attachment; filename="Covid-19.001"LIITETTÄ EI SAA AVATA!
Reply-To: l0ginbox@yandex.com (viittaa Venäjälle. Tämä on ilmaisoite.) From: WHO<info@infocompany.tk> (viittaa Uuteen Seelantiin. Tämä on ilmaisoite.) (WHO:lla ei ole mitään tekemistä tämnän kirjeen kanssa)
(Tämä rivi kertoo, että osoite on peilattu - ei aito) (envelope-from office@hotech.at) (Tämä rivi kertoo, että todellinen lähettäjä on "eyeland.gr") Received: from webmail.eyeland.gr (localhost.localdomain [127.0.0.1])
----------------------e-mail KIRJE-------------------------------
FYI Tel.:0732 6989-8414 Mail: office@hotech.at Web: www.hotech.at
(ja liitteenä oli viruksen sisältänyt DOC tiedosto nimellä "INVOICE 2066006888.doc")
------------------------------------------------------------------
"DHL Overdue-13010873412.gz"Tämä kirjeen headerissa (osoitetieto) oleva "envelope" koodi osoittaa, että kirje ei tule DHL:stä. Se on vain kierrätetty DHL:n palvelimen kautta jotta osoite on sieltä saatu plokattua "lähettäjäksi". Tämä on tyypillistä rikollisten kirjeiden käytäntöä nykyään. Lähettäjäosoite ei takaa mistä lähetys on alkujaan peräisin."TAX INVOICE.gz"
Received: from amsterdam-nl-datacenter.serverpoint.com (HELO rece.com) (64.235.37.57) by cng.neutech.fi (envelope-from edgvn-express-fin-credit-admin@dhl.com)
Kirjeen headerin analyysiä alla:
Received: from [127.0.0.1] (port=57502 helo=ganesha.w2imailservers.net)
by ganesha.w2imailservers.net with esmtpa (Exim 4.91)
(envelope-from <notify@dhl.com>)
TÄMÄ KOHTA KERTOO, ETTÄ KIRJEEN DHL OSOITE ON SAATU "PEILAAMALLA" SE DHL:N PALVELIMELTA (envelope)
X-Get-Message-Sender-Via: ganesha.w2imailservers.net: authenticated_id: surbhit@mrscorporation.com
X-Authenticated-Sender: ganesha.w2imailservers.net: surbhit@mrscorporation.com
AUTENTIKOITU LÄHETTÄJÄ ON mrscorporation.com
MRS:N VERKKOSIVU KERTOO: We are presently delivering services to a portfolio of public and private sector organizations.
With office in Delhi and branch associates in Ahmedabad, Bhopal, Chandigarh, etc., we are fast developing a pan-India reach. ELI KIRJEEN TODELLINEN LÄHETTÄJÄ ON JOSSAKIN PÄIN TÄTÄ ORGANISAATIOTA TAI TODENNÄKÖISEMMIN TÄMÄN ORGANISAATION JOKU KONE ON KAAPATTU
LIITETIEDOSTO "PDF" PÄÄTTEELLÄ VOI SISÄLTÄÄ HAITTAOHJELMAN
Content-Type: application/pdf;
name=DHL_AWB#280991007.pdf
.PNG KERTOO, ETTÄ KYSEESSÄ ON KUVA. TUO YLLÄ OLEVA DHL:N KIRJE ON KUVANA. KIRJE EI SIIS OLE MYÖSKÄÄN AITO.
Content-Disposition: inline;
filename=Dhl.png;
KOSKA LINKIT EIVÄT AKTIVOIDU KOMMENTEISSA siirrän kommentissani mainitsemat linkit tänne artikkeliin:
Aiheesta kirjoitti MikroBitti:
https://www.mikrobitti.fi/uutiset/haittaohjelma-hyokkaa-nain-tietosi-varastetaan/ff34ef99-4f66-359c-b3ba-5332ab3e9b30
IS kommentoi 8.8.2001 DigiTodayn artikkelia, joka varoittaa löytyneestä PDF viruksesta:
https://www.is.fi/digitoday/art-2000001346106.html
Dear Microsoft Winner. Attached to this email is your winning notification for being an active user of Microsoft. Microsoft General Manager, Public/Online Sector U.K
---------------------------------------------------Kirjeen analyysi kiinnostuneille:
Subject: OUTSTANDING PAYMENT To: Recipients <sales@trendsupplies.com> From: "Trend Supplies Co., Ltd" <sales@trendsupplies.com>
NEW ORDER TRACKSUITS model PREMIUM / 2T SPORT Lähettäjä: Natalia
X-PHP-Originating-Script: 10000:c.phpTämä PHP scripti on spämmerin käyttämä postitusohjelma jolla hän on näitä "häkkäys"
Subject: sinun.sahkopostiosoitteesin@kolumbus.fi has password sejase123. Password must be changed > Hello! > > I'm a programmer who cracked your email account and device about half year > ago. > You entered a password on one of the insecure site you visited, and I > catched it. > Your password from sinun.sahkopostiosoite@kolumbus.fi on moment of crack: sejase123 > > Of course you can will change your password, or already made it. > But it doesn't matter, my rat software update it every time. > > Please don't try to contact me or find me, it is impossible, since I sent > you an email from your email account. > > Through your e-mail, I uploaded malicious code to your Operation System. > I saved all of your contacts with friends, colleagues, relatives and a > complete history of visits to the Internet resources. > Also I installed a rat software on your device and long tome spying for > you. > > You are not my only victim, I usually lock devices and ask for a ransom. > But I was struck by the sites of intimate content that you very often > visit. > > I am in shock of your reach fantasies! Wow! I've never seen anything like > this! > I did not even know that SUCH content could be so exciting! > > So, when you had fun on intime sites (you know what I mean!) > I made screenshot with using my program from your camera of yours device. > After that, I jointed them to the content of the currently viewed site. > > Will be funny when I send these photos to your contacts! And if your > relatives see it? > BUT I'm sure you don't want it. I definitely would not want to ... > > I will not do this if you pay me a little amount. > I think $856 is a nice price for it! > > I accept only Bitcoins. > My BTC wallet: 1PL9ewB1y3iC7EyuePDoPxJjwC4CgAvWTo > > If you have difficulty with this - Ask Google "how to make a payment on a > bitcoin wallet". It's easy. > After receiving the above amount, all your data will be immediately > removed automatically. > My virus will also will be destroy itself from your operating system. > > My Trojan have auto alert, after this email is looked, I will be know it! > > You have 2 days (48 hours) for make a payment. > If this does not happen - all your contacts will get crazy shots with your > dirty life! > And so that you do not obstruct me, your device will be locked (also after > 48 hours) > > Do not take this frivolously! This is the last warning! > Various security services or antiviruses won't help you for sure (I have > already collected all your data). > > Here are the recommendations of a professional: > Antiviruses do not help against modern malicious code. Just do not enter > your passwords on unsafe sites! > > I hope you will be prudent. > Bye.
