Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: Mr Jones wants you to appear in court! InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Mr Jones wants you to appear in court!

Published: 2013-12-24
Last Updated: 2013-12-24 00:54:04 UTC
by Daniel Wesemann (Version: 1)
4 comment(s)

Wondering what the Costco / Walmart malware (yesterday's diary) was up to, we ran it in a lab environment. It happily connected to its Command&Control (C&C), and soon after started spamming the next round of bait. The upcoming scam email apparently looks like this:

and it comes complete with an EXE, named something like "Court_Notice_Jones_Day_Washington.exe", current MD5 84fae8803a2fcba2d5f868644cb55dd6 (Virustotal)

The C&C of the original Costco sample was at and A supplemental binary was pulled from If you have additional information on this scam or yesterday's Costco/Walmart version, please share in the comments below. Thanks to Francis Trudeau of Emerging Threats for help with the analysis and gathering the C&C traffic.


Keywords: malware scam spam
4 comment(s)
Diary Archives