Tuesday, November 22, 2016

Your LogMein.com subscription has expired! (Virus)

Dear client,

You are receiving this message because your subscription for LogMeIn Central has expired.
We were not able to charge you with the due amount because your credit card was declined.

You can download the bill directly from the LogMeIn website:
https://accounts.logme.in/billing.aspx?clusterid=0724&view_bill_id=3716 4647&file_type=doc

Please use another credit card or payment method in order to avoid complete service interruption.

Event type: Credit Card Declined
Account email: *.*
At: 21/11/2016

If you need more help, visit LogMeIn Support at:
http://solutions.logmein. com/SalesContactUs

Important Security Notice:
LogMeIn will never for your password or other sensitive information by email.

(Please don't reply to this email, as it's sent from an address that's not monitored.)

© LogMeIn Inc

Virus analysis :

CLICK : https://accounts.logme.in/billing.aspx?clusterid=0724&view_bill_id=3716 4647&file_type=doc
OPEN : https://reg.vn/en/view_bill.php?id=d2VibWFzdGVyQHJiY2FmZS5jb20=
DOWNLOAD : lgm_bill89831.doc
lgm_bill89831.doc : VIRUS


lgm_bill89831.doc analysis :

SHA256 : fc1f1845e47d4494a02407c524eb0e94b6484045adb783e90406367ae20a83ac
FILE : lgm_bill89831.doc
ALYac : Trojan.Downloader.W97M.Gen
Ad-Aware : W97M.Downloader.ESE
AegisLab : Troj.Downloader.Msword.Agent!c
Arcabit : W97M.Downloader.ESE
BitDefender : W97M.Downloader.ESE
Cyren : W97M/Nastjencro
ESET-NOD32 : VBA/Kryptik.T
Emsisoft : W97M.Downloader.ESE (B)
F-Prot : New or modified W97M/Nastjencro
F-Secure : Trojan:W97M/Nastjencro.A
GData : W97M.Downloader.ESE
Ikarus : Trojan-Downloader.VBA.Agent 20161121
Kaspersky : Trojan-Downloader.MSWord.Agent.auz
McAfee : W97M/Dropper.cu
McAfee-GW-Edition : W97M/Dropper.cu
eScan : W97M.Downloader.ESE
Microsoft : TrojanDownloader:O97M/Donoff!map
Sophos : Troj/DocDl-FQK
Symantec : W97M.Downloader
Tencent : Win32.Trojan.Inject.Auto
TrendMicro : W2KM_HANCITOR.AUSTT
TrendMicro-HouseCall : W2KM_HANCITOR.AUSTT

Email analysis :

NOTE : billing@secure-lgm.com
NOTE : Received : from wsip-70-165-74-172.hr.hr.cox.net
NOTE : (HELO secure-lgm.com) (70.165.74.172)

Wednesday, December 2, 2015

RE: order cancellation (Virus)

My order was supposed to be delivered last week and it’s still not here.

Please refund my full amount as stated on the attached invoice I received
from [$DOMAIN].

Thanks,

Albert Trujillo

Manager of operations
2312 Montgomery St

invoice_323489.doc

File analysis :

NOTE : open invoice_323489.doc
NOTE : invoice_323489.doc is a virus.

Virus analysis :

ALYac : Trojan.Agent.BOQY
AVware : Trojan.Win32.Generic.pak!cobra
AhnLab-V3 : W97M/Agent
Arcabit : HEUR(high).VBA.Trojan
Avast : Win32:Trojan-gen
Avira : TR/Crypt.ZPACK.219008
BitDefender : Trojan.Agent.BOQY
Cyren : PWS.UKZL-52
DrWeb : Trojan.PWS.Stealer.4118
ESET-NOD32 : Win32/PSW.Fareit.A
Emsisoft : Trojan.Agent.BOQY (B)
F-Secure : Trojan.Agent.BOQY
Fortinet : WM/Agent!tr
GData : Trojan.Agent.BOQY
Ikarus : Trojan.Win32.PSW
Kaspersky : Trojan.VBS.Agent.xw
McAfee : W97M/Dropper.ah
McAfee-GW-Edition : Artemis!5E49FAB20EC4
Microsoft : TrojanDropper:O97M/Farheyt
NANO-Antivirus : Trojan.Win32.Stealer.dyyyhx
Sophos : Troj/Agent-APMP
Symantec : Trojan.Mdropper
Tencen : Win32.Trojan.Crypt.Dxnf
TrendMicro : W2KM_DRIDEX.YYSPF
TrendMicro-HouseCall : W2KM_DRIDEX.YYSPF
VIPRE : Trojan.Win32.Generic.pak!cobra
nProtect : Trojan.Agent.BOQY

Email analysis :

NOTE : accounting@michaelsav.com
NOTE : User-Agent : Mozilla/5.0 (Windows; U; Windows NT 6.1; sv-SE; rv:1.9.2.8) Gecko/20100802 Thunderbird/3.1.2
NOTE : X-REMOTE : 4.28.11.153 ()