NatWest Statement (Natwest Virus)

View Your March 2015 Online Financial Activity Statement

Keep track of your account with your latest Online Financial Activity Statement from NatWest Bank. It's available for you to view at this secure site. Just click to select how you would like to view your statement:

View/Download as a PDF
View all EStatements

So check out your statement right away, or at your earliest convenience.

Thank you for managing your account online.
Sincerely,

NatWest Bank

Please do not respond to this e-mail. If you have any questions about this inquiry message or your NatWest Bank Ū Merchant account, please speak to a Customer Service representative at 1-800-374-2639

NatWest Bank Customer Service Department
P.O. Box 414 | 38 Strand, WC2N 5JB, London
Copyright 2014 NatWest Company. All rights reserved.
AGNEUOMS0006001

Email analysis :

NOTE : noreply@natwest.com
NOTE : ldbsgw@brallc.com
NOTE : User-Agent : Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
NOTE : Received : from unknown (HELO IKAEMVMYO) (62.225.191.34)

Rép :Payment Directive

From Desk of: Mark Webster
Director, International Payment Department

Dear Beneficiary

We wish to notify you during the ongoing Economic Summit of the International Monetary Fund in the presence of key economic policy makers, decision reached was to recall all overdue payments from banks and government treasuries owed to several contractors/winners and released to them via our supervision through our office in United Kingdom.

The payment instrument via a registered Non Resident Online account in your name with outstanding value been approved as the beneficiary of the approved sum due to be cleared by the Financial Clearing House in United Kingdom.

You are to contact the Private Banking Manager: Simon Attewell
Natwest Bank
HEADQUARTERS:
135 Bishopsgate, London EC2M 3UR
Email:sattewell@fsmail.net

He will be handling the payment release process.
Mark Webster
Director, International Payment Department

NatWest link for Virus

NatWest Logo

You have a new private message from NatWest

To view/read this your secure message please click here

Email Encryption Provided by NatWest. Learn More.
Email Security Powered by Voltage IBE
Copyright 2014 National Westminster Bank Plc. All rights reserved.

Footer Logo NatWest

To unsubscribe please click here

National Westminster Bank Plc. All rights, save as expressly granted, are reserved. Reproduction in any form of any part of the contents of this website without our prior written consent is prohibited unless for personal use only.

Email analysis :
=================================================
NOTE : Return-Path : < denqv@bpbcorp.com >
NOTE : Received : from unknown (HELO localhost) (113.167.221.144)

NOTE : User-Agent : Mozilla/5.0 (Windows NT 6.1; rv:24.0)
NOTE : Gecko/20100101 Thunderbird/24.2.0
NOTE : You have received a new secure message from NatWest
=================================================

Link analysis :
=================================================
NOTE : Click "To view/read this your secure message please click here"
NOTE : Open "http://high-hollin.org/nrhscgfayh/rxyxzmsbsy.html"
NOTE : A new download is processed :

NOTE : File "SecureMessage.zip" from http://www.explicacoesmagicmath.pt
NOTE : File "SecureMessage.zip" is a VIRUS !
=================================================

Virus analysis (DEF 20140916) :
=================================================
AVware : Win32.Malware!Drop
Avira : TR/ATRAPS.A.1717
Baidu-International : Trojan.Win32.Upatre.ABlK
DrWeb : Trojan.DownLoad3.34292
ESET-NOD32 : Win32/TrojanDownloader.Waski.A
Ikarus : Trojan-Spy.Agent
K7AntiVirus : Trojan (7000000c1)
K7GW : Trojan(7000000c1)
Kaspersky : Trojan-Downloader.Win32.Upatre.avh
Kingsoft : VIRUS_UNKNOWN
Malwarebytes : Trojan.Upatre
McAfee : Artemis!AE3D2F8620F0
Microsoft : TrojanDownloader:Win32/Upatre.AA
Panda : Trj/Chgt.F
Qihoo-360 : HEUR/QVM20.1.Malware.Gen
Sophos : Mal/DrodZp-A
Symantec : Trojan.Zbot
Tencent : Win32.Trojan-downloader.Upatre.Wqmz
VIPRE : Win32.Malware!Drop
ViRobot : Trojan.Win32.S.Agent.20992.PD
=================================================

Whois Analysis :
=================================================
high-hollin.org
=================================================
Domain Name:HIGH-HOLLIN.ORG
Domain ID: D153034212-LROR
Creation Date: 2008-06-20T18:34:26Z
Updated Date: 2012-06-19T08:02:22Z
Registry Expiry Date: 2015-06-20T18:34:26Z
Sponsoring Registrar:Tucows Inc. (R11-LROR)
Sponsoring Registrar IANA ID: 69
Domain Status: ok
Registrant ID:tuMZ59PcSs2k5l1K
Registrant Name:Douglas McCowen
Registrant Organization:None
Registrant Street: Riverside Barn
Registrant City:Winford- BRISTOL
Registrant State/Province:Avon
Registrant Postal Code:BS408HJ
Registrant Country:GB
Registrant Phone:+44.7985466869
Registrant Email:dhl_mccowen@hotmail.com
Admin ID:tuMZ59PcSs2k5l1K
Admin Name:Douglas McCowen
Admin Organization:None
Admin Street: Riverside Barn
Admin City:Winford- BRISTOL
Admin State/Province:Avon
Admin Postal Code:BS408HJ
Admin Country:GB
Admin Phone:+44.7985466869
Admin Email:dhl_mccowen@hotmail.com
Tech ID:tu9LIBi0nseyvCgJ
Tech Name:Pickaweb Limited Domains Dpt
Tech Organization:Pickaweb Limited
Tech Street: 7 Marlow Copse
Tech City:Chatham
Tech State/Province:Kent
Tech Postal Code:ME59DP
Tech Country:GB
Tech Phone:+44.8712180841
Tech Email:domains@pickaweb.co.uk
Name Server:NS7.UKHOSTSUPPORT.COM
Name Server:NS8.UKHOSTSUPPORT.COM
=================================================
explicacoesmagicmath.pt
=================================================
Domain Name: explicacoesmagicmath.pt
Creation Date (dd/mm/yyyy): 04/02/2013
Expiration Date (dd/mm/yyyy): 03/02/2015
Status: ACTIVE

Registrant

Francisco Cascao
Rua Francisco sa Miranda Lt 7
538
2975 538

Email: franciscocascao@iol.pt

Entidade Gestora / Billing Contact
EASYHOST - SERVI?OS INTERNET, UNIPESSOAL LDA
Email: dns@easyhost.pt
RACKSPOT LDA
Email: helpdesk@rackspot.com
Nameserver: explicacoesmagicmath.pt NS a.ns.rackspot.com.
Nameserver: explicacoesmagicmath.pt NS b.ns.rackspot.com.
=================================================

ARE YOU STILL ALIVE?...

Chief Executive Director Of International Remmittance,
Fund Transfer and Electronic ATM Card Department
Kilburn High Road, London NW6, London-UK.
(REGISTERED NO.1026167).

Attn: Beneficiary,

The U.S.A Government, World Bank And United Nations Organization Official Has Approved to pay you part payment of your Contract / Inheritance Fund payment Valued at 15Million (Fifteen Million Britain Pounds in conjunction with British Government and NATWEST BANK PLC LONDON. This decision was made last week. With this development, a woman by name (MRS: JANET WHITE) came to our office with an application stating that you gave her the power of attorney to be the beneficiary of your outstanding Contract / Inheritance / Award Funds. She made us to believe that you are dead and that she is your next of kin. We got your email address and decided to inform you by sending an email through this address hoping to find out, if you are dead or alive and also to find out if you at anytime gave this woman the power of attorney to represent you. If you are not aware of the above instruction, please do respond to this email immediately by contacting us, Please let us know if you are aware of that, because we are almost ready to release part payment of 15Million (Fifteen Million Britain Pounds of your outstanding funds to her nominated bank account stated below:

Bank Name: Washington Mutual Bank.
Address: 1723 Palmdale Bulv.
Palmdale Ca. 93550
Acct No:3573813158
Rout No:322271627
Swift code No:WMSBUS66
Beneficiary: JANET WHITE.

For immediate release of your said funds through ATM Card,Be informed that you are not allowed to correspond or contact any person or office with respect to this transfer other than this office, the new Britain Prime Minister David Cameron,have only giving instructions, that we can only release total Value of 15Million (Fifteen Million Britain Pounds) only, You are advised that a maximum withdrawal value of 10,000.00 Pounds is permitted daily And we are duly inter-switched and you can make withdrawal in any location of the ATM Center of your choice/nearest to you any where in the world. We have also concluded delivery arrangement with our accredited courier service Company to oversee the delivery of the ATM Card to you without any further delay you are required to send him an email, Please also reconfirm your information below:

1) YOUR FULL NAME.......................
2) RESIDENCE ADDRESS, CITY, STATE AND COUNTRY.............................
3) PERSONAL CELL PHONE, FAX AND MOBILE PHONE NUMBER......................
4) AGE AND SEX..............................
5.) Your Occupations......................................
6) Proof of your identity (International passport or Drivers License)....................

