Lucene search

CiscoCISCO-THREAT-29815

HistoryJun 27, 2013 - 1:34 p.m.

Threat Outbreak Alert: Fake Bank Payment Notification Email Messages on April 4, 2014

2013-06-2713:34:00

Cisco

tools.cisco.com

JSON

Low

Alert ID:

29815

First Published:

2013 June 27 13:34 GMT

Last Updated:

2014 April 7 11:33 GMT

Version:

Summary

Cisco Security has detected significant activity related to spam email messages that claim to contain a bank payment transfer notification for the recipient. The text in the email message attempts to convince the recipient to open the attachment and view the details. However, the .rar attachment contains a malicious .scr file that, when executed, attempts to infect the system with malicious code.

Email messages that are related to this threat (RuleID6396, RuleID6396KVR, RuleID6396_1KVR, RuleID6396KVR_1, RuleID6396KVR_2, Rule6396KVR_3, and RuleID6396_2KVR) may contain any of the following files:

> TT COPY.rar
TT COPY.exe
T.T_COPY.rar
image.scr
Swift Payment Copy 31 July 2013.rar
Swift Payment Copy 31 July 2013.exe
Swift copy NDB010813.rar
orderrrty.scr
TT_copy.rar
Payment Slip.rar
Payment Slip.scr
New Enquiry.rar
New Enquiry.scr
Payment Slip.exe
Payment_slip.rar
Payment_slip.exe
TT_Copy.exe
TT Payment Copy 22 August 2013.rar
TT Payment Copy 22 August 2013.scr
Swift Payment Copy 22 August 2013.rar
Swift Payment Copy 22 August 2013.scr
PI.rar
PI.exe
TT COPY.scr
TT Payment Copy 26 August 2013.rar
TT Payment Copy 26 August 2013.scr
Swift Payment Copy 26 August 2013.rar
Swift Payment Copy 26 August 2013.scr
TT Copy
Swift Copy.rar
image.exe
RECEIPT.rar
Receipt.exe
payment aggrement.rar
Products 1.exe
P O 008233201.rar
P O 008233201.scr
Remittance Swift Copy.rar
Payment Slip…rar
Payment Slip…exe
_tt payment(1).rar _
tt payment.scr
ScanCopy…rar
Scan Copy.scr
invoice.rar
invoice.pif
FW P.O&SWIFT COPYS.rar
FW P.O&SWIFT COPYS.exe
Official Purchase.rar
image01.scr
Payment_Slipfdp…rar
PAYMEN~1.SCR
tt payment.rar
tt payment.exe
specification (1).zip
specification.exe
specification.zip
Payment Slip…rar
Payment Slip…exe
CATALOGUE.exe
payment.rar
payment.exe
T.T COPY.rar
scan file.scr
Bank Payment Slip.rar
Bank Payment Slip.exe
Bank Payment Slip.scr
Payment Slips.rar
Payment Slips.scr
Payment details.rar
Payment details.exe
payment20130211.rar
payment20130211.scr
Payment_03112013.rar
Payment_03112013.scr
Payment.rar
Payment.exe
Orders1.rar
Orders1.exe
Payment04112013.rar
Payment04112013.scr
Payment copy.rar
Deposit.exe
tt order.rar
ZEsNEuISC.exe
Specification.rar
Payment_copy.rar
Payment_copy.exe
Payment_20130611.rar
Payment_20130611.scr
nday(1).scr
Payment09112013.rar
Payment09112013.scr
bankinslip.rar
po.exe
swift copy.rar
swift copy.exe
payment.exe
payment_20131112.rar
payment_20131112.scr
ORDER.rar
ORDER.exe
scan copy.rar
scan copy.exe
PAYMENT ADVICE.rar
PAYMENT ADVICE.exe
Payment Confirm.rar
Payment Confirm.scr
purchaseorder.rar
poo.exe
TT slip.scr
Catalog.rar
Catalog
swiftcopytransfer.rar
swiftcopytransfer.scr
Profoma Invoice.rar
Profoma Invoice.exe
purchase order and sample.exe
RE PAYMENT COPYs.rar
RE PAYMENT COPYs.exe
payment swfit.rar
payment swfit2.exe
receipt.scr
Payment advise.rar
transfer.exe
New_Order.PO.rar
New_Order.PO.exe
pay details.exe
pay.exe
New_Ordergpj.rar
New_Order?gpj.exe
Order Samples.rar
Order Samples.exe
_TT-COPY.rar
TT-COPY.exe
invoice.exe
confirmation payment_1.rar
confirmation payment.scr
_Bank Receipt.rar
Purchase order.exe
payment copy.rar
payment copy.exe
details_copy.rar
details copy.exe
spec_payment.exe
PODITRACO_bank_slip.rar
poditraco receipt.exe
_New Order Quotation.rar
New Order Quotation.exe
Puchase Order?fdp.rar
Puchase Order?fdp.exe
payment_manager.rar
payment_manager.scr
SWIFT PAYMENT SLIP.rar
IMG_774_663.scr
Payment receipt.rar
Scan.exe
pay slip.exe
TTcopy.rar
TTcopy.exe
Bank copy.rar
Bank copy.exe
_

The TT COPY.exe file in the TT COPY.rar attachment has a file size of 1,772,032 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0xA26DCDE797ABB3DC9D8F2A7283D0F218

The image.scr file in the T.T_COPY.rar attachment has a file size of 1,822,720 bytes. The MD5 checksum is the following string: 0x14CC0C19C1AE1AF6DC623D7E49CBD01E

The Swift Payment Copy 31 July 2013.exe file in the Swift Payment Copy 31 July 2013.rar attachment has a file size of 327,168 bytes. The MD5 checksum is the following string: 0xE56AC8F5EA93B1247FE303A5BF002618

The orderrrty.scr file in the Swift copy NDB010813.rar attachment has a file size of 346,624 bytes. The MD5 checksum is the following string: 0x7B9BA1DAB83918E78B3014C5D066F4DA

A variant of the image.scr file in the TT_copy.rar attachment has a file size of 385,024 bytes. The MD5 checksum is the following string: 0x04AF0F3422CCCB8863AFCBA20C4AFA11

