"Urgent eviction notification No2621" spam

This particularly cruel spam is a variation of the Court Notice spam that has been around for a few weeks. Thankfully it is very poorly worded which should alert at least some potential victims that it is a fake.

Date:      Tue, 28 Jan 2014 17:40:16 -0400 [16:40:16 EST]
From:      Eviction Notification [support.7@riduscourt.com]
Subject:      Urgent eviction notification No2621

 Eviction Notification,
   Please be advised that you are obliged to
   vacate the living space you occupy until March 28, 2014, 11 a.m.
   If you do not vacate it in the specified terms,
   the court will have to assign the forcible eviction for April 26,
   2014, 11 a.m.
   If nobody is home we will not be responsible for safe keeping of your
   belongings.
   Besides, if you fail to comply with the requirements of the court
   bailiff
   you will be fined for up to 200 minimum wage amounts
   with a subsequent doubling of the penalty amount
   and can be made criminally or administratively liable.
   The details of the circumstances that caused the judicial decision
   of eviction are attached herewith.
   Court bailiff,
   GOODWIN Bass

Attached is an archive file Copy_Of_The_Court_Statement_N1801.zip which in turn contains a malicious file Copy_of_the_court_statement_us_28_01_2014.exe.

For some reason the ZIP file that I have is corrupt and will not open, but I suspect that other versions may be valid. If anyone has a reliable analysis of this file it might be worth leaving a note in the Comments... thanks!

Update (30/1/14): here is a second version doing the rounds:

Date:      Wed, 29 Jan 2014 18:11:43 -0500 [01/29/14 18:11:43 EST]
From:      Notice To Quit [service_notice@mnduscourt.com]
Subject:      Notice to quit No5759

 Notice to quit,
   Hereby you are informed you have to quit the premises you hold until
   March, 21, 2014.
   If you stay in the currently occupied premises for a longer period of
   time,
   you will be assigned by court for forced eviction scheduled for April
   5, 2014.
   If court executives do not find you at home on the specified date,
   the court will disclaim any responsibility for safe keeping
   of your property left in the premises.
   Whether you fail to fulfill the requirements of the court
   you might be held liable to a fine equal to 100 minimum wage amounts.
   Attention.
   The adjudication details can be found attached to this notice.
   Bailiff of the court,
   RUSSELL ORTIZ 

In the case there is a ZIP file Details_For_Arrears_Document_29-01-2014_Copy_N5146.zip which contains a malicious executable Details_For_Arrears_Document_29-01-2014.exe which has an icon that makes it look like a Word document. The VirusTotal detection for this is 17/49. ThreatExpert reports a connection to 77.72.26.97 (Tesene SRL, Italy).

Update (31/1/14): Another couple of variations with a slightly different payload:

Date:      Fri, 31 Jan 2014 00:30:51 -0400 [01/30/14 23:30:51 EST]
From:      Eviction Notice [support.5@perkinscoie.com]
Subject:      Eviction notification No8423

 Eviction notice,

   Hereby you are notified that you have to move to another
   location from the currently occupied premises within
   the next three weeks.

   Please find the lawsuit details attached to this letter.

   If you do not move within this period of time,
   we will have no other alternative than to have you
   physically removed from the property per order of the Judge.

   If we can be of any assistance to you during your relocation,
   please feel free to contact us any time.

   Court representative,
   Emma Mason

---

Date:      Thu, 30 Jan 2014 14:23:27 -0500 [01/30/14 14:23:27 EST]
From:      Eviction Notice [support.7@perkinscoie.com]
Subject:      Notice to quit No8116

 Eviction notice,
   Hereby you are notified that you have to move to another
   location from the currently occupied premises within
   the next three weeks.
   Please find the lawsuit details attached to this letter.
   If you do not move within this period of time,
   we will have no other alternative than to have you
   physically removed from the property per order of the Judge.
   If we can be of any assistance to you during your relocation,
   please feel free to contact us any time.
   Court representative,
   Mary Tailor

The attachments on these two samples were Lawsuit_Details _Attache_ID88-175.zip and Lawsuit_Details _Attache_ID91-380.zip in turn containing a malicious executable Lawsuit_Details _Court_Representative.exe which has a VirusTotal detection rate of 16/50.  The ThreatExpert analysis shows an outbound connection to 41.86.112.12 (Mweb Connect, South Africa) also other analysis tools don't spot this [1] [2] [3].

Update (4/2/14): the spam run is ongoing with a couple of news ones spotted..

Date:      Mon, 03 Feb 2014 22:57:06 -0400 [02/03/14 21:57:06 EST]
From:      Eviction Notification [notice_support.7@littler.com]
Subject:      Evition notice No3998

 Eviction notification,
   You are hereby given notice that you are in breach
   of your tenancy of the premises you currently occupy.
   To remedy the breach you have to quit
   the premises within the following four weeks.
   If you fail to comply you will be physically removed
   and fined for up to 100 minimum monthly wages.
   Detailed information is attached herewith.
   Court secretary,
   RUSSO Anthony

-----------------------

Date:      Tue, 04 Feb 2014 10:29:55 -0500 [10:29:55 EST]
From:      Notice to quit [notice_service@kirkland.com]
Subject:      Notice to exit the premises No8527

 Notice to quit,
   We regret to inform you that in the period until 04/02/14
   you will have to relocate from the currently occupied premises.
   If the property is not timely vacated we will have to apply sanctions
   against you.
   Case details are attached to the present notice.
   Court secretary,
   JENSEN TATE 

Two sample attachment names are Lawsuit_Details _Copy_ID131-06.zip and Lawsuit_Details _Copy_SN_98-273.zip only one of which seems unzippable to Lawsuit_Details _Court Secretary_02-03-2014.exe which has a VirusTotal detection rate of 28/51. Most automated analysis tools are pretty inconclusive about what it does [1] [2] [3], but ThreatExpert reports an attempted connection to a server at 77.72.26.97 (Tesene, Italy) which has been used before in this attack.

RingCentral "New Fax Message on 01/22/2013" spam

This fake RingCentral fax spam has a malicious attachment:

Date:      Tue, 28 Jan 2014 14:28:24 +0000 [09:28:24 EST]
From:      Sheila Wise [client@financesup.ru]
Subject:      New Fax Message on 01/22/2013

You Have a New Fax Message
From:     (691) 770-2954
Received:     Wednesday, January 22, 2014 at 11:31 AM
Pages:     5
   

To view this message, please open the attachment

Thank you for using RingCentral.

Attached is a file fax.zip which in turn contains a malicious exectable fax.doc.exe with an icon to make it look like a Word document. The VirusTotal detection rate for the document is 10/50, and the Malwr analysis shows an attempted callback to ren7oaks.co.uk on 91.238.164.2 (Enix Ltd, UK).

The executable then downloads an apparently encrypted file from [donotclick]ren7oaks.co.uk/images/al2701.enc which has defied my half-hearted attempts an analysis.




fff

Ongoing Fake flash update via .js injection and SkyDrive, Part II

A few days ago I wrote about some ongoing injection attacks that were leading to Adscend Media LLC ads. Adscend say that the affiliate using their ad system was banned, although the ad code is still showing in the injection attacks themselves (update: you can see their take on this in the comments below). F-Secure also covered the attacks from a different aspect.

Although these injection attacks have died down a little they are still ongoing, but usually by the time I get to have a look at them part of the infection chain has been cleaned up. However, this infection is still current and shows what it going on at the moment.

In the case the code has been injected into the legitimate website sotralu.fr (report here) by altering the site's JS files, for example [donotclick]www.sotralu.fr/local/cache-js/fc1bd2678ffcf630f1ab8e56bda3ce7b.js

The code is fairly distinctive being attached at the bottom of the .js file, and it has a limited and fairly generic set of results at VirusTotal.

In this case the injection attempts to run a script from [donotclick]adsrr.home.pl/_vti_txt/rNn3m1K9.php?id=47276976 which in turn tries to download most of its content from [donotclick]adsrr.home.pl/_vti_txt/imgfiles/b.html (report here) which presents itself as a fake Flash update banner.

