CHASE Bank Spam: Incoming Wire Transfer

markusg · 24.05.2013, 16:59

Incoming Wire Transfer

Wer eine Mail mit dem Betreff

Zitat:

"Incoming Wire Transfer"
erhält, sollte diese an uns weiterleiten.

From: "Chase" <Chase@emailinfo.chase.com>
(gefälschter Absender)
Subject: Incoming Wire Transfer

Note: This is a service message with information related to your Chase
account(s). It may include specific details about transactions, products or
online services. If you recently cancelled your account, please disregard this
message.
CHASE
<http://email.chase.com/1fc2a7973layfousibubltdyaaaaaaecevjmc2cnhd4yaaaaa>

** We're writing to let you know the "Incoming Wire Transfer Report" is
available.
If you are not aware of this transaction or have concerns about the request,
please contact your company administrator.

The detailed Information about this transaction is available in the attached file.

Zitat:

Account: BUSINESS CHECKING/SAVINGS ACCOUNT
Date of deposit: 05/24/2013
Transaction number: 1
Type: International Wire Transfer
Amount: $136,835.10

If you aren't enrolled in "Incoming Transfer Report's" and think you've received
this message in error, please call our Customer Support team immediately, using
the phone number on the "Contact Us" page on Chase Online.

Note: This e-mail may contain confidential information. If you are not the
intended recipient (or have received this e-mail in error) please notify the
sender immediately and destroy this e-mail. Any unauthorized copying, disclosure
or distribution of the material in this e-mail is strictly forbidden.

E-mail Security Information

If you would like to learn more about e-mail security or want to report a
suspicious e-mail, click here
<http://email.chase.com/13495b33dlayfousibublteaaaaaaaecevjmc2cnhd4yaaaaa>.

*Note:* If you are concerned about clicking links in this e-mail, the Chase
Online services mentioned above can be accessed by typing
www.chase.com

<http://email.chase.com/1d7818769layfousibublteiaaaaaaecevjmc2cnhd4yaaaaa>

directly into your browser.

If you want to contact Chase, please do not reply to this message, but instead
go to
www.chase.com

<http://email.chase.com/129ccddd4layfousibublteqaaaaaaecevjmc2cnhd4yaaaaa>.
For
faster service, please enroll or log in to your account. Replies to this message
will not be read or responded to.

Your personal information is protected by advanced technology. For more detailed
security information, view our Online Privacy Policy
<http://email.chase.com/1cad8e980layfousibublteyaaaaaaecevjmc2cnhd4yaaaaa>.
To
request in writing: Chase Privacy Operations, PO Box 659752, San Antonio, TX
78265-9752.

JPMorgan Chase Bank, N.A. Member FDIC
2013 JPMorgan Chase & Co.
LCAA0213S

Es hängt an:
incoming_wire_05242013.zip
Rund 98,1 KB groß.
Virustotal Ergebniss der enthaltenen .EXE Datei:
https://www.virustotal.com/file/0a23...is/1369411502/
MD5: f9182e5f13271cefc2695baa11926fab
SHA1: b3cff6332f2773cecb2f5037937bb89c6125ec15
Detect: 10 / 47

Artemis!F9182E5F1327 (McAfee)
Malware.Packer.RRE (Malwarebytes)
W32/Trojan3.FHV (F-Prot)
Hlux.ZY (Norman)
Trojan-PSW.Win32.Tepfer.kzck (Kaspersky)
Gen:Variant.Kazy.178159 (BitDefender)
Trojan.Packed.196 (DrWeb)
Artemis!F9182E5F1327 (McAfee-GW-Edition)
W32/Trojan.NCDK-5971 (Commtouch)
Win32/Kryptik.BBVN (ESET-NOD32)

Es handelt sich hierbei um Zeus Gameover

Folgene Autostart Einträge werden erstellt:

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run
Ohbefy
"C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Ahgy\ohbefy.exe"

die Malware verbindet zu:

exquisitemusic.net/8VpK.exe

116.122.158.195:8080/forum/viewtopic.php

Diese Malware ist in der Lage, sensible Daten zu stehlen.
Passwörter, Banking Daten, etc.

- Wer eine solche, oder ähnliche verdächtige Mail erhält, möge diese an uns weiterleiten.
markusg - trojaner-board.de
- Mails, die man erhält, immer gründlich lesen.
- wer den Link geöffnet hatt, bitte ein Thema bei uns eröffnen.
http://www.trojaner-board.de/log-analyse-auswertung
- wer in sozialen Netzwerken aktiv ist, sollte den Link zu diesem beitrag ruhig teilen, um andere zu warnen

Code:

ATTFilter

http://www.trojaner-board.de/135504-chase-bank-spam-incoming-wire-transfer.html

CHASE Bank Spam: Incoming Wire Transfer

Diskussionsforum: CHASE Bank Spam: Incoming Wire Transfer

CHASE Bank Spam: Incoming Wire Transfer

Ähnliche Themen: CHASE Bank Spam: Incoming Wire Transfer