Sponsored by..

Thursday, 24 July 2014

NatWest "You have received a secure message" spam

This spam contains a link going to a malicious file:

From:     NatWest [secure.message@natwest.co.uk]
Date:     24 July 2014 14:06
Subject:     You have received a new secure message


You have received a secure message

To read your secure message click here . You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.

If you have concerns about the validity of this message, please contact the sender directly. For questions please contact the NatWest Bank Secure Email Help Desk at 0131 556 2568.
First time users - will need to register after opening the attachment.

About Email Encryption - http://www.natwest.com/content/global_options/terms/Email_Encryption.pdf
Another version uses the telephone number 0131 556 2164.

There are probably several different versions, in the ones I have the download location is:

http://avlabpro.com/img/report934875438jdfg8i45jg_07242014.exe
http://dentairemalin.com/images/report934875438jdfg8i45jg_07242014.exe


This malware has a VirusTotal detection rate of 6/52. Automated analysis tools are inconclusive [1] [2] as to what it does.

No comments: