2017-10-11 - WHATSAPP-THEMED BRAZIL MALSPAM PUSHES BANLOAD MALWARE

ASSOCIATED FILES:

  • 2017-10-11-WhatsApp-malspam-1st-run.pcap  (3,528,066 bytes)
  • 2017-10-11-WhatsApp-malspam-2nd-run.pcap   (3,647,909 bytes)
  • 01.zip  (1,586,625 bytes)
  • 2017-10-11-WhatsApp-malspam-0501-UTC.eml   (5,364 bytes)
  • 2017-10-11-WhatsApp-malspam-1216-UTC.eml   (17,682 bytes)
  • WhatsAppImage2017-10-11at17.59.08.exe   (1,816,064 bytes)

NOTES:

 

EMAIL

EMAIL INFORMATION:


Shown above:  Screenshot from the 1st email.

 


Shown above:  Screenshot from the 2nd email.

 

1ST EMAIL:

2ND EMAIL:

 


Shown above:  Clicking on an email link returns an EXE file (file extension showed as .php when I used Internet Explorer).

 


Shown above:  Downloaded EXE (same file downloaded from both emails).

 

TRAFFIC


Shown above:  Infection traffic filtered in Wireshark (1st run from link in 1st email).

 


Shown above:  Infection traffic filtered in Wireshark (2nd run from link in 2nd email).

 

1ST RUN:

2ND RUN:

 

MALWARE

EXE DOWNLOADED CLICKING A LINK FROM THE EMAILS:

FOLLOW-UP MALWARE (ZIP ARCHIVE) DOWNLOADED BY THE ABOVE FILE:

MALWARE RETRIEVED FROM INFECTED WINDOWS HOST (1 OF 2):

MALWARE RETRIEVED FROM INFECTED WINDOWS HOST (2 OF 2):

 

WINDOWS REGISTRY UPDATE:


Shown above:  Malware persistent on the infected Windows host.

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.