The Payment Slip.scr file in the Payment Slip.rar attachment has a file size of 254,113 bytes. The MD5 checksum is the following string: 0x27C1DD5891330203823E797D199A247D

A third variant of the image.scr file in the TT COPY.rar attachment has a file size of 380,928 bytes. The MD5 checksum is the following string: 0xC8D1AA9468C8124BAF0F57022C94DCA7

The New Enquiry.scr file in the New Enquiry.rar attachment has a file size of 1,132,147 bytes. The MD5 checksum is the following string: 0x3481BA6AB440C97A44761424C6AF642E

The Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 410,624 bytes. The MD5 checksum is the following string: 0x8EDA3394FF1ADAC85FF10620E801BEE4

A variant of the Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 410,624 bytes. The MD5 checksum is the following string: 0x71A30D00B713DB00ADFF038DBCA09287

The Payment_slip.exe file in the Payment_slip.rar attachment has a file size of 751,104 bytes. The MD5 checksum is the following string: 0x43E93846A21A80F924A64E3EF4FA5C36

A third variant of the Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 410,112 bytes. The MD5 checksum is the following string: 0xED7AE1A278A323DAD575AC9223E781E9

The _TT_Copy.exe _file in the TT_Copy.rar attachment has a file size of 411,292 bytes. The MD5 checksum is the following string: 0xC2AB2BFCC7A698624208E3489CE3F92F

A fourth variant of the image.scr file in the PAYMENT SLIP.rar attachment has a file size of 348,160 bytes. The MD5 checksum is the following string: 0xE4A155A94A414ED99243E22EA6C1AA50

A fourth variant of the Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 410,112 bytes. The MD5 checksum is the following string: 0x3BF9078A9DA3AE5D1E27F449A6340196

The TT Payment Copy 22 August 2013.scr file in the_ TT Payment Copy 22 August 2013.rar_ attachment has a file size of 88,064 bytes. The MD5 checksum is the following string: 0x88F156E34A5C336509A88626B8CD7246

The Swift Payment Copy 22 August 2013.scr file in the Swift Payment Copy 22 August 2013.rar attachment has a file size of 325,120 bytes. The MD5 checksum is the following string: 0x29AB70BD2AFC5FC5A8AF4B37C83506C2

A variant of the Swift Payment Copy 22 August 2013.scr file in the Swift Payment Copy 22 August 2013.rar attachment has a file size of 325,120 bytes. The MD5 checksum is the following string: 0x29AB70BD2AFC5FC5A8AF4B37C83506C2

The PI.exe file in the PI.rar attachment has a file size of 306,703 bytes. The MD5 checksum is the following string: 0x52812F5C3FF154115DF2EFBFE27E4CB8

The TT COPY.scr file in the TT COPY.rar attachment has a file size of 466,432 bytes. The MD5 checksum is the following string: 0xFF22FB821E8FC7EDCE83BC71F8AF787F

A fifth variant of the Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 409,088 bytes. The MD5 checksum is the following string: 0x8A1AF236DC9E9682C97E8D30555E84F3

The TT Payment Copy 26 August 2013.scr file in the TT Payment Copy 26 August 2013.rar attachment has a file size of 92,160 bytes. The MD5 checksum is the following string: 0x930A85870301C4BA3D1FFF27E128B676

The Swift Payment Copy 26 August 2013.scr file in the Swift Payment Copy 26 August 2013.rar attachment has a file size of 328,704 bytes. The MD5 checksum is the following string: 0x5C541FA184C4DAB2F019BEB72747EE50

A sixth variant of the Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 410,112 bytes. The MD5 checksum is the following string: 0xF8C42330155F7951FCF9C8734270661B

A seventh variant of the Payment Slip.exe file in the Payment Slip.rar attachment has a file size of 43,008 bytes. The MD5 checksum is the following string: 0xB319BF3E703016994C008B7A4F459B08

The TT Copy file in the TT Copy.rar attachment has a file size of 859,520 bytes. The MD5 checksum is the following string: 0x41D1936CAFB942DE9D987B8A0A2D3F2C

The image.exe file in the Swift Copy.rar attachment has a file size of 548,864 bytes. The MD5 checksum is the following string: 0xD8A332AA965380BD36741451B768360A

The Receipt.exe file in the RECEIPT.rar attachment has a file size of 162,446 bytes. The MD5 checksum is the following string: 0xE2A9494B8B5F00859ABC5B1CB1516A85

The Products 1.exe file in the payment aggrement.rar attachment has a file size of 635,392 bytes. The MD5 checksum is the following string: 0x812989AEC22FB78A55EF0817548F402A

The P O 008233201.scr file in the P O 008233201.rar attachment has a file size of 282,325 bytes. The MD5 checksum is the following string: 0x6A8B2E2A46B8BDFDC3A8D46C09072743

A fifth variant of the image.scr file in the Remittance Swift Copy.rar attachment has a file size of 225,280 bytes. The MD5 checksum is the following string: 0x2032D0CBCFF48EE3082BAA9C79CF84D6

The Payment Slip…exe file in the Payment Slip…rar attachment has a file size of 410,624 bytes. The MD5 checksum is the following string: 0x03283549A342DDB8C29DE3D31B3CDBFF

The tt payment.scr file in the tt payment(1).rar attachment has a file size of 251,025 bytes. The MD5 checksum is the following string: 0xDDCB159C1DF715922BED280563E6D914

The Scan Copy.scr file in the ScanCopy…rar attachment has a file size of 678,912 bytes. The MD5 checksum is the following string: 0x87D2A49D3CF088BE2BE53FBBF3AEAFFF

The invoice.pif file in the invoice.rar attachment has a file size of 362,496 bytes. The MD5 checksum is the following string: 0xBDE19F439A88A544D59B0E423973EA08

The FW P.O&SWIFT COPYS.exe file in the FW P.O&SWIFT COPYS.rar attachment has a file size of 892,928 bytes. The MD5 checksum is the following string: 0x3F9CE4F9BE298A7C7A31D6C9208A68C7

A variant of the TT COPY.exe file in the TT COPY.rar attachment has a file size of 295,637 bytes. The MD5 checksum is the following string: 0x4FB34FFE568BBC0537BC70020BFFCFA5

