Friday, 23 January 2015

IRS Notification - Fiscal Activity malware

IRS Notification - Fiscal Activity malware being spammed out.

Message Header:

From: "IRS" 
Subject: Re: IRS Notification - Fiscal Activity
Message Body:
Hello, yourname@yourdomain.co.uk
         
We notify you that last year, according to the estimates of tax taxation,
we had a shortage of means.
We ask you to install the special program with new digital certificates,
what to eliminate an error.

To install the program go to the link above:
http://irsuk.co/DownloadIRSService/SetupIRS2015.zip
Download link:

http://irsuk.co/DownloadIRSService/SetupIRS2015.zip
Inside the Zip file is a windows executable
SetupIRS2015.exe


Md5 Hashes:
15a92cdd276474c65fd7fcf07d099d59 [1]

Malware information:

VirusTotal Report [1] (hits 4/55 Virus Scanners)


Hybrid Analysis Report  [1]

Malwr Report [1]

Cheers,
Steve

No comments: