Threat Outbreak Alert RuleID8337KVR: Email Messages Distributing Malicious Software on September 26, 2016

2014-09-30T12:53:39
ID CISCO-THREAT-35872
Type ciscothreats
Reporter Cisco
Modified 2016-09-27T13:50:49

Description

Medium

Alert ID:

35872

First Published:

2014 September 30 12:53 GMT

Last Updated:

2016 September 27 13:50 GMT

Version:

15

Summary

  • Cisco Security has detected significant activity related to spam email messages distributing malicious software.

Email messages that are related to this threat (RuleID8337 and RuleID8337KVR) may contain the following files:

Name | Size in Bytes | MD5 Checksum
---|---|---
Document.zip / Document.scr
| 1,549,312
| 0x7FC61F402915476B580B5F4D9FECB925

payment slip.zip / payment slip.exe
| 653,824
| 0xB74427F7A02F15222AC22707AA3C55B5

Nicht.zip / Forderung 26.09.2014 - Rechnungsstelle Facebook GmbH.com
| 104,448
| 0x8618DD93D985E877D6C5DB00128A599D

bill_com_Payment_Details_147433-760939.zip /
bill_com_paymentdetails_ 7544265232436654534.pdf.exe
| 376,832 | 0xC044345DBFA2FAF6220ACB324C8F3724

bill_com_Payment_Details_386711-455162.zip /
bill_com_payment_details_ ID0000012773616632715381235.pdf.exe
| 376,832
| 0xAD24CD2E14DCBF199078BDBBAE4BF0CA

Comprovante_Deposito_ DOC.zip / Comprovante_Deposito_ DOC.exe
| 582,656
| 0x2C33D273A7A09413557A1AA397EB5A56

ET-86831013.zip / TicketDA.exe | 102,400
| 0x14E0C60F51A53405C25B03D5158F29ED

dhl_shipping_order_no_92820929283_received.zip /
dhl_shipping_order_no_92820929283_received.exe
| 643,072
| 0x627FC15463572121115CDE056835832E

BANK COPY 54456.zip / chiefo11.exe
| 1,827,328
| 0xD1BC3F74C4E06B270CFA8935ED406230

Payment_Slip.zip / Payment_Slip.scr
| 440,320
| 0x6A4B2BA53900AEEFCA2F8D00A9732C91

order.zip / order.scr
| 581,632
| 0x4C2E9E0FD9F4121ECEFEF3C37D244EC6

PRODUCT SAMPLE.PDF.JPG.zip / PRODUCT SAMPLE.scr
| 440,320
| 0xD8E8232B573C5FB4FBA27B63DE520219

Doc .0143 Sample.zip / Doc .0143 Sample.exe
| 553,984
| 0x539D4251BEE30D00E37EEDD0CC86CE52

PAYMENT SLIP.zip / payments-details (5).exe
| 1,537,536
| 0xDAE68170343742C1AEE398A4390FB26
PO-0017384-Order-pdf.zip / PO-0017384-Order-pdf.exe | 572,928 | 0xE7C837125F34E8AEC9583999F085FCD4
product sample.zip / product sample.exe
| 241,664 | 0x81C35FED2AE5FC9C4F46FA3636C9876C
Forderung stornierten Buchung Ihrer Bestellung Ebay vom 29.09.2014.zip /
Forderung 29.09.2014 - Stellvertretender Rechtsanwalt Ebay GmbH.com
| 90,112 | 0x86BEC88B8BACEAC36777D99B7CE8FC2F

Remttnce TT copy.zip / Remittance invoice.xl.scr
| 1,182,276 | 0x1C18FA8605688225D3D43CF53FE5674F
New-Order.xls.zip / New-Order.xls.exe | 378,781
| 0x5AF76BA392CF285EBEA0DA715B828496
Invoices.exe | 995,328 | 0xBD8BCC6F0125179B357FEF6924E5DC0A
Order#04356.zip / Order#04356.exe | 1,128,960
| 0x4A14552FA081A55EDF4B60036AA07BE4

NFe35160704429377000626550180000994151005007354-xml.zip /
NFe35160704429377000626550180000994151005007354-xml.jar | 132,061
| 0x60E1EE34A391F994EDB57BB33F74591E

purchase order - no. BN00089312 TLP545J.zip /
purchase order - no. BN00089312 TLP545J.exe | 200,704
| 0x45DC91912ADFF5240940CF37E5CE4B77

Swift_copy.zip / Swift_copy.exe | 856,064
| 0xD63A61AF9A7ACCCA79553B8DF058EEBF

Payment_Copy.zip / Payment_Copy.vbs | Not Availabl | 0xD706EA5A10662207A139B47100DC0BCC

order #PO-16-000750.zip / order #PO-16-000750.exe | 774,144
| 0x0E97C5A15418C1F1E72851820BA64989

slip.zip / slip.jar | Not Available
| 0xE90E8BC33811F82FA661C155BF53D415

Order#331-16.jar | Not Available
| 0x132326C5B92FB6DF773C716BBCD1C6F3

ORDER.zip / ORDER.exe | 1,249,280
| 0x2A7E3C02C9E98A51AE61862172454DBE

Order.zip / Order.exe | 152,576 | 0x06770DBC85A342A451F1A811F27E993D
Paymentslip.jar | Not Available | 0xFD45F35BC2632F08E1C6353ACD6A36EC
JX-100LED.zip / Balance Payment.exe | 397,312 | 0xB516D098EFBB565F7E518D2B7D20AF7D
BOA Wire Transfer Slip.zip / BOA Wire Transfer Slip.exe | Not Available | 0xAD7B8B62E50B1B08887820AF03664E48

Payment Advice.zip / Payment Advice.exe | 1,420,288
| 0x9C4E8ECA4DDB38FACAD436DE7EDF1CEC

purchase order.ace / purchase order.exe | Not Available | 0xF1B6D0FE8B2A3DA49A7D0EE980EF2F2B

ORDER#325434.jar | Not Available | 0xBC90618576A37893994F984374EAA41A

revised order.jar | 236,259 | 0xA599D3B27208181EE15117BDDA5A1D06
Swift Copy.jar | 236,681 | 0xF3BD0B5D369C364FCC8024836155A912
Order Confirmation.zip / Order Confirmation.exe | 1,114,112 | 0x53C5E20C69A275638BD8CD4C8289C8A7
TT Copy.zip / TT Copy.pif | 761,856
| 0x4C0A9166047EA02390A4C7E34D32BAFA
PAYMENT.zip / PAYMENT#details.exe | 458,752
| 0x75A13661018E4ED6CC8A0123FFA5F3AE
PAYMENT-SLIP.zip / PAYMENT-SLIP.exe | 778,240
| 0x6D5785DACA55A47E5921746F1C5BD665

Payment Invoice.zip / bot_output7648950.exe | 270,336
| 0x54D93B73878B448C7C97B1D4563BE9DB

NEW ORDER_1A31950.zip / NEW ORDER_1A31950.exe | 188,416
| 0x5668A988C40DAE30CD1BB96A838A9DCB

PURCHASE ORDER.zip / PURCHASE ORDER.jar | Not Available | 0xD39F63312EE09400E679C5B58F87060F

payment.zip / payment.exe
| 278,528
| 0x2A31574EE4AD4DB2948AB0FB8543CA71

Sample.Order.zip / Sample.Order.exe | 481,792 | 0xC144608A02D23093A1631D2BA4513C9D

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: Payment Confirmation Slip

Message Body:

HSBC - The world's local bank (www.hsbc.com)
About SecureMail Help
Email from HSBC
You have received a message from HSBC secured
Dear Sir/ Madam,
Please kindly download and view payment transfer confirmation attached below.
The payment was made to your account through one of your customers.
Regards

Or

> Subject: FW: Order/TT

Message Body:

Good day sir,
How are you today?
pls check attached, my manager had requested I email you our new order
details together with TT copy of balance payment. Kindly confirm in return.
regards,
MVP Trading Company, Inc.

Or

> Subject: Message copied from system quarantine

Message Body:

Hello
I have forwarded our orders several times without getting any response from you yet.
We will like to know what is causing the delay in response .
Please refer to the attached photo in my email.
I was informed that this was purchased from your company.
I would also like to order this product.

Or

> Subject: Re: Product

Message Body:

Dear,
Pls check out the sample and get back to us.
Awaiting yours.
Best Regards
Overseas trade administrator

Or

> Subject: payment slip

Message Body:

Kindly be inform that the payment has been made,attach to this mail is
the payment confirmation order.
Do get back to me as soon as you confirm it in your account.
Fine the attachment
Thanks

Or

> Subject: Urgent

Message Body:

Hello,
Just wanted to make sure you received the message i tried to deliver to you earlier, Please
view the document i uploaded for you in attachment,
Try to view the document its very important..:.
Thanks
Firstlady1

Or

> Subject: payment slip

Message Body:

Hello
Please quote your best price for the attached products, delivery time and availability of the product.
Attached is a Sample Quotation, kindly ensure price is competitive as we await your quote.

Or

> Subject: Payment Details [Incident: 147433-760939]

Message Body:

[Bill.com]
We could not process your Full Payment Submission.
The submission for reference
/UT4015918 was successfully received and was not processed.
Check attached copy (PDF Document) for more information.
Regards,
*

Or

> Subject: Re: Sales Inquiry - New Order

Message Body:

Dear sales,
I am from Al Abid, Project manager Hitech Electric,
We wish to place an order for the following Items as listed in the above attached document.
It is intended to be delivered within 34 days from the Order confirmation date since
we will be needing it to complete our outsanding projects.
Your urgent attention will be appreciated as we expect your quote which will include:
1. CIF
2. Terms of Payment (preferable T/T)
3. Certifiying Body
4. Expected date of Delivery
Thanks for your co-operations.
Sincerely
Project manager II

Or

> Subject: Product sample

Message Body:

Good Day,
We have confirmed your product but the price is very high.
Please review our attached enquiry and revert with possibility of quote.
Hope you can reply urgently so we can place the order and get it delivered on time.
Thanks,
Regards,

Or

> Subject: Offene Rechnung 56506548 Ronja Gr?nwoldt

Message Body:

Diese Nachricht wurde von meinem Android Mobiltelefon mit GMX Mail gesendet.
Stellvertretender Rechtsanwalt schrieb:
Sehr geehrte/r Ronja Gr?nwoldt,
Sie haben eine nicht beglichene Forderung bei der Firma Ebay GmbH.
Das von Ihnen gespeicherte Konto wurde im Moment der
Abbuchung nicht genügend gedeckt um die Lastschrift vorzunehmen.
In Vollmacht unseren Mandanten fordern wir Sie auf, die offene
Gesamtforderung schnellstens zu bezahlen. Aufgrund des bestehenden Zahlungsverzug
sind Sie gezwungen zuzüglich, die durch unsere Inanspruchnahme entstandenen
Gebühren von 45,95 Euro zu tragen. Wir erwarten die Zahlung inklusive der Gebühren
bis zum 01.10.2014 auf unser Girokonto. Für Fragen oder Unklarheiten erwarten
wir eine Kontaktaufnahme innerhalb des selben Zeitraums.
Es erfolgt keine weitere Erinnerung oder Mahnung.
Nach Ablauf der festgelegten Frist wird die Akte dem Staatsanwalt und der Schufa übergeben.
Die vollständige Forderungsausstellung, der Sie alle Einzelpositionen entnehmen können, fügen wir bei.
Mit verbindlichen Grüßen
Stellvertretender Rechtsanwalt Günther Christian

Or

> Subject: TT Copy of Remittance

Message Body:

Dear Sir,
Attached is the remittnce TT copy ref to your PDA
Kindly confirm by return upon receipt.
Best Regards

Or

> Subject: d251f56f5882b7703b9518933f87cc26

Message Body:

Hello,
How was your weekend?.
Please advice status of shipment of containers for our client
and also confirm if you have sent us the Original Documents (Invoice, Packing List, Bill of Lading, Form E, etc) ?
Have you sent it ? Give us the tracking number.
We have also contacted your colleague about the confirmation but we have not received any response.
Please find attached our balance payment swift copy. Our Boss has discussed with your Company about
the discounts with our previous order.
Kindly check the attached swift copy and confirm if you recieved payment.
Waiting for your urgent response.
Thank you.

Or

> Message Body:

Greetings ,
We are interested in your products and services. I am attaching our
purchase order.Please provide me with profoma invoice along with your bank
details .
Download and open attachment immediately for all information regarding our
order.
We keep our word.
Kind Regards

> Or

> Subject: New Purchase Order

Message Body:

Hello
Please view our purchase order. Kindly quote
us best price and send us a confirmation.
I would appreciate a quick reply.
Best Regards

Or

>
Subject: Segue em anexo a Nota Fiscal eletrônica nº 19713 no formato XML. - 16:42:52

Message Body:

Prezados senhores,
Segue em anexo a Nota Fiscal eletrônica nº 19713 no formato XML.
Chave de acesso: 35160709210718040187550000000197131000219541.
Protocolo nº 135160446701641, emitida em 25/07/2016 940929591655731

Or

> Subject: purchase order - no. BN00089312 TLP545J

Message Body:

Hi,
We did not receive your response about our last order.
Please confirm enclosed order and inform us the earliest delivery date.
Your prompt reply is needed.
Kindly view the attachment sample and P.O for delivery purpose.

Or

>
Subject: FYI. SWIFT Text :- US$ 30, 565.00.

Message Body:

Dear
FYI.
SWIFT Text :- US$ 30,565.00. - Message copy
Instance Type and Transmission -------------- ----------------------
Notification (Transmission) of Original sent to SWIFT (ACK)
Network Delivery Status : Network Ack
Priority/Delivery: Normal

Or

>
Subject: Payment copy

Message Body:

Good day to you,
Thank you for your reply email attach is copy of the payment confirmation slip
and our delivery order,
kindly inform us as soon as you have the money
in your account and send us the transport details.
Kind Regards,
Accounting Dept

Or

> Subject: order #PO-16-000750 w/ acknowledgment and confirmation

Message Body:

Hello,
Please see attached for my PO and kindly acknowledge.

Or

>
Subject: Confirm payment ASAP

Message Body:

Dear sir,
FYI

Or

>
Subject: ORDER

Message Body:

Good Day,
We sent you an email few days ago regarding an inquiry that we made few days back
but i did not receive any response from you regarding my order,
so i have just sent it again just in-case you did not receive it....
Please note my new purchase order list in my attached file for your
confirmation, and kindly send me your draft Quotation on the items....
Awaiting your reply.
Regards

> ****

>

Or

> Subject: Inquiry

Message Body:

Inquiry
We are in need of your products attached which we saw online. We will like
to know more on the product so we can place our orders. and let us know
the price listing and your payment terms and delivery terms.
Waiting for your response

Or

> Subject: SHIPMENT DOCUMENTS****

Message Body:

Dear Customer,
FYI
See the attached documents for your information.

> ****

Or

> Subject: Payment - G.M. Enterprises (JX-100LED x 2 and KE 750 KE760

Message Body:

Reminder
Dear, Please see attached the remits for
the payment which is scheduled to go out today 8th Augt 2016.
Thank you.
Thanks & Best regards

Or

> > Subject: BOA PAYMENT WIRE SLIP

Message Body:

Dear Sirs,
Please find in enclose attachment (Bank of America) wire transfer
swift copy for your reference as requested by our client/customer.
Transfer will take 1 ro 2 working days to reflect in your bank account
if you have any comment/questions pls refer to your customer for more details
.

Or

> Subject: Payment Advice

Message Body:

Hi,
Please find attached swift copy of invoice and confirm with your bank asap.

Or

> > Subject: PURCHASE ORDER

Message Body:

Dear customer,
kindly see the purchase order attached for the items requested and give us your confirmation
on date of shipping.We would also like to inquire about the following:
Delivery time of the product
Product warranty
Minimum Order Quantity
Payment terms available.
See to this request and do the needful.

Or

> Subject: PURCHASE ORDER#325434

Message Body:

Good Day,
Enclosed below is our order specification for August with Quantity,
Kindly advise us with your best quote.
If you have any further queries , please do not hesitate to contact us.
Your prompt response will be appreciated
.

Or

> Subject: Revised order

Message Body:

Dear Sir/Madam.
Enclosed please find our requirement attached for your reference.
Please check and confirm by sending your PI.please confirm all
details of our requirement and also provide the delivery date.
If you have further questions please don’t hesitate to contact
me directly.
Thanks and Best Regard!

