L.E. Owens SwisherPayment receipt eowens@swsh.com emails with a (Payment) 04.07.15.doc word document containing a macro.
These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.
Note
It's also worth remembering that the company itself may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net.
It's not advised to ring them as there won't really be anything they can do to help you.
|
Message Header::
From: "L.E. Owens" {leowens@swsh.com}
Subject: Payment receipt
Message Body:
Dear Valued Customer,
Thank you for calling with your credit card payment. The
payment has been posted to your account as requested. A copy of the receipt is
attached.
As always, we greatly appreciate your business. Please let
us know if we can be of further assistance.
Thank you for choosing Swisher!
Sincerely,
L.E
Owens
Customer
Care Specialist
Swisher
800.360.7974
800.444.4138
ext. 7248
leowens@swsh.com
swsh.com
Attachment:
(Payment) 04.07.15.doc
Sha256 Hashes:
713b05b0efa0aa9cf7d2e90b96027bf2ae83dcf6910d10972f151db9d6ae30df
c4c41d88a5d7280172e0b0cddb796a0bbfb1f24529b602a64a1144c84de4f987
8008a15c8321807da9c1ed31db3c00e10dd9d2b84ea15e6d285f35b95eb7c882
e2c4163b16258ea8719d39be8ac30b9020fcfb6616f70fefcc4471b6318d0ce4
369db430eca6baa2e589da8095e36dece8cab610fd9a545df0e5f15425ad60ee |
Malware Virus Scanner Reports:
NOTE
The current round of Word/Excel/XML attachments are targeted at Windows users.
Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment.
The auto-download file is normally a windows executable and so will not currently run on any operating system, apart from Windows.
However, if you are an Apple/Android user and forward the message to a Windows user, you will them put them at risk of opening the attachment and auto-downloading the malware.
Currently these attachments try to auto-download Dridex, which is designed to
steal login information regarding your bank accounts (either by key logging, taking auto-screens hots or copying information from your clipboard (copy/paste)) |
Cheers,
Steve
1 comment:
I've just received an email like this and have opened it my iPhone and Macbook Pro to see if it was from a company I had used but could only get a plain word document - I don't think it downloaded anything else, but is there a way to double check this? Thanks.
Post a Comment