New Excel malware: UKMail 988271023 tracking information from no-reply@ukmail.com


MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “UKMail 988271023 tracking information”.

This email is send from the spoofed address “no-reply@ukmail.com” and has the following body:

UKMail Info!
Your parcel has not been delivered to your address November 23, 2015, because nobody was at home.
Please view the information about your parcel, print it and go to the post office to receive your package.

Warranties
UKMail expressly disclaims all conditions, guarantees and warranties, express or implied, in respect of the Service.
Where the law prevents such exclusion and implies conditions and warranties into this contract,
where legally permissible the liability of UKMail for breach of such condition,
guarantee or warranty is limited at the option of UKMail to either supplying the Service again or paying the cost of having the service supplied again.
If you don’t receive a package within 30 working days UKMail will charge you for it’s keeping.
You can find any information about the procedure and conditions of parcel keeping in the nearest post office.

Best regards,
UKMail

The attached file 988271023-PRCL.xls 118 kB large Excel file with embedded malicious macro script that will download a trojan from a host.

The malware is known as LooksLike.Macro.Malware.gen!x3 (v) or X97M.Dropper.KV.

At the time of writing, 3 of the 55 AV engines did detect the trojan at Virus Total.

Use the Virus Total for more detailed information.
SHA256: 6154fd92261dd65f02dad954db7ee9950251a0c4b3a8a2f40cc9c1b714927692

3 thoughts on “New Excel malware: UKMail 988271023 tracking information from no-reply@ukmail.com

  1. I opened this document on my phone. Does anyone know what I can do or what I can expect to happen to my phone? My phone is a Samsung Galaxy S5

Comments are closed.