SPAM frauds, fakes, and other MALWARE deliveries...

FYI…

Fake 'Invoice' SPAM - delivers Dridex
- https://myonlinesecurity.co.uk/spoofed-john-miller-invoice-pretending-to-come-from-somebody-named-holmes-delivers-dridex-banking-trojan/
5 Jun 2017 - "… emails with random numbered -pdf- attachments that drops a malicious macro enabled word doc is an email with the subject of 'Invoice' pretending to come from a random first name Holmes at random email addresses but the body of the email imitates John Miller Ltd…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/invoice_John-Miller_-Holmes.png

… the PDF actually having some content that makes it almost look real:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/invoice_129303_pdf.png

A4 Inv_Crd 21297.pdf - Current Virus total detections 9/56*. Payload Security**
 drops Invoice_129302.docm (VirusTotal 8/59[3]) (Payload Security[4]) downloads an encrypted txt file from
 http ://spaceonline .in\8yfh4gfff which is converted by the script to miniramon8.exe (VirusTotal 13/61[5])…
DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/771808725251417389c0274ae12df50de998341df9da022a3847c6cea7398edd/analysis/1496654801/

** https://www.hybrid-analysis.com/sample/771808725251417389c0274ae12df50de998341df9da022a3847c6cea7398edd?environmentId=100
Contacted Hosts
111.118.212.86
192.48.88.167
89.110.157.78
85.214.126.182
46.101.154.177

3] https://www.virustotal.com/en/file/bda736fe0d8fe841d9efae96ff00b79e3cac730e8cfac14ba23c1d340749a196/analysis/1496654938/

4] https://www.hybrid-analysis.com/sample/bda736fe0d8fe841d9efae96ff00b79e3cac730e8cfac14ba23c1d340749a196?environmentId=100
Contacted Hosts
111.118.212.86
192.48.88.167
89.110.157.78
85.214.126.182
46.101.154.177

5] https://www.virustotal.com/en/file/c7dc1e2d1dbda6e287675160f1e96f6514b8a6f10017a1e4b76c7591c3785e97/analysis/

spaceonline .in: 111.118.212.86: https://www.virustotal.com/en/ip-address/111.118.212.86/information/
> https://www.virustotal.com/en/url/e3d58bf6f4a099d7087557e3a1fa885e141b21e848a3adcc9835481a2dcc915b/analysis/
___

- http://blog.dynamoo.com/2017/06/malware-spam-john-miller-limited-invoice.html
5 Jun 2017 - "This spam pretends to come from John Miller Ltd (but doesn't) and comes with a malicious payload. The domain mentioned in the email does -not- match the company being spoofed, and varies from message to message.

Screenshot: https://3.bp.blogspot.com/-mxosSM7W0uo/WTUk6vYWvOI/AAAAAAAALqA/p_xzIj40-G002U07MruQaudiFufUbW5ZgCLcB/s1600/john-miller.png

The attachment currently has a detection rate of about 9/56*. As is common with some recent attacks, the PDF actually contains an embedded Microsoft Office document. Hybrid Analysis** shows the malicious file downloading a component from cartus-imprimanta .ro/8yfh4gfff (176.126.200.56 - HostVision SRL, Romania) although other -variants- possibly exist. A file is dropped (in the HA report called miniramon8.exe) at detection rate of 11/61***. According to the Hybrid Analysis report, that attempts tom communicate with the following IPs:
192.48.88.167 (Tocici LLC, US)
[removed] (netclusive GmbH, Germany)
[removed] (Strato AG, Germany)
[removed] (Digital Ocean, Germany)
The payload is not clear at this time, but it will be nothing good.
Recommended blocklist:
192.48.88.167
89.110.157.78
85.214.126.182
46.101.154.177 "
* https://virustotal.com/en/file/d9a96d193f63cefb3380ed5a7ec10e401dd46ca0d9e11a6a019574e058c89fcc/analysis/1496654625/

** https://www.hybrid-analysis.com/sample/d9a96d193f63cefb3380ed5a7ec10e401dd46ca0d9e11a6a019574e058c89fcc?environmentId=100
Contacted Hosts
176.126.200.56
192.48.88.167
89.110.157.78
85.214.126.182
46.101.154.177

*** https://virustotal.com/en/file/c7dc1e2d1dbda6e287675160f1e96f6514b8a6f10017a1e4b76c7591c3785e97/analysis/1496655625/

cartus-imprimanta .ro: 176.126.200.56: https://www.virustotal.com/en/ip-address/176.126.200.56/information/
> https://www.virustotal.com/en/url/3d620daa824fb9b8f9d71285af66a101e57d0066bc85c2b6859f4baab6570dc3/analysis/
___

'WakeMed' Phish
REAL 'WakeMed': http://www.wakemed.org/contact-us
Raleigh, NC 27610

FAKE/Phish: https://myonlinesecurity.co.uk/wakemed-service-desk-your-mailbox-has-been-login-some-where-else-very-poor-attempt-at-phishing/
5 June 2017

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/WakeMed-SERVICE-DESK.png

"… If you follow the link you see a  very badly designed webpage, complete with spelling errors, obviously created by a non English speaker, looking like this:
(from: http ://itupdat.tripod .com/)
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/tripod_phish.png

… the spam -email- is a -compromised-  (may be spoofed) Canadian Nova Scotia Department of Education address… these emails use Social engineering tricks to persuade you to open the attachments that come with the email…"

itupdat.tripod .com: 209.202.252.101: https://www.virustotal.com/en/ip-address/209.202.252.101/information/
> https://www.virustotal.com/en/url/53de7c16b5444d3ad9b34d64c2b86de1f68208b74edfc163827452b7c580ddb7/analysis/

ccrsb .ca: 142.227.247.226: https://www.virustotal.com/en/ip-address/142.227.247.226/information/
___

Police dismantle crime network - online payment SCAMS
- https://www.helpnetsecurity.com/2017/06/05/police-dismantle-organised-crime-network/
June 5, 2017 - "The Polish National Police, working in close cooperation with its law enforcement counterparts in Croatia, Germany, Romania and Sweden, alongside Europol’s European Cybercrime Centre (EC3), have smashed a Polish organised crime network suspected of online payment scams and money laundering… Operation MOTO on 29-31 May 2017 resulted in 9 arrests including the criminal network’s masterminds, as well as 25 house searches in Poland. The perpetrators were advertising online cars as well as construction or agricultural machinery/vehicles, but never delivered the advertised goods to interested buyers, despite having received advance fee payments…"
 

    <_<

FYI…

Fake 'eFax' SPAM - delivers smoke/sharik/dofoil and Trickbot
- https://myonlinesecurity.co.uk/fake-efax-message-from-0300-200-3835-2-pages-malspam-delivers-smoke-sharik-dofoil-and-trickbot/
7 June 2017 - "An email with the subject of 'eFax message from 0300 200 3835' – 2 pages pretending to come from efax but actually coming from a look-alike-domain eFax with a malicious word doc attachment…
mail.efaxcorporate254 .top was registered on 5 June 2017 via publicdomainregistry .com using what are obviously -fake- details and hosted on a Russian server 185.186.141.227. Other -variants- of the domain are hosted on other IPs in the '109.248.200.0 – 109.248.203.255′ and ‘185.186.140.0 – 185.186.143.255’ ranges. Other -variants- of this were registered between 1st and 5th June 2017…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/eFax-message-from-0300-200-3835-2-pages.png

FAX_20170607_1496754696_302.doc - Current Virus total detections 7/57* Payload Security** shows a download from
  http ://5.149.250.240 /jun7.exe gets -renamed- to Pvmzgo.exe and autorun (VirusTotal 35/61[3]) Payload Security[4]. The malware on http ://5.149.250.240 is being updated at frequent intervals (currently still using jun7.exe) but I have seen 2 different versions since I originally posted… VirusTotal 10/59[5] 14/61[6] Payload Security[7]… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/fc34f8d73639adce0e1120732f8ac3a0083a7ad850f086d5028d40a2fd7895ee/analysis/1496851706/

** https://www.hybrid-analysis.com/sample/fc34f8d73639adce0e1120732f8ac3a0083a7ad850f086d5028d40a2fd7895ee?environmentId=100
Contacted Hosts
5.149.250.240
185.159.128.150

3] https://www.virustotal.com/en/file/4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736/analysis/

4] https://www.hybrid-analysis.com/sample/4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736?environmentId=100
Contacted Hosts
95.101.187.176
185.159.128.150

5] https://www.virustotal.com/en/file/415a75cd01a4b00385c974b59bbbd3e5211a985bf2560d7639d464fd5a56e9e6/analysis/1496866638/
jun7_exe

6] https://www.virustotal.com/en/file/421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9/analysis/1496899315/
jun7.exe

7] https://www.hybrid-analysis.com/sample/421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9?environmentId=100
Contacted Hosts
212.227.91.231
193.104.215.58
185.159.128.150

> Update 8 June 2017: -another- run of same email…
fax_20170608_96784512_336.doc - Current Virus total detections 5/55[8]. Payload Security[9] shows a download from
  http ://185.81.113.94 /jun8.exe gets -renamed- to Gqkdau.exe and autorun
(VirusTotal 14/61[10]) Payload Security[11]…
8] https://www.virustotal.com/en/file/3a6924693b76675d25cacc6b8b20520c7c2c9fafa6a2a4da8f8cf9cf77c1bc52/analysis/1496913428/

9] https://www.hybrid-analysis.com/sample/3a6924693b76675d25cacc6b8b20520c7c2c9fafa6a2a4da8f8cf9cf77c1bc52?environmentId=100
Contacted Hosts
185.81.113.94
185.159.128.150
192.150.16.117

10] https://www.virustotal.com/en/file/d986808e01a4c8c6b8ec0d4acc09a88f9393774fd1cf7bb45fbdf9b64b076b4b/analysis/1496924193/
jun8.exe

11] https://www.hybrid-analysis.com/sample/d986808e01a4c8c6b8ec0d4acc09a88f9393774fd1cf7bb45fbdf9b64b076b4b?environmentId=100
Contacted Hosts
185.81.113.94: https://www.virustotal.com/en/ip-address/185.81.113.94/information/
> https://www.virustotal.com/en/url/faae387b57aa87604780d50bb7beb3f5f4d0408d40b6787fc1937e82be5b40e6/analysis/
185.81.113.94 /jun8.exe
___

More Fake 'eFax' SPAM - delivers malware via ole rtf exploit
- https://myonlinesecurity.co.uk/another-fake-efax-email-delivers-malware-via-ole-rtf-exploit/
8 Jun 2017 - "Another -fake- eFax email… subject of 'eFax message from 116 – 921 – 1271' – 5 pages  pretending to come from eFax Inc with a zip attachment containing a malicious word doc…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/eFax-message-from-[removed]-5-pages.png

QSVN19945204621.zip extracts to pxsmnxd.doc - Current Virus total detections 11/57*. Payload Security**…
… 'found an embedded ole object in the rtf file. It will be using a recent rtf exploit… This email attachment contains what appears to be a genuine word doc or Excel XLS spreadsheet with either a macro script or an embedded OLE object that when run will infect you… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/f3c979b258f1067f3a413da83621ad1ce4b4b0ac8600a3c977574142600cac8a/analysis/1496924661/
pxsmnxd.doc

