Sponsored by..

Tuesday 28 July 2015

Malware spam: "Please Find Attached - Report form London Heart Centre" / "lhc.reception@heart.org.uk"

This spam is not from the London Heart Centre, but is instead a simple forgery with a malicious attachment:

From     lhc.reception@heart.org.uk
Date     Tue, 28 Jul 2015 14:15:05 +0700
Subject     Please Find Attached - Report form London Heart Centre

(See attached file: calaidzis, hermione.doc)

Attached is a file calaidzis, hermione.docm which comes in at least three different versions [1] [2] [3] which download a malicious binary from one of the following locations:

http://laperleblanche.fr/345/wrw.exe ( / OVH, France)
http://chloedesign.fr/345/wrw.exe ( / Barizco Inc., France)
http://ce-jeffdebruges.com/345/wrw.exe ( / OVH, France)

This is saved as %TEMP%\treviof.exe  and has a detection rate of 4/55. Automated analysis tools [1] [2] [3] report that it phones home to: (PE Kartashev Anton Evgen'evich, Ukraine)

I recommend that you block that IP. The malware is the Dridex banking trojan.


No comments: