Sponsored by..

Tuesday, 20 October 2015

Malware spam: "Shaun Buzzard [shaunb@hubbardproducts.com]" / "Order"

This fake financial spam does not come from Hubbard Products but is instead a simple forgery with a malicious attachment:

From     Shaun Buzzard [shaunb@hubbardproducts.com]
Date     Tue, 20 Oct 2015 16:05:55 +0530
Subject     Order

Hi ,
Please find attached order.

Kind regards.
Shaun Buzzard

Hubbard Products Limited
Hillview, Church Road, Otley, Suffolk. IP69NP
Registered in England No. 6217134

Email: shaunb@hubbardproducts.com
DDI: 01473892216

Fax: 01473890687


Important Email Information :
The information contained in this email is confidential and may be legally privileged.
This email is intended to be viewed initially only by the named individual or legal
entity. If the reader of this email is not the intended recipient or a representative
of the intended recipient, you are hereby notified that any reading, dissemination
or copying of this email or of the information contained herein is prohibited. If
you have received this email in error please immediately notify the sender by return,
delete this email and destroy any hard copies immediately. Thank you

The attachment is named lp22_20151013_164535.doc and I have seen the following MD5s:

608D1733D6E47C7BEE187C1EE890D6E3
C6CD52B59FC772EDDE4DF5D4058524FE
001415839B511361BC429C379892065D


The payload is the Dridex Shifu banking trojan, as seen in this spam run earlier today.

No comments: