Community Group Web Training

Computer Equipment recycling in Sussex

Joomla!® Specialists and trainers

previous arrow
next arrow
Slider

Fake invoice tries to deliver Remcos RAT

This is a strange & slightly more difficult than usual to analyse  malware, mainly because the bad actor appears to have made a total mess of the distribution.

I do not know if this will actually run on a proper computer, it obviously doesn’t like a sandbox / VM .

The email was received with a .dat extension, which is what Outlook  or the mail server often changes unknown extensions to. This dat file is actually a zip file. It does extract to a .pif and a jpg  image file of an invoice. The pif is not a windows shortcut file & is actually a renamed or wrongly named .exe file. I couldn’t get this to run properly in Anyrun at first using windows 7 but after renaming the .pif inside the zip to a .exe & then extracting the renamed file I could eventually run it on Anyrun where it crashed or rebooted the computer 3 times using windows 7. However it didn’t do much except try to connect to the C2, but I never got any response. It was only on the 3rd reboot that it was detected as Remcos when using a Windows 7 VM on anyrun .

It did not crash in Windows 10 on anyrun. all it did was drop the same files it drops on W7 and continually try to contact the C2.

Invoice.dat : Extracts to:  INOGQ190 pif / exe       Current Virus total detections  [1] [2] [3] [4] [5] :  Anyrun [email W7] [ W7 renamed.pif to .exe ]  [W10 .exe]

The C2 is myhousedubem.ddns.net  79.134.225.116

You can now submit suspicious sites, emails and files via our Submissions system

One of the  emails looks like:

From: GHAZAL TOUBAH <This email address is being protected from spambots. You need JavaScript enabled to view it.>

Date:  Wed 18/09/2019 03:59

Subject: RE: Invoice This email address is being protected from spambots. You need JavaScript enabled to view it.

Attachment:  Invoice.dat

Body content:

Dear This email address is being protected from spambots. You need JavaScript enabled to view it.

Enclosed is the pro-forma invoice sent to us. We had to immediately write you directly as it is not workable for us. please review

Kindly please double check and confirm by return the following:

  1. We agreed on 30% advance but PI is stated 50% advance.
  2. Expected time of delivery is different from earlier agreed shipment date.
  3. Pay attention to the Question marks we added to the PI to draw your attention to complete these parts.

 

Kindly amend and send back the revised PI so we can make the down payment

immediately.

Thanks & Regards

GHAZAL TOUBAH

(Purchasing Manager)

This email address is being protected from spambots. You need JavaScript enabled to view it.

NRG SERVICES W.L.L  -AN ISO 9001:2008 Certified Company

PO Box: 200131| Industrial Area | No.55 FuXingMenNei Street, Xicheng District, Beijing, P.R.C 100140  Email: This email address is being protected from spambots. You need JavaScript enabled to view it. | Website: www.casdollar.com

——————————————————————————

  P Save a Tree! Do not Print this Email if not Essential.

 This e-mail and any attachments are confidential to the addressee and may also be privileged. If you are not the addressee of this e-mail, you may not copy, forward, disclose or otherwise use it in any way what so ever. If you have received this e-mail by mistake, please e-mail the sender by replying to this message, and delete the original and any print out thereof.

Screenshot:

Fake Invoice Email

Fake Invoice Email

Email Headers:

IP Hostname City Region Country Organisation
104.131.213.159  mta.ekhtong.com Gramercy Park New York US AS14061 DigitalOcean, LLC

 

