Les campagnes utilisent depuis hier des fichiers au format RAR renfermant toujours le Trojan.JS.Downloader
Ces derniers tentent de faire croire que le mail a été envoyé depuis un iPhone avec la mention "Sent from my iPhone"
Ce matin ce sont des mails de fausses factures ALFI.
Sujet du mail :
ALFI : Facture client N° FC_2459085 du 30/03/2016
Bonjour,
Veuillez trouver ci-joint la facture pour le renouvellement de votre antivirus.
Bonne réception
A.Morel
A.L.F.I.
ZA de la MAIE
et aussi de fausses mailling avec des emails comportant le sujet Emailing suivi du document joint.
Ces mailling tentent de faire passer des fichiers xls, tiff, jpg, qui s'avèrent être des fichiers ZIP.
Utilisation de la double-extension.
Your message is ready to be sent with the following file or link attachments:
list-290.xlsx
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please notify the sender of this mail. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the Emami Ltd. Finally, the recipient should check this email and any attachments for the presence of viruses. Emami accepts no liability for any damage caused by any virus transmitted by this email.
A noter l'injection de fausses en-tête X-MXScan :
Return-Path: <
[email protected]>
X-MXScan-Scan: Scanned by MxScan 2.7.501.0 for WIN-3EAMS8MV18J
X-MXScan-Msgid: 0272193875288163440646087024765_
X-MXScan-License: {Unregistered Version} Only for personal and non-commercial use. Commercial use is PROHIBITED and requires a license.
X-MXScan-AntiVirus: ClamAV devel-clamav-0.97-408-ge11f7cc/21435/Wed, 30 Mar 2016 17:06:48 +0530 [Clean]
X-MXScan-AntiSpam: KEYWORD [Pass], RDNSBL [Pass], URLBL [NA], SPAMASSASSIN [NA], DCC_CHECK [NA]
X-MXScan-SpamScore: 0
X-MXScan-ProcessingTime: 5.063 sec(s)
X-ME-Bayesian: 0.000000
