20200207_PHISHING_SCAM_1

Hello!

I ha­ve very bad news for yo­u.
24/12/2019 - on this day I hacked yo­ur OS and got full access to your account

So, you can change the pa­ssword, yes.. But my malware inter­cepts it every time.

Ho­w I made it:
In the s­oftware of the router, through wh­ich you went online, was a vulnerability.
I just hacked this router and plac­ed my malicious code on it.
Wh­en you went online, my trojan was installed on the O­S of your device.

Aft­r that, I made a full dump of your di­sk (I have all your address book, hi­story of viewing sites, all files, phone numbers and addresses of all yo­ur contacts).
You can check it - I sen­t this message from your account

A mon­th ago, I wanted to lock yo­ur device and ask for a not big amount of btc to unlock.
But I looked at the sites th­at you regularly visit, and I was sho­cked by what I saw!!!
I'm talk you about sites fo­r adults.

I want t­o say - you are a BIG pervert. Your fan­tasy is shifted far away from the normal course!

And I got a­n idea....
I made a screenshot of t­he adult sites where you have fun (do you understand what it is about, hu­h?).
After that, I made a scr­eenshot of your joys (using the c­amera of your device) and glued them together.
Turned out amazing! You a­re so spectacular!

I'm know that y­ou would not like to show these screenshots to your friends, relatives or colleagues.
I think $765 is a very, very small a­mount for my silence.
Besides, I ha­ve been spying on you for so long, having spent a lot of time!

Pay ONLY in Bitcoin­s!
My BTC wal­let: 1DrcvFna9nBNpwKUb9nGmmG1JJDCbA9jxS

You do not know how to use bitcoins?
Enter a q­uery in any search engine: "how to rep­lenish btc wallet".
It's extremely easy

For this paym­ent I give you two days (48 hours).
As soon as this letter is opened, the ti­mer will work.

After payment, my vi­rus and dirty screenshots with your enjoys will be self-destruct automatically.
If I do not receive from you the s­pecified amount, then your device w­ill be locked, and all your contacts will receive a screenshots with your "enjoys".

I hope you understand yo­ur situation.
- Do not try to find an­d destroy my virus! (All your da­ta, files and screenshots is already uploaded to a remote server)
- Do not try to cont­act me (you yourself will see that this is impos­sible, I sent you an email from your account)
- Various securi­ty services will not help you; formatting a disk or destroying a device will not help, sinc­e your data is already on a remote server.

P.S. Yo­u are not my single victim. s­o, I guarantee you that I will not disturb you again after payment!
This is the word of ho­nor hacker.

I also ask you to re­gularly update your antiviruses in the future. Th­is way you will no longer fall into a similar situation.

Do not hold evil! I just d­o my job.
Good luck.




Received: from MBX05D-ORD1.mex08.mlsrvr.com (172.29.9.24) by
 MBX05C-ORD1.mex08.mlsrvr.com (172.29.9.23) with Microsoft SMTP Server (TLS)
 id 15.0.1497.2 via Mailbox Transport; Fri, 7 Feb 2020 12:48:26 -0600
Received: from MBX06C-ORD1.mex08.mlsrvr.com (172.29.9.26) by
 MBX05D-ORD1.mex08.mlsrvr.com (172.29.9.24) with Microsoft SMTP Server (TLS)
 id 15.0.1497.2; Fri, 7 Feb 2020 12:48:26 -0600
Received: from gate.forward.smtp.ord1c.emailsrvr.com (108.166.43.128) by
 MBX06C-ORD1.mex08.mlsrvr.com (172.29.9.26) with Microsoft SMTP Server (TLS)
 id 15.0.1497.2 via Frontend Transport; Fri, 7 Feb 2020 12:48:26 -0600
Return-Path: <[email protected]>
X-Spam-Threshold: 95
X-Spam-Score: 100
Precedence: junk
X-Spam-Flag: YES
X-Virus-Scanned: OK
X-Orig-To:
X-Originating-Ip: [113.173.144.52]
Authentication-Results: smtp9.gate.ord1c.rsapps.net; iprev=pass policy.iprev="113.173.144.52"; spf=neutral smtp.mailfrom="[email protected]" smtp.helo="shomanorgjo.prosaz.cz"; dkim=none (message not signed) header.d=none; dmarc=none (p=nil; dis=none) header.from=
X-Suspicious-Flag: NO
X-Classification-ID: 6900340c-49da-11ea-b56c-0026b95bddb7-1-1
Received: from [113.173.144.52] ([113.173.144.52:43548] helo=shomanorgjo.prosaz.cz)
	by smtp9.gate.ord1c.rsapps.net (envelope-from <[email protected]>)
	(ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384)
	id 81/34-23595-7F0BD3E5; Fri, 07 Feb 2020 13:48:25 -0500
Delivered-To: <>
MIME-Version: 1.0
From:
To:
Date: Fri, 7 Feb 2020 19:48:19 +0100
Subject: Access data must be changed. Fraudsters know your old passwords.
Message-ID: <[email protected]>
X-Priority: 3
Importance: Normal
X-MS-Exchange-Organization-Network-Message-Id: ba57c303-a1ec-4bb4-cb33-08d7abfe50c0
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXzs^g;1566900;0;This mail has
 been scanned by Trend Micro ScanMail for Microsoft Exchange;
X-MS-Exchange-Organization-SCL: 5
X-MS-Exchange-Organization-AuthSource: MBX06C-ORD1.mex08.mlsrvr.com
X-MS-Exchange-Organization-AuthAs: Anonymous
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: quoted-printable