Reply-To: purchase@animalagriculture.org
To: Recipients [DY]
Date: 24 October 2017 at 06:48
Subject: FW: Order acknowledgement for BEPO/N1/380006006(2)
Dear All,
Kindly find the attached Purchase order# IT/IMP06/06-17 and arrange to send us the order acknowledgement by return mail.
Note: Please expedite
the delivery as this item is very urgently required.
Regards, Raj Kiran
(SUDARSHAN SS) NAVAL SYSTEMS (S&CS)
BHARAT ELECTRONICS LIMITED BANGALORE PH:9180-22195857 BEL Website : www.bel-india.com SRM PORTAL :https://hpcrmp.iscodom.com/irj/portal
Every Sheets of paper is made from a tree.. Save trees... Conserve Trees.... Go Green .... Don't print this email or any Files unless you really need to!!!!
Confidentiality Notice
The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Bharat Electronics or support@bel.co.in immediately and destroy all copies of this message and any attachments.
Attached is a file Purchase order comfirmation.doc.z which contains a malicious executable Purchase order comfirmation.exe which currently has a detection rate of 12/66. It looks like the archive type does not actually match the extension..
If the intended target hides file extensions then it is easy to see how they could be fooled..
Copyright: (c)1998 by RicoSoft
Product: System Investigation
Description: System Investigation for NT/9x
Original Name: SysInv2.exe
Internal Name: SysInv2
File Version:2.3.1.37
Comments: Freeware / Careware from RicoSoft
Obviously that's fake, but a bit of Googling around shows SysInv2.exe being used in other similar attacks.
The Hybrid Analysis for is a little interesting (seemingly identifying it as Loki Bot), showing the malware phoning home to:
jerry.eft-dongle.ir/njet/five/fre.php (188.165.162.201 / Mizban Web Paytakht Co. Ltd., Iran)
Actually, the IP is leaded from OVH and claims to belong to dedicatedland.com in Birmingham, UK:
organisation: ORG-MWPM1-RIPE
org-name: Mizban Web Paytakht Mizban Web Paytakht
org-type: OTHER
address: 55 Orion Building, 90 Navigation Street
address: B5 4AA Birmingham
address: GB
e-mail: info@dedicatedland.com
abuse-mailbox: info@dedicatedland.com
phone: +44.7455017803
mnt-ref: OVH-MNT
mnt-by: OVH-MNT
created: 2015-01-22T22:12:03Z
last-modified: 2015-01-22T22:12:03Z
source: RIPE
The small 188.165.162.200/29 range is marked as "failover IPs". The WHOIS for dedicatedland.com comes up with a bogus looking address in Massachusetts:
Registrant Email: info@dedicatedland.com
Registry Admin ID: Not Available From Registry
Admin Name: Mizban Web Paytakht LLC
Admin Organization: irnameserver.com
Admin Street: Newton Center
Admin City: Newton Center
Admin State/Province: Massachusetts
Admin Postal Code: 00000
Admin Country: US
Admin Phone: +1.00000000
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
However RIPE show them as being in Tehran:
Mizban Web Paytakht Co. Ltd.Anyway, if you are not interested in sending traffic to Iran, Mizban Web Paytakht own AS64428 which comprises of 185.165.40.0/22 as well. I'll make a guess that the 188.165.162.200/29 range
No.43, North Ekhtiyariyeh St, Ekhtiyariyeh Sqr
1958743611 Tehran
IRAN, ISLAMIC REPUBLIC OF
phone: +98 2122587469
fax: +98 2122761180
e-mail: info (at) dedicatedland (dot) com
may be insecure and could be worth blocking.
The email itself originates from 104.171.114.204 which is allocated as follows:
CustName: jason Richards
Address: 121 main street
City: suffolk
StateProv: VA
PostalCode: 23434
Country: US
RegDate: 2017-01-16
Updated: 2017-01-16
Ref: https://whois.arin.net/rest/customer/C06298370
You probably don't need to accept .z attachments at your mail perimeter, and any decent anti-spam tool should be able to look inside archives to determine was is in there.