Or

> Subject: Payment

Message Body:

Dear Sir,
Please check the attached swift copy for your references,
Awaits your confirmation Asap.
Thanks and best Regards

Or

> Subject: Confirm Quotation**

Message Body:

Hello,
Please refer to attach attachment of our profile for
required order.Awaiting for your positive response
****

Or

> Subject: SWIFT

Message Body:

Dear Sir,
Our purchasing dept forwarded your commercial invoice for payment today.
Please find the attached TT payment advice for the last shipment.
Kindly confirm and telex release, the shipping documents
Should you have any queries, please feel free to contact the purchasing dept.

Or

>

> Subject: Correct Bank Information For Order no. 0093707

Message Body:

Could you please tell me which account no.
is correct below in the attachment for your new banking information:

Or

> Subject: PAYMENT SLIP ATTACHED

Message Body:

Dear Customer
FYI
Kindly confirm the attached receipt of payment.
Regards
**

Or

> > Subject: PI

Message Body:

Dear All,
We have made the payment of USD 103,349,35. TT copy attached for full payment details.
Document N. AMOUNT DIV.
INVOICE 5328 103,548.25 USD
CREDIT NOTE ECS/CN/06 -198,9 USD
TOTAL AMOUNT 103,349.35 USD
I am forwarding you the e-mail that the brokering company has sent us.
You will receive the money into your account in a couple of days.
Please Complete TT details attached.
Best regards
****

> ****

> > ****

Or

> Subject: New PO # E1A31950

Message Body:

Dear sir
Attach is our New quotation. kindly quote
your best price for New PO # E1A31950.
Your early reply will be highly appreciated ,
Please Confirm The ASAP.
Regards,
****

Or

> Subject: buying inquiry/order

Message Body:

Dear Sir,
Greetings to you and your company,, This is Steve from Saudi
Railway Company (SAR) from purchase department,we we are
looking for a good company or an agent from korea, That
will hep us supply the above product listed in the Po that
is attached. Kindly review and sign back with your best price
the destination port and address is in the attached Po as
stated in the attached before you stamp it Please reply to this
message with any updates or additional information as necessary

Or

> Subject: order catalog

Message Body:

Dear Sir/Madam,
This is the manager of Arabian BEmco Contracting
Co. Ltd,Please kindly view our attached order
catalog and let me know if you can supply us the same product.
Give me your minimum order
-Your Best Prices and FOB,Port of loading.
-Your estimated delivery time.
-Your Mode of Payment. ( If by L/C or T/T )
Best regards

Cisco security appliances can help protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Cisco Web Security Appliances help secure and control web and email traffic by offering layers of malware protection. Cisco security appliances are automatically updated to help prevent both spam email and hostile web URLs from being passed to the end user.

Revision History

  • Version | Description | Section | Date
    ---|---|---|---
    15 | Updated to report significant activity detected by Cisco Security on September 26, 2016 | — | 2016-September-27
    14 | Updated to report significant activity detected by Cisco Security on September 13, 2016 | — | 2016-September-27
    13 | Updated to report significant activity detected by Cisco Security on September 13, 2016 | — | 2016-September-14
    12 | Updated to report significant activity detected by Cisco Security on September 12, 2016 | — | 2016-September-13
    11 | Updated to report significant activity detected by Cisco Security on September 4, 2016 | — | 2016-September-07
    10 | Updated to report significant activity detected by Cisco Security on August 31, 2016 | — | 2016-September-02
    9 | Updated to report significant activity detected by Cisco Security on August 30, 2016 | — | 2016-August-31
    8 | Cisco Security has detected significant activity on August 23, 2016 | — | 2016-August-29
    8 | Cisco Security has detected significant activity on August 10, 2016 | | 2016-August-12
    7 | Cisco Security has detected significant activity on August 10, 2016 | | 2016-August-12
    6 | Cisco Security has detected significant activity on August 10, 2016 | | 2016-August-11
    5 | Cisco Security has detected significant activity on August 9, 2016 | | 2016-August-10
    4 | Cisco Security has detected significant activity on August 6, 2016. | | 2016-August-08
    3 | Cisco Security has detected significant activity on August 2, 2016. | | 2016-August-03 12:52 GMT
    2 | Cisco Security has detected significant activity on September 30, 2014. | | 2014-September-30 17:44 GMT
    1 | Cisco Security has detected significant activity on September 29, 2014. | | 2014-September-30 12:53 GMT
    Show Less

Legal Disclaimer

  • THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products