The path from the creation of malicious program to its delivery onto victims’ computers is long nowadays and involves many different players with the same goal – to make a financial gain. Malware authors usually offer their software to cyber criminals who in turn distribute it via underground forums. This is the how they keep their […]
The path from the creation of malicious program to its delivery onto victims’ computers is long nowadays and involves many different players with the same goal – to make a financial gain. Malware authors usually offer their software to cyber criminals who in turn distribute it via underground forums. This is the how they keep their […]
After the takedown of a major botnet, users have a “two-week window” to protect themselves against a powerful computer attack that ransoms people’s data and steals millions of dollars from unsuspecting victims. If you read our blog, you are familiar with the dangers of the Zeus Trojan and ransomware, and how people get infected. Here’s […]
The FBI, along with the Department of Justice, announced a multinational effort on their website that has disrupted a botnet called GameOver Zeus. GameOver Zeus has infected millions of Internet users around the world and has stolen millions of dollars. The UK’s National Crime Agency (NCA) has worked closely with the FBI to crack […]
Security and privacy on Social Media is a big topic at AVAST. While our antivirus products protect your various devices from malware infection spread on social channels, your privacy is still exposed to the public. Not anymore! It’s been a while, since we acquired Secure. me and it’s a superb product. Our team worked hard to […]
Software suite provides enterprise-grade security with turnkey, user-friendly functionality
Everyone hates getting bills, and with each new one it seems like the amount due just keeps getting higher and higher. However, Symantec recently discovered an energy bill currently being emailed to people that will hit more than just your bank account.
A recent spam campaign sending out emails masquerading as an Australian energy company is serving up the Cryptolocker malware…or at least that’s what the spammers want you to think. Once users become infected, they are told they are infected with Cryptolocker (Trojan.Cryptolocker) however, upon further research, Symantec discovered that the malware is not related to the original Cryptolocker virus and is merely a copycat attempting to cash in on the hype and infamy of Cryptolocker.
Energy bill gives users a shock
This particular spam campaign requires a lot of work from the victim to work but once it does, the user’s files will be encrypted and all the spammers have to do is wait for their ransom payment.
To infect users with the crypto malware, the spammers use a fake bill to lure recipients to a malicious website; however, the malware is not hosted here and it is just an evasive manoeuvre to evade any link-following technologies.
The email appears to be a legitimate electronic bill from an Australian energy company, complete with a balance outstanding. The recipient just has to click a link to view their bill.
Figure 1. Energy bill spam email
Once the link is clicked the user is directed to a website that appears to be a CAPTCHA entry page, but the numbers never change. Once the user enters the fake CAPTCHA and hits submit, they are directed to the next page, which contains a link to download the energy bill.
Figure 2. Fake CAPTCHA page
Figure 3. Download page
Clicking on the download link will save a zip file to the user’s computer. The folder contains an executable file disguised with a PDF icon in an effort to trick unsuspecting users into opening it. Opening this malicious file will cause all files on the compromised computer to be encrypted. Following this, a text file opens, informing the user that they have been hacked and that they must send an email to a specific address in order to get their files decrypted.
Figure 4. Text file
Figure 5. Notification of compromise
The malware also checks to see if Outlook or Thunderbird is installed on the compromised computer and, if so, harvests the email addresses in the user’s contact list. The addresses, which are presumably used to further spread the malware, are uploaded to the following remote location:
[https://]royalgourp.org/[REMOVED].php
Protection
Symantec advises users to be cautious of emails that request new or updated personal information. Users should also avoid clicking on links in suspicious messages.
Symantec detects this malware as Trojan.Cryptolocker.F
Messaging gateway and .cloud customers are protected from this spam campaign.
Large swathes of infrastructure owned by the attackers behind the financial fraud botnet and Cryptolocker ransomware network seized by authorities.
Read more…
Large swathes of infrastructure owned by the attackers behind the financial fraud botnet and Cryptolocker ransomware network seized by authorities.
Read more…
悪用コードや、侵害を受けた Web サイトからダウンロードされたファイルを介して拡散している情報盗難型のマルウェアファミリーによって、日本のオンラインバンキング利用者が狙われています。