Author Archives: Myonlinesecurity

credit note from random companies – JS malware leads to ransomware

Posted on by

Last revised or Updated on: 22nd March, 2016, 7:20 AMAn email with the subject of  Credit Note CN-73290 from On Semiconductor Corp for [redacted] (0312)  pretending to come from Accounts <message-service@post.xero.com> with a zip attachment is another one from the current bot runs which downloads some sort of ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. These don’t look like either Locky or Teslacrypt ransomware so it appears that another gang of bad actors are using the same email templates as the 2 prolific malspammers … Continue reading → Continue reading credit note from random companies – JS malware leads to ransomware→

Your account ID:98938 has been suspended. – JS malware leads to teslacrypt

Posted on by

Last revised or Updated on: 21st March, 2016, 5:45 PMAn email with the subject of   Your account ID:98938 has been suspended. [ random numbered]  coming from random names and email addresses  with a zip attachment is another one from the current bot runs which downloads teslacrypt They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: random email addresses Date: Beatriz gepp <geppBeatriz957@jjdior.com> Subject:  Your account ID:98938 has been suspended. Attachment: warning_letter_34692556.zip Body content: Your bank account associated with the ID:98938 has been … Continue reading → Continue reading Your account ID:98938 has been suspended. – JS malware leads to teslacrypt→

FW: Notification from random company name – word doc rtf macro malware

Posted on by

Last revised or Updated on: 18th March, 2016, 4:31 PMFollowing on from this post is an email with the subject of  FW: Notification from [random company name] pretending to come from random names and email addresses  with a malicious word doc rtf attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. some … Continue reading → Continue reading FW: Notification from random company name – word doc rtf macro malware→

blank email saying Attached Image pretending to come from a scanner or copier at your own domain – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 18th March, 2016, 12:37 PMA blank email with the subject of  Attached Image pretending to come from a scanner, copier or multi-functional device at your own domain with a random numbered zip attachment is another one from the current bot runs which downloads Locky ransomware and a separate password stealer Now the nemucod  .JS downloader inside the zip contacts 2 different download locations and downloads Locky ransomware from 1 location and  a password stealer from the second location. This is really evil, first they steal your passwords, bank details and anything and everything else that they want, then they lock and encrypt all your files and demand a ransom of several hundred UK pounds or US … Continue reading → Continue reading blank email saying Attached Image pretending to come from a scanner or copier at your own domain – JS malware leads to Locky ransomware→

UKMail Customer Services Proof of Delivery Report: 16/03/16-17/03/16 – word doc macro malware leads to Dridex

Posted on by

Last revised or Updated on: 18th March, 2016, 10:18 AMAn email with the subject of  Proof of Delivery Report: 16/03/16-17/03/16 pretending to come from UKMail Customer Services <list_reportservices@ukmail.com>  with a malicious word doc or Excel XLS spreadsheet attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: UKMail … Continue reading → Continue reading UKMail Customer Services Proof of Delivery Report: 16/03/16-17/03/16 – word doc macro malware leads to Dridex→

FedEx Problems with item delivery, n.00196222 Shawn Maddox – JS malware leads to ransomware

Posted on by

Last revised or Updated on: 18th March, 2016, 6:56 AMAn email with the subject of  FedEx_00196222.zip pretending to come from  mogotoys@server.robo-apps.com; on behalf of; FedEx 2Day <shawn.maddox@mogotoys.com>  with a zip attachment is another one from the current bot runs which downloads ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: mogotoys@server.robo-apps.com; on behalf of; FedEx 2Day <shawn.maddox@mogotoys.com> Date: Fri 18/03/2016 02:49 Subject: Problems with item delivery, n.00196222 Attachment: FedEx_00196222.zip Body content: Dear Customer,  Your parcel has arrived at March 15. Courier was … Continue reading → Continue reading FedEx Problems with item delivery, n.00196222 Shawn Maddox – JS malware leads to ransomware→

Invoice DOINV32142 from Tip Top Delivery – word RTF malware leads to Dridex

Posted on by

Last revised or Updated on: 17th March, 2016, 5:34 PMAn email with the subject of  Invoice DOINV32142 from Tip Top Delivery ( random characters)   pretending to come from  random email addresses with a malicious word doc RTF attachment  is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex or Dyreza and ransomware like Locky, cryptolocker or Teslacrypt. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The email looks like: From: random … Continue reading → Continue reading Invoice DOINV32142 from Tip Top Delivery – word RTF malware leads to Dridex→

PDFPart2.pdf Sent from my Samsung Galaxy Note 4 – powered by Three – JS malware leads to Locky ransomware

Posted on by

Last revised or Updated on: 17th March, 2016, 1:36 PMAn email with the subject of  PDFPart2.pdf pretending to come from Administrator  admin@ your own email domain with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Almost all of these are misconfigured and broken and look like this when received in an email client. Some email servers will fix the misconfiguration and deliver a working email. All the ones I have … Continue reading → Continue reading PDFPart2.pdf Sent from my Samsung Galaxy Note 4 – powered by Three – JS malware leads to Locky ransomware→