2013 FTC Consumer Sentinel Report - Identity Theft By U.S. City

Each year the Federal Trade Commission publishes a detailed report on the Fraud and Identity Theft complaints they received during the previous year, not just at the FTC, but throughout their Consumer Sentintel Network.

Some of the leading members of that network include the Better Business Bureau and the FBI's Internet Crime and Complaint Center (IC3.gov).

You can review the entire 2013 Consumer Sentinel Network Data Book on your own if you want to look up more about your state.

Just like last year, fraud that began by telephone/telemarketing was the top category, but 33% of all Fraud complaints started with an email!

Complaints by category were:

14% - Identity Theft
10% - Debt Collection Fraud
7% - Banks and Lenders
6% - Imposter Scams
6% - Telephone and Mobile Service Scams
4% - Prizes, Sweepstakes and Lottery Scams
4% - Auto-related Fraud
3% - Shop-at-home and Catalog Sales fraud
3% - Television and Electronic Media fraud
2% - Advanced Payment for Credit Services fraud

In the Fraud categories, over 1 million complaints were filed including $1.6 billion in fraud, where the median reported amount paid was $400. (Only 61% of those alleging fraud stated a loss amount.)

Within the category of Identity Theft, the top categories were:

34% - government documents/benefits fraud
17% - Credit Card Fraud
14% - Phone/Utilities Fraud
8% - Bank Fraud
6% - Employment-related Fraud
4% - Loan Fraud

In 2012, there were 369,145 Identity Theft Complaints registered by Consumer Sentinel.
In 2013, there were 290,056 Identity Theft Complaints.

That's a 21.5% reduction in Identity Theft Complaints! Does this indicate that Identity Theft improved from 2012 to 2013? Or does it indicate that Identity Theft has become so common place that people don't get irate and call the Better Business Bureau or the FTC when it occurs?

Wire Transfer Tops the Fraud Losses List

American consumers are just DESPARATE to throw their money away in Wire Transfers. Even though every wire transfer place I've visited in the last two years has big warning signs about the various forms of fraud involving sending your money away in a wire transfer, it continues to be the top way in which fraudsters separate their victims from their money.

YEAR	Complaints	Money Wired Out
2011	115,901	$438,343,577
2012	109,138	$456,541,454
2013	104,984	$507,713,984

Western Union and MoneyGram both have warning pages to help protect consumers! Follow their advice to not lose the average $4836 that more than 100,000 complained about last year!

Western Union has Eight Tips at their Knowledge Center:

1. Never send money to people you haven't met in-person
2. Never send money to pay for taxes or fees on lottery or prize winnings
3. Never use a test question as an additional security measure to protect your transaction
4. Never provide your banking information to people you don't know
5. Never send money in advance to obtain a loan or credit card
6. never send money for an emergency situation without verifying that it's a real emergency. (Gee - like a London Traveler Scam?)
7. Never send funds from a check in your account until it officially clears - which can take weeks
8. Never send a money transfer for an online purchase

MoneyGram has a great page called The 11 Most Common Wire Transfer Frauds that include:

1. The Vehicle Purchase Scam
2. The Fake Loan Scam
3. The Lottery or Sweepstakes Scam
4. The Internet Romance Scam
5. The Mystery Shopper Scam
6. The Charity Scam
7. The Relative in Need Scam
8. The Internet Purchase Scam
9. The Newspaper Ads Scam
10. The Check or Money Order Scam
11. The Elder Abuse Scam

They even have a nice Dodge the Scams Game to help you get it down pat!

Green Dot MoneyPak

In the most significant change in fraud payment behavior, this year 28% of fraud losses occurred via Prepaid cards, which was almost exclusively Green Dot Money cards. Two years ago this category of fraud losses didn't even exist! From 2012 to 2013 the number of victims went up 500% and the amount of money lost went up 600%!!

YEAR	Complaints	Prepaid Card Fraud Losses
2011	10	$9,054
2012	16,914	$6,946,619
2013	84,671	$42,858,396

(image from DotFab.com, click to visit)

How much of this fraud was due to the CryptoLocker and PoliceLock Ransomware? We can't be sure, but this is a PROFOUND shift in fraud loss behavior and a great deal of it is certain to be based on those two malware campaigns. We blogged about CryptoLocker using Greendot late in the year in our story Tracking CryptoLocker with Malcovery and IID, but the FBI's Donna Gregory reported on the malware as far back as this August 2012 FBI Ransomware Story where she said "We’re getting inundated with complaints!" referring to the complaints coming in to the FBI's IC3.gov complaint form, which is one source of Consumer Sentinel Data.

2013 - Top Cities for Identity Theft

Last year, 16 of the top 25 Identity Theft Metropolitan area were in Florida. This year it has fallen to 13.

13 of top 25 in Florida (16 in 2012)
4 of top 25 in California (0 in 2012)
3 of top 25 in Georgia (6 in 2012)
1 each in Alabama, Arkansas, Michigan, Tenessee, and West Virginia

Rank	Metro/Micropolitan Area	Per 100,000
1	Miami-FortLauderdale-WestPalmBeach, FL	340.4
2	Columbus, GA-AL	214.7
3	Naples-Immokalee-MarcoIsland, FL	214
4	Jonesboro, AR	190.9
5	Tallahassee, FL	179.4
6	CapeCoral-FortMyers, FL	174.9
7	Atlanta-SandySprings-Roswell, GA	170.7
8	PortSt.Lucie, FL	163.9
9	Beckley, WV	160.9
10	Tampa-St.Petersburg-Clearwater, FL	155.5
11	Orlando-Kissimmee-Sanford, FL	149.6
12	Detroit-Warren-Dearborn, MI	142.9
13	Lakeland-WinterHaven, FL	140.2
14	Stockton-Lodi, CA	133.1
15	Montgomery, AL	132.2
16	Vallejo-Fairfield, CA	128.2
17	Jacksonville, FL	125.7
18	Memphis, TN-MS-AR	125.5
19	Valdosta, GA	125.4
20	Ocala, FL	125
21	Gainesville, FL	122.6
22	Sebastian-VeroBeach, FL	122.4
23	LosAngeles-LongBeach-Anaheim, CA	119.1
24	Deltona-DaytonaBeach-OrmondBeach, FL	118.9
25	Fresno, CA	118.2
26	Albany, GA	117.6
27	SanFrancisco-Oakland-Hayward, CA	116.8
28	NorthPort-Sarasota-Bradenton, FL	116.6
29	Bakersfield, CA	116.5
30	Macon, GA	116.2
31	Riverside-SanBernardino-Ontario, CA	115.2
32	Savannah, GA	115.1
33	PuntaGorda, FL	115
34	Dallas-FortWorth-Arlington, TX	114.8
35	Crestview-FortWaltonBeach-Destin, FL	112.4
36	PalmBay-Melbourne-Titusville, FL	111.3
37	Flint, MI	109.7
38	Lynchburg, VA	108.1
39	Jackson, MS	107.4
40	Washington-Arlington-Alexandria, DC-VA-MD-WV	106.3
41	HomosassaSprings, FL	105.5
42	Niles-BentonHarbor, MI	105.2
43	Houston-TheWoodlands-SugarLand, TX	104.7
44	Fayetteville, NC	102.9
45	Sacramento--Roseville--Arden-Arcade, CA	101.3
46	Modesto, CA	101.1
47	Phoenix-Mesa-Scottsdale, AZ	101.1
48	LasVegas-Henderson-Paradise, NV	100.8
49	Chicago-Naperville-Elgin, IL-IN-WI	100.4
50	Killeen-Temple, TX	99.4
51	Auburn-Opelika, AL	98.4
52	NewYork-Newark-JerseyCity, NY-NJ-PA	97.7
53	SanJose-Sunnyvale-SantaClara, CA	96.4
54	Reno, NV	96.1
55	Philadelphia-Camden-Wilmington, PA-NJ-DE-MD	95.5
56	Chico, CA	95.5
57	Napa, CA	94.5
58	Pueblo, CO	94.3
59	Baltimore-Columbia-Towson, MD	93.4
60	SanDiego-Carlsbad, CA	93.4
61	Milwaukee-Waukesha-WestAllis, WI	92.8
62	Madera, CA	92.8
63	RockyMount, NC	92.5
64	Laredo, TX	92.3
65	Beaumont-PortArthur, TX	92
66	Denver-Aurora-Lakewood, CO	92
67	Cleveland-Elyria, OH	91.7
68	SantaCruz-Watsonville, CA	89.6
69	Brownsville-Harlingen, TX	89.4
70	Goldsboro, NC	88.9
71	Mobile, AL	88.6
72	Merced, CA	88.4
73	SantaMaria-SantaBarbara, CA	88.2
74	AnnArbor, MI	88.2
75	Tucson, AZ	87.9
76	Augusta-RichmondCounty, GA-SC	87.8
77	AtlanticCity-Hammonton, NJ	87.4
78	Redding, CA	86.9
79	Greenville-Anderson-Mauldin, SC	86.6
80	Athens-ClarkeCounty, GA	86.2
81	McAllen-Edinburg-Mission, TX	85.6
82	CorpusChristi, TX	85.5
83	BatonRouge, LA	85.4
84	SierraVista-Douglas, AZ	85.3
85	Austin-RoundRock, TX	85.2
86	Florence, SC	85.1
87	Albuquerque, NM	85
88	Boulder, CO	84.9
89	Pensacola-FerryPass-Brent, FL	84.9
90	ColoradoSprings, CO	84
91	California-LexingtonPark, MD	83.7
92	Dalton, GA	83.7
93	Hattiesburg, MS	83.3
94	SanAntonio-NewBraunfels, TX	83.2
95	WarnerRobins, GA	83
96	Oxnard-ThousandOaks-Ventura, CA	82.8
97	Trenton, NJ	82.7
98	Houma-Thibodaux, LA	82.6
99	Dover, DE	82.6
100	St.Louis, MO-IL	82.1

Alabama Identity Theft: 2012 compared to 2013

Forgive me, dear reader, for focusing on my own state just this once . . .

In 2012, Alabama's top cities for Identity Theft, and their Per Capita complaints received, were:

#15 - Columbus, GA/AL (205.9 per 100,000)
#16 - Montgomery, AL (203.7 per 100,000)
#42 - Auburn-Opelika, AL (124.1 per 100,000)
#62 - Birmingham-Hoover, AL (111 per 100,000)
#91 - Enterprise-Ozark, AL (97.8 per 100,000)
#97 - Huntsville, AL (95.5 per 100,000)
#100 - Mobile, AL (93.5 per 100,000)
#118 - Anniston-Oxford, AL (90.2 per 100,000)
#125 - Tuscaloosa, AL (88.4 per 100,000)
#132 - Dothan, AL (87.2 per 100,000)
#145 - Gadsden, AL (84.3 per 100,000)
#195 - Decatur, AL (72.8 per 100,000)
#198 - Daphne-Fairhope-Foley, AL (72.4 per 100,000)
#303 - Florence-Muscle Shoals, AL (56.4 per 100,000)

How does that compare to 2013's numbers?

The Columbus, Georgia/Alabama Metro area rose 13 places in the national rank to be the second worst city in America for Identity Theft.
Montgomery, Alabama had a very slight rise in rank (from #16 to #15), although the number of complaints per capita fell, it is still one of the worst cities in America for Identity Theft.
Mobile, Alabama rose in rank by 29 places, moving from #100 to #71.

All other cities in Alabama FELL in their national rank for Identity Theft -- but one must ask, as above, is that because crime is declining? or is apathy increasing? Have we become so desensitized to Identity Theft that we no longer feel the need to complain?

#2 +13 - Columbus, GA-AL (214.7 per 100,000) = +8.8 per 100,000
#15 +1 - Montgomery, AL (132.2) = -71.5 per 100,000
#51 -9 - Auburn-Opelika, AL (98.4) = -25.7 per 100,000
#71 +29 - Mobile, AL (88.6) = -4.9. per 100,000
#117 -55 - Birmingham-Hoover, AL (77.7) = -33.3 per 100,000
#131 +1 - Dothan, AL (74.8) = -12.4 per 100,000
#152 -55 - Huntsville, AL (68.5) = -27 per 100,000
#167 -42! - Tuscaloosa, AL (65.2) = -23.2 per 100,000
#226 -81! - Gadsden, AL (57.5)
#234 -116! - Anniston-Oxford-Jacksonville, AL(56.5)
#268 -70! - Daphne-Fairhope-Foley, AL (52.1)
#316 -121! - Decatur, AL (44.2)
#357 -54! - Florence-MuscleShoals, AL (36.7) -

Do YOU Know How to File an Identity Theft, Fraud, or Phishing Complaint?

If someone scammed you out of your money or stole your identity, that is a CRIME! What should you do? CALL THE POLICE!

But there are some other guidelines as well.

The Federal Trade Commission has two web pages that help you understand what to do if you have been the victim of identity theft:

FTC: What to do if you have been a victim of Identity Theft
FTC: How to file an Identity Theft Complaint with the FTC

FTC: March 2-8 is National Consumer Protection Week - tips and videos you can share with your friends are on this site!

You STILL want to call your local Police to let them know about the crimes against you. If someone stole YOUR identity or scammed you, they are likely targeting others as well! Besides your local law enforcement, it would be helpful if you could take the time to share what happened to you with the FBI Internet Crime & Complaint Center (ic3.gov). This unique center in West Virginia gathers hundreds of thousands of cybercrime complaints per year into a database that can be accessed by law enforcement across the country. Perhaps you will only be another drop in the bucket, but you MAY provide the missing link that ties many smaller losses together into a major investigation!

For PHISHING EMAILS, be sure to report that phish to Malcovery's PhishIQ system! By sending us the address of that suspicious or fake bank website, our automated systems will preserve forensic evidence about the phishing website and work on linking it to other websites that may have been created by the same criminal!

Appendix: The rest of the list (Top Identity Theft Cities by Rank)

101	NewOrleans-Metairie, LA	82
102	Charlotte-Concord-Gastonia, NC-SC	81.7
103	Prescott, AZ	81.5
104	SantaFe, NM	81.2
105	Tyler, TX	80.6
106	VirginiaBeach-Norfolk-NewportNews, VA-NC	80.4
107	Monroe, MI	80.3
108	LittleRock-NorthLittleRock-Conway, AR	80.2
109	Gainesville, GA	80.1
110	Hammond, LA	80.1
111	Bridgeport-Stamford-Norwalk, CT	80.1
112	LakeHavasuCity-Kingman, AZ	78.9
113	Seattle-Tacoma-Bellevue, WA	78.4
114	OklahomaCity, OK	77.9
115	Columbia, SC	77.8
116	Vineland-Bridgeton, NJ	77.8
117	Birmingham-Hoover, AL	77.7
118	ElPaso, TX	77.4
119	Muskegon, MI	77.2
120	NewHaven-Milford, CT	77.2
121	Midland, TX	76.9
122	Burlington, NC	76.8
123	Spokane-SpokaneValley, WA	76.7
124	Odessa, TX	76.6
125	HiltonHeadIsland-Bluffton-Beaufort, SC	75.9
126	Indianapolis-Carmel-Anderson, IN	75.3
127	Yakima, WA	75.2
128	Concord, NH	75.1
129	SanLuisObispo-PasoRobles-ArroyoGrande, CA	74.9
130	Reading, PA	74.9
131	Dothan, AL	74.8
132	Brunswick, GA	74.8
133	Lumberton, NC	74.5
134	Allentown-Bethlehem-Easton, PA-NJ	74.3
135	Wichita, KS	74.2
136	Charleston-NorthCharleston, SC	73.7
137	Richmond, VA	73.1
138	Akron, OH	72.4
139	KansasCity, MO-KS	71.9
140	Racine, WI	71.6
141	Rockford, IL	71.5
142	Scranton--Wilkes-Barre--Hazleton, PA	71.5
143	SantaRosa, CA	70.9
144	Topeka, KS	70.6
145	Dayton, OH	70.4
146	Spartanburg, SC	69.9
147	Salinas, CA	69.9
148	Shreveport-BossierCity, LA	69.8
149	Show Low, AZ	69.8
150	YubaCity, CA	69.5
151	PanamaCity, FL	68.8
152	Huntsville, AL	68.5
153	FortCollins, CO	68.4
154	Raleigh, NC	68.4
155	Portland-Vancouver-Hillsboro, OR-WA	68.1
156	Durham-ChapelHill, NC	67.8
157	Charleston, WV	67.4
158	Greeley, CO	66.8
159	Medford, OR	66.4
160	Yuma, AZ	66.4
161	Gulfport-Biloxi-Pascagoula, MS	66.4
162	Wilmington, NC	66.3
163	Springfield, MA	65.8
164	Columbus, OH	65.7
165	NewBern, NC	65.5
166	Boston-Cambridge-Newton, MA-NH	65.4
167	Tuscaloosa, AL	65.2
168	Flagstaff, AZ	64.7
169	Lawton, OK	64.5
170	Saginaw, MI	64.4
171	Hartford-WestHartford-EastHartford, CT	64.4
172	Minneapolis-St.Paul-Bloomington, MN-WI	64.2
173	Wausau, WI	64.1
174	Duluth, MN-WI	64
175	Amarillo, TX	63.9
176	Olympia-Tumwater, WA	63.8
177	Youngstown-Warren-Boardman, OH-PA	63.8
178	Asheville, NC	63.8
179	Toledo, OH	63.8
180	Bremerton-Silverdale, WA	63.7
181	Kankakee, IL	63.5
182	Chattanooga, TN-GA	63.4
183	Madison, WI	63.4
184	Bend-Redmond, OR	63.4
185	Greensboro-HighPoint, NC	63.1
186	Greenville, NC	63
187	Rochester, NY	62.7
188	MyrtleBeach-Conway-NorthMyrtleBeach, SC-NC	62.6
189	Pittsfield, MA	62.5
190	BattleCreek, MI	62.4
191	Visalia-Porterville, CA	62.4
192	EastStroudsburg, PA	62.4
193	Kingsport-Bristol-Bristol, TN-VA	62.3
194	Winston-Salem, NC	62.3
195	Sherman-Denison, TX	62
196	Nashville-Davidson--Murfreesboro--Franklin, TN	61.9
197	ElCentro, CA	61.9
198	Jacksonville, NC	61.9
199	Alexandria, LA	61.7
200	FortWayne, IN	61.3
201	Kalamazoo-Portage, MI	61.2
202	SouthBend-Mishawaka, IN-MI	61.1
203	Tulsa, OK	60.8
204	Sumter, SC	60.5
205	LasCruces, NM	60.2
206	Ashtabula, OH	60.1
207	York-Hanover, PA	60
208	Albany, OR	60
209	Champaign-Urbana, IL	59.9
210	Cincinnati, OH-KY-IN	59.6
211	BoiseCity, ID	59.5
212	Missoula, MT	59.5
213	Wooster, OH	59.4
214	Dunn, NC	59.3
215	Salisbury, MD-DE	59.1
216	Omaha-CouncilBluffs, NE-IA	59.1
217	Eureka-Arcata-Fortuna, CA	58.7
218	Elizabethtown-FortKnox, KY	58.6
219	Anchorage, AK	58.3
220	Elkhart-Goshen, IN	58.2
221	Jackson, MI	58
222	Hagerstown-Martinsburg, MD-WV	58
223	Pittsburgh, PA	58
224	PineBluff, AR	57.9
225	Providence-Warwick, RI-MA	57.8
226	Gadsden, AL	57.5
227	Lafayette, LA	57.4
228	IowaCity, IA	57
229	BarnstableTown, MA	57
230	Waco, TX	57
231	Springfield, MO	56.8
232	Springfield, IL	56.6
233	Worcester, MA-CT	56.6
234	Anniston-Oxford-Jacksonville, AL	56.5
235	Kingston, NY	56.4
236	CollegeStation-Bryan, TX	56.4
237	Lubbock, TX	56.4
238	Hanford-Corcoran, CA	56.2
239	Cleveland, TN	56.1
240	Monroe, LA	56.1
241	Longview, TX	56
242	SaltLakeCity, UT	55.9
243	Canton-Massillon, OH	55.9
244	Louisville/JeffersonCounty, KY-IN	55.8
245	Lexington-Fayette, KY	55.5
246	Lima, OH	55.5
247	Lansing-EastLansing, MI	55.4
248	Peoria, IL	55.1
249	Decatur, IL	55.1
250	Erie, PA	54.9
251	Clarksville, TN-KY	54.9
252	GrandRapids-Wyoming, MI	54.8
253	Bloomington, IL	54.8
254	Weirton-Steubenville, WV-OH	54.6
255	Kennewick-Richland, WA	54.5
256	Roanoke, VA	54.1
257	Buffalo-Cheektowaga-NiagaraFalls, NY	54.1
258	DesMoines-WestDesMoines, IA	54.1
259	Lebanon, PA	53.9
260	Williamsport, PA	53.4
261	Harrisburg-Carlisle, PA	53.3
262	Bellingham, WA	53.2
263	FortSmith, AR-OK	53.1
264	Norwich-NewLondon, CT	52.9
265	Albany-Schenectady-Troy, NY	52.8
266	Morristown, TN	52.7
267	Winchester, VA-WV	52.2
268	Daphne-Fairhope-Foley, AL	52.1
269	BayCity, MI	52
270	Longview, WA	51.8
271	Salem, OR	51.4
272	Lawrence, KS	51.4
273	Meridian, MS	51.2
274	St.Joseph, MO-KS	51
275	Texarkana, TX-AR	50.9
276	WichitaFalls, TX	50.9
277	London, KY	50.6
278	Ogden-Clearfield, UT	50.1
279	Hickory-Lenoir-Morganton, NC	50.1
280	Billings, MT	49.7
281	Lincoln, NE	49.6
282	Manchester-Nashua, NH	49.4
283	Coeurd'Alene, ID	49.1
284	Charlottesville, VA	48.9
285	MountVernon-Anacortes, WA	48.8
286	JeffersonCity, MO	48.7
287	Jackson, TN	48.5
288	MichiganCity-LaPorte, IN	48.4
289	Syracuse, NY	48.3
290	Chambersburg-Waynesboro, PA	48.1
291	Cookeville, TNMicropolitan	48.1
292	Lafayette-WestLafayette, IN	48.1
293	Janesville-Beloit, WI	48
294	Logan, UT-ID	47.8
295	Evansville, IN-KY	47.8
296	Bluefield, WV-VA	47.5
297	Knoxville, TN	47.3
298	Whitewater-Elkhorn, WI	47
299	Rochester, MN	46.9
300	Torrington, CT	46.9
301	Sheboygan, WI	46.8
302	Claremont-Lebanon, NH-VT	46.7
303	Davenport-Moline-RockIsland, IA-IL	46.6
304	LakeCharles, LA	46.6
305	Lancaster, PA	46.6
306	Pottsville, PAMicropolitan	46.5
307	JohnsonCity, TN	46.3
308	Danville, VA	46
309	Carbondale-Marion, IL	45.8
310	Tupelo, MS	45.5
311	Springfield, OH	44.8
312	Provo-Orem, UT	44.8
313	Roseburg, OR	44.6
314	Joplin, MO	44.4
315	Fayetteville-Springdale-Rogers, AR-MO	44.3
316	Decatur, AL	44.2
317	Abilene, TX	44.2
318	Huntington-Ashland, WV-KY-OH	44.1
319	Morgantown, WV	43.9
320	SiouxCity, IA-NE-SD	43.9
321	Johnstown, PA	43.8
322	CedarRapids, IA	43.8
323	Eugene, OR	43.8
324	GrandJunction, CO	43.6
325	Salem, OH	43.6
326	Mansfield, OH	43.4
327	Blacksburg-Christiansburg-Radford, VA	43.2
328	Jamestown-Dunkirk-Fredonia, NY	43
329	Portland-SouthPortland, ME	42.8
330	IdahoFalls, ID	42.8
331	Kahului-Wailuku-Lahaina, HI	42.6
332	Cumberland, MD-WV	42.6
333	FondduLac, WI	42.3
334	Wheeling, WV-OH	41.9
335	GlensFalls, NY	41.9
336	Wenatchee, WA	41.5
337	Gettysburg, PA	41.4
338	TraverseCity, MI	41.2
339	LaCrosse-Onalaska, WI-MN	41.1
340	SiouxFalls, SD	40.7
341	Columbia, MO	40.6
342	Watertown-FortDrum, NY	40.4
343	SanAngelo, TX	40.2
344	RapidCity, SD	40.1
345	Owensboro, KY	40.1
346	St.George, UT	39.1
347	Binghamton, NY	38.9
348	Tullahoma-Manchester, TN	38.9
349	Bloomington, IN	38.9
350	GreenBay, WI	38.9
351	TerreHaute, IN	38.9
352	UrbanHonolulu, HI	38.8
353	Utica-Rome, NY	38.7
354	Ithaca, NY	38.4
355	Muncie, IN	38.2
356	Burlington-SouthBurlington, VT	37.9
357	Florence-MuscleShoals, AL	36.7
358	EauClaire, WI	36.6
359	Ottawa-Peru, IL	36.2
360	BowlingGreen, KY	35.9
361	Holland, MI	35.9
362	Appleton, WI	35.9
363	Hilo, HI	35.7
364	Lewiston-Auburn, ME	34.4
365	Oshkosh-Neenah, WI	33.5
366	Staunton-Waynesboro, VA	32.9
367	Waterloo-CedarFalls, IA	32.8
368	Ogdensburg-Massena, NY	32.2
369	Fargo, ND-MN	32.1
370	St.Cloud, MN	31.7
371	Bangor, ME	31.2
372	Farmington, NM	30.8
373	Altoona, PA	30.7
374	Harrisonburg, VA	29.5
375	StateCollege, PA	29.2
376	Augusta-Waterville, ME	28.7
377	Bismarck, ND	27.9

WhatsApp Spam: a malware distribution scam

On February 19, 2014, Facebook Announced the purchase of WhatsApp for $4 billion in cash and 183,865,778 shares of Facebook stock ($12 Billion in current value) plus an additional $3 billion in shares to the founders that will vest over four years, for a total purchase price of $19 Billion. Within 24 hours, spammers were using WhatsApp lures to attract traffic to counterfeit pharmaceutical websites! Journalists in the United States were scurrying trying to figure out what WhatsApp even is, let alone why it should be worth $19 Billion.

Apparently WhatsApp has been growing in popularity in other parts of the world, as documented by a survey released in November by OnDevice Research which was headlined as Messenger Wars: How Facebook lost its lead which talked about the top Social Message Apps for mobile devices in five major markets: US, Brazil, South Africa, Indonesia, and China. While Facebook still lead in the US, and WeChat clearly dominates China, WhatsApp was the leading app in Brazil 72%, South Africa (68%), and Indonesia (43%).

