Thursday, 5 March 2015

RSTNAME Lloyds Bank - Pendeford Securities - Please Read Action Required

RSTNAME Lloyds Bank - Pendeford Securities - Please Read Action Required

Headers:
From: RSTNAME} Bunch" {Rosie.Bunch@lloydsbanking.com}
Subject: Lloyds Bank - Pendeford Securities - Please Read Action Required/PI Documents/ Region code East 2/ 3293861/
Message body:
Please find attached our document pack for the above customer. Once completed please return via email to the below address.

If you have any queries relating to the above feel free to contact us at

MN2Lloydsbanking@lloydsbanking.com

Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 9884503. Telephone: 0845 603 1637



There's a Zip file attached to the email:
ReportonTitle[?var=partorderb].1Final 1.zip

Inside the Zip file is a Windows executable:
ReportonTitle{_partorderb}.1Final.exe
Sha256 Hashes:
 60243596f8d978350fdacc417e9945d4da6bd713733fa31fc44611c7f8a8eba8   [1]

Malware Information:

VirusTotal Report [1] (hits 3/57 Virus Scanners)

Malwr Report [1]

Summary:

Steals private information from local Internet browsers
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)
Creates an Alternate Data Stream (ADS)
Installs itself for autorun at Windows startup


Hybrid Analysis Report [1]

Cheers,

Steve
Sanesecurity.com

1 comment:

Christopher Blyth said...

I have received a similar e-mail see below
From RSTNAME}.Glass " "
Please find attached our document pack for the above customer. Once completed please return via email to the below address.



If you have any queries relating to the above feel free to contact us at



MN2Lloydsbanking@lloydsbanking.com




Lloyds Banking Group plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC95000. Telephone: 0131 225 4555. Lloyds Bank plc. Registered Office: 25 Gresham Street, London EC2V 7HN. Registered in England and Wales no. 2065. Telephone 0207626 1500. Bank of Scotland plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC327000. Telephone: 08457 21 31 41. Cheltenham & Gloucester plc. Registered Office: Barnett Way, Gloucester GL4 3RL. Registered in England and Wales 1686327. Telephone: 0845 603 1637

Lloyds Bank plc, Bank of Scotland plc are authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and Prudential Regulation Authority.

Cheltenham & Gloucester plc is authorised and regulated by the Financial Conduct Authority.

Halifax is a division of Bank of Scotland plc. Cheltenham & Gloucester Savings is a division of Lloyds Bank plc.

HBOS plc. Registered Office: The Mound, Edinburgh EH1 1YZ. Registered in Scotland no. SC677632.

This e-mail (including any attachments) is private and confidential and may contain privileged material. If you have received this e-mail in error, please notify the sender and delete it (including any attachments) immediately. You must not copy, distribute, disclose or use any of the information in it or any attachments. Telephone calls may be monitored or recorded.