From: NatWest Invoice [firstname.lastname@example.org]
Date: 18 September 2014 11:06
Subject: Important - New account invoice
Your latest NatWest invoice has been uploaded for your review. If you have any questions regarding this invoice, please contact your NatWest service team at the number provided on the invoice for assistance.
To view/download your invoice please click here or follow the link below :
Thank you for choosing NatWest.
Important: Please do not respond to this message. It comes from an unattended mailbox.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.
The Royal Bank of Scotland International Limited trading as NatWest (NatWest). Registered Office: P.O. Box 64, Royal Bank House, 71 Bath Street, St. Helier, Jersey JE4 8PJ. Regulated by the Jersey Financial Services Commission.
The link in this particular email goes to bnsoutlaws.co.uk/qvgstopmdi/njfeziackv.html which then downloads a ZIP file from bnsoutlaws.co.uk/qvgstopmdi/Account_Document.zip which in turn contains a malicious executable Account_Document.scr which has a VirusTotal detection rate of just 1/53.
The ThreatTrack report [pdf] shows that the malware attempts to call home to:
UPDATE: bnsoutlaws.co.uk is now cleaned up, so you can un-block it.
The same malware is also being pushed by a fake Lloyds Bank email..
From: Lloyds Commercial Bank [email@example.com]
Date: 18 September 2014 11:45
Subject: Important - Commercial Documents
Important account documents
Case number: 68819453
Please review BACs documents.
Click link below, download and open document. (PDF Adobe file)
Please note that the Terms and Conditions available below are the Bank's most recently issued versions. Please bear in mind that earlier versions of these Terms and Conditions may apply to your products, depending on when you signed up to the relevant product or when you were last advised of any changes to your Terms and Conditions. If you have any questions regarding which version of the Terms and Conditions apply to your products, please contact your Relationship Manager. .
Senior Manager, Lloyds Commercial Banking
Calls may be monitored or recorded in case we need to check we have carried out your instructions correctly and to help improve our quality of service.
Please remember we guarantee the security of messages sent by email.