But those of us who keep track of spam and email-based threats have been hearing about WhatsUp for several months. As the popularity of WhatsApp grows due to the new acquisition, we believe we will see it become an even more popular spam lure. At least three distinct spamming groups have already used WhatsApp as a lure for their scams.

According to Malcovery Security's Brendan Griffin, WhatsApp was being used as a malware lure since at least September 19, 2013. I asked Brendan to give me a list of days when a WhatsApp spam/malware campaign made Malcovery's "Today's Top Threats" list. This campaign has been solidly in the top ten on:

SEPTEMBER 19, 23, 24, 25, 26
OCTOBER 2, 3, 4, 7, 8, 9, 10, 11, 16, 17, 18, 21, 22, 23, 24, 25
NOVEMBER 14
JANUARY 9, 13, 15, 20, 28

As Steve Ragan mentioned in his ComputerWorld article on November 8, 2013, WhatsApp was one of our Top Five Imitated Brands for the delivery of malware via spam for the quarter. (See ComputerWorld - Senior executives blamed for a majority of undisclosed security incidents.) Curiously, when I asked Brendan about the email I saw THIS WEEK imitating WhatsApp he said that was an example of spammers using the WhatsApp notoriety to drive traffic to counterfeit pharmaceutical websites!

WhatsApp spam used by ASProx Botnet to Deliver Kuluoz Malware

We've seen tremendous variety in both the malware being delivered and in the method of delivery over the course of so many spam runs. The first day we made note of the WhatsApp malware, September 19, 2013, we observed 52 different websites being advertised in the emails. Each of these websites had a file called "info.php" that was being called with a very long unique "message" parameter, such as:

/info.php?message=47lvQ31P1Nip+SkTsbYeAVNH+2aJDFeJ9djfprCHGa4= (a couple digits have been tweaked for privacy)

Websites used for malware delivery,September 19, 2013

aki-kowalstwo.pl	koshergiftsuk.com	samedaystationery.co.uk
amicidelcuore.info	lichtenauer-fv.de	schweitzers.com
arsenalyar.ru	locweld.com	sentabilisim.com
art52.ru	mbuhgalter.ru	sewretro.com
bhaktapurtravel.com.np	mdou321.ru	spentec.ca
bluereefwatersports.com	mikemetcalfe.ca	structuredsettlementsannuities.com
cateringjaipur.com	mirvshkatulke.ru	thaiecom.net
clockcards.ie	mrsergio.com	tiarahlds.com
dj220w.ru	muzikosfabrikas.lt	tk-galaktika.ru
djvakcina.com	mywebby.ru	towi69.de
easywebmexico.com	orbitmotion.com	trivenidigital.com
etarlo.ru	orderschering.com	veerbootkobus.nl
everyday24h.de	paternocalabro.it	venetamalaysia.com
globalpeat.com	paulhughestransport.com	verfassungsschutz-bw.de
gourmetschlitten.com	pax-sancta.de	vitapool.ru
idollighting.com	pennerimperium.de	zdrowieonly.ovh.org
juhatanninen.com	planeta-avtomat.ru
kasutin.ru	rkbtservice.ru

Visiting the link from any of of those websites resulted in code on the server resolving your IP address and creating a customer malware name based on your geographic location. For example, when we visited from Birmingham, Alabama IP addresses, we received a file called "VoiceMail_Birmingham_(205)4581400.zip" - 205 is the Area code for Birmingham, Alabama, so both the city name and the telephone number provided were intended to enhance the believability that this was a "real" VoiceMail message that we should open and listen to!

At the time we received this file, VirusTotal was showing a 7 of 48 detection rate. (When the file was last checked, December 4, 2013, the detection rate had improved to 36 of 48 AV products.)

This malware delivery mechanism, with the geographically labeled secondary malware, is a signature of the ASPROX => Kuluoz malware. Kuluoz, which is also known as DoFoil, is delivered as the second phase of a malware delivery scheme that begins by having computers that are part of the ASProx botnet sending spam. This is the same campaign that delivered Walmart/BestBuy/CostCo delivery messages around the Christmas holiday, and that delivered Courthouse, Eviction, and Energy bill spam. In the more recent VirusTotal report, AntiVir, DrWeb, and Microsoft label this sample as Kuluoz, while Agnitum, CAT-QuickHeal, Kaspersky, NANO-Antivirus, VBA32, and VIPRE call it DoFoil. Zortob is another popular label seen for this malware, and Symantec calls it "FakeAVLock" while Ikarus and Sophos calls it Weelsof. Weelsof is a Ransomware family and this label, as well as the FakeAV label, are likely due to tertiary malware. When secondary malware "drops" (a term that just means that ADDITIONAL malware is downloaded from the Internet after the initial infection) it is common for AntiVirus vendors to apply the label for the "ultimate intention" to all of the malware samples seen in that particular infection chain.

An excellent student paper by Shaked Bar from August 15, 2013, describes Kuluoz's role in dropping additional malware. This diagram is from his paper, Kuluoz: Malware and botnet analysis which was submitted as Mr. Bar's Dissertation for his Masters of Science in Computer Science.

At the time of Shaked Bar's paper, the prominent delivery mechanisms were spam messages imitating UPS and DHL. He also notes an earlier spam campaign from April 2013 imitating American Airlines. Bar's paper is well worth reading as he explains how C&C traffic is XOR'ed with the byte 0x2B to test the ability of the bot to send spam as well as other potential uses. Mr. Bar documents more fully the possible tertiary malware including Zeus (Zbot), ZeroAccess, and FakeAV. The malware uses the commercial geolocation service from MaxMind to identify its location, and the location may be instrumental in determining what additional malware should be installed.

Malcovery Security analysts also called attention in our September 19, 2013 report that the WhatsApp spam, when visited from an Android device, detected the OS and dropped a file called "WhatsApp.apk". .apk files are Android's "application package file" which is used to distribute and install Android apps. Examination of the .APK file confirmed thta this was Fake antivirus for your Android phone, containing descriptions of each supposedly detected malware in both English and Russian, as exhibited by this snip from the .APK file:

The URLs used to drop the infection shifted constantly. For example, these are the URLs from September 24th, each using "app.php" instead of "info.php":

abslmm.info	easychurchsoftware.com	psmagic.co.uk
animestyles.com	effectivewithpeople.com	reggiegallery.com
arcesubastas.com	europainthewilderness.com	scholarsbangladesh.com
azagom16.com	gigp01.com	tcfurniture.com
bluereefwatersports.com	killmanheatingandair.com	trivenidigital.com
bodfish.net	laduenails.com	wfbsusa.com
bptca.com	lisapetrilli.com	wpsverige.com
chester94.com	lunchesruslawncare.com	www.jigsawpuzzlesnow.com
claytonhistorysociety.org	lyallfamily.com	www.mindful-way.com
clearthoughtfarm.com	mypowerlines.com	www.minimesa.net
columbialivingmag.com	notedls.com	www.opalubka-spb.ru
crumptonplats.com	online-kent.co.uk	www.scholarsbangladesh.com
cvhi.ca	orbitmotion.com

And these were the sites for September 25th:

162.144.3.50	gonzomarketing.us	tejedoresdearte.com
aandekleiput.be	indianhotpeppers.com	theconservativeactivist.com
abslmm.info	interbanc-me.com	uhlit.com
academicgames.org	intercom-group.net	urokshof.be
acomputertech.com	jsmengineering.co.nz	uwes-futterkiste.de
allworldhearing.com	kepsballs.com	velomotoban.ru
angelomasotti.it	maxmuscleraleigh.com	visibus.ru
animestyles.com	miketrig.com	whatshisface.org
arcesubastas.com	miwera.de	www.besttechmfg.com
asca-info.com	mosobladvokatura.ru	www.bonnevilledrivingschool.com
barkersofwindsor.co.uk	neonett.net	www.citadelyachts.com
belliottjr.com	night55.com	www.coaching-pattaya.com
bmitraining.co.id	notedls.com	www.dasluae.com
brothermartin.com	oysterbaytaxi.com	www.dmdservice.com
buntingarchitecturalmetals.com	peakkickboxing.com	www.doanevent.com
caseybarnett.com	personalcarephysio.ca	www.gestiondutemps.be
cityofmossyrock.com	peterscreekauto.net	www.horseamour.com
cvhi.ca	photo2canvasdirect.com	www.kyhydropower.com
dasluae.com	pts.kovrov.ru	www.mhbchurch.qwestoffice.net
debsownbusiness.com	revoltadvertising.ca	www.mtnhwybaptistchurch.com
demaravillamassage.com	rsme.co.uk	www.musango.ca
dnsprattcanada.com	scholarsbangladesh.com	www.rhinocerose.fr
earnquick.co	shahmaulik.com	www.wholepersonsoftware.com
ecuavantransportation.com	solardynamicsinc.com	www.zhelezno.ru
finlandiasf.org	sumedacellular.com	zhinengqigongworldwide.org

WhatsApp Spam Used by Cutwail Botnet to deliver Upatre => Zeus Malware

More recently, the WhatsApp malware has been used by an entirely different spam sending malware team. This group, which favors the Cutwail spam botnet, uses spam messages to deliver a malware family known as UPATRE. UPATRE is a tiny malware file that is repacked constantly to ensure deliverability and that has little malicious behavior itself. The only function of UPATRE is to drop additional malware. In this case, the malware is attached as a .zip file that, when executed by the recipient in order to "play their missed message" will cause Zeus to be downloaded as the secondary malware.

