Malware spam: "12/16 A Invoice"

This fake financial spam leads to malware:

From:    Kelley Small
Date:    17 December 2015 at 08:39
Subject:    12/16 A Invoice

Hi,
Please find attached a recharge invoice for your broadband.

Many thanks,
Kelley Small

The sender's name is randomly generated, for example:

Harris Page
Leonel Kramer
Gracie Fuentes
Earlene Aguirre
Jerri Whitfield
Art Keith
Freeman Gregory
Moses Larson
Leanna Fletcher

There is an attachment in the format invoice36649009.doc where the number is randomly generated. This comes in at least six different versions but they do not appear to be uniquely generated (VirusTotal results [1] [2] [3] [4] [5] [6] [7]). Detection rates are close to zero.

The Malwr reports for those documents is a mixed bag [1] [2] [3] [4] [5] [6] [7] is a mixed bag, but overall they spot data being POSTed to:

179.60.144.18/chicken/bacon.php
91.203.5.169/chicken/bacon.php

Sources tell me there is another download location of:

195.191.25.145/chicken/bacon.php

Those IPs are likely to be malicious and belong to:

179.60.144.18 (Veraton Projects Ltd, Netherlands)
91.203.5.169 (Denis Pavlovich Semenyuk / TutHost, Ukraine)
195.191.25.145 (Hostpro Ltd, Ukraine)


They also GET from:

savepic.su/6786586.png

A file karp.exe  is dropped with an MD5 of 1fbf5be463ce094a6f7ad345612ec1e7 and a detection rate of 3/54. According to this Malwr report this communicates with:

80.96.150.201 (SC-Nextra Telecom SRL, Romania)

It's not clear what the payload is, but probably some sort of banking trojan such as Dridex.

MD5s:
1FBF5BE463CE094A6F7AD345612EC1E7
69F7AFB14E0E6450C4D122C53365A048
1A4048FA8B910CE6620A91A630B32CF6
7034285D8AA1EC84CFDFF530069ECF77
E0019B311E0319AB3C79C5CDAF5A067D
D08BC2E90E6BB63FB4AEBA63C0E298F4
3ED7EDC00C2C62548B83BCDAAA43C47A
B9D135801A8008EA74584C3DEB1BE8D4

Recommended blocklist:
80.96.150.201
179.60.144.18
91.203.5.169
195.191.25.145
savepic.su

UPDATE 12/1/16 

The same message format is being used for another attack with a slightly different payload, which is the same as used in this spam run.

Malware spam: "Your account has a debt and is past due" leads to Teslacrypt

This fake financial spam comes with an interesting error in the part that is meant to randomly-generate the dollar amount:

From:    Frances Figueroa
Date:    16 December 2015 at 17:22
Subject:    Your account has a debt and is past due

Dear Customer,

Our records show that your account has a debt of $345.{rand(10,99)}}. Previous attempts of collecting this sum have failed.

Down below you can find an attached file with the information on your case.

The value, sender's name and attachment name are randomly generated. The attachment is named in the format SCAN_INVOICE_79608749.zip which contains a malicious script that attempts to download Teslacrypt ransomware from the following locations:

whatdidyaysay.com/80.exe?1
iamthewinnerhere.com/80.exe?1

This has a VirusTotal detection rate of 3/54 and an MD5 of 5c2a687f9235dd536834632c8185b32e. Those download locations have been registered specifically for this purpose (they are not hacked sites) and are hosted on:

176.99.12.87 (Global Telecommunications Ltd., Russia)
185.69.152.145 (Hosting Ukraine Ltd, Ukraine)
5.178.71.10 (Serverius, Netherlands)

The following malicious sites are also hosted on those IPs:

dns1.ojwekhsdfs.in
dns2.ojwekhsdfs.in
whatdidyaysay.com
washawaydesctrucion.com
dns1.mikymaus.in
dns2.mikymaus.in
dns1.saymylandgoodbye.in
dns2.saymylandgoodbye.in
dns2.auth-mail.ru
gammus.com
ifyougowegotoo.com
iamthewinnerhere.com
thewelltakeberlin.com
remarkablyxj.top
sufficientbe.top
domainsgmwills.top
ns2.directly-truimph.com

These automated reports [1] [2] [3] show that the malware calls home to these following legitimate but hacked domains:

sofiehughesphotography.com
goedkoop-weekendjeweg.net
coatesarchitecture.com
hotbizlist.com
adamhughes.in
magaz.mdoy.pro

Recommended minimum blocklist:
176.99.12.87
185.69.152.145
5.178.71.10
whatdidyaysay.com
iamthewinnerhere.com

Malware spam: "Unpaid Invoice from Staples Inc., Ref. 09123456, Urgent Notice" leads to Teslacrypt

This fake financial spam is not from Staples or Realty Solutions but is instead a simple forgery with a malicious attachment.

From:    Virgilio Bradley
Date:    16 December 2015 at 14:37
Subject:    Unpaid Invoice from Staples Inc., Ref. 09846839, Urgent Notice

Dear Valued Customer,

This letter is a formal notice to you taking in consideration the fact that you are obligated to repay our company the sum of $767,90 which was advanced to you from our company on November 21st, 2015.
You now have two options: forward your payment to our office by January 17, 2016 or become a party in a legal action. Please be advised that a judgment against you will also damage your credit record.

Please acknowledge the receipt of the invoice attached and the e-mail, no later than December 31, 2015.


Regards,
Virgilio Bradley
Customer Service Department
Realty Solutions
182 Shobe Lane
Denver, CO 80216

The names, amounts and reference numbers change from email to email. The attachment has the same name of the reference (e.g. invoice_09846839_copy.doc) but despite this I have only seen one version with a VirusTotal detection rate of just 1/55.

