Offizielle Gewinnbenachrichtigung (Gewinnbenachritigung)

Achtung unseriöse email

Betreff der email: OFFIZIELLE GEWINNBENACHRITIGUNG

Scheinbarer Absender:

Inhalt der schädlichen email (in Textform):

     OFFIZIELLE GEWINNBENACHRITIGUNG

Wir sind erfreut ihnen mitteilen zu koennen, das die gewinnliste INTERNATIONALE LOTTO PROGRAMM an 10/11/2010. erschienen ist, der Organisator World Tourism Organization/Spanish Ministerio de Tourismo hat Sie auf der offiziellen Liste der gewinne,r erschienen am 13/11/2010.

DON LUIS ALBERT
( VICE PRESIDENT INTERNACIONAL AWARD DEPT. )

Ergänzende Anmerkungen:

invoice copy

Achtung unseriöse email

Betreff der email: invoice copy (waiting for your confirmation)


Scheinbarer Absender: beliebige email-Adresse

Inhalt der schädlichen email (in Textform):

Kindly open to see export License and payment invoice attached,
meanwhile we sent the balance payment yesterday.
Please confirm if it has settled in your account or you can call if
there is any problem.

Thanks
J.parker
Tiffany & Co.

Ergänzende Anmerkungen:

Typische fake-email "Skype voicemail service"

You received a new message from Skype voicemail service - Virus



This is an automated email, please don't reply.
Voice Message Notification

You received a new message from Skype voicemail service.

Message Details:

Time of Call: 17 Dec 2013 10:20:24 -0400
Length of Call: 38sec

Listen to the message (im Original verlinkt)
2003-2011 Skype Limited. Skype Communications S.a.r.l. 23-29 Rives de Clausen, L-2165 Luxembourg.  Skype, associated trademarks and logos and the "S" symbol are trademarks of Skype Limited.




Subject:  You received a new message from Skype voicemail service

This is an automated email, please don't reply.

Voice Message Notification

You received a new message from Skype voicemail service.

Message Details:

Time of Call: 17 Dec 2013 10:20:24 -0400
Length of Call: 38sec

Listen to the message
in the attached file.

S 2003-2013 Skype and/or Microsoft. The Skype name, associated trademarks and logos and 
the “S”
logo are trademarks of Skype or related entities.
Skype Communications S.a.r.l. 23-29 Rives de Clausen, L-2165 Luxembourg.

2003-2011 Skype Limited. Skype Communications S.a.r.l. 23-29 Rives de Clausen, L-2165 Luxembourg.
Skype, associated trademarks and logos and the "S" symbol are trademarks of Skype Limited.

   MSG-88494HA29.zip (67)

Malware Link Version:


Subject: You received a new message from Skype voicemail service

This is an automated email, please don't reply.
Voice Message Notification

You received a new message from Skype voicemail service.

Message Details:

Time of Call: 17 Dec 2013 10:20:24 -0400
Length of Call: 38sec

Listen to the message

2003-2011 Skype Limited. Skype Communications S.a.r.l. 23-29 Rives de Clausen, L-2165 Luxembourg.
Skype, associated trademarks and logos and the "S" symbol are trademarks of Skype Limited.

---

Header Examples:

Spoofs gmail and yahoo email addresses.

Received: from gateway.flycommunications.net [92.63.232.1]
   X-Envelope-From: reconfiguredf51 @gmail.com
   From: "Skype Communications" <reconfiguredf51 @gmail.com>
   Subject:  You received a new message from Skype voicemail service

Received: from bzq-79-176-166-233.red.bezeqint.net [79.176.166.233]
   X-Envelope-From: nayspiv26 @yahoo.com
   Subject:  You received a new message from Skype voicemail service

   From: "Skype Communications" <nayspiv26 @yahoo.com>
Received: from 50-201-219-238-static.hfc.comcastbusiness.net [50.201.219.238]
   X-Envelope-From: test @yahoo.com
   From: "Skype Communications" <test @yahoo.com>
   Subject:  You received a new message from Skype voicemail service

Received: from static.kpn.net [92.71.231.114]
   X-Envelope-From: penancinghm51 @yahoo.com
   From: "Skype Communications" <penancinghm51 @yahoo.com>
   Subject:  You received a new message from Skype voicemail service

Received: from rrcs-24-123-68-90.central.biz.rr.com [24.123.68.90]
   X-Envelope-From: commiseratess18 @yahoo.com
   From: "Skype Communications" <commiseratess18 @yahoo.com>
   Subject:  You received a new message from Skype voicemail service

Attachment / Link Samples:

18 December 2013 (Attachment type)

MSG-88494HA29.zip containing MSG-88494HA29.exe


VirusTotal report

Avast   Win32:Dropper-gen [Drp] 
ESET-NOD32  Win32/TrojanDownloader.Wauchos.X 
F-Prot   W32/Trojan3.GVE 
Commtouch  W32/Trojan.EQAE-3652 
TrendMicro  TSPY_ZBOT.OBY 
DrWeb   Trojan.Inject2.23 
Sophos   Troj/Agent-AFDT 
Kaspersky  Backdoor.Win32.Androm.bjpn 
Symantec  Backdoor.Trojan 

Malwr.com report

Installs itself for autorun at Windows startup

File-Analyzer.net report

Networking
Contains functionality to download additional files from the internet
 Urls found in memory or binary data
 Downloads files from webservers via HTTP
 Found strings which match to known social media urls
 Performs DNS lookups
 Posts data to webserver
  finley.su /new2 /gate.php  <-- is this a zues pony variant
  berges-saint-germain.com /UPC.exe
  finley.su /s1.mod
  81.177.170.217 /rk.mod
Boot Survival
Stealing of Sensitive Information
Data Obfuscation
HIPS / PFW / Operating System Protection Evasion
Anti Debugging
Virtual Machine Detection
AV process strings found
 avp.exe

domains:
massfloor.ru    5.79.83.20
finley.su     178.160.144.227
berges-saint-germain.com         213.186.33.40

ips:
213.186.33.40 France
195.186.1.121 Switzerland
5.79.83.20  Netherlands
157.56.77.158 United States
195.186.4.121 Switzerland
81.177.170.217 Russian Federation
178.160.144.227 Armenia

19 February 2014 (Link type)

Emails come with a series of links like:

frms.myzen.co.uk /1.html
hargreavesfurniture.co.uk /1.html
troytempest.com /1.html
myjanespa.com /1.html
honeybass.com /1.html
thehomelanddevelopers.com /1.html
gotohongkongspa.com /1.html
glashow-md.com /1.html
armormetalroofing.com /1.html
www.accentjamie.com /1.html
aquahousehibachi.com /1.html
tinysgardenspa.com /1.html
koolitz.com /1.html
pcdresale.com /1.html
theviewoman.com /1.html
walkerstribeca.com /1.html
mojosdeli.com /1.html
hillsideglass.co.za /1.html
ns228746.ovh.net /~laboitea /1.html
suntannailnyc.com /1.html
footfunflushing.com /1.html
sumofl.com /1.html
kosheryamasushi.us /1.html
christmas-goose.co.uk /1.html
aipn.it /1.html
munnarblooms.com /1.html
penplacer.com /1.html
goldroyalties.ca /1.html
www.minka.co.uk /~mnk-ftp /1.html
chinafun88.com /1.html
afflatusgravure.com /1.html
teakoprime.com /1.html
varadacreation.com /1.html
www.seoservicesindia.co /1.html
misaghbikes.ir /1.html
nuknfuts.aisites.com /1.html
mocha7003.mochahost.com /~msimecek /1.html
thericerestaurant.com /1.html
saladshackny.com /1.html
globalstudieschina.com /1.html
nyuslawyers.com /1.html
napolisfrisco.com /1.html
mocha7003.mochahost.com /~hypno /1.html
neseastudentdesigncompetition.org /1.html
cartes-d-affaire.com /1.html
allanteske.com /1.html
partyplancatering.com /1.html
masande.ie /1.html
www.svnhatta.com /1.html
vweb6.manufacture.com.tw /~chanlong /1.html
cmfoodny.com /1.html
malarstwodmw.artist.pl /1.html
go3gift.com /1.html
airportchapel.co.za /1.html
vssportsnetwork.com /1.html
ixora.mschosting.com /~stableco /1.html
kathsimages.co.za /1.html
ajrelax.com /1.html
mocha7003.mochahost.com /~hypnothe /1.html
kaszubyranczo.w.interia.pl /1.html
fashionmassagenorcross.com /1.html
pinpointmedia.tv /1.html
industrial-in.com /1.html
peculiarpresents.co.uk /1.html
newworldinvestor.com /1.html
www.counteract.talktalk.net /1.html
froyocafegardner.com /1.html
hhs1973.com /1.html
theaxiomproject.com /1.html

Each landing pages tries to load two or so javascript files (with .txt file extensions) like...

merdekapalace.com /1.txt
www.shivammehta.com /1.txt

Which will try to redirect to some malware site like ...

p22473.typo3server.info /9 /jsanalyzer.aspx
nedapardaz.com /theme /it /browser /_lzf_.php
merkabahcentro.com /xmlbrowser.aspx

You received a new message from Skype voicemail service - Virus

Achtung: Gefälschte Mail mit BSI-Absender im Umlauf

Warnung vom Bundesamt für Sicherheit in der Informationstechnik:

Online-Kriminelle verschicken derzeit erneut E-Mails, deren Absender angeblich das BSI ist. Die Mails mit dem Betreff "Information" enthalten im Anhang ein vermeintliches "Merkblatt" des BSI mit Sicherheitsempfehlungen. Die entsprechende Datei enthält jedoch stattdessen ein Schadprogramm, das sich beim Öffnen automatisch auf dem PC des Nutzers installiert.

Diese oder ähnlich lautende E-Mails stammen nicht vom BSI! Wenn Sie eine dieser Mails erhalten haben, sollten Sie den Anhang in keinem Fall öffnen, sondern die Mail umgehend löschen.

Ist die Datei im Anhang bereits geöffnet worden, dann ist es ratsam, den Computer mit einem aktuellen Virenscanner zu überprüfen und zu bereinigen. Da das Schadprogramm zurzeit noch nicht von allen Virenschutz-Programmen erkannt wird, sollten Sie nach rund 24 Stunden den Rechner erneut überprüfen. Eventuell kann es auch sinnvoll sein, den Rechner bei einem Befall mit Schadsoftware komplett neu aufzusetzen. Hilfestellung dazu bietet die BSI-für-Bürger-Webseite.

Opfer von Internetkriminalität: was kann man als Betroffener tun?

Falls Sie Opfer von Cyberkriminalität geworden sind, ist der richtige Ansprechpartner in jedem Fall die Polizei - entweder die örtliche Polizeidienststelle oder eine der Online- oder Internetwachen, die die Polizeien der Länder eingerichtet haben.

Was dabei zu beachten ist und welche Beweise eventuell gesichert werden sollten, beschreibt die Polizei Niedersachsen in ihrem Ratgeber Internetkriminalität.

Mastercard

Achtung unseriöse email

Betreff der email:    Betreff:     Ihre Karte wird Suspendiert


Scheinbarer Absender:www.mastercard.de <support@mastercard.de>

Inhalt der schädlichen email (in Textform):

Sehr geehrter Kunde,


Als SicherheitsmaЯnahme, mьssen wir Daten von der Karte zu ьberprьfen. Bitte bestдtigen Sie Ihre Anmeldeinformationen einmal.
Nach Angaben bestдtigen Ihre Karte wird aktualisiert.

Gehen Sie wie folgt.
1. Цffnen Sie die Datei in Ihrem E-Mail-Anhang und wдhlen Sie "Цffnen mit" aus!
2. Bitte fьllen Sie alle Daten aus und klicken Sie auf "Ьberprьfen"!


mit freundlichen GrьЯen
MasterCard Deutschland 2013

Ergänzende Anmerkungen:

Barclays transaction notification

Achtung unseriöse email

Betreff der email:    Betreff:     Barclays transaction notification #4280-404


Scheinbarer Absender:freedoml42@gmail.com

Inhalt der schädlichen email (in Textform):

ITransaction is completed. 2054 GBP has been successfully transfered.
If the transaction was made by mistake please contact our customer service.
Receipt on payment is attached.
Barclays Bank PLC is {MIX: by the Prudential Regulation Authority and {MIX:reuglated by the Finacnial Conduct Authority and the Prudential Regulation Authority except for lending where we are licesned by The Office of Fair Trading. Authroisation can be checked on the Financial Services Register. Barclays Bank PLC is a member of the Financial Services Compensation Scheme and the Financial Ombudsman Service. We subscribe to the Lending Code.
Barclays Bank PLC Registered Office: 18 Gresham Street, London EC68V 3HN. Registered in England and Wales No. 8820.
Save the Change® is a registered trademark of Barclays Bank PLC
PhoneBank® is a registered trademark of Barclays Bank PLC

Ergänzende Anmerkungen: Schädlicher Anhang (ZIP)

UPS Exception Notification,

Achtung unseriöse email

Betreff der email: UPS Exception Notification, Tracking Number 1Z522A9A4462324832

Scheinbarer Absender: UPS

Inhalt der schädlichen email (in Textform):

At the request of the shipper, please be advised that delivery of the following shipment has been rescheduled.

Important Delivery Information


Discover more about UPS:
Visit ups.com


Tracking Number:    1Z522A9A6892487822
Rescheduled Delivery Date:    14-April-2014
Exception Reason:    THE CUSTOMER WAS NOT AVAILABLE ON THE 1ST ATTEMPT. A 2ND ATTEMPT WILL BE MADE
Exception Resolution:    PACKAGE WILL BE DELIVERED NEXT BUSINESS DAY.
Shipment Detail 1Z522A9A6892487822 attached to the letter.

This e-mail contains proprietary information and may be confidential. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution or copying of this message is strictly prohibited. If you received this message in error, please delete it immediately.

This e-mail was automatically generated by UPS e-mail services at the shipper's request. Any reply to this e-mail will not be received by UPS or the shipper. Please contact the shipper directly if you have questions regarding the referenced shipment or you wish to discontinue this notification service.

© 2014 United Parcel Service of America, Inc. UPS, the UPS brandmark, and the color brown are trademarks of United Parcel Service of America, Inc. All rights reserved.
For more information on UPS's privacy practices, refer to the UPS Privacy Policy.
Please do not reply directly to this e-mail. UPS will not receive any reply message.
For questions or comments, visit Contact UPS.

This communication contains proprietary information and may be confidential. If you are not the intended recipient, the reading, copying, disclosure or other use of the contents of this e-mail is strictly prohibited and you are instructed to please delete this e-mail immediately.
Privacy Notice
Contact UPS

Ergänzende Anmerkungen:

Restpostenangebote auf facebook & Co

Die „B2B-Abzocke“ richtet sich mit Lock-Angeboten und durch Werbung in Social Media (v.a. auf Facebook) scheinbar an Gewerbetreibende. In Wahrheit werden Endverbraucher gezielt in eine Kostenfalle gelockt.

Es wird der Eindruck vermittelt, dass man nach einer kurzen Registrierung Konkursware, z.B. iPhones, Energy-Drinks, Parfums etc., zu extrem günstigen Preisen erstehen kann.

 Die Werbeanzeigen richten sich vorgeblich an Gewerbetreibende, zielen aber in Wahrheit auf Privat-Nutzer ab. Insbesondere die bekannten Abzocker-Firmen B2B Technologies Chemnitz GmbH (früher Melango.de GmbH bzw. JW Handelssysteme GmbH) und Vendis GmbH sorgen für Probleme.

Mehr Informationen zum Thema erhalten Sie hier:
http://www.watchlist-internet.at/abo-fallen/stark-gestiegen-b2b-abzocke/

CDS invoice

Achtung unseriöse email

Betreff der email: CDS Invoice: 168027


Scheinbarer Absender:  accounts@cdsgroup.co.uk

Inhalt der schädlichen email (in Textform):

Dear client

Please find attached your invoice number 168027

If you have any queries with this invoice, please email us at accounts@cdsgroup.co.uk or call us on 020 8752 8040

For and on behalf of

The CDS Group of Companies

                                                           

Crawfords of London  |  CrawfordsDelivery Services  |  Media Express  |    CDS International

   Passenger Car Services                     Same Day UK Couriers                  TV Support Units     Overnight & International




 

Tel:     020 8752 8040
Email: accounts@cdsgroup.co.uk

P Please consider the environment before printing this email.

This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please telephone or email the sender and delete this message and any attachment from your system.

If you are not the intended recipient you must not copy this message or attachment or disclose the contents to any other person. This e-mail or any attachments are for information purpose only and does not form any part of an agreement, contract or fact.

The contents of an attachment to this e-mail may contain software viruses, which could damage your own computer system. Whilst The CDS Group has taken every reasonable precaution to minimise the risk, we do not accept liability for any damage, which you sustain as a result of software viruses. You should carry out your own virus checks before opening any attachment to this e-mail.

This email has been scanned by iomartcloud.
http://www.iomartcloud.com

Ergänzende Anmerkungen: