We've trapped a couple of mails from gmail containing malware. Malware in the form of an attachment called "Payment.rar", "document.rar" or "INVOICES.rar"; within that file is a windows ".scr" or ".exe" executable.
The text is like this (sic):
Dear Sir/Ma
Please check attachment for the confirmation of the part payment into your account. Thanks for your patient and we sincerely apologize for the delay. Please find swift message for the payment made via attachment and confirm back.
--
Thanks & Regard,
Rohitashwa K. Mishra,
Senior Journalist,
Dainik Bhaskar Group.
Or perhaps like this, received from mail-vc0-f194.google.com [209.85.220.194] on Tue, 29 Oct 2013 06:12:01 (sic):
Dear sir ,
Regarding to the previous order i made in your company , the goods shipped
to me are not exactly what i purchased, the attachments are the slip of
the payment i made and sample of the products i need if you have them give
me feedback and the new account so that i`ll make the next payment as you
told me .
thanks.
Reporting this to Google's abuse address results in this message:
SMTP error from remote mail server after end of data: host aspmx.l.google.com [74.125.136.27]:
552-5.7.0 This message was blocked because its content presents a potential
552-5.7.0 security issue. Please visit http://support.google.com/mail/bin/answe
552-5.7.0 r.py?answer=6590 to review our message content and attachment content
552 5.7.0 guidelines. t9si5817581eeo.35 - gsmtp
They're right, there is a potential security issue - pity they don't want to have it reported to them.
Also a pity they don't enforce such guidelines on their own
product
users.
tvScience clients are shielded from the risk as all executable attachments from unknown senders are held in quarrantine. We report the message where possible to the sending organisation; in the above case the mails now have to be deleted.
UPDATE: They're still at it as of 2014/01/16.
Onthis occasion text is:
Hello dear,
I am sorry for getting back to you very late, I was on leave and only
came back to the office today.
As a matter of fact, we have evaluated your PI you sent to us previously.
kindly see the attached Revised Invoice and check if you can supplier me
the engines, spear spear parts, oils and cooler this January 2014, as we
have many demanding.
Hope to hear from you soonest.
Mr. Toney Adem (CEO)
Toney Adem Holdings Ltd.
The file is called "copy1.rar" and was sent by "mail-lb0-f194.google.com" ["209.85.217.194"].