The Latest in IT Security

This fake PayPal spam leads to malware on 72.46.140.14:

Date:      Tue, 1 May 2012 14:31:26 +0300
From:      “PayPal” [[email protected]]
Subject:      RE:You just sent a payment to Enrique Peterson

   
You just sent a payment
    Transaction ID: 2SM69324P0770102B
Hello xxxxxxxxxxxxxx,
Thanks for using PayPal. It may take a few moments for this transaction to appear in your account.
Merchant
Enrique Peterson
[email protected]
    Note to Thad Peterson
You haven’t sent a note.
Shipping address – confirmed
Michael Pepe
P.O. Box 173
Cheektowaga, NY�14225
United States
Total     $140.00 USD
Payment     $60.00 USD
Payment sent to Enrique Peterson

   
Help Centre | Resolution Centre | Security Centre

This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click “Contact Us” at the bottom of any page.
Copyright � 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

PayPal Email ID PP1526

The malicious payload is on 72.46.140.14/showthread.php?t=9d77a9163cda8dbe (report here) and is hosted by Versaweb in the US, suballocated to “Silver Knight Enterprises Corp” of Las Vegas.

Update: here is another variant

Date:      Tue, 1 May 2012 19:54:34 +0700
From:      “PayPal” [[email protected]]
Subject:      RE:You just sent a payment to Jame Peterson

   
You just sent a payment
    Transaction ID: 2SM69324P0770102B
Hello xxxxxxxxxxxxxxx,
Thanks for using PayPal. It may take a few moments for this transaction to appear in your account.
Merchant
Jame Peterson
[email protected]
    Note to Thad Peterson
You haven’t sent a note.
Shipping address – confirmed
Michael Pepe
P.O. Box 173
Cheektowaga, NY�14225
United States
Total     $100.00 USD
Payment     $60.00 USD
Payment sent to Jame Peterson

   
Help Centre | Resolution Centre | Security Centre

This email was sent by an automated system, so if you reply, nobody will see it. To get in touch with us, log in to your account and click “Contact Us” at the bottom of any page.
Copyright � 2012 PayPal, Inc. All rights reserved. PayPal is located at 2211 N. First St., San Jose, CA 95131.

PayPal Email ID PP1526