Sponsored by..

Tuesday 13 June 2017

Bellatora Inc (ECGR) pump-and-dump spam

It's been a little while since we've since an illegal pump-and-dump spam from the Necurs botnet, but here is a new one pushing a company called Bellatora Inc (stock ticker ECGR)
From:    Lillie Maynard
Date:    13 June 2017 at 09:37
Subject:    Here's why this company's shares are about to go up tenfold next week.

Yes, it's been some time since I reached out to you with something good but trust me… the wait will have been worth it.

I promised you that I'd only give you a tip if I had something spectacular, and today I do.

Remember my buddy in California who works at Accel? I had lunch with him yesterday and he told me that he firm is about to invest 50 million bucks into a small Marijuana company.

Basically they make weed vaporizers and their stuff is flying off the shelf because both weed, and vaporizers are all the craze right now.

Anyway, long story short, they're putting all that cash in the company at a price of $1.17 per share and yes you guessed it… it's way higher than where the stock price is as we speak.

The price is at just over 10 cents right now. This means that when they announce their involvement in a few days it should go up about tenfold overnight.

In fact, if you look at the chart, the price was at a little over 2 dollars a few weeks ago. My buddy tells me that his firm ‘crashed' it artificially so that they'd have more bargaining power at the table and it makes sense... They're coming in at just $1.17 instead of over 2 dollars.

Nonetheless this is a really rare chance for us to get in. I'll pick up at least 50,000 shares today and I think you should do the same.

The name of the company is Bellatora Inc. and its ticker is ECGR. If you do decide to tell a couple of your friends, please do me a favor and don't mention me by name.

Thanks,
Lillie Maynard
Bellatora seems to be involved in the vaping market, including medical marijuana vaping. I've seen a couple of other P&D spam runs in the past pushing stocks in this industry [1] [2].

Over the past month, the price of ECGR stock has cratered from over $2 per share to just 10 cents today. Yesterday someone traded 455,000 shares of that stock.


According to MarketWired this company has changed names several times over the years:

Company History
- Formerly=Oncology Medical, Inc. until 9-2016
- Formerly=Vianet Technology Group, Ltd. until 4-07
- Formerly=UTTI Corp. until 2-07
- Formerly=Unitech Industries, Inc. until 1-99
- Note=12-96 state of incorporation California changed to Delaware upon emergence from Chapter XI bankruptcy under Federal Bankruptcy Code
A quick look at the financials for this company turns up.. nothing. Which is kind of odd.

Anyway, stock being pushed through illegal pump-and-dump operations such as this is not being done for YOUR benefit, but for some party who holds a lot of stock. Avoid.

The spam run has been going on for about six hours, but has slowed down in the past few hours.


Version 2 - 13th June

It didn't take long for the second version to come out.. and there could be a lot more to come.

From:    Alisa Rich
Date:    13 June 2017 at 15:39
Subject:    Let me tell you why this stock will go up 10x by next week.

Haven't heard from me in a while right? That's because I'm not one to waste your time.

Whenever I do email you, it's because I've got something good. Really good.

My good friend who works at the big VC out in NY invited me for a bite yesterday. Nothing unusual, we always eat lunch together right?

However yesterday he gave me a really amazing piece of information and I want to share that with you.

The place he works at is basically injecting more or less 50 mill into this small American company that's in the cannabis business. Apparently, they've got some really amazing distribution and even better technologies.

Anyway... to make a long story longer he said the value they are coming in at is right around 1.20 a share and that this announcement will be made public some time in the next few days.

Given that the shares are at just 12 cents right now, do you have any idea what's going to happen when the announcement is out?

Yep, you guessed right... It's going to jump up 10 times, literally overnight.

The cannabis company is: Bella tora Inc.

You can buy it if you type E C G R in your brokerage account.

Feel free to tell only your closest friends about this. I really have no clue when the next time I get a tip will be.

Take care,
Alisa Rich




Monday 5 June 2017

Malware spam: "John Miller Limited" / "Invoice"

This spam pretends to come from John Miller Ltd (but doesn't) and comes with a malicious payload. The domain mentioned in the email does not match the company being spoofed, and varies from message to message.

From:    Felix Holmes
Date:    5 June 2017 at 10:20
Subject:    Invoice


Regards



Felix Holmes

cid:image001.jpg@01D00F00.660A92D0
Kirkburn Ind. Estate
Lockerbie
Dumfries and Galloway
DG11 2FF

Tel – 01576 208 741 (Accounts) 01576 208 747 (Main line)
Fax – 01576 208 748
Ext – 1008/1006
‘’New Website launched 30.05.2014 – visit www.[redacted].uk’’


Attached is a PDF file with a name similar to A4 Inv_Crd 914605.pdf - opening it up (NOT recommended) displays something fairly minimal.

The attachment currently has a detection rate of about 9/56. As is common with some recent attacks, the PDF actually contains an embedded Microsoft Office document. Hybrid Analysis shows the malicious file downloading a component from cartus-imprimanta.ro/8yfh4gfff (176.126.200.56 - HostVision SRL, Romania) although other variants possibly exist.


A file is dropped (in the HA report called miniramon8.exe) at detection rate of 11/61. According to the Hybrid Analysis report, that attempts tom communicate with the following IPs:

192.48.88.167 (Tocici LLC, US)
89.110.157.78 (netclusive GmbH, Germany)
85.214.126.182 (Strato AG, Germany)
46.101.154.177 (Digital Ocean, Germany)


The payload is not clear at this time, but it will be nothing good.

Recommended blocklist:
192.48.88.167
89.110.157.78
85.214.126.182
46.101.154.177



Thursday 11 May 2017

Malware spam with "nm.pdf" attachment

Currently underway is a malicious spam run with various subjects, for example:

Scan_5902
Document_10354
File_43359


Senders are random, and there is no body text. In all cases there is a PDF attached named nm.pdf with an MD5 of D4690177C76B5E86FBD9D6B8E8EE23ED or 6B305C5B59C235122FD8049B1C4C794D (and possibly more). Detection rates at VirusTotal are moderate [1] [2].

The PDF file contains an embedded Word .docm macro document. Hybrid Analysis [3] [4] is partly successful, but it shows a run-time error for the malicious code, but it does demonstrate that malicious .docm file is dropped with a detection rate of 15/58.

Putting the .docm file back into Hybrid Analysis and Malwr [5] [6] shows the same sort of results, namely a download from:

easysupport.us/f87346b

Given that this seems to be coming from the Necurs botnet, this is probably Locky or Dridex.

UPDATE

A contact pointed out this Hybrid Analysis which looks like basically the same thing, only in this sample the download seems to work. Note the references to "jaff" in the report, which matches this Tweet about something called "Jaff ransomware".

That report also gives two other locations to look out for:

trialinsider.com/f87346b
fkksjobnn43.org/a5/


This currently gives a recommended blocklist of:
47.91.107.213
trialinsider.com
easysupport.us

Tuesday 2 May 2017

Malware spam: DHL Shipment 458878382814 Delivered

Another day and another fake DHL message leading to an evil .js script.

From: DHL Parcel UK [redacted]
Sent: 02 May 2017 09:30
To: [redacted]
Subject: DHL Shipment 458878382814 Delivered

You can track this order by clicking on the following link:
https://www.dhl.com/apps/dhltrack/?action=track&tracknumbers=458878382814&language=en&opco=FDEG&clientype=ivother

Please do not respond to this message. This email was sent from an unattended mailbox. This report was generated at approximately 08:15 am CDT on 02/05/2017.

All weights are estimated.

The shipment is scheduled for delivery on or before the scheduled delivery displayed above. DHL does not determine money-back guarantee or delay claim requests based on the scheduled delivery. Please see the DHL Service Guide for terms and conditions of service, including the DHL Money-Back Guarantee, or contact your DHL customer support representative.

This tracking update has been sent to you by DHL on behalf of the Requestor [redacted]. DHL does not validate the authenticity of the requestor and does not validate, guarantee or warrant the authenticity of the request, the requestor's message, or the accuracy of this tracking update.

Standard transit is the date the package should be delivered by, based on the selected service, destination, and ship date. Limitations and exceptions may apply. Please see the DHL Service Guide for terms and conditions of service, including the DHL Money-Back Guarantee, or contact your DHL Customer Support representative.

In this case the link goes to parkpaladium.com/DHL24/18218056431/  and downloads a file DHL-134843-May-02-2017-55038-8327373-1339347112.js which looks like this.

According to Malwr and Hybrid Analysis the script downloads a binary from micromatrices.com/qwh7zxijifxsnxg20mlwa/ (77.92.78.38  - UK2, UK) and then subsequently attempts communication with

75.25.153.57 (AT&T, US)
79.170.95.202 (XL Internet Services, Netherlands)
87.106.148.126 (1&1, Germany)
78.47.56.162 (Mediaforge, Germany)
81.88.24.211 (dogado GmbH, Germany)
92.51.129.235 (Host Europe, Germany)
74.50.57.220 (RimuHosting, US)


The dropped binary has a VirusTotal detection rate of 10/60.

Recommended blocklist:
77.92.78.38
75.25.153.57
79.170.95.202
87.106.148.126
78.47.56.162
81.88.24.211
92.51.129.235
74.50.57.220

Thursday 27 April 2017

Malware spam: Scotiabank / "Secure email communication" / Secure.Mail@scotiabankmail.com

This fake financial spam leads to malware:

From:    ScotiaBank [Secure.Mail@scotiabankmail.com]
Date:    27 April 2017 at 14:13
Subject:    Secure email communication
Signed by:    scotiabankmail.com


Scotia Secure Email Logo
Secure mail waiting: (Secure)
Scotiabank has sent you a secure, encrypted e-mail message. To view this e-mail, please visit "Scotiabank Secure Email Service" or check attach file. For further information on how to use this service please reffer to "the Secure Email User Guide".
The email you receive from Scotiabank, including any attachments, may contain confidential and/or privileged information for the intended recipient(s) only and the sender does not waive any related legal rights or privilege. Any use or disclosure of the information by an unintended recipient is unauthorized and prohibited. If you have received an email message in error, please delete the entire message, including attachments if any, and inform us by return email. 

Opening the attached document SecureMail.doc leads to a simple page that tries to get you to enable Active Content (not recommended!).

Hybrid Analysis shows a download from elevationstairs.ca/fonts/dde60c5776c175c54d23d2b0c.png [70.33.246.140 - Host Papa, US] leading to a dropped file Pscou.exe which has a detection rate of 11/61 and appears to be Upatre.

Malwr Analysis of the downloaded file shows attempted communications to:

82.146.94.86 (Ringnett, Norway)
8.254.243.46 (Level 3, US)
217.31.111.153 (Ringnett, Norway)


scotiabankmail.com has been registered specifically for this attack, or you can block the sending IP of 89.40.216.186 (City Network Hosting AB, Sweden)

Recommended blocklist:
scotiabankmail.com [email]
89.40.216.186 [email]
70.33.246.140
82.146.94.86
8.254.243.46
217.31.111.153