Best spam/malware email fail of the year so far

Description:

Best spam/malware email fail of the year so far...

Message Body:

{nreceived} date: {date} from: {from_generated} x-mailer: the bat! ({nthebat_3_ver}) {nthebat_3_type} x-priority: 3 (normal) message-id: <{digit}.{symbol}{digit}@{nhost}> to: {mail_to} subject: {subject} mime-version: 1.0 content-type: multipart/alternative; boundary="----------{_nthebat_2_boundary}" ------------{_nthebat_2_boundary} content-type: text/plain; charset=koi8-r content-transfer-encoding: 8bit {encode}{_body_text}{/encode} ------------{_nthebat_2_boundary} content-type: text/html; charset=koi8-r content-transfer-encoding: 8bit {encode} {_body_html} {/encode} ------------{_nthebat_2_boundary}--

Cheers,

Steve

Sanesecurity.com

bank account report with attached zip Javascript malware.

Description:

bank account report with attached zip is Javascript malware #Locky #Malware

Headers:

Subject: bank account report

Message Body:

How are things? Thank you very much for responding my email in a very short time. Attached is the bank account report. Please look at it again and see if you have any disapproval. -- Yours faithfully, Kenneth Anthony MYSALE GROUP PLC Phone: +1 (851) 555-20-91, Fax: +1 (851) 555-20-72

Attachment filename(s):

obc_889.zip

Sanesecurity Signature detection(s):

phish.ndb: Sanesecurity.Malware.26256.JsHeur.UNOFFICIAL FOUND

foxhole_filename.cdb: Sanesecurity.Foxhole.Zip_fs294.UNOFFICIAL FOUND

foxhole_js.cdb: Sanesecurity.Foxhole.Wsf_Zip_1.UNOFFICIAL FOUND

It's also worth remembering that the company itself  may not have any knowledge of this faked email and any link(s) or attachment in the email normally won't have come from their servers or IT systems but from an external bot net.

These bot-net emails normally have faked email headers/addresses.

It's not advised to ring/email the the company themselves, as there won't really be anything they can do to help you or to stop the emails being spread.

Cheers,

Steve

Sanesecurity.com