Cybercriminals are currently trying to obtain sensitive data from ING-DiBa customers with dubious fake emails. The fake email claims that a problem has occurred during a routine security check of the online banking system. It advises that customers should immediately log on to an external website to avoid troubles with their bank.
However, in reality, this is a phishing attack that tries to collect personal information. In the following blog article, you will learn in detail how to protect yourself from fake emails or phishing attacks.
The fake email from our example
A German ING-DIBA fake email (click for zoom)
The adjacent picture shows the detailed structure of the fake email – allegedly sent by ING-DiBa – in an iPhone mailbox. In fact, the email is part of a mass phishing attack and the message was sent fraudulently to a variety of email recipients.
For example, the subject line states “For Your Safety (Reference Number: xyz)”, and the presumable arbitrary order of the combination was set to “kx5qrvnzx3h” in this case. Before we blackened the personal information for reasons of data protection, we noticed that both the recipient’s address and the sender’s address had the same information. This was already a first indication of a fake email.
This scam is not uncommon amongst perpetrators when it comes to gathering information about their randomly selected victims via phishing. Those affected are especially inclined to follow the attached link if the phishing or fake email is opened on a mobile device, as it is in this case. This is particularly true if they are actual customers of the bank mentioned in the email.
In everyday life, too, recipients of phishing emails are also quick to follow the link when receiving such an email. The attacker offers the targeted person appropriate options in case a recipient does not have an account with ING-DiBa. In our example, the recipient has the opportunity to follow a flashy red button and allegedly communicate that he is not a customer of ING-DiBa. The destination of the link, however, is a phishing website, which is intended to tap user data in a big way from the mostly unsuspecting victims. The fake security notification of ING-DiBa is not an isolated case.
6 tips to detect phishing or fake emails
With the following tips, you will be able to detect phishing or fake emails to protect yourself from being affected by such attacks.
Feature No. 1: The salutation
It is striking that either a standard phrase is used to address the target person, or the salutation is completely missing. Very rarely recipients of phishing emails are addressed with their whole name. This is due to the fact that fake emails are not isolated cases, but often automated emails which are sent out millions of times. Individual addresses are rather the exception. In our example there was no address at all.
Feature No. 2: Content of the email
A phishing mail is contextually designed to hide the true intentions towards the recipient at least until he first clicks on one of the attached links. These following baits are very popular with cyber crooks:
- Fake emails in the form of alleged PayPal security notifications
- Phishing emails which seem to come from banks or other institutions
- Fake email notifications that seem to come from Amazon or Ebay
- Fake security issues in social media accounts that need to be resolved promptly
This shows that cybercriminals are very creative when it comes to fooling their victims.
Feature No. 3: The call to action
Once the attacker has created and sent out his fake email, he urges the recipient to act. In this specific case, the targeted person is initially led to an external page by clicking on a link. This page usually resembles closely the login area of a bank, an online retailer or any other company that offers certain Internet services.
Once the victim has entered his details into the according form fields and pressed the confirmation button, the cybercriminal is in possession of the login details. Now he can make orders in online shops under false names or get access to sensitive account or company data. The phishing attack has been successful.
Feature No. 4: The time shortage
An effective means often used by attackers is the limitation of time. This is an attempt to put the victim under stress and distract it. In our example, this is stated as follows: “Please log into your account as soon as possible to avoid any delay in your banking activities.”
Fear-spreading phrases in the subject line, such as “Your account has been suspended” or “An amount has been debited from your account” are also quite popular and common. These sentences cause some recipients to panic, so they follow the attached link without much thought.
Feature No. 5: Questionable buttons and links
In order to successfully carry out the process of phishing, a related link in text or button form is part of the standard repertoire of any phishing or fake email. This is also the case in our example.
Therefore, when it comes to questionable security queries that have a link, we recommend that you do not access these links from your email program. Instead, you should always directly log in to your user accounts via a browser or via the official website of the provider. This applies to online services of any kind.
