2017-09-04 GlobeImposter "True Telecom Invoice"

2017-09-04 #globeimposter email phishing campaign "True Telecom Invoice"

Email sample:
-----------------------------------------------------------------------------------------------------------------------
From: billing@true-telecom.com
To: [REDACTED]
Subject: 59922362 - True Telecom Invoice for August 2017
Date: Mon, 04 Sep 2017 17:46:39 +0430

Dear Deborah Day

We have attached your latest True Telecom bill for August 2017.
View your bill online

To be able to read your invoice file you will require the Adobe Acrobat PDF viewer. You August already have this installed,
if not please visit the Adobe website and download their free viewer.

Payments made by direct debit will be collected 14 days from the date of the Bill.

If you wish to contact us, please do not hesitate to get in touch with one of our friendly customer services agents.

Telephone: 0800 840 40 60
Fax: 0844 779 2253
Email: customerservice@true-telecom.com

Please be advised that this is an unmonitored email address.

With Kind Regards,

The True Telecom Team
www.True-Telecom.com


True Telecom Ltd is registered in England and Wales No. 08225783.
Head Office address: Ground Floor,Lakeview West, Galleon Boulevard, Crossways Business Park, Dartford, Kent, DA2 6QE

This communication together with any attachments transmitted with it ("this E-Mail") is intended only for the use of the addressee and August contain information which is privileged and confidential. If the reader of this E-Mail is not the intended recipient or the employee or agent responsible for delivering it to the intended recipient you are hereby notified that any use, dissemination, forwarding, printing or copying of this E-Mail is strictly prohibited. Addressees should check this E-mail for viruses. The Company makes no representations as regards the absence of viruses in this E-Mail. If you have received this E-Mail in error please immediately delete, erase or otherwise destroy this E-Mail and any copies of it. Any opinions expressed in this E-Mail are those of the author and do not necessarily constitute the views of the Company. Nothing in this E-Mail shall bind the Company in any contract or obligation. The Company only guarantees service in accordance with the service charter. The company accepts no liability for failure of hardware after the termination point. For the purposes of this E-Mail "the Company" is the trading name of True Telecom Ltd. True Telecom Ltd (Registered in England & Wales No. 08225783)

Attachment: 2017-08-51237335-Bill.7z ->
-----------------------------------------------------------------------------------------------------------------------
- sender is billing@true-telecom.com
- subject is <8 digits> - True Telecom Invoice for August 2017
- body is in HTML format and contains link to file with downloader which is same as the one in attachment
- attached file "2017-08-<8 digits>-Bill.7z" contains file "2017-08-<8 digits>-Bill.vbs", a VBScript downloader which will download from:

Downloader download sites:
http://aac-autoecole.com/2017-08-42007004-Bill.7z
http://activ-conduite.eu/2017-08-42007004-Bill.7z
http://autoecolecarnot.com/2017-08-42007004-Bill.7z
http://montessibooks.com/2017-08-42007004-Bill.7z
http://pack-lines.com/2017-08-42007004-Bill.7z
http://red-dead.fr/2017-08-42007004-Bill.7z
http://rogames.ro/2017-08-42007004-Bill.7z
http://studiotoscanosrl.it/2017-08-42007004-Bill.7z
http://toubelis.gr/2017-08-42007004-Bill.7z
http://ventadepajaros.es/2017-08-42007004-Bill.7z
http://villasbarcelona.org/2017-08-42007004-Bill.7z
http://weekendjevliegen.nl/2017-08-42007004-Bill.7z

Malware download sites:
http://aquavista.org.nz/JIKJHgft
http://awholeblueworld.com/JIKJHgft
http://cabbiemail.com/JIKJHgft
http://geolearner.com/JIKJHgft
http://handhi.com/JIKJHgft
http://hexacam.com/JIKJHgft
http://jimaylor.net/JIKJHgft
http://m-tensou.net/JIKJHgft
http://n1xua.com/JIKJHgft
http://naturofind.org/p66/JIKJHgft
http://proyectogambia.com/JIKJHgft
http://world-tour2000.com/JIKJHgft

Malware:
- encoded on download, SHA256: 4b1097886cde91d2c4d66fdb53e446d94e34d692fbbd2b5475a065c5c30a901e, MD5: 3134ff6529ef055b232452e3f29bdece
- decode by XORing with "XdSk4gxRmVKXKBlRXHLa29VxIpIIegBH"
- decoded SHA256: bb1df4a93fc27c54c78f84323e0ea7bb2b54469893150e3ea991826c81b56f47, MD5: 6b456cff688be4715e6456cf12c64939
- VT: https://www.virustotal.com/en/file/bb1df4a93fc27c54c78f84323e0ea7bb2b54469893150e3ea991826c81b56f47/analysis/1504531635/
- HA: https://www.reverse.it/sample/bb1df4a93fc27c54c78f84323e0ea7bb2b54469893150e3ea991826c81b56f47?environmentId=100