Sponsored by..

Showing posts with label NACHA. Show all posts
Showing posts with label NACHA. Show all posts

Tuesday 22 November 2011

Spoof ACH mails, neoprenpillar.com and decalintos.com

Yet another ACH / NACHA / whatever scam email, they go something like this:
Date:      Tue, 22 Nov 2011 10:42:43 +0100
From:      "The Electronic Payments Association" [alerts@nacha.org]
Subject:      Rejected ACH transaction

The ACH transfer (ID: 925071618701), recently initiated from your checking account (by you or any other person), was canceled by the other financial institution.

Rejected transaction
Transaction ID:     925071618701
Reason for rejection     See details in the report below
Transaction Report     report_925071618701.doc (Microsoft Word Document)

About NACHA
The ACH Network had its start in the early 1970's when a group of California bankers formed the Special Committee on Paperless Entries (SCOPE) in direct response to the rapid escalation of check volume in the United States. The Committee set out to explore the technical, operational, and legal framework necessary for an automated payments system, leading to the formation of the first ACH association in 1972. Similar groups soon formed around the country.
NACHA occupies a unique role in the association world, serving as both an industry trade association and administrator of Automated Clearing House (ACH) Network. As the industry trade association that oversees the ACH Network, NACHA provides services in three key functional areas:

13450 Sunrise Valley Drive, Suite 100

Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

payments knowledge to further their professional development and benefit their employers. Offerings include in-person, desk-top, and distance learning courses, publications, and the Accredited ACH Professional (AAP) Program. Payments education offered by NACHA at the national level augments the rich offering of educational programs provided by the Regional Payments Associations throughout the country.

13450 Sunrise Valley Drive, Suite 100

Herndon, VA 20171

2011 NACHA - The Electronic Payments Association
Other subjects include:

  • ACH transfer failure
  • Rejected ACH transaction 
  • Your ACH transaction 
  • ACH transaction canceled 
  • Rejected ACH transaction 
There's a link through to a hacked site, containing four embedded javascripts on other hacked sites which eventually lead to decalintos.com or neoprenpillar.com, both hosted on 193.106.174.219 (IQHost Ltd, Russia). This tries to download a variety of exploits (Wepawet report here).

IQHost seems to be over-run with this sort of toxic crap at the moment. Blocking access to 193.106.172.0/22 is probably a smart move.

Wednesday 16 November 2011

More NACHA / ACH / Tax / Payment scam emails

Following on from yesterday's post, there have been many, many more of these emails with slight variations, presumably ending up with a similar malware infection as before.

If you get an email like this, do NOT click the link! Simply delete it.. if you have clicked the link then it is just possible that your PC is now infected with sometihhg nasty.

From: STALEYMARISELA@aol.com
Date: 16 November 2011 06:08
Subject: Tax Payment ID 8457924507 is failed.

Hello,


Your Federal Tax Payment ID: 9454542999 has been rejected.
Return Reason Code U68 – The identification number used in the Company Identification Field is not valid.
Please, check the information and refer to Code R21 to get details about
your company payment in transaction contacts section:


http://eftpsgov/U0123063643

MARISELA STALEY,
The Electronic Federal Tax Payment System

------------------------------

From: F. K. Gallegos [mailto:Gallegos_1966@nationalbankers.org]
Sent: 16 November 2011 08:59
Subject: ACH debit transfer was not accepted by our bank

Dear Bank Account Owner,

ACH debit transfer initiated by you or on your behalf was not accepted by our bank.

Transaction ID: 1707826560727761
Current status of transaction: declined

Please review transaction details as soon as possible.

D. Y. Gallegos
Treasury Administration


------------------------------

From: Darlene Wong [mailto:Wong_1955@nationalbankers.org]
Sent: 16 November 2011 05:26
Subject: Bill Payment was not accepted by BankUnited Express

Dear Madam / Sir,

Bill Payment sent by you or on your behalf was not accepted by BankUnited Express.

