{"id":13606,"date":"2013-07-25T00:00:22","date_gmt":"2013-07-25T07:00:22","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=12150"},"modified":"2018-10-05T12:48:43","modified_gmt":"2018-10-05T18:48:43","slug":"fake-copy-of-vodafone-u-k-contractyour-monthly-vodafone-bill-is-readynew-mms-received-themed-emails-lead-to-malware","status":"publish","type":"post","link":"https://www.webroot.com/blog/2013\/07\/25\/fake-copy-of-vodafone-u-k-contractyour-monthly-vodafone-bill-is-readynew-mms-received-themed-emails-lead-to-malware\/","title":{"rendered":"Fake ‘Copy of Vodafone U.K Contract\/Your Monthly Vodafone Bill is Ready\/New MMS Received’ themed emails lead to malware"},"content":{"rendered":"

Cybercriminals continue targeting U.K based Internet users in an attempt to trick them into thinking that they’ve received a legitimate email from Vodafone<\/strong><\/a> U.K. We’ve intercepted two, currently circulating, malicious spam campaign that\u00a0once again impersonate Vodafone U.K, this time relying on a bogus “Copy of Vodafone U.K<\/em>” themed messages, the ubiquitous ‘MMS Message Received<\/em>‘ campaign, as well as the most recent ‘Your Monthly Vondafone Bill is Ready<\/em>‘ theme.<\/p>\n

More details:<\/p>\n

<\/p>\n

Sample screenshots of the spamvertised emails:<\/strong><\/p>\n

\"Vodafone_UK_United_Kingdom_Fake_Contract_Shop_Email_Spam_Spamvertised_Malicious_Software_Malware_Social_Engineering\"<\/a><\/p>\n

\"Fake_Email_Spam_Spamvertised_Malware_Malicious_Software_Social_Engineering_Vodafone_UK_United_Kingdom_Your_Bill_Is_Ready\"<\/a><\/p>\n

Detection rates for the spamvertised malicious attachments:<\/strong>
\nMD5: a5bdeaadb002e12a38c9d354097f9a9a<\/strong><\/a> – detected by 30 out of 46 antivirus scanners as Backdoor.Win32.Androm.aehi; TrojanDownloader:Win32\/Dofoil.R.
\nMD5: 6aeacb54d57cddff1b1b39d2d3b32140<\/strong><\/a> – detected by 6 out of 47 antivirus scanners as Artemis!6AEACB54D57C; UDS:DangerousObject.Multi.Generic.
\nMD5: 3965d6f027812306ea953dbd0ac0bce0<\/strong><\/a> \u2013 detected by 6 out of 47 antivirus scanners as Heuristic.BehavesLike.Win32.ModifiedUPX.C; Trojan\/Win32.Tepfer.<\/p>\n

The last sample marks its presence on the affected systems through the following Mutexes:
\nCTF.TimListCache.FMPDefaultS-1-5-21-1547161642-507921405-839522115-1004MUTEX.DefaultS-1-5-21-1547161642-507921405-839522115-1004<\/em>
\n0B298A164743E1643757A7223C7E2D3470144646<\/em><\/p>\n

All of these samples phone back to the same C&C server:<\/strong>
\nhxxp:\/\/37.139.47.159\/fexco\/com\/index.php<\/em> (37-139-47-159.clodo.ru, AS56534)<\/p>\n

Webroot\u00a0SecureAnywhere<\/a><\/strong>\u00a0users are proactively protected from these threats.<\/p>\n

You can find more about Dancho\u00a0Danchev at his\u00a0LinkedIn Profile<\/a><\/strong>. You can also\u00a0follow him on Twitter<\/a><\/strong>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Cybercriminals continue targeting U.K based Internet users in an attempt to trick them into thinking that they’ve received a legitimate email from Vodafone U.K. We’ve intercepted two, currently circulating, malicious spam campaign that\u00a0once again impersonate Vodafone U.K, this time relying on a bogus “Copy of Vodafone U.K” themed messages, the ubiquitous ‘MMS Message Received‘ campaign, […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[14777,14771,14763,15659,15655,4811,3871,3881,5257,15663,4065,5717,4603,3875,5721,5883,12529,3529,11999,12759],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/13606"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=13606"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/13606\/revisions"}],"predecessor-version":[{"id":25707,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/13606\/revisions\/25707"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=13606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=13606"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=13606"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=13606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}