The image01.scr file in the Official Purchase.rar attachment has a file size of 238,080 bytes. The MD5 checksum is the following string: 0x6118519D5F4DBE1836647B9FBA5FB1F9

The PAYMEN~1.SCR file in the Payment_Slipfdp…rar attachment has a file size of 762,880 bytes. The MD5 checksum is the following string: 0x24C55E393AC015235F532138257C3487

The tt payment.exe file in the tt payment.rar attachment has a file size of 681,984 bytes. The MD5 checksum is the following string: 0xCF8A536AF23E3543DCED583749E2E9B1

A variant of the Payment Slip.scr file in the Payment Slip.rar attachment has a file size of 696,832 bytes. The MD5 checksum is the following string: 0x3FC7AA18548B384D7D3FEB9CDA7D1AB0

A third variant of the Payment Slip.scr file in the Payment Slip.rar attachment has a file size of 757,248 bytes. The MD5 checksum is the following string: 0x5913FF514F532790275294763F06B365

The specification.exe file in the specification (1).zip attachment has a file size of 741,376 bytes. The MD5 checksum is the following string: 0x630E4E0D25E19A1DAB9199DD22B09A49

The Payment Slip…exe file in the Payment Slip…rar attachment has a file size of 781,312 bytes. The MD5 checksum is the following string: 0x55415FD62631E2213B5EFD0D1D3F5293

The fourth variant of the Payment Slip.scr file in the Payment Slip.rar attachment has a file size of 744,448 bytes. The MD5 checksum is the following string: 0x2A7F46D50CDDBFEB04CD22FB3178B81C

The payment slip…exe file in the payment slip…rar attachment has a file size of 737,280 bytes. The MD5 checksum is the following string: 0x783B508168C6AA39AC5AF45375106EFE

A variant of the specification.exe file in the specification.zip attachment has a file size of 676,864 bytes. The MD5 checksum is the following string: 0x3DC76D5E76F6B09D1071B8C562D746A7

A variant of the TT Copy.rar file in the TT Copy.scr attachment has a file size of 287,558 bytes. The MD5 checksum is the following string: 0xE0B93AEA7DE65362FC9235AA3B0EA275

The CATALOGUE.exe file in the payment slip.rar attachment has a file size of 362,497 bytes. The MD5 checksum is the following string: 0x9F01907C1D857B6066601D745E226EDC

The payment.exe file in the payment.rar attachment has a file size of 264,705 bytes. The MD5 checksum is the following string: 0xDBDFF4A2279C7426A756425EBA2AA378

The scan file.scr file in the T.T COPY.rar attachment has a file size of 454,144 bytes. The MD5 checksum is the following string: 0xAF09EBB65117F791AD5537F9FFA93C89

A variant of the TT COPY.exe file in the TT COPY.rar attachment has a file size of 264,705 bytes. The MD5 checksum is the following string: 0x834211998591E353648ADB75AF8E89F6

The Bank Payment Slip.exe file in the _Bank Payment Slip.rar _attachment has a file size of 453,632 bytes. The MD5 checksum is the following string: 0x0E919765EFDEBD331BE10C950D768BF4

A fifth variant of the Payment Slip.scr file in the Payment Slip.rar attachment has a file size of 770,560 bytes. The MD5 checksum is the following string: 0x94CF9B2E56B3E2B0D27BDE5550A2FDE3

The Bank Payment Slip.scr file in the Bank Payment Slip.rar attachment has a file size of 766,464 bytes. The MD5 checksum is the following string: 0x22AD19C61045598B26B1C95BADA56ADD

A variant of the PI.exe file in the PI.rar attachment has a file size of 548,352 bytes. The MD5 checksum is the following string: 0x8F3D5DA27745D5613C03459FB7BA10D7

The Payment Slips.scr file in the Payment Slips.rar attachment has a file size of 734,720 bytes. The MD5 checksum is the following string: 0xE44865BB85586FEBC62E0E879C6861D8

The Payment details.exe file in the Payment details.rar attachment has a file size of 1,348,608 bytes. The MD5 checksum is the following string: 0x17A15CA8FB490E4F9779947CCA43422C

The payment20130211.scr file in the payment20130211.rar attachment has a file size of 53,893 bytes. The MD5 checksum is the following string: 0xAE4856E9B4508716A85CDEE0E5B2DF81

The Payment_03112013.scr file in the Payment_03112013.rar attachment has a file size of 53,893 bytes. The MD5 checksum is the following string: 0x0699EE9CD539426289E5958034474D95

The Payment.exe file in the Payment.rar attachment has a file size of 203,776 bytes. The MD5 checksum is the following string: 0x368069D89363EE7C572E10FCE360E5B4

The Orders1.exe file in the Orders1.rar attachment has a file size of 508,416 bytes. The MD5 checksum is the following string: 0x45BE05CE64D9D939669B873241D9632D

The Payment04112013.scr file in the Payment04112013.rar attachment has a file size of 50,825 bytes. The MD5 checksum is the following string: 0x62C8061FC2D1FF519C01B3F86A3770A5

A variant of the Payment.exe file in the Payment.rar attachment has a file size of 291,841 bytes. The MD5 checksum is the following string: 0xC6B9D8EAD02BD2DD564316F09FC9FDB6

The Deposit.exe file in the Payment copy.rar attachment has a file size of 119,808 bytes. The MD5 checksum is the following string: 0xAF700627A0C69FEBCA124EC57B9AECD6

The ZEsNEuISC.exe file in the tt order.rar attachment has a file size of 180,736 bytes. The MD5 checksum is the following string: 0x2F3C4D9BECBCABEA6368230799455B26

A third variant of the Specification.exe file in the Specification.rar attachment has a file size of 372,736 bytes. The MD5 checksum is the following string: 0xEEB364A94B6891D78CCD153188A9A768

The Payment_copy.exe file in the Payment_copy.rar attachment has a file size of 1,142,784 bytes. The MD5 checksum is the following string: 0x65DCC1E7239A82E80B2CCDB11FA7C5D5

The Payment_20130611.scr file in the Payment_20130611.rar attachment has a file size of 83,968 bytes. The MD5 checksum is the following string: 0x477D9111B0188E5B2A356D78E115A874

The nday(1).scr file in the Swift Copy.rar attachment has a file size of 861,962 bytes. The MD5 checksum is the following string: 0x073A3271FFCED3F544A27CDAB309FFF1

The Payment09112013.scr file in the _Payment09112013.rar _attachment has a file size of 74,388 bytes. The MD5 checksum is the following string: 0x3A26DB5EFC11E8BD801A67A6A9CF2B11

The po.exe file in the bankinslip.rar attachment has a file size of 464,384 bytes. The MD5 checksum is the following string: 0x4363C24B9985634D0B8D2FDB6307E1CB

A sixth variant of the Payment Slip.scr file in the Payment Slip.rar attachment has a file size of 770,560 bytes. The MD5 checksum is the following string: 0x94CF9B2E56B3E2B0D27BDE5550A2FDE3

The swift copy.exe file in the swift copy.rar attachment has a file size of 411,136 bytes. The MD5 checksum is the following string: 0x44388A9765BC2C6CAAD97DE365C8B4E1

The payment.exe file in the payment slip.rar attachment has a file size of 482,817 bytes. The MD5 checksum is the following string: 0x8ACE9E3053C52ED99C043F41801F03FB

A variant of the swift copy.exe file in the swift copy.rar attachment has a file size of 381,952 bytes. The MD5 checksum is the following string: 0x1C3829768E04626FE2F70B7DB306655B

The payment_20131112.scr file in the payment_20131112.rar attachment has a file size of 78,848 bytes. The MD5 checksum is the following string: 0xDC786B04C0C4FDD450F8F4797E8AD24B

The ORDER.exe file in the ORDER.rar attachment has a file size of 329,217 bytes. The MD5 checksum is the following string: 0x380C709C490036240173FB82B13813F1

The _scan copy.exe _file in the scan copy.rar attachment has a file size of 455,168 bytes. The MD5 checksum is the following string: 0x3C5303A904B75B54161EA53CDA1EAE6D

The PAYMENT ADVICE.exe file in the PAYMENT ADVICE.rar attachment has a file size of 873,713 bytes. The MD5 checksum is the following string: 0xB06B022DB6B7B78718239AE3FC038767

The Payment Confirm.scr file in the Payment Confirm.rar attachment has a file size of 1,069,132 bytes. The MD5 checksum is the following string: 0x8B9EF415C069755AA7E52D8DAD5F433A

A variant of the PAYMENT ADVICE.exe file in the PAYMENT ADVICE.rar attachment has a file size of 870,633 bytes. The MD5 checksum is the following string: 0xEC4C1ED13FA14CB72F543141B93F3491

A variant of the SCAN COPY.scr file in the _SCAN COPY.rar _attachment has a file size of 736,256 bytes. The MD5 checksum is the following string: 0x6B5F30803482C8EB98473526B3333623

A variant of the Payment details.exe file in the Payment details.rar attachment has a file size of 577,536 bytes. The MD5 checksum is the following string: 0x0695A19094735DB85CA4180DE33B022A

The poo.exe file in the purchaseorder.rar attachment has a file size of 700,928 bytes. The MD5 checksum is the following string: 0xF8A7E946CEAAE97123BD5BCAC9CF94D6

A variant of the Order.exe file in the Order.rar attachment has a file size of 549,376 bytes. The MD5 checksum is the following string: 0x223C6DAE5E486FF83AA261F91971AC84

The TT slip.scr file in the Swift copy.rar attachment has a file size of 765,675 bytes. The MD5 checksum is the following string: 0x3B1C8F448CDFC3337EE9135AEF3A7567

The Catalog file in the Catalog.rar attachment has a file size of 811,008 bytes. The MD5 checksum is the following string: 0x11E6B068150846A48635FC9029909995

A third variant of the PAYMENT DETAILS.exe file in the PAYMENT DETAILS.rar attachment has a file size of 773,224 bytes. The MD5 checksum is the following string: 0x9DD3288443EA08717DDEF60A3FB0E7FD

The swiftcopytransfer.scr file in the_ swiftcopytransfer.rar_ attachment has a file size of 740,928 bytes. The MD5 checksum is the following string: 0xA081DDB1D040DF988AFF82F8E0DF8370

The Profoma Invoice.exe file in the Profoma Invoice.rar attachment has a file size of 811,008 bytes. The MD5 checksum is the following string: 0xA559AEF7C71ECA93667FC341E588496C

The purchase order and sample.exe file in the _Payment Slip.rar _attachment has a file size of 811,008 bytes. The MD5 checksum is the following string: 0x7A453070E2111B0C302A0ACE38106001

A variant of the Profoma Invoice.exe file in the_ Profoma Invoice.rar_ attachment has a file size of 811,008 bytes. The MD5 checksum is the following string: 0xD393948E0012EBF7806C06E9F53F445A

The RE PAYMENT COPYs.exe file in the RE PAYMENT COPYs.rar attachment has a file size of 487,936 bytes. The MD5 checksum is the following string: 0x3128E399BCEE1F3D0BCB39E1572DAA48

A third variant of the Profoma Invoice.exe file in the Profoma Invoice.rar attachment has a file size of 577,536 bytes. The MD5 checksum is the following string: 0x8706E08CD80081892FBC26DD255DD151

The receipt.scr file in the receipt.rar attachment has a file size of 86,016 bytes. The MD5 checksum is the following string: 0xCC3B76CD3F38D5089E014A0762E23ED4

The payment swfit2.exe file in the payment swfit.rar attachment has a file size of 973,233 bytes. The MD5 checksum is the following string:0xFC3CD1FCF4BDE4D255CF4DAB6F2F5AD6

The transfer.exe file in the Payment advise.rar attachment has a file size of 1,530,880 bytes. The MD5 checksum is the following string: 0x6BE12CCF533D6575A4564B556B51B9FD

The_ New_Order.PO.exe_ file in the _New_Order.PO.rar _attachment has a file size of 665,913 bytes. The MD5 checksum is the following string: 0xD1C7B1B8A24F72040A4F82A81BC6378F

A fourth variant of the Profoma Invoice.exe file in the_ Profoma Invoice.rar_ attachment has a file size of 811,008 bytes. The MD5 checksum is the following string: 0xFC2576A2883DE7ED3F30B1FCBF937E38

The pay details.exe file in the payment.rar attachment has a file size of 309,248 bytes. The MD5 checksum is the following string: 0x0EE992C03F2D68CA29A50760A16C096D

The_ pay.exe_ file in the _payment.rar _attachment has a file size of 185,344 bytes. The MD5 checksum is the following string: 0x6563B60743ED482083A629F44087C43F

The New_Order?gpj.exe file in the New_Ordergpj.rar attachment has a file size of 487,424 bytes. The MD5 checksum is the following string: 0x60DB18A49BDC630BEE09985A07FE0FB5

The Order Samples.exe file in the_ Order Samples.rar _attachment has a file size of 626,688 bytes. The MD5 checksum is the following string: 0xA4DFDF3BB4E79C3854B4256A101B3003

The TT-COPY.exe file in the TT-COPY.rar attachment has a file size of 1,059,896 bytes. The MD5 checksum is the following string: 0xBB40AFB3F9ADB06C38569D1B8990342C

The invoice.exe file in the invoice.rar attachment has a file size of 963,137 bytes. The MD5 checksum is the following string: 0x92441DA74A68E4398B33EAAECA20BC3A

The confirmation payment.scr file in the confirmation payment_1.rar attachment has a file size of 4,433,408 bytes. The MD5 checksum is the following string: 0x3A6C3A1DB7BCB599E83FFF4068E0F695

The Purchase order.exe file in the Bank Receipt.rar attachment has a file size of 928,152 bytes. The MD5 checksum is the following string: 0xA0A6AE98A78D7F1BF2FEFE2C47FD4981

The payment copy.exe file in the payment copy.rar attachment has a file size of 678,912 bytes. The MD5 checksum is the following string: 0x22BEAEDEA85D4DD87CA4AFA589936536

A variant of the Payment Slips.scr file in the Payment Slips.rar attachment has a file size of 293,440 bytes. The MD5 checksum is the following string: 0x95CBFEB3D891BE45C707B2649CA7662C

The details copy.exe file in the details_copy.rar attachment has a file size of 361,472 bytes. The MD5 checksum is the following string: 0xEA77BE77898A87C56835A45C9E629007

The spec_payment.exe file in the TT_copy.rar attachment has a file size of 268,800 bytes. The MD5 checksum is the following string: 0x024911A8DC60CF3E133010C657A95362

A variant of the payment copy.exe file in the payment copy.rar attachment has a file size of 501,760 bytes. The MD5 checksum is the following string: 0xDAB778E7F2A979E8381BF90977A1F514

The poditraco receipt.exe file in the PODITRACO_bank_slip.rar attachment has a file size of 268,288 bytes. The MD5 checksum is the following string: 0x2CB1903275E35C09FCDC135FA311B91E

The _New Order Quotation.exe _file in the New Order Quotation.rar attachment has a file size of 1,534,976 bytes. The MD5 checksum is the following string: 0x9FB1BCDBC969FA43C8EAADD5D3A0944A

The_ Puchase Order?fdp.exe _file in the Puchase Order?fdp.rar attachment has a file size of 615,424 bytes. The MD5 checksum is the following string: 0xFA1D3C4DD7BD4DD3779093AEA337FD56

The payment_manager.scr file in the payment_manager.rar attachment has an approximate file size of 92,600 bytes. The MD5 checksum is not available.

A fifth variant of the Profoma Invoice.exe file in the Profoma Invoice.rar attachment has a file size of 1,143,808 bytes. The MD5 checksum is the following string: 0x1F64C1DE1DD0DC5720095A77105A07CA

The IMG_774_663.scr file in the SWIFT PAYMENT SLIP.rar attachment has a file size of 1,304,675 bytes. The MD5 checksum is the following string: 0x1E14F63AF7A5C59B85191FBE1109C07D

The Scan.exe file in the Payment receipt.rar attachment has a file size of 690,176 bytes. The MD5 checksum is the following string: 0x2B9321F6047B40828007C7B7743EE1BD

The _pay slip.exe _file in the _Payment slip.rar _attachment has a file size of 1,408,855 bytes. The MD5 checksum is the following string: 0x5002EF3C6FD0013A7A43AA7ACB231FF8

The TTcopy.exe file in the _TTcopy.rar _attachment has a file size of 444,657 bytes. The MD5 checksum is the following string: 0x06000C5571C1B245925CF3450AA8F477

The _Bank copy.exe _file in the Bank copy.rar attachment has a file size of 1,470,020 bytes. The MD5 checksum is the following string: 0x2E4EB83215BDDFC8B901A4B0C4BC6D23

The following text section is a sample of the email message that is associated with this threat outbreak:

> Message Body:

**Attn Sir/ Madam,
Pls Find attached, the transfer copy of payment made today to your account.
Let me know as soon as you have confirmed the funds in your account.
Thanks & Regards,
Peter Baquero
Client Relationship Partner **

> Message Body:

**Dear Sir,
Very sorry for delay, We have been out of office, just back.
Pls see attached swift copy for payment remitted today 31th July, 2013.
I will be waiting for your urgent reply. please inform us.
Your urgent feedback will be highly appreciated, for us to know when you will effect our shipment,
Waiting for your reply.
Best regards
Z.X.Deng **

> Subject: Re: Re: Payment Slip

Message Body:

**Dear Sir /Madam
How are you? Thanks for your email, Attachment is the payment slip.
i wait your confirmation.
Best regards
Smith. **

> Subject: Re: Re: Invoice

Message Body:

**Dear Sir/ Madam,
Good day,sorry for the delay in reply, Attached is the payment slip.hope to hear from you as soon as possible.
Thanks
M & Q metals ltd **

> Subject: Re: Bank Advice from HSBC

Message Body:

Dear Sir/Madam, The attached payment advice is issued at the request of our
customer. The advice is for your reference only. Yours faithfully, Global Payments
and Cash Management HSBC. This is an auto-generated email, please DO NOT REPLY.
Any replies to this email will be disregarded.

