Malware spam: Scotiabank / "Secure email communication" / Secure.Mail@scotiabankmail.com

This fake financial spam leads to malware:

From:    ScotiaBank [Secure.Mail@scotiabankmail.com]
Date:    27 April 2017 at 14:13
Subject:    Secure email communication
Signed by:    scotiabankmail.com


Scotia Secure Email Logo
Secure mail waiting: (Secure)
Scotiabank has sent you a secure, encrypted e-mail message. To view this e-mail, please visit "Scotiabank Secure Email Service" or check attach file. For further information on how to use this service please reffer to "the Secure Email User Guide".
The email you receive from Scotiabank, including any attachments, may contain confidential and/or privileged information for the intended recipient(s) only and the sender does not waive any related legal rights or privilege. Any use or disclosure of the information by an unintended recipient is unauthorized and prohibited. If you have received an email message in error, please delete the entire message, including attachments if any, and inform us by return email. 

Opening the attached document SecureMail.doc leads to a simple page that tries to get you to enable Active Content (not recommended!).

Hybrid Analysis shows a download from elevationstairs.ca/fonts/dde60c5776c175c54d23d2b0c.png [70.33.246.140 - Host Papa, US] leading to a dropped file Pscou.exe which has a detection rate of 11/61 and appears to be Upatre.

Malwr Analysis of the downloaded file shows attempted communications to:

82.146.94.86 (Ringnett, Norway)
8.254.243.46 (Level 3, US)
217.31.111.153 (Ringnett, Norway)

scotiabankmail.com has been registered specifically for this attack, or you can block the sending IP of 89.40.216.186 (City Network Hosting AB, Sweden)

Recommended blocklist:
scotiabankmail.com [email]
89.40.216.186 [email]
70.33.246.140
82.146.94.86
8.254.243.46
217.31.111.153

Malware spam: "RBC - Secure Message" / service@rbc-secure-message.com

This fake banking email leads to some sort of malware:

---

From:    RBC - Royal Bank [service@rbc-secure-message.com]
Date:    15 February 2017 at 17:50
Subject:    RBC - Secure Message
Signed by:    rbc-secure-message.com

Secure Message This is an automated message send by Royal Bank Secure Messaging Server. To ensure both you and the RBC Royal Bank comply with current legislation, this message has been encrypted. Please check attached documents for more information. Note: You should not store confidential information unless it is encrypted. CONFIDENTIALITY NOTICE:The contents of this email message and any attachments are intended solely for the addressee(s)and may contain confidential and/or privileged information and may be legally protected from disclosure. If you are not the recipient of this message or their agent, or if this message has been addressed to you in error, please immediately alert the sender by reply email and then delete this message and any attachments. If you are not the recipient, you are hereby notified that any use, dissemination, copying, or storage of this message or its attachments is strictly prohibited.

RBCSecureMessage.doc 44K

---

Attached is a file RBCSecureMessage.doc which contains some sort of macro-based malware. It displays the following page to entice victims to disable their security settings.

Automated analysis is inconclusive [1] [2].  The domain rbc-secure-message.com is fake and has been registered solely for this purpose of malware distribution. In all the samples I saw, the sending IP was 64.91.248.146 (Liquidweb, US) but it does look like all these IPs in the neighbourhood are involved in the same activity:

64.91.248.137
64.91.248.146
64.91.248.148
64.91.248.150

I recommend you block 64.91.248.128/27 at your email gateway to be sure.

Malware spam: "Royal Bancshares of Pennsylvania, Inc." / "Latest invoice [Urgent]"

This fake financial spam leads to malware:

From:    Kieth Valentine [Kieth.Valentine87@assistedlivingflorida.com]
Date:    28 April 2016 at 16:32
Subject:    Latest invoice [Urgent]

Hello,

We are writing to you about fact, despite previous reminders, there remains an outstanding amount of USD 5883,16 in respect of the invoice(s) contained in current letter. This was due for payment on 17 April, 2016.

Our credit terms stipulate full payment within 3 days and this amount is now more than 14 days overdue.
The total amount due from you is therefore USD 5883,16

If the full amount of the sum outstanding, as set above, is not paid within 7 days of the date of this email, we will begin legal action, without warning, for a court order requiring payment. We may also commence insolvency proceedings. Legal proceedings can take affect on any credit rating. The costs of legal proceedings and any other amounts which the court orders must also be paid in addition to the debt.

This email is being sent to you according to the Practice Direction on Pre-Action Conduct (the PDPAC) contained in the Civil Procedure Rules, The court has the power to sanction your continuing failure to respond.

To view the the original invoice in the attachment please use Adobe Reader.

We await your prompt reaction to this email.

Best wishes,

Kieth Valentine

Royal Bancshares of Pennsylvania, Inc.
1(265)530-0620 Ext: 300
1(265) 556-3611

The only sample I have seen of this is malformed and the attachment cannot be downloaded. However, what it should be in this case is a file Latest invoice18.zip containing a malicious script 2016INV-APR232621.pdf.js. Analysis of this obfuscated script is pending, it is likely to be either Locky ransomware or the Dridex banking trojan.

Malware spam: FEDERAL RESERVE BANK

This spam does not come from the Federal Reserve Bank, but is instead a simple forgery with a malicious attachment:

From     "FDIC, Federal Reserve Bank"
Date     Tue, 24 Nov 2015 15:14:19 +0200
Subject     IMPORTANT!

FEDERAL RESERVE BANK

Important:
You are getting this letter in connection with new directive No. 172390635 issued
by U.S. Treasury Department, Federal Reserve and Federal Deposit Insurance Corporation
(FDIC). The directive concerns U.S. Federal Wire and ACH online payments.

We regret to inform you that from 11/24/2015 till 11/27/2015 definite restrictions
will be applied to all Federal Wire and ACH online transactions.

It's essential to know all the restrictions and the list of affected institutions.
The process of working with online transactions is mostly very tense, so it's possible
to overlook the applied restrictions, that may be very important for you.

More detailed information regarding the affected institutions and U.S. Treasury Department
restrictions is contained in the attached document.

Federal Reserve Bank System Administration

Alternative headers:

From    U.S. FRBank [admin@frb.com]
Date    24 November 2015 at 12:59
Subject    Attention!FED Wire and ACH Restrictions Applied!

From     FEDERAL RESERVE BANK [admin@usfrb.com]
Date     Tue, 24 Nov 2015 21:33:45 +0300
Subject     FED Wire and ACH Restrictions. IMPORTANT!

From     "USA FEDERAL RESERVE BANK" [security@frbservices.com]
Date     Tue, 24 Nov 2015 10:59:40 -0500
Subject     U.S. Treasury Department. FED Wire and ACH Restrictions Applied.

 Attached is an Excel file made up of part of the recipient's domain name plus a random number. So far I have seen two samples of this (VirusTotal [1] [2]) the latter of which is corrupt. The woirking one contains a macro that looks like this.

According to this Malwr report, the macro respectively POSTs and GETs from the following URLs:

rmansys.ru/utils/inet_id_notify.php
s01.yapfiles.ru/files/1323961/435323.jpg

Also, network communication is made with two other IPs, giving the following potentially malicious hosts:

185.26.97.120 (First Colo / Fornex, Germany)
90.156.241.111 (Masterhost, Russia)
89.108.101.61 (Agava Ltd, Russia)
95.27.132.170 (Beeline Broadband, Russia)

That .JPG file is actually an executable with a detection rate of 5/55. The Hybrid Analysis report shows all sorts of interesting things going on, but no clue as to what the purpose of the malware actually is. Those reports and this Malwr report shows some additional traffic:

217.197.126.52 (e-Style ISP, Russia)
88.147.168.112 (Volgatelecom, Russia)

According to this Malwr report it drops all sorts of files including _iscrypt.dll [VT 0/54] and 2.exe [VT 2/54] which is analysed in this Malwr report and this Hybrid Analysis report. It is unclear as to what it does (ransomware? remote access trojan?), but it appears that the installation may be password protected.

MD5s:
dfe5c17d74d5827df48395561ff2df58
132e53dcc20c8c2ebbec669d2764c182
832d9cc537e52e220a58a0f47069a315

Recommended blocklist:
185.26.97.120
90.156.241.111
89.108.101.61
95.27.132.170
217.197.126.52
88.147.168.112
217.19.105.3

UPDATE

This Hybrid Analysis report shows various web pages popping up from the Excel spreadsheet, including MSN and Lidl. The purpose of this is unknown.

Malware spam: "FW : Incoming SWIFT" / "Clyde Medina" [Clyde.Medina@swift.com]

This fake banking email comes with a malicious attachment:

From     "Clyde Medina" [Clyde.Medina@swift.com]
Date     Wed, 30 Sep 2015 12:35:56 GMT
Subject     FW : Incoming SWIFT

We have received this documents from your bank regarding an incoming SWIFT transfer.

CONFIDENTIAL NOTICE: The contents of this message, including any attachments, are
confidential and are intended solely for the use of the person or entity to whom
the message was addressed. If you are not the intended recipient of this message,
please be advised that any dissemination, distribution, or use of the contents of
this message is strictly prohibited. If you received this message in error, please
notify the sender. Please also permanently delete all copies of the original message
and any attached documentation. Thank you.

Attached is a file SWIFT_transfer.zip which contains a malicious executable SWIFT_transfer.scr which currently has a detection rate of 2/56.

Automated analysis is pending, although the payload is almost definitely Upatre/Dyre. Please check back later.

UPDATE:
The Hybrid Analysis report shows Upatre/Dyre activity, including the malware phoning home to a familiar IP address of 197.149.90.166 in Nigeria which I recommend you block or monitor.