Here is what the Cutwail-delivered version of the WhatsApp spam looked like on January 28, 2014:

This version of Upatre connects to the Internet to download an encoded version of GameOver Zeus to allow safe passage through any blocking and detecting methods. This model of downloading an undetectable version that is then decoded into a fully functional Zeus malware by the Upatre module was documented in this blog in our story GameOver Zeus now uses Encryption to bypass Perimeter Security. In the case of the January 28th WhatsApp malware, the Zeus .enc file came from either:

zubayen . com / up / wav.enc
or from inspireplus . org . uk / images / banners / wav.enc
(spaces added for your safety)

WhatsApp Spam Delivering Canadian Health & Care Mall links?

As WhatsApp reaches the pinnacle of awareness among American spam recipients, it is only natural that the Pharmaceutical spammers would get in on the game. On February 20, 2014, the spammers sent out "Missed Voice Message" spam with a huge number of random URLs belonging to compromised webservers. Each of the compromised webservers, usually the spammer has harvested Userids and passwords for their FTP credentials in previous malware runs, has a newly created .php or .pl file that contains an encoded redirector to a pharmaceutical website.

On February 20th, the advertised spam all redirected to one of more than fifty compromised webservers, each of which then redirected to a Canada Health & Care Mall websites. The advertised URLs have a simple Javascript obfuscation to try to hide the true destination, such as this page:

gjhqv1="\x30";qnnt2="\x68\x74\x74\x70\x3A\x2F\x2F\x74\x68\x65\x64\x69\x65\x74\x70\x68\x61\x72\x6D\x61\x63\x79\x2E\x63\x6F\x6D";setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x71\x6E\x6E\x74\x32\x3B",gjhqv1);

When interpreted as Javascript, the "setTimeout" portion says "make the "window.top.location.href" equal to "gjhqv1". The top portion says "set gjhqv1" equal to thedietpharmacy.com, and do it in "0" milliseconds.

Reviewing 50 URLs of this type, with names such as "reactivates.php" or "bombarding.pl" or "gaelicizes.php", there were only the four redirections: canadavasomax.com
lossdietpharmacy.com
thedietpharmacy.com
wellnessasaletraining.com

each of which looked like this:

Interac Phishers try their hand at IRS

Last week Malcovery Security had an interesting phish show up claiming to be related to the IRS. This one turns out to be a great example of the (activate 1940 horror movie narrator voice) The POWER OF CROSS BRAND INTELLIGENCE (/activate). Here's what the website looked like:

Phish from: bursafotograf.com / profiles / interac / RP.do.htm

In this phish, the "big idea" is that you can escalate your IRS Tax Refund if you specify which bank you would like the refund to be deposited into. When you click the bank's logo, you are taken to a phishing site for that brand and asked to provide your Userid and Password, which are then emailed to the phisher. Here's an example of the page you would see if you clicked on the Regions Bank logo (graphic courtesy of PhishTank submission 2254700.)

Things get quite fascinating though when we hide the graphics:

Why would an IRS phish have ALT TEXT including for four of the largest Canadian banks? By looking at the source code for the phishing page, we see that this is a very lightly rebranded Interac phish: First, the website Title is "INTERAC e-Transfer" ...

INTERAC is a very interesting money transfer system used in Canada that allows anyone to send money to anyone else simply by using either their email address or cell phone text messaging service. A Transaction code is texted/emailed from the payer to the recipient, allowing the recipient to login to the Interac service and choose what account, and what bank, they would like to receive the funds into.

The phish has some Javascript at the top that includes variables like "var provinceList = new Array ("Alberta", "British Columbia", "New Brunswick", "Newfoundland and Labrador", "Nova Scotia", "Ontario", "Prince Edward Island", "Saskatchewan");" and a pull down menu with options "Select Institution", "Select Province or Territory" and "Select Credit Union."

As we continue into the table of graphics, we see that the phisher has changed his graphics and links to refer to the American banks, with code such as:

href = chasecustomerprofile
img src = chasecustomerprofile/css/images/chaseNew.gif .... but with "alt=CIBC"

href = navy/index.htm
img src = imgs/nfculogo.png  .... but with "alt=President's Choice Financial"

href = suntrust
img src = imgs/suntrust.png  .... but iwth "alt = RBC Royal Bank"

etc . . . 

Phishing Cross-Brand Intelligence

It seems fairly clear that we should be able to find more phishing sites that used the original Interac code, and of course we can in the Malcovery PhishIQ system.

Here is a phish that was seen on June 21, 2013 on the website freevalwritings.com / wp / interacsessions / RP.do.htm

And another first seen on May 28, 2013 on the website anglaisacote.com / interac / RP.do.htm (note the common path on both of these that matches the current IRS phish = "interac/RP.do.htm" RP.do.htm is used on the REAL Interac website.

Phishing & Spam Cross-Brand Intelligence

An interesting thing about phishing emails that differentiates them from standard spam. While normal spam is often sent via botnets, phishing emails tend to be sent from the same IP address over a period of time. When we use Malcovery PhishIQ to examine the IRS version of the Interac phish, which attempts to steal money from Bank of America, Chase Bank, Navy Federal Credit Union, SunTrust, Regions Bank, Wells Fargo, USAA, and Citi, we see that the originally advertised URL was actually "130.13.122.25 / irsjspmessageKey-IG09210358i /". That URL forwarded visitors to the website "ernursusleme.com / Connections / irsonlinedeposit /" which then forwarded the visitors to "bursafotograf.com / profiles / interac / RP.do.htm" which is where the screenshot at the top of this article was captured.

So, to find spam messages related to this phish, it seems reasonable to search the Malcovery Spam Data Mine for emails that advertised URLs on 130.13.122.25.

We found two sets of spam messages that advertised URLs on that host in our spam collection. One batch from January 8, 2014 and the other batch from January 28th and January 29th, 2014.

The January 28th and January 29th emails claimed to be from "From: USAA (USAA.Web.Services@customer.usaa.com)" with an email subject of "New Insurance Document Online".

Two of the emails were sent from 122.3.92.116 (Philippines) and one email was sent from 70.166.118.54 (Cox). What other emails were sent from those IP addresses?

Here are the emails from 122.3.92.116

Date:	Subject:	From Name	From Email
Dec 13, 2013	Your account has been limited until we hear from you	service@ intl.paypal.com	survey.research-3086@ satisfactionsurvey.com
Dec 13, 2013	Your account has been limited until we hear from you	service@ intl.paypal.com	survey.research-3086@ satisfactionsurvey.com
Dec 14, 2013	Your account has been limited until we hear from you	service@ intl.paypal.com	survey.research-3086@ satisfactionsurvey.com
Dec 16, 2013	Confirmation - personal information update	USAA	USAA.Web.Services@ customermail.usaa.com
Dec 18, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 18, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 18, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 23, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 30, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 31, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 31, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Dec 31, 2013	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 5, 2014	Notification of Limited Account Access	PayPal	PayPal@ abuse.epayments.com
Jan 7, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 7, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 7, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 8, 2014	View Your USAA Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 17, 2014	Canada Tax send you an INTERAC e-Transfer	notify@ payments.interac.ca	notify@ payments.interac.ca
Jan 19, 2014	Your dispute has been ended 01/20/2014: Get your money back	PayPal	paypal.feedback@ email.com
Jan 19, 2014	Your dispute has been ended 01/20/2014: Get your money back	PayPal	paypal.feedback@ email.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 20, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	View and Sign Your USAA Insurance Policy	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 21, 2014	Your dispute has been ended 01/20/2014: Get your money back	PayPal	paypal.feedback@ email.com
Jan 28, 2014	New Insurance Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Jan 28, 2014	New Insurance Document Online	USAA	USAA.Web.Services@ customermail.usaa.com
Feb 8, 2014	Canada Revenue send you an INTERAC e-Transfer	TD Canada Trust	notify@ payments.interac.ca

And here are the emails from 70.166.118.54

Date:	Subject:	From Name	From Email
Jan 29, 2014	New Insurance Document Online	USAA	USAA.Web.Services@customermail.usaa.com
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 3, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 4, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 4, 2014	INTERAC e-Transfer Received	notify@ payments.interac.ca	notify@ payments.interac.ca
Feb 8, 2014	Canada Revenue send you an INTERAC e-Transfer	RBC Royal Bank	notify@ payments.interac.ca
Feb 9, 2014	Canada Revenue send you an INTERAC e-Transfer	RBC Royal Bank	notify@ payments.interac.ca
Feb 11, 2014	Wells Fargo ATM/Debit Card Expires Soon	Wells Fargo Online	alerts@ notify.wellsfargo.com
Feb 11, 2014	Wells Fargo ATM/Debit Card Expires Soon	Wells Fargo Online	alerts@ notify.wellsfargo.com

The Power of Cross-Brand Intelligence

To summarize, we started with a new IRS phish, and through some comparisons in the Phishing and Spam Data Mines, ended with phish for USAA, PayPal, Wells Fargo, and Interac all being linked together. Investigators interested in learning more are encouraged to reach out!

