Malware spam: "Considerable law alternations" / "excerptum_from_the_implemented_rule.zip" / "Pamela Adams"

This fake legal spam comes with a malicious payload:

Date: Wed, 24 Jun 2015 22:04:09 +0900
Subject: Considerable law alternations

Pursuant to alternations made to the Criminal Code securities have to be reestimated.
Described proceeding is to finish until April 2016.
However shown levy values to be settled last in this year.
Please see the documents above  .
Pamela Adams
Chief accountant

In the sample I saw there was an attachment named excerptum_from_the_implemented_rule.zip containing a malicious executable excerptum_from_the_implemented_act.exe which has a VirusTotal detection rate of 2/55.

Automated analysis tools [1] [2] [3] show malicious traffic to the following IPs:

93.185.4.90 (C2NET Przno, Czech Republic)
216.16.93.250 (Clarity Telecom LLC / PrairieWave, US)
195.34.206.204 (Radionet, Ukraine)
75.98.158.55 (Safelink Internet , US)
185.47.89.141 (Orion Telekom, Serbia)
83.168.164.18 (SWAN, a.s. TRIO network, Slovakia)
85.192.165.229 (Rostelecom / VolgaTelecom, Russia)
178.222.250.35 (Telekom Srbija, Serbia)

The Malwr report and Hybrid Analysis report indicate a couple of  dropped files, gebadof.exe (VT 2/55 - identical to the initial file) and qppwkce.exe (VT 3/55). This malware appears to be a combination of the Upatre downloader and Dyre banking trojan.

Recommended blocklist:
93.185.4.90
216.16.93.250
195.34.206.204
75.98.158.55
185.47.89.141
83.168.164.18
85.192.165.229
178.222.250.35

MD5s:
a85849c45667805231f2093e2eabe89d
e91e0424ac23193461c57ac1046e7dc1

Malware spam: "Hope this e-mail finds You well" / "Stacey Grimly"

This spam comes with a malicious attachment:

Date:    23 June 2015 at 14:14
Subject:    Hope this e-mail finds You well

Good day!

Hope this e-mail finds You well.

Please be informed that we received the documents regarding the agreement No. 7232-003 dated from 3rd day of June.
However there are some forms missing.
We made the list of missing documents for Your ease (the list is attached below).
Please kindly check whether these forms are kept in your records.
In case you have any questions here are our contact details: 838-72-99. Feel free to give a call at any time.

Stacey Grimly,
Project Manager

Some of the details vary in each email, but the overall format is the same. So far I have seen two different mis-named attachments:

check.zip size=57747.zipsize=57747
check.zip size=57717.zipsize=57717

The file sizes actually match the one listed in the file's name. Because the attachment is not properly named, some ZIP file handlers may fail to deal with them. Equally, the technique may be designed to get the spam past mail filters.

Each archive contains a file info_bank_pdf.exe with different checksums and a detection rate of 3/52 or 3/54. Automated analysis tools [1] [2] [3] indicate traffic to the following locations:

93.93.194.202 (Orion Telekom, Serbia)
173.216.240.56 (Suddenlink Communications, US)
188.255.169.176 (Orion Telekom, Serbia)
68.190.246.142 (Charter Communications, US)

These two Malwr reports [1] [2] show dropped files named yaxkodila.exe (two versions, VT 5/54 and 5/55) plus a file jieduk.exe (VT 8/54). Incidentally, the VirusTotal analysis also throws up another IP address of:

104.174.123.66 (Time Warner Cable, US)

The malware is a common combination of the Upatre downloader and Dyre banking trojan, targeting Windows systems.

Recommended blocklist:
93.93.194.202
173.216.240.56
188.255.169.176
68.190.246.142
104.174.123.66

 MD5s:
67f05372a34534c5892defb29ba8ead7
267e23f6430999f4b71a074835f19fb2
cebf89f088458f3e89599ae44d03cddf
cfdcb1cbe8983707287be4a03cdb88b4
880ba84222524510c9fe3b3d80429816

Malware spam: "Tax inspection notification" / "tax_663-20845-0479-435.zip size=18288.zipsize=18288"

This fake tax notification comes with a malicious payload.

Date:    22 June 2015 at 19:10
Subject:    Tax inspection notification

Good day!
Trust this e-mail finds You well.
Please be notified that next week the revenue service is going to organize tax inspections.
That is why we highly recommend You to file the attached form in order to be prepared.
Inspectors are to determine whether You as a taxpayer have settled the correct amount of taxes.
According to our records, the inspectors license No. is 090-96919-5886-935. Please check  as it is an important procedure rule.
We may discuss all the related matters by phone: +1 998-497-85. Feel free to contact us.
Bruce Climt,
Tax Advisor

Attached is a file with a malformed ZIP filename of tax_663-20845-0479-435.zip size=18288.zipsize=18288 which contains a malicious executable info_bank_pdf.exe which has a VirusTotal detection rate of 4/57.

This Malwr analysis indicates a traffic pattern consistent with the Upatre downloader:

http://93.93.194.202:13234/203/HOME/0/51-SP3/0/ELHBEDIBEHGBEHK
http://93.93.194.202:13234/203/HOME/41/5/4/ELHBEDIBEHGBEHK

That IP address is the same as seen in this attack earlier today and it belongs to Orion Telekom in Serbia. This VirusTotal report also shows traffic to 178.214.221.89 (Optical Systems LLC, Ukraine), and this Hybrid Analysis report also shows traffic to 37.57.144.177 (Triolan, Ukraine).

Furthermore, this other Malwr report shows two dropped executables, karetfob.exe [VT 4/57] and sveezback.exe [VT 15/57]. The dropped payload will be the Dyre banking trojan.

Recommended blocklist:
93.93.194.202
178.214.221.89
37.57.144.177

MD5s:
394c56133b323ce3bf038cfc7a00562a
4e9fec8e532664672bd3a022f4f0b4ec
14b8a0f6a9258f9e73f63a4269641ca0

Malware spam: "Shareholder alert" / "instructions.zip size=21154.zipsize=21154"

This fake financial spam comes with a malicious attachment:

Date:    22 June 2015 at 13:07
Subject:    Shareholder alert

Hope this e-mail finds You well. Please note that in 2015 no dividends will be paid due to resolution of the Board of Directors. Please see attached.     Glen McCoy, Partner

Attached is a mis-named ZIP file called instructions.zip size=21154.zipsize=21154 containing a malicious executable instructions_document.exe which has a VirusTotal detection rate of 1/56.

