Thursday, 18 December 2014

malware: rbs account incident

More incoming nasties...

From: "Les Caron" (and other "random names/addresses)
Subject: RE: Incident IM02023830 (random reference)

Good Afternoon ,

Attached are more details regarding your account incident.

Please extract the attached content and check the details.

Please be advised we have raised this as a high priority incident and will endeavour to resolve it as soon as possible. The incident reference for this is IM02023830.


We would let you know once this issue has been resolved, but with any further questions or issues, please let me know.

Kind Regards,

Les Caron

Level 2 Adviser | Customer Experience Team, IB Service & Operations 7th Floor, 1
Hardman Boulevard | Manchester | M3 3AQ | Depot code: 049
Tel: 0845 300 4108 |Email: Les.Caron@rbs.co.uk The content of this e-mail is CONFIDENTIAL unless stated otherwise


Inside the zipped attachment is:


IM0743436407_pdf.scr

Again: it's NOT a pdf file but an executable screen saver file.

Submitting the file (hash: 9513595daf2c327d1be65f79aaafb70f) to VirusTotal give us
a hit rate of [5/56]

Cheers,

Steve
Sanesecurity.com

No comments: