{"id":72541,"date":"2011-07-28T11:22:47","date_gmt":"2011-07-28T11:22:47","guid":{"rendered":"https:\/\/localhost\/wordpress\/?p=72541"},"modified":"2011-07-28T11:22:47","modified_gmt":"2011-07-28T11:22:47","slug":"mastercard-spam-leads-to-fake-av","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/mastercard-spam-leads-to-fake-av\/","title":{"rendered":"MasterCard spam leads to Fake AV"},"content":{"rendered":"

We’re seeing a significant “spam attached malware” campaign in the past 48 hours with different attachment MD5s.<\/p>\n

3305f83abf31fc66fa8f588b35be8eb2
\n8e3331b64a5884e1ef4f4c8a3d09bc7a<\/p>\n

\"\"<\/p>\n

The username portion of the email sender is random, using a classic misspelling that has been consistent. Usernames are a single word, followed by a “.”, “_” or “-“, followed by a two or three digit number. The most popular words (by far) are “manager” and “support”, but we’ve also seen “admin”, “administration”, “alerts”, “cunsumer”, “delivery”, “e-file”, “finance”, “frboard-webannouncements”, “govdelivery”, “information”, “inspector”, “news”, “news-alerts”, “no-reply”, “protection”, “public”, “report”, “service”, “stats”, “subscriber”, “subscriptions”, “usttb” and “webannouncements”.<\/p>\n

The attached file is actually named as a “.com” using a random seeming filename in the format “id” followed by a 5-7 digit number (such as id918538.com).<\/p>\n

When the file is launched, it attempts to make a connection with any of a long list of domains that are probably made by a “DGA” or “Domain Generation Algorithm”. It’s likely that at different times or days this list would be different. The purpose of the malware seems to be just another fake anti-virus product. Here’s the scan that kicked off:<\/p>\n

\"\"<\/p>\n

After the scan, as expected, I was constantly reminded of the grave danger I was in:<\/p>\n

\"\"<\/p>\n

By using Quick Heal Total security<\/a>, such fraudulent emails get tagged as spam and users stay protected.
\nQuick Heal also detects malicious attachments and the installed rogueware files.<\/p>\n

\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"

We’re seeing a significant “spam attached malware” campaign in the past 48 hours with different attachment MD5s. 3305f83abf31fc66fa8f588b35be8eb2 8e3331b64a5884e1ef4f4c8a3d09bc7a The username portion of the email sender is random, using a classic misspelling that has been consistent. Usernames are a single word, followed by a “.”, “_” or “-“, followed by a two or three digit […]<\/p>\n","protected":false},"author":22,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,24],"tags":[22,23,25,26,27],"class_list":["post-72541","post","type-post","status-publish","format-standard","hentry","category-email","category-malware","tag-email-malware","tag-fraudulent-email","tag-phishing","tag-rogueware","tag-scareware"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72541"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=72541"}],"version-history":[{"count":0,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72541\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=72541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=72541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=72541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}