Transaction ID: 17072923276
Current status of transaction: under review

Please review transaction details as soon as possible.

Darlene F. Wong
Treasury Administration


------------------------------

From: Gideon Elkins
Sent: 16 November 2011 18:03
Subject: Re: your Direct Deposit payment ID 239660991991

Attn: Financial Department

Please be notified, that your latest Direct Deposit transaction
(Int. No. 239660991991) was declined, due to your current Direct
Deposit software being out of date. The detailed information
about this matter is available in the secure section of our web
site:

http://peluangusahaonlines.com/57tt9o/index.html

Please refer to your financial institution to acquire the updated
version of the software.

Yours truly,
Gideon Elkins
ACH Network Rules Department
NACHA - The Electronic Payments Association

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
Phone: 703-561-1100 Fax: 703-787-0996

------------------------------

From: Duncan Winkler [mailto:Winkler1939@uba.org]
Sent: 15 November 2011 17:59
Subject: Funds Transfer was not accepted by our bank

Dear bank account holder,

Funds Transfer created by you or on your behalf was not accepted by our bank.

Transaction ID: 1701205726906
Current status of transaction: under review

Please review transaction details as soon as possible.

Duncan Winkler
Customer Support
Austin County State Bank

------------------------------

From: O. Q. Morrison [mailto:Morrison1940@uba.org]
Sent: 15 November 2011 12:35
Subject: ACH payroll payment was not accepted by United Security Bank

Dear Bank Account Owner,

ACH payroll payment initiated by you or on your behalf was not accepted by United Security Bank.

Transaction ID: 17093959546892
Current status of transaction: declined

Please review transaction details as soon as possible.

Gary Morrison
Accounting Management

------------------------------

Date:      Wed, 16 Nov 2011 11:42:53 +0530
From:      "Aryanna Collins" YBPAryanna@hotmail.com
Subject:      Tax Payment ID 3419177910 is failed.

Good morning,


Your Federal Tax Payment ID: 9173073387 has been rejected.

Return Reason Code U78 – The identification number used in the Company Identification Field is not valid.

Please, check the information and refer to Code R21 to get details about

your company payment in transaction contacts section:


http://eftps.gov/U1433600391



Aryanna Collins,

The Electronic Federal Tax Payment System

------------------------------

Date:      Wed, 16 Nov 2011 01:05:20 -1100
From:      "The Electronic Payments Association" alert@nacha.org
Subject:      ACH payment rejected
Attachments:     nacha_logo.jpg

The ACH transaction (ID: 8185663180422), recently initiated from your checking account (by you or any other person), was rejected by the Electronic Payments Association.

Rejected transfer
Transaction ID:     8185663180422
Reason for rejection     See details in the report below
Transaction Report     report_8185663180422.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100

Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

------------------------------

Date:      Wed, 16 Nov 2011 12:52:10 +0100
From:      Bettye_Mcknight@irs.gov
Subject:      Rejected Federal Tax transfer

Your Tax transaction (ID: 971900616898), recently initiated from your bank account was rejected by the your financial institution.

Canceled Tax transaction
Tax Transaction ID:     971900616898
Reason for rejection     See details in the report below
FederalTax Transaction Report     tax_report_971900616898.pdf (Adobe Acrobat Reader Document)




To e-file your 2010 tax return or other electronic forms, you must verify your identity with your Self-Select PIN or Adjusted Gross Income from your 2009 tax return. If you don't have this information from your 2009 tax return, you can request an Electronic Filing PIN�it's as easy as 1-2-3!


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

------------------------------

Date:      Wed, 16 Nov 2011 12:09:36 +0100
From:      "The Electronic Payments Association" risk_manager@nacha.org
Subject:      Your ACH transaction
Attachments:     nacha_logo.jpg

The ACH transfer (ID: 516582351138), recently initiated from your bank account (by you or any other person), was canceled by the other financial institution.

