Description
Cisco Security Intelligence Operations has detected significant activity related to spam e-mail messages that claim to contain a tax document from E*Trade Financial for the recipient. The e-mail message instructs the recipient to open the attachment to download the tax form. However, the .zip attachment contains a malicious .exe file that, when executed, attempts to infect the system with malicious code.
E-mail messages that are related to this threat (RuleID5341) may contain the following files:
E-Trade_Tax_Form8809830.zip
E-Trade_Tax_Form.exe
The E-Trade_Tax_Form.exe file in the E-Trade_Tax_Form8809830.zip attachment has a file size of 133,120 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0xC291651F7AE8176A53CEE1A19FE6C635
The following text is a sample of the e-mail message that is associated with this threat outbreak:
Subject: Important Tax Document
Message Body:
E*TRADE Financial
E*TRADE Financial
E*TRADE Financial E*TRADE Financial
E*TRADE Financial
E*TRADE Financial Your Tax Document is Now Available E*TRADE Financial
E*TRADE Financial
E*TRADE Financial Dear Customer,
Account number ending in: 8469
A tax document for your E*TRADE Securities brokerage account shown above is now available online.
To view and complete your tax document now, please follow the instructions below. (Adobe Acrobat Reader required.) E*TRADE Financial
E*TRADE Financial
E*TRADE Financial E*TRADE Financial E*TRADE Financial Download E-Trade_Tax_Form8809830.zip. E*TRADE Financial
E*TRADE Financial
E*TRADE Financial E*TRADE Financial E*TRADE Financial Now you right click on any folder. You will see an option of unzip file in context menu. Click on it. E*TRADE Financial
E*TRADE Financial
E*TRADE Financial E*TRADE Financial E*TRADE Financial Please complete all required entries on your tax form.
E*TRADE Financial
E*TRADE Financial
E*TRADE Financial Please review your tax document carefully. If there is any information you feel is incorrect, please notify us immediately.
For more information on tax reporting and cost basis, please go to www.etrade.com/taxcenter.
If you have questions about your tax form please call 1-800-ETRADE-1 (1-800-387-2331 or from outside the U.S., call +1 678 624 6210), anytime 24/7. You can also log on to your account and send us a Secure Message by clicking on the Customer Service link found in the upper right-hand corner of the page.
As always, we appreciate your business and the opportunity to serve you.
Sincerely,
E*TRADE Securities Customer Service E*TRADE Financial
E*TRADE Financial
E*TRADE Financial E*TRADE Financial E*TRADE Financial
E*TRADE Financial
E*TRADE Financial PLEASE READ THE IMPORTANT DISCLOSURES BELOW
E*TRADE Securities LLC is located at 1271 Avenue of The Americas, New York, NY 10020.
To view your tax document online, simply log on at www.etrade.com. Under the Accounts tab, select Tax & Account Records. In the Brokerage Account Statement & Records section, click Tax Documents.
For fastest service and maximum security, log on to your account before e-mailing us. Please do not reply directly to this e-mail, as we do not receive messages sent to this address.
The E*TRADE FINANCIAL family of companies provides financial services that include trading, investing, and related banking products and services to retail investors.
Securities products and services are offered by E*TRADE Securities LLC, Member FINRA/SIPC.
System response and account access times may vary due to a variety of factors, including trading volumes, market conditions, system performance, and other factors.
Secure Message E*TRADE Financial
E*TRADE Financial is committed to protecting you against email fraud (phishing or spoofing). If you see the animated Security Enhanced icon along with your first name and the last four digits of your primary account number at the top of this email, you can be sure its a legitimate message from us. Learn more about online security at www.etrade.com/onlinesecurity.
If you want to visit the Web pages referenced in this e-mail, you can also type the corresponding URLs below directly into your browser:
hxxps://us.etrade.com/e/t/plan/tax
hxxps://us.etrade.com/e/t/jumppage/viewjumppage?PageName=secureid_enter
hxxp://www.etrade.com/onlinesecurity
hxxp://www.sipc.org/
2013 E*TRADE Financial. All Rights Reserved.
Source: Cisco