Threat Outbreak Alert RuleID21486: Email Messages Distributing Malicious Software on March 9, 2016

2016-03-08T15:40:29
ID CISCO-THREAT-43921
Type ciscothreats
Reporter Cisco
Modified 2016-03-10T13:11:30

Description

Medium

Alert ID:

43921

First Published:

2016 March 8 15:40 GMT

Last Updated:

2016 March 10 13:11 GMT

Version:

2

Summary

  • Cisco Security has detected significant activity related to spam email messages distributing malicious software.

Email messages that are related to this threat (RuleID21486 and RuleID21486KVR) may contain the following files:

Name | Size in Bytes | MD5 Checksum
---|---|---
INVD0922D.zip / statistics_56179860242.js
| 4,964
| 0x0AF4E25EFE4AB2451FA34BB4DA3CCDC3

order_copy_A4283262.zip / readme_048181837.js | Not Available | 0xD3B8CA2B94B1B68C0D5E54599BEC78AF
MX62EDO201603018437955.zip / HR2874706473.js | Not Available | 0xFF45E6E4B95B5CAC4071BBF8B6A9D7E2

MX62EDO2016030139141.zip / KD2038701642.js | Not Available | 0x1D89BB7C7FACD7BDE4691D6A4E034152
document_invoice_322468.zip / message.090919030.js | Not Available | 0x1D89BB7C7FACD7BDE4691D6A4E034152

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: March Invoice

Message Body:

Hi,
Attached is the November invoice.
Thanks!

Or

> Subject: Delay with Your Order #A4283262, Invoice #79302558

Message Body;

Dear Valued Customer,
It is very unpleasant to hear about the delay with your order #A4283262,
but be sure that our department will do its best to resolve the problem.
It usually takes around 7 business days to deliver a package of this size to your region.
The local post office should contact your as soon as they will receive the parcel.
Be sure that your purchase will be delivered in
time and we also guarantee that you will be satisfied with our services.
Thank you for your business with our company.

Or

> Subject: Emailing: MX62EDO 01.03.2016

Message Body:

Your message is ready to be sent with the following file or link
attachments: MX62EDO 01.03.2016 SERVICE SHEET
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.

Or

> Subject: Invoice

Message Body:

Dear Customer,
The attached document is a transaction payment
confirmation from GlobalMarketing Ltd.
Thank you for your business - we appreciate it very much.
Sincerely,

Cisco security appliances can help protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Cisco Web Security Appliances help secure and control web and email traffic by offering layers of malware protection. Cisco security appliances are automatically updated to help prevent both spam email and hostile web URLs from being passed to the end user.

Related Links
Cisco Security
Cisco SenderBase Security Network

Revision History

  • Version | Description | Section | Date
    ---|---|---|---
    2 | Cisco Security has detected significant activity on March 9, 2016. | | 2016-March-10 13:11 GMT
    1 | Cisco Security has detected significant activity on March 8, 2016. | | 2016-March-08 15:40 GMT
    Show Less

Legal Disclaimer

  • THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products