> Subject: Attached payment slip

Message Body:

Dear Sir /Madam
How are you? Thanks for your email, Attachment is the payment slip.
i wait your confirmation.
Best regards
Smith.

> Subject: PI COPY

Message Body:

Dear sir,
We deposited the remaining amount into your account on 23/08/2013.Find attached PI/order number for review and confirmation.We believe our goods will be delivered before 1st week of September.
Truly,
Khalid Mohammed
Sales director
AL BARID COMPANY LLC

> Message Body:

Please find the two attached file of the swift payment of $38,750 We
transferred to your account on behalf of your customer.
Regards,
Dubai Exchange LLC.

> Subject: Re: Re: Payment Slip

Message Body:

Dear Sir /Madam
How are you? Thanks for your email, Attachment is the payment slip.
i wait your confirmation.
Best regards
Smith.

> Subject: Find Attached Copy of the TT slip

Message Body:

> Dear Sir
>
> Find attached transfer Payment slip copy.
>
> We have finally wired the deposit payment to your account today.
>
> Please confirm from your bank and start working on the delivery of our items ASAP.
>
> Accounts Department.
>
> Best regards,
>
> Ahmed Abdulrahman
> Chief Acct
> AL SAHOO TRADING CO WLL.

> Message Body:

Hello Sir,
Please check the attachment for the part payment details for the delivery of the items to our shipment office. Please confirm and get back to us via office Email asap.
Best Regards
Hazira Sai Bukai.

> Subject: Fwd: Purchase_order

Message Body:

Hello ,
Kindly find attached the TT Payment copy that was transferred to
your account and let us know when the shipment will commence.
Regards.
–
We Sincerely Hope To Hear From You Soon
Thanks & Regards
Mr Hasbian.
Sales Manager
–––––––––––––––––––––––––––––––––––––––––––––––––––-
DISCLAIMER
Privileged/Confidential information may be contained in this
communication (which includes any attachment).
If you are not an intended recipient, you must not use, copy, disclose,
distribute or retain this communication or any part of it. Instead,
please delete all copies of this communication from your computer system
and notify the company.

> Subject: Fwd: Payment Slip

Message Body:

Dear Sir/ Madam,
Good day,sorry for the delay in reply, Attached is the payment slip.hope to hear from you as soon as possible
Thanks
AD METALS LTD

> Message Body:

Hello,
Advance payment was successfully sent out to your bank account today,
please check the attached payment confirmation for details.
Best regards.

> Message Body:

Here is the transfer copy slip of the payment made ,please confirm
the account and kindly find the attach copy and get back to us with
original BL COPY

> Message Body:

Good day
The Payment has been made to your account today,
Attached is the Payment Slip Copy
Please confirm and get back to me
Best regards,
spark
Citadel Efficiency Market

> Message Body:

Dear sir/Madam,
Please we are very sorry for the delays in making the payment, today we have remitted payment against your INVOICE.
Find attached TT copy of payment of $140,000 USD made to your account.
kindly confirm the BANK SLIP attached.
Pls send to me final copy B/L and Form E copy.
We Will send balance after
receiving BL
Thanks,
Aiman Al Amoudi.

> Subject: Re: The Payment

Message Body:
**
Dear Sir /Madam
How are you? Thanks for your email, Attachment is the payment slip.
i wait your confirmation.
Best regards
Frau Eunice Meyer,
AG Allgemeine Anlageverwaltung (AAA).**

> Message Body:

Find attached the payment slip of the payment made to your bank account
and our new order on the zip file.
kindly confirm as soon as you receive the payment in your bank account.
Best Regards

> Subject: Fw: Payment Slip

> Message Body:

> Message Body:

_____________________________________________
Best Regards

> Message Body:

_______________________________________________
With best Regards

> Message Body:

Dear Sir/Ma,
We have had a total check with your company products and found the exact products we want with your company. We hereby have placed our order with your company.
Find attached our purchase order, and send us signed Proforma Invoice and bank detail so we can remit payment to your bank immediately.
Please send us Proforma Invoice as soon as possible and confirm shipping date not later than end of November.

> Message Body:

––––––––––––––––––––––––––––––
With Best Regards –––––––––––––––––-

> Message Body:

Dear Sir,
The Payment has been made to the account today,
Attached is the Payment Slip Copy
Please confirm to us by reply.
Best Regards
Ann
Sales Executive Manager
Ph: 3242 9566-3242 5097

> Message Body:

Dear Supplier,
Good day!!
How are you? Have you received my email? Would you please check attachmentand make the adjustment for the prices.
And about the following four items: for the products we are interested in please quote us your best prices please don’t hesitate to contact with me.
Best regards,
Neil
ITTL TOOLS LTD

> Subject: Swift Copy

Message Body:

Dear Sir,
Please find attached Transfer Swift Copy wired to your Bank Account today
as instructed by our client for last Proforma Invoice / Order.
Kindly acknowledge receipt and confirm same to our client, including the
Order Shipment and Delivery Date.
Regards.
Alvin George.
Transfer Department.
H. Forex and Transfer Exchange.
201 Bishops-gate
London EC2M 3AB
United Kingdom

> Subject: Re: The Payment

Message Body:

Attention: Sir / Madam
Please we are very sorry for the delays in making the payment, today we have remitted payment against your INVOICE.
Find attached TT copy of payment OR CLICK HERE TO VIEW Payment made to your account, kindly confirm the BANK SLIP attached and send to me final copy B/L and Form E copy
Thanks
Frau Eunice Meyer,
AG Allgemeine Anlageverwaltung (AAA).

> Subject:** Payment Copy**

Message Body:

Dear Sir,
I’ve been waiting for your reply since last week after finally scheduled payment of the balance of your bank account…
I attach back the payment copy to you.
Please confirm your bank and proceed with shipping this week.
We are waiting for confirmation of your payment.
Accounts Department
Mogens Pedersen
Changzhou XNE Group

> Subject: PAYMENT ADVICE

Message Body:

Dear Sir,
We are going to transfer payment to your bank account today. Kindly
confirm the attached bank account wire instruction is correct before we
make payments today.
Gradi Srl-Trade
Marcinkowo 154
11-700 Mragowo

> Subject:** Remittance Swift Copy.**

Message Body:

Dear Sir,
This is with reference to the payment we made to your account and This is the second time i am contacting you on this issue without a single response from you!
For easy reference, we are attaching scan copies of the payment details is also attached in a zip folder
Kindly extract the payment details from the zip folder to your desktop and open to view the details as you may not be able to view it from the zip folder
Please dont forget to get back to me after collecting the money so i can tell you what to do next
Regards!

> Message Body:

**Classified-By: [email protected]
Action: move
Source-Folder: /Vacation
Destination-Folder: /Junk
Destination-Mailbox: Find attached transfer copy.
we have made payment today against the invoice no 3746473.
Please confirm from your bank and proceed with production ASAP.
We await confirmation,
Best Gulf Trading Co. L.L.C.
**

> Subject: Please Send sample!

Message Body:

**Greetings!
As per our conversation, please find attached quotation and catalog.
Please feel free to contact us in case of any query/information.
Warm Regards,
Anirudh Aneja.
DELLA EX-TRADING COMPANY
No , 28 , Arcot Road , 1st Floor .
Porur Chennai 600 116. (India).
Tel: + 91 - 44 - 42051110.
**

> Message Body:

**Attention: Sir / Madam
Please we are very sorry for the delays in making the payment, today we have remitted payment against your INVOICE.
Find attached TT copy of the remain balance payment made to your account, kindly confirm the BANK SLIP attached
Pls send to me final copy B/L and Form E copy
Thanks
Best Regards,
Best regards
Roberto Shawery
Reximine INC
1401 Broadway St
Marseilles, IL 613412067
USA.
Tel: +15164769541
**

Or** **

> Subject: invoice payment

Message Body:

**Kindly Find attached tt copy on behalf of client also let us know lead time of shipment
SONIA MOORE
Senior Executive
**

> Subject: PAYMENT COPY COMFIRMATION

Message Body:

Dear Sir,
We are about to transfer payment to your bank account now. Kindly confirm the attached bank account information is correct before we make payments.
Gradi Srl-Trade
Marcinkowo 154
11-700 agowo
tEL: 742-108-26-11

> Subject: Fwd: Payment Advice

Message Body:

Good Day,
We’ve made the payment, find attachment slips please courier the bills asap.
Sent from my iPhone®

> Message Body:

**(See attached file: New Order.eml)
This communication may contain privileged and/or confidential information. It is intended solely for the use of the addressee. If you are not the intended recipient, you are strictly prohibited from disclosing, copying, distributing or using any of this information. If you received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. This communication may contain nonpublic personal information about consumers subject to the restrictions of the Gramm-Leach-Bliley Act. You may not directly or indirectly reuse or redisclose such information for any purpose other than to provide the services for which you are receiving the information.
127 Public Square, Cleveland, OH 44114
If you prefer not to receive future e-mail offers for products or services from Key
send an e-mail to mailto:[email protected] with ‘No Promotional E-mails’ in the SUBJECT line.
**

> Message Body:

REGARDS
--
Changzhou Start Imp.&Exp. Co., Ltd
Add: No.2323 Fudu Business Apartment, No.398 Tongjiang Road, Xinbei District, Changzhou, Jiangsu, China #213022
Tel/Fax: (+86)519-85108158
Mob/Whatsapp: (+86)13906116641
Skype: estella.chin8
Primary Email Add: [email protected]
Stand-by Email Add: [email protected]

> > Cisco Security analysts examine real-world email traffic data that is collected from over 100,000 contributing organizations worldwide. This data helps provide a range of information about and analysis of global email security threats and trends. Cisco will continue to monitor this threat and automatically adapt systems to protect customers. This report will be updated if there are significant changes or if the risk to end users increases.

Cisco Virus Outbreak Filters protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Email that is managed by Cisco and end users who are protected by Cisco web security appliances will not be impacted by these attacks. Cisco appliances are automatically updated to prevent both spam email and hostile web URLs from being passed to the end user.

Revision History

* Version	Description	Date
78	Cisco Security has detected significant activity on April 4, 2014.	2014-April-07 11:33 GMT
77	Cisco Security has detected significant activity on March 31, 2014.	2014-April-01 11:43 GMT
76	Cisco Security has detected significant activity on March 28, 2014.	2014-March-28 20:07 GMT
75	Cisco Security has detected significant activity on February 27, 2014.	2014-March-03 13:23 GMT
74	Cisco Security has detected significant activity on February 20, 2014.	2014-February-21 13:23 GMT
73	Cisco Security has detected significant activity on February 14, 2014.	2014-February-17 13:52 GMT
72	Cisco Security has detected significant activity on February 12, 2014.	2014-February-14 14:01 GMT
71	Cisco Security has detected significant activity on February 2, 2014.	2014-February-03 14:05 GMT
70	Cisco Security has detected significant activity on January 30, 2014.	2014-January-31 21:14 GMT
69	Cisco Security has detected significant activity on January 24, 2014.	2014-January-24 20:30 GMT
68	Cisco Security has detected significant activity on January 23, 2014.	2014-January-24 12:40 GMT
67	Cisco Security has detected significant activity on January 17, 2014.	2014-January-21 14:17 GMT
66	Cisco Security has detected significant activity on January 12, 2014.	2014-January-13 14:07 GMT
65	Cisco Security has detected significant activity on January 8, 2014.	2014-January-09 16:18 GMT
64	Cisco Security has detected significant activity on December 31, 2013.	2014-January-07 13:32 GMT
63	Cisco Security has detected significant activity on December 21, 2013.	2013-December-23 13:35 GMT
62	Cisco Security has detected significant activity on December 19, 2013.	2013-December-20 13:18 GMT
61	Cisco Security has detected significant activity on December 19, 2013.	2013-December-19 14:21 GMT
60	Cisco Security has detected significant activity on December 17, 2013.	2013-December-18 13:44 GMT
59	Cisco Security has detected significant activity on December 16, 2013.	2013-December-17 14:11 GMT
58	Cisco Security has detected significant activity on December 11, 2013.

| | 2013-December-13 05:38 GMT
57 | Cisco Security has detected significant activity on December 11, 2013.

| | 2013-December-12 15:18 GMT
56 | Cisco Security has detected significant activity on December 8, 2013.

| | 2013-December-09 19:47 GMT
55 | Cisco Security has detected significant activity on December 6, 2013.

| | 2013-December-09 16:16 GMT
54 | Cisco Security has detected significant activity on December 4, 2013.

| | 2013-December-05 14:33 GMT
53 | Cisco Security has detected significant activity on December 2, 2013.

| | 2013-December-03 23:03 GMT
52 | Cisco Security has detected significant activity on November 26, 2013.

| | 2013-December-02 15:19 GMT
51 | Cisco Security has detected significant activity on November 26, 2013.

| | 2013-November-27 15:18 GMT
50 | Cisco Security has detected significant activity on November 21, 2013.

| | 2013-November-22 18:30 GMT
49 | Cisco Security has detected significant activity on November 20, 2013.

| | 2013-November-21 16:18 GMT
48 | Cisco Security has detected significant activity on November 18, 2013.

| | 2013-November-19 13:14 GMT
47 | Cisco Security has detected significant activity on November 13, 2013.

| | 2013-November-15 17:48 GMT
46 | Cisco Security has detected significant activity on November 13, 2013.

| | 2013-November-14 16:45 GMT
45 | Cisco Security has detected significant activity on November 11, 2013.

| | 2013-November-12 22:13 GMT
44 | Cisco Security has detected significant activity on November 9, 2013.

| | 2013-November-11 21:01 GMT
43 | Cisco Security has detected significant activity on November 7, 2013.

| | 2013-November-08 21:04 GMT
42 | Cisco Security has detected significant activity on November 5, 2013.

| | 2013-November-07 15:08 GMT
41 | Cisco Security has detected significant activity on November 5, 2013.

| | 2013-November-06 16:51 GMT
40 | Cisco Security has detected significant activity on November 4, 2013.

| | 2013-November-05 18:56 GMT
39 | Cisco Security has detected significant activity on November 3, 2013.

| | 2013-November-04 20:53 GMT
38 | Cisco Security has detected significant activity on October 31, 2013.

| | 2013-October-31 20:08 GMT
37 | Cisco Security has detected significant activity on October 29, 2013.

| | 2013-October-30 18:57 GMT
36 | Cisco Security has detected significant activity on October 28, 2013.

| | 2013-October-29 13:35 GMT
35 | Cisco Security has detected significant activity on October 28, 2013.

| | 2013-October-28 14:23 GMT
34 | Cisco Security has detected significant activity on October 23, 2013.

| | 2013-October-24 16:47 GMT
33 | Cisco Security has detected significant activity on October 17, 2013.

| | 2013-October-18 14:07 GMT
32 | Cisco Security has detected significant activity on October 11, 2013.

| | 2013-October-11 18:53 GMT
31 | Cisco Security has detected significant activity on October 8, 2013.

| | 2013-October-09 13:40 GMT
30 | Cisco Security has detected significant activity on October 7, 2013.

| | 2013-October-07 16:08 GMT
29 | Cisco Security has detected significant activity on September 30, 2013.

| | 2013-October-01 13:17 GMT
28 | Cisco Security has detected significant activity on September 30, 2013.

| | 2013-September-30 17:44 GMT
27 | Cisco Security has detected significant activity on September 26, 2013.

| | 2013-September-27 13:02 GMT
26 | Cisco Security has detected significant activity on September 25, 2013.

| | 2013-September-25 14:04 GMT
25 | Cisco Security has detected significant activity on September 23, 2013.

| | 2013-September-23 12:20 GMT
24 | Cisco Security has detected significant activity on September 20, 2013.

| | 2013-September-20 13:51 GMT
23 | Cisco Security has detected significant activity on September 10, 2013.

| | 2013-September-11 15:09 GMT
22 | Cisco Security has detected significant activity on September 9, 2013.

| | 2013-September-09 16:33 GMT
21 | Cisco Security has detected significant activity on September 5, 2013.

| | 2013-September-06 13:49 GMT
20 | Cisco Security has detected significant activity on September 5, 2013.

| | 2013-September-05 18:34 GMT
19 | Cisco Security has detected significant activity on September 4, 2013.

| | 2013-September-05 15:37 GMT
18 | Cisco Security has detected significant activity on August 30, 2013.

| | 2013-August-30 12:05 GMT
17 | Cisco Security has detected significant activity on August 27, 2013.

| | 2013-August-28 12:17 GMT
16 | Cisco Security has detected significant activity on August 27, 2013.

| | 2013-August-27 17:52 GMT
15 | Cisco Security has detected significant activity on August 26, 2013.

| | 2013-August-26 13:13 GMT
14 | Cisco Security has detected significant activity on August 22, 2013.

| | 2013-August-23 15:07 GMT
13 | Cisco Security has detected significant activity on August 22, 2013.

| | 2013-August-23 12:44 GMT
12 | Cisco Security has detected significant activity on August 20, 2013.

| | 2013-August-20 15:24 GMT
11 | Cisco Security has detected significant activity on August 16, 2013.

| | 2013-August-19 17:21 GMT
10 | Cisco Security has detected significant activity on August 16, 2013.

| | 2013-August-16 18:19 GMT
9 | Cisco Security has detected significant activity on August 13, 2013.

| | 2013-August-13 16:05 GMT
8 | Cisco Security has detected significant activity on August 10, 2013.

| | 2013-August-12 11:33 GMT
7 | Cisco Security has detected significant activity on August 7, 2013.

| | 2013-August-07 19:29 GMT
6 | Cisco Security has detected significant activity on August 6, 2013.

| | 2013-August-07 12:38 GMT
5 | Cisco Security has detected significant activity on August 5, 2013.

| | 2013-August-05 14:05 GMT
4 | Cisco Security has detected significant activity on August 4, 2013.

| | 2013-August-05 12:17 GMT
3 | Cisco Security has detected significant activity on August 1, 2013.

| | 2013-August-01 15:56 GMT
2 | Cisco Security has detected significant activity on July 7, 2013.

Legal Disclaimer

THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products

JSON