Highest Malware Spam Rate since April 2013

Since 2006, my lab at UAB, part of The Center for Information Assurance and Joint Forensics Research has been gathering spam and finding creative ways to analyze it to find new threats. Last December we licensed that technology to form Malcovery Security who have picked up the reins on the work of finding and reporting on new malicious threats in spam. Between the groups, we've evaluated nearly a billion spam messages, so when one of my analysts says they are seeing something "new" I pretty much listen to them.

This week they said "spam-delivered Malware is going through the roof!" I was traveling when I got that first report but was able to spend some time in the lab with the analysts yesterday, and they weren't kidding!

The new volume levels started on Wednesday, February 5th, with a campaign imitating Bank of America. On February 6th it changed to Visa/Mastercard, and on February 7th it was imitating FedEx. When we say it was extremely high volume, we mean it!

Date	Messages reviewed	Count	Email Subject
Feb 5	1,066,187	171,186	Bank of America Alert: Online Banking Security Measures
Feb 6	1,176,667	303,646	ATTN: Important notification for a Visa / MasterCard holder!
Feb 7	1,113,739	267,445	Some important information is missing

Those numbers indicate that for the last three days this single malware distributor was accounting for 16%, 25.8%, and 24% of all the spam we reviewed! How does that compare to normal? The previous day, February 4th, we considered the "Photos" malware campaign to be heavily spammed when it reached 5% of total spam volume for the day.

Microsoft's Security Intelligence Report (volume 15) showed spam message breakdown for the first half of 2013 like this:

Historically, we've only seen one day, either at UAB or at Malcovery, that had a higher percentage of malware-laden spam. April 17, 2013, the day following the Boston Marathon Bombing, broke all the records for heaviest spam campaign that was distributing malware as we wrote about in Boston Marathon Explosion Spam Leads to Malware. Cisco's 2014 Annual Security Report calls attention to that spam campaign as well, saying that it accounted for 40% of all the spam messages delivered worldwide that day. Their report included this caution of "Breaking News" emails ...

Because breaking news spam is so immediate, email users are more likely to believe the spam messages are legitimate. Spammers prey on people’s desire for more information in the wake of a major event. When spammers give online users what they want, it’s much easier to trick them into a desired action, such as clicking an infected link. It’s also much easier to prevent them from suspecting that something is wrong with the message.

Here are some more details about the spam messages that were seen in the past three days:

---

Computers opening this attachment would try to contact the URLs listed here. The "404.php" is an exploit kit that results in the ".exe" files being dropped: (http is changed to hYYp and spaces added to URLs for your protection)

hYYp://37.139.47.56   /srt/404.php
hYYp://37.139.47.56   /ssd/usa.exe
hYYp://37.139.47.56   /ssd/usa2.exe
hYYp://62.76.187.171   /srt/404.php
hYYp://62.76.187.171   /ssd/usa.exe
hYYp://62.76.187.171   /ssd/usa2.exe
hYYp://62.76.187.221   /ssd/usa.exe
hYYp://62.76.187.221   /ssd/usa2.exe
hYYp://62.76.187.221   /ssd/usa2.exe
hYYp://85.143.166.119   /srt/404.php
hYYp://85.143.166.119   /ssd/usa.exe

---

hYYp://37.139.47.56    /srt/404.php
hYYp://37.139.47.56    /ssd/usa.exe
hYYp://37.139.47.56    /ssd/usa2.exe
hYYp://37.139.47.56    /ssd/ust2.exe
hYYp://37.139.47.56    /ssd/ust21.exe
hYYp://62.76.179.171    /punta/gae.php
hYYp://62.76.187.171    /srt/404.php
hYYp://62.76.187.171    /ssd/usa.exe
hYYp://62.76.187.171    /ssd/usa2.exe
hYYp://62.76.187.171    /ssd/ust2.exe
hYYp://62.76.187.171    /ssd/ust21.exe
hYYp://62.76.187.221    /ssd/usa.exe
hYYp://62.76.187.221    /ssd/usa2.exe
hYYp://62.76.187.221    /ssd/ust2.exe
hYYp://62.76.187.221    /ssd/ust21.exe
hYYp://62.76.42.144    /punta/gae.php
hYYp://62.76.46.249    /punta/gae.php
hYYp://85.143.166.119    /srt/404.php
hYYp://85.143.166.119    /ssd/usa.exe
hYYp://85.143.166.119    /ssd/usa2.exe
hYYp://85.143.166.119    /ssd/ust2.exe

---

hYYp://37.139.47.56    /srt/404.php
hYYp://37.139.47.56    /ssd/ust12.exe
hYYp://62.76.187.171    /srt/404.php
hYYp://62.76.187.171    /ssd/ust12.exe
hYYp://85.143.166.119    /srt/404.php
hYYp://85.143.166.175    /ssd/ust12.exe

---

The IP addresses that would be most critical to block to protect your network would be these. Most of these addresses are on a Cloud hosting service in Russia, "clodo.ru", some on the ASN - St. Petersburg, Russia (clodo.ru) - AS48172 OVERSUN and others on AS56534 PIRIX-INET-AS PIRIX, ltd.

37.139.47.56 
62.76.179.171
62.76.187.171
62.76.187.221
62.76.42.144
62.76.46.249
85.143.166.119
85.143.166.175

The .exe that gets dropped is ZeuS, though current detection would make that a bit hard to tell. The main file being dropped this morning has the MD5 hash = b32e5922c82208b5fdf6d60503d458f9. Here is the VirusTotal report for that URL as of this timestamp, which is showing greatly improved detection over my original run. ESET, Kaspersky, and Microsoft are all agreeing this is Zeus, while 9 other vendors list some form of "Generic" as the detection name.

Spamming Computers analysis

How often were the same computers used to send these campaigns? We first created three lists of IP addresses used to deliver the spam on each day. I called them ss5ip, ss6ip, and ss7ip for the three days. ss5ip was a list of the 47,380 IP addresses we saw deliver the Bank of America spam on February 5. ss6ip was a list of the 58,532 IP addresses we saw deliver the Visa/MasterCard spam on February 6. ss7ip was a list of the 51,883 IP addresses we saw deliver the FedEx spam on February 7.

5 Intersection 6 = 22,500 shared IPs
6 Intersection 7 = 25,405 shared IPs
5 Intersection 7 = 18,261 shared IPs
16,255 IPs were seen in all three campaign.

107,987 unique IPs were seen if we combine all three campaigns.

Those 107,987 IP addresses sent Malcovery's spam accounts an average of 6.8 emails each and a median of 4 emails each. The two top spamming IP addresses were 86.64.142.28 (France, 158 messages) and 200.123.8.123 (Peru, 142 messages).

I geo-coded those IP addresses that sent more than 10 emails to us, which was a total of 21,955 IP addresses from 141 countries. A very unusual number of IP addresses, more than 45%, are from Spanish-speaking countries, . At some point this botnet probably enlarged itself on Spanish-language spam- or website-based malware

 ES  3052 - Spain
 AR  2148 - Argentina
 US  1841 - United States
 CO  1387 - Colombia
 MX  1374 - Mexico
 IT  1263 - Italy
 DE  1025 - Germany 
 PE  915  - Peru
 RO  876  - Romania
 BR  833  - Brazil
 GB  666  - Great Britain
 CL  634  - Chile
 FR  537  - France
 IL  489  - Israel 
 CA   379  - Canada
 PL  342  - Poland
 TR  325  - Turkey
 BG  267  - Bulgaria
 PT  259  - Portugal
 GR  238  - Greece
 VE  238  - Venezuela
 AT  183  - Austria
 RS  180  - Republic of Serbia
 EC  131  - Ecuador
 CH  118  - Switzerland
 IN  116  - India
 CZ  104  - Czech Republic
 PA  104  - Panama

GameOver Zeus now uses Encryption to bypass Perimeter Security

The criminals behind the malware delivery system for GameOver Zeus have a new trick. Encrypting their EXE file so that as it passes through your firewall, webfilters, network intrusion detection systems and any other defenses you may have in place, it is doing so as a non-executable ".ENC" file. If you are in charge of network security for your Enterprise, you may want to check your logs to see how many .ENC files have been downloaded recently.

Malcovery Security's malware analyst Brendan Griffin let me know about this new behavior on January 27, 2014, and has seen it consistently since that time.

On February 1st, I reviewed the reports that Malcovery's team produced and decided that this was a trend we needed to share more broadly than just to the subscribers of our "Today's Top Threat" reports. Subscribers would have been alerted to each of these campaigns, often within minutes of the beginning of the campaign. We sent copies of all the malware below to dozens of security researchers and to law enforcement. We also made sure that we had uploaded all of these files to VirusTotal which is a great way to let "the industry" know about new malware.

To review the process, Cutwail is a spamming botnet that since early fall 2013 has been primarily distributing UPATRE malware via Social Engineering. The spam message is designed to convince the recipient that it would be appropriate for them to open the attached .zip file. These .zip files contain a small .exe file whose primary job is to go out to the Internet and download larger more sophisticated malware that would never pass through spam filters without causing alarm, but because of the way our perimeter security works, are often allowed to be downloaded by a logged in user from their workstation.

As our industry became better at detecting these downloads, the criminals have had a slightly more difficult time infecting people. With the change last week, the new detection rate for the Zeus downloads has consistently been ZERO of FIFTY at VirusTotal. (For example, here is the "Ring Central" .enc file from Friday on VirusTotal -- al3101.enc. Note the timestamp. That was a rescan MORE THAN TWENTY-FOUR HOURS AFTER INITIAL DISTRIBUTION, and it still says 0 of 50. Why? Well, because technically, it isn't malware. It doesn't actually execute! All Windows EXE files start with the bytes "MZ". These files start with "ZZP". They aren't executable, so how could they be malware? Except they are.

In the new delivery model, the .zip file attached to the email has a NEW version of UPATRE that first downloads the .enc file from the Internet and then DECRYPTS the file, placing it in a new location with a new filename, and then causing it both to execute and to be scheduled to execute in the future.

I am grateful to William MacArthur of GoDaddy, Brett Stone-Gross of Dell Secure Works, and Boldizsár Bencsáth from CrySys Lab in Hungary who were three researchers who jumped in to help look at this with us. Hopefully others will share insights as well, so this will be an on-going conversation. (UPDATE: Boldizsár has published details of how the encoding works -- the file is first compressed and then XOR'ed with a 32-bit key). Upatre reverses the process to create the .exe file)

UPATRE campaigns that use Encryption to Bypass Security

Here are the campaigns we saw this week, with the hashes and sizes for the .zip, the UPATRE .exe, the .enc file, and the decrypted GameOver Zeus .exe file that came from that file. For each campaign, you will see some information about the spam message, including the .zip file that was attached and its size and hash, and the .exe file that was unpacked from that .zip file. Then you will see a screenshot of the email message, followed by the URL that the Encrypted GameOver Zeus file was downloaded from, and some statistics about the file AFTER it was decrypted.

ALL OF THESE SPAM CAMPAIGNS ARE RELATED TO EACH OTHER! They are all being distributed by the criminals behind the Cutwail malware delivery infrastructure. It is likely that many different criminals are paying to use this infrastructure.

Campaign: 2014-01-27.ADP	Messages Seen: 2606	Subject: Invoice #(RND)
From: ADP - Payroll Services	payroll.invoices@adp.com
Invoice.zip	9767 bytes	b624601794380b2bee0769e09056769c
Invoice.PDF.exe	18944 bytes	8d3bf40cfbcf03ed13f0a900726170b3

dcmsservices.com/images/stories/slides/pdf.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

electriciansdublinireland.com/wp-content/uploads/2014/01/pdf.enc	287920 bytes	09ced08856101f86c02890f4373623a4
decrypted	338432 bytes	b63415efcc70974269bd9d8da10b3ac1

---

Campaign: 2014-01-27.BBB	Messages Seen: 776	Subject: FW: Complaint Case (RND)
From: Better Business Bureau	(Random)@newyork.bbb.org
Case 463252349343.zip	9762 bytes	1ed259d9e7474cfe56df485be479ea97
Case 463252349343.exe	18944 bytes	809ae1af04ab921aa60efeb7083d21d7

sigmau.co.uk/templates/hot_spicy/images/glass/pdf.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

skipbagsdublin.com/wp-content/uploads/2014/01/pdf.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

---

Campaign: 2014-01-27.HMRC	Messages Seen: 302	Subject: Important Information for Employers
From: HMRC Employer Alerts & Registrations	employers@alerts.hmrc.gov.uk
Employer_Bulletin_Issue_46_79520EEE31.zip	7218 bytes	413cda07e774a5ed7f98279dd9e8a087
Employer_Bulletin_Issue_46_79520EEE31.exe	17920 bytes	2616babcdf0c5b9086ff63fa6682fe07

all-monitor.com/images/pdf.enc	282449 bytes	9d1b8f296b5bfb0f4817c2aacb8815a3
decrypted	289280 bytes	fa4d35b63a8485bc7c0b167ca9358b76

---

Campaign: 2014-01-27.HSBC	Messages Seen: 404	Subject: FW: Payment Advice - Advice Ref:[GB(RND)] / ACH credits / Customer Ref:[pay run 14/11/13]
From: HSBC Advising Service	advising.service.(RND).(RND).RND)@mail.hsbcnet.hsbc.com
PaymentAdvice.zip	7162 bytes	c17396cddadf201f83074615824240c0
PaymentAdvice.exe	17920 bytes	e0595c4f17056e5599b89f1f9cf52d83

afrolatinotala.com/images/pdf.enc	282448 bytes	414755f65ebbaf52669aaab649b3f274
decrypted	289280 bytes	5a393b283f42edd17c7da2625b8e1045

---

Campaign: 2014-01-27.Skype	Messages Seen: 275	Subject: Skype Missed voice message
From: Administrator	docs(#)@(many)
Skype-message.zip	10147 bytes	79fb2e523fe515a6dac229b236f796ff
Voice_Mail_Message.exe	18944 bytes	6e4857c995699c58d9e7b97bff6e3ee6

rockthecasbah.eu/templates/beez/css/wav.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

---

Campaign: 2014-01-27.VoiceMessage	Messages Seen: 271	Subject: Voice Message from Unknown
From: Administrator	docs(#)@(many)
VoiceMessage.zip	7273 bytes	d2070f6a15312dec7882ca0d9ec7f431
VoiceMessage.exe	17920 bytes	8a739776cf8316eba1bfae50e020c8f1

akhrisawal.com/images/marquee/wav.enc	282448 bytes	73c811d0794de15906225d7d936fc6b7
decrypted	289280 bytes	2b0db77ac980be10b9ef4562269d8db4

ayeshaomar.com/images/host/wav.enc	282446 bytes	1d30d5fe55585d24cd15ef97afb7322c
decrypted	289280 bytes	b993b4cb332b979d6f8509f5765abfd4

---

Campaign: 2014-01-28 DeptTreasury	Messages Seen: 223	Subject: Department of Treasury Notice of Outstanding Obligation - Case (RND)
From:	support@salesforce.com
FMS-Case-(RND).zip	9462 bytes	067617d990a861f87304bb08b6628524
FMS-.exe	18944 bytes	40afe219c14a0a5f3a4ddd6c8e39bc23

almotawer.biz/img/pdf.enc	328025 bytes	41d57ca4b8705247186e2f30d911d811
decrypted	387584 bytes	7178a455ee9a0d6e42465ad9967a177a

imagevillage.co.uk/images/pdf.enc	328025 bytes	41d57ca4b8705247186e2f30d911d811
decrypted	387584 bytes	7178a455ee9a0d6e42465ad9967a177a

---

Campaign: 2014-01-28.IRS	Messages Seen: 192	Subject: Complaint Case (RND)
From: IRS.gov	fraud.dep@irs.gov
Complaint_RND.zip	7240 bytes	f20768ed9f771a92950a5f5ab14bf57f
Complaint_.exe	17408 bytes	8163d272c4975b1d7ed578b4d24b3d2a

farmyarddog.co.uk/images/pdf.enc	282486 bytes	97b200826b7a526d91fda4c56dc438ae
decrypted	289276 bytes	542a5a6f04ddcad3effc72121c59e332

hamdanicoffee.com/up/pdf.enc	282486 bytes	97b200826b7a526d91fda4c56dc438ae
decrypted	289276 bytes	542a5a6f04ddcad3effc72121c59e332

---

Campaign: 2014-01-28.NewVoiceMessage	Messages Seen: 165	Subject: New Voice Message
From: Voice Mail	(RND)@(reflective)
VoiceMail.zip	6502 bytes	2a048dfb3429155d552cb0c37b499b51
VoiceMail.exe	17920 bytes	dc2e2f04a01009f3193b0df4ba0f6e81

hailantrdg.com/scripts/wav.enc	282489 bytes	11a55dd1a756dbba6e7d404a7c22544a
decrypted	289280 bytes	cae9c9614affac694320215228efcf27

morethanshelters.co.uk/images/banners/wav.enc	282489 bytes	11a55dd1a756dbba6e7d404a7c22544a
decrypted	289280 bytes	cae9c9614affac694320215228efcf27

---

Campaign: 2014-01-28.RingCentral	Messages Seen: 7720	Subject: New Fax Message on 1/22/2013
From: RND	RND@RND
fax.zip	9929 bytes	afa90762f6412173cf6e0e6d1d57531d
fax.doc.exe	18944 bytes	81e425646f68d3adaddca0cf398f595f

ren7oaks.co.uk/images/al2701.enc	441073 bytes	f626ad2af056644ff4717e1cd80c6da3
decrypted	484352 bytes	c7c4a875b90c86136e497af8ffc9a9e0

salahicorp.com/up/al2701.enc	441073 bytes	f626ad2af056644ff4717e1cd80c6da3
decrypted	484352 bytes	c7c4a875b90c86136e497af8ffc9a9e0

---

Campaign: 2014-01-28.WhatsApp	Messages Seen: 767	Subject: Missed voice message, "(timestamp)"
From: WhatsApp Messenger	ctaylor@magma.net
Missed-message.zip	6492 bytes	494d6095b540dbc9f570e22b717a32df
Missed-message.exe	17920 bytes	a4c01917b7d48aa7c1c9a2619acb5453

inspireplus.org.uk/images/banners/wav.enc	282491 bytes	33070eda34ccea632c3b4007a1e2beee
decrypted	289268 bytes	dc5b998fd7a6f29ebac6365654d57609

zubayen.com/up/wav.enc	282491 bytes	33070eda34ccea632c3b4007a1e2beee
decrypted	289268 bytes	dc5b998fd7a6f29ebac6365654d57609

---

Campaign: 2014-01-28.Skype	Messages Seen: 574	Subject: Skype Missed voice message
From: Administrator	docs(#)@(many)
Skype-message.zip	9163 bytes	dfa3db3c14ae1e369a4a9df6cb82832f
Skype-message.exe	18944 bytes	ab703881cb4b3fbd5ee13df30b7bb8d7

---

Campaign: 2014-01-29.RingCentral1	Messages Seen: 3811	Subject: New Fax Message on 1/29/2013
From: RND	RND@*.ru
fax.zip	9473 bytes	0842e4bcc8af1f0d54519a99834be218
fax.pdf.exe	18432 bytes	d309df26dd91294dc4acd5fb78aa98f5

Campaign: 2014-01-29.RingCentral1	Messages Seen: 2887	Subject: New Fax Message on 1/22/2013
From: RND	RND@RND
fax.zip	9929 bytes	afa90762f6412173cf6e0e6d1d57531d
fax.pdf.exe	19968 bytes	5db38bd493ef2f9b35bb0015822b493d

Campaign: 2014-01-29.RingCentral1	Messages Seen: 2353	Subject: New Fax Message on 1/29/2013
From: RND	RND@*.ru
fax.zip	9994 bytes	2d65747503e7b251ad597a650f352f4e
fax.doc.exe	18944 bytes	81e425646f68d3adaddca0cf398f595f

internetauctions.ca/img/apps/al2901.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

---

Campaign: 2014-01-29.eFax	Messages Seen: 1016	Subject: Fax transmission: (RND-RND-RND-RND).zip
From: eFax Corporate	message@inbound.efax.com
(RND-RND-RND-RND.zip)	9628 bytes	9f2613dabe2a89ac21e9b55b6df51ebc
{fax num123}.exe	17920 bytes	89f45f68a0568996a6a109a1d04b6670

amy-escort.com/amy/pdf.enc	281970 bytes	42dda6f13b2c8df96321570e1fa84fe8
decrypted	289785 bytes	ee038bdd137f518614599275add5b9bb

pakmailbarrie.com/images/banners/pdf.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

---

Campaign: 2014-01-29.LloydsTSB	Messages Seen: 551	Subject: January Spending
From: RND	RND@lloydstsb.com
January.zip	9586 bytes	ea42b883dab711810243e8f138438733
January.exe	17920 bytes	c28d9a0b3b2643a01fd3f3250a39a511

airconexpress.com.au/images/deac/pdf.enc	281971 bytes	9c790bfd6def569362483192d6e1b9ba
decrypted	289800 bytes	82dd0f87007fc0149183e1de8f0913f2

numantis.com/images/banners/pdf.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

---

Campaign:	Messages Seen: 166	Subject: Voice Message from Unknown
From: Administrator	docs(#)@(many)
Message.zip	8748 bytes	ff2c3e6b875803945b320e438304f506
VoiceMessage.exe	17920 bytes	13d6046c575abe9c3072067135a57996

---

Campaign: 2014-01-30.BanquePopulaire	Messages Seen: 259	Subject: Numero de cas: RND
From: Banquepopulaire.fr	response-automatique@banquepopulaire.fr
Cas_RND.zip	9476 bytes	a21cd2697687ae6eb1b15175a8fb0ae2
Cas_01302014.exe	17920 bytes	968779b34f063af0492c50dd4b6c8f30

doradoresources.com/images/ie6/pdf.enc	282033 bytes	8cce7406f943daa81ef31411247491d3
decrypted	300544 bytes	092eb58dce516414908ecf6f3156372a

sportsstoreonline.in/wp-content/uploads/2013/03/pdf.enc	OFFLINE bytes	OFFLINE
decrypted	bytes

---

Campaign: 2014-01-30.Remit	Messages Seen: 206	Subject: FW: Last Month Remit
From: Administrator	docs(#)@reflective
Remit.(domain).zip	9465 bytes	145d3da149cc8fa3bef38af648713fb6
Remit.exe	17920 bytes	84a6030c8265b33c3c4e68d29975bd76

excelbizsolutions.com/templates/pdf.enc	282036 bytes	5c7d5797e1f46c29dd9c7a9976d9d359
decrypted	299008 bytes	aaf1097da1e50b7fd8d8c5e1a95acd80

poragdas.com/images/Porag/pdf.enc	282036 bytes	5c7d5797e1f46c29dd9c7a9976d9d359
decrypted	299008 bytes	aaf1097da1e50b7fd8d8c5e1a95acd80

---

Campaign: 2014-01-30.Skype	Messages Seen: 42	Subject: Skype Missed voice message
From: Administrator	docs(#)@reflective
Missed voice message.zip	9336 bytes	40453639a6fbd58b1d30099666ad32a
Missed voice message.exe	18944 bytes	30e5d9d4d7da572fdef6f7253950a53c

aatextiles.com/images/gallery/wav.enc	328784 bytes	75a9d6fd9fe34a4ff737c987938a8f6c
decrypted	386048 bytes	f2bef403482c4dd70bd4e1be1fd4af8f

profitera.com/img/newsletter/auto/wav.enc	328784 bytes	75a9d6fd9fe34a4ff737c987938a8f6c
decrypted	386048 bytes	f2bef403482c4dd70bd4e1be1fd4af8f

---

Campaign: 2014-01-30.AssortedFax	Messages Seen: 2410	Subject: Corporate eFax message from (RND) jConnect fax from (RND) - (RND) pages, Caller_ID (RND)
From: eFax Corporate jConnect Dun & Bradstreet	message / case.alert@inbound.j2.com dnb.com inbound.efax.com
FAX_001_RND.zip	10293 bytes	18b72825aecde011bdc92c1526491571
FAX_001_20143001_814.exe	18944 bytes	915fdc8403b26bac79801fa1a341495d

(These three all use the same binaries)

---

Campaign:	Messages Seen: 1627	Subject: New Fax Message on 01/29/2013
From: RND	RND@*.ru
fax.zip	10095 bytes	8627ce01daaebc35610d05cdbdbde612
fax.pdf.exe	18432 bytes	465c2656c07ab05e9349920f53dd0deb

Campaign: 2014-01-30.LaPoste	Messages Seen: 101	Subject: Scan de (RND)
From: LaPoste	reponse-automatique@laposte.net
Scan_RND_RND_RND.zip	9494 bytes	daaf11e91c3cc3506042d633373aabd3
Scan_301_30012014_001.exe	17920 bytes	968779b34f063af0492c50dd4b6c8f30

---

Campaign: 2014-01-30.Staples	Messages Seen: 245	Subject: Your order is awaiting verification!
From: Staples Advantage Orders	Order@staplesadvantage.com
Order_RND.zip	9465 bytes	e669d0ff0238ed2f3601c01f1a532728
Order.exe	17920 bytes	84a6030c8265b33c3c4e68d29975bd76

---

Campaign: 2014-01-31.RingCentral1	Messages Seen: 3488	Subject: New Fax Message on 01/29/2014
From: RND	RND@*.ru
fax.zip	9815 bytes	d373a3e96519612896facb6f18e89785
fax.pdf.exe	19968 bytes	9a836550c9e74a46076a7292fb0d4ab1

aim2go.com/WEB-INF/al3101.enc	329132 bytes	ded1b7f7ea934faf84a8dcc5011316cd
decrypted	390144 bytes	f07d3afab1eb150e8a315596b5fb23f9

bandwagondesign.com/scripts/al3101.enc	329132 bytes	ded1b7f7ea934faf84a8dcc5011316cd
decrypted	390144 bytes	f07d3afab1eb150e8a315596b5fb23f9

---