국내 악성코드 정보2016. 3. 24. 12:25

지인이 랜섬웨어 메일 관련해서 샘플을 보내줘서 정리해보았다. 참고로 지인 아이디가 나오는 부분은 필터링하였음.



1. Your account ID:07485 has been suspended. - TeslaCrypt




Your bank account associated with the ID:07485 has been suspended because of the unusual activity connected to this 
account and a failure of the account holder to pay the taxes on a due date.

Your debt: - 435,43 USD
 

For more details and the information on how to unlock your account please refer to the document attached.



2. Your account ID:41858 has been suspended. - 1번과 동일한 C&C




Your bank account associated with the ID:41858 has been suspended because of the unusual activity 
connected to this account and a failure of the account holder to pay the taxes on a due date.

Your debt: - 279,44 USD
 

For more details and the information on how to unlock your account please refer to the document attached.



3. You are being accused with bodily injury (Case: 58460804) - TeslaCrypt



Hello,

You are being charged with articles 309 to 312 of the Criminal Code. 
The amounts indicated for committing a crime in this section is ranging from $5,000 to $12,000.

The plaintiff also claims a moral damage compensation amounting to $11063
 

Please, find more information on the case (ID: 58460804) in report enclosed.



4. Attached Image - Stupid Locky ㅡ_ㅡ;;






5. Voicemail from 07730881627 <07730881627> 00:00:24 - STUPID LOCKY




6. Unpaid electricity bill - Customer Reference 00684044 - 1,2 C&C 동일.



Dear Client,


You have an outstanding debt of - 787,53 $ for period of 02/01 - 03/01. 
We kindly ask you to transfer the amount as soon as possible in order to avoid power cut.

Find you bill and payment information in the document attached.



7. Unpaid electricity bill - Customer Reference 33047327 - 6번과 동일




8. Unpaid electricity bill - Customer Reference 21965873 - 7번과 동일





9. Image65859643302722.pdf - Locky Ransomware




10. Unpaid electricity bill - Customer Reference 26898986




11. Image937345965113.pdf - stupid locky




12. FW: Receipt #760058 - C&C 연결 X



Dear **,

Please find attached receipt of payment made to us today.

Regards,
Clara Mercado

VP Analytic Services


13. FW: Receipt #760058 - 연결 X




Dear **,

If there is any reason why payment should not be made or if you are experiencing difficulties
with making the payment please get in touch so that we can discuss the matter and stop the recovery process.

Full details are attached to this email.

Regards,
Isidro Gonzales

Operations Director (CEO Designate)



14. FW: Payment Details - [985089]




Posted by Ec0nomist

댓글을 달아 주세요

  1. 스팸메일에 첨부된 파일 열면 결제되는건가요?

    2016.03.27 15:30 신고 [ ADDR : EDIT/ DEL : REPLY ]
  2. dan

    관리자의 승인을 기다리고 있는 댓글입니다

    2016.03.28 16:44 [ ADDR : EDIT/ DEL : REPLY ]
  3. 비밀댓글입니다

    2016.04.23 10:17 [ ADDR : EDIT/ DEL : REPLY ]