The Malwr report indicates network traffic to:

http://93.93.194.202:13227/212/HOME/0/51-SP3/0/ELHBEDIBEHGBEHK
http://93.93.194.202:13227/212/HOME/41/5/1/ELHBEDIBEHGBEHK

93.93.194.202 is Orion Telekom in Serbia.

It also drops an executable xiroukiqa.exe with a detection rate of 5/56 and vusjeson.exe with a detection rate of 4/57. The VirusTotal report for the last binary also shows traffic to 64.111.36.35 ( Midwest Data Center, US), which is clearly malicious according to VirusTotal.

The characteristics of this malware indicate the Upatre download leading to the Dyre banking trojan.

Recommended blocklist:
64.111.36.35
93.93.194.202

MD5s:
058216b2635e9c48c22eda6f9b7c83b5
6b2858d4452d97992ab78fd228c3970d
da53e58da4778515d22a96968766c3e3

Malware spam: "New instructions" / "instructions_document.exe"

This rather terse spam comes with a malicious payload:

From:    tim [tim@thramb.com]
Date:    19 June 2015 at 16:40
Subject:    New instructions

New instructions payment of US banks, ask to read

Attached is an archive file with the somewhat unusual name of instructions.zip size=19811 which contains a malicious executable named instructions_document.exe.

The VirusTotal analysis indicates that this is the Upatre download [detection rate 3/57]. Automated analysis tools [1] [2] [3] [4] show traffic to:

93.93.194.202:13222/C21/UEQUILABOOMBOOM/0/51-SP3/0/MEBEFEBLGBEID

which is an IP operated by Orion Telekom in Serbia, and also 66.196.63.33:443 which is Hamilton Telecommunications in the US. A characteristic of this generation of Upatre is that it sends traffic to icanhazip.com which while not malicious in itself is quite a good indicator of infection.

In all cases I have seen, Upatre drops the Dyre banking trojan, but I have been unable to obtain a sample.

Recommended blocklist:
93.93.194.202
66.196.63.33

MD5s:
329a2254cf4c110f3097aafdaa50c82a

Malware spam: "NOTA FISCAL ELETRÔNICA COD. 6Uhrae.088693" / "sac.contact4e74974737@bol.com.br"

These Portuguese-language spam pretends to be some sort of banking invoice aim, but instead leads to malware hosted on Google Drive. The target appears to be users in Brazil.

From:    sac.contact4e74974737@bol.com.br
To:    mariomarinho@uol.com.br
Date:    18 June 2015 at 08:46
Subject:    NOTA FISCAL ELETRÔNICA COD. 6Uhrae.088693
Signed by:    bol.com.br

Olá.
Estamos encaminhando o LINK para download da nota fiscal eletrônica.
https://cfb53a79c1679ed75e40a391fa21b9b359784781.googledrive.com/host/[redacted]

Caso tenha alguns dos dados errados favor nos retorne no email nfe@jmcomercio.com.br.

 ATT, DANI AIRES DP.FINANCEIRO

18/06/15 :
04:46:18.161 :
''8636055042''WTg9R9cng3hYUD''RYkSkcFpJs''
Por favor, não "responda" esta mensagem.

The reference numbers and sender change slightly in each version.

I've seen three samples before, each one with a different download location [a list is here] which leads to a ZIP file named NFe_0185189710250029301785.zip which in turn contains a malicious executable NFe_0185189710250029301785.exe which has a VirusTotal detection rate of 8/57. Comments in that report indicate that this may be the Spy.Banker trojan.

The Malwr report indicates that it downloads components from the following locations:

http://donwup2015.com.br/arq/point.php
http://tynly2015.com.br/upt/ext.zlib

The Hybrid Analysis report  also has some other details.

These sites are hosted on:

108.167.188.249 (WebsiteWelcome, US)
187.17.111.104 (Universo Online, Brazil)

The VirusTotal report for both these IPs [1] [2] indicates a high level of badness, indicating that they should be blocked.

Furthermore, Malwr shows that it drops a file with a detection rate of 2/57. As yet, I have only tested this on Malwr and it fails to run.

Recommended blocklist:
108.167.188.249
187.17.111.104

MD5s:
71070bc5e6b5c03c2e1d1ef4563c7b94
b969376c85d4e7f1a94ca3a2e416792e

Malware spam: "[Nyfast] Payment accepted" / "Nyfast [mailto:sales@nyfast.com]"

This spam does not come from Nyfast but is instead a simple forgery with a malicious attachment.

From: Nyfast [mailto:sales@nyfast.com]
Sent: Monday, June 15, 2015 11:47 AM
Subject: [Nyfast] Payment accepted

Hi , Thank you for shopping with Nyfast!

Order ZUJIEQGQV - Payment processed Your payment for order with the reference ZUJIEQGQV was successfully processed.

You can review your order and download your invoice from the "Order history" section of your customer account by clicking "My account" on our shop.

If you have a guest account, you can follow your order via the "Guest Tracking" section on our shop.

Nyfast powered by PrestaShop™

Attached is a Word document with a malicious macro, named 29172230_15.06.15.doc. The payload is the same as the one found in this earlier spam run.

Malware spam: "New Doc" / "Will Kinghan [WKinghan@hhf.uk.com]"

This spam does not come from Henry Howard Finance, but is instead a simple forgery with a malicious attachment.

From:    Will Kinghan [WKinghan@hhf.uk.com]
Date:    15 June 2015 at 12:09
Subject:    New Doc

Hello,

My apologies again.

Document attached

Will

With kind regards,

Will Kinghan

Account Manager

T: 01633 415235 |M: 07468723790| E: wkinghan@hhf.uk.com

www.henryhowardfinance.co.uk

Head Office

T: 01633 415222  | F: 01633 415223
Unit 5 | Langstone Business Village | Langstone Park | Langstone | Newport | Gwent | NP18 2LH   
 

The information in or attached to this email is confidential and may be legally privileged. If you are not the intended recipient of this message any use, disclosure, copying, distribution or any action taken in reliance on it is prohibited and may be unlawful. If you have received this message in error, please notify the sender immediately by return email or by telephone on 01633 415222 and delete this message and any copies from your computer and network. Henry Howard Finance plc. do not warrant this email and any attachments are free from viruses and accepts no liability for any loss resulting from infected email transmissions.  Henry Howard Finance plc. reserve the right to monitor all e-mail communications through its networks. Please note that any views expressed in this email may be those of the originator and do not necessarily reflect those of Henry Howard Finance plc. registered in Wales, Company no. 40151132 has registered offices at Unit 5 Langstone Business Village, Langstone Park, Newport, NP18 2LH, VAT no. 753461724. Henry Howard Finance Plc is Authorised by the Financial Conduct Authority (FCA)

Attached is a Word document New doc.doc which contains a malicious macro. It is the same payload as seen in this other spam run earlier today.

Malware spam: "Payment Confirmation 29172230" / "reed.co.uk Credit Control [mailto:creditcontrol.rol@reed.co.uk]"

This fake financial spam does not come from Reed, but is instead a simple forgery with a malicious attachment:

From: reed.co.uk Credit Control [mailto:creditcontrol.rol@reed.co.uk]
Sent: Monday, June 15, 2015 11:10 AM
Subject: Payment Confirmation 29172230

Dear Sirs,

Many thanks for your card payment. Please find payment confirmation attached below.

Should you have any queries, please do not hesitate to contact Credit Control Team on 0845 241 9293.

Kind Regards

Credit Control Team
T: 020 7067 4584
F: 020 7067 4628
Email: creditcontrol.rol@reed.co.uk

The only sample I have seen so far has an attachment 29172230_15.06.15.doc [detection rate 3/57] which contains this malicious macro [pastebin] which downloads a component from the following location:

http://www.freewebstuff.be/34/44.exe

This is saved as %TEMP%\ginkan86.exe and has a VirusTotal detection rate of 6/57. There will probably be other download locations, but they should all lead to an identical binary. Automated analysis tools [1] [2] [3] show traffoc to the following IPs:

136.243.14.142 (Hetzner, Germany)
71.14.1.139 (Charter Communications, US)
173.230.130.172 (Linode, US)
94.23.53.23 (OVH, France)
176.99.6.10 (Global Telecommunications Ltd, Russia)

According the this Malwr report, it also drops a Dridex DLL with a detection rate of 18/57.

Recommended blocklist:
136.243.14.142
71.14.1.139
173.230.130.172
94.23.53.23
176.99.6.10

MD5s:
4270bcfa447d96ccb41e486c74dd3d16
724683fa48c498a793d70161d46c811c
ff0f01d7da2ab9a6cf5df80db7cc508a

Pump and Dump: "Go buy DJRT right now" / Dale Jarrett Racing Adventure Inc

This illegal Pump and Dump spam is pushing stocks in Dale Jarrett Racing Adventure Inc (DJRT):

From:    PennyStockCrew [info@pennystockcrew.com]
Date:    10 June 2015 at 10:18
Subject:    Go buy DJRT right now!

Dear Traders,

Our alert DJRT is doing so amazing that you are probably regretting you didn't buy it yet.

I'll tell you this point blank. If you didn't buy DJRT you are an idiot. Take 1 or 2k and go buy it right this second because it is going to go absolutely ballistic.

DJRT is the stock of the minute, of the hour, of the moment and my stock pick of the year!

GO buy DJRT right now and watch it kick past 10 dollars in a heartbeat.

You are signed up to my alerts at www.pennystockcrew.com
Thank you for being a loyal member.

Sincerely yours,
Penny Stock Crew | info@pennystockcrew.com | Michael Killian | PO Box 110226 | Nutley, NJ 07110

The email is almost definitely nothing to do with pennystockcrew.com but is instead being spammed out by a criminally-controlled botnet.

DJRT is a loss-making stock which probably doesn't have good prospects according to it's own SEC filing.

The P&D spam started on 10th June, and we can see from the trading data that somebody bought 1.8 million shares just before the spam run started [via]

	Date Close/Last Volume 13:18 0.045 167,875* 06/10/2015 0.041 850,878 06/09/2015 0.045 470,269 06/08/2015 0.044 1,355,516 06/05/2015 0.0132 0 06/04/2015 0.0132 0 06/03/2015 0.0132 1,000 06/02/2015 0.02 0 06/01/2015 0.02 5,002 05/29/2015 0.0269 5,000 05/28/2015 0.0175 10,000 05/27/2015 0.0175 0 05/26/2015 0.0175 0 05/22/2015 0.0175 5,600 05/21/2015 0.0175 1,362 05/20/2015 0.0175 0 05/19/2015 0.0175 1,652 05/18/2015 0.0175 0 05/15/2015 0.0175 0 05/14/2015 0.0175 61,000 05/13/2015 0.0175 0 05/12/2015 0.0175 0 05/11/2015 0.0175 0 * This data reflects the latest intra-day delayed pricing.

This activity pushed the stock price up from 1.3 cents to nearly 5 cents. In recent years stocks have never traded particularly highly, but they recent dropped to the 1 cent area after trading from 2 to 5 cents.

Usually with a pump-and-dump spam such as this, it is either the spammers who are trying to manipulate the share price, or a stock holder seeking to boost the value of the shares so they can sell them. I have no evidence at all that anyone connected with Dale Jarrett Racing Adventure Inc has anything to do with this.


Typically, stocks promoted through P&D spams such as this will collapse after the spamming has finished, leaving investors out of pocket. Often the companies are on the verge of bankruptcy anyway, so investors sometimes lose everything. This too is likely to be a poor investment. Avoid.

Phish: "New_Order_#056253_Hf_Constructions" / "joseph.zhou@hong-kee.com"

I've seen a few of these today, presumably they aren't quite spammy enough to get blocked by our mail filters..

From: Kang Li [mailto:joseph.zhou@hong-kee.com]
Sent: 10. juni 2015 09:35
Subject: New_Order_#056253_Hf_Constructions

Dear,

Please find attached our new order and send P/I against 50% advance payemnt

best regards
kang

The attachment is New_Order_#056253_Hf_Constructions.pdf which looks like a purchase order, but there is a blurred out section.

An examination of the underlying PDF file shows two URLs listed:

[donotclick]designaffair.com.my/js/jss/accesslogin.php
[donotclick]perm.ly/importers-buyers-exporters

In turn these redirect to:

[donotclick]megatrading.hol.es/order/0exbligh0bwwciagica8is0tw2lmielfidhdpia8ahrtbcbk/index.html
[donotclick]tips-and-travel.com/~saulitoo/imgs/0exbligh0bwwciagica8is0tw2lmielfidhdpia8ahrtbcbk/index.html

The second URL listed 404s, but the first one is active. According to the URLquery report, it looks harmless, just leading to a phishing page. But when I tried it in a test environment, the behaviour was somewhat different and it also attempted to load a page at:

[donotclick]guest.lifevericalls.xyz/outlandish_litigant_tuners_nudeness/03737928145651311

This page 404s, but was previously hosted on a bad server at 92.222.42.183 [VT report]. That server has been offline for a few days, but the URL is suggestive of an exploit kit of some sort.

The "megatrading.hol.es" (hosted on 31.220.16.16 by Hostinger - VT report) landing page looks like a straightforward phish:

Entering the username and password always seems to return an error, even if you are absolutely certain the combination are correct..

I suspect that all this portion is doing is collecting email addresses and passwords for use later. Webmail accounts have some value to the bad guys, and of course many people re-use passwords all over the place, so it could be used as a way to get access to other services. Take care.

Recommended blocklist:
31.220.16.16
92.222.42.183

Malware spam: "Hayley Sweeney [admins@bttcomms.com]" / "Your monthly BTT telephone bill"

This spam does not come from BTT Communications, but is instead a simple forgery with a malicious attachment:

From:    Hayley Sweeney [admins@bttcomms.com]
Date:    10 June 2015 at 11:20
Subject:    Your monthly BTT telephone bill

Please find attached your telephone bill for last month.
This message was sent automatically.

For any queries relating to this bill, please contact Customer Services on 01536 211100. 

So far I have only seen one sample with an attachment Invoice_68362.doc which contains this malicious macro [pastebin] which downloads a malicious executable from:

http://www.jimaimracing.co.uk/64/11.exe

This is saved as %TEMP%\birsafpc.exe and it has a VirusTotal detection rate of 6/57. Automated analysis tools show traffic to the following IPs:

173.230.130.172 (Linode, US)
94.23.53.23 (OVH, France)
176.99.6.10 (Global Telecommunications Ltd, Russia)

This Malwr report also indicates that it drops a Dridex DLL with a detection rate of 7/57.

Recommended blocklist:
173.230.130.172
94.23.53.23
176.99.6.10

MD5s:
80e51715a4242d0d25668d499796b733
10e4291882e2d45a1a7a52e7d93a5579
53f8addb0e1734be13735e51332b2e90

Malware spam: "Password Confirmation [490192125626] T82"

This spam email message comes with a malicious attachment:

From:    steve.tasker9791@thomashiggins.com
Date:    9 June 2015 at 10:41
Subject:    Password Confirmation [490192125626] T82

Full document is attached

So far I have seen only a single example of this. Attached is a malicious Word document named 1913.doc [VT 3/57] which contains this malicious macro [pastebin] which downloads a component from the following location:

http://oakwindowsanddoors.com/42/11.exe

Incidentally, the macro contains a LOT of junk that appears to have been harvested from a Microsoft tutorial or something. The downloaded executable has a VirusTotal detection rate of 4/57 and automated analysis tools [1] [2] [3] [4] indicate traffic to the following IPs:

173.230.130.172 (Linode, US)
94.23.53.23 (OVH, France)
31.186.99.250 (Selectel, Russia)

The Malwr report shows that it downloads a Dridex DLL with a detection rate of 3/57.

Recommended blocklist:
173.230.130.172
94.23.53.23
31.186.99.250

MD5s:
3a39074dd9095e0b436dcc9513a0408a
1994c977a4e6e6386e0ba17c0cffe5c9
2e5c33d8fdf22053cb3f49b200b35dc8

Malware spam: "Bank payment" / "sarah@hairandhealth.co.uk"

This fake financial spam does not come from SBP Hair and Health but is a simple forgery with a malicious attachment.

From: sarah@hairandhealth.co.uk [mailto:sarah@hairandhealth.co.uk]
Sent: Monday, June 08, 2015 10:10 AM
Subject: Bank payment

Dear customer

Please find attached a bank payment for £3083.10 dated 10th June 2015 to pay invoice 1757.  With thanks.

Kind regards

Sarah
Accounts

Attached is a file Bank payment 100615.pdf [VT 2/57] which appears to drop a Word document with a malicious macro. Although there are probably several versions of this attachment, according to the Hybrid Analysis report it downloads a component from:

192.186.217.68/~banobatwo/15/10.exe

This is saved as %TEMP%\biksampc.exe and has a VirusTotal detection rate of 5/57. Automated analysis tools [1] [2] [3] indicate network traffic to the following IPs:

146.185.128.226 (Digital Ocean, Netherlands)
31.186.99.250 (Selectel, Russia)
176.99.6.10 (Global Telecommunications Ltd, Russia)
203.151.94.120 (Internet Thailand Company Limited, Thailand)
185.12.95.40 (RuWeb, Russia)

The Malwr report indicates that it drops a Dridex DLL with a detection rate of 4/57.

Recommended blocklist:
146.185.128.226
31.186.99.250
176.99.6.10
203.151.94.120
185.12.95.40

MD5s:
48d496afc9c2c123e1ab0c72822a7975
6cbd6126b5761efffbe10dafaa7a4bde
2e499cacb5b3a396a3b2a08bd0f4ce1e

Some domains belonging to Michael Price of BizSummits

Here are some domains belonging to Michael Price of BizSummits. Just saying.

hiringspring.net
logistics-summit.com
supplychainsummit.net
acr-clnt1.com
opendetail.com
itsecurityshow.com
lawpathfinder.net
esquirecareers.net
checkdetailz.com
bayareatechsummit.com
hospital-growthsummit.org
theproductdevsummit.net
powerbizdev.com
prexecutives.org
goldcoastsummit.com
hartfordsummit.org
tampatechsummit.com
jacksonvillesummit.com
miamisummit.org
atlantatechsummit.com
knoxvillesummit.org
nashvillesummit.org
sandiegotechsummit.com
orangecountysummit.com
lasummit.org
portlandtechsummit.com
seattletechsummit.com
denversummit.org
phoenixsummit.org
nytechsummit.org
providencesummit.org
bostonsummit.org
worcestersummit.org
portland-summit.com
cfobestpracticesroundtable.com
orlandosummit.com
cfo-summit.com
the-trainingsummit.net
thefinance-list.com
procurementsummits.org
procurementleadership.org
biz-summits.com
customerservicesociety.org
risk-summit.net
backupsite.biz
alturls.net
serveurls.net
servesites.net
arja.org

Malware spam: "General Election 2015 Invoices" / "SIMSSL@st-ives.co.uk"

This unusually-themed spam leads to malware. It does not come from St Ives but is instead a simple forgery.

