API tools faq
paste
malwageddon

VISA phishing email campaign

malwageddon
Jul 17th, 2013
339
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.26 KB | None | 0 0
raw download clone embed print report
  1. NOTE: Information is based on a sample of VISA phishing email seen on 2013-07-17
  2.  
  3. -------------------------------------------------------------------
  4. Received: from 78.186.147.70 (account [email protected] HELO hyfewnkzrtwsmyn.figwqwlrrgyggm.ru)
  5. by 78.186.147.70.static.ttnet.com.tr (CommuniGate Pro SMTP 5.2.3)
  6. From: "Visa" <[email protected]>
  7. Subject: VISA - Suspicious Recent Transactions
  8. Attachment: Content-Type: application/zip; name="Report.xxxxxx.xxxxxx.zip" (xxxxx - first and second names/words as per receiver's email address)
  9.  
  10. Body:
  11. Dear Visa card holder,
  12.  
  13. A recent review of your transaction history determined that your card was used in possible fraudulent transactions. For security reasons the requested transactions were refused. Please carefully review electronic report for your VISA card.
  14.  
  15. For more details please see the attached transaction report.
  16.  
  17. Marie_Long
  18. Data Protection Officer
  19. VISA EUROPE LIMITED
  20. 1 Sheldon Square
  21. London W2 6WH
  22. United Kingdom
  23.  
  24.  
  25. CONFIDENTIALITY NOTICE:
  26. This electronic mail transmission and any attached files contain information intended for the exclusive use of the individual or entity to whom it is addressed and may contain information belonging to the sender (Visa Europe Limited.) that is proprietary, privileged, confidential and/or protected from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distributions of this electronic message are violations of federal law. Please notify the sender, by email or telephone (+44 (0)20 7795 3059), of any unintended recipients and delete the original message without making any copies. Thank You
  27. -------------------------------------------------------------------
  28.  
  29. MD5s
  30. ZIP: c39a87bd68bbd5dbef4b92529e00a687
  31. EXE: 228b4252e186bf8b5645b5dd896a260a - VT(6/46) https://www.virustotal.com/en/file/77a5c7efb4fa1a1ad40907ac7072eeff17d9887c2e5a2f98c376f5023afb0cef/analysis/
  32.  
  33. GETs:
  34. adaptum.gr/8h5gjBh.exe
  35. preview.vibration-trainers.com/V2YE.exe
  36. www.costruzionimediterraneo.it/FP0gd6.exe
  37. www.wineoutleteventspace.com/7UNFVh.exe
  38.  
  39. POSTs:
  40. dreamonseniorswish.org/ponyb/gate.php
  41. nursenextdoor.com/ponyb/gate.php
  42. phonebillssuck.com/ponyb/gate.php
  43. prospexleads.com/ponyb/gate.php
  44.  
  45. additional sending hosts:
  46. Received: from 74.194.2.50(helo=umhlge.deeytewbemscea.net)
  47. by r74-194-2-50.jsbrcmta01.jnboar.lr.dh.suddenlink.net with esmtpa (Exim 4.69)
  48. Received: from 125.93.255.198 (account [email protected] HELO avvzmtdtkn.cejfp.org)
  49. by (CommuniGate Pro SMTP 5.2.3)
  50. Received: from 117.85.23.166 (account [email protected] HELO ajmul.wqudvgopb.org)
  51. by 166.23.85.117.broad.wx.js.dynamic.163data.com.cn (CommuniGate Pro SMTP 5.2.3)
  52. Received: from 58.247.112.14(helo=pkittsaifbubz.kjvgys.tv)
  53. by with esmtpa (Exim 4.69)
  54. Received: from 75.77.194.67(helo=vimvdtceiawjcc.syixxjw.info)
  55. by mail.therussofirm.com with esmtpa (Exim 4.69)
  56. Received: from 87.115.85.96 (account [email protected] HELO acfcrwfnudjsv.zbqgbswjmzq.ru)
  57. by device.lan (CommuniGate Pro SMTP 5.2.3)
  58. Received: from 202.130.175.2 (account [email protected] HELO fcctfphpfqnpwad.uindsnhe.info)
  59. by (CommuniGate Pro SMTP 5.2.3)
  60. Received: from 61.152.173.94(helo=hgqutytwmsqlsb.msrxvjju.tv)
  61. by with esmtpa (Exim 4.69)
  62. Received: from 67.78.250.250(helo=uhvhjitrkpvmphc.jswaivtwvloa.tv)
  63. by rrcs-67-78-250-250.se.biz.rr.com with esmtpa (Exim 4.69)
  64. Received: from 98.189.121.21 (account [email protected] HELO zuhewvkru.iuaghilhvy.ru)
  65. by wsip-98-189-121-21.oc.oc.cox.net (CommuniGate Pro SMTP 5.2.3)
  66. Received: from 5.245.68.149 (account [email protected] HELO aqsgsbumymvp.nshzxytkv.net)
  67. by (CommuniGate Pro SMTP 5.2.3)
  68. Received: from 113.102.155.139(helo=hhvbhe.rbbvde.su)
  69. by with esmtpa (Exim 4.69)
  70. Received: from 41.247.225.9 (account [email protected] HELO hprvjvvq.rlmpbzkafw.tv)
  71. by 247-225-09.telkomadsl.co.za (CommuniGate Pro SMTP 5.2.3)
  72. Received: from 70.91.226.229 (account [email protected] HELO bmyyimvkvwdam.mivumdchzjlc.ru)
  73. by 70-91-226-229-BusName-Michigan.hfc.comcastbusiness.net (CommuniGate Pro SMTP 5.2.3)
  74.  
  75. IPs from the list above:
  76.  
  77. 113.102.155.139
  78. 117.85.23.166
  79. 125.93.255.198
  80. 202.130.175.2
  81. 41.247.225.9
  82. 5.245.68.149
  83. 58.247.112.14
  84. 61.152.173.94
  85. 67.78.250.250
  86. 70.91.226.229
  87. 74.194.2.50
  88. 75.77.194.67
  89. 87.115.85.96
  90. 98.189.121.21
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!