Tag: CyberSecurity

Beware of the “India Post 170th Anniversary” WhatsApp Scam

Anurag2 Comments

Recently, a new phishing scam has been circulating on WhatsApp, claiming to celebrate the “India Post 170th Anniversary.” The message includes a shortened URL, such as https://tinyurl.com/lndiaPost-1164

which redirects unsuspecting users to a fraudulent website: https://indiapost37.pages.dev/22602976.

This website impersonates India Post, one of India’s largest postal networks, in an attempt to steal users’ personal information. Here’s a breakdown of how the scam works and how to stay protected:

How the Scam Works

  1. The Message: It starts with a WhatsApp message claiming that India Post is celebrating its 170th anniversary with special prizes. This message contains a shortened link that appears legitimate at first glance, using the name “India Post” to gain trust.
  2. The Phishing Website: Once the link is opened, it redirects to a webpage mimicking the official India Post website, complete with logos and branding. However, this page is hosted on a suspicious domain (pages.dev), which is a clear red flag that it is not an official India Post site.
  3. Fake Questionnaire: The page presents users with simple questions such as:
    • What is your age?
    • What is your gender?
    • Do you know about India Post?

The goal here is to keep the user engaged while also making the scam seem more legitimate.

4. “Prize” Announcement: After answering the questions, users are prompted with a pop-up claiming they have won a large amount of money—typically in the range of INR 62,478.55. This is an attempt to excite users and push them to the next step, which involves sharing more sensitive information.

5. Request for Personal Information: To claim the so-called prize, users are then asked to provide personal details such as their email address and mobile number. This is the final stage where the scammers collect information that could be used for future phishing attacks, identity theft, or selling the data to other cybercriminals.

Key Red Flags to Recognize the Scam

  • Unfamiliar Domain Name: The genuine India Post website domain is indiapost.gov.in. Any other domain should be considered suspicious.
  • Requests for Personal Information: Government institutions rarely ask for personal details through unsolicited messages or unverified websites.
  • Too Good to Be True Prizes: Randomly winning large sums of money without prior participation is a classic sign of a scam.

To further investigate the legitimacy of these URLs, we can utilize VirusTotal, an online tool for checking websites and files for potential threats. Upon submitting both URLs

https://tinyurl.com/lndiaPost-1164 and https://indiapost37.pages.dev/2260297 VirusTotal scans them against multiple security databases and provides a report with detailed insights. In this case, the report reveals that both URLs have been flagged by several security vendors as malicious or phishing sites. Screenshots from VirusTotal show clear warnings of suspicious behavior, confirming that these URLs are designed to deceive users into revealing personal information. This evidence underscores the importance of checking untrusted links on reputable scanning platforms before clicking them.

How to Stay Safe

  1. Avoid Clicking Suspicious Links: Never click on links sent from unknown numbers, especially those that seem promotional or too good to be true.
  2. Verify with Official Sources: Go directly to the official India Post website (indiapost.gov.in) or contact them directly to confirm any offers.
  3. Report Phishing Attempts: If you receive such a message, report it on WhatsApp and avoid forwarding it to others.
  4. Educate Others: Share this information with friends and family to prevent them from falling victim to similar scams.

Conclusion

Phishing scams like these take advantage of people’s trust and curiosity. By staying alert and following best practices online, you can avoid falling prey to such fraudulent schemes. Always verify links and offers directly with official organizations and be cautious of any request for personal information from unverified sources.

Stay safe and share awareness—your vigilance is your best defense!

Reference:

Any.run Report on the analysis

Instagram Phishing Email: We detected a new login into your Instagram account

Anurag2 Comments

How to Spot the Phishing Email Right Away

The first red flag in this scam is that the email doesn’t come from an official Instagram domain. Instead, the message is sent via an unfamiliar email address that is clearly not affiliated with Instagram. A legitimate email from Instagram will come from an official domain like @mail.instagram.com or similar. If you notice the sender’s email address is strange or not even remotely related to Instagram, it’s a phishing attempt.

Email Body: Suspicious Links and No Mention of Account Details

This phishing email didn’t mention Instagram username, the location of the alleged login, or any details expected from a real alert.

Moreover, the email typically contains links urging you to “Send Password Request” and “Not My Request“. Instead of leading to Instagram’s official site, the link is a mailto: link with several email addresses, which is highly suspicious. No legitimate company, let alone Instagram, would handle account security issues this way.

Upon reviewing the email header, I noticed that it was sent from 144 . 76 . 133 . 106 (Germany).

And all the email addresses were listed in the mailto: field.

Key Red Flags of the Phishing Email

  • Unfamiliar Email Address: Always check the sender’s email address. Phishing emails usually come from random addresses that don’t resemble official Instagram domains.
  • No Mention of Your Account: The email fails to specify which Instagram account is affected. A legitimate alert would always include details such as your account username, device, or location of the suspicious activity.
  • Suspicious Links: The email includes odd links (often mailto: links with multiple email addresses) instead of leading to Instagram’s official help page or security center.
  • Generic Greeting: Phishing emails often use non-personal greetings like “Dear User” or “Hello Instagram User” instead of addressing you by your actual name or username.
  • Pressure Tactics: The email urges immediate action to “secure your account,” but provides no credible way to verify the login attempt through legitimate channels.

Conclusion

The “We detected a new login into your Instagram account” phishing email is an obvious scam, particularly when you notice that it doesn’t mention which account was compromised. The lack of details, unfamiliar sender, and suspicious links make it easy to identify as a phishing attempt. Stay vigilant, verify any unusual emails, and always prioritize your online security.

Have you ever encountered an email like this? Share your experience and help others stay safe online!

Beware of Phishing Emails: “Hey, You Have a Problem” Scam

Anurag2 Comments

Phishing scams are becoming increasingly sophisticated, and one of the more recent and alarming tactics involves an email with the subject line “Hey, You Have a Problem.” The body of the email is brief but ominous:

Subject: Hey, you have Problem
Body: Hi! You have a problem.
Details here
You have very little time.
Don’t you dare share this info with any of your friends.

The email contains a link to a website that supposedly contains more information about the so-called “problem.” However, this link is a trap designed to exploit your fear and curiosity.

How the Scam Works

  1. The Hook: The email’s vague and alarming message is designed to create a sense of urgency. The phrase “You have very little time” triggers panic, pushing you to click on the link without thinking.
  2. The Deception: Once you click the link, you’re taken to a website that claims you’ve been hacked. The site may impersonate a hacker, threatening that they have gained control of your device, taken screenshots of you through your camera, or recorded your browsing activity.
  3. The Demand: To avoid these fabricated consequences, the “hacker” demands a ransom payment in Bitcoin, a popular cryptocurrency known for its anonymity. The site might also include a countdown timer, adding further pressure to comply quickly.

Email header

The email sent by id rafaelgarciays@buhuchetnko.ru client IP: 92.53.96.143

Redirection link

The link given in email redirects to domain https :// 59exp . ru and the VirusTotal score for this URL is 1/96

What Happens When You Click the Link?

If you click on the link provided in the email, here’s what typically happens next:

  1. Personalized Attack: The link contains a parameter specific to the victim’s email address, allowing the scammer to track which email recipient clicked on the link. This personalization adds a layer of authenticity to the scam, making it more convincing.
  2. Fake Ransom Demands: Once on the phishing site, you’ll be presented with a message from an alleged hacker claiming that they have compromised your device. The message might say that they have deployed a script on a website you visited, which allegedly allowed them to take screenshots of you using your camera.
  3. Bitcoin Ransom: The scammer then demands a ransom, usually in Bitcoin, to prevent the release of these “screenshots” or other fabricated evidence of wrongdoing. The demand is typically accompanied by threats and a tight deadline to create a sense of urgency.

Opening Phishing Site

The phishing site links a security incident to the victim’s email ID and the Bitcoin address 1CWTFeMfPCG1Q6uVLSpHUmQ1J1i6hxj1LK, where the scammer demands a transfer of USD $699.

After reviewing the blockchain transactions associated with the Bitcoin address 1CWTFeMfPCG1Q6uVLSpHUmQ1J1i6hxj1LK, no transaction for the amount of USD $699 has been found to date.

