Bredolab trojan keeps on using DHL tracking emails to infect systems

MX Lab keeps on intercepting Bredolab variants where the DHL tracking story is present in the email.

The From address is Manager Reinaldo Pelletier <delivery@dhl-usa.com>. The name of the person is choosen randomly and can be any combination of first and last name. The subject of the email is “DHL Express Services. Please get your parcel NR.37888″. The email contains the attachment DHL_Delivery_Label_089d97c.zip with DHL_Delivery_Label_089d97c.exe. Be aware, that the numbers in the filenames and subject can change randomly.

The body of the email:

Dear customer!

The courier company was not able to deliver your parcel by your address.
Cause: Error in shipping address.

You may pickup the parcel at our post office personaly!

Please attention!
The shipping label is attached to this e-mail.
Print this label to get this package at our post office.

Thank you for attention.
DHL Services.

At the time of writting, only 14 of the 41 AV engines detected the virus. Virus Total permlink and MD5: 7e4fd271218525ea87787edd4443ffae.

Letter from Ondernemings-Portaal België

My company Pixel Design and MX Lab received today a letter from Ondernemings-Portaal België, in Dutch, regarding our presence on their business portal http://www.ondernemings-portaal-belgie.be or http://www.portail-des-entreprises-de-belgique.be/.

The way this company works is more or less similar to the World Business Guide or Belgisch Internet Register (DAD). Page one is the introduction letter and page two is the registration form with the company details that will be used in the pubication.

The letter does state the following:

Indien de door ons ingevuld gegevens niet correct of onvolledig zouden zijn, hebt u de mogelijkheid om uw gegevens te corrigeren: de basisgegevensinvoer (naam, postcode, plaats) onder www.ondernemings-portaal-belgië submenu-item: registratie. Hiervoor worden geen kosten berekend!

For the non Dutch speaking readers, the above mentions that you can correct your basic details like name, zip and city on the web site without any costs.

Wilt u meer communicatiegegevens dan de basisgegevensinvoer publiceren, dan gebruikt u het bijgevoegde formulier en stuurt het aan ons terug. Aangezien wij geen kamer-aangesloten- of overheidsafhankelijke onderneming zijn, zijn er aan deze publicatie kosten verbonden.

If you want to publish more data than the basic details like name, zip and city then you need to take extra costs into account.

Indien u per vergissing als exploitant van een privé internet pagina werd aangeschreven of niet wenst gepubliceerd te worden, gelieve dit dan in het daartoe bestemde vak linksonder aan te duiden en het formulier aan ons terug te sturen.

If you don’t want your details published on their web site because your company does not exist anymore, you don’t want a publication or you are a private person, you need to mark this on the first paper and send this back to Ondernemings-Portaal België with the registration form.

Now here is catch. The place where you can mark that you don’t want to publish your basic details is on the first page. The registration form with your details is on page two. On page two you are asked to sign and put the date on it. Now, if they receive it and they throw page one in the trashcan – something you can’t check – you have signed their contract for publication. The ‘not publish’ option is not on their registration form so it can be abused.

The costs are not mentioned on the first page but is stated on the second page and this is € 987 per year and the contract is for 3 years! So be aware that this is a costly advertisment.

Beside that, when you are in dispute with the company be aware that their establishment is located in Germany under the name TVV Tele Verzeichnis Verlag GmbH, Hamburg, and that German law applies to the contract.

Unizo, the Union of Independent Entrepreneurs in Belgium, has dedicated a whole section on their web site regarding these advertising recruiters (site in Dutch) with lots of examples.

Follow

Get every new post delivered to your Inbox.

Join 109 other followers