According to this Malwr report, the macro in the document downloads a binary from:

iamthewinnerhere.com/97.exe

This appears to be Teslacrypt ransomware and it has a detection rate of 5/53. Unlike some other malware, the domain iamthewinnerhere.com has been registered specifically to host this malware, and is located on:

185.69.152.145 (Hosting Ukraine Ltd, Ukraine)
84.200.69.60 (Ideal-Hosting UG, Germany)

Nameservers are DNS1.SAYMYLANDGOODBYE.IN and DNS2.SAYMYLANDGOODBYE.IN. Other suspect sites on these IPs are:

dns2.auth-mail.ru
metiztransport.ru
remarkablyxj.top
sufficientbe.top
domainsgmwills.top
dns2.mikymaus.in
dns2.dlhosting.in
dns2.donaldducks.in
dns2.saymylandgoodbye.in
dns1.gogodns.ru
dns2.gogodns.ru
gammus.com
testsfds.com
waschmaschinen.testsfds.com
miracleworld1.com
ifyougowegotoo.com
hellofromjamaica.com
www.hellofromjamaica.com
firstwetakemanhat.com
thewelltakeberlin.com
mixer.testsg.net
abfalleimer.testsg.net
buegeleisen.testsg.net
bodenwischer.testsg.net
wasserfilter.testsg.net
kuechenmaschinen.testsg.net
testzd.net
staubsauger.testzd.net
waschtrockner.testzd.net
kaffeevollautomat.testzd.net
izfrynscrek.net
ftp.lazur.info
aspirateurs.lazur.info

According to this Malwr report, it then phones back to these legitimate but hacked domains:

sofiehughesphotography.com
magaz.mdoy.pro
adamhughes.in
goedkoop-weekendjeweg.net
hotbizlist.com
coatesarchitecture.com

MD5s:
3999736909019a7e305bc435eb4168fd
8f4bd99c810d517fb2d2b89280759862

Recommended minimum blocklist:
iamthewinnerhere.com
185.69.152.145
84.200.69.60

Malware spam: "Invoice No. 22696240" / "Sharon Samuels" [sharons463@brunel-promotions.co.uk]

This fake financial email does not come from Brunel Promotions but is instead a simple forgery with a malicious attachment.

From     "Sharon Samuels" [sharons463@brunel-promotions.co.uk]
Date     Wed, 16 Dec 2015 14:46:12 +0300
Subject     Invoice No. 22696240

  Good morning

Please find attached your latest invoice, for your attention.

Please be advised that your goods have been despatched for delivery.

Regards

Sharon
--------------------------------------------
Calendars and Diaries of Bristol Limited
Hope Road
Bedminster

BRISTOL
Bristol
BS3 3NZ
United Kingdom
Tel:01179636161
Fax:01179664235

Various details in the message change, such as the invoice number. I have seen two attachments with detection rates of 4/55 [1] [2] which according to Malwr [3] [4] download a malicious binary from the following locations:

winnig.privat.t-online.de/98g654d/4567gh98.exe
printempsroumain.org/98g654d/4567gh98.exe

This executable has a detection rate of 3/52 and these automated analyses [1] [2] [3] [4] indicate network traffic to:

199.7.136.84 (Megawire, Canada)
202.69.40.173 (Gerrys Information Technology (PVT) Ltd, Pakistan)
221.132.35.56 (Ho Chi Minh City Post and Telecom Company, Vietnam)

The payload is the Dridex banking trojan, probably.

MD5s:
d73d599ef434d7edad4697543a3e8a2b
7bcf4a947a74866debbcdeae068541fe
1cf8d5ab33c7e9e603d87d482c1c865d

Recommended blocklist:
199.7.136.84
202.69.40.173
221.132.35.56

Malware spam: "Documentation: Your Order Ref: SGM249/013" / "Jonathan Carroll [Jonathan@john-s-shackleton.co.uk]"

This fake financial spam is not from John S. Shackleton (Sheffield) Ltd but is instead a simple forgery with a malicious attachment. It is the second spam in a day pretending to be from a steel company.

From     Jonathan Carroll [Jonathan@john-s-shackleton.co.uk]
Date     Wed, 16 Dec 2015 11:11:09 -0000
Subject     Documentation: Your Order Ref: SGM249/013

Your Order: SGM249/013
Our Order: 345522
Advice Note: 355187
Despatch Date: 22/12/15

Attachments:
s547369.DOC Shackleton Invoice Number 355187


John S. Shackleton (Sheffield) Ltd
4 Downgate Drive
Sheffield
S4 8BU

Tel: 0114 244 4767
Fax: 0114 242 5965

E-mail: sales@john-s-shackleton.co.uk
Web: www.johnsshackleton.co.uk

Phone us for a free stock brochure.

Our product range includes: Beams, Columns, Pfc's, Channels, Flats, Rounds, Squares,
Angles, Tees, Convex, ERW Tubes, Hollow Section, Cold Reduced Sheet, Hot Rolled Sheet
Galvanised Sheet, Zintec Sheet, Floorplate, Open Mesh Flooring, Handrail Standards,
Tube, Tubeclamps. Welded Mesh, Expanded Metal, Perforated Sheet, U Edging, Fencing
and Bright Bar.

IMPORTANT NOTE

Our Terms and Conditions of Sale apply to all quotations and the supply of all goods.
Copies of our Terms and Conditions of Sale are available on request or can be found
on our website www.johnsshackleton.co.uk . These
Terms and Conditions include a provision (see term 12) that title to goods supplied
shall not pass to a customer until payment is received by us in full for all goods
supplied. We only accept orders for the supply of goods on the basis our Terms and
Conditions of Sale apply.

I have only seen a single sample of this spam, with an attachment s547369.DOC which has a VirusTotal detection rate of 4/55. According to this Malwr Report it downloads a malicious binary from:

bbbfilms.com/98g654d/4567gh98.exe

This binary has a detection rate of 4/53 and is the same payload as found in this spam run, leading to the Dridex banking trojan.

