Trojaner-Board - Fundsxpress.com Spam: Merchant Statement

Merchant Statement

Wer eine Mail mit dem Betreff
Merchant Statement
erhält, sollte diese an uns weiterleiten.

Zitat:

From: "secure.fundsxpress.com" <noreply@secure.fundsxpress.com>
(gefälschter Absender)

Merchant Statement
Attached is your Fundsxpress.com Paymentech electronic Merchant Billing Statement.If you need help, please contact your Account Executive or call Merchant
Services at the telephone number listed on your statement.PLEASE DO NOT RESPOND BY USING REPLY. This email is sent from an unmonitored email address, and
your response will not be received by Fundsxpress.com Paymentech.Fundsxpress.com Paymentech will not be responsible for any liabilities that may result
from or relate to any failure or delay caused by Fundsxpress.com Paymentech's or the Merchant's email service or otherwise.Fundsxpress.com Paymentech recommends
that Merchants continue to monitor their statement information regularly.----------Learn more about Fundsxpress.com Paymentech Solutions, LLC payment processing
services at Secure.Fundsxpress.com.----------THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information
intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or
any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments
from your computer.

Es hängt an:
Statement ID 4657-345-347-0332.zip
(Nummern können varieren).
Rund 206 KB groß.
Virustotal Ergebniss der enthaltenen .EXE Datei:
https://www.virustotal.com/file/120e...is/1367876712/
MD5: 6b2cc223f1cc01af5d43c13601322b32
SHA1: f2e056642faec14108bb46164a0237aa2c63e79f
Detect: 23 / 46

Gen:Variant.Kazy.171162 (MicroWorld-eScan)
RDN/Generic.bfr!dr (McAfee)
Trojan (K7AntiVirus)
Trojan (K7GW)
W32/Trojan3.CEU (F-Prot)
Trojan.Zbot (Symantec)
TROJ_KRYPTIK.QGM (TrendMicro-HouseCall)
Trojan-Spy.Win32.Zbot.lgee (Kaspersky)
Gen:Variant.Kazy.171162 (BitDefender)
Troj/Bredo-AGI (Sophos)
UnclassifiedMalware (Comodo)
Trojan-Spy:W32/Zbot.BBHY (F-Secure)
Trojan.PWS.Panda.3734 (DrWeb)
TR/Spy.ZBot.lgee (AntiVir)
TROJ_KRYPTIK.QGM (TrendMicro)
Trojan.Win32.Agent.AMN (A) (Emsisoft)
PWS:Win32/Zbot (Microsoft)
Gen:Variant.Kazy.171162 (GData)
W32/Trojan.OASN-2506 (Commtouch)
Trojan.Zbot (PCTools)
Win32/Spy.Zbot.AAU (ESET-NOD32)
Trojan-Spy.Agent (Ikarus)
Suspicious file (Panda)

Es handelt sich hierbei um Zeus Gameover

Folgene Autostart Einträge werden erstellt:

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run
{0F023442-9CC8-AD41-4DB7-7B5F439F584D}
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Edysi\yqedni.exe

die Malware verbindet zu:

mail.yaklasim.com:8080/ponyb/gate.php

Diese Malware ist in der Lage, sensible Daten zu stehlen.
FTP Zugänge, Banking Daten, sonstige Passwörter.

- Wer eine solche, oder ähnliche verdächtige Mail erhält, möge diese an uns weiterleiten.
markusg - trojaner-board.de
- Mails, die man erhält, immer gründlich lesen.
- wer den Link geöffnet hatt, bitte ein Thema bei uns eröffnen.
http://www.trojaner-board.de/log-analyse-auswertung