Rejected transaction
Transaction ID:     516582351138
Reason of rejection     See details in the report below
Transaction Report     report_516582351138.doc (Microsoft Word Document)

13450 Sunrise Valley Drive, Suite 100

Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

------------------------------

Date:      Wed, 16 Nov 2011 06:11:50 -0300
From:      Helga_Springer@irs.gov
Subject:      Federal Tax payment rejected

Your federal Tax transaction (ID: 384736455888), recently from your bank account was rejected by the your Bank.

Canceled Tax transfer
Tax Transaction ID:     384736455888
Reason of rejection     See details in the report below
FederalTax Transaction Report     tax_report_384736455888.pdf (Adobe Acrobat Reader Document)

ďż˝

ďż˝
Important Information for Home-care Service Recipients

If you are a home-care service recipient who has a previously assigned EIN either as a sole proprietor or as a household employer, do not apply for a new EIN. Use the EIN previously provided. If you can not locate your EIN for any reason, follow the instructions on the Misplaced Your EIN? Web page.

If you are a home-care service recipient who does not have an EIN, do not use the online application to apply for one. You must apply for your EIN using one of the other methods (phone, fax or mail). For additional information, visit the How to Apply for an EIN Web page.


Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785

------------------------------

Date:      Wed, 16 Nov 2011 13:25:11 +0700
From:      Marylou Friedman Friedman_1948@icba.org
Subject:      Wire Transfer was hold by National Bank of California

Dear Account Owner,

Wire Transfer created by you or on your behalf was hold by National Bank of California.

Transaction ID: 17017200231113028
Current status of transaction: on hold

Please review transaction details as soon as possible.

Marylou S. Friedman
Customer Support
National Bank of California

------------------------------

Date:      Tue, 15 Nov 2011 12:01:16 +0000
From:      "Yuridia KIRKLAND"
Subject:      Fwd: Wire Transfer Confirmation (FED_REFERENCE_6232TI676)

Dear Bank Account Operator,

I regret to inform you that Wire transfer initiated by you or on your behalf was hold by us.



Transaction: 2342937901002077

Current transaction status: Pending



Please review transaction details as soon as possible.

------------------------------

Date:      Tue, 15 Nov 2011 07:56:46 -0800
Subject:      Fwd: Wire Transfer Confirmation (FED 23160LI34)

Dear Bank Account Operator,

I regret to inform you that Wire transfer initiated by you or on your behalf was hold by us.



Transaction: 408332756171192

Current transaction status: Pending



Please review transaction details as soon as possible.

------------------------------

Date:      Wed, 16 Nov 2011 01:13:56 +0900
From:      "New York State Police" noreply-401212008@nyc.gov
Subject:      UNIFORM TRAFFIC TICKET (ID: 622969718)

New York State ? Department of Motor Vehicles

UNIFORM TRAFFIC TICKET
POLICE AGENCY
NEW YORK STATE POLICE



Local Police Code



THE PERSON DESCRIBED ABOVE IS CHARGED AS FOLLOWS




Time: 7:17 AM

Date of Offense: 04/10/2011



IN VIOLATION OF

NYS V AND T LAW Description of Violation:

SPEED OVER 55 ZONE

TO PLEAD, PRINT CLICK HERE AND FILL OUT THE FORM

------------------------------

Date:      Tue, 15 Nov 2011 11:22:33 -0500
From:      information@direct.nacha.org
Subject:      Your Direct Deposit payment via ACH was declined

Attn: Financial Manager

We regret to notify you,
that your latest Direct Deposit via ACH payment (ID141672824371) was cancelled,
because your current Direct Deposit software version was out of date.

Please use the link below to enter the secure section of our web site and see the details::

www.nacha.org/download/report09809878.pdf

Please apply to your financial institution to get your updated version of the software needed.

Kind regards,

------------------------------

Date:      Tue, 15 Nov 2011 20:26:57 +0530
From:      info@direct.nacha.org
Subject:      Direct Deposit payment was rejected

Dear Sirs,

Herewith we are notifying you,
that your most recent Direct Deposit payment (No.378745855247) was cancelled,
because your current Direct Deposit software version was out of date.

Please visit the secure section of our web site to see the details:

www.nacha.org/download/report09809878.pdf

Please apply to your financial institution to get the necessary updates of the Direct Deposit software.

Yours faithfully,

------------------------------

Date:      Tue, 15 Nov 2011 05:48:07 -0800
From:      "Abdul N . Moser" Moser1940@vabankers.org
Subject:      ACH payroll payment was not accepted by us

Dear Sir/Madam,

I regret to inform you that ACH payroll payment sent by you or on your behalf was not accepted by us.

Transaction ID: 1704692033837
Current status of transaction: pending

Please review transaction details as soon as possible.

Abdul Moser
Accounting Management
First SAvings Bank of Hegewisch


------------------------------

Date:      Tue, 15 Nov 2011 16:00:55 +0300
From:      forgery16@uncw.edu
Subject:      ACH payment canceled

The ACH transfer (ID: 3323817008922), recently initiated from your checking account (by you or any other person), was canceled by the Electronic Payments Association.

Rejected transaction
Transaction ID:     3323817008922
Reason for rejection     See details in the report below
Transaction Report     report_3323817008922.doc (Microsoft Word Document)

About NACHA
By 1978, it was possible for two financial institutions located anywhere in the United States to exchange ACH payments under a common set of rules and procedures. By 1988, the number of ACH payments exceeded 1 billion annually. By 2001, the volume of ACH payments grew by more than 1 billion in a single year.
To help guide advocacy and related communication activities, NACHA established a Communications and Marketing Advisory Group (CMAG) in early 2010. CMAG brings together practitioners representing ACH Network participants to engage in work efforts to benefit the Network and those who utilize it.

13450 Sunrise Valley Drive, Suite 100

Herndon, VA 20171

2011 NACHA - The Electronic Payments Association

Monday 14 November 2011

NACHA / Wire Transfer malicious emails

I'm not sure if these three incidents are all related or are just using the same approach, but here goes.

Date:      Mon, 14 Nov 2011 17:53:54 +0100
Subject:      Disallowed Direct Deposit payment

Dear Sirs,

Herewith we are notifying you, that your latest Direct Deposit transaction (No. 60795715105) was disallowed, because of your business software package being out of date. The detailed information about this matter is available in the secure section of our web site:

hxxp://astola.com.au/93oj63/index.html

Please apply to your financial institution to obtain the new version of the software.

Kind regards,
Sidney Gross
ACH Network Rules Department
NACHA - The Electronic Payments Association

13450 Sunrise Valley Drive, Suite 100
Herndon, VA 20171
Phone: 703-561-1100 Fax: 703-787-0996

and then

Date:      Mon, 14 Nov 2011 02:42:02 +0530
From:      accounting@victimdomain.com
Subject:      Fwd: Wire Transfer Confirmation (FED 5697WN59)

Dear Bank Account Operator,

I regret to inform you that Wire transfer initiated by you or on your behalf was hold by us.

Transaction ID: 85802292158295165

Current status of transaction: under review

Please review transaction details as soon as possible.

Bernadette Dickinson
Payments Administration

and finally

Date:      Mon, 14 Nov 2011 10:56:29 +0530
From:      "HARMONY URBAN" support@federalreserve.gov
Subject:      Your Wire Transfer

Good day,

Account: Business Account XXX

Amount: $ 93,056.63

Wire Transfer Report: View

The wire transfer will be processed within 2 hours.

Please make sure that everything is as you requested.

HARMONY URBAN,
Federal Reserve Wire Network 

The first spam leads to a hacked site in Australia (there are probably many others). In turn, this tries to load four scripts to install malware though an HCP attack (Wepawet report here). The scripts are:

lallygag.com/js.js
www.miracleshappenrr.com/images/js.js
kyare.net/js.js
allmemoryram.com/js.js

In all cases, those scripts appear to be on legitimate (but hacked) websites. The final step for that attack is to try to install a malicious Java application from colobird.com/content/import.jar - a domain that is hosted on 216.250.120.100 but one that was only registered very recently.


The second and third emails take a different approach, loading a page at www.btredret.ru/main.php hosted on 93.187.142.38 (S.C. Profisol Telecom S.R.L., Romania). This attemps a Java exploit (Wepawet report here). This IP is part of a small netblock of 93.187.142.32 - 93.187.142.63 (93.187.142.32/27) and can probably safely be blocked, or you could just block the whole /24 if you wanted,

This is an old approach that has been doing the rounds for two years. It must still work though..

Thursday 12 November 2009

support@nacha.org: "Please review the transaction report"

This is the Zbot trojan or something, very much like this one.


From: Electronic Payments Association [mailto:support@nacha.org]
Sent: 12 November 2009 14:58

Subject: Please review the transaction report


Dear bank account holder,
The ACH transaction, recently initiated from your bank account (by you or any third party), was rejected by the Electronic Payments Association. Please review the transaction report by clicking the link below:

Unauthorized ACH Transaction Report

------------------------------------------------------------------
Copyright ©2009 by NACHA - The Electronic Payments Association



The underlying link goes to nacha.org.fffazsf.org.uk which is itself hosted on some sort of Fast Flux botnet. The landing page attempts to get a user to download report.exe ( a Zbot variant). It also opens an IFRAME to 121.12.170.177 in China, a well-known malware domain.



VirusTotal shows patchy detections, still being analysed by ThreatExpert.

The domain name registration is obviously fake:


Domain name: fffazsf.org.uk
Registrant:
Matthew Hughes
Registrant type:
Non-UK Individual
Registrant's address:
203 Striding Ridge Drive Goldsboro 3881 Belgium
Registrar:
Webfusion Ltd t/a 123-Reg.co.uk [Tag = 123-REG]
URL: http://www.123-reg.co.uk

Relevant dates:

Registered on: 12-Nov-2009

Renewal date: 12-Nov-2011
Last updated: 12-Nov-2009
Registration status:
Registration request being processed.
Name servers: ns1.pa-estate.com ns1.tradesdomains.net
Dig deeper at pa-estate.com and we see a familiar email address:

Name : Michell
Organization : Michell

Address : 8663 Sudley Road
City : Manassas
Province/State : beijing

Country : United States

Postal Code : 20108

Phone Number : 571-866-7585793

Fax : 571-866-7585793

Email : Michell.Gregory2009@yahoo.com


A Google Search for that address comes up with over 24,000 references!

tradesdomains.net is registered differently:

Dolorous Lane
fergunis@gmail.com

512 Stonegate Pl

Brentwood
TN

37027

US

Phone: +1.6155546664


ns1.pa-estate.com and ns1.tradesdomains.net are hosted at 207.210.101.253 (Global Net Access, LLC ) which also hosts puioypai.org which looks suspect too. ns2.tradesdomains.net is on 195.178.190.48 (Bahnhof Internet, Sweden).

Added: the email comes from several different addresses, including:
  • report@nacha.org
  • support@nacha.org
  • info@nacha.org
Subjects include:
  • Your ACH transaction was rejected by The Electronic Payments Association (NACHA)
  • Please review the transaction report
  • Your ACH transaction was rejected
Domains spotted so far:
  • nacha.org.tttteacf.co.uk
  • nacha.org.tttteacx.org.uk
  • nacha.org.redaczxm.me.uk
  • nacha.org.fffazsx.co.uk
Some additional nameservers:
  • ns1.pa-estate.net
  • ns1.video-format.com