Fake 'BACs documents' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/fake-royal-bank-of-scotland-important-bacs-documents-malspam-delivers-trickbot-banking-trojan/
7 Jul 2017 - "An email with the subject of 'FW: Important BACs documents' pretending to come from Royal Bank of Scotland but actually coming from a look-a-like domain with a -link- to a malicious zip attachment containing a .js file… delivering Trickbot banking Trojan… criminals sending these have registered various domains that look like genuine Bank domains. Normally there are 3 or 4 newly registered domains that -imitate- the bank or some message sending service that can easily be confused with a legitimate organisation in some way that send these. So far we have only found 1 domain today:
rbsdocs .co.uk > 160.153.162.130
As usual they are registered via Godaddy as registrar and hosted by Godaddy on ip 160.153.162.130 but the emails are being sent via host Europe 85.93.88.125…
Rbs_Account_BACs.js - Current Virus total detections 1/57*. Payload Security** shows a download from
http ://mutfakdolabisitesi .com/grandsergiostalls.png which of course is -not- an image file but a renamed .exe file that gets renamed to qkY5ijY.exe and autorun (VirusTotal 12/64***)… The basic rule is NEVER open any attachment -or- link in an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/2ab8e06ea8d83b593f2c9af2ec271db8fff9c1ebb0b3b4e3e716fc0bbb541e8d/analysis/1499423876/
Rbs_Account_BACs.js
'Facebook Lottery' - Scam
- https://myonlinesecurity.co.uk/facebook-lottery-scam/
7 Jul 2017 - "'Oh look I have won the Facebook Lottery', or might have done if there actually was such a thing. Unfortunately it is all a big scam. If you were unwise enough to reply, all you would get is a request for a sum of money for Post & packing and the transfer fee for the money. To make it more attractive than usual, apart from the just over $1m money they are giving you a Facebook cap, tee shirt and wallet, 'Wow! how exciting!'. To show how clueless or how they don’t filter or check email addresses they send to, this was sent to a spam-trap-email address…
Fake 'Delivery Status' SPAM - delivers ransomware
- https://myonlinesecurity.co.uk/new-powershell-ransomware-coming-in-malspam-emails-pretending-to-be-email-bounce-messages/
10 July 2017 - "We were notified of a new ransomware version* last night. This new version comes as an email attachment which is a zip inside a zip before extracting to a .js file in a -fake- 'Delivery Status Notification, failed to deliver' email bounce message. The .js file in the email attachment is a PowerShell -script- and there are no other files involved. Nothing new is downloaded. When the files are encrypted they DO NOT change file name or extensions and appear “normal” to the victim until you try to open them. This is the same behaviour we have been seeing with the recent 'UPS failed to deliver'** nemucod ransomware versions…
* https://twitter.com/SecGuru_OTX/status/884136470910562304
Fake 'Secure Communication' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/yet-another-spoofed-hm-revenue-customs-secure-communication-malspam-delivering-trickbot-banking-trojan/
10 Jul 2017 - "An email with the subject of 'Secure Communication' pretending to come from HM Revenue & Customs but actually coming from a look-alike-domain < Secure.Communication@ hrmccommunication .co.uk > with a malicious word doc attachment… delivering Trickbot banking Trojan… a very important site involved in today’s campaign with images being hosted on www .libdemvoice .org/wp-content/uploads/2012/06/HMRC-logo-300×102.jpg… they have been hosting an HMRC logo since 2012…
HMRC3909308823743.doc - Current Virus total detections 6/57*. Payload Security** shows a download from one of these 2 locations:
http ://pilotosvalencia .com/grazlocksa34.png -or- http ://ridderbos .info/grazlocksa34.png