Feature No. 6: This is how reputable companies and institutes work
As far as the detection of phishing emails or fake emails is concerned, it should always be remembered that reputable companies or institutes would never ask you to disclose personal information via email.
For this reason, various banks regularly point to the problem of fake emails or the so-called phishing mails. One bank states for example:
“Volksbank Raiffeisenbank or BVR will never ask bank customers for personal information such as PIN or account number via email. Neither will we insert a link to online banking in emails or ask bank customers to make test or remittance transfers. These practices are always indicators of attempted fraud.” (Source: Volksbank Raiffeisenbank)
Therefore, you can delete such an email immediately. This is ultimately the simplest way to counter a phishing attack.
Additional service information
Reputable and hardly suspicious – that’s how phishing emails, which have been circulating for several months and which allegedly come from Amazon, reach the mailboxes of many users. The reason for this is that those emails do not appear to be a cunning fraud but quite the opposite. They are so good in copying the design of a real Amazon email that they are hardly indistinguishable for end users. In addition, the cybercriminals use a personalized form of address in these phishing emails, which adds weight to the credibility of the email.
Example of such an Amazon phishing email (Click to enlarge image).
A phishing email personalized in this way is referred to as a “spear phishing attack”. These targeted attacks aim specifically at a single person or group of people. The behavior and personal data of target persons are spotted in advance in order to personalize the spear-phishing email the best possible way. Those fraud emails can only be identified through the sender address with which they were sent. These can, for example, be as follows:
More detailed information about possible sender addresses, the structure of phishing emails and content can be found here.
What do the attackers want to achieve?
Referring in the email to the Federal Data Protection Act, the victims are requested to verify their data. By clicking on a link, they are redirected to a fake website that is almost indistinguishable from the real Amazon site. On closer inspection, only the URL used does not match that of Amazon.
On the fake sites, the people concerned should then disclose data of themselves. Otherwise the hackers threaten to block access to the account, as shown in the example above. This is, of course, a hollow statement. Anyone who responds to this request, however, transmits his data directly to the fraudsters. The cybercriminals use the obtained data to make purchases at the expense of the person concerned or to misuse them for other criminal activities.
Does Hornetsecurity Advanced Threat Protection detect fake emails?
Hornetsecurity Advanced Threat Protection is able to detect the new Amazon phishing emails as well as other targeted attacks. Safety mechanisms including Fraud Attempt Analysis, Identity Spooning Recognition and Intention Recognition can filter out threats of this kind. A loss of sensitive data can thus be prevented and Amazon phishing emails do not even get into the mailboxes of a company or employees.
Additional service information
When it comes to new types of malware, there is always the question of what their objectives are. At the moment we are monitoring a new .NET spyware that has not yet been reported. It distinguishes itself by using persistent anti-analysis techniques implemented by utilizing the Confuser packer. Apart from that, the spyware does not put a lot of effort into disguising itself during runtime, thus revealing its intentions. This malware collects login details from many different programs and uses a keylogger to gather information.
This .NET spyware that we named Camolog is spreading due to an ongoing phishing campaign and it uses a keylogger to collect login details from mail clients, browsers, FTP and instant messenger clients. After these campaigns collect information, the access data gathered is usually sold by cybercriminals or used for later attacks.
In the individual emails of a large wave of spam emails, the subject headings (see screenshot) and attachments are slightly different. Most of the time, the attachments that deliver the malware are between 400KB and 1.3MB in size. In the following screenshot, you can see one of these phishing e-mails with the contact information crossed out, because in many cases, these are the information stolen from real people.
Example of a phishing mail that delivers malware
The phishing email fools the recipients into believing that they are going to receive a price quote or an offer of some kind and this motivates them to open the attachment. However, it contains a RAR archive named “Sample Product 9076_pdf.rar”. The archive hides the executable .NET file “SampleProduct9076_pdf.exe” which serves as a dropper for the spyware and is secured by a version of the publicly available cover-up tool Confuser.
When opening the malware in the .NET decompiler dotPeek, the usage of Confuser becomes apparent. The project name “dimineata” is noticeable and can be used to identify the malware and is displayed in the screenshot below.
The .NET Decompiler dotPeek lets you analyze the Confuser.
On the other hand, the application of both anti-decompiler and anti-debugger techniques makes it harder to analyze the malware. The analysis tool IDA Pro will crash when loading the binary file, specific .NET decompilers do not function properly and debuggers used in dynamic analyses fail, which means that manual analyses will rarely provide information. It’s likely that this is also one of the reasons why there is an absence of this spyware being publicly reported so far.
Bypassing security measures
The only way to obtain an overview of this malware’s behavior is to run it in a safe and controlled environment. In doing so, you can observe that the malware runs as a process named “chrome.exe” with the description “Accu-Chek 360˚ diabetes management software”. This process starts another sub-process with the same name. After a few moments, the original binary file generates a copy of itself as AppData\Local\Temp\iaq\iaq.exe, starts its sub-process and subsequently deletes itself.
At the time the sub-process is loaded, its binary data must be fully extracted and decrypted in the memory. The transfer takes place in the form of a byte array to the AppDomain.Load() function. This function is not affected by the anti-analysis methods of the cover-up tool because it belongs to the .NET framework. Unlike the malware functions, it can be easily analyzed. Thus, with a debugger such as dnSpy it is possible to set a breakpoint on this function and dump the binary file of the malware that is loaded by the dropper. But, let’s have a closer look into the malware itself.
Analysis of spyware.
The binary file of the dropped spyware is only masked by randomly renaming the functions and variables, not by additional anti-analysis methods. Therefore, it is possible to generate readable source code with a .NET decompiler again and thus reveal the behavior of the malware.
What information is collected?
The spyware collects numerous information: Next to the FTP Client SmartFTP’s connection data, which are saved in the favorites, but also passwords from the client WS_FTP, recently used connections from FileZilla, connections of saved sessions from WinSCP and the connection data from FTPWare.
Additionally, the account data saved in the Instant Messenger Pidgin and the passwords from the video chat tool Paltalk are read out. Camolog also diligently collects account data from the Outlook and Thunderbird mail clients as well as the login details from the YandexBrowser, ChromePlus and Chromium browsers. The spyware can also record all kind of data and password input with a keylogger.
The Spyware nests itself within the system by creating registry keys for Windows Autorun (see list of indicators). The malware is pretty good at identifying itself in the system through these registry keys and the running process “chrome.exe”.
Cloud protection by Hornetsecurity products
Through the use of our cleverly designed spam filter mechanisms, Hornetsecurity has been detecting the emails of this campaign since they first appeared and we have been filtering them out in the cloud. As a result, there is no way for the spyware to get close to our customers’ business infrastructure.
With Hornetsecurity Advanced Threat Protection, our customers benefit from being protected against any variation of this malware. Through the use of behavioral analysis, the level of protection Hornetsecurity ATP provides exceeds that of a conventional spam filter.
Here is an extract from the ATP behavioral analysis:
The detailed evaluation of the sandbox analysis.
List of indicators for the detection of malware
Subject lines used in the campaign:
- Quotation request
- Quote-Bid Identifier: ITB-0011-0-2018/AM
- Quote-Bid Identifier: ITB-0014/0015-0-2018/AM
- Kindly Quote-Bid Identifier: ITB-0016-0-2015/AM
- Quotation required
Attachment of the phishing email – Win32 RAR Archive
- File name: Sample Product 9076_pdf.rar
- SHA256: 5f5e7a57d9500fcece0b7c88c8925bb13243222182e5badddaa2419bda963ca6
- Attachments of other emails of this campaign:
- 30eaa3e9b9390f603d2a349c0a4cf064225eff3ede60a24aab8e69cf67cf83a5 Product sample 0015_pdf.rar
- 6acf72c636aa9ff2fae225d75eea063c2ee61026151a6c405175dd06e8a5c01f product sample 0019_pdf.rar
- a54f7ff3ecf8acccc23fe2c52fd5e58099852f3448dcec67c6deff5fa925a4d5 Sample product 0011_pdf.rar
- c165676976f9e91738c5b6a3442bf67832a7556e23e49f1a77c115af47b290ee Sample Product 0014_pdf.rar
- 97cea5ce28bbebff16251cbde247362915e8f41a89f979ae266c797aff6ef5e6 Sample Product 0016_pdf.rar
- 5f5e7a57d9500fcece0b7c88c8925bb13243222182e5badddaa2419bda963ca6 Sample Product 9076_pdf.rar
- File type: RAR archive data, v4, os: Win32
- Size: 331K
- Content of the archive, SHA256: 2feb8a19f44c29a83a0561ca7e38492e1a843add08eda2027a8a7c5041af6de6
Dropper from out of the archive
- File name: SampleProduct9076_pdf.exe
- SHA256: 2feb8a19f44c29a83a0561ca7e38492e1a843add08eda2027a8a7c5041af6de6
- Other dropper of the campaign:
- 38782911f7deca093b0e6018fd6c51122a8211c9c446f89de18e6ada85afa0d1 Product sample 0015_pdf.exe
- 542b6a778489710994aadfaca3b57e0a9c03d2e3b6d5617e3220f364cbde9a45 product sample 0019_pdf.exe
- 04381c6ecdf618ce122084a56ca5416c6774cba4b34909e95f7a532523c3e877 Sample product 0011_pdf.exe
- 42992976461c59a4a52e4bf202d4bfcd738408d729ff9cbc55786016cb4075c3 Sample Product 0014_pdf.exe
- 2a159afdc686df016ee370aeed134f9c4fe44320a32ec2eb25d76270206b5b5a Sample Product 0016_pdf.exe
- 2feb8a19f44c29a83a0561ca7e38492e1a843add08eda2027a8a7c5041af6de6 Sample Product 9076_pdf.exe
- File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
- Size: 429K
- Process name: chrome.exe
- Description: Accu-Chek 360˚ diabetes management software
- Drops the file SHA256: 67c7840eefb640e70473ebc4bb7dec89f8168d679226be0696708e3427956114
- Significant string: dimineata.exe
- Stores a copy of itself under C:\Benutzer\analyst\Appdata\Local\Temp\iaq.exe ab
- File name: impartial.exe
- SHA256: 67c7840eefb640e70473ebc4bb7dec89f8168d679226be0696708e3427956114
- File type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
- Size: 58K
- Process name: chrome.exe
Registry Keys, of which information have been gathered
- HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles*
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook*
- HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Files, of which information have been gathered
- C:\Users\Administrator\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
- C:\Users\Administrator\AppData\Local\Chromium\User Data\Default\Login Data
- C:\Users\Administrator\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
- C:\Users\Administrator\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
Registry Keys, that have been created to generate persistence
- Autorun entry for the dropper: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\iaq
- reg_value C:\Users\ADMINI~1\AppData\Local\Temp\iaq\iaq.exe
- Autorun entry of the spyware: Spyware: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Application
- reg_value C:\Users\Administrator\Desktop\chrome.exe -boot
Value-added distributor Contronex includes Hornetsecurity’s Cloud Security Services into its portfolio
Hornetsecurity has closed its first VAD contract in the U.S. with Naples, FL based distributor Contronex. With this new partnership, Hornetsecurity will significantly expand its reach into the U.S. and Canada.
According to Oliver Dehning, CEO of Hornetsecurity. “With Contronex, we have found the perfect match. They are experienced in providing the best security solutions in the IT marketplace. Also, they offer an extensive network of resellers that are trained in selling high-class security products. We’re very happy to have established a relationship with this experienced partner.”
