Malware spam: "Invoice FEB-23456789" from "Accounting Specialist"

This fake financial spam comes from random senders, the attachment is malicious and drops the Locky ransomware:

From:    Kenya Becker
Date:    19 February 2016 at 11:59
Subject:    Invoice FEB-92031923


Good morning,

Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice.
If you have any questions please let us know.

Thank you!

Kenya Becker
Accounting Specialist

==================

From:    Toni Jacobson
Date:    19 February 2016 at 12:10
Subject:    Invoice FEB-63396033


Good morning,

Please see the attached invoice and remit payment according to the terms listed at the bottom of the invoice.
If you have any questions please let us know.

Thank you!

Toni Jacobson
Accounting Specialist 

Attached is a file with a semirandom name similar to invoice_feb-92031923.doc (Sample VirusTotal report) which contains XML that looks like this [pastebin]. Malwr analysis of these samples [1] [2] shows it downloading a malicious executable from:

ratgeber-beziehung.de/5/5.exe
www.proteusnet.it/6/6.exe

If recent patterns are followed, there will be several different download locations with different versions of the file at each. I will let you know if I get these locations. The binaries has a detection rate of 7/55 and 6/54 and these Malwr reports [1] [2] [3] indicate that it phones home to:

85.25.138.187 (PlusServer AG, Germany)
31.41.47.3 (Relink Ltd, Russia)

Other samples are being analysed, but in the meantime I recommend that you block traffic to:

85.25.138.187
31.41.47.3

UPDATE 1

Some additional download locations from these Malwr reports [1] [2] [3]:

ecoledecorroy.be/1/1.exe
animar.net.pl/3/3.exe
luigicalabrese.it/7/7.exe

..stil working on those other locations!

UPDATE 2

Two other locations are revealed in these Malwr reports [1] [2]:

http://lasmak.pl/2/2.exe
http://suicast.de/4/4.exe

Malware spam: "Rechnung Nr. 2016_131" / fueldner1A0@lfw-ludwigslust.de

This German language spam does not comes from LFW Ludwigsluster but is instead a simple forgery with a malicious attachment. The sender's email address is somewhat randomised, as is the name of the attachment.

From:    fueldner1A0@lfw-ludwigslust.de
Date:    19 February 2016 at 09:10
Subject:    Rechnung Nr. 2016_131

Sehr geehrte Damen und Herren,

bitte korrigieren Sie auch bei der Rechnung im Anhang den Adressaten:

LFW Ludwigsluster Fleisch- und Wurstspezialitäten

GmbH & Co.KG

Vielen Dank!

Mit freundlichen Grüßen

Anke Füldner

Finanzbuchhaltung

Tel.: 03874-422038

Fax: 03874-4220844

E-Mail: fueldner@lfw-ludwigslust.de 

LFW Ludwigsluster Fleisch- und Wurstspezialitäten

GmbH & Co.KG, Bauernallee 9, 19288 Ludwigslust

HRA 1715, Amtsgericht Schwerin

Geschäftsführer: U.Müller, U.Warncke

USt.-IdNr. DE202820580, St.Nr. 08715803209

Diese E-Mail kann vertrauliche und/oder rechtlich geschützte Informationen enthalten. Wenn Sie nicht der richtige Adressant sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten diese E-Mail und alle Anhänge und Ausdrucke unverzüglich.

Das Gebrauchen, Publizieren, Kopieren oder Ausdrucken sowie die unbefugte Weitergabe des Inhalts dieser E-Mail ist nicht erlaubt.

This e-mail and any attached files may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

Attached is a file with a format similar to RG460634280127-SIG.zip which contains a malicious javascript in the format RG6459762168-SIG.js or similar. At the moment, I have seen two samples, both with zero detection rates at VirusTotal [1] [2]. Malwr analysis of one of the samples shows that a binary is downloaded from:

mondero.ru/system/logs/56y4g45gh45h

Other samples probably have different download locations. This executable has a detection rate of 7/53 and it appears to drop another executable with a relatively high detection rate of 26/55. Both the VirusTotal and Malwr reports indicate that this is the Locky ransomware from the people who usually push Dridex.

The malware phones home to:

46.4.239.76 (Dmitry Melnik, Ukraine / Myidealhost.com aka Hetzner, Germany)

But in fact the entire 46.4.239.64/27 range looks pretty bad and I recommend that you block it.

Incidentally, full credit to the company involved in putting this massive banner on their website warning people about the fake email..

UPDATE

An additional analysis from a trusted source (thank you). Download locations are:

mondero.ru/system/logs/56y4g45gh45h
tcpos.com.vn/system/logs/56y4g45gh45h
www.bag-online.com/system/logs/56y4g45gh45h

The malware phones home to:

46.4.239.76/main.php
94.242.57.45/main.php
wblejsfob.pw/main.php
kqlxtqptsmys.in/main.php
cgavqeodnop.it/main.php
pvwinlrmwvccuo.eu/main.php
dltvwp.it/main.php
uxvvm.us/main.php

The active C2s (some may be sinkholes) appear to be:

46.4.239.76 (Dmitry Melnik, Ukraine / Myidealhost.com aka Hetzner, Germany)
94.242.57.45 (vstoike.com / Fishnet Communications, Russia)
185.46.11.239 (Agava Ltd, Russia)
69.195.129.70 (Joes Datacenter, US)

Analysis those C2 locations give a recommended blocklist of:
46.4.239.64/27
94.242.57.45
185.46.11.239
69.195.129.70

Fake job: resume@gbjobsite.com

This fake job offer looks like it might be from the creators of the Dridex banking trojan. It comes with various subjects:

Cooperation with the great company
We offer new vacancy
employees needed
cooperation with an international company
hi!
The crisis has finished! Work with us!
beneficial offer
Wanted regional manageres
Hello!
partial occupation
Working with partial occupancy
beneficial proposition
The part-time employment

The body text is always very similar:

Hello!

