Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Another Day, Another Spam... - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Another Day, Another Spam...

In my last diary[1], I gave an example of an uncommon spam message. But attackers have always new ideas to deliver their malicious content to us. Here are two new examples. October being the Cyber Security Awareness month[2], more examples are always welcome.

The first one was delivered as an "NDR" message ("Non-Delivery Receipt") to the SANS ISC handlers mailbox:

From: "Bounced mail" 
To: handlers@isc.sans.edu
Subject: Mail System Error - Returned Mail
Date: Fri, 21 Oct 2016 22:08:23 +0530
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <20161021163820.8819C40060@isc.sans.org>
X-Envelope-To: UNKNOWNX-Loop: handlermail

Your message was not delivered due to the following reason(s):

Your message could not be delivered because the destination server was
not reachable within the allowed queue period. The amount of time
a message is queued before it is returned depends on local configura-
tion parameters.

Most likely there is a network problem that prevented delivery, but
it is also possible that the computer is turned off, or does not
have a mail system running right now.

Your message was not delivered within 1 days:
Server 32.80.249.78 is not responding.

The following recipients could not receive this message:


Please reply to postmaster@isc.sans.edu
if you feel this message to be in error.

Attached to this mail, a malicious ZIP file with a .pif file inside. The file is in fact a PE file (MD5: 2aa0d2ae9f8492e2b4acda1270616393). The hash was unknow to VT but once uploaded, it was reported as a very old worm, nothing very malicious.

The second example was received by one of our readers is a fake SharePoint notification:

The link points to hxxp://thekchencholing.org/.https/www/sharepoint.com/sites/shareddocument/SitePages/Home.aspx/index.php?wreply=YW5keS5nZXJhZXJ0c0BjZWdla2EuYmUN (the site has been cleaned up in the meantime). SharePoint is a common Microsoft tool used in big organizations and people could be lured by this kind of message.

Most spam campaigns are easy to detect but some messages, when properly redacted, may lure the victim easily. We are never far from an unfortunate click. Stay safe!

[1] https://isc.sans.edu/forums/diary/Spam+Delivered+via+ICS+Files/21611/
[2] https://www.dhs.gov/national-cyber-security-awareness-month

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

Xme

466 Posts
ISC Handler
Greetings,

In regards to spam messages, we've been receiving a lot of them more frequently than normal. The most recent one we received contained this message:

-Begin message-

--------------------------------
YOU RECEIVED A FAX R772815
-----------------------------------

Color Depth: 8 Bits
Conn Time: 02 m. 31 s.
DTMF/DID: Digital
Remote ID: 2929-432-746
Template: normal

Please download your fax from attached file

Your archive password: aqr3

-End Message-

Attached to the e-mail was a file called "Criminal_Case.against-You X42 NVM 76C.rar"

I've seen a lot of the messages before showing invoices for things or other documents, but this was the first time I had seen them spoof an eFax.

Respectfully,
Josh
PotatoMcGruff

1 Posts
Here's a new one I got today, complete with malicious word doc:

Subject: credit card charge from <domain name in the to>

What is this fucking charge on my card?
I never visited or bought anything from <domain name in the to>.
I have attached a screenshot of my statement.
I want my money back!!!
I have attached my card statement, please get back to me ASAP.

Thank you
<redacted company name>
<redacted sender name>
P. <redacted phone number with correct area code for company>
F. <redacted phone number with correct area code for company>
R

35 Posts
These days I have been receiving spoofed emails sending pishing of banks. It has been used two tecniques:
1. The From:, Return-Path:, Reply-To:, and To: is the same address (address spoofed of our email system).
2. The message arrive to our email system:
2.a. If the message is accepted in our email system, is delivery to the recipient.
2.b. It the message is rejected in our email system (this address is not allowed to send unauthenticated messages from Internet), the messages is rejected in our system, and then the MTA sending the email send a second message of "Non-Delivery Receipt" with subject "Returned mail: see transcript for details" with the original message attached.

In both cases, the message is delivered to the target.

Somebody have been receiving these type of malicious email?
Do you know how to defend against this attack?
Thank you.
R
1 Posts

Sign Up for Free or Log In to start participating in the conversation!