Urgent Court Notice from GreenWinick Lawyers delivers malware

I spent some time yesterday in the Malcovery Security Spam Data Mine looking at the E-Z Pass malware campaign. The ASProx spammers behind that campaign have moved on to Court Notice again . . .

Subjects like these:

• Hearing of your case in Court No#
• Notice of appearance
• Notice of appearance in court No#
• Notice to Appear
• Notice to Appear in Court
• Notice to appear in court No#
• Urgent court notice
• Urgent court Notice No#

(All of the subjects that have "No#" are followed by a four digit integer.)

(click to enlarge)

As normal, the spammers for these "Court Appearance" spam campaigns have just grabbed an innocent law firm to imitate. No indication of any real problem at Green Winick, but I sure wish one or more of these abused law firms would step up and file a "John Doe" lawsuit against these spammers so we could get some civil discovery going on!

These are the same criminals who have Previously imitated other law firms including Jones Day (jonesday.com), Latham Watkins (lw.com), Hogan Lovells (hoganlovells.com), McDermitt, Will & Emery (wme.com), and many more! Come on! Let's go get these spammers and the malware authors that pay them!

We've seen 88 destination hosts between July 10th and this morning (list below) but it is likely there are many more!

When malware spammers use malicious links in their email instead of attachments, they tend to have a much better success rate if they deliver unique URLs for every recipient. That is what is happening in this case, and what always happens in these ASProx / Kuluoz spam campaigns. An encoded pseudo-directory is used in the path portion of the URL, which is combined with rotating through hundreds of 'pre-compromised' websites to host their malicious content.

Four patterns in the path portion of the URL are better indicators as we believe there will be MANY more destination hosts.

• tmp/api/…STUFF…=/notice
• components/api/…STUFF…=/notice
• wp-content/api/…STUFF…=/notice
• capitulo/components/api/…STUFF...=/notice

where "...STUFF..." is an encoding that we believe is related to the original recipient's email address, but have been unable to confirm at this time.

http:// arhiconigroup.com / wp-content / api / pwCYg4Ac5gk0WlQIVFEkRSPGL2E7vZhP8Qh4LMGbbAk= /notice

(to protect the spam donor, the pwCYg... string above has been slightly altered. If you want to work on de-coding, let me know and I'm happy to provide a couple hundred non-altered strings.)

Just like with last week's E-Z Pass spam campaign, visiting the destination website results in a uniquely geo-coded drop .zip file that contains a .exe file.

As an example, when downloading from my home in Birmingham Alabama where my zip code is 35242, the copy I received was named:

Notice_Birmingham_35242.zip

which contained

Notice_Birmingham_35242.exe, which is icon'ed in such a way that it appears to be a Microsoft Word document.

The MD5 of my '.exe' was: 5c255479cb9283fea75284c68afeb7d4

The VirusTotal report for my .exe is here:

VirusTotal Report (7 of 53 detects)

Extra credit points to Kaspersky and Norman for useful and accurate naming !

Kaspersky = Net-Worm.Win32.Aspxor.bpyb
Norman = Kuluoz.EP

Each of the 88 destination websites that we observed was likely compromised to host the malware. We do not believe these are necessarily "Bad Websites" but they either have a vulnerability or have had the webmaster credentials stolen by criminals.

If these are YOUR website - look for one of those directories I mentioned ...

/tmp/api/
/components/api/
/wp-content/api/
/capitulo/components/api/

www.metcalfplumbing.com
www.mikevanhattum.nl
www.mieszkaniaradomsko.pl
www.millionairemakeovertour.com
www.mkefalas.com
www.moldovatourism.ro
www.mobitrove.com
www.modultyp.com
www.mommyabc.com
www.monsterscalper.com
www.myconcilium.de
www.nellalongari.com
www.northsidecardetailers.com.au
www.parasitose.de
www.paulruminski.eu
www.petitecoach.com
www.phasebooks.net
www.plr-content.com
www.profimercadeo.com
www.propertyumbrellablueprint.com
www.proviewhomeservices.com
www.puntanews.com.uy
www.qifc.ir
www.rado-adventures.com
www.rantandraveweddingplanning.com
www.registrosakasicos.es
www.rimaconsulting.com
www.romiko.pl
www.saffronelectronics.co.uk
www.sasregion.com
www.saxonthewall.com
www.sealscandinavia.se
www.stkatharinedrexel.org
www.tecza.org
www.theanimationacademy.com
www.thehitekgroup.com
www.tusoco.com
www.urmasphoto.com
www.vicmy.net
www.viscom-online.com
www.vtretailers.com
www.warp.org.pl
www.webelonghere.ca
www.weihnachten-total.de
www.wesele.eu
www.whistlereh.com
www.wicta.nl
www.widitec.com.br
www.wonderlandinteractive.dk
www.wpprophet.com
www.xin8.org
www.zabytkowe.net
www.zeitgeistportugal.org
www.zmianywpodatkach.pl
www.znamsiebie.pl
www.zuidoost-brabant.nl
www.zs1grodzisk.pl
yourmentoraffiliatemarketing.com
atenea.edu.ec
comopuedoblanquearmisdientes.com
arhiconigroup.com
chris-coupe.com
drnancycooper.com
ian-mcconnell.com
izkigolf.com
kalemaquil.com
kingdommessengernetwork.com

Interac Phishers try their hand at IRS

Last week Malcovery Security had an interesting phish show up claiming to be related to the IRS. This one turns out to be a great example of the (activate 1940 horror movie narrator voice) The POWER OF CROSS BRAND INTELLIGENCE (/activate). Here's what the website looked like:

Phish from: bursafotograf.com / profiles / interac / RP.do.htm

In this phish, the "big idea" is that you can escalate your IRS Tax Refund if you specify which bank you would like the refund to be deposited into. When you click the bank's logo, you are taken to a phishing site for that brand and asked to provide your Userid and Password, which are then emailed to the phisher. Here's an example of the page you would see if you clicked on the Regions Bank logo (graphic courtesy of PhishTank submission 2254700.)

Things get quite fascinating though when we hide the graphics:

Why would an IRS phish have ALT TEXT including for four of the largest Canadian banks? By looking at the source code for the phishing page, we see that this is a very lightly rebranded Interac phish: First, the website Title is "INTERAC e-Transfer" ...

INTERAC is a very interesting money transfer system used in Canada that allows anyone to send money to anyone else simply by using either their email address or cell phone text messaging service. A Transaction code is texted/emailed from the payer to the recipient, allowing the recipient to login to the Interac service and choose what account, and what bank, they would like to receive the funds into.

The phish has some Javascript at the top that includes variables like "var provinceList = new Array ("Alberta", "British Columbia", "New Brunswick", "Newfoundland and Labrador", "Nova Scotia", "Ontario", "Prince Edward Island", "Saskatchewan");" and a pull down menu with options "Select Institution", "Select Province or Territory" and "Select Credit Union."

As we continue into the table of graphics, we see that the phisher has changed his graphics and links to refer to the American banks, with code such as:

href = chasecustomerprofile
img src = chasecustomerprofile/css/images/chaseNew.gif .... but with "alt=CIBC"

href = navy/index.htm
img src = imgs/nfculogo.png  .... but with "alt=President's Choice Financial"

href = suntrust
img src = imgs/suntrust.png  .... but iwth "alt = RBC Royal Bank"

etc . . . 

Phishing Cross-Brand Intelligence

It seems fairly clear that we should be able to find more phishing sites that used the original Interac code, and of course we can in the Malcovery PhishIQ system.

Here is a phish that was seen on June 21, 2013 on the website freevalwritings.com / wp / interacsessions / RP.do.htm

And another first seen on May 28, 2013 on the website anglaisacote.com / interac / RP.do.htm (note the common path on both of these that matches the current IRS phish = "interac/RP.do.htm" RP.do.htm is used on the REAL Interac website.

Phishing & Spam Cross-Brand Intelligence

An interesting thing about phishing emails that differentiates them from standard spam. While normal spam is often sent via botnets, phishing emails tend to be sent from the same IP address over a period of time. When we use Malcovery PhishIQ to examine the IRS version of the Interac phish, which attempts to steal money from Bank of America, Chase Bank, Navy Federal Credit Union, SunTrust, Regions Bank, Wells Fargo, USAA, and Citi, we see that the originally advertised URL was actually "130.13.122.25 / irsjspmessageKey-IG09210358i /". That URL forwarded visitors to the website "ernursusleme.com / Connections / irsonlinedeposit /" which then forwarded the visitors to "bursafotograf.com / profiles / interac / RP.do.htm" which is where the screenshot at the top of this article was captured.

So, to find spam messages related to this phish, it seems reasonable to search the Malcovery Spam Data Mine for emails that advertised URLs on 130.13.122.25.

We found two sets of spam messages that advertised URLs on that host in our spam collection. One batch from January 8, 2014 and the other batch from January 28th and January 29th, 2014.

The January 28th and January 29th emails claimed to be from "From: USAA (USAA.Web.Services@customer.usaa.com)" with an email subject of "New Insurance Document Online".

Two of the emails were sent from 122.3.92.116 (Philippines) and one email was sent from 70.166.118.54 (Cox). What other emails were sent from those IP addresses?

Here are the emails from 122.3.92.116

Date:	Subject:	From Name	From Email
Dec 13, 2013	Your account has been limited until we hear from you	service@ intl.paypal.com	survey.research-3086@ satisfactionsurvey.com
Dec 13, 2013	Your account has been limited until we hear from you	service@ intl.paypal.com	survey.research-3086@ satisfactionsurvey.com
Dec 14, 2013	Your account has been limited until we hear from you	service@ intl.paypal.com	survey.research-3086@ satisfactionsurvey.com
Dec 16, 2013	Confirmation - personal information update	USAA	USAA.Web.Services@ customermail.usaa.com
Dec 18, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 18, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 18, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 23, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 30, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 31, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 31, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 31, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 5, 2014	Notification of Limited Account Access	PayPal	PayPal@ abuse.epayments.com
Jan 7, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 7, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 7, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 19, 2014	Your dispute has been ended 01/20/2014: Get your money back	PayPal	paypal.feedback@ email.com
Jan 19, 2014	Your dispute has been ended 01/20/2014: Get your money back	PayPal	paypal.feedback@ email.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	Your dispute has been ended 01/20/2014: Get your money back	PayPal	paypal.feedback@ email.com
Jan 28, 2014	New Insurance Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 28, 2014	New Insurance Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Feb 8, 2014	Canada Revenue send you an INTERAC e-Transfer	TD Canada Trust	notify@ payments.interac.ca

And here are the emails from 70.166.118.54

Date:	Subject:	From Name	From Email
Jan 29, 2014	New Insurance Document Online	USAA	USAA.Web.Services@customermail.usaa.com
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 4, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 4, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 8, 2014	Canada Revenue send you an INTERAC e-Transfer	RBC Royal Bank	notify@ payments.interac.ca
Feb 9, 2014	Canada Revenue send you an INTERAC e-Transfer	RBC Royal Bank	notify@ payments.interac.ca
Feb 11, 2014	Wells Fargo ATM/Debit Card Expires Soon	Wells Fargo Online	alerts@ notify.wellsfargo.com
Feb 11, 2014	Wells Fargo ATM/Debit Card Expires Soon	Wells Fargo Online	alerts@ notify.wellsfargo.com

The Power of Cross-Brand Intelligence

To summarize, we started with a new IRS phish, and through some comparisons in the Phishing and Spam Data Mines, ended with phish for USAA, PayPal, Wells Fargo, and Interac all being linked together. Investigators interested in learning more are encouraged to reach out!