From PC World [no_reply@pcworld.co.uk]Attached is a file 102836144.doc which comes in a single version with a detection rate of 3/55. Analysis is pending, however the payload is like to be the same as with these two spam runs [1] [2].
Date Mon, 11 Jan 2016 15:30:38 +0300
Subject We are processing your PC WORLD order (PCW1521248708)
From: Raleigh Frazier [FrazierRaleigh8523@amnet.net.au]The name of the sender, references and attachment name varies. There are at least three different variations of the attachment, probably more. Detection rates are approximately 2/55 [1] [2] [3] and these Malwr reports [4] [5] [6] indicate that the behaviour is very similar to the one found in this spam run.
Date: 11 January 2016 at 11:20
Subject: Invoice-11JAN15-53771728-GB
Dear Customer,
Please find attached Invoice 53771728 for your attention.
Should you have any Invoice related queries please do not hesitate to
contact either your designated Credit Controller or the Main Credit Dept. on
02051 2651180.
For Pricing or other general enquiries please contact your local Sales Team.
Yours Faithfully,
Credit Dept'
From: Terry CherryThe sender's name, references and attachments may vary. This appears to be a spam from Dridex 120, and it is a characteristic that there is a very large number of variants of the attachments. In this case, I analysed three different attachments with detection rate of about 2/55 [1] [2] [3] and which according to these Malwr reports [4] [5] [6], downloads a binary from the following locations:
Date: 11 January 2016 at 10:48
Subject: Kaseya Invoice - 1ED0C068
Dear Accounts Payable,
Thank you for your purchase of Kaseya Licenses. Attached please find our invoice for your purchase under the K2 Software Catalog.
Our bank details for wire transfer are included on the attached invoice.
Should you wish to submit payment via credit card, please contact our customer service department (billing-cs@kaseya.com) for assistance with adding card details through our portal.
Please do not hesitate to let us know if you have any questions.
Thanks again for your patronage.
Sincerely,
Terry Cherry
Kaseya Customer Invoicing
Corporate: +1.415.694.5700 X4946
Email: CherryTerry66644@nyoda.com
From Andrew Williams [andrew.williams@eurocoin.co.uk]E-Service have been exceptionally quick about posting an update on their Twitter page. However, they have not been hacked at all as it is trivially easy to forge an email message. The attachment is a malicious Excel spreadsheet which leads to the Dridex banking trojan.
Date Mon, 11 Jan 2016 17:07:38 +0700
Subject E-Service (Europe) Ltd Invoice No: 10013405
Dear Customer,
Please find your invoice attached from E-Service (Europe) Ltd. We kindly ask you
to make payment for all transactions on or before their due date.
Please contact E-Service (Europe) if you have any issues or queries preventing your
prompt payment on:
Tel (44) 01707 280000
Email: accounts@e-service.co.uk
Or logon and register to access your customer portal where you can view all historic
orders & transactions on www.e-service.co.uk
PLEASE NOTE NEW E-SERVICE (EUROPE) BANK DETAILS:
Currency A/C No. Sort Code Swift Code IBAN No.
GBP 21698613 40-04-37 MIDLGB22 GB48MIDL40043721698613
EUR 71685997 40-05-15 MIDLGB22 GB75MIDL40051571685997
Kind regards
E-Service (Europe) Accounts Team
From UKFast Accounts [accounts@ukfast.co.uk]I am unable to determine what the body text is at the moment. In this case, the attachment was named Invoice-1228407.doc and has a VirusTotal detection rate of 3/54. The Malwr report shows that the malicious macro [pastebin] downloads an executable from:
Date Mon, 11 Jan 2016 11:00:10 +0300
Subject Your latest invoice from UKFast No.1228407
From: Hoyt FowlerI have only seen a single sample of this email at present, but if consistent with other similar emails then details such as the sender's name and reference numbers will vary. In this case, the attachment was named INV-SE723A36B7.doc and had a VirusTotal detection rate of 1/55.
Date: 8 January 2016 at 10:49
Subject: Invoice from DSV 723A36B7 , ARIA (U K) LTD, 04995672, Customer ref: ALEX MUNRO, SE/GB
Invoice/Creditnote no.: 723A36B7
Total Amount: GBP 60,00
Due Date: 28.01.2016
If you have any questions to this invoice/creditnote please contact the person written in the upper right corner of the invoice.
Please see attached document.
Best Regards
Hoyt Fowler
DSV Road Limited
Scandinavia House
Parkeston, Harwich
Essex, CO12 4QG No.3874882
Tel: 01255 242242
Registered in England
VAT No. GB759894254
Global Transport and Logistics
From: Carey Cross
Date: 7 January 2016 at 11:35
Subject: Close Invoice Finance Limited Statement 1/1
Dear Customer,
Please find attached your latest statement from Close Brothers Invoice Finance.
Your username is 05510/0420078
Your password should already be known to you.
If you have any queries please contact:
For Credit Control: creditcontrolqueriesCBIF@closebrothers.com
For login help: closloginhelp@netsend.biz
If you’re considering growing your business or are simply looking for support with cash flow, visit our website to see how we can help www.closeinvoice.co.uk/cashflow
Regards
Close Brothers Invoice Finance
From: Amber SmithThe sender's name varies, as does the reference number which matches the name of the attachment. I have seen three unique samples so far (there are probably more) with VirusTotal detection rates of 2/54 [1] [2] [3] and the Malwr reports [4] [5] [6] show these documents communicating with:
Date: 7 January 2016 at 10:38
Subject: Invoice 01147665 19/12 £4024.80
Hi,
Happy New Year to you !
Hope you had a lovely break.
Many thanks for the payment. There’s just one invoice that hasn’t been paid and doesn’t seem to have a query against it either.
Its invoice 01147665 19/12 £4024.80 P/O ETCPO 35094
Can you have a look at it for me please?
Thank-you !
Kind regards
Amber Smith
Credit Control
Finance Department
Ibstock Group
Supporting Ibstock, Ibstock-Kevington & Forticrete
-----------------------------------------------
( +44 (0)1530 257371
( VPN: 700 2371
6 +44 (0)1530 257379
From: Leonor StevensYesterday I saw several spam runs similar to this coming from Dridex botnet 120. There are many, many variations of the attachment although I do not believe that they are uniquely-generated.
Date: 7 January 2016 at 10:13
Subject: Your Latest Documents from Angel Springs Ltd [1F101177]
Dear Customer,
Please find attached your latest document (s). You may have noticed that we have changed the way you receive your new attached documents from Angel Springs. Following feedback from our customers we've invested in upgrading our billing systems to make things a little easier for you.
Here's a few ways we've made it easier for you:
Your new documents are now attached to your email. You don't have to follow a link now to get to your documents.
Our customer portal has been upgraded to give you a clearer, simpler view of your documents and any outstanding invoices.
You can simply and easily raise any queries you may have through the customer portal.
Please note: you may wish to save your documents on initial viewing. However, after your first viewing you will be able to access copy documents by simply clicking the link.
If you would like to discuss or have any queries in relation to any of the documents then please do not hesitate to contact us on 0845 230 9555 and we will be more than happy to assist you. Please do not reply to this email.
To see Angel Springs latest special offer that will save you money and help support Make a Wish, please click on the attached document
With Kind Regards,
Angel Springs Ltd
From: Desiree Doyle
Date: 6 January 2016 at 12:29
Subject: Unilet Invoice 67940597
Hello,
Please find attached another invoice to pay please by BACS.
Thanks
Desiree Doyle
Accounts Department
-----Original Message-----
From: Desiree Doyle
Sent: 06 January 2016 12:30
To: Desiree Doyle
Subject: Scanned from a Xerox Multifunction Device
Please open the attached document. It was scanned and sent to you using a Xerox Multifunction Device.
Attachment File Type: pdf, Multi-Page
Multifunction Device Location: Melbury House-MG01
Device Name: 7225
For more information on Xerox products and solutions, please visit http://www.xerox.com
BU is a Disability Two Ticks Employer and has signed up to the Mindful Employer charter. Information about the accessibility of University buildings can be found on the BU DisabledGo webpages This email is intended only for the person to whom it is addressed and may contain confidential information. If you have received this email in error, please notify the sender and delete this email, which must not be copied, distributed or disclosed to any other person. Any views or opinions presented are solely those of the author and do not necessarily represent those of Bournemouth University or its subsidiary companies. Nor can any contract be formed on behalf of the University or its subsidiary companies via email.
From: Forrest Cleveland
Date: 6 January 2016 at 11:23
Subject: STA19778072 - BACS PAYMENT
Importance: High
Hello,
Wasn’t sure who to email.
I don’t know if you have been asked but Statestrong Products Ltd are making one payment today for two cars. Could you let me know when it is in the account please as these are both collections tomorrow.
YG15XVK paid set up fee by card
£455.99 Incl vat rental
£500 deposit
DE64ZXM
£210 setup fee
£431.99 Incl vat rental
£500 deposit
Total - £2097.98
Thanks
Lorie
From: Addie CaldwellThe sender's name varies. So far I have seen three different versions of the attachment (in the format remit85752524.doc or similar) with VirusTotal detection rates in the range of 2/54 [1] [2] [3] and the Malwr reports [4] [5] [6] show similar characteristics to this spam run plus this additional URL:
Date: 6 January 2016 at 10:31
Subject: Payment notification from Third Energy Services Limited
Payment notification from Third Energy Services Limited
Third Energy Services Limited
Registered in England & Wales. Registered number: 85752524.
Registered office: 7th Floor. Portland House, Bressenden Place, London, UK, SW1E 5BH
Tel: 01944 759904 ot 0207 0420 800
This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Third Energy. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone.
Please contact the sender if you believe you have received this email in error.
Addie
From: Viola CarrilloI have seen two variants of the attachment (VirusTotal results [1] [2]) and these two Malwr reports [3] [4] indicate identical characteristics to the payload in this spam run which is also being sent out today.
Date: 6 January 2016 at 09:53
Subject: Invoice for IA20114520
To Whom It May Concern,
Please find attached an invoice relating to Penalty Charge Notice Number IA20114520 along with a copy of the contravention.
In order to prevent this fine from escalating further we have paid this fine on your behalf. Should you have any queries concerning these charges please don’t hesitate to contact me.
Payment for this invoice will be taken by Direct Debit 9 working days from the date of this email.
Please refer to page 2, point 3.6 in your Terms and Conditions for information on Traffic Offences.
From: Bertha ShermanI have seen at least four different attachments with names in a format similar to invoice40201976.doc (VirusTotal results [1] [2] [3] [4]). These Malwr reports [5] [6] [7] [8] show that the malware contained within POSTs to:
Date: 6 January 2016 at 09:29
Subject: Invoice-205611-49934798-CROSSHILL SF
Dear Customer,
Please find attached Invoice 02276770 for your attention.
Should you have any Invoice related queries please do not hesitate to
contact either your designated Credit Controller or the Main Credit Dept. on
01635 279370.
For Pricing or other general enquiries please contact your local Sales Team.
Yours Faithfully,
Credit Dept'
Registry Registrant ID:There is no such company as "Righway Technologies, Inc" but the name Roman Alyabiev matches the records for the IP block:
Registrant Name: Roman Alyabiev
Registrant Organization: Righway Technologies, Inc.
Registrant Street: 1740 H Dell Range Blvd #281
Registrant City: Cheyenne
Registrant State/Province:
Registrant Postal Code: 82009
Registrant Country: US
Registrant Phone: +1.3074590153
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: contact@goforfiles.com
Registry Admin ID:
network:Network-Name:Dedicated ServerA full list of sites currently or recently hosted in this block can be found here. The domains in use for browser hijacking are:
network:IP-Network:199.195.196.176/29
network:IP-Network-Block:199.195.196.176 - 199.195.196.183
network:Org-Name:Alyabiev, Roman
network:Street-Address:pr. Molodeznoi 7 kv. 101
network:City:Kemerovo
network:State:
network:Postal-Code:650044
network:Country-Code:RU
From: Rachael Murphy
Date: 23 December 2015 at 13:05
Subject: Christmas Industrial Decorating invoice-50473367)
Good afternoon,
Please find attached 1 invoice for processing.
Regards and Merry Christmas!
Rachael Murphy
Financial Manager
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
From: Claire CareyThe sender's name and reference number are randomly generated. Attached is a file in the format invoice29111658.doc which comes in at least three different versions (VirusTotal results [1] [2] [3]).
Date: 23 December 2015 at 12:01
Subject: UKSM Invoice 70146427
Good time of day,
Thank you for choosing UK Safety Management Ltd. to carry out your Portable Appliance Testing.
Please find enclosed your invoice.
Claire Carey
www.uksafetymanagement.co.uk
From: Josie Ruiz
Date: 23 December 2015 at 11:38
Subject: FW: Meridian (Acc. No. 51588088) - Professional Fee Invoice
Dear Sir/Madam,
Re: Meridian Professional Fees
Please find attached our fee note for services provided, which we trust meets with your approval.
Payment should be made to Meridian International VAT Consulting Ltd. within the agreed payment terms.
We look forward to your remittance in due course.
Yours sincerely
Josie Ruiz
Financial CEO
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com ______________________________________________________________________
The information in this email and any attachments are the property ofALTAVIA or its affiliates and may contain proprietary and confidential information that is intended for the addressee(s) only. If you are not the intended recipient, please refrain from any disclosure, copying, distribution, retention or use of this information. You are hereby notified that such actions are prohibited and could be illegal. If you have received this e-mail in error, please immediately contact the sender and delete the e-mail. We appreciate your cooperation. Email transmissions being not guaranteed, ALTAVIA and its affiliates decline their liability due to this email transmission, specifically when altered, modified or falsified.
Les informations contenues dans cet e-mail ainsi que les fichiers joints sont la propriété d’ALTAVIA et / ou ses filiales et peuvent être des informations confidentielles et privées qui sont adressées à l’attention de leur destinataire uniquement. Si vous n’êtes pas le destinataire du message merci de ne pas divulguer, copier, diffuser, conserver ou utiliser ces informations. Vous êtes par la présente notifié que ces agissements sont interdits et peuvent être illégaux. Si vous avez reçu cet e-mail par erreur, merci de prendre contact immédiatement avec l’expéditeur et de détruire cet e-mail. Nous vous remercions de votre coopération. La correspondance en ligne n’étant pas un moyen entièrement sécurisé, ALTAVIA et ses filiales déclinent toute responsabilité au titre de cette transmission, notamment si son contenu a été altéré, déformé ou falsifié.
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
From: Avril Sparrowhawk [Avril.Sparrowhawk@lescaves.co.uk]
Date: 22 December 2015 at 11:14
Subject: CWIH8974 PAYMENT RECEIVED
CWIH8974.doc
92K
From: trinity [trinity@topsource.co.uk]Attached is a file British Gas.doc with an MD5 a VirusTotal detection rate of 2/54. Analysis of the document is pending, however it will most likely drop the Dridex banking trojan.
Date: 22 December 2015 at 10:36
Subject: British Gas - A/c No. 602131633 - New Account
British Gas.doc
92K
