Threat Outbreak Alert RuleID29109: Email Messages Distributing Malicious Software on May 12, 2017

Medium

Alert ID:

53823

First Published:

2017 May 12 15:43 GMT

Version:

1

Summary

• Cisco Security has detected significant activity related to spam email messages distributing malicious software.

Email messages that are related to this threat (RuleID29109) may contain the following files:

Name	Size in Bytes	MD5 Checksum
KP-80-00-BD-PI-SPC-0010-01.rar / KP-80-00-BD-PI-SPC-0010-01.exe
1,062,400
0x95010DEF3201C2FF10B3A7FD2CFA343D

The following text is a sample of the email message that is associated with this threat outbreak:

> Subject: Enquiry MH70006 - Order to place for KANGAN PROJECT (rf. KASCO)

Message Body:

Dear Sir Good day. Hope you are good! I am glad to inform you that we got awarded for the project in subject concerning pipes, fittings and flanges. Hence, this is an order to place. The financing EPC for this project in IRAN is the Spanish SERCOBE. In fact, got the order thanks to our branch CTA Iberia (Spain). Here below and attached the item for which we would like to get your best offer, together with the complete specifications as required by the customer. Please note that we are asking for KASCO production, in seamless execution instead of welded. Hence, kindly do not consider those technical aspects related to welded pipes only. ITEM Type ITEM CODE SIZE1 (Inch) DESCRIPTION QTY(M) REMARKS 37 UT EPPPAB2523AXZ28CB 28 PIPE WELDED SAW 100% RT BE ASME B36.10M ASTM A691 1 1/4CR CL22 PWHT THK. 31.75 mm 1,164 to be offered in SMLS execution Moreover, see the following points for which I would like to get the extra cost (if any): - CFR BANDAR ASSALUYEH or BANDAR ABBAS; - Certificate 3.2 - Tolerance -0/+2% for each item - Delivery EXW Mill within October 10th, 2017; we have penalties in case of delay… due to the total amount of the order we would like to avoid to pay any fee. Moreover, we will have an internal meeting on May 16th to organize the managing of the project, and it would be very good to have your offer within that day, in accordance to the specs (where applicable). Kind of obvious to say that prices and payment term are really important. Last but not least, prices are required in EURO. Waiting for yours asap… Thanks and best regards,

Cisco security appliances can help protect customers during the critical period between the first exploit of a virus outbreak and the release of vendor antivirus signatures. Cisco Web Security Appliances help secure and control web and email traffic by offering layers of malware protection. Cisco security appliances are automatically updated to help prevent both spam email and hostile web URLs from being passed to the end user.

Revision History

* Version	Description	Section	Date
1	Initial release to report significant activity detected by Cisco Security on May 12, 2017.	—	2017-May-12
Show Less

---

Legal Disclaimer

• THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products