As well as the Adscend Media ad, this directs the user to download flashplayerinstaller.exe from [donotclick-https]skydrive.live.com/download.aspx?cid=cafe68e3dcbe2d33&resid=CAFE68E3DCBE2D33%21111 which has a VirusTotal detection rate of just 2/50. The Malwr analysis of this file shows a subsequent download from [donotclick-https]skydrive.live.com/download.aspx?cid=cafe68e3dcbe2d33&resid=CAFE68E3DCBE2D33%21112 which has a VirusTotal detection rate of 7/50 but a rather inconclusive Malwr report showing that it modifies the computer to run at startup.

Other researchers might want to grab those files and have a poke at them, so I haven't reported them yet. I'd be interested if anybody can get more intel on whoever is behind it.

The use of SkyDrive is sneaky, but you might decide that it's the sort of thing that you want to block in your corporate environment anyway. It might just be that the best way to counter this sort of attack is to apply a bit of user education about the threat.

"Skype Missed voice message" spam

This fake Skype email has a malicious attachment:

Date:      Mon, 27 Jan 2014 19:37:11 +0300 [11:37:11 EST]
From:      Administrator [docs1@victimdomain.com]
Subject:      Skype Missed voice message

Skype system:
You have received a voice mail message.
Date 01/27/2014
Message length is 00:01:18. 

Attached to the email message is an archive file Skype-message.zip which in turn contains a malicious executable Voice_Mail_Message.exe which has a VirusTotal detection rate of 13/49. Malwr reports that the malware calls home to rockthecasbah.eu on  64.50.166.122 (LunarPages, US). This server has been compromised before and I recommend you block traffic to it.

"Your FED TAX payment" spam

This fake "Tax payment" spam comes with a malicious attachment:

Date:      Mon, 27 Jan 2014 14:24:42 +0100 [08:24:42 EST]
From:      "TaxPro_PTIN@irs.gov" [TaxPro_PTIN@irs.gov]
Subject:      Your FED TAX payment ( ID : 34KIRS821217111 ) was Rejected

*** PLEASE DO NOT RESPOND TO THIS EMAIL ***

Your federal Tax payment (ID: 34KIRS821217111), recently sent from your checking account was returned by the your financial institution.

For more information, please download notification, using your security PIN 55178.

Transaction Number:     34KIRS821217111

Payment Amount:     $ 9712.00

Transaction status:     Rejected

ACH Trace Number:     768339074172506

Transaction Type:     ACH Debit Payment-DDA

Internal Revenue Service, Metro Plex 1, 8401 Corporate Drive, Suite 300, Landover, MD 20785.

Attached is a file Tax payment.zip which in turn contains a malicious executable Tax payment.exe which has a VirusTotal detection rate of 11/50. Automated analysis by Malwr is inconclusive, other analysis tools are currently down or under DDOS at the moment.

"Carnival Cruise Line Australia" fake job offer

This fake job offer does NOT come from Carnival Cruise lines:

From:     Mrs Vivian Mrs Vivian carnjob80@wp.pl
Date:     27 January 2014 09:59
Subject:     JOB ID: AU/CCL/AMPM/359/14-00
Signed by:     wp.pl

Carnival Cruise Line Australia

15 Mount Street North Sydney

NSW 2060, Australia

Tel (2) 8424 88000

http://www.carnival.com.au/     

http://www.carnivalaustralia.com/

carnivalcareer@globomail.com

JOB ID: AU/CCL/AMPM/359/14-00

What is your idea of a great career? Is it a job that allows you to travel to beautiful destinations on a spectacular floating resort, being part of a multi-cultural team with co-workers from more than 120 different nationalities? Or is it a job that allows you to earn great money while you learn, grow and fulfill your dreams and career ambitions?

It’s Carnival Cruise Line policy not to discriminate against any employee or applicant for employment because of RACE, COLOR, RELIGION, SEX, NATIONAL ORIGIN, AGE, DISABILITY, MARITAL OR VETERAN STATUS.

PLEASE NOTE THESE FOLLOWING: 
Employment Type:               Full-Time/Part-Time
Salary:                                  USD $45,000/ USD $125,000 per annual
Preferred Language of Resume/Application: English
Type of work:            Permanent / Temporary
Status:                        All Vacancies
Job Location:              Australia

Contract Period:          6 Months, 1 Year, 2 Years and 3 Years
Visa Type:                  Three Years working permit

The management will secure a visa/working permit for any qualified applicant. VISA FEE, ACCOMMODATION & FLIGHT TICKET will be paid by the company

We have more than 320 different positions available, interested applicants should forward their RESUME/CV or application letter to Mrs Vivian Oshea via email on (carnivalcareer@globomail.com) so we can forward the list of positions available and our employment application form

Email: carnivalcareer@globomail.com

Note: Applicants from AMERICA, EUROPE, ASIAN, CARIBBEAN and AFRICA can apply for these vacancies.

Regards

Management

Carnival Cruise Line Australia

carnivalcareer@globomail.com

Despite the appearance of Carnival's actual web sites in the email, the reply address is NOT a genuine Carnival address and is instead a free email account. The email actually originates from 212.77.101.7 in Poland.

The basic idea behind this scam is to offer a job and then charge the applicant for some sort of processing fees or police check or come up with some other reason why the applicant needs to pay money. Once the money has been taken (and perhaps even the victim's passport or other personal documents stolen) then the job offer will evaporate.

More information on this type of scam can be found here and here.

"MVL Company" fake job offer

This job offer is a fake, and in reality probably involves money laundering or handling stolen goods:

From: Downard Bergstrom [downardkrjbergstrom@outlook.com]
Subject: Longmore
Date: Fri, 24 Jan 2014 18:52:49 +0000

Hello,
Today our Company, MVL Company, is in need of sales representatives in United Kingdom.

Our Company deals with designer goods and branded items. We've been providing our customers with exclusive products for more than five years, and we believe that the applicant for the position must have great communication skills, motivation, desire to earn money and will to go up the ladder. All charges related to this opening are covered by the Company. Your main duties include administrative support on orders and correspondence, controlling purchase orders and expense reports.

Part-time job salary constitutes 460GBP a week.
Full-time job is up to 750GBP per week .
Plus we have bonus system for the best workers!

To apply for the vacancy or to get more details about it, please email us directly back to this email.

Hope to hear from you soon!
Best regards,
Downard Bergstrom

The spam is somewhat unusual in that it addresses me by my surname, indicating that the email data might have been stolen from a data breach (Adobe perhaps). The email originates from a freee Microsoft Outlook.com account and gives no clues as to its real origins. A look at Companies House Webcheck confirms that there is no company of this exact name, although there are several innocent companies with similar names.

Avoid.

Somnath Bharti: when a spammer becomes a government minister

More than a decade ago I came across an outfit called TopSites LLC which was running a spam operation which was pestering webmasters to renew their listings in the Topsites directory which was basically an unlicensed rip-off of the Open Directory Project in what was basically a business directory scam.

I documented the saga in a five-part series (plus a couple of follow-ups) and eventually TopSites shut up shop, with the main person behind it (Paul Aunger) cashing out from the business and buying into another firm called Inova Technology instead. There's a long story to that particular business and its I won't cover it here, but if you're really interested a trip to InvestorsHub is kind of interesting.

Part way through the TopSites spamming operation, they picked up a partner in India called Somnath Bharti. India was an ideal place to send spam from because it had no anti-spam laws at the time (and is still very lax in this area), so the act of spamming by itself was not illegal.. although the act of selling paid directory listings when they were actually free is a lot more questionable.

Mr Bharti denied any involvement, but since I had a copy of his business card it was pretty clear that he was lying. After I identified him, Mr Bharti was listed in the Spamhaus ROKSO list which is basically a list of the world's worst spammers. An example of the spam can be found here, linking Topsites to Mr Bharti's Madgen Solutions.

I didn't really pay much attention to Mr Bharti after that, although for a long time my site was the number one result in Google for Somnath Bharti which must have irritated him, and I did learn that he moved from IT to become a lawyer.

So I was rather surprised to find that Mr Bharti is now a government minister at the centre of a growing political storm in India, and now journalists are beginning to check his background, which is leading some of them back to what I wrote a decade ago.

Now, I'm not an expert in Indian law (and detractors of Mr Bharti say that he isn't either) but anti-spam laws in India basically do not exist, and certainly a decade ago I don't think that there was anything under Indian law that Mr Bharti was doing wrong. Even so, he was successfully sued in California [doc] for those same spam emails. Rather more seriously, being involved in a business that sells worthless directory listings is certainly legally questionable, although no case about that aspect was ever brought against Topsites or Mr Bharti.

One thing is certain - Mr Bharti lied about his involvement with TopSites. After I published details of his connection, he sent a somewhat threatening email denying involvement but inadventendly confirming it at the same time:

Subject: surprising and serious
From: Somnath [somnath.bharti@gmail.com]
 
Hi Conrad,
I was taken by surprise to find you listing my name, one of my properties address and my picture in an article on a company named "TopSites LLC" on your site. I don't know on what basis you have been talking so emphatic without cross verifying with the person you are talking about. To my utter surprise, you have been having this article on your site accusing me of being related to a company I have heard only through your article. Please have the same removed ASAP and explain to me what made you write all this about a person, not even remotely attached to any such company.
Please acknowledge of this email and have any and everything related my name, my pic and c-28 address removed. I am available at +91-9891819893, if you have anything to talk about. Also, post on the same page an apology for this grievous mistake on your part.
--
Regards,
Somnath Bharti

In that email, Mr Bharti emphatically denies involvement, but confirms that the photograph and address I published of him are correct.

What Mr Bharti didn't know was that I had a copy of his business card, not only confirming his connection, but listing him as CEO.

If you are interested in researching the topic for youself, a good place to start is Google Groups, especially searches relating Topsites, Bharti and Madgen Solutions (Bharti's IT company). I don't know if Mr Bharti is still denying his involvement in Topsites, but the evidence is damning if you look for it.

By TopSites LLC's own admission, they were turning in $1.8 million a year by 2005. How much of that money made its way to Mr Bharti is a mystery. And quite how Mr Bharti reconciles his questionable past business practices with his membership of an anti-corruption political party is also a mystery.

I don't know if Mr Bharti accepts or denies his role as a spammer for TopSites LLC, but his name is all over several public records and I also have private unpublished data that places him firmly near the centre of the operation. Perhaps he thinks that selling something that should be free is also an ethical way to do business, I don't know. And how does he explain a blatant and rather pathetic lie about involvement? That's something I don't know either. But I would certainly be interested in seeing what he has to say for himself..

Update:  after being exposed in the Times of India, Mr Bharti denies being reponsible.. but I look deeper at his involvment with the spamming operation here.

"Legal Business Proposal" spam has a malicious attachment

This email looks like it should be an advanced fee fraud, but instead it comes with a malicious attachment. I love the fact that this is a Legal Business Proposal as opposed to an Illegal one.

Date:      Thu, 23 Jan 2014 12:45:11 +0000 [07:45:11 EST]
From:      Webster Bank [WebsterWeb-LinkNotifications@WebsterBank.com]
Subject:      Legal Business Proposal

Hello, I'm Norman Chan Tak-Lam, S.B.S., J.P, Chief Executive, Hong Kong Monetary Authority (HKMA).

I have a Business worth $47.1M USD for you to handle with me.

 Detailed scheme of business can be seen in the attached file.

Attached is a file business-info.zip which in turn contains a malicious executable business-info.exe with a VirusTotal detection rate of 16/49.

Automated analysis tools [1] [2] [3] show attempted connections to dallasautoinsurance1.com on 38.102.226.239 and wiwab.com on 38.102.226.82. Both those IPs are Cogent Communications ones that appear to be rented out to a small web hosting firm called HostTheName.com. For information only, that host has these other IPs in the same range:
38.102.226.82
38.102.226.5
38.102.226.7
38.102.226.10
38.102.226.12
38.102.226.14
38.102.226.17
38.102.226.19
38.102.226.21