which of course is -not- an image file but a renamed .exe file that gets renamed to Sonqa.exe and
autorun (VirusTotal 10/63***)… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/91d47bdb1c6ac1a3ecf9c1c51970a6064429b58c712ef16a9f3f6d2e3d64e56c/analysis/1499682599/
JAVA_ADWIND - Trend Micro telemetry
> http://blog.trendmicro.com/trendlabs-security-intelligence/spam-remote-access-trojan-adwind-jrat/
July 11, 2017 - "… our telemetry for JAVA_ADWIND… the malware has had a steady increase in detections since the start of the year. From a mere 5,286 in January 2017, it surged to 117,649 in June. It’s notable, too, that JAVA_ADWIND detections from May to June, 2017 increased by 107%, indicating that cybercriminals are actively pushing and distributing the malware… JAVA_ADWIND detections from January to June, 2017:
> https://blog.trendmicro.com/trendlabs-security-intelligence/files/2017/07/jrat-adwind-spam-1.jpg
… a Java EXE, dynamic-link library (DLL) and 7-Zip installer will be fetched from a domain that we uncovered to be a file-sharing platform abused by the spam operators:
hxxps ://nup[.]pw/DJojQE[.]7z
hxxp ://nup[.]pw/e2BXtK[.]exe
hxxps ://nup[.]pw/9aHiCq[.]dll …
… it appears to have the capability to check for the infected system’s internet access. It can also perform reflection, a dynamic code generation in Java. The latter is a particularly useful feature in Java that enables developers/programmers to dynamically inspect, call, and instantiate attributes and classes at runtime. In cybercriminal hands, it can be -abused- to evade static analysis from traditional antivirus (AV) solutions…
Indicators of Compromise:
Files and URLs related to Adwind/jRAT:
hxxp ://ccb-ba[.]adv[.]br/wp-admin/network/ok/index[.]php
hxxp ://www[.]employersfinder[.]com/2017-MYBA-Charter[.]Agreement[.]pif
hxxps ://nup[.]pw/e2BXtK[.]exe
hxxps ://nup[.]pw/Qcaq5e[.]jar …"
Protected.doc - Current Virus total detections 5/58*. Payload Security** shows a download from
http ://armor-conduite .com/geroi.png which of course is -not- an image file but a renamed .exe file that gets renamed to Tizpvu.exe and autorun (VirusTotal 9/63***). An alternative download location is
http ://kgshrestha .com.np/geroi.png … DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/689758d11e57287c809250a14b38fa2833b2c7895a7823562fca85e87c740b84/analysis/1499942591/
Fake 'Secure message' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/spoofed-sage-outdated-invoice-malspam-delivers-trickbot/
14 Jul 2017 - "An email with the subject of 'Secure email message. pretending to come from Sage Invoice but actually coming from a look-a-like domainwith a malicious word doc attachment… delivering Trickbot banking Trojan…
SageInvoice.doc - Current Virus total detections 4/57*. Payload Security** shows a download from
http ://ridderbos .info/sergiano.png which of course is -not- an image file but a renamed .exe file that gets renamed to Pmkzc.exe and autorun (VirusTotal 8/61***)… An alternative download location is
http ://kgshrestha .com.np/sergiano.png … DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/9594c4a60d67b58d48f8d235c5a03a26e2435a791cfdb89f6892fcb81954b435/analysis/1500038647/
Fake 'payment slip' SPAM - delivers malware
- https://myonlinesecurity.co.uk/fake-swift-copy-notification-payment-slip-malspam-with-an-ace-attachment-delivers-malware-and-a-jrat-trojan/
18 Jul 2017 - "… an email with the subject of 'payment slip' … pretending to come from random companies, names and email addresses with an ACE attachment (ACE files are a sort of zip file that normally needs special software to extract. Windows and winzip do not natively extract them) which delivers some malware… it has some indications of fareit Trojan. This also has a jrat java.jar file attachment…
doc00042714507507789135.zip extracts to: doc000799723147922720821.vbs - Current Virus total detections 9/57*.
Payload Security* shows a download of an encrypted text file from
http ://pluzcoll .com/56evcxv? which is converted to nbVXsSxirbe.exe (VirusTotal 31/63***)… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/9033a377113f80beedde5575de1fe832bb0e49b9bc6e33851b26e8c8a47fd6d8/analysis/1500373606/
Fake 'Invoices' SPAM - deliver Trickbot
- https://myonlinesecurity.co.uk/multiple-campaigns-delivering-trickbot-banking-trojan/
19 July 2017 - "… pdf attachments that drops a malicious macro enabled word doc that delivers Trickbot…
today we have seen 3 different campaigns and subjects all eventually leading to the same Trickbot payload…"
___
Bots - searching for Keys & Config Files
- https://isc.sans.edu/diary/22630
2017-07-19 - "… yesterday, I found a -bot- searching for… interesting files: configuration files from popular tools and website private keys. Indeed, file transfer tools are used by many webmasters to deploy files on web servers and they could theoretically leave juicy data amongst the HTML files… Each file was searched with a different combination of lower/upper case characters… This file could contain references to hidden applications (This is interesting to know for an attacker)…" (More detail at the isc URL above.)
___
'Cloud' - Data Leak results from Amazon AWS Configuration Error
7/18/2017 - "A data leak at Dow Jones & Co. exposed the personal information of millions of customers after a public cloud configuration error. This marks the fifth major public cloud leak in the past several months after similar incidents affected Verizon, the WWE, US voter records, and Scottrade. This mistake compromised millions of customers' names, account information, physical and email addresses, and last four digits of credit card numbers. It also affected 1.6 million entries in Dow Jones Risk and Compliance, a collection of databases used by financial companies for compliance with anti-money laundering regulations. All of this information was left exposed in an Amazon Web Services S3 bucket, which had its permission settings configured to let any AWS Authenticated User download data using the bucket's URL. Amazon defines "authenticated user" as anyone who has a free AWS account, meaning the data was available to more than one million users… Dow Jones has confirmed 2.2 million people were exposed. Based on the repository's size and composition, Upguard "conservatively estimates" up to four million people could have been affected, though it states* duplicated subscriptions may account for some of the difference. The publisher has "no reason to believe" any of the data was stolen…"
Fake 'eFax' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/efax-message-from-8473365403-1-pages-caller-id-44-020-3136-4931-malspam-delivers-trickbot-banking-trojan/
20 July 2017 - "… Trickbot malspams… an email with the subject of 'eFax message from 8473365403' – 1 page(s), Caller-ID: 44-020-3136-4931 pretending to come from eFax but actually coming from a look-a-like domain with a malicious word doc attachment… they are registered via Godaddy as registrar hosted on 160.153.16.19 and the emails are sent via AS8972 Host Europe GmbH 85.93.88.109. These are registered with what are obviously -fake- details…
… The -link- in the email body goes to
https ://efax-download .com/pdx_did13-1498223940-14407456340-60
where you see page like this with-a-link to download the actual malware binary
https ://efax-download .com/14407456340-60.zip. extracting to 14407456340-60.exe
The page tries initially to automatically download 14407456340-60.pdf.exe (VirusTotal 3/64*).
Payload Security[2]…
> https://myonlinesecurity.co.uk/wp-content/uploads/2017/07/efax-download.png
* https://twitter.com/Racco42
> Beware - for some reason the pastebin link is giving me -diverts- to a scumware site trying to download a -fake-flashplayer-hta-file (VirusTotal 17/58[1]) (Payload Security [2])
https ://uubeilisthoopla .net/85123457821940/be74be7a58e47c2837f71295a31d1533/24c3df3c0fe3c937281c3d8d7427e1da.html
which downloads
https ://uubeilisthoopla .net/85123457821940/1500548202679984/FlashPlayer.jse
(VirusTotal 4/58[3]) (Payload Security [4])…
1] https://www.virustotal.com/en/file/25822bd5a94779301001ba485bcbb49f087b5f56c07e4e9803284af24174f3c7/analysis/1500548514/
FlashPlayer.hta
01258895166_6382218_592164.zip: Extracts to: 01258861149_20170411_185381.wsf
Current Virus total detections 2/58*. Payload Security** shows a download from
http ://avocats-france-maroc .com/sdfgdsg1? which gave a js file (VirusTotal 7/57[3]) (Payload Security[4]) which contacts a list-of-sites and should download an encrypted text file which is converted by the js file to the Trickbot binary. However, Payload Security[4] couldn’t get anything. The sites I can see in -this- js file are:
aprendersalsa .com/nhg67r? – artegraf .org/nhg67r? – asheardontheradiogreens .com/nhg67r?
asuntomaailma .com/nhg67r?… It will probably be similar to an earlier Trickbot version…
Thanks to Racco42[5] who has found the download sites and payload - PasteBin[6].
> Caution: we have been seeing fake flashplayer downloads & diverts via malicious ads on pastebin…
The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/f1071e7982786be807a4ee9b7f9ea7bfac4cbb21ae5d5ca1852e5a7513ea80d3/analysis/1500641858/
01258861149_20170411_185381.wsf
Malicious Chrome extensions / Facebook fraud - more
- https://www.helpnetsecurity.com/2017/07/21/stealthy-botnet/
July 21, 2017 - "ESET* researchers have unearthed a botnet of some 500,000 infected machines engaged mostly in ad-related fraud by using malicious Chrome extensions, but also Facebook fraud and brute-forcing Joomla and WordPress websites…"
* https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/
20 Jul 2017 - "… a huge botnet that they monetize mainly by installing malicious browser extensions** that perform ad injection and click fraud. However, they don’t stop there. The malicious Windows services they install enable them to execute anything on the infected host. We’ve seen them being used to send a fully featured backdoor, a bot performing massive searches on Google, and a tool performing brute-force attacks on Joomla and WordPress administrator panels in an attempt to compromise and potentially resell them.
Figure 1 shows the full Stantinko threat from the infection vector to the final persistent services and related plugins:
> https://www.welivesecurity.com/wp-content/uploads/2017/07/stantinko-infographics-blog-01.png
… Stantinko stands out in the way it circumvents antivirus detection and thwarts reverse engineering efforts to determine if it exhibits malicious behavior. To do so, its authors make sure multiple parts are needed to conduct a complete analysis. There are always -two- components involved: a loader and an encrypted component. The malicious code is -concealed- in the encrypted component that resides either on the disk or in-the-Windows-Registry. This code is loaded and decrypted by a benign-looking executable. The key to decrypt this code is generated on a per-infection basis. Some components use the bot identifier and others use the volume serial number from its victim PC’s hard drive. Making reliable detections based on the non-encrypted components is a very difficult task, since artifacts residing on the disk do not expose malicious behavior until they’re executed. Moreover, Stantinko has a powerful resilience mechanism. After a successful compromise, the victim’s machine has two malicious Windows services installed, which are launched at system startup. Each service has the ability to reinstall the other in case one of them is deleted from the system. Thus, to successfully uninstall this threat, both services must be deleted at the same time. Otherwise, the C&C server can send a new version of the deleted service that isn’t detected yet or that contains a new configuration…"