** https://www.hybrid-analysis.com/sample/f3c979b258f1067f3a413da83621ad1ce4b4b0ac8600a3c977574142600cac8a?environmentId=100
Contacted Hosts
5.196.42.122: https://www.virustotal.com/en/ip-address/5.196.42.122/information/
> https://www.virustotal.com/en/url/7f0fc1b7bead5f61300bec48ee0d74624cb0122032b62caee39e01fc0de9a263/analysis/
 

    <_<

FYI…

Fake 'Credit Note' SPAM - delivers malware
- https://myonlinesecurity.co.uk/fake-anna-mills-baby-bottles-wholesale-limited-copy-credit-note-malspam-delivers-malware/
9 Jun 2017 - "… an email with the subject of 'Copy Credit Note' coming or pretending to come from Anna Mills anna.mills@ random email addresses with a semi-random named zip attachment which contains another zip file which delivers a wsf file eventually delivering what looks like emotet banking Trojan…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/anna_mills.png

1763904.zip extracts to AA-213-RR.zip: Extracts to: AA-213-RR.wsf - Current Virus total detections 11/55*
Payload Security** shows a download of an encrypted file from
 http ://sellitni .com/hjgf677??RqtfrQRDh=FirlRSoaCC  which is converted by the script to emsjwIjFro1.exe
(VirusTotal 22/61[3]) which suggests it might be emotet banking malware (Payload Security[4])…
The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/af53c0b99e2189a59ef7c6204519baee8876472e7e438c5304300972fff4de3d/analysis/1496999598/
AA-213-RR.wsf

** https://www.hybrid-analysis.com/sample/af53c0b99e2189a59ef7c6204519baee8876472e7e438c5304300972fff4de3d?environmentId=100
Contacted Hosts
188.165.220.204: https://www.virustotal.com/en/ip-address/188.165.220.204/information/
> https://www.virustotal.com/en/url/1229db156990ff1072ac4346e5885124d6b5ae33c138ab91fbf2a6b89236be34/analysis/

3] https://www.virustotal.com/en/file/e7e4903ad38c1de9e7314e5cde375fe2d76c898a985fd205ffadc8f816af0ba0/analysis/

4] https://www.hybrid-analysis.com/sample/e7e4903ad38c1de9e7314e5cde375fe2d76c898a985fd205ffadc8f816af0ba0?environmentId=100
 

    <_<

FYI…

Fake 'invoice' SPAM - delivers malware
- https://myonlinesecurity.co.uk/more-invoice-malspam-delivers-malware-using-wsf-files/
12 Jun 2017 - "… an email with the subject of 'Invoice PIS0120650' (random numbers) coming or pretending to come from NoReplyMailbox @ random companies, names and email addresses with a zip attachment which matches the subject  that contains another zip file, containing a WSF file which eventually delivers what looks like it will turn out to be either Dridex or Trickbot banking Trojan…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Invoice-PIS0120650.png

InvoicePIS0120650.zip: extracts to  LZTFBQLX6G.zip which Extracts to: LZTFBQLX6G.wsf
Current Virus total detections 12/56*. Payload Security** shows a download of an encrypted file from
 http ://ythongye .com/8yhf2ui? which is converted by the script to wvHyIX1.exe
(VirusTotal 19/60[3]) Payload Security[4]…  found 4 -different- WSF files amongst the 150 zips received:
LZTFBQLX6G.wsf - Current Virus total detections 12/56[5]
IZ7JAG6.wsf - Current Virus total detections 11/55[6]
MVUN1W9FO1.wsf - Current Virus total detections 14/56[7]
TOTAHZEQT.wsf - Current Virus total detections 14/56[8]
Manual examination of the various WSF scripting files received shows these download Locations for the malware
(obfuscated in the WSF file using base64 encoding & extra padding):
78tguyc876wwirglmltm .net/af/8yhf2ui > 119.28.85.128
e67tfgc4uybfbnfmd .org/af/8yhf2ui > 119.28.85.128
sacrecoeur.bravepages .com/8yhf2ui? > 66.219.202.10
ythongye .com/8yhf2ui? > 103.249.108.128
sheekchilly .com/8yhf2ui? > 103.21.59.174
lamartechnical .com/8yhf2ui? > 216.97.233.44
syrianchristiancentre .org/8yhf2ui? > 103.21.58.130
skveselka .wz.cz/8yhf2ui > 185.64.219.7
svadba-tamada .de/8yhf2ui > 81.169.145.148
aacom .pl/8yhf2ui? > 193.239.206.248
smartzaa .com/8yhf2ui? > 103.21.58.252
… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/d9351db902a8f3031d0ee410f4682f6896fa8dac8ccfe21d6a6c92f46844ae20/analysis/1497289622/
LZTFBQLX6G.wsf

** https://www.hybrid-analysis.com/sample/d9351db902a8f3031d0ee410f4682f6896fa8dac8ccfe21d6a6c92f46844ae20?environmentId=100
Contacted Hosts
103.249.108.128

3] https://www.virustotal.com/en/file/c305ebba4a998304919ada152c3eb3fe4037baa4526a9c16959b43c754743277/analysis/

4] https://www.hybrid-analysis.com/sample/d9351db902a8f3031d0ee410f4682f6896fa8dac8ccfe21d6a6c92f46844ae20?environmentId=100
Contacted Hosts
103.249.108.128

5] https://www.virustotal.com/en/file/d9351db902a8f3031d0ee410f4682f6896fa8dac8ccfe21d6a6c92f46844ae20/analysis/1497289622/

6] https://www.virustotal.com/en/file/8a4c8f7795eaa63ad5aed612ba6e3d81fe205a98b3edf7bc3a8f00a7977b2d4a/analysis/1497281678/

