Sponsored by..

Tuesday 26 January 2016

Malware spam: "Alpha Heating Innovation"

This fake financial email is not from Alpha Heating Innovation but is instead a simple forgery with a malicious attachment:

From     Kurt Sexton
Date     Tue, 26 Jan 2016 10:59:05 -0500
Subject     =?UTF-8?B?UmVtaXR0YW5jZSBBZHZpY2UgNTk2M0U5?=

For the attention of Accounts Receivable,

We are attaching an up to date remittance advice detailing the latest payment on
your account.

Please contact us on the email address below if you would like your remittance sent
to a different email address, or have any queries regarding your remittance.


Kind regards,
Kurt Sexton

Best Regards,

Kurt Sexton


Credit Controller - Alpha Heating Innovation



t - 01732 783 019

f - 0844 871 8765

e - stacey.tomsett@alpha-innovation.co.uk

w - www.alpha-innovation.co.uk



Head Office: Alpha Heating Innovation - Nepicar House - London Road - Wrotham Heath
- Kent - TN15 7RS - 01732 783 000

National Distribution Centre: Alpha Heating Innovation – Unit 7 Euroway – Quarry
Wood Industrial Estate - Aylesford - Kent – ME20 7UB - 01622 711 000

The names of the sender and reference numbers will vary. I have only seen two different variants of the attachment, in the format remittance_advice5963E9.doc (VirusTotal [1] [2]) but there are probably more. Analysis is pending, and at the moment I have not had time to decode the document that looks like this [pastebin]. It does seem to have some characterstics of a Dridex downloader.

1 comment:

Yaa Tiwaah Sackey said...

Hi, your post confirmed my suspicions. I received a similar mail a couple of days ago. I was very sure it was a ruse so I thought it wise to share with others.I pasted the mail below:


Marcel Case
To promofd@yahoo.co.uk Jan 26 at 4:01 PM
For the attention of Accounts Receivable,

We are attaching an up to date remittance advice detailing the latest payment on your account.

Please contact us on the email address below if you would like your remittance sent to a different email address, or have any queries regarding your remittance.


Kind regards,
Marcel Case

Best Regards,

Marcel Case


Credit Controller - Alpha Heating Innovation



t - 01732 783 019

f - 0844 871 8765

e - stacey.tomsett@alpha-innovation.co.uk


w - www.alpha-innovation.co.uk



Head Office: Alpha Heating Innovation - Nepicar House - London Road - Wrotham Heath - Kent - TN15 7RS - 01732 783 000

National Distribution Centre: Alpha Heating Innovation – Unit 7 Euroway – Quarry Wood Industrial Estate - Aylesford - Kent – ME20 7UB - 01622 711 000