NW - Leicester CRT Online banking application form CRM:017618675

NW - Leicester CRT Online banking application form  CRM:017618675 malware with an attached Online banking upd appl form.zip

Headers:

From: NW - Leicester CRT {Leicester.CMT@NatWest.com} Subject: Online banking application form********* CRM:017618675

Message body:

Please find enclosed the requested online application form which
you will need to complete and return to myself via the post.
 
Kind Regards
 
Sal Melton
Relationship Manager's Assistant
Leicester Business Banking Customer Support
1st Floor
1 Granby Street
Leicester         
LE1 6EJ
Tel:  0116 2709615
Fax: 0116 2501160
E Mail: Sal.Melton@natwest.com
 
Internal depot code - 060
DATA CLASSIFICATION: unless otherwise stated the information contained within this email is CONFIDENTIAL

Attached to the message is a Zip file:

Online banking upd appl form.zip

Inside the Zip file is a Windows Executable file:

Online banking upd appl form.scr

Sha256 Hashes:

d46d08b4ee94c57efa56f55fdf995a88b64b3bd63a077577b5888fc750743d33 [1]

Anti virus reports:

VirusTotal Report: [1] (Detection 3/56)

Cheers,
Steve
Sanesecurity.com

Your receipt for today's Ocado delivery Ocado customer services receipt.doc

Your receipt for today's Ocado delivery Ocado customer services receipt.doc macro malware.
These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.

Note

It's also worth remembering that the company itself  may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net. It's not advised to ring them as there won't really be anything they can do to help you.

Header:

From: Ocado customer services {customerservices@ocado.com} Subject: Your receipt for today's Ocado delivery

Message Body:

Hello Your receipt for today’s delivery is attached to this email. I’ll be delivering your 12:00-14:00 order and, so you’ll know it’s me, I’ll be driving the Lemon van. Your order doesn’t have any substitutions, everything’s there. See you later, Paul

Attachment:

receipt.doc

Sha256 Hashes:

357807e192b591045f47e75eb8bf90ffd836334896975cead383459fabf05cf7 [1] 44805663bb4a9593cef0aa693f363dbd60ccf4ce50fe04ed9ce6e96f1ff57212 [2] 843fa344144221549eb5f11619601a5af465debf701d5ca8c65c0de997f1d3e5 [3]

Malware Virus Scanner Reports:

VirusTotal Report: [1] (detection 3/56) VirusTotal Report: [2] (detection 3/56) VirusTotal Report: [3] (detection 3/56) Sanesecurity sigs (phish.ndb) detected this as: Sanesecurity.Malware.24819.MacroHeurGen.Hp Sanesecurity sigs (badmacro.ndb) detected this as: Sanesecurity.Badmacro.Doc.CreObj

NOTE

The current round of Word/Excel/XML/Docm attachments are targeted at Windows users. Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment. The auto-download file is normally a windows executable and so will not currently run on  any operating system, apart from Windows. However, if you are an Apple/Android user and forward the message to a Windows user, you will them put them at risk of opening the attachment and auto-downloading the malware. Currently these attachments try to auto-download Dridex, which is designed to steal login information regarding your bank accounts (either by key logging, taking auto-screens hots or copying information from your clipboard (copy/paste))

Cheers,

Steve

Sanesecurity.com

Stephanie Greaves COS007202.doc Bombardier Transportation

Stephanie Greaves COS007202.doc macro malware.
These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.

Note

It's also worth remembering that the company itself  may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net. It's not advised to ring them as there won't really be anything they can do to help you.

Header:

From: "Stephanie Greaves" {sgreaves@btros.co.uk} Subject: COS007202

Message Body:

Good morning, Please see attached purchase order. Kind regards, Stephanie Greaves Administration Apprentice Bombardier Transportation (Rolling Stock) UK Ltd Electronics, Cabling, & Interior Division Litchurch Lane, Derby, DE24 8AD

Attachment:

COS007202.doc

Sha256 Hashes:

357807e192b591045f47e75eb8bf90ffd836334896975cead383459fabf05cf7 [1] 44805663bb4a9593cef0aa693f363dbd60ccf4ce50fe04ed9ce6e96f1ff57212 [2] 843fa344144221549eb5f11619601a5af465debf701d5ca8c65c0de997f1d3e5 [3]

Malware Virus Scanner Reports:

VirusTotal Report: [1] (detection 3/56) VirusTotal Report: [2] (detection 3/56) VirusTotal Report: [3] (detection 3/56) Sanesecurity sigs (phish.ndb) detected this as: Sanesecurity.Malware.24819.MacroHeurGen.Hp Sanesecurity sigs (badmacro.ndb) detected this as: Sanesecurity.Badmacro.Doc.CreObj