Yours Sincerely,
Mr.John Brown.

ARE YOU STILL ALIVE?..08/03/2014.

Chief Executive Director Of International Remmittance,
Fund Transfer and Electronic ATM Card Department
Kilburn High Road, London NW6, London-UK.
(REGISTERED NO.1026167).

Attn: Beneficiary,

The U.S.A Government, World Bank And United Nations Organization Official Has Approved to pay you part payment of your Contract / Inheritance Fund payment Valued at 15Million (Fifteen Million Britain Pounds in conjunction with British Government and NATWEST BANK PLC LONDON.

This decision was made last week. With this development, a woman by name (MRS: JANET WHITE) came to our office with an application stating that you gave her the power of attorney to be the beneficiary of your outstanding Contract / Inheritance / Award Funds.

She made us to believe that you are dead and that she is your next of kin. We got your email address and decided to inform you by sending an email through this address hoping to find out, if you are dead or alive and also to find out if you at anytime gave this woman the power of attorney to represent you.

If you are not aware of the above instruction, please do respond to this email immediately by contacting us, Please let us know if you are aware of that, because we are almost ready to release part payment of 15Million (Fifteen Million Britain Pounds of your outstanding funds to her nominated bank account stated below:

Bank Name: Washington Mutual Bank.
Address: 1723 Palmdale Bulv.
Palmdale Ca. 93550
Acct No:3573813158
Rout No:322271627
Swift code No:WMSBUS66
Beneficiary: JANET WHITE.

For immediate release of your said funds through ATM Card,Be informed that you are not allowed to correspond or contact any person or office with respect to this transfer other than this office, the new Britain Prime Minister David Cameron,have only giving instructions, that we can only release total Value of 15Million (Fifteen Million Britain Pounds) only, You are advised that a maximum withdrawal value of 10,000.00 Pounds is permitted daily And we are duly inter-switched and you can make withdrawal in any location of the ATM Center of your choice/nearest to you any where in the world.

We have also concluded delivery arrangement with our accredited courier service Company to oversee the delivery of the ATM Card to you without any further delay you are required to send him an email, Please also reconfirm your information below:

1) YOUR FULL NAME.......................
2) RESIDENCE ADDRESS, CITY, STATE AND COUNTRY.............................
3) PERSONAL CELL PHONE, FAX AND MOBILE PHONE NUMBER......................
4) AGE AND SEX..............................
5.) Your Occupations......................................
6) Proof of your identity (International passport or Drivers License)....................

Yours Sincerely,
Mr.John Brown.

INSTRUCTIONS TO CREDIT YOUR BANK ACCOUNT WITH US$12, 500,000.00

From the Desk of Mrs. Sarah Mills
Natwest Bank
St. Paul's
Juxon House
GB - 98 St. Paul's Churchyard EC4M 8BU
London, United Kingdom

Dearest Customer,

INSTRUCTIONS TO CREDIT YOUR BANK ACCOUNT WITH US$12, 500,000.00

The management of the Natwest Bank United Kingdom writes to inform you of your long over due payment that has been lying wait in the treasury department of the Natwest Bank for payment. With regards to the approval of your Approval of this payment as confirmed by the Legal Department of the Natwest Bank United Kingdom; you are hereby directed to contact Mr. Paul Lewis for immediate payment as your payment officer with the contact information below:

Contact Person: Lewis Paul
Email: bnatwest69@yahoo.com.hk
Tel + 44 7928665063

Be further informed that the management of Natwest Bank has authorized Mr. Paul Lewis to wire your funds without any delay as soon as you provide him with the following information:

Full name:
Current occupation:
Home address:
Country:
Mobile phone:
Bank Details:

You are therefore authorized to reconfirm to the telex department of the Natwest Bank United Kingdom your complete Personal Information? and Account Information? to enable us carry out your transfer accordingly. Contact our office as soon as possible on email or contact Paul Lewis for more details on your transfer. Thank you, for your understand and patience.

Mrs. Sarah Mills
Chief executive officer,