2014-08-29 - ASPROX BOTNET PHISHING EMAIL - SUBJECT: NOTICE OF COURT ATTENDANCE

ASSOCIATED FILES:

 

NOTES:

 

PHISHING EMAIL:

SCREENSHOT:

 

MESSAGE TEXT:

From: Court Agent <security905@new-york-city-lawyers.com>
Date: Friday, August 29, 2014 at 1:00 UTC
To:
Subject: Notice of court attendance

As a defendant you have been scheduled to attend the hearing in the Court of Detroit.

Hearing date: 8 September 2014
Hearing time: 9:00 a.m.
Hearing subject: illegal use of software

Prior to the court thoroughly study the plaint note in the attachment to this mail.

Sincerely,
Court agent,
Abigail Mason

Attachment: PlaintNote_1554_copy.zip (82.8)

 

PRELIMINARY MALWARE ANALYSIS

EMAIL ATTACHMENT:

File name:  PlaintNote_1554_copy.zip
File size:  61.3 KB ( 62752 bytes )
MD5 hash:  4362e898eaec07b757f95a07032411d0
Detection ratio:  26 / 55
First submission:  2014-08-29 22:22:33 UTC
VirusTotal link:  https://www.virustotal.com/en/file/d2d4eac9d07ecf2548497d9aa0609d52438ae55ced6045992338b1e5092a836a/analysis/

 

EXTRACTED MALWARE:

File name:  PlaintNote_copy.exe
File size:  112.0 KB ( 114688 bytes )
MD5 hash:  88e2cdde9022f7c35647cafd4335d134
Detection ratio:  25 / 55
First submission:  2014-08-29 22:09:42 UTC
VirusTotal link:  https://www.virustotal.com/en/file/ef8947456e520660a0423dc7f3589bf486d9da3e6b84129f7b899438b35ee6c8/analysis/

 

DROPPED FILE (FROM THE INFECTED HOST - USER'S APPDATA\LOCAL\TEMP FOLDER):

File name:  2014-08-29-phishing-malware-dropped-file.exe
File size:  84.0 KB ( 86016 bytes )
MD5 hash:  5a3001be0abd7e6955cf39a285421279
Detection ratio:  5 / 54
First submission:  2014-08-29 18:38:42 UTC
VirusTotal link:  https://www.virustotal.com/en/file/f5cbd7c9d4cf37935bd44081b5695ff837a51e0dce9089645602e7f137b03fab/analysis/

 

INFECTION TRAFFIC

FROM SANDBOX ANALYSIS OF THE MALWARE:

 

SNORT EVENTS FROM SANDBOX ANALYSIS

Emerging Threats and ETPRO rulesets from Sguil on Security Onion (without ET POLICY or ET INFO events):

Sourcefire VRT ruleset from Snort 2.9.6.2 on Debian 7:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.