{"id":72711,"date":"2010-12-17T06:03:23","date_gmt":"2010-12-17T06:03:23","guid":{"rendered":"https:\/\/localhost\/wordpress\/?p=72711"},"modified":"2010-12-17T06:03:23","modified_gmt":"2010-12-17T06:03:23","slug":"fake-amazon-shipping-update-email-spreads-malware","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/fake-amazon-shipping-update-email-spreads-malware\/","title":{"rendered":"Fake Amazon shipping update email spreads malware."},"content":{"rendered":"

Are you waiting for a delivery from Amazon.com? Then be careful\u2026.
\nIf you receive a below notification in your email, as it could be that hackers are trying to trick you into infecting your computer.<\/p>\n

\"\"<\/p>\n

When we click on \u201cShop Now & Save\u201d<\/strong>, it downloads the file in a zip format, which contain the malicious file.<\/p>\n

The download location of the file is below,<\/p>\n

https:\/\/marc.info\/?l=phpdoc&m=124294161207621&q=p3<\/p>\n

This script contains additional urls. From where it downloads and executes additional malwares on the affected machine. The data identified by the above URL was then requested from the remote web server.<\/p>\n

https:\/\/{xxxx}dnl.com\/6-40\/l\/a\/laabaa\/tdl.exe
\nhttps:\/\/www.{xxxx}btown.com\/laabaa\/tdl.exe<\/p>\n

More information about remote host server.<\/p>\n

Domain : – MARC.INFO
\nPerson : – Private Person
\nCreated : – 2002.07.13
\nIP Country : – US
\nIP Address : – 70.89.85.151 , 173.79.223.25<\/p>\n

If you received the email as above please don’t open the attached ZIP file as it contains malware.
\nQuick Heal detects it as “Trojan.Agent.cifa” .<\/p>\n

Thanks Mahesh.<\/p>\n","protected":false},"excerpt":{"rendered":"

Are you waiting for a delivery from Amazon.com? Then be careful\u2026. If you receive a below notification in your email, as it could be that hackers are trying to trick you into infecting your computer. When we click on \u201cShop Now & Save\u201d, it downloads the file in a zip format, which contain the malicious […]<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-72711","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72711"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=72711"}],"version-history":[{"count":0,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/72711\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=72711"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=72711"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=72711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}