7] https://www.virustotal.com/en/file/e21fd27d3bac1e96920e7d8fa5430b2a02bba93683b6f71de072da6ad2b0ab83/analysis/1497294665/

8] https://www.virustotal.com/en/file/0411fe66e423186a0bce645fb814958e70d460f1bd1528e107a9a81ec51cfc14/analysis/1497294745/
 

    <_<

FYI…

Fake 'Emailing' SPAM - delivers pdf malware
- https://myonlinesecurity.co.uk/malspam-with-pdf-attachments-dropping-macro-excel-xls-files-deliver-malware/
14 Jun 2017 - "… an email with the subject of 'Emailing: 288639672' (random numbers) pretending to come from random names and email address that delivers some sort of malware. Over the last couple of weeks these have switched between Jaff ransomware, Dridex banking Trojans and Trickbot banking Trojan…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/emailing-288639672.png

288639672.pdf Current Virus total detections 11/56*. Payload Security** drops 000049764694.xlsm
(VirusTotal 11/56[3]) (Payload Security[4]). JoeSandbox[5]: downloads an encrypted txt file from
 http ://mailblust .com\98tf77b which is converted by the script to fungedsp8.exe (VirusTotal 8/60[6])..
There are 4 hardcoded (slightly obfuscated) download sites in the macro (there will be more in other versions)
mailblust .com\98tf77b > 162.251.85.92
78tguyc876wwirglmltm .net\af\98tf77b > 119.28.85.128
randomessstioprottoy .net\af\98tf77b > 119.28.85.128
3456group .com\98tf77b > 69.49.96.24
… Other sites found so far have been posted HERE:
- https://twitter.com/coldshell/status/874943588412653568
… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/3938fef25270abd0cc415693d8920e2f547253d05e53bc724f9832d040cd4aa3/analysis/1497432816/

** https://www.hybrid-analysis.com/sample/3938fef25270abd0cc415693d8920e2f547253d05e53bc724f9832d040cd4aa3?environmentId=100
Contacted Hosts
162.251.85.92

3] https://www.virustotal.com/en/file/3938fef25270abd0cc415693d8920e2f547253d05e53bc724f9832d040cd4aa3/analysis/1497432816/

4] https://www.hybrid-analysis.com/sample/9ee95b5f2ed81a04448ec296b2527275a815ec829bd13c04bcf988d062e320fc?environmentId=100
Contacted Hosts
162.251.85.92

5] https://jbxcloud.joesecurity.org/analysis/291764/1/html

6] https://www.virustotal.com/en/file/7712fcc54a22e33f49f1394bce603a397adf418695cdfe2503cf77fe5678e395/analysis/1497433869/
___

'Google Drive' - Phish
- https://myonlinesecurity.co.uk/important-document-google-drive-email-credential-phishing-scam/
14 Jun 2017 - "…  phishing attempts for email credentials… pretends to be a message saying 'log in to Google Drive' to get some documents that have been sent to you…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/IMPORTANT-DOCUMENT-google-drive-phishing.png

If you follow the link (all are identical) you see a webpage looking like this:
 https ://www.mealcare .ca/gdrive/drive/drive/auth/view/share/ - but it is HTTPS so it is “safe“. That is nothing you give to the criminal can be intercepted, so your email log in details can’t be stolen by another criminal on the way. Remember a green padlock HTTPS does NOT mean the site is safe. All it means is secure from easy interception between your computer and that site:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/mealcare_google_phish1.png

After you select 'click here' on this identical copy of the Google drive page (if you are not looking at the url bar) you get:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/mealcare_google_phish2.png

After you input your details you get sent to a 404 not found page on Morgan Stanley website. I can only assume the phisher tried to link originally to a genuine pdf on Morgan Stanley who quickly removed it:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/mealcare_morgan_stanley_404.png…"

mealcare .ca: 77.104.162.117: https://www.virustotal.com/en/ip-address/77.104.162.117/information/
> https://www.virustotal.com/en/url/1f8bf1c44fc217ceac3cde829867f2b602880ba3924da27cbee2112ecffc8939/analysis/
 

    <_<

FYI…

Fake 'Moneygram' SPAM - delivers java adwind
- https://myonlinesecurity.co.uk/fw-moneygram-maintenance-schedule-from-20th-june-2017-malspam-delivers-java-adwind/
15 Jun 2017 - "… a slightly different subject and email content to previous ones… These have a genuine PDF attachment with a -link- in it that downloads a zip containing the malware. The link goes to
 https ://www.domingosdandreaimoveis .com.br/wp-admin/images/Moneygram.transactions.12thJune.2017.zip
which is almost certainly a compromised wordpress site…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Fw-Moneygram-Maintenance-Schedule-From-20th-June-2017.png

The pdf looks like:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/moneyschedule_pdf.png

Moneygram.transactions.12thJune.2017.jar (474kb) - Current Virus total detections 21/55*. Payload Security**…
The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/ccce9185b82e21f52fc01efc7def531b85d9047c6ea68e4d72e5422067de999a/analysis/1497502711/

** https://www.hybrid-analysis.com/sample/ccce9185b82e21f52fc01efc7def531b85d9047c6ea68e4d72e5422067de999a?environmentId=100
Contacted Hosts
185.120.144.148

domingosdandreaimoveis .com.br: 187.45.187.122: https://www.virustotal.com/en/ip-address/184.95.37.110/information/
 

    <_<

FYI…

Fake Email account notice – Phish
… 'Your Mailbox Will Be Terminated'
- https://myonlinesecurity.co.uk/your-mailbox-will-be-terminated-phishing-for-email-credentials/
16 Jun 2017 - "We see lots of phishing attempts for email credentials. This one is slightly different…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Your-Mailbox-Will-Be-Terminated-ans@thespykiller.co_.uk-.png

If you follow the link you see a webpage looking like this:
 https ://deadsocial .com//media/email_updatep1/login.php?userid=ans@ thespykiller .co.uk
(you can put any email address at the end of the link & get the same page with email already filled in).
The red countdown continues to decrease in time while the page is open:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/spoofed_email_update.png

… After you input your email address and password, you get told 'incorrect details' and forwarded to an almost identical looking page where you can put it in again and it does that on a continual loop:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/spoofed_email_update2.png

… Don’t assume that all attempts are obvious. Watch for any site that invites you to enter ANY personal or financial information…"

deadsocial .com: 184.154.216.243: https://www.virustotal.com/en/ip-address/184.154.216.243/information/
> https://www.virustotal.com/en/url/71588e2727ffcb33e8c37f31375a77eed4d1a9aa178e16a115833e2e7b9b24c7/analysis/
 

   <_<

FYI…

Fake DHL SPAM - delivers malware
- https://myonlinesecurity.co.uk/fake-dhl-commercial-invoice-malspam-delivers-malware/
20 Jun 2017 - "An email with the subject of 'Commercial Invoice' pretending to come from export@ dhl-invoice .com with a malicious Excel XLS spreadsheet attachment delivers some sort of malware… I am being told that -other- subjects in this malspam run -spoofing- DHL include: 'DHL Commercial Invoice' and 'DHL poforma invoice'. There appear to be several different -spoofed- senders @dhl-invoice .com…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/fake-dhl-commercial-invoice-malspam-email.png

dhl_commercial_invoice_.xls - Current Virus total detections 5/55*. Payload Security** shows a download from
 http ://travel-taxi .net/test/edf.exe (VirusTotal 51/62[3]), (Payload Security[4]).
Other download locations -embedded- in other versions of the macro include
 http ://okinawa35 .net/m/iop.exe
The XLS file looks like:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/dhl_commercial_invoice_xls.png
… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/b6cc986a29dec82b64f35ceca9d9528b92801fb7571e9736c69fef83a2701409/analysis/1497948303/

** https://www.hybrid-analysis.com/sample/b6cc986a29dec82b64f35ceca9d9528b92801fb7571e9736c69fef83a2701409?environmentId=100
Contacted Hosts
202.218.50.130

3] https://www.virustotal.com/en/file/1c950172857b52c45d8a480acd3d14b5cc1877acf0bef9aaad55ff73990fe217/analysis/

4] https://www.hybrid-analysis.com/sample/88843cbfb7e327ca6b04b2a6a17a79df5484694b5f38de06a51f8ddde3301522?environmentId=100

travel-taxi .net: 203.183.93.149: https://www.virustotal.com/en/ip-address/203.183.93.149/information/
> https://www.virustotal.com/en/url/2b5ef80e8ec740f64c2736d601182d3ddac39146c339bbbbf39fe736284fc1d5/analysis/

okinawa35 .net: 202.218.50.130: https://www.virustotal.com/en/ip-address/202.218.50.130/information/
> https://www.virustotal.com/en/url/8b87cdd68a154ba1e7cbf091f945031d748438b782edded483613d417c83fd1c/analysis/
 

    <_<

FYI…

Fake 'Invoice' SPAM - delivers Locky
- https://myonlinesecurity.co.uk/the-return-of-locky-with-fake-invoice-emails/
21 Jun 2017 - "… an email with the subject of 'Copy of Invoice 79898702' coming or pretending to come from  noreply@ random email addresses with a semi-random named zip attachment in the format of 79898702.zip (random 8 digits). The zip matches the subject… Whether this is a permanent return to Locky or a one off, I don’t know… Locky has vanished for while before & returned. It is also very unusual for Locky to come as an executable file inside a zip…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Copy-of-Invoice-79898702.png

79898702.zip: extracts to INV-09837592.zip which in turn Extracts to: INV-09837592.exe
Current Virus total detections 10/60*. Payload Security**. None of the sandboxes are showing any encrypting activity or the usual Locky signs, so it looks like a -new- version with protections against analysis. We only know it is Locky because one of the analysts[1] extracted the Locky payload from the memory while running this file (Virustotal 39/60***)… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/49184047c840287909cf0e6a5e00273c6d60da1750655ad66e219426b3cf9cd8/analysis/
INV-09837592.exe

** https://www.hybrid-analysis.com/sample/49184047c840287909cf0e6a5e00273c6d60da1750655ad66e219426b3cf9cd8?environmentId=100

*** https://www.virustotal.com/en/file/b546fad0209bbf800c11565c4720fdb2685966242d2ff162f7be556dd037a6a1/analysis/1498057764/
_005C0000.mem

1] https://twitter.com/mpvillafranca94/status/877544503720247296

- http://blog.talosintelligence.com/2017/06/necurs-locky-campaign.html
June 21, 2017 - "… The volume of Locky spam Necurs has sent since the start of this particular campaign is notable. In the first hour of this campaign, Talos observed that Locky spam accounted for up to 7.2% of email volume on one of our systems*. While the campaign has since decreased in the number of messages being sent per minute, Necurs is still actively sending messages containing Locky… we can expect a fixed version of Locky to appear in a future round of Necurs' ransomware spam… it's always risky clicking-on-links or opening -attachments- in strange email messages…"
> https://1.bp.blogspot.com/-O9IsDuPG5CQ/WUrZvGUQC2I/AAAAAAAABGU/xd8ggmw2doQ7iK2tb_5ztyE62QP4DqvegCLcBGAs/s1600/image3.jpg
___

Fake 'Receipt to print' SPAM - delivers malware
- https://myonlinesecurity.co.uk/receipt-to-print-malspam-delivers-malware/
21 Jun 2017 - "… an email with the subject of 'Receipt to print' coming or pretending to come from random companies, names and email addresses with a semi-random named zip attachment which delivers some malware… Earlier WSF files today delivered Trickbot banking Trojan…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/receipt-to-print.png

Receipt_6706.zip: extracts to archive0124.zip which extracts to: 0923.wsf
Current Virus total detections 11/57*. Payload Security** shows a download of an encrypted file from
 http ://tag27 .com/08345ug? which is converted by the script to IeEOifS6.exe (VirusTotal 11/57***).
Manual examination and basic decoding of the WSF file shows these download locations:
tag27 .com/08345ug? > 162.210.102.220
78tguyc876wwirglmltm .net/af/08345ug > 119.28.86.18
malamalamak9 .net/08345ug? > 74.122.121.8
randomessstioprottoy .net/af/08345ug > 119.28.86.18
shreveporttradingantiques .com/08345ug? > 74.220.215.225 …
The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/fa88fa362c3deebf0a05983e92ecdfcc5e77097c1803c23706766a03e6852c71/analysis/1498051603/

** https://www.hybrid-analysis.com/sample/fa88fa362c3deebf0a05983e92ecdfcc5e77097c1803c23706766a03e6852c71?environmentId=100
Contacted Hosts
162.210.102.220
119.28.86.18
74.122.121.8

*** https://www.virustotal.com/en/file/14b933fc72e99e0002d6614ab869bd41d3b1ce28dc1f0817b33b9b70126ea45e/analysis/1480617465/
 

    <_<

FYI…

Fake 'INVOICE' SPAM - delivers malware
- https://myonlinesecurity.co.uk/confirm-order-and-revise-invoice-malspam-uses-cve-2017-0199-rtf-exploit-to-deliver-malware/
26 Jun 2017 - "An email with the subject of '*CONFIRM ORDER AND REVISE INVOICE*' pretending to come from admin@ random company with a malicious word doc attachment. This word doc is actually an RTF file that uses what looks like the CVE-2017-0199 exploit…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/CONFIRM-ORDER-AND-REVISE-INVOICE.png

Order Ref-22550.doc - Current Virus total detections 16/56*. Neither MALWR nor JoeSandbox could get any malicious content from it. Payload Security is still -down- this morning for maintenance that was hoped to be done over the weekend.
Update: after a bit of manual editing & investigating I was able to find the download location:
  https ://dev.null .vg/OtoGQj9.hta (VirusTotal 13/56**) ( MALWR***) which should deliver
  http ://allafrance .com/ziko.exe but is currently giving me a 404… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/cf3dcb347fc0ca6345c594aea3a2ac92f46ed512fff5f5ffff0787fa17c9bd6d/analysis/1498451330/
Order Ref-22550.doc

** https://www.virustotal.com/en/file/f9460741322906d86b32f6381a03cf8658463cf75a4696fdc20c5604d0f538b5/analysis/1498457573/
OtoGQj9.hta

*** https://malwr.com/analysis/ZDI4ZWFmYjRmZDg2NDNkODg2ODQ4NmYzMjAzNjBkNjY/

dev.null .vg: 104.27.187.29: https://www.virustotal.com/en/ip-address/104.27.187.29/information/
> https://www.virustotal.com/en/url/22c9b23023cf5e07066b14eb23b216ae40eaa45f52cdebb65f3da722aaa09263/analysis/
104.27.186.29: https://www.virustotal.com/en/ip-address/104.27.186.29/information/
> https://www.virustotal.com/en/url/22c9b23023cf5e07066b14eb23b216ae40eaa45f52cdebb65f3da722aaa09263/analysis/

allafrance .com: 85.14.171.25: https://www.virustotal.com/en/ip-address/85.14.171.25/information/
> https://www.virustotal.com/en/url/0980580a95a00d80bf048fe64e4790fc20523df30c2f5c8dc9b2ddb692b7eb4e/analysis/
___

Fake 'invoice' SPAM - links to malware doc file
- https://myonlinesecurity.co.uk/more-invoice-malspam-with-links-to-download-word-doc-deliver-malware/
26 Jun 2017 - "… An email with the subject of 'Cust # 880767-00057' [redacted] pretending to come from Jackie Fill (probably random senders) with a -link- that downloads a malicious word doc. The subject and the link that appears in body of the email has the recipients name in it but the actual link doesn’t. The link in this case went to
 http ://facyl .com.br/Invoices-payments-and-questions-JBQHL-933-907247/ where it downloaded a macro enabled word doc (the link is very slow & does time out)…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Cust-880767-00057.png

Invoice-NUVKHC-227-980463.doc - Current Virus total detections 9/56*… Joesandbox** shows connections to numerous sites where a malicious file is downloaded using PowerShell, including:
 http ://carbeyondstore .com/cianrft/ > 72.52.246.64
 http ://motorgirlstv .com/kdm/ > 202.191.62.208
 http ://nonieuro .com/xauqt/ > 216.104.189.202
 http ://pxpgraphics .com/espzyurt/ > 69.65.3.206
 http ://studiogif .com.br/jedtvuziky/ > 192.185.216.153
Eventually giving an .exe file (VirusTotal 10/61***)… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment -or- link in an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/dc39a7c3de4a13ca1ddd43b16f161430a017d82d347bb06e622ac246d301ff78/analysis/1498480442/

** https://jbxcloud.joesecurity.org/analysis/297919/1/html

*** https://www.virustotal.com/en/file/b1acddd9b84a282e89f4a87e36ddfa00774627941ecfdb86f122bd7356622fe2/analysis/1498478920/

facyl .com.br: 187.45.187.130: https://www.virustotal.com/en/ip-address/187.45.187.130/information/
> https://www.virustotal.com/en/url/f8f644d3bb005d384235e3f96ee7559e86f7672c20ace5681af4245b66cb44e5/analysis/
 

