feed on feeds - 2015/11/25 - items 0 to 15

Being told to get off plane in front of passengers was "humiliating", says Kameelah Rasheed, who alleges discrimination.

Senior UN official says 200,000 civilians are living in a state of "virtual siege" in the Yemeni city.

An anonymous reader writes with news that Cox Communications' insurer, Lloyds Of London underwriter Beazley, is refusing to cover legal costs and any liabilities from the case brought against it by BMG and Round Hill Music. TorrentFreak reports: "Trouble continues for one of the largest Internet providers in the United States, with a Lloyds underwriter now suing Cox Communications over an insurance dispute. The insurer is refusing to cover legal fees and potential piracy damages in Cox's case against BMG Rights Management and Round Hill Music. Following a ruling from a Virginia federal court that Cox is not protected by the safe-harbor provisions of the DMCA, the Internet provider must now deal with another setback. Following a ruling from a Virginia federal court that Cox is not protected by the safe-harbor provisions of the DMCA, the Internet provider must now deal with another setback."

Read more of this story at Slashdot.

The Sub Laban family may soon join tens of thousands of Palestinians evicted from occupied East Jerusalem by Israel.

There appears to be more to Turkey's action than an alleged border incursion.

Introduction

Earlier today (Wednesday2015-11-25), one of our readers notified the ISC of malicious spam (malspam) with a Word document designed to infect a Windows computer with malware. I found examplesof the malspam and looked into it. Word documents from this particular campaign will download Pony malware which will infect a Windows computer with Vawtrak. Themalspam was blocked by our spam filters, but others might seethis, so Im posting this information in a diary.

Thanks for the heads up, Travis!

The emails

The emails spoof your company name (or whatever domain youre using for your email address), and they have a Microsoft Word document as an attachment. The ones Ive found have">From: accounting@[your company].com
Reply-To: accounting@[your company].com">---
Este email est livre de vrus e malware porque a proteo avast! Antivirus est">Attachment: Bill.doc

have a notification at the bottom stating This email is free of viruses and malware protection because the Avast! Antivirus is active. These antivirusmessages were all in different languages, based on the host these emails were sent" />
Shown above: Example of the malspamwith a different language for the antivirusnotification.

We saw this malspam come from senders at the following IP addresses:

2015-11-25 15:06 UTC - 85.246.96.111 (l13-96-111.dsl.telepac.pt)
2015-11-25 15:36 UTC - 178.253.170.155 (178-253-170-155.vdial.slovanet.sk)
2015-11-25 15:59 UTC - 188.250.234.94 (bl24-234-94.dsl.telepac.pt)
2015-11-25 16:14 UTC - 88.16.67.20 (20.Red-88-16-67.dynamicIP.rima-tde.net)
2015-11-25 16:26 UTC - 82.54.254.143 " />
Shown above: An example of the email headers from this malspam.
The attachment

The attachment is a Microsoft Word document with malicious macros. The sample had already been submitted to VirusTotal (link), but it only had a 1 / 55 detection rate when I first checked. I enabled the documents macros in a controlled environment toinfect" />
Shown above: The maliciousdocumentopened in Word2007.

The infection" />
Shown above: A pcap of the infectiontraffic filtered in Wireshark by HTTP request.

ection traffic using Security Onion with the EmergingThreats Pro signature set. " />
Shown above: Some of the alerts in Sguil on Security Onion.

The following IP addresses and domain names were associated with this Pony/Vawtrak infection:
- 95.213.169.17 - reflahadi.ru
- 149.210.186.152 - cafetariaxl.nl
- 46.161.1.172 - castuning.ru
- 91.200.14.95 - hybridtrend.com
- 81.177.22.179 - 81.177.22.179
Malware and artifacts from the infected host

The Word document caused the following artifacts to appear in the infecteduser" />
Shown above: Artifacts from the infected users AppData/Local/Temp directory.
- 12.rtf - MD5 hash: 6dfd5c9274b1ecb1bad095cb8f00100e - VirusTotal link
- 13.rft - MD5 hash: f08febf78a641505c13746fd38ed09c3 - VirusTotal link
- 721723.exe(alsoHadFeqt.exe)- MD5 hash: a054dfe5575c59f6bd96fc395041eb93 - VirusTotal link
- st11.exe - MD5 hash: bd86e1a8a35b12841ee6694dcc607cd0 - VirusTotal link
Both st11.exe and 721723.exe deleted themselves shortly after appearing in thedirectory. st11.exeis the Pony downloader. 721723.exeis Vawtrack, which copied itself to another directory and updated the infected host" />
Shown above: The Vawtrak malware from this infection.

Final words

Malspamwith a Word document that causes Pony to download more malware is not uncommon. Its just another example of the many types of malspam we see blocked by our spam filters on a daily basis.

Email examples, traffic, and malware from this diary can be found here.

Many thanks to our readers, who continue to notifyus of suspicious activity!

---
Brad Duncan
Security Researcher at Rackspace
Blog: www.malware-traffic-analysis.net - Twitter: @malware_traffic
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

An anonymous reader writes: A new wearable technology developed by a team of biomedical engineers at Texas A&M University seeks to aid seamless communication between deaf people who use sign language and those who do not understand it. The arm device contains a network of sensors which track hand movements, as well as the electromyography (EMG) signals generated by the muscles in the wrist, and process and translate the different signals into text in real-time.The prototype currently uses Bluetooth to translate the sign language to a computer or smartphone.