From: SIMSSL@st-ives.co.uk [mailto:SIMSSL@st-ives.co.uk]
Sent: Friday, June 05, 2015 9:53 AM
Subject: General Election 2015 Invoices

Dear Sir/Madam

Please find attached your invoice 62812 for GE2015

Please could payment be quoted with your constituency name/Invoice numbers

Our Bank Details are:
St Ives Management Services Limited
HSBC
Sort Code: 40-04-24
Account Number: 71419501
Account Name: St Ives Management Services Limited

Remittance advices should be emailed to simsAR@st-ives.co.uk

If paying by cheque, please kindly remit to the address below and not to 1 Tudor Street:

St Ives Management Services Limited
c/o Branded3
2nd Floor, 2180 Century Way
Thorpe Park
Leeds
LS 8ZB

If you have already paid by credit card then there is no need for you to make payment again.

For payment queries please contact Steven Wilde 0113 306 6966

For invoice queries please contact Emily Villiers 0207 902 6449

Kind Regards
SIMS Sales Ledger

This email is intended for the addressee only. It may be confidential and legally privileged. Unauthorised use, copying or disclosure of any of it may be unlawful. St. Ives plc does not accept liability for changes made to this message after it was sent. Any opinions expressed in this email do not necessarily reflect the opinions of St. Ives plc. If you have received this communication in error, please return the message to the sender by replying to it and delete the email immediately.

Whilst St. Ives plc has taken steps to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that this email and its attachments do not adversely affect their system or data. St. Ives plc accepts no responsibility in this regard and the recipient should carry out such virus and other checks, as is considered appropriate.

St. Ives plc reserves the right to read any e-mail or attachment entering or leaving its systems from any source without prior notice.

St. Ives plc registered in England & Wales no. 1552113

Registered office: One Tudor Street, London EC4Y 0AH 

I have only seen one sample so far, with a Word document 1445942147T0.doc attached containing this macro which tries to download a malicious executable from g6000424.ferozo[.]com/25/10.exe but this fails with a timeout. However, the payload will be the Dridex banking trojan.

UPDATE:
I was informed of another download location at elkettasandassociates[.]com/25/10.exe which downloads a malicious binary with a detection rate of 5/57.

Automated analysis tools [1] [2] [3] show network traffic to the following IPs:

203.151.94.120 (Internet Thailand Company Limited, Thailand)
31.186.99.250 (Selectel, Russia)
146.185.128.226 (Digital Ocean, Netherlands)
185.12.95.40 (RuWeb, Russia)

According to this Malwr report it drops a Dridex DLL with a detection rate of 3/57.

Recommended blocklist:
203.151.94.120
31.186.99.250
146.185.128.226
185.12.95.40

MD5s:
4287dfb5e191d92f34ae50e190eee214
e481e0a2f853a84c903aea752823e496

Malware spam: "simonharrington@talktalk.net" / "Subject: Emailing: slide1"

This malware spam arrived in my mailbox in a somewhat mangled state.

From:    Simon Harrington [simonharrington@talktalk.net]
Subject: Emailing: slide1
Date: Mon, 01 Jun 2015 19:42:14 +0700

  Instead of having an attachment, it has a Base 64 encoded section like this:

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAACAAAAKgAAAAAA
AAAAEAAALAAAAAQAAAD+////AAAAACkAAAB+AAAA////////////////////////////////

As it is, this email is harmless because all the bad stuff needs decoding. Extracing that section and decoding it gives a file named slide1.doc which contains this malicious macro [pastebin].

This macro downloads a malicious component from:

http://irpanet.com/1/09.exe

Which has a VirusTotal detection rate of 7/56.  This Malwr report shows it communicating with the same IPs we saw earlier:

31.186.99.250 (Selectel Network, Russia)
107.170.1.205 (Digital Ocean, US)
146.185.128.226 (Digital Ocean, Netherlands)
144.76.238.214 (Hetzner, Germany)

It also drops the same Dridex DLL we saw earlier, now with a detection rate of 9/56.

Recommended blocklist:
31.186.99.250
107.170.1.205
146.185.128.226
144.76.238.214

MD5s:
0d02257ec18b92b3c1cf58b8cb6b3d37
cef5555f191735867c34868c346501ad

Incidentally, the email address is a genuine one belonging to a poor chap in Tunbridge Wells  (who has nothing to do with this). I bet his mailbox is completely packed with bouncebacks and responses from confused people..

Malware spam: "Uplata po pon 43421" / "Mirjana Prgomet [mirjana@fokus-medical.hr]"

I have no idea what "Uplata po pon" means, but this spam does come with a malicious attachment:

From:    Mirjana Prgomet [mirjana@fokus-medical.hr]
Date:    20 May 2015 at 08:26
Subject:    Uplata po pon 43421

There is no body text, but the only example I saw had an attachment name of report20520159260[1].doc which contained this malicious macro [pastebin] which downloads a malicious executable from:



http://uvnetwork.ca/1/09.exe


This is saved as %TEMP%\eldshrt1.exe and has a VirusTotal detection rate of 3/56. There are probably other download locations with other variants of the document, but the payload should be the same in each case.



Automated analysis tools [1] [2] [3] indicate network traffic to the following locations:


31.186.99.250 (Selectel Network, Russia)
107.170.1.205 (Digital Ocean, US)
146.185.128.226 (Digital Ocean, Netherlands)
144.76.238.214 (Hetzner, Germany)

The Malwr report shows that it drops a Dridex DLL with a detection rate of 5/53.