Malware spam: "Your e-Invoice(s) from Barrett Steel Services Ltd" / "samantha.morgan@barrettsteel.com"

This fake financial spam does not come from Barrett Steel Services Ltd but is instead a simple forgery with a malicious attachment:

From:    samantha.morgan@barrettsteel.com
Date:    16 December 2015 at 09:44
Subject:    Your e-Invoice(s) from Barrett Steel Services Ltd

Dear Customer,

Please find attached your latest Invoice(s).

Kind Regards,
Samantha Morgan,
Barrett Steel Services Ltd,

Phone: 01274654248
Email: samantha.morgan@barrettsteel.com


PS
Have you considered paying by BACS ?  Our details can be found on the attached invoice.

Please reply to this email if you have any queries.


You can use the link below to perform an Experian credit check.

http://www.experian.co.uk/business-check/landing-page/barrett-steel.html?utm_source=BarrettSteel&utm_medium=Banner&utm_campaign=BusinessCheckBS

Samantha Morgan
Credit Controller

Tel: 01274 654248 |  | Fax: 01274 654253
Email: Samantha.Morgan@Barrettsteel.com | Web: www.barrettsteel.com


------------------------------------------------------------------------------
IMPORTANT NOTICE

The information contained in or attached to this e-mail is intended for the use of the individual or entity to which it is addressed. It may contain information which is confidential and/or covered by legal, professional or other privilege (or other similar rules or laws). If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are not authorised to and must not disclose, copy, distribute, or retain this message or any part of it.  Nor should you take any action with reference to it. If you have received this communication in error, please return it with the title "received in error" to Barrett.Admin@Barrettsteel.com then delete the email and destroy any copies of it.

This email has been scanned for viruses, but no responsibility is accepted once this communication has been transmitted. You should scan attachments (if any) for viruses.

Registered Office:
Barrett House, Cutler Heights Lane, Dudley Hill, Bradford, BD4 9HU

This message has been scanned by iCritical.

Attached is a file e-Invoice Barrett Steel Services Ltd.doc which I have seen just a single variant of, with a VirusTotal detection rate of 4/54 which according to this Malwr analysis downloads a malicious binary from the following location:

wattplus.net/98g654d/4567gh98.exe

This downloaded binary has a detection rate of 4/53 and according to this Malwr report it attempts to contact:

199.7.136.84 (Megawire, Canada)

I strongly recommend that you block traffic to that IP. Other analysis is pending. The payload is almost definitely the Dridex banking trojan.

Domain registration scan: cn-registry.net / "Huabao Ltd"

This type of Chinese domain registration scam has been around for years.

From:    Jim Gong [jim.gong@cnregistry.net]
Date:    15 December 2015 at 13:40
Subject:    "petroldirect"

Dear CEO,

(If you are not the person who is in charge of this, please forward this to your CEO, because this is urgent, Thanks)

We are a Network Service Company which is the domain name registration center in Shanghai, China.

We received an application from Huabao Ltd on December 14, 2015. They want to register " petroldirect " as their Internet Keyword and " petroldirect .cn "、" petroldirect .com.cn " 、" petroldirect .net.cn "、" petroldirect .org.cn " 、" petroldirect .asia " domain names etc.., they are in China and Asia domain names. But after checking it, we find " petroldirect " conflicts with your company. In order to deal with this matter better, so we send you email and confirm whether this company is your distributor or business partner in China or not?

 

Best Regards,

  Jim
General Manager 
Shanghai Office (Head Office)
3008, Jiulong Building, No. 836 Nandan Road,
Shanghai, China
Tel: +86 216191 8696
Mobile: +86 1870199 4951
Fax: +86 216191 8697
Web: www.cn-registry.net

In fact, there is no Huabao Ltd - it's just a made-up name that the scammers use to try to persuade you into buying some overpriced and worthless domains. Nobody is interested in buying these domains, and no domain registrar would contact you before registration in any case as it is not the responsibility of registrar to do so*.

I certainly don't recommend forwarding this to your CEO, as many CEOs will not understand the scam and may fall for it. If you do forward it, make you that you point out that this is a scam.

This scam has been around for so long, that I even made a video about it..

These following domains are all variations of the same rogue Chinese registrar:

cnregistry.net
cn-registry.net
cnwebregistry.net
cn-registry.com
cnweb-registry.com
cnwebregistry.com
cnwebregistry.org
cnweb-registry.org
cnregistry.com.cn
cn-registry.org.cn
cnweb.org.cn
webregistry.org.cn

* except in specific and limited circumstances (e.g sunrise applications) that do not apply here.

Malware spam: "Rockspring Remittance Advice - WIRE"

This fake financial spam comes with a malicious attachment:

From:    Kristina Salinas
Date:    15 December 2015 at 14:59
Subject:    Rockspring Remittance Advice - WIRE

Dear Customer,

Please find attached your Remittance Details for the funds that will be deposited to your bank account on December 15th.

Rockspring Capital is now sending through the bank the addenda information including your remit information.

If you are not seeing your addenda information in your bank reporting you may have to contact your local bank representative.

Accounts Payable

Attached is a malicious document with a random name. I have only seen one sample so far with a VirusTotal detection rate of 3/55. The Malwr report indicates that same behaviour as this earlier spam run  which is dropping Nymaim ransomware.

Tainted network: Dmitry Shestakov / vds24.net on OVH

vds24.net (apparently belonging to "Dmitry Shestakov ") is a Russian reseller of OVH servers that has come up on my radar a few times in the past few days [1] [2] [3] in connection with domains supporting Teslacrypt malware and acting as landing pages for the Angler exploit kit.

Curious as to what was hosted on the vds24.net I set about trying to find out their IP address ranges. This proved to be somewhat difficult as they are spread in little chunks throughout OVH's IP space. I managed to identify:

5.135.58.216/29
5.135.254.224/29
51.254.10.128/29
51.254.162.80/30
51.255.131.64/30
149.202.234.116/30
149.202.234.144/30
149.202.234.188/30
149.202.237.68/30
176.31.24.28/30
178.32.95.152/29
178.33.200.128/26

Then using a reverse DNS function, I looked up all the domains associated with those ranges (there were a LOT) and then looked the see which were active plus their SURBL and Google ratings. You can see the results of the analysis here [csv].