“As a growing value-added distributor of IT security software solutions, we regularly add new vendors to expand our product portfolio. With Hornetsecurity, the onboarding process was accomplished quicker than ever”, adds Beat Kramer, CEO at Contronex.
Hornetsecurity, a leading European Cloud Security Service provider, offers a full suite of Email Security Solutions protecting companies of all sizes from malware or phishing attacks and unauthorized access and loss of data, all without the need for extra hardware, software or administrative effort.
Founded in 1990 in Naples, FL, Contronex specializes in the distribution of IT security solutions and commits to three simple concepts: integrity, reliability and commitment to service, which aligns perfectly with the Hornetsecurity approach. Contronex has developed a unique partner program for resellers and managed service providers that helps them to purchase the products their clients’ need.
Good news for Hornetdrive users: Hornetsecurity has treated its fully encrypted cloud storage with a new update. The latest version Hornetdrive 4.5 has many new features in store, especially when it comes to compatibility and user experience. Here are some of them in detail.
Users of Mac OS version 10.13 (High Sierra) will benefit from one of the new features in particular. With this update, Hornetdrive now supports Apple’s new file system APFS, which has replaced the outdated HFS+. So you can use Hornetdrive like before on your brand-new iMac od MacBook, too.
Export of log files facilitates data analysis
Another practical feature increases Hornetdrive’s user friendliness. Version 4.5 offers a new export and filter function. This facilitates users to keep an overview on all events taking place. Every activity is logged in a so-called “event log file”, which can contain a high number of data. With the new export and filter functionality, these data can be downloaded easily as a CSV file and thus filtered and analyzed outside of Hornetdrive.
Always stay up to date
Also, the new notification feature helps users react and adapt to recent activities within Hornetdrive. This functionality can be found under “Settings” and “Notifications”. There they can determine whether to receive pop-up or email notifications for certain events like file conflicts, new file versions, the renaming of folders or new drive members.
Turn on notifications in a flash
The new Hornetdrive version 4.5 can be downloaded cost-free from now on for all Windows, Mac OS X and Linux versions on our website. Android and iOS users can get their latest version in the play store or app store.
Hornetsecurity has closed another strategic partnership with a value-added distributor.
ADN Advanced Digital Network Distribution GmbH from Bochum, Germany has been founded in 1994 and specializes in the distribution of cloud services, technologies and solutions that require intensive consulting. With this cooperation, Hornetsecurity dramatically increases its reach, as ADN contains a network of 6.000 partners and clients.
The Hornetsecurity services can be purchased through ADN as of now. The value-added distributor provides more than 30 employees that have been trained and certified on the vendor solutions to support resellers with their high competence.
“From the start ADN focused on our partnership with enthusiasm and engagement. Such a huge team of sales-related and technical specialists is a true added-value for ADN resellers”, says Daniel Blank, CEO of Hornetsecurity. “Our services reduce complexity and offer resellers the opportunity to differentiate from their competitors. I am convinced that ADN is the perfect partner to push exactly these topics and to explore the enormous growth potential in cloud security.”
“Our experience is that companies, when it comes to processing emails in the cloud and long-term storage of emails, lay a strong emphasis on data security and compliance. Organizations also have high expectations on spam filtering and protection from ransomware and deceiving emails like CEO fraud“, says Dirk Wolbeck, team leader networking & security at ADN.
Resellers and system houses should consider these requirements when selecting the suitable email cloud security solution. With its focus on email security ”made in Germany“, Hornetsecurity offers the necessary expertise and is thus the perfect partner for ADN.
„It is our goal to have the best and most innovative vendors on board. The Hornetsecurity surface provides a quick overview, is easy to manage and offers multitenancy. Attributes that are very important to our clients“, adds Dirk Wolbeck.