NOTE

The current round of Word/Excel/XML/Docm attachments are targeted at Windows users. Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment. The auto-download file is normally a windows executable and so will not currently run on  any operating system, apart from Windows. However, if you are an Apple/Android user and forward the message to a Windows user, you will them put them at risk of opening the attachment and auto-downloading the malware. Currently these attachments try to auto-download Dridex, which is designed to steal login information regarding your bank accounts (either by key logging, taking auto-screens hots or copying information from your clipboard (copy/paste))

Cheers,

Steve

Sanesecurity.com

Sofie Robillard prices rhynoled.ca ebay.com

Sofie Robillard prices rhynoled.ca ebay.com  macro malware.
These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.

Note

It's also worth remembering that the company itself  may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net. It's not advised to ring them as there won't really be anything they can do to help you.

Header:

From: "eBay" {ebay@ebay.com} Subject: Re: Re: prices

Message Body:

Ok, I undertand.Can you please email me the price for the attached item list? Thank you. Sofie Robillard 902 425 LEDS (5337) Ext. 1 www.rhynoled.ca

Attachment:

item_list.doc

Sha256 Hashes:

8016c99eb970af2b1aa0c588a19cc5ee096f42778a0c60d8b3c4dc8376e68095 [1]

Malware Virus Scanner Reports:

VirusTotal Report: [1] (detection 3/55) Sanesecurity sigs (phish.ndb) detected this as: Sanesecurity.Malware.25741.MacroHeurGen.mod Sanesecurity sigs (badmacro.ndb) detected this as: Sanesecurity.Badmacro.25741.MacroHeurGen.mod

NOTE

The current round of Word/Excel/XML/Docm attachments are targeted at Windows users. Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment. The auto-download file is normally a windows executable and so will not currently run on  any operating system, apart from Windows. However, if you are an Apple/Android user and forward the message to a Windows user, you will them put them at risk of opening the attachment and auto-downloading the malware. Currently these attachments try to auto-download Dridex, which is designed to steal login information regarding your bank accounts (either by key logging, taking auto-screens hots or copying information from your clipboard (copy/paste))

Cheers,

Steve

Sanesecurity.com

Ray White [Scan] 2015-10-14 5:29:54 p.m raylian.co.uk

Ray White [Scan] 2015-10-14 5:29:54 p.m raylian.co.uk macro malware.
These emails aren't from these companies at all , they are just being used to make the email look more genuine, ie. from a real company.

Note

It's also worth remembering that the company itself  may not have any knowledge of this email and it's link(s) or attachment as it won't have come from their servers and IT systems but from an external bot net. It's not advised to ring them as there won't really be anything they can do to help you.

Header:

From: Ray White {rw@raylian.co.uk} Subject: [Scan] 2015-10-14 5:29:54 p.m.

Message Body:

Amanda's attached.

Attachment:

2015-10-14 5-29-54 p.m..doc

Sha256 Hashes:

5f211cfd6cd1b01dda2d29ab143b5bc7f32425945630b63c3b93f60c1d1ce857 [1] 6aaf62eef9f848786fed86943e21489a3f6464aec093628224a97ed37318593d [2] 742bb47beaf5b432a6ddcd67955a5ec53216c6303f8ac2298ae8b17facd9c8f3 [3] dc7754256622945c6574a806e5c35d59cad40e111d66fd0495bbeedd6213130b [4] ef3a69967b6517cfa84e984c92ab349e66d8cb0fbe906719f29bf96e419db592 [5]

Malware Virus Scanner Reports:

VirusTotal Report: [1] (detection 4/56) VirusTotal Report: [2] (detection 4/56) VirusTotal Report: [3] (detection 4/56) VirusTotal Report: [4] (detection 4/56) VirusTotal Report: [5] (detection 4/56) Sanesecurity sigs (phish.ndb) detected this as: Sanesecurity.Malware.24946.MacroHeurGen.RB Sanesecurity sigs (badmacro.ndb) detected this as: Sanesecurity.Badmacro.Doc.CreObj

NOTE

The current round of Word/Excel/XML/Docm attachments are targeted at Windows users. Apple and Android software can open these attachments and may even manage to run the macro embedded inside the attachment. The auto-download file is normally a windows executable and so will not currently run on  any operating system, apart from Windows. However, if you are an Apple/Android user and forward the message to a Windows user, you will them put them at risk of opening the attachment and auto-downloading the malware. Currently these attachments try to auto-download Dridex, which is designed to steal login information regarding your bank accounts (either by key logging, taking auto-screens hots or copying information from your clipboard (copy/paste))

Cheers,

Steve

Sanesecurity.com