2017-07-07 - BRAZIL MALSPAM - SUBJ: MENSAGEM PESSOAL (DETRAN) - (87960)

ASSOCIATED FILES:

  • 2017-07-07-Brazil-Detran-malspam-traffic.pcap   (3,575,975 bytes)
  • 2017-07-07-Brazil-Detran-malspam-0810-UTC.eml   (3,716 bytes)
  • IyWEFxHT.exe   (590,048 bytes)
  • Multa(Notificacao).lnk   (1,238 bytes)
  • MultaNotificacao.zip   (844 bytes)
  • dx9fd3g5_2_.zip.txt   (479 bytes)
  • fltLib.dll   (3,019,136 bytes)
  • ipvdr.zip   (3,587,452 bytes)
  • t9f9o89d_1_.zip.txt   (6,313 bytes)

 

EMAIL

EMAIL HEADERS:

 


Shown above:  Screenshot from one of the emails.

 


Shown above:  Google translation of the Portuguese language Brazilian email to English.

 


Shown above:  Malicious zip archive and extracted .link file after clicking link from the malspam.

 

TRAFFIC


Shown above:  Traffic from the infection filtered in Wireshark.

 

ASSOCIATED DOMAINS AND URLS:

 

FILE HASHES

ZIP ARCHIVE AFTER CLICKING LINK FROM THE EMAIL:

EXTRACTED .LNK FILE FROM ZIP ARCHIVE:

MALWARE RETRIEVED FROM THE INFECTED HOST:

 

IMAGES


Shown above:  Script retrieved from 1st HTTPS request to sendspace.com (disguised as a zip archive).

 


Shown above:  Script retrieved from 2nd HTTPS request to sendspace.com (disguised as a zip archive).

 


Shown above:  Contents of the archive downloaded from 104.223.0.112.

 


Shown above:  Persistent executable (just loads any file named "fltLib.dll" located in the same directory).

 


Shown above:  The actual malware DLL for this infection.

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.