FYI…
Fake 'invoice EME018' SPAM – doc malware
- http://myonlinesecurity.co.uk/ieuan-james-invoice-eme018-docx-word-doc-malware/
8 Jan 2015 - "'invoice EME018.docx' pretending to come from Ieuan James with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may include cridex, dridex, dyreza and various Zbots, cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment… The email has come in corrupted on my email server and looks like this (I am sure some email servers will serve up a working version) :
–Apple-Mail-2E10F14F-2909-483A-9642-7C58A403A905
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit
–Apple-Mail-2E10F14F-2909-483A-9642-7C58A403A905
Content-Type: application/msword;
name=”invoice EME018.doc”;
x-apple-part-url=D103C3C9-1CC9-4BE2-89E7-EB608B41F92A
Content-Disposition: attachment;
filename=”invoice EME018.doc”
Content-Transfer-Encoding: base64 …
… extracted the malicious word doc from the content.
8 January 2015 : invoice EME018.doc - Current Virus total detections: 1/56*
According to Dynamoo’s blog[1] this EME018.doc malware file will connect to one of these sites http ://ecovoyage.hi2 .ro/js/bin.exe http ://mateusz321.cba .pl/js/bin.exe - This binary is saved as %TEMP%\oHIGUIgifdg.exe and has a VirusTotal detection rate of 10/55** …"
* https://www.virustotal.com/en/file/66a2de2890ebaf7ca4521f97a44c5f30371aea72dc1023b051fea4ef3da94ece/analysis/1420701971/
** https://www.virustotal.com/en/file/12f6d880b94e16fbc1fca0ba1c97b47373e81e03cffc8d08954db13dea1c0678/analysis/1420708713/
1] http://blog.dynamoo.com/2015/01/malware-spam-ieuan-james-invoice.html
8 Jan 2015 - "… this morning I've seen a handful of these malformed malware spams, claiming to be from a Ieuan James and with a subject of invoice EME018.docx. The body text contains some Base64 encoded data which presumably is meant to be an attachment… Recommended minimum blocklist:
59.148.196.153
74.208.11.204
129.215.249.52
78.140.164.160
37.1.208.21
86.156.238.178
In addition I suggest blocking 3NT Solutions LLP / inferno.name IP ranges on sight. I would very strongly recommend blocking the entire 37.1.208.0/21 range…"
___
Fake 'INVOICE ADVISE' and 'NOVEMBER INVOICE' SPAM - doc/xls malware
- http://blog.dynamoo.com/2015/01/malware-spam-invoice-advise-08012015.html
8 Jan 2015 - "These two -spam- runs have different email messages but the same payload. In both cases, there are multiple -fake- senders:
Sample 1 - INVOICE ADVISE 08/01/2015
From: Mia Holmes
Date: 8 January 2015 at 09:11
Subject: INVOICE ADVISE 08/01/2015
Good morning
Happy New Year
Please could you advise on the November GBP invoice in the attachment for me?
Many thanks
Kind Regards
Mia Holmes
Accountant
SULA IRON & GOLD PLC
Sample 2 - NOVEMBER INVOICE
From: Reed Barrera
Date: 8 January 2015 at 09:16
Subject: NOVEMBER INVOICE
Good morning
Happy New Year
Please could you advise on the November GBP invoice in the attachment for me?
Many thanks
Kind Regards
Reed Barrera
Controller
ASSETCO PLC
Other sender names include:
- Marlin Rodriquez
Accountant
CLONTARF ENERGY PLC
- Olive Pearson
Senior Accountant
ABERDEEN UK TRACKER TRUST PLC
- Andrew Salas
Credit Management
AMTEK AUTO
The attachment is in a Word document (in one sample it was a Word document saved as an XLS file). Example filenames include:
RBAC_9971IV.xls
INV_6495NU.doc
2895SC.doc
There are -four- different malicious files that I have seen so far, all with low detection rates [1] [2] [3] [4] which contain in turn one of these macros… leading to a download from one of the following locations:
http ://188.241.116.63 :8080/mops/pops.php
http ://108.59.252.116 :8080/mops/pops.php
http ://178.77.79.224 :8080/mops/pops.php
http ://192.227.167.32 :8080/mops/pops.php
This file is downloaded as g08.exe which is then copied to %TEMP%\1V2MUY2XWYSFXQ.exe. This file has a detection rate of 3/56*. The VT report shows a POST to 194.146.136.1:8080 (PE "Filipets Igor Victorovych", Ukraine) which is a well-known malware server which I recommend that you block. This IP is confirmed in the Malwr report which also shows a dropped DLL which is the same as found in this spam run and has a detection rate of just 2/56**."
1] https://www.virustotal.com/en/file/e0225133c9a4987fcb29c8e646225496248c16a033a565b70b77f4288071b426/analysis/1420712512/
2] https://www.virustotal.com/en/file/b018c37bd4b27d8fcfc543d05ef5c0f0477551afe4a396584c6f1b83aeacfa92/analysis/1420712527/
3] https://www.virustotal.com/en/file/b1c10f76fc15c3ca6ca89df5335d716241e57951098f7324bbe8c627430a0af6/analysis/1420712717/
4] https://www.virustotal.com/en/file/d75b7a1865bed23978462197e7b5d8f1f25dd7eec8244d29f4710dc22bf6e36e/analysis/1420713398/
* https://www.virustotal.com/en/file/bc93e9bdf92f0a9fb24ccbf053f59d79e31588a956204b4d09efff1091a40c89/analysis/1420713841/
** https://www.virustotal.com/en/file/b56547ec2ee8185f772f1cdf034573883df442e4e9fde458fcf526a97563d53b/analysis/1420714510/
- http://myonlinesecurity.co.uk/november-invoice-word-doc-excel-xls-malware/
8 Jan 2015: INV_7330KQ.doc - Current Virus total detections: 1/56*
* https://www.virustotal.com/en/file/bc93e9bdf92f0a9fb24ccbf053f59d79e31588a956204b4d09efff1091a40c89/analysis/1420713841/
… Behavioural information
TCP connections
194.146.136.1: https://www.virustotal.com/en/ip-address/194.146.136.1/information/
<_<