    <_<

FYI…

Fake 'Fattura' SPAM - delivers xls attachment malware
- https://myonlinesecurity.co.uk/more-italian-fattura-malspam-delivering-banking-trojans/
27 Jun 2017 - "An email with the subject of 'Fattura n.9171 del 27/06/17' pretending to come from random Italian email addresses with an Excel XLS spreadsheet attachment…
Update: I am 100% assured* that this is Trickbot banking Trojan…
* https://twitter.com/_operations6_/status/879680802136707073

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Fattura_it_spam1.png

Attachment: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Fattura_it_spam2.png

The xls file looks like this, with the instructions to 'enable content' in Italian. They obviously hope that the victim will 'enable content & macros' to see the washed out invoice details in full detail:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/Italian-Fattura-fake-invoice-xls.png

FATTURA num. 6655 del 27-=.xls - Current Virus total detections 6/56[1]. Payload Security[2] shows a download from
 https ://3eee22abda47 .faith/nvidia4.dvr (VirusTotal 11/61[3])… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
1] https://www.virustotal.com/en/file/df501864f4a6338f0d646e0e5143ac30b06dbed92b15b312d9fdd914a9cc9395/analysis/
1_FATTURA num. 5999 del 27-06-2017.xls

2] https://www.hybrid-analysis.com/sample/df501864f4a6338f0d646e0e5143ac30b06dbed92b15b312d9fdd914a9cc9395?environmentId=100
Contacted Hosts
46.173.218.138

3] https://www.virustotal.com/en/file/85adc0dde125d2c96e388c4a03139bf056d9bacf55a4f957b2c237b83ef619f8/analysis/
nvidia4.dvr

3eee22abda47 .faith: 46.173.218.138: https://www.virustotal.com/en/ip-address/46.173.218.138/information/
> https://www.virustotal.com/en/url/a0e0edc904eb4c26c61458c62849af16df4eaccf0792aa90055ca1962dcfeca1/analysis/
___

Protect Your Cloud - from Ransomware
> http://www.darkreading.com/cloud/9-ways-to-protect-your-cloud-environment-from-ransomware/d/d-id/1329221
6/27/2017
___

Multiple Petya Ransomware Infections Reported
- https://www.us-cert.gov/ncas/current-activity/2017/06/27/Multiple-Petya-Ransomware-Infections-Reported
June 27, 2017

- http://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html
June 27, 2017 - "… a new malware variant has surfaced…"

- https://www.helpnetsecurity.com/2017/06/27/petya-ransomware/
June 27, 2017

- http://www.reuters.com/article/us-cyber-attack-idUSKBN19I1TD
Jun 27, 2017 | 4:35pm EDT

- http://www.telegraph.co.uk/news/2017/06/27/ukraine-hit-massive-cyber-attack1/
27 June 2017 • 8:50pm GMT
 

    <_<

FYI…

Fake 'UPS cannot deliver' SPAM - delivers ransomware
- https://myonlinesecurity.co.uk/return-of-fake-ups-cannot-deliver-malspam-with-an-updated-nemucod-ransomware-and-kovter-payload/
29 Jun 2017 - "The 'UPS failed to deliver' messages have come back… it looks like the Kovter gang have taken advantage of the Petya outbreak to add to the mix. They have updated the nemucod ransomware version to make it, on first look, impossible to decrypt at this time without paying the ransom. Thanks to Michael Gillespie* a well known anti-ransomware campaigner for his assistance and pointing me in the right direction about the new nemucod ransomware version…
* https://twitter.com/demonslay335
If you get infected by this or any other ransomware please check out the ID Ransomware service** which will help to identify what ransomware you have been affected by and offer suggestions for decryption…
** https://id-ransomware.malwarehunterteam.com/index.php

The emails are the same as usual (you only have to look through this blog and search for UPS[1] or FedEx[2] or USPS[/3]… hundreds of different examples and subjects)…
1] https://myonlinesecurity.co.uk/?s=UPS

2] https://myonlinesecurity.co.uk/?s=fedex

3] https://myonlinesecurity.co.uk/?s=usps

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/ups_unable_to_deliver.png

… there is a difference in the .js files that are coming in the (attachment) zips… The initial js looks very similar to previous but has much longer vars (var zemk) that is used to download the other files…
Showing a high level of encryption that at this time appears unable to be decrypted without paying the ransom.
This ransom note (or something similar with different links) gets displayed on the victim’s desktop:
>> https://myonlinesecurity.co.uk/wp-content/uploads/2017/06/nemucod_ransomware_instructions.jpg

The original js downloads 3 files - 1 is Kovter as usual, the second is unknown and there is a massive 6.7mb php interpreter. The 2nd file won’t run without the php interpreter. It looks like it also belongs to PHP and both php files together are needed to run the downloaded php counter files to encrypt the computer…
4] https://www.hybrid-analysis.com/sample/d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e?environmentId=100
Contacted Hosts (406)

5] https://jbxcloud.joesecurity.org/analysis/300085/1/html
UPS-Delivery-005156577.doc.js

6]https://www.virustotal.com/en/file/d167368409c3fa244e17cef06eb83174b03fc0397cb0d907daf30dfdba5e100e/analysis/1498629470/
UPS-Delivery-005156577.doc.js
Detection ratio: 9/55

… The Kovter download looks like it works separately to the ransomware but might actually be involved somewhere along the line:
7] https://www.virustotal.com/en/file/21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92/analysis/1498630707/
da40c167cd75d.png
Detection ratio: 25/62