We are looking for employees working remotely.

My name is yvon, am the personnel manager of a large UK company.
Most of the work you can do from home, that is, at a distance.
Salary is 1000£ - 4000£.

If you are interested in our offer, mail to us your answer on resume@gbjobsite.com and we will send you an extensive information as soon as possible.
Best regards!
Personal Staff 

The spam appears to originate from within the sender's own domain, but this is just a simple forgery. Emails sent to the domain gbjobsite.com are sent to an innocuous-looking but nonetheless evil IP of 172.246.47.65 (Enzu Inc, US). Nameservers are using the domain abcdns.biz. Domain registration details are either fake or anonymous.

The nature of the job is illegal, and will most likely involve money laundering, handling stolen goods or other fraudulent activities. Avoid at all costs.

Fake job: "Personal Assitant and Administrative officer needed." / Walter.Smith [sales@ema.su]

This job offer is a fake, and is actually intended to recruit people for criminal activities such as money laundering or receiving stolen goods.

From:    Walter.Smith [sales@ema.su]
Reply-To:    waltersmith7@ig.com.br
Date:    17 February 2016 at 23:54
Subject:    Re: Personal Assitant and Administrative officer needed.

Hello,

I'm looking for someone who can handle my business & personal errands at his/her spare time as I keep traveling a lot. Someone who can offer me these

services mentioned below:

* Mail services (Receive my mails and drop them off at UPS or USPS)
* Shop for Gifts
* Bill payment (pay my bills on my behalf, access to the funds would be provided by me)
* Sit for delivery (at your home) or pick items up at nearby post office at your convenience.

Let me know if you will be able to offer me any or all of these services and 10% of my income weekly would be your weekly payment. If you will be available for this job position ,send me a confirmation e-mail and send me your details like complete name/address/country/state/ city/zip/phone or you could even attach your resume.I do have a pile up of work and a number of unattended duties which you can assist me with soon.

Please note that this job DOES NOT require any financial obligation of any sort from you as I would be catering for all expenses.

I look forward to hearing from you.

Sincerely,

Mr.Walter.Smith.

It appears to come from the domain ema.su (".su" is the old domain for the Soviet Union, still around today) but in face the Reply-To address is waltersmith7@ig.com.br. The email was routed through an insecure server at 50.47.43.21 (mail.plantsmartsales.com) and apparently originated from 71.2.1.212 (apparently in Warren, Ohio).

Despite appearing to be a "no risk" proposition with a 10% payoff, all the money being handled is actually stolen, and the person handling it will be liable for 100% of the loss and could face legal action. Any goods handled and reshipped will be stolen, and any correspondence sent and received will be fraudulent. Avoid this at all costs.

Malware spam: "Payment" / Laurence Cottle [lcottle60@gmail.com]

This very widespread spam run comes with a malicious attachment which drops the Locky ransomware. Note that the email address has a random number appeneded to it

From:    Laurence Cottle [lcottle60@gmail.com]
Date:    18 February 2016 at 13:35
Subject:    Payment

Hi

Any chance of getting this invoice paid, please?

Many thanks

Laurence

Attached is a file unnamed document.docm which comes in several different versions.

Third-party analysis (thank you!) reveals that there are download locations at:

acilkiyafetgulertekstil.com/system/logs/7647gd7b43f43.exe
alkofuror.com/system/engine/7647gd7b43f43.exe
merichome.com/system/logs/7647gd7b43f43.exe
organichorsesupplements.co.uk/system/logs/7647gd7b43f43.exe
shop.zoomyoo.com/image/templates/7647gd7b43f43.exe
tutikutyu.hu/system/logs/7647gd7b43f43.exe
vipkalyan.com.ua/system/logs/7647gd7b43f43.exe

This dropped a malicious binary with a detection rate of 3/55, since updated to one with a detection rate of 4/55.

MD5s:
a40d4d655cd638e7d52f7a6cdedc5a8e  
9f622033cfe7234645c3c2d922ed5279

The malware phones home to:

195.154.241.208/main.php
46.4.239.76/main.php
94.242.57.45/main.php
kqlxtqptsmys.in/main.php
cgavqeodnop.it/main.php
pvwinlrmwvccuo.eu/main.php
dltvwp.it/main.php
uxvvm.us/main.php
wblejsfob.pw/main.php

Out of those, the most supect IPs are:

195.154.241.208 (Iliad / Online S.A.S., FR)
46.4.239.76 (myidealhost.com / Hetzner, DE)
94.242.57.45 (Vstoike.com / Fishnet Communications, RU)
69.195.129.70 (Joes Datacenter LLC, US)

Recommended blocklist:
195.154.241.208
46.4.239.76
94.242.57.45
69.195.129.70

Malware spam: Copy of Invoice 20161802-12345678 leads to Locky ransomware

This fake financial spam spoofs different senders and different companies, with a different reference number in each.

From:    Devon Vincent
Date:    18 February 2016 at 08:14
Subject:    Copy of Invoice 20161802-99813731

Dear [redacted],

Please find attached Invoice 20161802-99813731 for your attention.

For Pricing or other general enquiries please contact your local Sales Team.

Yours Faithfully,

Devon Vincent
Tenet Healthcare Corporation    www.tenethealth.com

=================

From:    Elvia Saunders
Date:    18 February 2016 at 09:19
Subject:    Copy of Invoice 20161802-48538491

Dear [redacted],

Please find attached Invoice 20161802-48538491 for your attention.

For Pricing or other general enquiries please contact your local Sales Team.

Yours Faithfully,

Elvia Saunders
The PNC Financial Services Group, Inc.  www.pnc.com

I have seen two variants of the document (VirusTotal [1] [2]). Analysis of the documents is pending, however it is likely to be the Dridex banking trojan.

