CastleCops :: View topic - Suspect zip attachement spoofed Circuit City sender

Suspect zip attachement spoofed Circuit City sender
Goto page 1, 2, 3 Next
CastleCops -> Unknown Files

Author: crimewatch, Location: USA

Posted: Tue Oct 10, 2006 4:23 pm Post subject: Suspect zip attachement spoofed Circuit City sender

So you're sitting there scratching your head thinking "What order?" Note the message body that follows:

Quote:

Dear Customer,

Thank you for ordering from our internet shop. If you paid with a credit card, the charge on your statement will be from name of our shop.

This email is to confirm the receipt of your order. Please do not reply as this email was sent from our automated confirmation system.

Date : 08 Oct 2006 - 12:40
Order ID : 37679041

Payment by Credit card

Product : Quantity : Price
WJM-PSP - Sony VAIO SZ370 C2D T7200 : 1 : 2,449.99

Subtotal : 2,449.99
Shipping : 32.88
TOTAL : 2,482.87

Your Order Summary located in the attachment file ( self-extracting archive with "37679041.pdf" file ).

PDF (Portable Document Format) files are created by Adobe Acrobat software and can be viewed with Adobe Acrobat Reader.
If you do not already have this viewer configured on a local drive, you may download it for free from Adobe's Web site.

We will ship your order from the warehouse nearest to you that has your items in stock (NY, TN, UT & CA). We strive to ship all orders the same day, but please allow 24hrs for processing.

You will receive another email with tracking information soon.

We hope you enjoy your order! Thank you for shopping with us!

Boy oh boy... I sure as heck didn't oder no stinkin $2,449.99 Sony VAIO from Circuit City!

Really makes ya wanna open that zip file to see if you've been had, right?

HEADERS for this spam:
Return-Path: <commiserate@flyingwebsites.com> Tue Oct 10 10:38:52 2006
Received: from UnknownHost [85.101.222.158] by ds98162-1 with SMTP;
Tue, 10 Oct 2006 10:38:52 -0400
Date: Tue, 10 Oct 2006 20:33:46 +0500
From: info@circuitcity.com
Message-ID: <68185984.55835593@crawford.com>
To: shreveport@operationhomefront.net
Subject: Order ID : 37679041 Is Being Processed
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------0BABE07038B4A4C"
X-Rcpt-To: <sac@operationhomefront.net>
X-SmarterMail-Spam: SPF_None

IP Trace for this message

Reg Info:
85.101.222.158
Record Type: IP Address
OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL[/quote]

Author: Ilex, Location: USA

Posted: Tue Oct 10, 2006 4:39 pm Post subject:

One of my coworkers got a similar message a little while ago, only his was from "Walmart". He apparently opened the attached zip file and broke IE.

I am looking for information on how to fix this, and will keep watching this space.

Author: PCBruiser,

Posted: Tue Oct 10, 2006 4:47 pm Post subject:

Hi, crimewatch,

I have two suggestions. First, the email your coworker received should be submitted to PERT, out anti-phising service that analyzes phish, and reports it to the appropriate authorities. You can submit the phish here:

CastleCops Link

/modules.php?name=Fried_Phish&fp=queue

Next, the zip file should be uploaded into this thread for analysis by CC's Security Experts.

Finally, I recommend that you follow CastleCops' Malware Removal and Prevention procedure for your co-workers system, a new system CastleCops devised to enable users to either partially, or fully clean their systems without the direct aid of an expert.

You will find the Malware Removal and Prevention Procedure here:

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

If that doesn't fix the problem, then go to this Forum, read the instructions at the top of the page carefully:

CastleCops Link

/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html

Follow these instructions:

CastleCops Link

/t102301-Hijackthis_Guidelines_Read_Before_Posting.html

and one of CC's trained 1st Responders or Security Experts will help you.

Author: PCBruiser,

Posted: Tue Oct 10, 2006 4:51 pm Post subject:

Pardon me, Ilex, I accidentally used the member name of the original poster to this thread. My mistake.

I cannot edit my prior post, so I should also note that I had three suggestions, not two. Again sorry about that also.

Finally, I also intended to welcome you to CastleCops.

Author: crimewatch, Location: USA

Posted: Tue Oct 10, 2006 5:00 pm Post subject:

Thanks guys....

I have wared all our chapters about this item. I realize it could be a big nuthin' but better safe than sorry. I have contacted the two domains that are real and one that is listed as "For Sale" so they know their names are being used. We'll see what CircuitCity.com and crawford.com has to say. I also included a link to this discussion.

I also made the following statement in my e-mail to them:

"The attached zip file was not opened due to security concerns. I doubt your firm wishes to be associated with such suspicious activity and would want to be a party to the solution. If we find the zip file contains a malicious script, we will do what we can to prosecute the offender under new California cyber protection laws. Your cooperation would be appreciated."

Has anyone had an opportunity to examine the zip file? What should I do next?

Author: crimewatch, Location: USA

Posted: Tue Oct 10, 2006 5:16 pm Post subject:

Question about Fried Phish(TM)

For the text box entitled: "And/or enter a complete phish URL" what specific URL goes there, if any?

Should we mention our national website where the harvesting may have taken place (or sub-web in this case)?

Author: PCBruiser,

Posted: Tue Oct 10, 2006 5:17 pm Post subject:

I would definitely recommend you submit the phish to PERT as I suggested earlier. PERT's news feeds are monitored by many security and police organizations, and generally gets takedown results pretty quickly. The zip file you posted earlier will be analyzed by one of our qualified Security Experts sometime in the next day or two. And they will report back in this thread what they found.

Author: nosirrah, Location: USA

Posted: Tue Oct 10, 2006 5:19 pm Post subject:

Not very surprising .

STATUS: FINISHEDComplete scanning result of "37679041.exe", received in VirusTotal at 10.10.2006, 18:45:02 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.25 10.10.2006 HEUR/Crypted
Authentium 4.93.8 10.10.2006 W32/Goldun.NJ@dr
Avast 4.7.892.0 10.10.2006 no virus found
AVG 386 10.10.2006 no virus found
BitDefender 7.2 10.10.2006 no virus found
CAT-QuickHeal 8.00 10.10.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 10.10.2006 Trojan.Haxdoor-131
DrWeb 4.33 10.10.2006 BackDoor.Haxdoor.359
eTrust-InoculateIT 23.73.18 10.10.2006 no virus found
eTrust-Vet 30.3.3125 10.10.2006 no virus found
Ewido 4.0 10.10.2006 no virus found
Fortinet 2.82.0.0 10.10.2006 suspicious
F-Prot 3.16f 10.10.2006 security risk named W32/Goldun.NJ@dr
F-Prot4 4.2.1.29 10.10.2006 W32/Goldun.NJ@dr
Ikarus 0.2.65.0 10.10.2006 Trojan-Downloader.Win32.Small.gen
Kaspersky 4.0.2.24 10.10.2006 Backdoor.Win32.Haxdoor.lf
McAfee 4869 10.09.2006 no virus found
Microsoft 1.1603 10.10.2006 no virus found
NOD32v2 1.1796 10.10.2006 a variant of Win32/Haxdoor
Norman 5.80.02 10.10.2006 Suspicious_F.gen
Panda 9.0.0.4 10.10.2006 Suspicious file
Sophos 4.10.0 10.05.2006 no virus found
TheHacker 6.0.1.094 10.08.2006 no virus found
UNA 1.83 10.09.2006 no virus found
VBA32 3.11.1 10.10.2006 no virus found
VirusBuster 4.3.7:9 10.10.2006 no virus found

Kaspersky can get rid of this and has a free trial : http://www.download.com/Kaspersky-Anti-Virus/3000-2239_4-10589989.html?tag=lst-0-2 . You may have to uninstall your current antivirus software to use Kaspersky .

Thanks for the sample BTW .It will come in handy for research .

Author: PCBruiser,

Posted: Tue Oct 10, 2006 5:21 pm Post subject:

crimewatch wrote:

Sorry, we cross-posted, and I didn't see this until after I just posted. If you paste the full phish into the first box, that's all they need. You can leave the second box empty.

Author: crimewatch, Location: USA

Posted: Tue Oct 10, 2006 6:04 pm Post subject: THANK YOU!!!

nosirrah wrote:

Not very surprising. STATUS: FINISHEDComplete scanning result of "37679041.exe", received in VirusTotal at 10.10.2006, 18:45:02 (CET). Thanks for the sample BTW .It will come in handy for research .

Okay, so the zip extracts to a .exe file that does nothing and on the surface doesn't look like a tojan or virus, right? It's not an altered file extension? I've run virus scans that cleared one day and and got a hit the on the same file the next day. That said, since I didn't unzip the file (if it's a true zip file) I should just be able to delete it, right? No time bomb here? Wink

I'm still trying to figure out how this came to me sac(at)operationhomefront.net when it was addressed to the other chapter.

Author: nosirrah, Location: USA

Posted: Tue Oct 10, 2006 6:22 pm Post subject:

Even unzipping it should not infect your system . I did and nothing happened . I will be running it tonight on my test system to see what it unleashes .

You will be fine just deleting it .

As to how you got this spam I am not the guy to ask . The members of our phishing forums would be better able to answer this question .

Author: crimewatch, Location: USA

Posted: Tue Oct 10, 2006 6:27 pm Post subject:

nosirrah wrote:

Not very surprising.

Another question if I may?

Recall the statement "self-extracting archive with "37679041.pdf" file" in the message body? Were you expecting it to extract a .pdf rather than an exe or is that the executable to open the pdf?

Cool

Learning is indeed a journey but testing what one learns can be a stop along the road worthy of a momentary destination.

Author: crimewatch, Location: USA

Posted: Tue Oct 10, 2006 6:37 pm Post subject:

nosirrah wrote:

As to how you got this spam I am not the guy to ask . The members of our phishing forums would be better able to answer this question .

Outstanding... thank you so much Nosirrah! Maybe we're related? I grew up spending some time at the business end of a Marine captain's swagger stick. Call me "whosirmesirnosirnotIsir!"

Oh, I did join PERT, will donate and become more involved. As you can see from my profile, I've been lurking and learning from all of you for a while.

Author: Ilex, Location: USA

Posted: Tue Oct 10, 2006 6:48 pm Post subject: Thank You!!!

Thank you, PCBruiser and nosirrah for your speedy and informative responses!

I moved the affected PC to my work area and found that IE works again since the re-boot. I will be getting started on the clean-up shortly, thank you again for the links and instructions.

My vile file appears to be the same one as previoulsy submitted; should I still upload it to the Phish Phry or will that be redundant?

Author: nosirrah, Location: USA

Posted: Tue Oct 10, 2006 6:49 pm Post subject:

crimewatch wrote:

nosirrah wrote:

Not very surprising.

Learning is indeed a journey but testing what one learns can be a stop along the road worthy of a momentary destination.

No , I know these jerks better than that . I would have been shocked if it were a pdf . Wink

The trick is to mask the .exe with the .zip (because this will bypass some email malware scanners) in hopes that you will just open what pops out of the .zip .

Quote:

Oh, I did join PERT, will donate and become more involved. As you can see from my profile, I've been lurking and learning from all of you for a while.

Learning , teaching and helping , that is what we are all about . Welcome aboard . Very Happy

CastleCops -> Unknown Files

All times are GMT

Goto page 1, 2, 3 Next Page 1 of 3