://malwr.com/an...DQ0MzZhMjVhNTQ/
*** https://www.virustot...sis/1491905198/
kxecz.exe
hitecmetal .com.my: 110.4.45.192: https://www.virustot...92/information/
___
Fake 'scanned file' SPAM - delivers malware
- https://myonlinesecu...livers-malware/
11 Apr 2017 - "... an email that has a multitude of subjects all along the line of 'scanned file/image document/image etc. pretending to come from totally random senders with a pdf attachment. This PDF does have an embedded word doc inside... Payload Security Hybrid Analysis... is currently down. I assume this will turn out to be Dridex in the same way it did yesterday*...
* https://myonlinesecu...eliver-malware/
Screenshot: https://myonlinesecu.../image-data.png
20170411414556.pdf - Current Virus total detections 10/57*. MALWR**...
Update: ... the word macro content shows downloads of -encrypted- txt files from:
medjobsmatch .com/kjv783r
outoftheboxpc .org/kjv783r
jenya.kossoy .com/kjv783r
Which MALWR*** managed to decode as redchip2.exe (VirusTotal 8/61[4]) which although not being detected as Dridex is either likely to be Dridex or Kegotip... DO NOT follow the advice they give to enable macros or enable editing to see the content... The basic rule is NEVER open any attachment to an email, unless you are expecting it..."
* https://www.virustot...sis/1491908876/
** https://malwr.com/an...jJlMjg1NmQ4Yjg/
*** https://malwr.com/an...jk1ZmM5MGZmZmU/
Hosts
23.229.143.7
4] https://www.virustot...sis/1491910444/
medjobsmatch .com: 23.229.143.7: https://www.virustot....7/information/
outoftheboxpc .org: 216.87.186.17: https://www.virustot...17/information/
jenya.kossoy .com: 64.111.126.118: https://www.virustot...18/information/
___
Fake Google Maps listings redirect Users to fraudulent sites
- https://www.bleeping...tes-each-month/
Apr 10, 2017 - "... This is the result of a study carried out by Google and University of California, San Diego researchers, who analyzed over 100,000 businesses marked as 'abusive' and added to Google Maps between June 2014 and September 2015. Researchers say that 74% of these abusive listings were for local businesses in the US and India, mainly in pockets around certain local hotspots, especially in large metropolitan areas such as New York, Chicago, Houston, or Los Angeles. In most cases, the scheme was simple. A customer in need of a locksmith or electrician would search Google Maps for a local company. If he navigated to the website of a fake business or called its number, a call center operator posing as the business' representative would send over an unaccredited contractor that would charge much more than regular professionals. If a customer's situation were urgent, the contractor would often charge more than the initial agreed upon price. Researchers said that 40.3% of all the listings for fake companies they found focused on on-call services, such as locksmiths, plumbers, and electricians, were customers were desperate to resolve issues... To list a business card on Google Maps, companies must go through a series of checks that involves Google mailing a postal card, or making a phone call to the business headquarters. After analyzing over 100,000 fake listings, researchers said miscreants registered post office boxes at UPS stores and used the same address to register tens to hundreds of listings per address. They did the same thing for their phone contact, by buying cheap VoIP numbers from providers such as Bandwidth .com, Level 3, Twilio, or Ring Central... The research team discovered that crooks managed to hijack 0.5% of Google Maps' outbound traffic for the studied period... Google also says it currently detects and disables around 85% fake listings before they ever appear on Google Maps..."
> https://static.googl...chive/45976.pdf
[ 9 pages ]
Edited by AplusWebMaster, 11 April 2017 - 09:10 AM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