Recommended blocklist:
31.186.99.250
107.170.1.205
146.185.128.226
144.76.238.214

MD5s:
7008675da5c1b0a6b59834d125fafa45
cef5555f191735867c34868c346501ad

Malware spam: "Your Invoice IN278577 from Out of Eden" / "sales@outofeden.co.uk"

This fake invoice does not come from Out of Eden Ltd but is instead a simple forgery leading to malware.

From: sales@outofeden.co.uk [mailto:sales@outofeden.co.uk]
Sent: 22 May 2015 10:50
Subject: Your Invoice IN278577 from Out of Eden

Dear customer,

Thank you for your order. Please find attached a DOC copy of your invoice IN278577 from sales order S391622.

Your order was despatched on 21/05/2015.  Please check the order on delivery and report any shortage, damage or discrepancy within 48 hours from of receipt of this invoice.

If you would prefer to receive a paper invoice or if this email has been sent to the wrong address, please email sales@outofeden.co.uk or call our Customer Service Team on 017683 72939.

Kind Regards,

Customer Services
Tel: 017683 72939
Please consider the environment before printing this email

Out of Eden Ltd
The UK's Most Popular One-Stop-Shop for Hospitality Products www.outofeden.co.uk

Home Farm Buildings, Kirkby Stephen.  CA17 4AP
Tel: 01768 372 939 Fax: 01768 372 636
Email: sales@outofeden.co.uk
VAT no: 621 2326 86
Reg. in England & Wales - Co. No. 3178081

The payload is very similar to the one found in this earlier spam run, the payload appears to be the Dridex banking trojan.

My contact who sent the information about this spam run (thanks!) also sent the following data about the attachments and download locations. I haven't had time to look into it any further.

hxxp://thepattersonco[.]com/85/20.exe
Attachment: Invoice IN278577 (emailed 2015-05-21).doc
MD5: b15ac324d13f8804959a81172317a4ba

hxxp://www[dot]footingclub[.]com/85/20.exe
Attachment: Invoice IN278577 (emailed 2015-05-21).doc
MD5: d89c0affa2c1b5eff1bfe55b011bbaa8

hxxp://hci-ca[.]com/85/20.exe/85/20.exe
Attachment: Invoice IN278577 (emailed 2015-05-21).doc
MD5: 98c3a42b0d958333a4108e04f10d441f

hxxp://www.seedsindaphne[.]org/85/20.exe
Attachment: Invoice IN278577 (emailed 2015-05-21).doc
MD5: 13dfb8bd543e77453cfd0ab3d586ba77 

hxxp://mercury.powerweave[.]com/85/20.exe
Attachment: Invoice IN278577 (emailed 2015-05-21).doc
MD5: cf5a5ec18a9031f998a1a3945ca10379

Malware spam: "This is a Remitter Advice following the submission of a payment instruction by Lloyds Bank Plc." / "Australian Taxation Office"

This spam doesn't seem to know if it's from Lloyds Bank or the Australian Tax Office.

From:    Australian Taxation Office [noreply@ato.gov.au]
Date:    22 May 2015 at 10:31
Subject:    Remittance Advisory Email


Monday 22 May 2014

This is a Remitter Advice following the submission of a payment instruction by Lloyds Bank Plc.

Please review the details of the payment here.


Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 2299428. Telephone: 0845 603 1637

Lloyds Bank plc, Bank of Scotland plc are authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority.

Cheltenham & Gloucester plc is authorised and regulated by the Financial Conduct Authority.

Halifax is a division of Bank of Scotland plc. Cheltenham & Gloucester Savings is a division of Lloyds Bank plc.

HBOS plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC218813.

This e-mail (including any attachments) is private and confidential and may contain privileged material. If you have received this e-mail in error, please notify the sender and delete it (including any attachments) immediately. You must not copy, distribute, disclose or use any of the information in it or any attachments. Telephone calls may be monitored or recorded.
The link in the email goes to a download page at sharefile.com and leads to an archive file FAX_82APL932UN_772.zip containing a malicious executable FAX_82APL932UN_772.scr which has a date stamp of 01/01/2002 (presumably to make it harder to spot).

This binary has a detection rate of 4/57 and automated analysis tools [1] [2] [3] [4] show that it downloads another file from:

relianceproducts.com/js/p2105us77.exe

This is renamed to csrss_15.exe and has a detection rate of 3/54. It is most likely a component of the Dyre banking trojan.

In addition, this Hybrid Analysis report shows traffic to:

209.15.197.235 (Peer 1, Canada) [relianceproducts.com]
217.23.194.237 (BLICNET, Bosnia and Herzegovina)

Recommended blocklist:
209.15.197.235
217.23.194.237

MD5s:
eb26a6c56b7f85b3257980d0c273c3cf
178a4e3dfa0feea04079592d3113bd2e

Malware spam: "Travel order confirmation 0300202959" / "overseastravel@caravanclub.co.uk"

This fake booking confirmation (received from a contact - thanks!) does not come from the Caravan Club, but is a simple forgery with a malicious attachment:

From: overseastravel@caravanclub.co.uk [mailto:overseastravel@caravanclub.co.uk]
Sent: 21 May 2015 12:34
Subject: Travel order confirmation 0300202959    
    
Dear Customer,

Thank you for your travel order.

Please find attached your booking confirmation which you should take with you on your trip. Please note we no longer send tickets for overseas travel bookings.

Now you have booked your trip why not let The Club help you make the most of your stay?

Did you know The Club has a wide selection of travel advice on the website as well as directions to all our overseas sites?

Want some inspiration on more sites across Europe? Take a look at our Caravan Europe Guides.

If you ’’ ve not already taken out holiday insurance why not let The Club give you a Red Pennant quote online .

Yours sincerely    

The Caravan Club

The file in this case is called Travel Order Confirmation - 0300202959.doc, however the payload seems to be identical to the one found in this earlier spam run.

Malware spam: "Invoice# 2976361 Attached" / "PGOMEZ@polyair.co.uk"

So far I have only seen one sample of this. The sender and subject may vary.

From:    PGOMEZ@polyair.co.uk
Date:    21 May 2015 at 08:58
Subject:    Invoice# 2976361 Attached

Invoice Attached - please confirm..


This transmission may contain information that is privileged and strictly confidential.  If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED.

If you received this transmission in error, please contact the sender and delete the material from any computer immediately.  Thank you.

Attached is a malicious file with the no-very-imaginative name 00001.doc [VT 4/56] which contains this malicious macro [pastebin] that downloads a component from the following location:

http://mercury.powerweave.com/72/11.exe

This download site is hosted on 50.97.147.195 (Softlayer Technologies, US / Powerweave Software Services, India), although be aware that other versions of the macro may download from other locations. This file is saved as %TEMP%\ribasiml.exe and has a VirusTotal detection rate of 5/57.

Automated analysis tools [1] [2] [3] [4] show attempted communications with the following IPs:

78.24.218.186 (TheFirst-RU, Russia)
78.46.60.131 (Hetzner, Germany)
87.236.215.151 (OneGbits, Lithuania)
94.242.58.146 (Fishnet Communications, Russia)
130.208.166.65 (The University of Iceland, Iceland)
176.31.28.250 (OVH, France / Bitweb LLC, Russia)
185.12.95.191 (RuWeb, Russia)

The Malwr report shows that it drops a Dridex DLL with a detection rate of 4/57.

Recommended blocklist:
78.46.60.131
87.236.215.151
94.242.58.146
130.208.166.65
176.31.28.250
185.12.95.191
50.97.147.195

MD5s:
f5aee45ce06f6d9f9210ae28545a14c6
56305283d26e66b81afcbcb6f0e9b9b4
015cc26b738d313e5e7aba0c9114670e

Malware spam: "Sky.com / Statement of Account" and "Voice Mail / You have a new voice" via volafile.io

These two spam runs attempt to download malware from volafile.io. To give the folks at Volafile credit, all the malware I have seen linked to has been taken down. I suspect that the payload is the Dyre banking trojan.

From:    Sky.com [statement@sky.com]
Date:    20 May 2015 at 12:30
Subject:    Statement of account

Afternoon,

Please find the statement of account, download and view from the link below:

https://dl4.volafile.io/download/8eFEP-cNVEX-Jg/statement_00429117.zip

We look forward to receiving payment for the September invoice as this is now due for payment.

Regards,
Elliot

This email, including attachments, is private and confidential. If you have received this email in error please notify the sender and delete it from your system. Emails are not secure and may contain viruses. No liability can be accepted for viruses that might be transferred by this email or any attachment. Wilson McKendrick LLP Solicitors, Queens House, 29 St. Vincent Place, Glasgow G1 2DT Registered in Scotland No. SO303162. Members: Mark Wilson LLB Dip. NP LP Allan T. McKendrick LLB Dip. LP NP.


======================

From:    Voice Mail [Voice.Mail@victimdomain]
Date:    20 May 2015 at 12:11
Subject:    You have a new voice

You are receiving this message because we were unable to deliver it, voice message did not go through because the voicemail was unavailable at that moment.

* The reference number for this message is _qvs5419167125_001

The transmission length was 41
Receiving machine ID : BA9R-DUQUC-TY7T

To download and listen your voice mail please follow the link below: https://dl3.volafile.io/download/rnTYPuYNVEX6Jw/statement_00429114.zip

The link to this secure message will expire in 24 hours. If you would like to save a copy of the email or attachment, please save from the opened encrypted email. If an attachment is included, you will be given the option to download a copy of the attachment to your computer.

volafile.io is a pretty uncommon place to share files, so it might be worth looking at your traffic to see if there have been any unexpected requests to that site.

Malware spam: "Australian Taxation Office [noreply@ato.gov.au]" / "eFax message - 2 page(s)"

Apparently the Australian Taxation Office thinks I have a fax.. or perhaps it is something more sinister?

From:    Australian Taxation Office [noreply@ato.gov.au]
Date:    19 May 2015 at 12:48
Subject:    eFax message - 2 page(s)

Fax Message [Caller-ID: 408-342-0521]
You have received a 2 pages fax at 2015-05-19 08:18:16 AM EST.

* The reference number for this fax is
min2_did16-0884196800-3877504043-49.

View this fax using your PDF reader.

Please visit www.eFax.com/en/efax/twa/page/help if you have any questions regarding this message or your service.
Thank you for using the eFax service!

Predictably, the link leads to a malicious download (this time at storage-ec2-24.sharefile.com) named Fax_00491175.zip and containing in turn a malicious executable Fax_00491175.scr.

This executable has a detection rate of 5/57. Automated analysis tools [1] [2] [3] shows that it downloads a further component from:

http://employmentrisk.com/images/1405uk77.exe

In turn, this has a detection rate of 4/57 and the Hybrid Analysis report indicates that it tries to communicate with 194.28.190.183 (AgaNet Agata Goleniewska, Poland).

Recommended blocklist:
employmentrisk.com
194.28.190.183

MD5s:
a6aa82995f4cb2bd29cdddedd3572461
b3b483c10d4f7eacd7cfa42f604968f8

Malware spam: "Your reasoning stands in need" / "Have a need in your thought" / "In want of your concern"

This fake financial spam run is similar to this one last week, and comes with a malicious attachment.

From:    Aida Curry
Date:    18 May 2015 at 11:40
Subject:    Your reasoning stands in need

Good Afternoon,
We have attained a reimbursement from you for the draft of £ 2909. Please would you secure me with a remittance, in order for me to reconcile the statement.
I will be sending you a pronouncing of outstanding invoices tomorrow, the entire quantum of outstanding is £ 5893 less the 1 draft received making a whole outstanding of £ 2984. We would very much appreciate settlement of this.
As previously mentioned we reversed to a limited company on 1st December 2014. We are desire to conclude all the old checks down, for both tax and year end reasons. We would be very grateful in your assistance in eliciting the outstanding.
If you need any application of bills please do not hesitate to contact us
Regards,
Aida Curry

-------------------

From:    Cornelius Douglas
Date:    18 May 2015 at 11:39
Subject:    Your reasoning stands in need

Good morning
Please find attached   a remittance advice, relating to a outpayment made to you.
Many thanks
Regards,
Cornelius Douglas
Seniour Finance Assistant

