FYI...
Fake 'Unaccepted account' SPAM – PDF malware
- http://myonlinesecur...ke-pdf-malware/
4 May 2015 - "An email coming from random senders and random email addresses with subjects of 'Holded account notification' or 'Unaccepted account caution' or similar vaguely banking related subjects with a zip attachment is another one from the current bot runs... Some subjects seen with this series of spam emails are:
Blocked bank operation report
Holded account notification
Unaccepted account caution
Rejected operation warning
Blocked transaction warning
Some attachment names are:
block_warning_information.zip
nullfication_alert_details.zip
rejection_message_data.zip
rejection_notification_form.zip
invalidation_alert_document.zip
The email looks like:
Be noted that your depositis rejected.
Please see the report for detailed information.
Susan Morgan
Account Security Department
-Or-
Be adviced that your payment not accepted.
Please see the document for detailed information.
Mary Roberts
Senior Manager
-Or-
We inform you that your fund not accepted.
Please look the document for detailed information.
Jane Jones
Senior Manager
4 May : block_warning_information.zip | nullfication_alert_details.zip
Extracts to: block_warning_report.exe | abrogation_warning_information.exe
Current Virus total detections: 1/55* | 1/55** . This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it really is, so making it much more likely for you to accidentally open it and be infected..."
* https://www.virustot...0bbc1/analysis/
... Behavioural information
TCP connections
166.78.246.145: https://www.virustot...45/information/
91.211.17.201: https://www.virustot...01/information/
38.124.60.223: https://www.virustot...23/information/
88.221.14.249: https://www.virustot...49/information/
UDP communications
191.233.81.105: https://www.virustot...05/information/
** https://www.virustot...sis/1430748957/
... Behavioural information
TCP connections
104.130.28.231: https://www.virustot...31/information/
91.211.17.201: https://www.virustot...01/information/
38.124.60.223: https://www.virustot...23/information/
88.221.14.249: https://www.virustot...49/information/
UDP communications
23.101.187.68: https://www.virustot...68/information/
- https://isc.sans.edu...l?storyid=19657
2015-05-05
___
ACH Spam
- http://threattrack.t...846488/ach-spam
May 4, 2015 - "Subjects Seen:
ACH Approval Letter
Typical e-mail details:
The Automated Clearing House (ACH) application for your company has been processed and the payer unit number assigned is 029762. This number identifies to the Federal Reserve Bank of Cleveland the account to be debited and is required input in the “ABI ACH Payment Authorization Input Record.” It is the responsibility of the payer to use the correct payer unit number in every transaction in which statements are paid via ACH.
You may begin paying statements via ACH. If you are a Customhouse broker who is using ACH for the first time, please contact your ABI client representative to request that your ABI records be updated to permit ACH filing. If you are already using ACH for other importer statement transmissions, you do not need to contact your ABI client representative. If you are a new ABI importer, please contact your ABI client representative to ensure that the appropriate ABI records are updated to permit you to transmit entry summaries, which will be filed under ACH...
If you have any questions, you may contact ACH Help Desk at (317) 298-1200, extension 1098.
Sincerely,
Cindi Miller, Chief
Collections Refunds and Analysis Branch
Revenue Division
Thank You,
Kirsten Anderson
Malicious File Name and MD5:
ACH_Import_Information.scr (bc7bb730e98fcde7044251784e0d8ceb)
Tagged: ACH, Upatre
___
Macro Malware: Old Tricks still Work ...
- http://blog.trendmic...ll-work-part-1/
May 4, 2015 - "Now comes a time when we are reminded of why this security warning prompt in Microsoft Word matters:
Microsoft Word security warning for macros:
> https://blog.trendmi...04/Figure01.jpg
... We’ve already seen signs of macro malware in the threat landscape a year ago with the W97M_SHELLHIDE.A and TSPY_ZBOT.DOCM combination. At first, we thought that it was just a chance encounter but, as covered in our recent report on BARTALEX, the method of distributing malware through the misuse of macros has borne the likes of DRIDEX, ROVNIX and VAWTRAK into computer systems from the latter part of 2014 up to this year. What’s more, we noticed that this resurgence of macro malware has a single area of focus: enterprises. Enterprises were heavily affected by a spam outbreak involving macro malware. We saw that macro malware detections in Q1 2015 drove huge numbers:
Q1 2015 MS Word and Excel malware detections:
> https://blog.trendmi...04/Figure-2.jpg
This data is based on feedback from Trend Micro’s Smart Protection Network, representing files that have been detected on endpoints. The following conclusions can be drawn:
- The two common malware families seen are W97M_MARKER and W2KM_DLOADR.
- You can see X2KM_DLOADR detections around the start of February.
- A couple more significant ones like W2KM_DOXMAL and W2KM_MONALIS started showing up on the 2nd week of March
- Finally, W2KM_BARTALEX started picking up middle of February and was seen up to the last week of March... The macro code was instrumental in dropping the .DLL file that instated the malware, GHOLE. Targeted attack campaigns would usually use vulnerabilities that had been determined to be effective on a target, or even zero-day vulnerabilities. This operation, however, had taken a much easier route of using the tired, old method of traditional malware. If you take the methods employed by GHOLE, ZBOT, DRIDEX, ROVNIX and VAWTRAK, we’ve all seen them in the past – as well as macro malware and email-borne threats... the right time has come and known threats are repackaged with old methods, resulting to what we now determine to be equally effective..."
___
Fiesta EK wreaks havoc on popular Torrent Site
- https://blog.malware...r-torrent-site/
May 4, 2015 - "... Beside the illegal nature of the act in some countries, many sites that index torrents are filled with aggressive ads and pop ups often tricking the user to run programs and other junk that they don’t need. To get the actual content you were looking for is often a battle that could end with some unwanted toolbars added to your browser, or worse, malware. Such is the case with popular Torrent index SubTorrents .com, a very popular Torrent in Spain and Latin America... Users trying to download their favourite TV show may end up getting more than they were looking for. Upon browsing the site, a malicious -redirection- silently loads the Fiesta exploit kit and associated malware payload. Fortunately, Malwarebytes Anti-Exploit users were shielded from this threat... Given the large amounts of ads on the site, it would have been fair to suspect a malvertising issue, but this was not the case here. Rather, the site itself has been -compromised- and serves a well hidden iframe... the author had some fun trying to make things a little more complicated. Rather than directly inserting a malicious iframe (to the exploit kit landing), they chose to build it on the fly by retrieving the content from an external .js... The exploit kit is Fiesta EK and we noticed a new format, where semi colons are now commas... Downloading illegal Torrents is dangerous business. On top of fake files that waste your time and bandwidth, users have to navigate through a sea of misleading ads and pop ups. They may end up saving a few bucks off that latest movie but could also risk a lot more, like getting a nasty malware infection. Ransomware being so prevalent these days could mean that all of user’s files, including those movies and songs could be encrypted and held for ransom. Regardless, it is important to stay safe from such attacks by keeping your computer up-to-date..."
(More detail at the malwarebytes URL above.)
Edited by AplusWebMaster, 05 May 2015 - 05:13 AM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