There may well be legitimate domains in this range, but out of 1658 domains identified, 1287 (77.6%) are flagged by SURBL as being spammy. Only 11 (0.7%) are identified as malicious, but in reality I believe this to be much higher.

In particular, the following IP ranges seem to be clearly bad from those ratings:

51.254.10.131
51.254.162.81
51.255.131.66
51.255.142.101
149.202.234.190
149.202.237.68
178.33.200.138

I can see 61 active IPs in the vds24.net range, so perhaps it is only a small proportion. However, depending on your network stance, you may want to consider blocking all the IP ranges specified above just to be on the safe side.

UPDATE

One additional range has come to light, connected with the Dridex banking trojan:

51.254.51.176/30

Malware spam: "Invoice Attached" / "Accounting Specialist| Bank of America, N.A., Cabot Oil & Gas Corp."

This fake financial spam has a malicious attachment:

From:    Ernestine Harvey
Date:    15 December 2015 at 11:34
Subject:    Invoice Attached

Good morning,

Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice. If you have any questions please let us know.

Thank you!

Mr. Ernestine Harvey
Accounting Specialist| Bank of America, N.A., Cabot Oil & Gas Corp.

The sender name varies randomly, except in the email they are all signed "Mr." even if they have female names, for example:

Mr. Colleen Sheppard
Mr. Joel Small
Mr. Esther Gates
Mr. Devin Joyce
Mr. Todd Robertson

The attachments are named in the format invoice_12345678_scan.doc - the filenames are randomly-generated and indeed every attachment seems to be unique. Typical VirusTotal detection rates are around 3/54, and the macro looks something like this.

An analysis of five of the attachments [1] [2] [3] [4] [5] shows attempted downloads from:

modern7technologiesx0.tk/x1656/dfiubgh5.exe
forbiddentextmate58.tk/x1656/ctruiovy.exe
temporary777winner777.tk/x1656/fdgbh44b.exe
former12futuristik888.tk/x1656/fdgjbhis75.exe

Note that these are all .TK domains.. and they are all hosted on exactly the same server of 31.184.234.5 (GTO Ltd, Montenegro). A look at VirusTotal's report for that IP gives another malicious domain of:

servicexmonitoring899.tk

I would suggest that the entire 31.184.234.0/24 range looks pretty questionable.

Anyway, the downloaded binary has a VirusTotal detection rate of 4/55 and the comments indicate that rather surprisingly this is the Nymaim ransomware. The Hybrid Analysis indicates network traffic to xnkhfbc.in on 200.195.138.156 (Szabo & Buhnemann, Brazil). But in fact that domain seems to move around a lot and has recently been seen on the following IPs:

41.224.12.178 (Orange Tunisie Internet, Tunisia)
51.255.59.248 (OVH, France)
78.107.46.8 (Corbina Telecom, Russia)
95.173.163.211 (Netinternet, Turkey)
118.102.239.53 (Dishnet, India)
140.116.161.33 (TANET, Taiwan)
185.114.22.214 (Osbil Technology Ltd., Turkey)
192.200.220.42 (Global Frag Networks, US)
200.195.138.156 (Szabo & Buhnemann Ltda, Brazil)
210.150.126.225 (HOSTING-NET, Japan)

There are a bunch of bad domains associated with this malware but the only other one that seems to be active is oxrdmfdis.in.

MD5s:
4CADF61E96C2D62292320C556FD34FE6
BBAAAB1245D7EDD40EE501233162110E
6B6C7430D33FE16FAE94162D61AF35DD
79A10791B1690A22AB4D098B9725C5E0
D148440E07434E4823524A03DE3EB12F
79A10791B1690A22AB4D098B9725C5E0
B41205F6AEEEB1AA1FD8E0DCBDDF270E


Recommended blocklist:
31.184.234.5
41.224.12.178
51.255.59.248
78.107.46.8
95.173.163.211
118.102.239.53
140.116.161.33
185.114.22.214
192.200.220.42
200.195.138.156
210.150.126.225
xnkhfbc.in
oxrdmfdis.in

UPDATE

A source tells me (thank you) that  servicexmonitoring899.tk  is now resolving to 78.129.252.19 (iomart, UK) that has also recently hosted these following domains:

google-apsm.in
specre.com
ganduxerdesign.com
www.ganduxerdesign.com
upmisterfliremsnk.net
tornishineynarkkek.org
tornishineynarkkek2.org

Some of these domains are associated with Rovnix.

Malware spam: "Invoice for Voucher ACH-2-197701-35" / "Reservations [res@affordablecarhire.com]"

This fake financial spam does not come from Affordable Car Hire but is instead a simple forgery with a malicious attachment.

From:    Reservations [res@affordablecarhire.com]
Date:    15 December 2015 at 11:50
Subject:    Invoice for Voucher ACH-2-197701-35

	Payment Link For BookingACH-2-197701-35
	Please find attached your invoice for reservation number ACH-2-197701-35
	This email was sent on 14/12/2015 at 16:25

ACH-2-197701-35-invoice.xls 116K

I have only seen a single sample, with an attachment ACH-2-197701-35-invoice.xls which has a VirusTotal detection rate of 3/54. According to this Malwr report, it downloads a malicious binary from:

usahamanfaat.com/8iy45323f/i87645y3t23.exe

The payload here is the Dridex banking trojan, and it is identical to the one found in this spam run.

Malware spam: "Order PS007XX20000584" / "Nicola Hogg [NHogg@pettywood.co.uk]"

This rather brief spam does not come from Petty Wood but is instead a simple forgery with a malicious attachment:

From:    Nicola Hogg [NHogg@pettywood.co.uk]
Date:    15 December 2015 at 10:14
Subject:    Order PS007XX20000584

There is no body text, but instead there is an attachment PS007XX20000584 - Confirmation with Photos.DOC which has a VirusTotal detection rate of 5/55 and it contains a malicious macro [pastebin] which (according to this Malwr report) downloads a binary from:

kutschfahrten-friesenexpress.de/8iy45323f/i87645y3t23.exe

There are probably other version of the document with different download locations. This malicious executable has a detection rate of 2/54 and between them these three reports [1] [2] [3] indicate malicious traffic to:

199.7.136.84 (Megawire Inc, Canada)
221.132.35.56 (Ho Chi Minh City Post And Telecom Company, Vietnam)

The payload here is likely to be the Dridex banking trojan.

MD5s:
8b288305733214f8e0d95386d886af2d
f9c00d3db5fa6cd33bc3cd5a08766ad0

Recommended blocklist:
199.7.136.84
221.132.35.56

Malware spam: "Reference Number #89044096, Notice of Unpaid Invoice" leads to Teslacrypt

This fake financial spam comes with a malicious attachment.

From:    Carol Mcgowan
Date:    15 December 2015 at 09:09
Subject:    Reference Number #89044096, Notice of Unpaid Invoice

Dear Valued Customer,

It seems that your account has a past due balance of $263,49. Previous attempts to collect the outstanding amount have failed.

Please remit $263,49 from invoice #89044096 within three days or your account will be closed, any outstanding orders will be cancelled and this matter will be referred to a collection agency.

The payment notice is enclosed to the letter down below.

Attached is a file invoice_89044096_scan.doc which has a VirusTotal detection rate of 2/54, and which contains this malicious macro [pastebin] which attempts to download a binary from the following location:

thewelltakeberlin.com/92.exe 

This domain was registered only today, and at the moment is not resolving properly. The payload here is likely to be Teslacrypt.

The WHOIS details for it are:

Registrant Name: Quinciano Huerta
Registrant Organization: Quinciano Huerta
Registrant Street: Vila Fonteles 163  
Registrant City: Fortaleza
Registrant State/Province: CE
Registrant Postal Code: 60741-080
Registrant Country: BR
Registrant Phone: +55.8568257712
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: wexel@thewelltakeberlin.com

Nameservers are dns1.saymylandgoodbye.in and dns2.saymylandgoodbye.in hosted on 5.178.71.5 (Serverius, Netherlands) and 83.69.233.102 (Awax Telecom, Russia)

Those two IPs host or have recently hosted the following potentially malicious domains:

buildites.com
dauth-mail.ru
ddonaldducks.in
directly-success.com
dmikymaus.in
dsaymylandgoodbye.in
dsoftextrain644.com
gammus.com
hackeroff.net
kalamarkesof.org
linuxczar.com
metiztransport.ru
miracleworld1.com
obamalox.com
outreel.ru
pro100now.ru
rapdacity.ru
remarkablyxj.top
staringpartnerk.com
sufficientbe.top
superiorityci.top
trillionstudio.com
vmark.su
workcccbiz.in

Recommended minimum blocklist:
thewelltakeberlin.com
83.69.233.102
5.178.71.5

UPDATE
There is a good analysis of this malware at TechHelpList including the C2 domains involved.

Malware spam: "Israel Burke" / "BCP Transportation, Inc."

This fake invoice comes with a malicious attachment:

From:    Israel Burke [BurkeIsrael850@business.telecomitalia.it]
Date:    14 December 2015 at 15:00
Subject:    Israel Burke

Dear Customer:

Attached please find an invoice(s) for payment.  Please let us know if you have any questions.

We greatly appreciate your business!

Israel Burke
BCP Transportation, Inc.

I have only seen one sample of this, it is possible that the company name and sender names are randomly generated. The attachment in this case was named invoice_scan_76926455.doc and has a detection rate of 3/55.

Despite the name, this is not a Word document but is an XML document [pastebin] containing ActiveMIME data. The Malwr report for this indicates network traffic to:

109.234.34.224 (McHost.Ru, Russia)
80.96.150.201 (SC-Nextra Telecom SRL, Romania)

That Malwr report shows a dropped binary named qqqew.exe which has a VirusTotal detection rate of 5/55.

I am not certain of the payload, but I suspect that this Word document is dropping Upatre leading to the Dyre banking trojan.

MD5s:
a81a19478dbe13778f06191cf39c8143
5b1db9050cc44db3a99b50a5ba9d902a

Recommended blocklist:
109.234.34.224
80.96.150.201

Malware spam: "Your order #12345678" / "11 Money Way, Pittsburgh, PA 15226"

This fake financial spam leads to malware:

From:    Giuseppe Sims
Date:    14 December 2015 at 14:19
Subject:    Your order #25333445

Dear Valued Customer,

This letter was sent to you as a formal notice that you are obligated to repay our company the sum of 2,760$ which was advanced to you from our company on October 16, 2015.
Please, find the invoice enclosed down below.

This amount must be repaid until the date of maturity to payment obligation, December 28, 2015 and you have failed to repay our company the same despite repeated requests for this payment.

Thank you in advance for your prompt attention to this matter. We look forward to your remittance. If you have any questions, please do not hesitate to contact us.

Sincerely,
Giuseppe Sims
11 Money Way
Pittsburgh, PA 15226

The sender's name is randomly-generated but is always female. Also random are the order number and value, and there is an attachment in the format invoice_12345678_scan.zip that matches the reference in the document.

Inside that ZIP file is a uniquely generated .JS file in the format invoice_XXXXXX.js or invoice_copy_XXXXXX.js which is highly obfuscated (like this) and deobfuscates to something like this.

The various versions of the macro attempts to download a binary from the following location:

miracleworld1.com/80.exe?1

I cannot get this to resolve at the moment, it turns out that the domain was only registered today.

Domain Name:miracleworld1.com
Registry Domain ID:
Registrar WHOIS Server: whois.webnic.cc
Registrar URL: webnic.cc
Updated Date:2015-12-14 21:24:21
Creation Date:2015-12-14 21:21:12
Registrar Registration Expiration Date:2016-12-14 13:21:11
Registrar:WEBCC
Registrar IANA ID:460
Registrar Abuse Contact Email:compliance_abuse@webnic.cc
Registrar Abuse Contact Phone:+603 8996 6799
Domain Status:Active
Registry Registrant ID:
Registrant Name:Eliisa Laukkanen
Registrant Organization:Eliisa Laukkanen
Registrant Street:Etelaesplanadi 89
Registrant City:Ingermaninkyla
Registrant State/Province:Ingermaninkyla
Registrant Postal Code:07810
Registrant Country:FI
Registrant Phone:+358.0460879234
Registrant Phone Ext:
Registrant Fax:+358.0460879234
Registrant Fax Ext:
Registrant Email:bomb@miracleworld1.com

I think they started spamming before the domain records could be pushed out fully. Shame.

Nameservers are DNS1.DONALDDUCKS.IN and DNS2.DONALDDUCKS.IN on 93.189.42.21 (NTCOM, Russia) and 178.33.200.177 (Dmitry Shestakov, Belize / OVH, France) respectively.

Looking at the nameservers, I can see that the following malicious domains are part of the same cluster, and I recommend you block all of them:

gammus.com
miracleworld1.com
soft2webextrain.com

Although I have not been able to acquire the payload, it is almost definitely Teslacrypt.

UPDATE

An updated version of the script is being spammed out that looks like this when deobfuscated. This attempts to download Teslacrypt from the following URLs:

firstwetakemanhat.com/91.exe?1
miracleworld1.com/91.exe?1

This has a detection rate of 4/55. firstwetakemanhat.com was registered just today and is hosted on:


193.150.0.78 (PE Govoruhin Vitaliy Sergeevich, Russia)
84.200.69.60 (Ideal-Hosting UG, Germany)


Nameservers are DNS1.GOGODNS.RU and DNS2.GOGODNS.RU which are hosted on the same two IPs.

The Malwr report shows more details, however this is my recommended blocklist (updated):
193.150.0.78
84.200.69.60 
gammus.com
miracleworld1.com
soft2webextrain.com
firstwetakemanhat.com

Malware spam: "Invoice 14 12 15" / "THUNDERBOLTS LIMITED [enquiries@thunderbolts.co.uk]"

This terse fake financial spam is not from the awesomely-named Thunderbolts Limited but is instead a simple forgery with a malicious attachment:

From:    THUNDERBOLTS LIMITED [enquiries@thunderbolts.co.uk]
Date:    14 December 2015 at 11:15
Subject:    Invoice 14 12 15

This message contains 2 pages in PDF format.

Curiously, the bad guys have gone as far as to include a fake header to make it look like a fax:

X-Mailer: ActiveFax 3.92

 
Attached is a file fax00163721.xls which is fairly obviously not a PDF document. So far I have seen two versions of this with a detection rate of 6/55 [1] [2] and which these Malwr reports [3] [4] indicate download a malicious binary from:

exfabrica.org/437g8/43s5d6f7g.exe
test-cms.reactive.by/437g8/43s5d6f7g.exe

This binary has a detection rate of 0/54. That VirusTotal report and this Hybrid Analysis both show traffic to:

199.7.136.84 (Megawire, Canada)

This malware is likely to be Dridex. Given that it is similar to the one found here,  I would recommend blocking network traffic to:

199.7.136.84
221.132.35.56
202.69.40.173
78.47.66.169

MD5s:
a0de2560362cc6dfc53d1cd5ff50559b
bd22c4b0b6996a8405b2d33696e1e71e
b1fff594a8877042efd0ed4d67f6feb6

Malware spam: "Scan from a Samsung MFP" / "Gareth Evans [gareth@cardiffgalvanizers.co.uk]"

This fake scanned document does not come from Cardiff Galvanizers but is instead a simple forgery with a malicious attachment.

From:    Gareth Evans [gareth@cardiffgalvanizers.co.uk]
Date:    14 December 2015 at 10:43
Subject:    FW: Scan from a Samsung MFP

Regards

Gareth

-----Original Message-----

Please open the attached document. It was scanned and sent to you using a
Samsung MFP. For more information on Samsung products and solutions, please
visit http://www.samsungprinter.com.


This message has been scanned for malware by Websense. www.websense.com

I have seen just a single sample of this, named Untitled_14102015_154510.doc and with a VirusTotal detection rate of 7/54. It contains a malicious macro [pastebin] which according to this Malwr report downloads a malicious binary from:

test1.darmo.biz/437g8/43s5d6f7g.exe

There will probably be other versions of the document downloading from the same location. The binary has a VirusTotal detection rate of 1/54. Those two reports plus this Hybrid Analysis indicate network traffic to the following malicious IPs:

199.7.136.84 (Megawire, Canada)
221.132.35.56 (Ho Chi Minh City Post And Telecom Company, Vietnam)
202.69.40.173 (Gerrys Information Technology (PVT) Ltd, Pakistan)
78.47.66.169 (Hetzner, Germany)

The payload is likely to be the Dridex banking trojan.

MD5s:
dcb019624fb8e92eb26adf2bef77d46c
21781d7e2969bd9676492c407a3da1cc

Recommended blocklist:
199.7.136.84
221.132.35.56
202.69.40.173
78.47.66.169

Malware sites and evil networks to block (2015-12-11)

This group of domains and IPs are related to this Teslacrypt attack, sharing infrastructure with some of the malicious domains in question. In addition to Teslacrypt, some of these are connected with PoSeidon, Pony and Gozi malware.

The analysis [csv] includes SURBL and Google ratings, ISP information and a recommended blocklist.

Malicious domains:
auth-mail.ru
blagooooossss.com
brostosoosossss.com
chromedoors.ru
debatelocator.ru
ggergregre.com
growthtoys.ru
hagurowrob.ru
hedtheresran.ru
listfares.ru
littmahedtbo.ru
mikymaus.in
mytorsmired.ru
poponkia.com
soft2webextrain.com
softextrain64.com
softextrain644.com
toftevenghertbet.ru
wordlease.ru
workcccbiz.in

Partly or wholly malicious IPs:
46.166.168.106
80.87.202.52
96.8.119.3
104.232.34.141
149.202.234.190
176.103.48.223
185.18.53.247
185.118.64.182

Recommended blocklist:
46.166.168.64/26 (Duomenu Centras, UA)
80.87.202.0/24 (JSC Server, RU)
96.8.119.0/27 (New Wave NetConnect, US)
104.232.34.128/27 (Net3 Inc, US)
149.202.234.188/30 (OVH / Dmitry Shestakov, BZ)
176.103.48.0/20 (PE Ivanov Vitaliy Sergeevich, UA)
185.18.53.247 (Fornex Hosting, NL)
185.118.64.176/28 (CloudSol LLC, Russia)

I've blocked traffic to 176.103.48.0/20 for two years with no ill-effects, it seems to be a particularly bad network. There may be a few legitimate sites hosted in these ranges, they would mostly be Russian.. so if you don't usually visit Russian websites then the collateral damage might be acceptable.

Malware spam: "Invoice #66626337/BA2DEB0F" leads to Teslacrypt

I have only seen one sample of this fake invoice spam, so it is possible that the invoice references and sender names are randomly generated.

From:    Jarvis Miranda
Date:    11 December 2015 at 08:25
Subject:    Invoice #66626337/BA2DEB0F

Dear Client,

Our finance department has processed your payment, unfortunately it has been declined.
Please, double check the information provided in the invoice down below and confirm your details.

Thank you for understanding.

In the sample I saw, the attached file was named SCAN_invoice_66626337.zip which contained a malicious javascript [pastebin] with a VirusTotal detection rate of 5/54. When deobfuscated it becomes a bit clearer that it is trying to download a binary from:

soft2webextrain.com/87.exe?1
46.151.52.231/87.exe?1

This behaviour can be seen in these automated reports [1] [2]. The downloaded executable has a detection rate of 6/55 and an MD5 of 56214f61a768c64e003b68bae7d67cd2. This Malwr report gives a clearer indication of what the binary is doing, attempting to pull information from:

kochstudiomaashof.de

The screenshots indicate clearly that this is ransomware, specifically Teslacrypt.

Note that the soft2webextrain.com domain is on the same server as softextrain64.com seen yesterday, so 185.118.64.182 (CloudSol LLC, Russia) can be considered to be malicious.


UPDATE
I didn't spot originally that the "soft2webextrain.com" website is multhomed with another IP address on 149.202.234.190 which is an OVH IP allocated to a customer "Dmitry Shestakov" an which forms a small block of 149.202.234.188/30 which is probably also worth blocking.

UPDATE 2
I made an error with one of the IP addresses and specified 185.118.64.183 and it should have been 185.118.64.182.

Recommended blocklist:
185.118.64.182
149.202.234.188/30
46.151.52.231
kochstudiomaashof.de

Malware spam: "Order 311286 Acknowledged" / "sales@touchstonelighting.co.uk"

This fake financial spam does not come from Touchstone Lighting but is instead a simple forgery with a malicious attachment.

From:    sales@touchstonelighting.co.uk
Date:    10 December 2015 at 12:02
Subject:    Order 311286 Acknowledged

There is no body text. Attached is a malicious Word document Order Acknowledgement.doc which appears to be exactly the same as the payload used for this spam run.

Malware spam: "STMT ACWL-15DEC12-120106" / "accounts@mamsoft.co.uk [statements@mamsoft.co.uk]"

This fake financial email does not come from MAM Software but is instead a simple forgery with a malicious attachment.

From:    accounts@mamsoft.co.uk [statements@mamsoft.co.uk]
Date:    10 December 2015 at 11:35
Subject:    STMT ACWL-15DEC12-120106

The following are attached to this email:
XACWL-15DEC12-120106.DOC

Attached is a file XACWL-15DEC12-120106.DOC which I have only seen one variant of so far, with a VirusTotal detection rate of 6/54. According to the Malwr analysis, it downloads a file from:

life.1pworks.com/76t7h/76gjk.exe

There will probably be other versions of the document with different download locations. This executable has a detection rate of 2/54 and according to this Malwr report it contacts:

136.145.86.27 (University Of Puerto Rico, Puerto Rico)

Other analysis is pending, in the meantime I recommend that you block traffic to that IP. The payload is probably the Dridex banking trojan.

MD5s:
6e8f48e7d53ac2c8f7b863078e9050b2
fbf7c8c4f90fcfdf284c3624d6baedf7

Malware spam: "Foreman&Clark Ltd" / "Last Payment Notice" leads to Teslacrypt

This fake financial spam does not come from the long-defunct Foreman & Clark, but instead it comes with a malicious attachment that leads to ransomware.

From:    Harlan Gardner
Date:    10 December 2015 at 08:48
Subject:    Reference Number #20419955, Last Payment Notice

Dear Client,

This e-mail is pursuant to your contract with Foreman&Clark Ltd. for our services date November 15, 2015 for the amount of $8,151.
Your failure to pay as per the December 1, 2015 invoice equals to the breach of our contract.

Please, acknowledge the receipt of this e-mail within three business days. Please, make your payment to the corresponding account, stated in the invoice attached no later than January 2, 2016.
In case you fail to respond to this e-mail we well be compelled to pursue all the necessary legal actions.

Thank you beforehand for your attention to this case.
Looking forward to hearing back from you.

Sincerely,
Harlan Gardner
Sales Manager

Foreman&Clark Ltd.
256 Raccoon RunSeattle,
WA 98101

In the sample I saw, the attachment was named copy_invoice_20419955.zip which contained this malicious obfuscated script which has a VirusTotal detection rate of 2/55. When deobfuscated it becomes a bit clearer as to what it does, with an attempted download from:

46.151.52.196/86.exe?1
softextrain64.com/86.exe?1

This pattern is the same as the spam run yesterday. The downloaded binary has an MD5 of 42b27f4afd1cca0f5dd2130d3829a6bc, a detection rate of 5/55 and the Malwr report indicates that it pulls data from the following domains:

graysonacademy.com
grassitup.com
grupograndes.com
crown.essaudio.pl
garrityasphalt.com
gjesdalbrass.no

The characteristics of this malware indicate the Teslacrypt ransomware.

Recommended blocklist:
46.151.52.196
softextrain64.com
gjesdalbrass.no
graysonacademy.com
grassitup.com
grupograndes.com
crown.essaudio.pl
garrityasphalt.com

Fake "Fretter Inc" spam leads to Teslacrypt ransomware

This email claims to be from the long-dead retailer Fretter Inc, but it is not. Instead it comes with a malicious attachment leading to the Teslacrypt ransomware.

From:    Tonia Graves [GravesTonia8279@ikom.rs]
Date:    9 December 2015 at 14:50
Subject:    Your order #11004118 - Corresponding Invoice #B478192D

Dear Valued Customer,

We are pleased to inform you that your order #11004118 has been processed and ready to be dispatched. However, according to our records, above mentioned invoice is still unpaid.
We would highly appreciate if you sent your payment promptly. For your information, don't hesitate to check the invoice enclosed to this letter or contact us directly.
In case if you have already sent your payment, please disregards this letter and kindly allow us up to 3 business days to clear the incoming payment.

We look forward to your remittance and will the dispatch the goods.

Thank you for choosing our services we sincerely hope to continue doing business with you again.

Sincerely,
Tonia Graves

Sales Department Manager
Fretter Inc.
2715 Sycamore Road
Nyssa, OR 97913

There sender's name and the reference numbers change in each version. Attached is a file copy_invoice_11004118.zip which in turn contains a malicious script [VT 5/54] which in the sample I investigated was named invoice_iU9A2Y.js. When deofuscated it looks like this.

The Malwr report for that script shows it downloading from:

softextrain64.com/86.exe?1

The script itself shows an alternate location of:

46.151.52.197/86.exe?1

This has a VirusTotal detection rate of 3/55. A Malwr report on just the executable plus this Hybrid Analysis report shows it connecting to:

gjesdalbrass.no

It also tries to identify the IP address of the host by connecting to http://myexternalip.com/raw which is a benign service that you might consider to be a good indicator of compromise.

You can see in the screenshots of that Malwr report that this is ransomware, specifically Teslacrypt.

Recommended blocklist:
gjesdalbrass.no
softextrain64.com
46.151.52.197

Malware spam: "EXB (UK) Ltd Invoice" / "Sales [sales@exbuk.co.uk]"

This fake financial spam does not come from EXB (UK) Ltd but is instead a simple forgery with a malicious attachment.

From:    Sales [sales@exbuk.co.uk]
Date:    8 December 2015 at 12:03
Subject:    EXB (UK) Ltd Invoice

Dear Sirs,

Please find attached our invoice, Thank you for your order

Best Wishes

EXB (UK) Ltd

Attached is a Word document named Invoice 1195288 from EXB (UK) Limited.doc which comes in at least three different versions (VirusTotal results [1] [2] [3]) and which contain a complex macro [pastebin] that fails to run in automated analysis tools [4] [5] [6] [7] [8] [9].

The payload (if it works) is likely to be the Dridex banking trojan.

UPDATE
According to the comments on this post plus some other sources, the macros in these documents download from:

cabezasdealambre.eu/76re459/98uy76t.exe
mfmanastacio.com/76re459/98uy76t.exe
216.119.110.104/76re459/98uy76t.exe

That payload is identical to the one found in this earlier spam run.

Malware spam: "Updated Statement - 2323191" / "David Lawale [David.Lawale@buildbase.co.uk]"

This fake financial spam does not come from Buildbase but is instead a simple forgery with a malicious attachment.

From:    David Lawale [David.Lawale@buildbase.co.uk]
Date:    8 December 2015 at 10:58
Subject:    Updated Statement - 2323191

Hi,

Please find attached copy updated statement as your account has 3 overdue incoices. Is there any reasons why they haven’t yet been paid?

Kind Regards

David

David Lawale | Credit Controller | Buildbase

Harvey Road, Basildon, Essex, SS13 1QJ

tel: +44(0)1268 590718 | fax: +44(0)1268 590077 

www.buildbase.co.uk

Attached is a file 151124142451_0001.xls which I have seen come in two versions so far (VirusTotal results [1] [2]). Analysis of this malware is pending, but it most likely leads to the Dridex banking trojan.

UPDATE 1
Automated analysis is inconclusive [1] [2] [3] [4] [5] [6]. It is possible that there is an error in the macro.

UPDATE 2
According to the comments in this post and also some other sources, the the macros download from:

gulteknoofis.com/76re459/98uy76t.exe
kinderdeszorns.de/76re459/98uy76t.exe
agencjareklamowalodz.com/76re459/98uy76t.exe

This has a detection rate of 4/55. According to these reports [1] [2] [3] and other sources, the malware phones home to:

216.189.52.147 (High Speed Web/Genesis 2 Networks, US)
23.113.113.105 (AT&T, US)
221.132.35.56 (Ho Chi Minh City Post and Telecom Company, Vietnam)
78.47.66.169 (Hetzner, Germany)

MD5s:
0316dbd20fbfd5a098cd8af384ca950f
1b4283c8531653a5156911be1e6535
5a2140f864d98949d44945500a7d18
6ce6e2b915688f2b474e65813dc361

Recommended blocklist:
216.189.52.147
23.113.113.105
221.132.35.56
78.47.66.169