-------------------

From:    Jewell Shepard
Date:    18 May 2015 at 11:37
Subject:    Have a need in your thought

Please, see the attached similar of the remittance.
Please, can you remit a revised pronouncing so we can settle any outstanding balances.
Kind Regards,
Jewell Shepard

Subjects spotted so far are:
In want of your concern
Your reasoning stands in need
Have a need in your thought
Vital announcement 561335
Your advertence stands in need
Grand advert 482209
Important notice 540897
In want of your regarding
In want of your concern
Your reasoning stands in need
Wish to know your thought
Your cognizance is in great necessity
Need your consideration

There seem to be several different attachments, but for the sake of simplicity I have looked at just one. The Hybrid Analysis report shows this this is a MIME attachment that downloads and executes a script from pastebin[.]com/download.php?i=C5KGsRX3 which in turn downloads a malicious executable from  193.26.217[.]220:80/bt/get3.php (Servachok LTD, Russia) which is saved as crypted.120.exe.

This executable has a VirusTotal detection rate of 4/57. The Malwr and Hybrid Analysis reports indicates traffic to 5.63.154.228 (Reg.Ru, Russia) and also shows a dropped Dridex DLL with a detection rate of 3/57.

Recommended blocklist:
5.63.154.228
193.26.217.220

MD5s (executable):
af15ba558c07f8036612692122992aad
0074fdc06f8b1da04c71feb249e546dc

Malware spam: "Need your attention,''Important notice" / "Financial information" / "Important information"

This mix of spam messages come with a malicious attachment:

From:    Johnny Higgins [JohnnyHigginsyb@mail.whitsoncm.com]
To:    "it-dept@victimdomain"
Date:    13 May 2015 at 11:39
Subject:    Need your attention,''Important notice

Good Afternoon,

We have received a payment from you for the sum of £ 686.  Please would you provide me with a remittance, in order for me to reconcile the statement.

I will be sending you a statement of outstanding invoices tomorrow, the total amount outstanding is £ 1564  less the £3254.00 received making a total outstanding of £ 878.  We would very much appreciate settlement of this.

As previously mentioned, we changed entity to a limited company on 1st December 2014.  We are keen to close all the old accounts down, for both tax and year end reasons.  We would be very grateful in your assistance in settling the outstanding.

If you need any copy invoices please do not hesitate to contact us

Regards,

Johnny Higgins

--------------------------

From:    Rowena Mcconnell [RowenaMcconnellev@telemar.it]
To:    tedwards@victimdomain
Date:    13 May 2015 at 11:38
Subject:    Financial information

Good Afternoon,

Please see attached the copy of the remittance.

Please can you send a revised statement so we can settle any outstanding balances.

Kind Regards,

Rowena Mcconnell

--------------------------

From:    Jimmie Cooley [JimmieCooleyzils@fsband.net]
To:    server@victimdomain
Date:    13 May 2015 at 11:34
Subject:    Important information

Good morning

Please find attached a remittance advice, relating to a payment made to you.

Many thanks

Regards,

Jimmie Cooley
Seniour Finance Assistant

Each attachment is slightly different, but does contain the name of the recipient plus a random number (e.g. it-dept_0E78A3A5700B.doc). The payload is meant to be a multi-part MIME file, but many are corrupt and are either Base 64 encoded or are "404 Not Found" files.

If the file is correctly format, it should behave similarly to this Hybrid Analysis report, which says that it connects to several different IPs, but crucially also it downloads a malicious executable from 91.226.93[.]110/bt/get1.php (Sobis, Russia) and saves it as crypted.120.exe.

This malicious executable has a detection rate of 2/56 and the Malwr report says that it communicates with 46.36.217.227 (FastVPS, Estonia) and drops a Dridex DLL with a detection rate of 22/56.

Recommended blocklist:
46.36.217.227
91.226.93.110

MD5s:
9afecfaa484c66f2dd11f2d7e9dc4816
d2f825ecfb3d979950b9de92cbe29286

Malware spam: "ATTN: Outstanding Invoices - [4697E0] [April|May]"

This spam comes with random senders and reference numbers, but in all cases includes a malicious attachment:

From:    Debbie Barrett
Date:    12 May 2015 at 11:14
Subject:    ATTN: Outstanding Invoices - [4697E0] [April|May]

Dear anthony,

Kindly find attached our reminder and copy of the relevant invoices.
Looking forward to receive your prompt payment and thank you in advance.

Kind regards

The attachment name combines the recipient's email address with the fake reference number, e.g. barry_51DDAF.xls which isn't actually an Excel file at all, but a multipart MIME file. Payload Security's Hybrid Analysis tools manages to analyse it though, showing several steps in the infection chain.

First a VBScript is downloaded from pastebin[.]com/download.php?i=5K5YLjVu

Secondly, that VBScript then downloads a file from 92.63.88[.]87:8080/bt/get.php (MWTV, Latvia) which is saved as crypted.120.exe, this has a detection rate of 2/57.

This component then connects to 46.36.217.227 (FastVPS, Estonia) and according to this Malwr report drops a Dridex DLL with a detection rate of 3/56.

There are several different attachments, so far I have seen the following MD5s:
110B42E097A7677A993CF1B3B24743D8
20AEB9ECEBC26B3CDE960728E890F904
33A8CBE7B75B20B5EA1069E3E2A13D80
3973E29F7BDC7903FFCB596B10F9FD54
7019D711AE0E2FEDEE25EAA3341CFB7F
949816F4DF724E690690B3C8AD3871D4
9CDEFFBAC7B79302D309404E6F3068C4
B5C2393D44D8E0C94D04E2D159AE8776
B84D52F59AEC53B8D7FA109D256FCB6B
CA5E8A531A8EE24B15FC7B2A66502042
E99216D829C632DF24ECAD9162AF654C
EC1AD4316DBA799EF2E2440E715CD5F5
F4B5B0AE85F27E0A475BD359F5BE76E8
F666682D638FE67607DD189705844AD5

The MD5s for the malware components are:
DD7ADC5B140835DC22F6C95694F9C015
9AFECFAA484C66F2DD11F2D7E9DC4816
838F0A8D3FCBD0DDB2F8E8D236D17957

Recommended blocklist:
92.63.88.0/24
46.36.217.227