Incoming malware example

An incoming bit of malware:

"Please see attached copy (Invoice_9918492) of the original invoice." with an attached zip file.

Let's have a look at the *current* 0 minute results...

MD5: 90d968aab763ea0e91c357e47f10372d
File name: Invoice_9918492.zip

Detected already by ClamAV 3rd Party signatures:  

phish.ndb: Sanesecurity.Malware.22634.ZipHeur.Dte.UNOFFICIAL  
foxhole_all.cdb: Sanesecurity.Foxhole.Zip_exe.UNOFFICIAL

Detected already by ClamAV 3rd Party signatures hashes:  

rogue.hdb: Sanesecurity.Rogue.0hr.1107v29162.UNOFFICIAL
bofhland_malware_attach.hdb: BofhlandMWFile498.UNOFFICIAL

Example snapshot, number blocked per hour mean: 114, Max: 4831

VirusTotal:

Detection ratio: 2 / 47
Analysis date: 2013-11-07 09:13:28 UTC ( 2 minutes ago )
 AntiVir: TR/Crypt.XPACK.Gen3
Sophos: Troj/Invo-Zip

ThreatTrack Pdf Analysis:

https://drive.google.com/file/d/0B1SVySdiVS8BY25DSmdaOXZzbU0

New website

Well, it's been a while since I've updated the blog, so I thought I'd better do so. To start with, the new website is live, on the sanesecurity.com domain at the moment. More new stuff coming shortly....

fake dhl email using pif

Another round of fake DHL emails... but this time... it's got a PIF attachment, instead of the
normal zipped exe variety.

Here's the email....












Submitted to Threatexpert:
http://www.threatexpert.com/report.aspx?md5=8b7c994f4d5b0b5e35216bd68d87edb3

Submitted to VirusTotal (7/43)
http://www.virustotal.com/file-scan/report.html?id=2936d561853db9119ac2d5e7120f80d4e8ed39fa191365b5d8be83cfa4f95343-1305796256

It seems to be interested in the following banks:
http://eureka.cyber-ta.org/OUTPUT/8b7c994f4d5b0b5e35216bd68d87edb3/dns.txt

Detected as:

Sanesecurity.Rogue.2050 and Sanesecurity.Malware.16418

Cheers,

Steve
Sanesecurity

strange facebook emails

Received this interesting and very simple email today...








From the source code you can see, that the link doesn't go to facebook...



... It instead, takes you to a forum... which has been hacked (which you can see when you look into the source code)



The forum then re-directs you, via a 302 re-redirect... to another site (seen with httpfox)






The final site you end up with... is a fake anti-virus site, which are generally a pain to remove :(

Checking the actual fake anti-virus site (in bold) with urlvoid.com...



















You can see that out of 21 url checkers... they all come up clean....

It's not nice out there.... but Sanesecurity.Malware.15890 and Sanesecurity.Malware.15891 are currently blocking these emails.

Cheers,

Steve
Sanesecurity

birth certificate malware

Here's a birth certificate email:




















Inside the zip... is surprise, surprise... an exe file:






Submitted to VirusTotal:











Added detection as:

Sanesecurity.Rogue.0hr.0914v32427 (rogue.hdb)

Cheers,

Steve
Sanesecurity