Received: from [104.131.213.159] (port=53888 helo=slot0.ekhtong.com)
	by knight.knighthosting.co.uk with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.92)
	(envelope-from <This email address is being protected from spambots. You need JavaScript enabled to view it.>)
	id 1iAQBH-0002UX-Ks
	for This email address is being protected from spambots. You need JavaScript enabled to view it.; Wed, 18 Sep 2019 03:59:00 +0100
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=ekhtong.com;
 h=Reply-To:From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; i=This email address is being protected from spambots. You need JavaScript enabled to view it.;
 bh=dWp6Mur2B6IK2z4NslcLqih9i5g=;
 b=VNoRSYEYZXkk832WbPoayHoLrN9bSWSf6Zl9BF3cDGwydUxK7rgLaaNhoi4u0OUjhss9oprI2um7
   +v4dqWeGQlIJwEKSUutz4NZstb3ReQ2FigzGPNfBl5FHKaCxBuQSEj/xrM/M1d/NXL/J+hM8e6Dd
   kmmiu/EYdgHKaHXMeAUuTYuZvpKnbBNsoh6MDBp+YueJ4jc6SDHqnPO8D0hEpl6c3WwTYEe2hULu
   zQCVU9f2UIalbhJVhxB1K32+N2arfmM0jfVp0+yaPOi5OK85kqIm5uh613T5te6oaMrarg8uFTDM
   S/qUk0KhU2cpUfmseR/cE8aiY7QYYijNr1wGjw==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=ekhtong.com;
 b=cQKRYQpEw9pUoWkCc1rIdIPWIQrJMXWdTrc6oxqkR1NYgBINPlP6h+1+4xnDsjQt8G9aq8O6L1A6
   kmwG+z+g5cD9rxxRQYFdS/68heFdOsLCRim4bqexP9fWHWbz88fr3k6xhrodJ50rqrUgAv5ZoNjP
   v2DEx14WeAupBAXop++W9pJGv2L6E0Ab+1Fd6B3SDzHOntPOEKeTZ8Uidxzu8ERskgCMFAs0XJYY
   0XEVTMrE7PjGBCdwyqKmcUvB6/oSw8pw8THV3kGggfIUU2IRKxaOYNN8WBXrDrJtMxGBb1EWon3A
   2kRna+wi/KnlJwxy4Vozfx3lB2AXkl5UaMw4PA==;
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
From: GHAZAL TOUBAH<This email address is being protected from spambots. You need JavaScript enabled to view it.>
To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Subject: RE: Invoice This email address is being protected from spambots. You need JavaScript enabled to view it.
Date: 17 Sep 2019 19:58:56 -0700
Message-ID: <This email address is being protected from spambots. You need JavaScript enabled to view it.>
MIME-Version: 1.0
Disposition-Notification-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0012_38A72117.EBE6FBB2"

email header details

 

These malicious attachments normally have a password stealing component, with the aim of stealing your bank, PayPal or other financial details along with your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your Facebook and other social network log in details. A very high proportion are Ransomware versions that encrypt your files and demand money ( about £350/$400) to recover the files.

  All the alleged senders, amounts, reference numbers, Bank codes, companies, names of employees, employee positions, email addresses and phone numbers mentioned in the emails are all random. Some of these companies will exist and some won’t.  Don’t try to respond by phone or email, all you will do is end up with an innocent person or company who have had their details spoofed and picked at random from a long list that the bad guys have previously found. The bad guys choose companies, Government departments and organisations  with subjects that are designed to entice you or alarm you into blindly opening the attachment or clicking the link in the email to see what is happening.  

Please read our How to protect yourselves page for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware.

 

This is another one of the  files that unless you have “show known file extensions enabled“, can easily be mistaken for  a genuine  DOC / PDF / JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected.

 Be very careful with email attachments. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day.

The basic rule is NEVER open any attachment to an email, unless you are expecting it. Now that is very easy to say but quite hard to put into practice, because we all get emails with files attached to them. Our friends and family  love to send us pictures of them doing silly things, or even cute pictures of the children or pets.

Never just blindly click on the file in your email program. Always save the file to your downloads folder, so you can check it first. Many malicious files that are attached to emails will have a faked extension. That is the 3 letters at the end of the file name. Unfortunately windows by default hides the file extensions so you need to Set your folder options to “show known file types. Then when you unzip the zip file that is supposed to contain the pictures of “Sally’s dog catching a ball” or a report in word document format that work has supposedly sent you to finish working on at the weekend, or an invoice or order confirmation from some company,  you can easily see if it is a picture or document & not a malicious program.

If you see JS or .EXE or .COM or .PIF or .SCR or .HTA .vbs, .wsf , .jse  .jar at the end of the file name DO NOT click on it or try to open it, it will infect you.

While the malicious program is inside the zip file, it cannot harm you or automatically run. When it is just sitting unzipped in your downloads folder it won’t infect you, provided you don’t click it to run it. Just delete the zip and any extracted file and everything will be OK. You can always run a scan with your antivirus to be sure. There are some zip files that can be configured by the bad guys to automatically run the malware file when you double click the zip to extract the file. If you right click any suspicious zip file received, and select extract here or extract to folder ( after saving the zip to a folder on the computer) that risk is virtually eliminated. Never attempt to open a zip directly from your email, that is a guaranteed way to get infected. The best way is to just delete the unexpected zip and not risk any infection.

:

IOC:

Secure.docMD5: b2e0d468b82b1de92829817b1292907eSHA-1: 2364a75570bab29a5ef1e780bae03f0ff6935f57Download URLshttp://ballparkjerseys.com/bo.bin  212.53.86.192http://asifapparels.com/bo.bin  173.249.54.230MD5: 11458b0259a54c0a8146e7c16d1595e4SHA1: 1ce8d815703dc9bfce0053d3b1c27f2d9bcdff39

Email from: This email address is being protected from spambots. You need JavaScript enabled to view it.

Read more https://myonlinesecurity.co.uk/fake-invoice-tries-to-deliver-remcos-rat/

Add comment

By entering a comment, if it is of a commercial nature, you will be auto enrolled in our customer care course as detailed in our rate card.
By entering a comment you legally agree to the course and to pay. Thanks


Security code
Refresh