Date: Mon, 12 Feb 2012 08:16:16 -1100
From: "The Electronic Payments Association"
Subject: ACH transfer rejected
Attachments: nacha_logo.jpg
The ACH transfer (ID: 1366285882700), recently initiated from your bank account (by you or any other person), was rejected by the other financial institution.
Rejected transaction
Transaction ID: 1366285882700
Rejection Reason See details in the report below
Transaction Report report_1366285882700.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association
==================
Date: Mon, 12 Feb 2012 19:06:12 +0000
From: "The Electronic Payments Association"
Subject: ACH transfer rejected
Attachments: nacha_logo.jpg
The ACH transaction (ID: 9485030409966), recently sent from your checking account (by you or any other person), was canceled by the Electronic Payments Association.
Canceled transfer
Transaction ID: 9485030409966
Rejection Reason See details in the report below
Transaction Report report_9485030409966.doc (Microsoft Word Document)
13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
2011 NACHA - The Electronic Payments Association
The malware is at cooldcloud.com/search.php?page=73a07bcb51f4be71 hosted on 74.91.117.227 (Nuclear Fallout Enterprises... again). Blocking the IP is best as that will protect against other malware, although you may want to block more widely given the problems with this host.
The malware tries to download additional content from twistcosm.com/forum/index.php?showtopic=656974 on 199.30.89.139 (Central Host / Zerigo Inc), another problem hosting company.
You can find a Wepawet report here.
No comments:
Post a Comment