Description
Cisco Security Intelligence Operations has detected significant activity related to spam e-mail messages that claim to contain a failed money transfer message from Western Union for the recipient. The e-mail message instructs the recipient to open the attachment to view the details. However, the .zip attachment contains a malicious .exe file that, when executed, attempts to infect the system with malicious code.
E-mail messages that are related to this threat (RuleID5726) may contain the following files:
TRANSFER DET47589037579.exe
TRANSFER2663 1.zip
The TRANSFER DET47589037579.exe file in the TRANSFER2663 1.zip attachment has a file size of 244,736 bytes. The MD5 checksum, which is a unique identifier of the executable, is the following string: 0xA6C6DA75532B7CEEDDABA20943FFA1E3
The following text is a sample of the e-mail message that is associated with this threat outbreak:
Subject: ORG MTCN: 747-857-7003 NEW MTCN: =44-513-951
Message Body:
Dear Agent,
The following transfer has been =efused by Western Union.
Please notify the sender and/or sending agent =hat the transfer is now available as a refund of principal and charges.
ORG MTCN: 624-506-3361 NEW MTCN: 624-559-349
File Date: 04/04/13
Transfer detailes attached to the letter.
If you need any =urther assistance, do not hesitate to contact us;
Email: =ugsi@westernunion.com
Fax: 866-420-5247.
The MTCN must be referenced on all of the documentation.
Thank you,
Government Sanctions & =nterdiction Research Department
Source: Cisco Systems