Trojan from paypal?

Discussion in 'Malware Help (A Specialist Will Reply)' started by picturevalve, Jun 24, 2008.

  1. picturevalve

    picturevalve Private E-2

    I receive various spoof emails purporting to be from paypal and containing trojans, but one today has the following header :

    Return-Path: <spoof-review@paypal.com>
    Delivered-To: my email address
    Received: (qmail 12027 invoked from network); 24 Jun 2008 00:32:32 -0000
    Received: from smtp-a01.internal.boltblue.com (HELO smtp-a01.boltblue.com) ([172.20.8.85])
    (envelope-sender <spoof-review@paypal.com>)
    by email.backend.boltblue.com (qmail-ldap-1.03) with SMTP
    for <my email address>; 24 Jun 2008 00:32:32 -0000
    Received: from phx01imail02.phx.paypal.com (mx0.phx.paypal.com [66.211.168.230])
    by smtp-a01.boltblue.com (Postfix) with ESMTP id 2BADC76608
    for <my email address>; Tue, 24 Jun 2008 01:32:27 +0100 (BST)
    DomainKey-Signature: s=dkim; d=paypal.com; c=nofws; q=dns;
    h=Received:thread-index:Received:Message-ID:Date:From:To:
    Subject:MIME-Version:Content-Type:
    Content-Transfer-Encoding:X-Mailer:Content-Class:
    Importance:priority:X-MimeOLE:Return-Path:
    X-OriginalArrivalTime;

    Kaspersky threw up the following alert

    Infected: Trojan program Trojan-Spy.HTML.Paylap.cf [From:<spoof-review@paypal.com>][Subject:Thank you for your email... ZACVL (KMM58152391I96L0KM) :ppk1][Time:2008/06/24 01:32:32]\text/plain 1.3 KB

    The ip address 66.211.168.230 is from ebay, has this been spoofed as well?

    OrgName: eBay, Inc
    OrgID: EBAY
    Address: 2145 Hamilton Ave
    City: San Jose
    StateProv: CA
    PostalCode: 95008
    Country: US

    NetRange: 66.211.160.0 - 66.211.191.255
    CIDR: 66.211.160.0/19
    NetName: EBAY-2

    Strangely I had only just forwarded a spoof email header to paypal - minus the trojan in the guts - a few minutes previously.
    An inside job?
     
    picturevalve, Jun 24, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what your real question is. Spam and spoofed email address are just things that happen. Better ISPs have built-in antispoofing in their networks. Some just don't know how to set it up. Once some spammer has you email address, you will find yourself getting added to more and more spam lists, especially if you ever make the mistake of responding to any of the emails. Even if it is a message from you telling them where to go. All you did was confirm your email address was valid and you will get added to more spam lists.

    We can check to see if you PC has any malware on it, but there is nothing that any of these scans will do to help you from spammers having your email address. Sometimes if you are really plagued with spam issues, it is easier to just change email address and be more careful who you give it to. If you have friends who use Reply to All and like to send out jokes and other BS to dozens of people, never give them your email address. At least not one that is an important email address.
     
    chaslang, Jun 25, 2008
    #2
  3. picturevalve

    picturevalve Private E-2

    My real question is how did they spoof the ip address in the header?
    I didn't realise that was possible.
     
    picturevalve, Jun 25, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's what hackers do. And that is why there is such a thing as IP Spoofing and why I mentioned antispoofing. Depending on how much reading you wish to do, you can read about this in lots of place by doing the appropriate searches. A few examples:

    http://www.securityfocus.com/infocus/1674
    http://www.scs.carleton.ca/~dlwhyte/whytepapers/ipspoof.htm
    http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_10-4/104_ip-spoofing.html
    http://www.iss.net/security_center/advice/Underground/Hacking/Methods/Technical/Spoofing/default.htm
    http://en.wikipedia.org/wiki/IP_address_spoofing
    http://spoofer.csail.mit.edu/summary.php


    http://en.wikipedia.org/wiki/Spoofed_URL
    http://secunia.com/advisories/10395/
    http://support.microsoft.com/?id=833786
     
    chaslang, Jun 25, 2008
    #4
  5. picturevalve

    picturevalve Private E-2

    Thanks for the links, there's a lot to read there. I never respond to the emails, or download them,just send them on to paypal or whoever ( header only). That one just happened to get through my manual filtering at my email provider. So if I send that header to paypal themselves is there any way that the spammer can "sniff" it as mentioned in one of those links?
     
    Last edited: Jun 26, 2008
    picturevalve, Jun 26, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This should not be a problem. Sniffing occurs only when the spoofer is part of your own network which I tend to doubt is the case for you.
     
    chaslang, Jun 26, 2008
    #6
  7. picturevalve

    picturevalve Private E-2

    http://www.pronetworks.org/forum/post-766559.html

    In the above post it claims that this type of email did in fact originate at paypal and they are looking into it. This was last May, I'm still getting them - every time I send a report. I get no replies from paypal, however. Could the emails be intercepted?
     
    Last edited: Aug 23, 2008
    picturevalve, Aug 23, 2008
    #7
  8. picturevalve

    picturevalve Private E-2

    Latest from them has this in the message :
    Thread-Topic: follow up on phone call (KMM22142349I96L0KM) :ppk4
    and I've no doubt that Kaspersky will flag it as a trojan in there somewhere.
    So is Kaspersky flagging up a false positive or is something nasty coming from paypal? The message is definitely from them as it's in response to a phone call I made.
     
    picturevalve, Aug 23, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It would not be the first time or the last time. ;)
     
    chaslang, Aug 23, 2008
    #9
  10. picturevalve

    picturevalve Private E-2

    I downloaded the email with the ppk4 identifier and no problem with Kaspersky. The one with the ppk1 identifier was identified as the paylap trojan and Kaspersky has put it in the backup rather than quarantine, so I can't submit it to them without restoring it.
     
    picturevalve, Aug 25, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay so if you want to submit it to them, you will have to restore it.
     
    chaslang, Aug 25, 2008
    #11

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds