NUEVO MAIL QUE ADJUNTA UN ISO QUE CONTIENE UN EXE INFECTADO CON Win32/Detplock

El contenido del mail incluye un anexado a un fichero ISO que no es mas que un empaquetado que incluye un EXE malicioso que pasamos a controlar a partir del ELISTARA de hoy como Win32/Detplock

TEXTO DEL MAIL
______________

Asunto: FW: Paymnet Copy – Correspondence P.O (4938530)
De: Credit Controller <bwoods@omega.com>
Fecha: 23/01/2020 13:00
Para: DESTINATARIO

Dear,

Find the payment slip attached for the order we made in your firm.
I am the head of finance and accounts.

My colleague has been communicating with you for certain products.
Please confirm to her that you have received payment in your bank account.
This payment was processed yesterday on the Jan 22nd.

I await your reply.

Gracias

Best regards

Bev Wood
Credit Controller

Direct Tel: +44 (0)161 777 2227
Fax: +44 (0)161 777 2273
Email: bwoods@omega.com
Web: http://www.omega.co.uk

Your Single Source for Process Measurement and Control!

OMEGA ENGINEERING SHARED SERVICE CENTRE
ONE OMEGA DRIVE | RIVER BEND TECHNOLOGY CENTRE
NORTHBANK IRLAM | MANCHESTER M44 5BD | UK

FREEPHONE SALES 0800 488 488 (UK ONLY)

anexado : Payment swift_ref0029-20200122.iso —> contiene Payment swift_ref0029-20200122.EXE infectado con Win32/Detplock

___________

Extraido el ISO ofrece un EXE de nombre Payment swift_ref0029-20200122.EXE con un Win32/Detplock, que pasamos a controlar a partir del ELISTARA de hoy

total sobre el fichero exe contenido en el ISO anexado, ofrece el siguiente informe>

saludos

ms, 23-1-2020