8] https://www.hybrid-analysis.com/sample/21efa5573721890cdcf9481f613ccb7d633733f05bc29cfeae402802e382cc92?environmentId=100
Contacted Hosts (398)

… Sites involved in this campaign found so far this week:
resedaplumbing .com > 166.62.58.18
modx.mbalet .ru> 95.163.101.104
artdecorfashion .com > 107.180.0.125
eventbon .nl > 109.106.167.212
elita5 .md > 217.26.160.15
goldwingclub .ru > 62.109.17.210
www .gloszp .pl > 87.98.239.19
natiwa .com > 115.84.178.83
desinano .com.ar > 190.183.59.228
amis-spb .ru > 77.222.61.227
perdasbasalti .it > 94.23.64.3
120.109.32.72: https://www.virustotal.com/en/ip-address/120.109.32.72/information/
calendar-del .ru > 77.222.61.227
indexsa.com .ar > 190.183.59.228 …"
___

'Blank Slate' - malspam campaign -ransomware-
- https://isc.sans.edu/forums/diary/Catching+up+with+Blank+Slate+a+malspam+campaign+still+going+strong/22570/
Last Updated: 2017-06-29 - "'Blank Slate' is the nickname for a malicious spam (malspam) campaign pushing
-ransomware- targeting Windows hosts… Today I collected 11 Blank Slate emails, so this diary examines recent developments from the Blank Slate campaign. Today's Blank Slate malspam was pushing Cerber and GlobeImposter ransomware… -fake- Chrome pages sent victims zip archives containing malicious .js files designed to infect Windows hosts with ransomware… potential -victims- must open the zip attachment, open the enclosed zip archive, then double-click the final .js file. That works on default Windows configurations…"
(More detail at the isc URL above.)
___

- https://www.bitdefender.com/news/massive-goldeneye-ransomware-attack-affects-users-worldwide-3330.html?icid=overlay|c|all-pages|goldeneye
Update 6/28 08.00 GMT+3 - "There is mounting evidence that the #GoldenEye / #Petya ransomware campaign might not have targeted financial gains but rather data destruction…"
 

   <_<

FYI…

Fake 'wire request' SPAM - delivers banking trojan
- https://myonlinesecurity.co.uk/fake-bank-of-america-the-wire-request-is-unsuccessful-malspam-delivers-chthonic-banking-trojan/
6 Jul 2017 - "An email with the subject of 'The wire request is unsuccessful!' pretending to come from Billing Support using random senders & email addresses with a malicious word doc attachment delivers Chthonic banking trojan…

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/07/billing-support.png

printed_ty_0717.doc - Current Virus total detections 12/58*. Payload Security** shows a download from
 http ://185.117.73.105 /bofasup.exe (VirusTotal 13/57***)… alternative doc detections [1] [2]. Other download locations include: (there are 3 download locations hard coded in the macro):
 http ://185.45.192.116 /bofasup.exe
 http ://185.117.72.251 /bofasup.exe
… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/0b50c759aa614d2e40740c8581f0ba3ef4a24521c4a1e0e2a707e274d7392e3e/analysis/1499318502/

** https://www.hybrid-analysis.com/sample/0b50c759aa614d2e40740c8581f0ba3ef4a24521c4a1e0e2a707e274d7392e3e?environmentId=100

*** https://www.virustotal.com/en/file/d73aeebb8835a93472062ae7619abc19ccc09646b38312b16e7f8cfa9a7ee397/analysis/
bofasup.exe

1] https://www.virustotal.com/en/file/b11691b10e71dd7a2bb8519aa55e0d747bf537fd1e2326823697c61a108a3968/analysis/
printed_copy_da_0717.doc
Detection ratio: 13/57
 
2] https://www.virustotal.com/en/file/882e41a5859363452385058da9d1c723406272d1bda5cfd9046115dfc4945e63/analysis/1499319821/
copy_wt_0717.doc
Detection ratio: 11/57
___

Fake 'eFax' SPAM - malicious doc/xls attachment
- https://myonlinesecurity.co.uk/more-faked-e-fax-messages-spoofing-nest-pensions-delivers-malware/
6 Jul 2017 - "… spoofed eFax message from 1 month ago[1], the same gang are using a similar range of fake e-faxcorporatexxx.top domains to send these malspam emails. Today’s comes  with the usual typical subject of 'eFax message from “0300 200 3822” – 2 page(s)' coming from eFax with a malicious word doc attachment which delivers some sort of malware…
1] https://myonlinesecurity.co.uk/fake-efax-message-from-0300-200-3835-2-pages-malspam-delivers-smoke-sharik-dofoil-and-trickbot/

Screenshot: https://myonlinesecurity.co.uk/wp-content/uploads/2017/07/efax_nest.png

The word doc looks like:
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/07/securemessagedoc_nest.png

SecureMessage.doc - Current Virus total detections 6/57*… Joesandbox** shows a download from
 http ://5.149.252.155 /parcelon13.exe (VirusTotal 15/63***)…
This email attachment contains what appears to be a genuine word doc -or- Excel XLS spreadsheet with either a macro script -or- an embedded OLE object that when run will infect you… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/2d1416850ad33c23e9b4076f3f7f36b215d64c6259f0bd2d211ae043f8a3b85c/analysis/1499264264/
SecureMessage.doc

** https://jbxcloud.joesecurity.org/analysis/304760/1/html

*** https://www.virustotal.com/en/file/cf8f3cd568c449d06786092be1b41eccf2da6b7f9b37b17d2263589cec6cc3c3/analysis/1499306577/

e-faxcorporate102 .top: 46.8.221.104: https://www.virustotal.com/en/ip-address/46.8.221.104/information/
 

    <_<