** https://www.helpnetsecurity.com/images/posts/stantinko-1.jpg (More detail at the welivesecurity URL above.)
Weather .com, Fusion expose Data via Google Groups Config Error
> http://www.darkreading.com/vulnerabilities—threats/weathercom-fusion-expose-data-via-google-groups-config-error–/d/d-id/1329449
7/24/2017 - "Major companies have publicly exposed messages containing sensitive information due to a user-controlled configuration error in Google Groups. Researchers at RedLock Cloud Security Intelligence (CSI) discovered Google Groups belonging to hundreds of companies inadvertently exposed personally identifiable information (PII) including customer names, passwords, email and home addresses, salary compensation details, and sales pipeline data. Internal messages also exposed business strategies, which could create competitive risk if in the wrong hands, explains RedLock*…
* https://blog.redlock.io/google-groups-misconfiguration
The Weather Company, the IBM-owned operator of weather .com and intellicast .com, is among the companies affected. Fusion Media Group, parent company of Gizmodo, The Onion, Jezebel, Lifehacker, and other properties made the same mistake… The companies that leaked data accidentally chose the sharing setting 'public on the Internet', which enabled -anyone- on the Web to access -all- information contained in their messages. RedLock advises all companies using Google Groups to ensure 'private' is the sharing setting** for 'Outside this domain-access to groups'. RedLock's CSI team routinely checks various cloud infrastructure tools for threat vectors, and monitors publicly available data to detect misconfigurations that could cause security incidents…"
** https://blog.redlock.io/hs-fs/hubfs/Blogs/GoogleGroupsSetting.png
___
Petya decryptor for old versions released
- https://blog.malwarebytes.com/malwarebytes-news/2017/07/bye-bye-petya-decryptor-old-versions-released/
Last updated: July 25, 2017 - "Following the outbreak of the Petya-based malware in Ukraine, the author of the original version, Janus, decided to release his master key, probably closing the project… Based on the released key, we prepared a decryptor that is capable of unlocking all the legitimate versions of Petya…
WARNING: During our tests we found that in some cases Petya may -hang- during decryption, or cause some other problems potentially -damaging- to your data. That’s why, before any decryption attempts, we recommend you to make an additional backup…
It -cannot- help the victims of pirated Petyas, like PetrWrap or EternalPetya (aka NotPetya)…" (More detail at the malwarebytes URL above.)
Fake 'No Subject' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/fake-telstra-bill-malspam-delivers-trickbot-banking-trojan-via-multi-stage-download/
26 Jul 2017 - "Another Trickbot campaign overnight… Pretends to be a bill coming from notifications@ in.telstra .com.au…. You get a wsf file in zip to start with. That has a hardcoded single site in the file. That downloads a .js file which has 4 or sometimes 5 hardcoded urls which download an encrypted txt file that is converted by the js file to a working Trickbot binary. The name & reference number in the email is random…
May-July2017.zip: Extracts to: QPX_ 18941124638_411385.wsf - Current Virus total detections 4/57*.
Payload Security** downloads from dodawanie .com/?1 (or one of the other stage 2 sites listed in this pastebin[3]
(VirusTotal 5/577[4]) (Payload Security[5]) which -cannot- examine the file because it is seen as txt. However that downloads of an encrypted file from one of the stage 3 sites listed in this pastebin report[6] which is converted by the script to an .exe file (VirusTotal 17/63[7]) (Payload Security[8])… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/adff69837675f282bdb5992834bd348629314d8fb35aaa1d0244a1d97535cbc6/analysis/1501020013/
QPX_ 18941124638_411385.wsf
Fake 'Account secure documents' SPAM - delivers Trickbot
- https://myonlinesecurity.co.uk/spoofed-hsbc-account-secure-documents-malspam-delivers-trickbot/
26 Jul 2017 - "An email with the subject of 'Account secure documents' pretending to come from HSBC but actually coming from a look-alike-domain with a malicious word doc attachment is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan …
PaymentAdvice.doc - Current Virus total detections 4/57*. Payload Security** shows a download from
https ://kartautoeskola .com/test/images/logo.png which is -not- an image file but a renamed .exe file
that gets -renamed- to warrantyingresalesdioxide.exe and autorun (VirusTotal 1/63***) Payload Security[4]…
DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/51fc6482d1ab80010ebfe25d5b2a81c556235f4f541631589be49b3d9ac366af/analysis/1501070044/
PaymentAdvice.doc
BEC attacks more costly than Ransomware…
- http://www.darkreading.com/vulnerabilities—threats/bec-attacks-far-more-lucrative-than-ransomware-over-past-3-years/d/d-id/1329414
7/20/2017 - "… cybercriminals walked away with $5.3 billion from business email compromise (BEC) attacks compared with $1 billion for ransomware over a three-year stretch, according to Cisco's 2017 Midyear Cybersecurity Report released*…
* https://engage2demand.cisco.com/cisco_2017_midyear_cybersecurity_report
… Cisco's Martino says targeted cybersecurity -education- for employees can help prevent users from falling for BEC -and- ransomware attacks. The finance department could especially benefit from security training on phishing campaigns, so when the bogus-email comes across the transit of the CEO asking for a funds transfer it can be detected… Regular software patching also is crucial. When spam-laden-malware hits or ransomware attacks similar to WannaCry surfaces, the impact can be minimized… a balanced defensive and offensive posture, with not just firewalls and antivirus but -also- including measures to hunt down possible attacks through data collection and analysis…"
Fake 'Invoice notification' SPAM - delivers malware
- https://myonlinesecurity.co.uk/invoice-notification-with-id-number-40533-delivers-malware/
27 Jul 2017 - "An email with the subject of 'Invoice notification with id number: 40533' pretending to come from random senders with a link-in-the-email to a malicious word doc delivers… malware… possibly Emotet banking Trojan…
GOCNX8263762.doc - Current Virus total detections 7/57*. Payload Security** shows a download from one of the sites listed below where a random named .exe is delivered (VirusTotal 13/62[/3]) (Payload Security[4]).