How to Protect Yourself

  1. Don’t Click on Suspicious Links: If you receive an unexpected email with a link, especially one that makes alarming claims, don’t click on it. Instead, verify the sender’s identity through other means.
  2. Check the URL: Before clicking any link, hover over it to see the actual URL. If it looks suspicious or unfamiliar, don’t click it.
  3. Be Skeptical of Urgent Requests: Scammers often create a false sense of urgency to pressure you into acting quickly. Take a moment to think before responding to any urgent requests, especially those involving money.
  4. Use Strong, Updated Security Measures: Ensure your devices are protected with up-to-date antivirus software, and consider using a password manager to help secure your accounts.
  5. Report Phishing Attempts: If you receive a phishing email, report it to your email provider and any relevant authorities. This helps protect others from falling victim to the same scam.
  6. Educate Yourself and Others: Stay informed about the latest phishing tactics and share this information with friends, family, and colleagues to help them avoid similar scams.

Conclusion

Phishing scams like the “Hey, You Have a Problem” email are designed to exploit your fears and pressure you into making hasty decisions. By staying informed and following best practices for online security, you can protect yourself from these malicious schemes. Remember, when in doubt, it’s always better to be cautious and verify before taking action.

Trojan Agent Tesla – Malware Analysis

Anurag4 Comments

Hash – 077f75ef7fdb1663e70c33e20d8d7c4383fa13fd95517fab8023fce526bf3a25

Family : Agent Tesla

Downloaded Sample Link: Click here

Signature: Microsoft Visual C# v7.0/ Basic.NET

Filename: UIhLdVHHlUAKoEOpjVAsXFlIQrgS.exe

Blg9_30032020_81

VirusTotal score:

Blg9_30032020_82

Malware behavior:

  • Steal browser information (URL, Usernames, Passwords)
  • Steal passwords for email clients.
  • Steal FTP Clients
  • Steal download manager passwords.
  • Collect OS and hardware information.

Browser Information:

When I debug the malware executable, Initially it creates a SQLite database to store collected information from victims machine.

Below are the tables getting created.

Blg9_30032020_26
Blg9_30032020_83
Blg9_30032020_28

Tables created:

  • meta
  • logins
  • sqlite_sequence
  • stats
  • compromised_credentials

found it collected browsers data (Google chrome), that includes accessed URLs and related usernames and passwords.

Blg9_30032020_29

database table logins stores all browser related information. Below are the table columns.

Blg9_30032020_30
Blg9_30032020_47

Apart from this, malware also look for all different types of browsers to steal data from it.

It look for below browsers:

  • Opera Browser
  • Yandex Browser
  • 360 Browser
  • Iridium Browser
  • Comodo Dragon
  • Cool Novo
  • Chromium
  • Torch Browser
  • 7Star
  • Amigo
  • Brave
  • CentBrowser
  • Chedot
  • Coccoc
  • Elements Browser
  • Epic Privacy
  • Kometa
  • Orbitum
  • Sputnik
  • Uran
  • Vivaldi
  • Citrio
  • Liebao Browser
  • Sleipnir 6
  • QIP Surf
  • Coowon
Blg9_30032020_11

Below screenshot taken while debugging malware.

Blg9_30032020_50

Malware also look for below email clients. I haven’t install any of them on my machine during analyzing this.

Email Clients:

  • Outlook
  • Thunderbird
  • Foxmail
  • Opera Mail
  • Pocomail
  • Claws-mail
  • Postbox
Blg9_30032020_12
Blg9_30032020_84

FTP Clients:

Malware grabs credentials from FTP clients as well. Below list.

  • FileZilla
  • Core FTP
  • SmartFTP
  • FTPGetter
  • FlashFXP
Blg9_30032020_76
Blg9_30032020_75

It also makes FTP web request. (Remote Server couldn’t find)

Blg9_30032020_90
Blg9_30032020_91

It uses smtp client to send information over the network using port 587 which indicates sending data from smtp client to a particular smtp Server through mail attachments.

Blg9_30032020_85
Blg9_30032020_86

Malware executable also make HTTPWebRequest which must be downloading SMTP client to transfer data to remote SMTP server.

Blg9_30032020_89

unfortunately, it didn’t make any connection to any remote server address.

Summary:

  • Steal Browser Information including urls, usernames and passwords.
  • Steal email client credentials.
  • Steal credentials of FTP servers.
  • Computer information.

Thank you.