NUEVOS MAILS CUYOS FICHEROS ANEXADOS PASAMOS A CONTROLAR COMO BACKDOOR ANDROM A PARTR DEL ELISTARA 40.63 DE HOY

Se reciben dos mails, ambos anexando fichero .ISO, que desempaquetandolos se obtiene sendos .EXE, a saber:

El primero tiene el siguiente texto:

Asunto: Fwd: BANK TRANSFER LETTER FOR 4th payment
De: Gimbrowns Marine <gimbrownm@gmail.com>
Fecha: 07/02/2019 18:01
Para: destinatario

Good Day.

See attached Bank letter for transfer.

The swift copy will be sent to you today once I receive it.

Thank you.

Kind Regards,
Audrey

GIMBROWNS MARINE SECURITY OIL & GAS LIMITED

Email addresses: gmbph@yahoo.com
gimbrownm@gmail.com
gmbapap@gmail.com
gmblagos@gmail.com
gmbmarinesgroup@gmail.com

Website: www.gmbmarinegroup.com

Office number : +2348057448323

GIMBROWNS MARINE SECURITY OIL & GAS LTD
FLAT 6,D UPPER LODGE,SHELL LOCATION RD,
OFF TOMBIA EXTENTION,GRA PHASE II
PORT HARCOURT,
RIVERS STATE
NIGERIA.

Nombre: BANK TRANSFER LETTER.pdf.exe

que, como puede verse, tiene doble extensión .PDF.EXE y

total:

__________

y el segundo, muy similar, pero con diferente remitente y anexado:

Asunto: FW: Payment Swift Copy – Swoft430593095 *3rd Party Remittance*
De: Casper Bendtzen <casperm.bendtzen@elopak.com>
Fecha: 07/02/2019 17:58
Para: DESTINATARIO

Good Morning,

Find the attached payment copy for a transfer ordered by your client.
We were duly instructed to remit this payment to your bank account by your client.
In the attached payment swift copy, Your client’s details are referenced on the payment copy attached.

Kindly inform them and also inform us when you have received the payment.

Also inform us, does your bank accept international cheques? We can change to remitting via cheques for future payments.
Other payments we send to your country for other clients are made by cheques. Let us know if your bank would allow this.

I remain at your discretion if you have any questions.

Waiting for your kind reply.

Best regards

Casper Bendtzen
International Payment/Accounts Admin

??: Via Bruno Buozzi n°28, 43056, SanPolo di Torrile, Parma, Italy

Cuyo ISO contiene el siguiente EXE, tambien con doble extensión .PDF.EXE, total:>

Ambos los pasamos a controlar a partir del ELISTARA 40.63 de hoy

saludos

ms, 7-2-2019