Sponsored by..

Tuesday, 14 January 2014

HSBC "Payment Advice" spam / Payment Advice.exe


This fake HSBC spam comes with a malicious attachment:

Date:      Tue, 14 Jan 2014 11:57:29 -0300 [09:57:29 EST]
From:      HSBC Advising Service [advising.service.738805677.728003.693090157@mail.hsbcnet.hsbc.com]
Subject:      Payment Advice - Advice Ref:[G72282154558] / Priority payment / Customer Ref:[63 434S632U9I]


Sir/Madam

The attached payment advice is issued at the request of our customer. The advice is for your reference only.

Yours faithfully

Global Payments and Cash Management

HSBC

***************************************************************************

This is an auto-generated email, please DO NOT REPLY. Any replies to this email will be disregarded.

***************************************************************************

This e-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail.

***************************************************************************

"SAVE PAPER - THINK BEFORE YOU PRINT!"
The is an attachment Payment Advice [G72282154558].zip which contains an executable Payment Advice.exe with a VirusTotal detection rate of 12/48. Automated analysis by Comodo CAMAS shows an attempted connection to thebostonshaker.com on 206.190.147.139 (Salt Lake City Hosting, US). It is the only site on this IP address, blocking either temporarily may give some protection.

1 comment:

Chris Neary said...

XXX has been added to disable accidental download.

Subject: Payment Advice - Advice Ref:[GB404247858069] / CHAPS credits / Customer Ref:[pay run 29/05/14]

Sir/Madam,

Please download document from dropbox, payment advice is issued at the request of our customer. The advice is for your reference only.

Download link:

http://www.pennec-conseils.com/css/XXX document-128_712.zip

Yours faithfully,
Global Payments and Cash Management
HSBC

***************************************************************************

This is an auto-generated email, please DO NOT REPLY. Any replies to this email will be disregarded.

***************************************************************************
Security tips

1. Install virus detection software and personal firewall on your computer. This software needs to be updated regularly to ensure you have the latest protection.
2. To prevent viruses or other unwanted problems, do not open attachments from unknown or non-trustworthy sources.
3. If you discover any unusual activity, please contact the remitter of this payment as soon as possible.

*******************************************************************
This e-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the sender immediately by return e-mail.

Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.
*******************************************************************
"SAVE PAPER - THINK BEFORE YOU PRINT!"