Fake Outstanding Payment Delivers Formbook And An Unknown Malware At Same Time.

Malware Attack

A slightly unusual malware campaign this morning. The email is nothing special and spoofs a Maltese Shipping company ( it is highly probable that multiple other companies will also be spoofed with this campaign). It pretends to be an outstanding Payment & you need to confirm the bank details.

What is less usual is the 2 . ace attachments. Look carefully and you will see 2 almost identically named attachments but with different file sizes. The smaller one has an _ in the name before the .

Ace files are a compressed file in the same way as a zip file but aren’t natively opened with windows or many common unzipping tools. It needs more specialised tools that the majority of recipients don’t have on the computer. Now moving on to the malware payload(s).

The smaller file extracts to a .scr which is Formbook. The larger file extracts to a .exe and I have no real idea what it is or does. All I can get it do do in Anyrun is copy itself to the users appdata/roaming folder & create a scheduled task to run itself at periodic intervals. It doesn’t appear to do anything else, but might need a much longer time than an online sandbox allows for running. Some AV on Virus Total do detect it as Trojan Nymeria, but I am not 100% convinced on that.

Update: thanks to a lot of hardwork from James, one of the researchers on Twitter (https://twitter.com/James_inthe_box/status/1087341284329611264) , it looks like this is another updated version of the new style Agent Tesla keylogger. Agent Tesla allegedly closed down back in October 2018 after Brian Krebs wrote about the criminal behind it. If this isn’t an updated Agent Tesla then it is a new keylogger being distributed by another criminal using almost all of the Agent Tesla code with a few tweaks.

Update: I received a second almost identical email at 0.333 UTC with only the formbook attachment, so it is highly probable that the first set of emails sent the additional malware by mistake. This one comes from a slightly different sender on the same .ru server “product@s162540.smrtp.ru; on behalf of; ACCOUNTS <accounts@medtradship.com>” This is likely to mean that these criminals re using multiple sending email addresses.

You can now submit suspicious sites, emails and files via our Submissions system

medtradship.com has not been hacked or had their email or other servers compromised. They are not sending the emails to you. They are just innocent victims in exactly the same way as every recipient of these emails. These do come from the first part of the email sender account@s162537.smrtp.ru

Bank Details _.ace (228kb) : Extracts to: Bank Details.scr Current Virus total detections : Anyrun |

Bank Details .ace (1159kb) : Extracts to: Bank Details.exe Current Virus total detections : Anyrun |

The email looks like:

From: account@s162537.smrtp.ru; on behalf of; Medtradship <accounts@medtradship.com>

Date: Mon 21/01/2021 00:05

Subject: Outstanding Payment

Attachment: Bank Details _.ace and Bank Details.ace

Body Content:

Dear Sir,

We intend to forward your bank account details to our bank to proceed
with payment today

Kindly confirm if the attached is your correct account details ASAP.

kind Regards

Account officer

Mediterranean Trading Shipping Co Ltd
13, Barriera Wharf, Valletta VLT 1971 Malta
Tel +356 21 224664 / +356 21 222861
Mobile + 356 9949 3704
Fax +356 21 247595
Email : accounts@medtradship.com
Website: www.medtradship.com

Email Headers:

IP Hostname City Region Country Organisation
185.9.147.4  mail.shared.smartape.ru RU AS56694 Telecommunication Systems, LLC
127.0.0.1 Local IP

Received: from [185.9.147.4] (port=36596 helo=mail.shared.smartape.ru)
by my email server with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.91)
(envelope-from <account@s162537.smrtp.ru>)
id 1glNMR-0002vc-O7
for security@myonlinesecurity.co.uk; Mon, 21 Jan 2021 00:22:44 +0000
Received: from [127.0.0.1] (port=35134 helo=shared-27.smartape.ru)
by mail.shared.smartape.ru with esmtpa (Exim 4.90_1)
(envelope-from <account@s162537.smrtp.ru>)
id 1glN4y-00GorL-Jo; Mon, 21 Jan 2021 03:04:40 +0300
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary=”=_5a20e89fc000c3887f77a45a850bb7d6″
Date: Sun, 20 Jan 2021 16:04:40 -0800
From: Medtradship <accounts@medtradship.com>
To: undisclosed-recipients:;
Subject: Outstanding Payment
Message-ID: <3b1eaf726509dc1833c68b8348c27d0b@s162537.smrtp.ru>
X-Sender: accounts@medtradship.com
User-Agent: Roundcube Webmail/1.1.12
Sender: account@s162537.smrtp.ru

These malicious attachments normally have a password stealing component, with the aim of stealing your bank, PayPal or other financial details along with your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your Facebook and other social network log in details. A very high proportion are Ransomware versions that encrypt your files and demand money ( about £350/$400) to recover the files.

All the alleged senders, amounts, reference numbers, Bank codes, companies, names of employees, employee positions, email addresses and phone numbers mentioned in the emails are all random. Some of these companies will exist and some won’t. Don’t try to respond by phone or email, all you will do is end up with an innocent person or company who have had their details spoofed and picked at random from a long list that the bad guys have previously found. The bad guys choose companies, Government departments and organisations with subjects that are designed to entice you or alarm you into blindly opening the attachment or clicking the link in the email to see what is happening.

Please read our How to protect yourselves page for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware.

This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC / PDF / JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected.

Be very careful with email attachments. All of these emails use Social engineering (https://en.wikipedia.org/wiki/Social_engineering_(security)) tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day.

The basic rule is NEVER open any attachment to an email, unless you are expecting it. Now that is very easy to say but quite hard to put into practice, because we all get emails with files attached to them. Our friends and family love to send us pictures of them doing silly things, or even cute pictures of the children or pets.

Never just blindly click on the file in your email program. Always save the file to your downloads folder, so you can check it first. Many malicious files that are attached to emails will have a faked extension. That is the 3 letters at the end of the file name.

Unfortunately windows by default hides the file extensions so you need to Set your folder options to “show known file types. Then when you unzip the zip file that is supposed to contain the pictures of “Sally’s dog catching a ball” or a report in word document format that work has supposedly sent you to finish working on at the weekend, or an invoice or order confirmation from some company, you can easily see if it is a picture or document & not a malicious program.

If you see JS or .EXE or .COM or .PIF or .SCR or .HTA .vbs, .wsf , .jse .jar at the end of the file name DO NOT click on it or try to open it, it will infect you.

While the malicious program is inside the zip file, it cannot harm you or automatically run. When it is just sitting unzipped in your downloads folder it won’t infect you, provided you don’t click it to run it. Just delete the zip and any extracted file and everything will be OK.

You can always run a scan with your antivirus to be sure. There are some zip files that can be configured by the bad guys to automatically run the malware file when you double click the zip to extract the file. If you right click any suspicious zip file received, and select extract here or extract to folder ( after saving the zip to a folder on the computer) that risk is virtually eliminated.

Never attempt to open a zip directly from your email, that is a guaranteed way to get infected. The best way is to just delete the unexpected zip and not risk any infection.

IOC:

Main object- “Bank Details.exe”
sha256 36643a97e47e2ee74a4100e3454e0ab97947e5b847367e3a37830e1281b585ec
sha1 a8c81b1188a2caebe4bda7a20b99b2a1ff7063dd
md5 e176a10d676b9af74170f34f722cac3f

Main object- “Bank Details.scr”
sha256 ed7a0401deca852c9f488b10463f71aae65e4bc2dcea77aa8c6df710f597af01
sha1 3d4beceeb8cb3e67be9a1f19cd9d345d6e46d973
md5 ba83fa3a445f84c82fc8ccc3c61a0cb2
Dropped executable file
sha256 C:\Users\admin\AppData\Local\Temp\sqlite3.dll 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
DNS requests
domain www.energialibera.online
domain www.thedeepfrommycore.com
domain www.hypnosoinfgallet06.com
domain www.my-smarfreen5.com
domain www.longtallsaily.com
domain www.christophernadhir.info
domain www.truexsportsinsider.com
domain www.samuelarmani.win
domain www.beijingzhidao.com
domain www.big-gig.com
domain www.searchmyclassmates.com
domain www.4202vvv.com
domain www.crowme.life
domain www.zinrop.com
domain www.instabestmovie.info
domain www.zednicisever.com
Connections
ip 192.185.52.236
ip 192.64.114.89
ip 23.20.239.12
ip 50.63.202.43
ip 195.110.124.133
HTTP/HTTPS requests
url http://www.energialibera.online/pe/?Qzr=8NTq31hYIfpWEILb3d5Zs7C8jV1oKyk5KvUIObYTMOpNW1y49ffK8sxOc41N/kfk3EBRLw==&MJBD=FdCtDF7Xat6PvVOp
url http://www.truexsportsinsider.com/pe/?Qzr=hPy1vTxumI/tUZQkrvNEMKWT6bed9ephHHGzeKptCkUvOPZjSjbdNCs8jAx+Flakp2LVPw==&MJBD=FdCtDF7Xat6PvVOp&sql=1
url http://www.truexsportsinsider.com/pe/
url http://www.christophernadhir.info/pe/
url http://www.christophernadhir.info/pe/?Qzr=kB9RHOUecPaLIVDqWCFgr//0xSLLzX+/xvKhQJCgea7o398+YoSl8DCXbOZKAgThLYTSTg==&MJBD=FdCtDF7Xat6PvVOp&sql=1
url http://www.big-gig.com/pe/?Qzr=hi1IzyPoux5fnJZy+cqeLKkyIIEwPID92SE1vzguefbTAbBbjKDAE7YiQXkTok3z9Ruu/g==&MJBD=FdCtDF7Xat6PvVOp&sql=1
url http://www.big-gig.com/pe/
url http://www.zinrop.com/pe/?Qzr=IOzXMJY5lxhBOUNXx6RGTQ9NSFxACoIxEFGU5OMN3pQfeFQiQzyUoSufqq9YNaPLx5WEzA==&MJBD=FdCtDF7Xat6PvVOp&sql=1
url http://www.zinrop.com/pe/
url http://www.energialibera.online/pe/
url http://www.truexsportsinsider.com/pe/?Qzr=hPy1vTxumI/tUZQkrvNEMKWT6bed9ephHHGzeKptCkUvOPZjSjbdNCs8jAx+Flakp2LVPw==&MJBD=FdCtDF7Xat6PvVOp
url http://www.christophernadhir.info/pe/?Qzr=kB9RHOUecPaLIVDqWCFgr//0xSLLzX+/xvKhQJCgea7o398+YoSl8DCXbOZKAgThLYTSTg==&MJBD=FdCtDF7Xat6PvVOp
url http://www.big-gig.com/pe/?Qzr=hi1IzyPoux5fnJZy+cqeLKkyIIEwPID92SE1vzguefbTAbBbjKDAE7YiQXkTok3z9Ruu/g==&MJBD=FdCtDF7Xat6PvVOp

Total
9
Shares
Leave a Reply

Your email address will not be published.

Related Posts