UPDATE 1

There is a second variant of the spam with essentially the same (undefined) payload:

From:    Heather Ewing
Date:    18 February 2016 at 08:41
Subject:    Invoice

Dear Sir/Madam,

I trust this email finds you well,

Please see attached file regarding clients recent bill. Should you need further assistances lease feel free to email us.

Best Regards,

Heather Ewing
The Bank of New York Mellon Corporation www.bnymellon.com

In this case the attachment was named Invoice51633050.doc - automated analysis is inconclusive. An examination of the XML attachment [pastebin] indicates that it may be malformed.

UPDATE 2

A contact (thank you) analysed one of the samples and found that the document downloaded an executable from:

killerjeff.free.fr/2/2.exe

According to this Malwr report this is the Locky ransomware, and it phones home to:

95.181.171.58 (QWARTA LLC, Russia)
69.195.129.70 (Joes Data Center, US)

I suspect that the second one may be a sinkhole, but there should be no ill effects from blocking it.


UPDATE 3

A couple more samples have come to light [1] [2] one of which shows a new phone home location of:

185.14.30.97 (ITL Serverius, NL)

UPDATE 4

From user Ralf9000 at VirusTotal here are some more download locations:

onigirigohan.web.fc2.com/1/1.exe
killerjeff.free.fr/2/2.exe
uponor.otistores.com/3/3.exe
premium34.tmweb.ru/4/4.exe
bebikiask.bc00.info/5/5.exe
avp-mech.ru/7/7.exe

6.exe seems to be missing. Analysis of these is pending.

UPDATE 5

According to these Malwr reports on all the available samples [1] [2] [3] [4] [5] [6] the various versions of Locky seem to call back to:


95.181.171.58 (QWARTA LLC, Russia)
31.41.47.37 (Relink Ltd, Russia)
185.14.30.97 (ITL, Ukraine / Serverius, Netherlands)
69.195.129.70 (Joes Datacenter, US)

I have omitted what appear to be obvious sinkholes.

Recommended blocklist:
95.181.171.58
31.41.47.37
185.14.30.97
69.195.129.70

Malware spam: tracking documents / cmsharpscan@gmail.com

This fake document scan spam has a malicious attachment:

From:    cmsharpscan3589@gmail.com
Date:    17 February 2016 at 14:32
Subject:    tracking documents

Reply to: cmsharpscan@gmail.com [cmsharpscan@gmail.com]
Device Name: Not Set
Device Model: MX-2640N
Location: Not Set

File Format: DOC (Medium)
Resolution: 200dpi x 200dpi

Attached file is scanned image in DOC format.

I have only seen a single sample of this with an attachment cmsharpscan@gmail.com_20160217_132046.docm which has a VirusTotal detection rate of 7/54. According the the Malwr analysis of the document, the payload is the Locky ransomware and is identical to the earlier attach described here.

Malware spam: "Rechnung 2016-11365" / mpsmobile GmbH [info@mpsmobile.de]

This bilingual spam does not come from mpsmobile but is instead a simple forgery with a malicious attachment.

From:    mpsmobile GmbH [info@mpsmobile.de]
Date:    17 February 2016 at 12:23
Subject:    Rechnung 2016-11365

Sehr geehrte Damen und Herren,

anbei erhalten Sie das Dokument 'Rechnung 2016-11365' im DOC-Format. Um es betrachten und ausdrucken zu können, ist der DOC Reader erforderlich. Diesen können Sie sich kostenlos in der aktuellen Version aus dem Internet installieren.

Mit freundlichen Grüssen
mpsmobile Team

______________________________

_____

Dear Ladies and Gentlemen,

please find attached document ''Rechnung 2016-11365' im DOC-Format. To view and print these forms, you need the DOC Reader, which can be downloaded on the Internet free of charge.

Best regards
mpsmobile GmbH

mpsmobile GmbH
Brühlstrasse 42
88416 Ochsenhausen
Tel: +49 7352 923 23 0
Fax: +49 7352 923 23-29
Email: info@mpsmobile.de

Handelsregister Amstgericht ULM HRB 727290
Sitz der Gesellschaft: Ochsenhausen
UStIDNr: DE 281079008

Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet.

In the sample I saw, the attachment was named 19875_Rechnung_2016-11365_20160215.docm and has a VirusTotal detection rate of 5/54.

According to this Malwr report  the binary attempts to download the Locky ransomware (seemingly a product of those behind the Dridex banking trojan). It attempts to download a binary from:

feestineendoos.nl/system/logs/7623dh3f.exe?.7055475

This dropped file has a detection rate of 3/53.  Analysis of the file is pending, but overall this has been made more complicated because the Locky installer calls out to a number of domains, many of which actually appear to have been sinkholed.

Machines infected with Locky will display a message similar to this:

Unfortunately, the only known way to recover from this is to restore files from offline backup once the infection has been removed from the PC.

UPDATE

Another version plopped into my inbox, VT 7/54  and according to this Malwr report, it downloads from:

nadeenk.sa/system/logs/7623dh3f.exe?.7055475

This variant POSTs to a server at:

46.4.239.76 (Myidealhost.com  / Hetzner, Germany)

It is likely that the C2 server (identified in the previous report) is:

85.25.149.246 (PlusServer AG, Germany)

Recommended blocklist:
85.25.149.246
46.4.239.76

Malware spam: Fwd:Accumsan Neque LLC Updated Invoice / Please turn on the Edit mode and Macroses!

This malware spam may come from several different companies, but I have only a single sample. It is notable for the mis-spelling of "Macros" as "Macroses" in the document.

From:    Fletcher Oliver [angel@jiahuan.com.tw]
Date:    17 February 2016 at 06:23
Subject:    Fwd:Accumsan Neque LLC Updated Invoice

Good morning

Please check the bill in attachment. In order to avoid fine  you have to pay in 12 hours.

Best regards

Fletcher Oliver
Accumsan Neque LLC

Attached is a document Q7FX9ZH.doc with the distinctive text Attention! To view this document, please turn on the Edit mode and Macroses!

Needless to say, enabling Edit mode and Macroses is a Very Bad Idea. The VirusTotal detection rate for this file is just 2/54. Hybrid Analysis [1] [2] shows that the macro first downloads from:

www.design-i-do.com/mgs.jpg?OOUxs4smZLQtUBK=54

This looks to be an unremarkable JPEG file..

(Note that I have munged the JPEG slightly to stop virus scanners triggering). As far as I can tell, the JPEG actually contains data that is decrypted by the macro (a technique called steganography). A malicious VBS is created [pastebin] and a malicious EXE file is dropped with a VirusTotal result of 7/54.

Automated analysis of the dropped binary [1] [2] shows that it phones home to:

216.59.16.25 (Immedion LLC, US / VirtuaServer Informica Ltda, Brazil)

I strongly recommend that you block traffic to that IP. Payload is uncertain, but possibly the Dridex banking trojan.

Malware spam: ATTN: Invoice J-06593788 from random companies

This fake financial spam does not come from Apache Corporation but instead is a simple forgery with a malicious attachment.

From:    June Rojas [RojasJune95@myfairpoint.net]
Date:    16 February 2016 at 09:34
Subject:    ATTN: Invoice J-06593788

Dear nhardy,

Please see the attached invoice (Microsoft Word Document) and remit payment according to the terms listed at the bottom of the invoice.

Let us know if you have any questions.

We greatly appreciate your business!

June Rojas
Apache Corporation      www.apachecorp.com

Other versions of this spam may come from other corporations. In the single sample I have seen there is an attached file invoice_J-06593788.doc which has a VirusTotal detection rate of 5/54. Analysis is pending, however this is likely to be the Dridex banking trojan.

UPDATE 1

This Dridex run exhibits a change in behaviour from previous ones. I acquired three samples of the spam run and ran the Hybrid Analysis report on them [1] [2] [3] and it shows that the macro dowloads from one of the following locations:

www.southlife.church/34gf5y/r34f3345g.exe
www.iglobali.com/34gf5y/r34f3345g.exe
www.jesusdenazaret.com.ve/34gf5y/r34f3345g.exe

Curiously, the binary downloaded from each location is different, with the following MD5s:

CBE75061EB46ADABC434EAD22F85B36E
B06D9DD17C69ED2AE75D9E40B2631B42
FB6CA1CD232151D667F6CD2484FEE8C8

Each one phones home to a different location, the ones I have identified are:

109.234.38.35 (McHost.ru, Russia)
86.104.134.144 (One Telecom SRL, Moldova)
195.64.154.14 (Ukrainian Internet Names Center, Ukraine)

There may be other samples with other behaviour.

UPDATE 2

It is possible that this is dropping ransomware, not Dridex. One other download location identified here:

www.villaggio.airwave.at/34gf5y/r34f3345g.exe

This one has an MD5 of:

1FD40A253BAB50AED41C285E982FCA9C

Detection rate is 5/53 but I do not yet know where this phones home to.

UPDATE 3

That last sample phones home to:

91.195.12.185 (PE Astakhov Pavel Viktorovich, Ukraine)

according to this Hybrid Analysis.

Recommended blocklist:
109.234.38.0/24
86.104.134.128/25
195.64.154.14
91.195.12.185 

UPDATE 4

It appears that this is dropping some ransomware called "Locky" apparently by the makers of Dridex, according to this.

Malware spam: "receipt" / "Accounts" [accounts@aacarpetsandfurniture.co.uk]

This fake financial spam does not come from AA Carpets and Furniture, but is instead a simple forgery with a malicious attachment:

From     "Accounts" [accounts@aacarpetsandfurniture.co.uk]
Date     Tue, 16 Feb 2016 02:15:52 -0700
Subject     receipt

Please find attached receipt

Kind Regards

Christine

Accounts

12-14 Leagrave Road
Luton
Beds
LU4 8HZ

T: 01582488449
F: 01582400866
W:www.aacfdirect.co.uk
E: accounts@aacarpetsandfurniture.co.uk

Attached is a file CCE06102015_00000.docm of which I have only seen a single sample, with a detection rate of 5/54. Analysis is pending, however this would appear to be the Dridex banking trojan.

Malware spam: fmis@oldham.gov.uk / Remittance Advice : Tue, 16 Feb 2016 14:18:52 +0530

This spam does not come from Oldham Council but is is instead a simple forgery with a malicious attachment. The timestamp in the subject line varies, probably generated by the infected computer sending the spam.

From:    fmis@oldham.gov.uk
Date:    16 February 2016 at 08:48
Subject:    Remittance Advice : Tue, 16 Feb 2016 14:18:52 +0530


**********************************************************************
Confidentiality: This email and its contents and any attachments are intended
only for the above named. As the email may contain confidential or legally privileged information,
if you are not, or suspect that you are not, the above named or the person responsible
for delivery of the message to the above named, please delete or destroy the
email and any attachments immediately.”

Security and Viruses: This note confirms that this email message has been
swept for the presence of computer viruses. However, we advise that in keeping
with good management practice, the recipient should ensure that the email together
with any attachments are virus free by running a virus scan themselves.
We cannot accept any responsibility for any damage or loss caused by software viruses.

Monitoring: The Council undertakes monitoring of both incoming and outgoing emails.
You should therefore be aware that if you send an email to a person within the Council
it may be subject to any monitoring deemed necessary by the organisation from time to time.
The views of the author may not necessarily reflect those of the Council.

Access as a public body: The Council may be required to disclose this email (or any response to it)
under the Freedom of Information Act, 2000, unless the information in it is covered
by one of the exemptions in the Act.

Legal documents: The Council does not accept service of legal documents by email.
**********************************************************************

I have only seen a single copy of this spam, with an attachment 201602_4_2218.docm which has a VirusTotal detection rate of 5/54. Analysis is pending, but the payload is likely to be the Dridex banking trojan.

UPDATE

This spam is related to this one.  Automated analysis of the samples [1] [2] [3] [4] plus some private sources indicate download locations for this and other related campaigns today at:

labelleflowers.co.uk/09u8h76f/65fg67n
lepeigneur.power-heberg.com/09u8h76f/65fg67n
yurtdisiegitim.tv/09u8h76f/65fg67n
hg9.free.fr/09u8h76f/65fg67n
jtonimages.perso.sfr.fr/09u8h76f/65fg67n
test.blago.md/09u8h76f/65fg67n

This file has a detection rate of 3/54. According to those reports, it phones home to:

151.248.117.140 (Reg.ru, Russia)
87.229.86.20 (Znet Telekom, Hungary)
50.56.184.194 (Rackspace, US)

Recommended blocklist:
151.248.117.140
87.229.86.20
50.56.184.194

Malware spam: Overdue Invoice 012345 - COMPANY NAME

This malicious spam appears to come from many different senders and companies. It has a malicious attachment:

From:    Brandi Riley [BrandiRiley21849@horrod.com]
Date:    15 February 2016 at 12:20
Subject:    Overdue Invoice 089737 - COMS PLC

Dear Customer,

The payment is overdue. Your invoice appears below. Please remit payment at your earliest convenience.

Thank you for your business - we appreciate it very much.

Sincerely,

Brandi Riley

COMS PLC

Attached is a file in the format INVOICE-UK865916 2015 NOV.doc which comes in several different versions (VirusTotal results [1] [2] [3]). The Hybrid Analysis shows an attempted download from:

node1.beckerdrapkin.com/fiscal/auditreport.php

This is hosted on an IP that you can assume to be malicious:

193.32.68.40 (Veraton Projects, BZ / DE)

The dropped executable (detection rate 4/54) then phones home to:

194.58.92.2 (Reg.Ru Hosting, Russia)
202.158.123.130 (Cyberindo Aditama, Indonesia)
185.24.92.229 (System Projects LLC, Russia)

The payload is the Dridex banking trojan.

Recommended blocklist:
193.32.68.40
194.58.92.2
202.158.123.130
185.24.92.229

Malware spam: "Invoice (w/e 070216)" / Kelly Pegg [kpegg@responserecruitment.co.uk]

This fake financial spam does not come from Response Recruitment but is instead a simple forgery with a malicious attachment:

From     Kelly Pegg [kpegg@responserecruitment.co.uk]
Date     Mon, 15 Feb 2016 13:15:37 +0200
Subject     Invoice (w/e 070216)

Good Afternoon

Please find attached invoice and timesheet.

Kind Regards

Kelly

Attached is a file SKM_C3350160212101601.docm which comes in several different variants. The macro in the document attempts to download a malicious executable from:

216.158.82.149/09u8h76f/65fg67n
sstv.go.ro/09u8h76f/65fg67n
www.profildigital.de/09u8h76f/65fg67n

This dropped a malicious executable with a detection rate of 6/54 which according to these automated analysis tools [1] [2] calls home to:

5.45.180.46 (B & K Verwaltungs GmbH, Germany)

I strongly recommend that you block traffic to that address. The payload is the Dridex banking trojan.

Malware spam: "Your latest invoice from The Fuelcard Company UK Ltd" / customerservice@fuelcards.co.uk

This fake financial spam does not come from The Fuelcard Company UK Ltd but is instead a simple forgery with a malicious attachment. For some reason, fake fuel card spam is popular with the bad guys.

From:    customerservice@fuelcards.co.uk
Date:    12 February 2016 at 10:44
Subject:    Your latest invoice from The Fuelcard Company UK Ltd


Please find your latest invoice attached.

If you have any queries please do not hesitate to contact our Customer Service Team at customerservice@fuelcards.co.uk

Regards

The Fuelcard Compa

The Fuelcard Company UK Ltd
St James Business Park   Grimbald Crag Court   Knaresborough   HG5 8QB
Tel 0845 456 1400   Fax 0845 279 9877
http://www.thefuelcardcompany.co.uk

Please consider the environment before printing this email.
________________________________________
This email and any files transmitted with it are confidential, maybe legally privileged, and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the system administrator and then kindly delete the message. If you are not the intended recipient, any disclosure, copying, distribution or any other action taken is prohibited, and may be unlawful. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.  Please note that once signed,  The Fuelcard Company terms & conditions take precedence over all prior communications by any employee or agent of The Fuelcard Company. Once a client signs The Fuelcard Company terms & conditions, this will form the full extent of The Fuelcard Company’s agreed contract with the client.

E-mails may be corrupted, intercepted or amended and so we do not accept any liability for the contents received. We accept no responsibility for any loss caused by viruses. You should scan attachments (if any) for viruses.

Head Office: The Fuelcard Company UK Ltd, St James Business Park, Grimbald Crag Court, Knaresborough HG5 8QB

Registered number: 5939102

I have only seen a single sample with an attachment named invoice.xls with a detection rate of 5/54. Analysis is pending, but the payload is likely to be the Dridex banking trojan.

UPDATE

This Hybrid Analysis shows that this particular sample downloads from:

legismar.com/09u8h76f/65fg67n

This is the same executable as found in this earlier spam run.

Malware spam: "DVSA RECEIPT" / FPO.CC.15@vosa.gsi.gov.uk

This spam email does not come from a UK government agency, but is instead a simple forgery with a malcious attachment. Note that the sender's email address seems to vary slightly, but all are spoofed to come from vosa.gsi.gov.uk.

From     FPO.CC.15@vosa.gsi.gov.uk
Date     Fri, 12 Feb 2016 12:47:20 +0300
Subject     DVSA RECEIPT

Good afternoon

Please find attached your receipt, sent as requested.

Kind regards

(See attached file)

Fixed Penalty Office
Driver and Vehicle Standards Agency | The Ellipse, Padley Road, Swansea,
SA1 8AN
Phone: 0300 123 9000



Find out more about government services at www.gov.uk/dvsa

**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed.  Any views or opinions presented may be those of the
originator and do not necessarily represent those of DVSA.

If you were not the intended recipient, you have received this email and
any attached files in error; in which case any storage, use,
dissemination, forwarding, printing, or copying of this email or its
attachments is strictly prohibited.  If you have received this
communication in error please destroy all copies and notify the sender
[and postmaster@dvsa.gsi.gov.uk ] by return email.

DVSA's computer systems may be monitored and communications carried on
them recorded, to secure the effective operation of the system and for
other lawful purposes.

Nothing in this email amounts to a contractual or other legal commitment
on the part of DVSA unless confirmed by a communication signed on behalf
of the Secretary of State.

It should be noted that although DVSA makes every effort to ensure that
all emails and attachments sent by it are checked for known viruses
before transmission, it does not warrant that they are free from viruses
or other defects and accepts no liability for any losses resulting from
infected email transmission.

Visit www.gov.uk/dvsa  for information about the Driver Vehicle and Standards Agency.
*********************************************************************


The original of this email was scanned for viruses by the Government Secure Intranet
virus scanning service supplied by Vodafone in partnership with Symantec. (CCTM Certificate
Number 2009/09/0052.) This email has been certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded
for legal purposes.

Attached is a file Fixed Penalty Receipt.docm which comes in at least ten different variants with the following MD5s:



1cb27d23f9999d9d196a5d20c28fbd4e
68225ddcb35694eff28a2300e8d60399
a99d6c25218add7ece55b2503666b664
57ab4224e7d2274d341020767a6609fd
51f5960ae726906a50b5db4e9253c3c2
7a43a911e0ad208adf4e492345349269
4aae160341b6d96adc2c911ddc941222
f34460da1e77ae4a3b178532800300a2
58a01b254b9d7b90d1d0f80c14f5a089
50e1c94e43f05f593babddb488f1a2f9

I captured two samples with detection rate of about 3/54 [1] [2] and the Malwr reports for those [3] [4] indicate the macro in the document downloads a malicious executable from:

raysoft.de/09u8h76f/65fg67n
xenianet.org/09u8h76f/65fg67n
steinleitner-online.net/09u8h76f/65fg67n [reported here]

This dropped file has a detection rate of 5/54 (MD5 7bf7df5e630242182fa95adff4963921). This Hybrid Analysis report indicates subsequent traffic to:

192.100.170.19 (Universidad Tecnologica de la Mixteca, Mexico)
87.229.86.20 (ZNET Telekom Zrt, Hungary)
84.38.67.231 (ispOne business GmbH, Germany)

The payload is the Dridex banking trojan.

Recommended blocklist:
192.100.170.19
87.229.86.20
84.38.67.231

Malware spam: "Your Sage Pay Invoice INV00318132" / Sagepay EU [accounts@sagepay.com]

This spam does not come from Sage Pay but is instead a simple forgery with a malicious attachment:

From:    Sagepay EU [accounts@sagepay.com]
Date:    11 February 2016 at 13:21
Subject:    Your Sage Pay Invoice INV00318132


Please find attached your invoice.

We are making improvements to our billing systems to help serve you better and because of that the attached invoice will look different from your previous ones.  You should have already received an email that outlined the changes, however if you have any questions please contact accounts@sagepay.com or call 0845 111 44 55.

Kind regards

Sage Pay
0845 111 44 55

Attached is a file INV00318132_V0072048_12312014.xls which appears to come in a wide variety of different versions (at least 11). The VirusTotal detection rate for a subset of these is 4/54 [1] [2] [3] [4] [5] [6]. Only a single Malwr report seemed to work, indicating the macro downloading from:

www.phraseculte.fr/09u8h76f/65fg67n

This dropped executable has a detection rate of 3/54. The Malwr report shows it phoning home to:

84.38.67.231 (ispOne business GmbH, Germany)

I strongly recommend that you block traffic to that IP. The payload is the Dridex banking trojan.

Malware spam: "Scan from KM1650" / "Please find attached your recent scan" / "scanner@victimdomain.tld"

This fake document scan leads to malware. It appears to originate from within the victim's own domain, but it is just a simple forgery.

From:    scanner@victimdomain.tld
Date:    11 February 2016 at 10:24
Subject:    Scan from KM1650

Please find attached your recent scan  

Attached is a file =SCAN7318_000.DOC which seems to come in several different varieties (sample VirusTotal results [1] [2] [3]). The Malwr reports [4] [5] [6] indicate the the macro in the document downloads a malicious executable from:

maraf0n.vv.si/09u8h76f/65fg67n
www.sum-electronics.co.jp/09u8h76f/65fg67n

The dropped executable has a detection rate of 2/54. As with this earlier spam run it phones home to:

87.229.86.20 (ZNET Telekom Zrt, Hungary)

Block traffic to that IP. The payload is the Dridex banking trojan.

Malware spam: "INT242343 Unpaid Invoice - Your Services May Be Suspended" / payments@wavenetuk.com

This spam does not come from Wavenet Group but is instead a simple forgery with a malicious attachment:

From     payments [payments@wavenetuk.com]
Date     Thu, 11 Feb 2016 15:14:59 +0530
Subject     INT242343 Unpaid Invoice - Your Services May Be Suspended

PLEASE NOTE:  THIS IS A NO REPLY EMAIL ACCOUNT

Dear Customer
        Please find attached to this email your statement
You can view the invoices listed on our e-billing site at www.netbills.co.uk
If you have any queries regarding use of the e-billing site or this statement please
call us on 08444 12 7777.