The delivery sites are all compromised sites:
http ://petruchio .org/zbmcicj/
http ://danjtec .it/ldcgtgkew/
http ://radiosmile .hu/q/
http ://ihealthcoach .net/paqdauulaq/
http ://btsound .com/erepr/
… DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/65c861a58ff17e389c04f000ddabd5421765dd4bf5aac666e6aa1b4934b15d27/analysis/1501132650/
URQTN6370102.doc
ZDFRRI208.doc - Current Virus total detections 1/58[1]. Payload Security[2] doesn’t show any download… Twitter contacts Malwarehunterteam[3] and Antelox[4] have found some of the associated download urls and payload…
Theses word docs are using various tricks that make it difficult for the online sandboxes to decode/analyse, find the download sites and download the eventual payload. The url so far found is
http ://macsys.ca/ZQRZCy/ but… there are others.
1] https://www.virustotal.com/en/file/6bf1ec3bc2f0a97bdca700f02a99db02543fc00e6e9e88bbc444e56c4f74dfc5/analysis/1501480309/
BNCKKK930.doc
Fake 'Receipt' SPAM - delivers ransomware
- https://myonlinesecurity.co.uk/more-fake-receipts-and-payment-receipt-emails-deliver-globe-ransomware/
31 July 2017 - "… malware downloaders pretending to be a 'payment receipt' -or- a 'receipt' is an email with the subject of 'Receipt 21426' coming or pretending to come from donotreply@ random email addresses with a zip attachment containing a .vbs file that delivers globe ransomware. The zip name corresponds with the subject line. There are a mass of subject lines today. Some of the patterns include:
Receipt#83396
Receipt 21426
Payment-421
Payment Receipt 222
Payment Receipt#97481
Payment Receipt_8812
Receipt-351
Payment Receipt_03950 …
One of the emails looks like: From: donotreply@ blueprintrecruitment .co.uk
Date: Mon 31/07/2017 11:15
Subject: Receipt 21426
Attachment: P21426.zip
[Body content:]
Attached is the copy of your payment receipt.
P21426.zip: Extracts to: 20172.2017-07-31_75.20.68.vbs - Current Virus total detections 7/58*. Payload Security** shows a download of a txt file from
http ://koewege .de/98wugf56? > 81.169.145.77
which is simply renamed by the script to a random named .exe file (VirusTotal 14/64[3]) (Payload Security[4])…
The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/9f476dccaa8ed2d8ee30cea0232413c236197ad7fff59b77d266b55dbcd711d6/analysis/1501499651/
20172.2017-07-31_75.20.68.vbs
SecureMessage.doc - Current Virus total detections 5/58* Payload Security** shows a download from
http ://lexpertpret .com/fr/nologo.png which of course is -not- an image file but a renamed .exe file that gets renamed to ywbltmn.exe and autorun (VirusTotal 16/63[3]) (Payload Security[4]). An alternative download location is
https ://hvsglobal .co.uk/image/nologo.png
DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/08e3da6d2868bb292f81e3580b1686a34fc5c25051f2c9601671f35873688307/analysis/1501605462/
SecureMessage.doc
VM97358238_20170801.zip: Extracts to: VM9742814303_20170801.vbs Current Virus total detections 16/55*
Payload Security**. Manual analysis of the vbs file shows these download sites hardcoded in a base64 encoding with a bit of extra nonsense padding to try to hide them (there will be loads of other sites in other vbs files attached to a -different- version of this)
showyourdeal .com/JHghjHy6? > 143.95.99.159
89tg7gjkkhhprottity .com/af/JHghjHy6 > 91.214.114.154
mybutterhalf .com/JHghjHy6? > 208.91.198.170
dreamoneday .com/JHghjHy6? > 103.21.58.181
These are downloaded as txt files but are simply renamed .exe files (VirusTotal 16/55[3]) (Payload Security[4])…
The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/794dcfdcc1362140eee6fcda11ddf239ab048a965bba634bb787321db9672cfa/analysis/1480616575/
-6dt874p53077.js
Update: it appears that this is more likely to be Globeimposter ransomware* not Emotet. It looks like I was mislead by initial detections on VirusTotal and the delivery method.
* https://twitter.com/VK_Intel/status/892613372889399296 2nd Update 2 August 2017: This campaign has continued on and off all night (UK time) with a slight change to the zip file names. From exactly midnight UK time last night the last part of the zip name ( the date) changed from VM#######_20170801.zip to VM#######_20170802.zip. Looking through a few of the nearly 600 I received, it looks like the download sites are the -same- as many of the sites in yesterday’s (and earlier) Trickbot and globeimposter campaigns that I didn’t report on because of other real world commitments. A list of sites can be seen in VT comments**. Just change /98wugf56 to /JHghjHy6 (quite a few sites are live using the latest file name format).
** https://www.virustotal.com/en/file/adcced3025b513fd907f595357182d66c630ebcad3d0720851230ec93a81fa27/analysis/
Fake 'Online Bill' SPAM - delivers malware
- https://myonlinesecurity.co.uk/spoofed-vodafone-online-bill-manager-your-phone-bill-is-ready-to-view-delivers-banking-trojan/
2 Aug 2017 - "… malspam campaign pretending to be a 'Vodafone bill'. These started earlier this morning with links-in-the-email to a compromised or fraudulently set up SharePoint business site that soon stopped delivering the malware payloads. They then quickly switched to a whole host of other compromised sites to host the word doc that is the first stage in the malware download process. This is definitely a dyre based banking Trojan and might be Dridex or might be Trickbot…
Bill_02082017.doc - Current Virus total detections 21/59*. Payload Security** downloads an encrypted txt file from one of these 3 sites (may be more in other macros so far not examined):
http ://ortaokuldayiz .com/82yyfh3 > 94.73.148.130
http ://trredfcjrottrdtwwq .net/af/82yyfh3 > 54.214.108.57
http ://eoliko .com/82yyfh3 > 5.100.152.26
which is converted by the script to sultan8.exe (VirusTotal 16/63[3]) (Payload Security[/4])…
Eset Ireland did mention this one earlier today:
> https://blog.eset.ie/2017/08/02/fake-vodafone-bill-spreads-trojan-malware/
DO NOT follow the advice they give to enable macros or enable editing to see the content… The basic rule is NEVER open any attachment to an email, unless you are expecting it…"
* https://www.virustotal.com/en/file/e7731c732e562d09d59135acf4a331b4b6b1cdaf041c7629924cc35d0b159eb8/analysis/
Bill_02082017.doc
![https://myonlinesecurity.co.uk/wp-content/uploads/2017/08/Voicemail-From-[removed]-at-935AM.png](https://myonlinesecurity.co.uk/wp-content/uploads/2017/08/Voicemail-From-[removed]-at-935AM.png){kind=link}
