Lots of different emails pretending to be from various different Government departments  They are all another one from the current upatre-zbot runs which try to drop cryptolocker on your computer. Updated 28 July 2014: today’s version is Your Online Submission for Reference 465/GB2703024 Could not process with the same malware as https://myonlinesecurity.co.uk/hmrc-tax-refund-notice-fake-pdf-malware/ subjects are: Your Online Submission for Reference 435/GB8397317 Could not process < numbers vary> Could not process Online Submission Notification of direct debit of fees Fairly Simple email : We could not process your Full Payment Submission. The submission for reference 475/RA8746193 was successfully received and was not … Continue reading →

These Dun and Bradstreet Spam emails have subjects like FW: Case – 7624582  or FW : New Company Complaint – 0815915 pretending to come from Dun and Bradstreet is another one from the current zbot runs which try to drop cryptolocker, ransomware and loads of other malware on your computer. They are using email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Please note the poor spelling … Continue reading →

another one from the current zbot runs which try to drop malware on your computer. This attachment appears to have an anti VM technology so automatic analysers don’t get any payload and crash part through analysing it, in an attempt to bypass anti-virus detections Email content says: Dear customer, We attempted to deliver your item at 10:10 AM on Nov 28th,   2013. The delivery attempt failed because nobody was present at the shipping address, so this notify has been automatically sent. If the parcel is not scheduled for redelivery or picked up within 72 hours, it will be returned to … Continue reading →

another one from the current upatre-zbot runs which try to drop cryptolocker on your computer Edit: 9 October 2014  There is an updated version of this post, describing the newest malware versions spreading via this perennial email template https://myonlinesecurity.co.uk/microsoft-outlook-received-voice-mail-fake-wav-malware/               Current Virus total detections:   1/47  https://www.virustotal.com/en/file/d692b2ad9f19ca92cbd13e5f08ac6ba7cd144549f1f5f4654de8eac57bc09adb/analysis/ MALWR Auto Analysis:  https://malwr.com/analysis/ZjY4NDViNGZiYTA0NGEwZWJlZmMxMWFiNmQzZmFkMjY/ This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper .wav file ( music or speech file) instead of the .exe file it really is, so making it much more likely for you to … Continue reading →

another one from the current upatre-zbot runs which try to drop cryptolocker on your computer This one is going for  double pronged approach, with 2 zip files and slightly different names. The second should  be very well known to your antivirus which should protect you.           Current Virus total detections:   BankDocuments.exe   2/48 https://www.virustotal.com/en/file/ae0881d3b9d9459f05361514c6159c657df1bf525da1a1d47c8d425cd7ba728b/analysis/ Current Virus total detections:  Bank_Docs_11132013.exe 44/48   https://www.virustotal.com/en/file/5bda57e0cca9728ad56314c90a54c61c51edf3d3b7c548056041f81660d0d667/analysis/ MALWR Auto Analysis: BankDocuments.exe     https://malwr.com/analysis/ZjQwZmQxYTdjY2I3NDMxN2FiMGIwYzkwODZlYjU0ZDI/ MALWR Auto Analysis:  Bank_Docs_11132013.exe  https://malwr.com/analysis/ZjFlYWE0MzhkYzg3NDlhMDlmYWI4NTVjZTlhYTExMmM/ This is another one of the spoofed icon files that unless you have “show known file extensions enabled“, will look like a proper PDF file instead of the .exe file it … Continue reading →