Card Receipt aquaid Tracey Smith malware word document

Card Receipt aquaid Tracey Smith emails are back once again in a targeted malware run.

"AquAid's" malware run of a macro infected "Card Receipt" word document has a random attachment,
however these emails aren't from Aquaid at all, they just being used to make the email look more
genuine, ie. from a real company.

Message Headers (Note that the email address is random):

From: "Tracey Smith" {tracey.smith550@aquaid.co.uk} Subject: Card Receipt Date: Tue, 06 Jan 2015 09:56:42 +0200

Message Body:

Hi Please find attached receipt of payment made to us today Regards Tracey Tracey Smith| Branch Administrator AquAid | Birmingham & Midlands Central Unit 35 Kelvin Way Trading Estate | West Bromwich | B70 7TP Telephone:        0121 525 4533 Fax:                  0121 525 3502 Mobile:              07795328895 Email:               tracey.smith@aquaid.co.uk AquAid really is the only drinks supplier you will ever need with our huge product range. With products ranging from bottled and mains fed coolers ranging up to coffee machines and bespoke individual one off units we truly have the right solution for all environments. We offer a refreshing ethical approach to drinks supply in that we support both Christian Aid and Pump Aid with a donation from all sales.  All this is done while still offering a highly focused local service and competitive pricing. A personalised sponsorship certificate is available for all clients showing how you are helping and we offer £25 for any referral that leads to business. ********************************************************************* AquAid Franchising Ltd is a company registered in England and Wales with registered number 3505477 and registered office at 51 Newnham Road, Cambridge, CB3 9EY, UK. This message is intended only for use by the named addressee and may contain privileged and/or confidential information. If you are not the named addressee you should not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify the sender and delete the message and any attachments accompanying it immediately. Neither AquAid nor any of its Affiliates accepts liability for any corruption, interception, amendment, tampering or viruses occurring to this message in transit or for any message sent by its employees which is not in compliance with AquAid corporate policy.

One example of the random attachment file name:

CAR015 151239.doc

Md5 Hashes:

2e8dc58a36806e13cd61e4a25f38c9ee e7d6aa728aa28487400cb2ae82051531

Malware Macro document information:

VirusTotal Report [1] (hits 0/56 Virus Scanners) VirusTotal Report [2] (hits 0/56 Virus Scanners) Malwr Report [1] Decoded Macro [1]

Sanesecurity signatures are blocking this as: Sanesecurity.Malware.24646.DocHeur

NOTE The current round of Word and Excel attachments are targeted at Windows users. Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment. The auto-download file is normally a windows executable and so will not currently run on  any operating system, apart from Windows. However, if you are an Apple/Android user and forward the message to a Windows user, you will them put them at risk of opening the attachment and auto-downloading the malware. Currently these attachments try to auto-download Dridex, which is designed to steal login information regarding your bank accounts (either by key logging, taking auto-screens hots or copying information from your clipboard (copy/paste))

Cheers,

Steve

Sanesecurity.com