Interesting new spam..

Rather than the usual “You have voicemail” email with a zipped attachment I came across a few of these today with similar content all claiming to be WhatsApp voicemail. This time they don’t have an attachment but link to (I presume) a hacked website containing a php file that serves a zip file containing a .exe virus.

Return-Path: usov_@mail.ru
Received: from hosting-isp.tomline.ru ([83.172.0.35])
by media.REDACTED.com
; Wed, 13 Nov 2013 17:37:24 +0000
Received: by hosting-isp.tomline.ru (Postfix, from userid 3184)
id 47069B92B43; Fri, 8 Nov 2013 19:38:08 +0700 (NOVT)
To: redacted@address.com
Subject: 6 New Voicemail(s)
X-PHP-Script: pick-life.ru/ for 127.0.0.1, 127.0.0.1
From: "WhatsApp Messaging Service" <service@pick-life.ru>
X-Mailer: CSMTPConnectionv1.3
Reply-To: "WhatsApp Messaging Service" <service@pick-life.ru>
Mime-Version: 1.0
Content-Type: multipart/alternative;boundary="----------1383914288527CDB3075AF3"
Message-Id: <20131113174629.47069B92B43@hosting-isp.tomline.ru>
Date: Fri, 8 Nov 2013 19:38:08 +0700 (NOVT)

------------1383914288527CDB3075AF3
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

WhatsAppYou have a new voicemail!DetailsTime of Call: Nov-05 2013 13:55:57Lenth of Call: 53 secondsPlay*If you cannot play, move message to the "Inbox" folder.2013 WhatsApp Inc

------------1383914288527CDB3075AF3
Content-Type: text/html; charset="ISO-8859-1";
Content-Transfer-Encoding: 7bit

--- thecomputerperson MOVED TO PASTEBIN http://pastebin.com/SUwbgUCj ---

------------1383914288527CDB3075AF3--

I’ve removed the link in the above email but it did link to:
DONOTCLICK://responseit-host3.com/msg.php?message=c5B3SJqebSuJ8Y3xZcjoevDc6oy5dz0j4ypWwBpw9Tc=

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s