From: Althea DukeWho the message is "from" varies from message to message, but the body text is the same. Analysis of the payload is pending, but it is probably similar to yesterday's Locky run.
Date: 22 June 2016 at 16:00
Subject: Corresponding Invoice
Dear lisa:
Thank you for your email regarding your order of 21 June, and sorry for the delay in replying. I am
writing to confirm receipt of your order, and to inform you that the item you requested will be delivered
by 25 June at the latest. If you require more information regarding this order, please do not hesitate to
contact me.
Also, our records show that we have not yet received payment for the previous order of 11 June,
so I would be grateful if you could send payment as soon as possible. Please find attached the
corresponding invoice.
If there is anything else you require, our company would be pleased to help. Looking forward to
hearing from you soon.
Yours sincerely
Althea Duke
Managing Director
UPDATE
A little bit of analysis, via these automated reports [1] [2] [3] [4] [5] show some download locations as:
personal-architecture.nl/6gcpaey
ding-a-ling-tel.com/b289dg
plasticsmachine.com/d43ndxna
hyip-all.com/9qwmc65
Various files are dropped, including these samples [6] [7] the latter of which is a three week old version of Locky. Go figure. The comments in this report show C2 servers at:
51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
185.82.216.55 (ITL, Bulgaria)
93.170.169.188 (PE Dunaeivskyi Denys Leonidovich, Ukraine)
Three out of those four servers are the same as yesterday.
Recommended blocklist:
51.254.240.48
91.219.29.41
185.82.216.55
93.170.169.188
1 comment:
Thanks for the info! Received this well-written message yesterday to my spam folder, and was curious about the content (but reluctant to actually open the e-mail, naturally). Found your blog post as the top result for the google search "corresponding invoice spam".
Post a Comment