Someone Keeps Sending me Viruses

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Mar 23, 2020 7:57 am

Hello 419 Eater!

On the 20th of March I received a strange email pretending to be from a hospital,It asked the recipients to open the attached file because supposedly it was a purchase order.

One thing I noticed was the weird .rar ending.

Just to be safe I downloaded and opened the file in a Windows 7 Virtual Machine and ran it thru Virus Total.

My suspicion was correct, it was a Trojan.

Fast Forward to today and I received an email again from the same name and same spoofed email with another 1 MB .rar file.

It seems like the guy send the same virus again because he thinks that it failed last time.

This time I finally figured out how to open the Task Manager and it was not surprising to find that the file was running in the background.

I don't know how to post pictures on here so I posted all of them on postimage
https://postimg.cc/gallery/3e0aiq9r0/

If anyone wants to analyse the file he send me, send me a message.

Also I am sorry if this is posted in the wrong place.

Posted: Mon Mar 23, 2020 9:01 am

Eater doesn't deal with this type of thing but I'm glad you used a VM to open the file. RAR is similar to a zip file. Multiple files are packaged in a RAR that extract when you open it. They probably put the RAR into a zip file to help it bypass your mail provider's filters. I'd mark the email as spam to help your mail provider block subsequent resends and move on with life. There's not much more you can do than that. Definitely destroy that VM instance though...there's no telling what lurks in it now.

Posted: Mon Mar 23, 2020 9:18 am

Thanks for letting me know!

I reported it to Protonmail and I always destroy VMs after downloading these things.

Posted: Mon Mar 23, 2020 12:40 pm

Moved here.

As mentioned, this isn't Advance Fee Fraud or what we deal with, however...

We probably don't emphasize it enough, but, for safety's sake, you should never open any file a lad sends. If it claims to be a word processing document (WORD or PDF), tell the lad your computer says it's corrupted. Same with an Excel file. If you see an extension you don't recognize, certainly do not open it.

While most low-level AFF lads aren't adept at malicious files or links, many "seasoned" and successful lads diversify and take every advantage they can.

Posted: Mon Mar 23, 2020 12:55 pm

Even low-level lads are a big risk of passing on viruses. Some people will think sending a virus to a scammer is a good idea, lads pass around files between them and many will still work in Internet cafes so there's a very good chance that even the most technically inept scammer may unknowingly send you a virus.

If you really must know what's in a Word/Excel/PDF document or image and you're on Gmail then you can view it from within Gmail itself (assuming you are using the webmail and not a mail client). And other mail providers probably do similar.

Posted: Mon Mar 23, 2020 4:38 pm

I suggest to always ask that any Word or Excel file be converted into a PDF and any PDF you receive from a lad be converted into a DOCX. Don't bother looking at them, tell the lad that he then needs to move the information into the body of the email text. They will and end up giving you even more attention.

Posted: Tue Mar 24, 2020 2:28 am

Yes B8er, As far as I know GMX and Gmail give you the Ability to preview a file instead of opening or downloading it.

Someone Keeps Sending me Viruses	View next topic View previous topic