FedEx Home Delivery Postal Notification malware

FedEx Home Delivery Postal Notification malware is now arriving in the form of a html email,
with a link to a website which auto-downloads a dangerous zip file:

Headers:

From: "FedEx Home Delivery" {support@fincaelsympatico.es} X-Mailer: TWIG2.6.2 Reply-To: "FedEx Home Delivery" {support@fincaelsympatico.es} Subject: Postal Notification

Message body:

Dear Customer, Your parcel has arrived at December 29. Courier was unable to deliver the parcel to you. To receive your parcel, print this label and go to the nearest office.         Get Shipment Label

Clicking on the link with a Windows system gives you a zip file (name based on IP address location)

Label-Crewe.zip

Clicking on the link with an non-Widows system...the zip isn't downloaded...

Yes, Windows 9x...

On the Windows machine, Inside the zip, is Windows executable:

Label-Crewe.exe

VirusScanner Reports:

Md5 Hash:  eb0e95be3e03b5616ddd388c583c52b4 VirusTotal Report : [ 9 / 56] (a variant of Win32/Kryptik.CULP) Malwr Report Hybrid-Analysis Report

When the exe files runs, the following location is accessed:

IP: 217.106.239.250 Port 443 Location: Russian Federation

Best avoid this one...

Cheers,

Steve
Sanesecurity.com

unread messages from ladies - dating scams

As reported on the blog earlier there is an updated dating scam being used... but still posting to various forums:

Message Headers:

From: "Vilma" {rachellemarionnagxyn@goi360.com} Subject: 5 unread messages Date: Fri, 02 Jan 2015 17:19:56 -0200

Message Body:

Dear member of our Dating site! You have 5 unread messages from ladies. Please, check them here: [ Read now ] Best wishes to you, Administrator Vilma

The profile links to various websites that run a forum and point to a direct post:

http://projektorium2.prv.pl/viewtopic.php?p=4711#4711

An example forum post:

Hi everyone! My name is Irina, I live in Ekaterinburg (Russia) and have a dream like many other girls – I want to find my love and live a wonderful life together! This is not the only my interest, but for now it has become a priority.

Cheers,

Steve
Sanesecurity.com

Dreaming to fall in love: my name is Elena dating scam

As reported on the blog earlier there is an updated Dreaming to fall in love: my name is Elena dating scam being used... but still posting to various forums:

Message Headers:

From: "Elena" {BettyLee1979vo@energospectr.ru} Subject: Dreaming to fall in love

Message Body:

Hi, my name is Elena. I live in Ekaterinburg (Russia) and have a dream like many other girls – I want to find my love and live a wonderful life together! You can find my profile here

The profile links to various websites that run a forum and point to a direct post:

http://projektorium2.prv.pl/viewtopic.php?p=4711#4711

An example forum post:

Hi everyone! My name is Irina, I live in Ekaterinburg (Russia) and have a dream like many other girls – I want to find my love and live a wonderful life together! This is not the only my interest, but for now it has become a priority.

No doubt there will be more of these later :(

Cheers,

Steve
Sanesecurity.com

thinkedmoney.com clickmoneys.com and binarysmoney.com job scams continue

As reported in the earlier blog entry here..

http://sanesecurity.blogspot.co.uk/2014/12/new-job-money-making-scam.html

The job scam emails continue to come in, binarysmoney.com being the current one.

So far we've seen...

thinkedmoney.com clickmoneys.com binarysmoney.com

Cheers,

Steve
Sanesecurity.com

Why Russian Women Want To Leave Russia dating scam

Why Russian Women Want To Leave Russia seems to be a big spam run at the moment, to start
the New Year off....

Headers:

From: "Forum" {corina-o-ocinoctw@rr.com} Subject: Why Russian Women Want To Leave Russia

Message Body:

Look what they write on the forum

The forum links to various websites that run a forum and point to a direct post:

http: / /birdsofafeathertv DOT com/talk/viewtopic.php?f=8&t=578597

Here's an example of one forum post:

What will Sharon and Tracy do now?

Cheers,

Steve
Sanesecurity.com