Malware spam "Info from SantanderBillpayment.co.uk" / "Santanderbillpayment-noreply@SantanderBillPayment.co.uk"

This fake financial spam comes with a malicious attachment:

From     "Santanderbillpayment-noreply@SantanderBillPayment.co.uk" [Santanderbillpayment-noreply@SantanderBillPayment.co.uk]
Date     Tue, 29 Sep 2015 12:33:56 GMT
Subject     Info from SantanderBillpayment.co.uk

Thank you for using BillPay. Please keep this email for your records.

The following transaction was received on 29 September 2015 at 09:11:36.

Payment type:          VAT
Customer reference no: 0343884
Card type:            Visa Debit
Amount:                GBP 4,683.00

For more details please check attached payment slip.

Your transaction reference number for this payment is IR0343884.

Please quote this reference number in any future communication regarding this payment.

Yours sincerely,

Banking Operations

This message is intended for the named person above and may be confidential, privileged
or otherwise protected from disclosure. If it has reached you by mistake please contact
the sender on 0300 200 3601 and delete the message immediately.


**PLEASE DO NOT REPLY TO THIS E-MAIL, AS WE WILL NOT BE ABLE TO RESPOND**
Emails aren't always secure, and they may be intercepted or changed after they've
been sent. Santander doesn't accept liability if this happens. If you think someone
may have interfered with this email, please get in touch with the sender another
way.
This message doesn't create or change any contract. Santander doesn't accept responsibility
for damage caused by any viruses contained in this email or its attachments. Emails
may be monitored. If you've received this email by mistake, please let the sender
know at once that it's gone to the wrong person and then destroy it without copying,
using, or telling anyone about its contents.

Santander Corporate Banking is the brand name of Santander UK plc, Abbey National
Treasury Services plc (which also uses the brand name of Santander Global Banking
and Markets) and Santander Asset Finance plc, all (with the exception of Santander
Asset Finance plc) authorised and regulated by the Financial Services Authority,
except in respect of consumer credit products which are regulated by the Office of
Fair Trading. FSA registration numbers: 106054, 146003 and 423530 respectively.
Registered offices: 2 Triton Square, Regent's Place, London NW1 3AN and Carlton Park,
Narborough LE19 0AL. Company numbers: 2294747, 2338548 and 1533123 respectively.

Registered in England. Santander and the flame logo are registered trademarks.

The attachment is named SantanderBillPayment_Slip0343884.zip although I have not been able to get a working copy. The payload is most likely the Upatre/Dyre banking trojan. My sources tell me that the current wave of this is phoning home to 197.149.90.166 in Nigeria which is worth blocking or monitoring.

Malware spam: "Bankline ROI - Password Re-activation Form" / "secure.message@rbs.co.uk"

This fake banking spam does not come from RBS, but is instead a simple forgery with a malicious attachment:

From     "RBS" [secure.message@rbs.co.uk]
Date     Wed, 23 Sep 2015 11:28:48 GMT
Subject     Bankline ROI - Password Re-activation Form

Please find the Re-activation form attached, send one per user ensuring only one
box is selected in section 3.  A signatory on the bank mandate must sign the form.

Fax to 1850 826978 or alternatively you may wish to email the completed document,
by attaching it to an email and sendinsg it to banklineadministration@rbs.co.uk

On receipt of the completed form we will respond to the request within 2 working
hours and communicate this to the user by email.

<>

Please note - The life-span of an activation code is 21 days; after this time, the
activation code will expire and a new one must be ordered. 

Please be aware when choosing a new pin and password for the service, it is important
not to use pin/passwords that you have used before but to use completely different
details.

If you are the sole Standard Administrator may I take this opportunity to suggest
when you are reinstated on the system, to set up another User in a Standard Administrator
role. This will prevent you being locked out completely and allow you to order a
new activation code from within the system and reset your security sooner.

If you require any further assistance then please do not hesitate to contact us on
1850 310269 and one of our associates will be happy to assist you.

Regards
Bankline Product Support

This e-mail message is confidential and for use by the intended recipient only. If
the message is received by anyone other than the intended recipient, please return
the message to the sender by replying to it and then delete the message from your
computer. Internet e-mails are not necessarily secure. Ulster Bank Limited and Ulster
Bank Ireland Limited (\"Bankline Bank Group\")/ Royal Bank of Scotland Group plc
does not accept responsibility for changes made to this message after it was sent.
Ulster Bank Group / Royal Bank of Scotland Group plc may monitor e-mails for business
and operational purposes. By replying to this message you give your consent to our
monitoring of your email communications with us. Whilst all reasonable care has been
taken to avoid the transmission of viruses, it is the responsibility of the recipient
to ensure that the onward transmission, opening or use of this message and any attachments
will not adversely affect its systems or data. No responsibility is accepted by any
member of Ulster Bank Group / Royal Bank of Scotland Group plc in this regard and
the recipient should carry out such virus and other checks as it considers appropriate.

In the sample I saw, the attached file was Bankline_Password_reset_3537684.zip containing a malicious exeucutable Bankline_Password_reset_8569474.scr which has a VirusTotal detection rate of 2/56. The Hybrid Analysis report shows behaviour consistent with Upatre / Dyre and shows that the malware communicates with a known bad IP of 197.149.90.166 (Cobranet, Nigeria) which I definitely recommend blocking or monitoring.

Malware spam: "Transaction confirmation" / "donotreply@lloydsbank.co.uk"

This fake banking spam comes with a malicious attachment:

From     donotreply@lloydsbank.co.uk
Date     Fri, 18 Sep 2015 11:52:36 +0100
Subject     Transaction confirmation

Dear Customer,

Please see attached the confirmation of transaction conducted from Your
account. Kindly sign and forward the copy to us for approval.

Best regards,
Your personal Manager

Thora Blanda

tel: 0345 300 0000

LLOYDS BANK. 

Attached is a file Notice.zip which contains a malicious executable Value mortgage policy .exe (note the rogue space) which has a VirusTotal detection rate of 3/55. The Hybrid Analysis report shows activity consistent with Upatre/Dridex including a key indicator of traffic to 197.149.90.166 in Nigeria.

Malware spam: "Lloyds Bank - Pendeford Securities - Please Read Action Required/PI Documents/ Region code East 2/ 8715811/"

This fake Lloyds Bank spam comes with a malicious payload:

From:    RSTNAME} Crabtree [Chang.Crabtree@lloydsbankcommercial.com]
Date:    15 September 2015 at 13:18
Subject:    Lloyds Bank - Pendeford Securities - Please Read Action Required/PI Documents/ Region code East 2/ 8715811/

Please find attached our document pack for the above customer. Once completed please return via email to the below address.

If you have any queries relating to the above feel free to contact us at

MN2Lloydsbanking@lloydsbankcommercial.com
Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 7117152. Telephone: 0845 603 1637

Lloyds Bank plc, Bank of Scotland plc are authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority.

Cheltenham & Gloucester plc is authorised and regulated by the Financial Conduct Authority.

Halifax is a division of Bank of Scotland plc. Cheltenham & Gloucester Savings is a division of Lloyds Bank plc.

HBOS plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC453043.

This e-mail (including any attachments) is private and confidential and may contain privileged material. If you have received this e-mail in error, please notify the sender and delete it (including any attachments) immediately. You must not copy, distribute, disclose or use any of the information in it or any attachments. Telephone calls may be monitored or recorded.

In the sample I saw, there was a Word document ReportonTitle7117152.1Final.doc attached (detection rate 4/56), containing this malicious macro. The macro attempts to download components from the following locations:

thebackpack.fr/wp-content/themes/salient/wpbakery/js_composer/assets/lib/prettyphoto/images/prettyPhoto/light_rounded/66836487162.txt
thebackpack.fr/wp-content/themes/salient/wpbakery/js_composer/assets/lib/prettyphoto/images/prettyPhoto/light_rounded/sasa.txt
obiectivhouse.ro/wp-content/plugins/maintenance/load/images/fonts-icon/66836487162.txt
obiectivhouse.ro/wp-content/plugins/maintenance/load/images/fonts-icon/sasa.txt

A further download  then takes place from:

vandestaak.com/css/libary.exe

This has a detection rate of 3/56. The general characteristics of this file make it a close match to the Upatre/Dyre payload of this concurrent spam run (automated analysis is pending).

Recommended blocklist:
197.149.90.166
vandestaak.com
thebackpack.fr
obiectivhouse.ro

MD5s:
4b944c5e668ea9236ac9ab3b1192243a
1939eba53a1289d68d1fb265d80e60a1

Malware spam: "HSBC SecureMail" / "You have received a secure message"

This fake HSBC email message has a malicious payload:

From:    HSBC SecureMail [HSBCRepresentative_WilliamsBlankenship@hsbc.co.uk]
Date:    16 September 2015 at 13:13
Subject:    You have received a secure message

You have received a secure message Read your secure message by opening the attachment. You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it with Internet Explorer. If you have concerns about the validity of this message, please contact the sender directly. For questions please contact the HSBC Secure Mail Help Desk. First time users - will need to register after opening the attachment. About Email Encryption - http://www.hsbc.co.uk/secureemail HSBC_Payment_87441653 16K

Attacked is a file HSBC_Payment_87441653.zip which in turn contains a malicious executable HSBC_Payment_87441653.exe, this has a VirusTotal detection rate of 4/56.

UPDATE: The Hybrid Analysis report shows network traffic to a familiar Nigerian IP of 197.149.90.166 which I strongly recommend you block. The traffic pattern is indicative of Upatre dropping the Dyre banking trojan.

MD5:
359f0c584d718f44e9777e259f013031

Malware spam: "Strange bank account operation" / "Unauthorised bank account activity" / "Illegal bank account transfer" etc

This fake financial spam comes with a malicious payload. It appears to be randomly generated in part, here are some examples:

Date:    8 July 2015 at 18:02
Subject:    Strange bank account operation

Kindly be informed that bank did noticed suspect attempt of money withdrawal relating to Your debit card.
Please find enclosed bank e-mail sent by financial department on Monday.
As well attached are security details for Your review.
Michael Morgan
Senior Manager

==========

Date:    1 January 1970 at 00:00
Subject:    Suspicious bank account operation

Kindly be acknowledged that bank had found unauthorised attempt of amounts withdrawal from Your credit card.
Please find enclosed bank warning provided by bank manager earlier.
Also enclosed are security details for Your affirmation.
Robin Owen
Chief accountant

==========

Date:    8 July 2015 at 17:59
Subject:    Illegal bank account transfer

Kindly be informed that bank security department has found illegal attempt of money withdrawal from Your Mastercard account.
Please check the enclosed bank publication provided by banking department today.
As well attached are security details for Your approval.
Clive Adams
Tax Consultant

=========

Date:    8 July 2015 at 16:55
Subject:    Strange bank account transfer

Kindly note that bank did noticed suspect attempt of amounts withdrawal related to Your Mastercard.
Please examine the enclosed bank statement sent by manager on Monday.
Furthermore attached are personal details for Your confirmation.
Martin Morgan
Tax authority

==========

Date:    8 July 2015 at 17:51
Subject:    Unauthorised bank account activity

Kindly be acknowledged that bank security department had detected suspect attempt of money withdrawal related to Your debit card.
Please check the enclosed bank statement forwarded by banking department today.
In addition attached are security details for Your control.
Robin Willis
Senior Manager

Attached is a Word document [VT 6/55]with various filenames:

extract_of_bank_document.doc
fragment_of_bank_fax.doc
original_of_bank_report.doc
scan-copy_of_bank_document.doc
transcript_of_bank_statement.doc

All the samples I have seen have an identical document with different names, containing this malicious macro which then goes off and downloads various other components according to the Hybrid Analysis report, using the following URLs:

midwestlabradoodle.com/wp-content/plugins/really-simple-captcha/6727156315273.txt
artyouneed.com/wp-includes/theme-compat/6727156315273.txt
artyouneed.com/wp-includes/theme-compat/kaka.txt

These appear to download as a set of malicious scripts [1] [2] [3] which then download a further component from:

bluemagicwarranty.com/wp-includes/theme-compat/getrichtoday.exe

This binary has a detection rate of 3/55. The Malwr report shows that it drops two other files, named as Zlatowef.exe [VT 3/55] and redtytme4.exe [VT 9/55] and it also downloads components from:

38.65.142.12:12551/ON12/HOME/0/51-SP3/0/ELHBEDIBEHGBEHK
38.65.142.12:12551/ON12/HOME/41/5/4/ELHBEDIBEHGBEHK

That IP is allocated to Cogent Communications in Mexico. The download is Upatre which means that the payload is almost definitely the Dyre banking trojan, even though the delivery mechanism of a Word document is unusual for Dyre.

Recommended blocklist:
38.65.142.12
midwestlabradoodle.com
artyouneed.com
bluemagicwarranty.com

MD5s:
8d547f5ef829d9033c3eb5d4ce1602c1
5cff4106fd4c393f4b935e8e97277351
21023e02a33ec1d924f489378d1f01d5
e8f2c4845008d3064948ed336c1a9852

Malware spam: "This is a Remitter Advice following the submission of a payment instruction by Lloyds Bank Plc." / "Australian Taxation Office"

This spam doesn't seem to know if it's from Lloyds Bank or the Australian Tax Office.

From:    Australian Taxation Office [noreply@ato.gov.au]
Date:    22 May 2015 at 10:31
Subject:    Remittance Advisory Email


Monday 22 May 2014

This is a Remitter Advice following the submission of a payment instruction by Lloyds Bank Plc.

Please review the details of the payment here.


Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 2299428. Telephone: 0845 603 1637

Lloyds Bank plc, Bank of Scotland plc are authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority.

Cheltenham & Gloucester plc is authorised and regulated by the Financial Conduct Authority.

Halifax is a division of Bank of Scotland plc. Cheltenham & Gloucester Savings is a division of Lloyds Bank plc.

HBOS plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC218813.

This e-mail (including any attachments) is private and confidential and may contain privileged material. If you have received this e-mail in error, please notify the sender and delete it (including any attachments) immediately. You must not copy, distribute, disclose or use any of the information in it or any attachments. Telephone calls may be monitored or recorded.
The link in the email goes to a download page at sharefile.com and leads to an archive file FAX_82APL932UN_772.zip containing a malicious executable FAX_82APL932UN_772.scr which has a date stamp of 01/01/2002 (presumably to make it harder to spot).

This binary has a detection rate of 4/57 and automated analysis tools [1] [2] [3] [4] show that it downloads another file from:

relianceproducts.com/js/p2105us77.exe

This is renamed to csrss_15.exe and has a detection rate of 3/54. It is most likely a component of the Dyre banking trojan.

In addition, this Hybrid Analysis report shows traffic to:

209.15.197.235 (Peer 1, Canada) [relianceproducts.com]
217.23.194.237 (BLICNET, Bosnia and Herzegovina)

Recommended blocklist:
209.15.197.235
217.23.194.237

MD5s:
eb26a6c56b7f85b3257980d0c273c3cf
178a4e3dfa0feea04079592d3113bd2e

Malware spam: "invoice@bankline.ulsterbank.ie" / "Outstanding invoice"

This fake banking email leads to malware.

From:    invoice@bankline.ulsterbank.ie [invoice@bankline.ulsterbank.ie]
Date:    2 April 2015 at 11:46
Subject:    Outstanding invoice

Dear [victim],

Please find the attached copy invoice which is showing as unpaid on our ledger.

To download your invoice please click here

I would be grateful if you could look into this matter and advise on an expected payment date .

Courtney Mason

Credit Control

Tel: 0845 300 2952 

The link in the email leads to a download location at hightail.com (the sample I saw downloaded from https://www.hightail.com/download/e?phi_action=app/directDownload&fl=SWhZekZucVhVbTlFQlFJWjA4bnVnVE9yZWt5UmdteDRsUjJuWENHRzVZbz0) which is a file called Doc_0062119-LQ.zip which in turn contains the malicious executable Doc_0062119-LQ.scr.

The executable has a VirusTotal detection rate of 3/57 and has characteristics that identify it as Upatre. Automated analysis tools [1] [2] [3] [4] [5] show that it downloads additional components from:

eduardohaiek.com/images/wicon1.png
edrzambrano.com.ve/images/wicon1.png

 It also POSTs data to 141.105.141.87 (Makiyivka Online Technologies Ltd, Ukraine) in a characteristic Upatre manner:

http://141.105.141.87:13840/0204uk11/HOME/0/51-SP3/0/ELHBEDIBEHGBEHK

According to the Malwr report, the downloader drops a file gkkjxyz22.exe which has a detection rate of 2/57. This is probably the Dyre banking trojan.

Recommended blocklist:
141.105.140.0/22
 eduardohaiek.com
edrzambrano.com

MD5s:
4c666564c1db6312b9f05b940c46fa9a
876900768e06c3df75714d471c192cc6

Malware spam: "JP Morgan Access [Carrie.Tolstedt@jpmorgan.com]" / "FW: Customer account docs"

This fake financial spam comes with a malicious attachment.

---

From:    JP Morgan Access [Carrie.Tolstedt@jpmorgan.com]
Date:    18 March 2015 at 17:49
Subject:    FW: Customer account docs

We have received the following documents regarding your account, if you would like to confirm the changes please check / view the documents please click here. Carrie L. Tolstedt Carrie.Tolstedt@chase.com Senior Executive Vice President Community Banking J.P. Morgan Treasury and Securities Services This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

---

As it happens, Carrie L Tolstedt is a real executive... at Wells Fargo. The lady in the picture is another Wells Fargo employee entirely.

But anyway, this is a simple forgery containing a link to a file at Cubby which downloads as Documents_JP3922PV8.zip and contains a malicious file Documents_JP3922PV8.exe which has a icon to make it look like an Adobe acrobat file.

The executable has a low VirusTotal detection rate of 3/57.  Various automated analysis tools [1] [2] [3] [4] show the malware downloading additional components from:

bej-it-solutions.com/pvt/ixusn.rtf
capslik.com/mandoc/ixusn.rtf

It then attempts to POST data to an IP at 109.230.131.95 (Vsevnet Ltd. Russia) which is a critical IP to block if you want to protect yourself against this type of Upatre / Dyre attack.

The Malwr report also shows that amongst other things it downloads an executable lwxzqrk36.exe which has a detection rate of just 2/57. That Malwr report also shows that it downloads and pops up a PDF about drone strikes.

Source: malwr.com

Presumably this PDF pops up to make the victim think that they have been duped into opening some politically-themed spam. Instead, they have actually installed the Dyre banking trojan.. in other words, the victim may well think that it is nothing serious when it really is.

The download locations for this Upatre/Dyre combination change all the time, but the IP address of 109.230.131.95  has been around for a little while. Also, it is a characteristic of this malware that it calls out to checkip.dyndns.org to determine the client IP address.. monitoring for traffic going to that location can be a useful indicator of infection.


ssssssssssss

Malware spam: "You have received a new secure message from BankLine" / "Bankline [secure.message@business.natwest.com]"

This fake banking spam leads to malware.

From:    Bankline [secure.message@business.natwest.com]
Date:    6 March 2015 at 10:36
Subject:    You have received a new secure message from BankLine

You have received a secure message.

Your Documents have been uploaded to Cubby cloud storage.
Cubby cloud storage  is a cloud data service powered by LogMeIn, Inc.

Read your secure message by following the link bellow:

https://www.cubbyusercontent.com/pl/Business%20Secure%20Message.zip/_90ad04a3965340b195b8be98c6a6ae37


----------------
You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.

If you have concerns about the validity of this message, please contact the sender directly. For questions please contact the Bankline Bank Secure Email Help Desk at 0131 556 8719.

First time users - will need to register after opening the attachment.
About Email Encryption - https://help.business.natwest.com/support/app/answers/detail/a_id/1671/kw/secure%20message 

This downloads a ZIP file from cubbyusercontent.com which contains a malicious executable Business Secure Message.exe which has a VirusTotal detection rate of just 1/57.

Automated analysis tools [1] [2] [3] [4] show attempted connections to the following URLs:

http://all-about-weightloss.org/wp-includes/images/vikun.png
http://bestcoveragefoundation.com/wp-includes/images/vikun.png
http://190.111.9.129:14248/0603no11/HOME/0/51-SP3/0/ELHBEDIBEHGBEHK
http://190.111.9.129:14249/0603no11/HOME/41/7/4/

It also appears that there is an attempted connection to 212.56.214.203.

Of all of these IPs, 190.111.9.129 (Navega.com, Guatemala) is the most critical to block. It is also a characteristic of this malware (Upatre/Dyre) that it connects to checkip.dyndns.org to work out the IP address of the infected machine, it is worth checking for traffic to this domain.

The Malwr report shows several dropped files, including fyuTTs27.exe which has a VirusTotal detection rate of 4/57.

Malware spam: "BACS Transfer : Remittance for.."

So far I have only seen one sample of this..

From     "Garth Hutchison"
Date     21/01/2015 11:50
Subject     BACS Transfer : Remittance for JSAG400GBP

We have arranged a BACS transfer to your bank for the following amount : 5821.00
Please find details attached.

Attached is a malicious Word document BACS_transfer_JS87123781237.doc [VT 1/57] which contains a macro [pastebin] which downloads a file from:

http://stylishseychelles.com/js/bin.exe

This is then saved as %TEMP%\iHGdsf.exe. This has a VirusTotal detection rate of 6/57 identifying it as a Dridex downloaded. You can see the Malwr report here.

Sources indicate that this malware phones home to the following IPs which I recommend you block:

92.63.88.108
143.107.17.183
5.39.99.18
136.243.237.218

Malware spam: "CardsOnLine@natwesti.com" / "Cards OnLine E-Statement E-Mail Notification"

This fake NatWest email leads to malware:

From:    CardsOnLine [CardsOnLine@natwesti.com]
Date:    26 January 2015 at 13:06
Subject:    Cards OnLine E-Statement E-Mail Notification

Body:

Dear Customer

Your July 30, 2014 E-Statement for account number xxxxxxxxxxxx6956 from Cards OnLine is now available.

For more information please check link: http://afreshperspective.com/NATWEST_BANK-MESSAGES-STORAGE/new.secured_document.html

Thank you
Cards OnLine


Many internet users have recently been targeted through bogus E-Mails by fraudsters claiming to be from their bank. These E-Mails ask customers to provide their internet banking security details in order to reactivate their account or verify an E-Mail address.

Please be on your guard against E-Mails that request any of your security details. If you receive an e-mail like this you must not respond.

Please remember that, for security reasons, apart from when you create them at registration or when you change your Internet Pin or Password, we will only ever ask you to enter random characters from your Internet PIN and Password when you logon to this service.

You must keep your security details secret. We would never ask you, by E-Mail, to enter (or record) these details in full and you must not respond to E-Mails asking for this information.

National Westminster Bank Plc, Registered in England No 929027. Registered
Office: 135 Bishopsgate, London EC2M 3UR. Authorised and regulated by the Financial Services Authority.

This E-Mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet E-Mails are not necessarily secure. National Westminster Bank Plc does not accept responsibility for changes made to this message after it was sent.

Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by National Westminster Bank Plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate.

Users who click the link see a download page similar to this:

The link in the email downloads a randomly-named file in the format security_notice55838.zip which contains a malicious binary which will have a name similar to security_notice18074.exe.

This binary has a VirusTotal detection rate of 1/56 and is identified by Norman AV as Upatre. Automated analysis tools are not particularly enlightening [1] [2].

Malware spam: "You have received a new secure message from BankLine"

For some reason these RBS BankLine spam messages are a popular mechanism for the bad guys to spread malware.

From:    Bankline [secure.message@rbs.com.uk]
Date:    23 January 2015 at 12:43
Subject:    You have received a new secure message from BankLine

You have received a secure message.

Read your secure message by following the link bellow:

http://donumyok.com/RBS-DATA.STORAGE/personal.document.html

----------------
You will be prompted to open (view) the file or save (download) it to your computer. For best results, save the file first, then open it.

If you have concerns about the validity of this message, please contact the sender directly.
For questions please contact the Bankline Bank Secure Email Help Desk at 0131 556 3513.

The link in the email seems to be somewhat dynamic, as I have also seen this slightly different variant of:

http://donumyok.com/RBS_BANK-ONLINE_SECURE_STORAGE/receive.personal-document.html

The landing page looks like this:

The link on that landing page goes to http://animation-1.com/js/jquery-1.41.15.js?get_message which downloads a ZIP file called Bankline_document_pdf71274.zip (or something similar) containing an executable file named something like Bankline_document_pdf24372.exe. The numbers change in each case, and indeed the executable changes slightly every time it is downloaded.

The ThreatExpert report shows that it attempt to communicate with the well-known-bad-IP of 202.153.35.133 (Excell Media Pvt Ltd, India) which is associated with the Dyre banking trojan.

Malware spam: "Barclays - Important Update, read carefully!" / "Barclays Online Bank [security-update@barclays.com]"

This fake Barclays spam leads to malware.

From:    Barclays Online Bank [security-update@barclays.com]
Date:    20 January 2015 at 14:41
Subject:    Barclays - Important Update, read carefully!

Dear Customer,

Protecting the privacy of your online banking access and personal information are our primary concern.

During the last complains because of online fraud we were forced to upgrade our security measures.

We believe that Invention of security measures is the best way to beat online fraud.

Barclays Bank have employed some industrial leading models to start performing an extra security check with Your Online Banking Activities to ensure a safe and secure Online and Mobile Banking.

For security reasons we downloaded the Update Form to security Barclays webserver.

You are requested to follow the provided steps and Update Your Online Banking details, for the safety of Your Accounts.

- Please download and complete the form with the requested details:  http://fizza.ro/BARCLAYS~ONLINE.BANKING~UPDATE/update.html

- Fill in all required fields with your accurately details (otherwise will lead to service suspension)

Warning: If you choose to ignore our request, you leave us no choice but to temporary hold on your funds.

Thank you for your patience as we work together to protect your account.

Please update your records on or before 48 hours, a failure to update your records will result in a temporary hold on your funds.

Sincerely,

Barclays Online Bank Customer Service

We apologize for any inconvenience this may have caused.

(c) Copyright 2015 Barclays Bank Plc. All rights reserved.

The link in the email varies, some other examples seen are:
http://nrjchat.org/ONLINE~IMPORTANT-UPDATE/last-update.html
http://utokatalin.ro/ONLINE-BANKING_IMPORTANT/update.html
http://cab.gov.ph/ONLINE-IMPORTANT~UPDATE/last~update.html

Visiting these sites goes through some javascript hoops, and then leads to a ZIP file download which contains a malicious EXE that changes every time it is downloaded. The files are named in the general format update12345.zip and update54321.exe.

The file itself is an Upatre downloader, with poor detection rates [1] [2] [3].

The Malwr report shows traffic to the following URLs:
http://202.153.35.133:33384/2001uk11/HOME/0/51-SP3/0/
http://202.153.35.133:33384/2001uk11/HOME/1/0/0/
http://clicherfort.com/mandoc/eula012.pdf
http://202.153.35.133:33387/2001uk11/HOME/41/7/4/
http://essextwp.org/mandoc/ml1from1.tar

Out of these 202.153.35.133 (Excell Media Pvt Ltd, India) is one you should definitely block. This downloader drops several files including (in this case) %TEMP%\sJFcN24.exe which has a VirusTotal detection rate of just 3/57 and is identified as Dyreza.C by Norman anti-virus.

Randomly generated "invoice xxxxxx October" spam comes with a malicious Word document

There have been a lot of these today:

From:     Sandra Lynch
Date:     27 October 2014 12:29
Subject:     invoice 0544422 October

Please find attached your October invoice, we now have the facility to email invoices,
but if you are not happy with this and would like a hard copy please let me know.
New bank details for BACS payments are Santander Bank Sort Code 0544422 Account No 5600544422.
Thanks very much

Kind Regards


Sandra Lynch

The numbers in the email are randomly generated, as is the filename of the attachment (in this example it was invoice_0544422.doc).

The document itself is malicious and has a VirusTotal detection rate of 5/53. Inside the Word document is a macro [pastebin] that attempts to download an execute a malicious binary from http://centrumvooryoga.nl/docs/bin.exe which is currently 404ing which is a good sign.

There's a fair chance that the spammers will use this format again, so always be cautious of unsolicited email attachments.