(Trojan) RED Offer per Mail

[Mike Luk]

Hey Guys ,

hope this Post is ok in here...

i just want to buy a RED Scarlet Collection so i Post it here. Now i got an eMail with an "rar" File in it.
Lucky for me i am a Mac User with Trojan Experience.

So i just wonder why he dont put the Pics in the eMail. I Open the rar without Autorun the Stuff inside
and got an .exe and .scr File in it. (Plus some Red Pics)

I upload the Files and look ... Trojan found.

[TABLE="class: table table-bordered table-striped, width: 100%"]
[TR]
[TD]Malwarebytes[/TD]
[TD="class: text-red"]Trojan.MSIL[/TD]
[TD]20130207[/TD]
[/TR]
[/TABLE]

So Guys , Beware of eMail Attachments

Someone else got these Problems while trying to buy a RED ?

The Offer was

Dear mister Lukavecz,

We’re a United Stated based filmcompany that are mainly shooting videoclips, shorts, documentaries and reels. We’re about to shoot our first feature film and like to upgrade to the RED EPIC-X.
However, we’ve got a RED Scarlet-X ready-to-shoot-package for sale with only 74 hours of work.


RED Scarlet-X brain
Side SSD Module
Titanium PL Mount
RED 18-85 t2.9 CineZoom Lenses
Redmote
Redvolt 4-pack
Redmag 1.8’’ SSD (4-Pack)
DSMC Side Handle


Our original offer was $15000,- but since we’re really trying to sell this guy, we’re willing to go down to $12500 or €9000,-.


Since you live in Germany, and we are located in the United States, we’d like to do this transfer through bank wire or PayPal. Mainly because no shipping buyers fee and/or costs are related with the use of PayPal.
Photo’s are included in the attachments and link: Link to a Filehoster /file/ZE-ysUiK/Scarlet-X_Package.html
Thanks,
.

Just delete the Name ...

So , beware Guys

Best Wishes

Mike

 

[Mike Luk]

Now i send the Files to Avira and they analyse them.

[TABLE="class: table table-bordered table-striped, width: 100%"]
[TR]
[TD]Kaspersky[/TD]
[TD="class: text-red"]Trojan-Ransom.Win32.Blocker.apmi[/TD]
[TD]20130208[/TD]
[/TR]
[/TABLE]

[TABLE="class: table table-bordered table-striped, width: 892"]
[TR]
[TD]AntiVir[/TD]
[TD="class: text-red"]TR/Ransom.Blocker.apmi.1[/TD]
[TD]20130208
[/TD]
[/TR]
[/TABLE]
So a classic Ransom Ware ...

So - dear Jeff Reed (jeffreed1(at)hotmail.com) its not Realy Cool to send these things to Others .

Original Results of Scan

https://www.virustotal.com/file/c08...50210b2222484f0fb8599d94/analysis/1360298462/

 

[chad vachter]

Thanks very much Mike . That's great that there is such a wonderfully diverse set of skills in this forum , I feel like no question could g unanswered.

 

[Mike Luk]

Thank you,

if there are mistakes Or You got some questions , just Tell me

Mike