Friday, 26 July 2013

Bank of America "Your transaction is completed" spam / payment receipt 26-07-2013.zip

This fake Bank of America spam has a malicious attachment:

Date:      Fri, 26 Jul 2013 15:50:32 +0200 [09:50:32 EDT]
From:      impairyd04@gmail.com
Subject:      Your transaction is completed

Transaction is completed. $09681416 has been successfully transferred.
If the transaction was made by mistake please contact our customer service.
Payment receipt is attached.

*** This is an automatically generated email, please do not reply ***
Bank of America, N.A. Member FDIC. Equal Housing Lender Opens in new window
© 2013 Bank of America Corporation. All rights reserved  

There is an attachment payment receipt 26-07-2013.zip which in turn contains the executable file payment receipt 26-07-2013.exe. This appears to be a Zbot variant with a pretty low detection rate of 9/46 at VirusTotal.

The Malwr report is the most detailed for this sample, and Anubis also has some useful information. Of note is that there is network traffic to the following IPs that seem to be pretty common for this Zbot / Zeus variant:

14.97.179.244
46.48.148.147
67.140.85.16
71.43.167.82
77.242.55.214
89.40.177.36
93.126.38.211
99.72.61.142
99.116.158.19
99.120.1.3
107.217.117.139
178.238.233.29
183.11.30.252
184.147.56.198
186.136.173.245
186.59.228.111
187.214.26.20
190.36.95.118
190.239.109.160
194.36.163.54
201.153.236.237
208.115.110.218
210.213.137.50
217.92.30.173
219.92.103.31
220.246.38.109
223.204.40.170

UPDATE: 
In the first version of this list I accidentally included the following Google IPs. Don't block these:
173.194.70.94
173.194.70.103

No comments: