Sponsored by..

Tuesday 12 January 2016

Malware spam: "Payment Advice - 0002014343" / Bhavani Gullolla [bhavani.gullolla1@wipro.com]

This fake financial spam is not from Wipro but is instead a simple forgery with a malicious attachment.

From:    Bhavani Gullolla [bhavani.gullolla1@wipro.com]
Date:    12 January 2016 at 09:51
Subject:    Payment Advice - 0002014343

Dear Sir/Madam,

This is to inform you that we have initiated the electronic payment through our Bank.
Please find attached payment advice which includes invoice reference and TDS deductions if any.

Transaction Reference :
Vendor Code :9189171523
Company Code :WT01
Payer/Remitters Reference No :63104335
Beneficiary Details :43668548/090666
Paymet Method : Electronic Fund Transfer
Payment Amount :1032.00
Currency :GBP
Processing Date :11/01/2016

For any clarifications on the payment advice please mail us at  wipro.vendorhelpdesk@wipro.com OR
call Toll Free in India 1800-200-3199 between 9:00 am to 5:00 pm IST (Mon-Fri) OR contact person indicated in the purchase order.

VHD Signature
The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com
The attachment is randomly-named in the format 9705977867.doc which I have seen in two different versions with detection rates of 5/54 [1] [2], and according to the Malwr reports [3] [4] they both download a malicious binary from:


This download location is characteristic of the Dridex 220 botnet. The downloaded binary has a detection rate of 4/55 and this Malwr report shows network traffic to: (Interserver Inc, US)

I strongly recommend that you block this IP address.

Payload MD5:

Attachment MD5s (there are probably others!)


There is an additional download location of:


The payload has changed but still has similar characteristics to before [VirusTotal report / Malwr report].

Payload MD5:


Jokstar said...

Also seen at per-forms.com

Unknown said...

Good find :)