Accounts Department
Wavenet Group
Incorporating - Titan Technology, Centralcom and S1 Network Services
Tel 08444127777


This email and its attachments may be confidential and are intended solely for the
use of the individual to whom it is addressed and should be considered private and
protected by law. Any views or opinions expressed are solely those of the author
and do not necessarily represent those of Wavenet Ltd or its subsidiaries. Wavenet
Ltd Registered in England No 3919664. Registered address: Friars Gate 2, 1011 Stratford
Road, Shirley, Solihull, West Midlands, B90 4BN. If you are not the intended recipient
of this email and its attachments, you must take no action based upon them, nor must
you copy or show them to anyone. Please contact the sender if you believe you have
received this email in error. Wavenet Ltd reserves the right to monitor email communications
through its networks.

This email and its attachments may be confidential and are intended solely for the
use of the individual to whom it is addressed and should be considered private and
protected by law. Any views or opinions expressed are solely those of the author
and do not necessarily represent those of Wavenet Ltd or its subsidiaries. If you
are not the intended recipient of this email and its attachments, you must take no
action based upon them, nor must you copy or show them to anyone. Please contact
the sender if you believe you have received this email in error. Wavenet Ltd reserves
the right to monitor email communications through its networks

I have only seen a single sample of this with an attachment OutstandingStatement201602111650.js which has a VirusTotal detection rate of 0/53. The Malwr analysis shows that this script downloads an executable from:

gp-training.net/09u8h76f/65fg67n

There are probably a few other download locations. This binary has a detection rate of 2/54.  The Malwr report also indicates that it phones home to:

87.229.86.20 (ZNET Telekom Zrt, Hungary)

I strongly recommend that you block traffic to that IP. The payload is the Dridex banking trojan.

Malware spam: "New Doc 115" / "Sent from Yahoo Mail on Android"

This rather terse spam has a malicious attachment:

From:    admin [ali73_2008949@yahoo.co.uk]
Date:    10 February 2016 at 10:16
Subject:    New Doc 115

Sent from Yahoo Mail on Android

The sender's email address varies from message to message. Attached is a file New Doc 115.doc which is reportedly identical to the one found in this spam campaign.

Malware spam: Emailing: MX62EDO 10.02.2016 / documents@dmb-ltd.co.uk

This spam has a malicious attachment:

From     documents@dmb-ltd.co.uk
Date     Wed, 10 Feb 2016 11:12:41 +0200
Subject     Emailing: MX62EDO 10.02.2016

Your message is ready to be sent with the following file or link
attachments:

MX62EDO  10.02.2016 SERVICE SHEET


Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments.  Check your e-mail
security settings to determine how attachments are handled.

Attached is a malicious document named MX62EDO 10.02.2016.doc. I haven't had time to analyse these myself, but a trusted source (thank you) says that there are three different variants of documents, downloading a malicious executable from the following locations:

calflytech.com/09u8h76f/65fg67n
g-t-c.co.uk/09u8h76f/65fg67n
opoai.com/09u8h76f/65fg67n

This drops an executable with a VirusTotal detection rate of 6/55.  This malware calls back to the following IPs:

87.229.86.20 (ZNET Telekom Zrt, Hungary)
50.56.184.194 (Rackspace, US)
144.76.73.3 (Hetzner, Germany)

The payload is the Dridex banking trojan. Some chatter I have seen indicates that this has been hardened against analysis.

Recommended blocklist:
87.229.86.20
50.56.184.194
144.76.73.3
 

Malware spam: "Accounts" / [accounts_do_not_reply@aldridgesecurity.co.uk]

This rather terse spam does not come from Aldridge Security but it is instead a simple forgery with a malicious attachment. There is no subject.

From     [accounts_do_not_reply@aldridgesecurity.co.uk]
Date     Tue, 09 Feb 2016 10:31:14 +0200
Subject    

Accounts

I have only seen a single sample with an attachment document2016-02-09-103153.doc which has a VirusTotal detection rate of 5/54. Automated analysis [1] [2] shows that it downloads a malicious executable from:

promo.clickencer.com/4wde34f/4gevfdg

This has a detection rate of 5/54. Those analyses indicates that the malware phones home to:

50.56.184.194 (Rackspace, US)

I strongly recommend that you block traffic to that IP. The payload is the Dridex banking trojan.

Malware spam: "Accounts Documentation - Invoices" / CreditControl@crosswater.co.uk

This fake financial spam does not come from Crosswater Holdings, but it is instead a simple forgery with a malicious attachment:

From:    CreditControl@crosswater.co.uk
Date:    8 February 2016 at 10:34
Subject:    Accounts Documentation - Invoices

Please find attached the invoice(s) raised on your account today. If you have more than one invoice they will all be in the single attachment above.

If you have any queries please do not hesitate to contact the Credit Controller who deals with your account.
Alternatively if you do not know the name of the Credit Controller you can contact us at:

Accounts@crosswater-holdings.co.uk

or call us on 0845 873 8840

Please do not reply to this E-mail as this is a forwarding address only.

Attached is a malicious script ~13190.js which comes in at least two different variants (VirusTotal [1] [2]). According to automated analysis [3] [4] [5] [6] these scripts download from:

hydroxylapatites7.meximas.com/98876hg5/45gt454h
80.109.240.71/~l.pennings/98876hg5/45gt454h

This drops an executable with a detection rate of 3/53 which appears to phone home to:

188.40.224.73 (NoTag, Germany)

I strongly recommend that you block traffic to that IP address. The payload is likely to be the Dridex banking trojan.

Malware spam: "BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016" / "Fuel Card Services" [adminbur@fuelcardgroup.com]

This fake financial spam does not come from Fuel Card Services Ltd but is instead a simple forgery with a malicious attachment:

From     "Fuel Card Services" [adminbur@fuelcardgroup.com]
Date     Thu, 04 Feb 2016 04:29:24 -0700
Subject     BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016

Please note that this message was sent from an unmonitored mailbox which
is unable to accept replies. If you reply to this e-mail your request
will not be actioned. If you require copy invoices, copy statements,
card ordering or card stopping please e-mail
support@fuelcardservices.com quoting your account number which can be
found in the e-mail below. If your query is sales related please e-mail
info@fuelcardservices.com.


E-billing
-

From: adminbur@fuelcardservices.com

Sent: Thu, 04 Feb 2016 04:29:24 -0700
To: [redacted]
Subject: BP Fuel Card E-bill 0200442 for Account B216552 31/01/2016

Account: B216552

Please find your e-bill 0200442 for 31/01/2016 attached.

To manage you account online please click
http://eservices.fuelcardservices.com

If you would like to order more fuel cards please click
http://www.fuelcard-group.com/cardorder/bp-burnley.pdf

If you have any queries, please do not hesitate to contact us.

Regards

Cards Admin.
Fuel Card Services Ltd

T 01282 410704
F 0844 870 9837
E support@fuelcardservices.com


Supplied according to our terms and conditions. (see
http://www.fuelcardservices.com/ebill.pdf).


Please also note that if you cannot open this attachment and are using
Outlook Express
 to view your mail you should select Tools / Options / Security Tab and
deselect the
option marked "Do not allow attachments to be opened that potentially
may be a virus".
 All of our outgoing mail is fully virus scanned but we recommend this
facility is
re-enabled if you do not use virus scanning software.

I have only seen one sample with an attachment named ebill0200442.xls which contains this malicious macro [pastebin] which is different to recent Dridex macros, and is similar to one first seen yesterday. According to this Malwr report it downloads an executable from:

www.trulygreen.net/43543r34r/843tf.exe

also reported is as a download location is:

www.mraguas.com/43543r34r/843tf.exe

If you look at the details of the Malwr report, it seems that the the script does creates a LOT of files all over the place. The dropped executable has a detection rate of 4/52 and according to this Hybrid Analysis shows that it phones home to:

62.76.191.108 (Clodo-Cloud / IT-House, Russia)

This is the same IP address as seen earlier, put the payload has now changed. Blocking that IP would be wise, and I would suggest that blocking 62.76.184.0/21 is probably worth considering too.

Malware spam: "More scans" / admin@victimdomain.tld / DOC201114-201114-001.js

This terse spam appears to originate from within the victim's own organisation, but it does not. Instead it is a simple forgery with a malicious attachment:

From:    admin [admin@victimdomain.tld]
Date:    4 February 2016 at 08:17
Subject:    More scans

Attached is a file DOC201114-201114-001.js which comes in a variety of different variants. The payload appears to be the Dridex banking trojan, as seen in this earlier spam run.

Malware spam: "January balance £785" / Alison Smith [ASmith056@jtcp.co.uk]

This fake financial spam does not come from J. Thomson Colour Printers, but is instead a simple forgery with a malicious attachment:

From     Alison Smith [ASmith056@jtcp.co.uk]
Date     Thu, 04 Feb 2016 10:52:21 +0300
Subject "January balance £785"

Hi,

Thank you for your recent payment of £672.

It appears the attached January invoice has been missed off of your payment. Could
you please advise when this will be paid or if there is a query with the invoice?

Regards

Alison Smith
Assistant Accountant

  Registered in Scotland 29216
  14 Carnoustie Place
  Glasgow G5 8PB
  Tel: 0141 429 1094
  www.jtcp.co.uk

 P Save Paper - Do you really need to print this e-mail?

The poor company being spoofed has already been hit by this attack recently [1] [2]. The email address of the sender varies from message to message.

Attached is a file IN161561-201601.js which comes in at least five different versions (VirusTotal [1] [2] [3] [4] [5]). This is a highly obfuscated script that looks like this [pastebin] and automated analysis of the various scripts [6] [7] [8] [9] [10] [11] [12] [13] shows that the macro downloads from the following locations (there may be more):

ejanla.co/43543r34r/843tf.exe
cafecl.1pworks.com/43543r34r/843tf.exe

This binary has a detection rate of 2/52 and phones home to:

62.76.191.108 (Clodo-Cloud / IT-House, Russia)

Note that the whole 62.76.184.0/21 block is a haven for malware, but it does also have some legitimate Russian customers. You might want to consider blocking the entire range if your users don't need to visit Russian websites. The payload is the Dridex banking trojan, and although it is unusual to see a plain .js file spammed out like this, it is consistent with botnet 220.

Malware spam: "Attached Image" from canon@ the recipient's own domain

This spam pretends to come from the victim's own domain, but it doesn't. Instead it is a simple forgery with a malicious attachment.

From:    canon@victimdomain.tld
Date:    3 February 2016 at 12:09
Subject:    Attached Image

There is no body text. Attached is a file 1690_001.xls of which I have seen a single variant with a detection rate of 9/54. The Hybrid Analysis shows it downloading an executable from:


best-drum-set.com/43rf3dw/34frgegrg.exe

This has a detection rate of 6/51 and is the same binary as used in this other spam attack today.

Malware spam: "Invoice MOJU-0939" / Accounts [message-service@post.xero.com]

This fake financial spam comes with a malicious attachment. It does not come from Moju Ltd but is instead a simple forgery with a malicious attachment:

From:    Accounts [message-service@post.xero.com]
Date:    3 February 2016 at 09:04
Subject:    Invoice MOJU-0939

Hi,

Here's invoice MOJU-0939 for 47.52 GBP. For last weeks delivery.

The amount outstanding of 47.52 GBP is due on 25 Feb 2016.

If you have any questions, please let us know.

Thanks,
Moju Ltd

I have only seen one sample of this, with an attachment named Invoice MOJU-0939.zip containing a malicious script invoice_id4050638124.js that has detection rate of 2/53 and which according to this Malwr report downloads a binary from:

www.ni-na27.wc.shopserve.jp/43rf3dw/34frgegrg.exe

This payload is the same as seen in this concurrent spam run.