{"id":17461,"date":"2018-11-05T10:06:47","date_gmt":"2018-11-05T02:06:47","guid":{"rendered":"https:\/\/www.exabytes.sg\/blog\/?p=17461"},"modified":"2022-01-27T18:08:42","modified_gmt":"2022-01-27T10:08:42","slug":"phishing-mail-pretending-sheep","status":"publish","type":"post","link":"https:\/\/www.exabytes.sg\/blog\/phishing-mail-pretending-sheep\/","title":{"rendered":"Phishing Mail : A Big Wolf Pretending as a Sheep\u2019s Knocking on Your Monitor Screen"},"content":{"rendered":"

\"\"<\/span><\/p>\n

Phishing Mail<\/strong><\/h2>\n

I am A, an Exabee working at Exabytes.<\/p>\n

I\u2019m just an ordinary human who joins the crazy morning traffic to Exabytes Office in Payar Lebar every day to fulfill the mission of <\/span>\u2018Grow Your Business Online!\u2019<\/i><\/b><\/p>\n

What the\u2026this is surely not a good start amid Monday Blues because I just received a similar email which I thought was some kind of love story, and moved it straight to the Junk folder. <\/span>And I found a Big Bad Wolf Hiding “Phishing Mail” behind Exabytes Mail. <\/strong><\/p>\n

\"spot<\/span><\/p>\n

So, I grabbed a cup of coffee and started to perform an analysis.<\/span>
\n<\/span>
\n<\/span>GOSH! <\/span>\u201cEmail target@domain.com<\/strong><\/span>\u00a0has been compromised!\u201d<\/span><\/p>\n

Look How I Met Big Bad Wolf<\/b> in some Phishing Mails. <\/b><\/h2>\n

Email header + Content<\/b><\/b><\/h3>\n

All emails consist of an Email header and Email body.<\/span><\/p>\n

Email header records every single relay point going through before it reaches your mailbox.<\/span><\/p>\n

It is like how you trace your parcel from a courier service provider after purchasing something online.<\/span><\/p>\n\n\n\n
\u00a0Received: from [12.12.12.123] (UnknownHost [12.12.12.123]) by mail.domain.com with SMTP;<\/p>\n

Thu, 29 Oct 2018 06:17:21 +0800<\/span><\/p>\n

Message-ID: <xxxxxx><\/span><\/p>\n

From: <target@domain.com<\/strong>><\/p>\n

To: \u00a0<target@domain.com<\/strong>><\/span><\/p>\n

Subject: account target@domain.com<\/strong> is compromised<\/span><\/p>\n

Date: 29 Oct 2018 06:00:12 +0800<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

\"phishing<\/p>\n

Suspicion 1: I know your password!<\/b><\/h4>\n\n\n\n
\n

I’m a hacker who hacked your email and device a few months ago.<\/span><\/h4>\n

You entered a password on one of the sites you visited, and I intercepted it.<\/span><\/h4>\n

Of course you can\/will change your password, or already changed it.<\/span><\/h4>\n

But it doesn’t matter, my malware updated it every time.<\/span><\/h4>\n

Do not try to contact me or find me, it is impossible, since I sent you an email from your account.<\/span><\/h4>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

If you have my email account password, why didn\u2019t you directly authenticate\/relay over the mail server but instead sending from a third party host [12.12.12.123], and pretended that you know my password?<\/span><\/p>\n

 <\/p>\n

\"Phishing<\/p>\n

<\/h3>\n

Suspicion 2: Spying on you!<\/b><\/h3>\n\n\n\n
\n

Through your email, I uploaded malicious codes to your Operating System.<\/span><\/h4>\n

I saved all your contacts with friends, colleagues, relatives, and a complete history of visited websites.<\/span><\/h4>\n

I also installed a Trojan on your device and have been spying on you for a long time.<\/span><\/h4>\n

You are not my only victim. I usually lock computers and ask for a ransom.<\/span><\/h4>\n

But I was struck by the sites of intimate content that you often visit.<\/span><\/h4>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

The spammer seems to put on more pressure.<\/span><\/p>\n

If he\/she is a real hacker that got \u201cfull access\u201d to my laptop\/desktop, then he\/she should deploy a ransomware instead of sending a phishing mail, and wait for me to take the bait.<\/span><\/p>\n

 <\/p>\n


\n\"Phishing
\n<\/span><\/p>\n

Suspicion 3: I made screenshot from your photos!<\/b><\/h3>\n\n\n\n
\n

So, when you had fun on piquant sites (you know what I mean!), I made screenshot using my program from your camera device.<\/span><\/h4>\n

After that, I combined them with the content of the currently viewed site.<\/span><\/h4>\n

There will be laughter when I send these photos to your contacts! BUT I’m sure you don’t want this to happen.<\/span><\/h4>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

My broken camera already stopped working for a some time and the website I frequently visit is exabytes.my. Now you really make me laugh, I get your joke! LOL!<\/span><\/p>\n

 <\/p>\n

\"Phishing<\/p>\n

Suspicion 4: Pay me or Data gone!<\/b><\/h3>\n\n\n\n
\n

Therefore, I expect payment from you for my silence.<\/span><\/h4>\n

I think $852 is an acceptable price for it!<\/span><\/h4>\n

Pay with Bitcoin.<\/span><\/h4>\n

My BTC wallet: 1DVU5Q2HQ4srFNSSaWBrVNMtL4pvBkfP5w<\/span><\/h4>\n

If you do not know how to do this – Search this on Google “how to transfer money to a bitcoin wallet”. It is not difficult.<\/span><\/h4>\n

After receiving the specified amount, all your data will be immediately destroyed automatically. My virus will also remove itself from your operating system.<\/span><\/h4>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

It seems that you care about me more than I do regarding this data. You care about me so much that you provided me with the steps on how to make payment.<\/span><\/p>\n

Wow, the last line sounds like a scene in Mission Impossible. Are you a fan of the box office?<\/span><\/p>\n

 <\/p>\n

\"Phishing<\/p>\n

Suspicion 5: Time is running out! I’m coming now!<\/b><\/h3>\n\n\n\n
\n

My Trojan have auto alert, after this email is read, I will know it!<\/span><\/h4>\n

You have 2 days (48 hours) to make payment. If this does not happen – all your contacts will get crazy shots from your dark secret life! Soon your device will be blocked too (also after 48 hours).<\/span><\/h4>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

I read the similar email last week, did you not track that?<\/span><\/p>\n

Email actually got a function called \u201cRead receipts\u201d. And why would you need to spend time writing a Trojan?<\/span><\/p>\n

 <\/p>\n

\"phishing<\/p>\n

Suspicion 6: Do not be Silly!<\/b><\/h3>\n\n\n\n
\n

Do not be silly!<\/span><\/h4>\n

Police or friends won’t help you for sure …<\/span><\/h4>\n

P.S. I can give you advice for the future. Do not enter your passwords on unsafe sites.<\/span><\/h4>\n

I hope you understand your situation now.<\/span><\/h4>\n

Farewell.<\/span><\/h4>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Finally, I saw a meaningful line in the whole content\u2026Yes, Do not be silly with such low level phishing mail, and I will sure help my friends by spreading this information ^^<\/span><\/p>\n

Bye Mr. Spammer, good try!<\/span><\/p>\n

For More Similar Post About Cyber Security and Scam Mails<\/p>\n