¿Has recibido una citación por email de la Policía? No descargues el archivo, es un malware
Severity 3 - Medium Affected Resources: Users who received the aforementioned phishing email and downloaded and ran—or attempted to open—the file. Description: Fraudulent messages associated with a phishing campaign …
Users who received the aforementioned phishing email and downloaded and ran or attempted to open the file.
Fraudulent messages belonging to a phishing campaign contact users via email to distribute Trojan malware, under the pretext of providing more information about a court summons, due to a complaint filed against the user via a link that supposedly redirects to an app but actually downloads a .zip compressed file containing a .txt file and an .hta file, both of which are saved to the device.
If you’ve received an email, apparently from the National Police, summoning you regarding an alleged complaint, but you haven’t clicked on the link or downloaded the attachment, mark it as spam and delete it from your inbox.
However, if you have downloaded the file but have not opened it, be sure to delete it from both your Downloads folder and the Recycle Bin.
On the other hand, if you downloaded the file and ran it to view the information about the alleged summons, you should take the following steps:
- Disconnect the infected device from your home network to prevent the malware from spreading to other devices.
- Run a full system scan with your antivirus software, and make sure it’s up to date.
- If you suspect the device is still infected, you should consider formatting it or performing a factory reset to remove the infection. This action will erase all stored data, so you should back up your data regularly.
- Take screenshots of the email and files to attach as evidence when filing a report with law enforcement if necessary. You can use online witnesses to verify the content of this evidence.
- If you’re unsure whether a communication is truly official, you can always contact the National Police or call INICBE at 017 to receive advice from cybersecurity experts.
Find out how to protect yourself from this type of virus and other kinds of attacks with our recommendations.
A campaign has been detected that impersonates the National Police using phishing techniques, with the aim of tricking the victim into downloading a .zip file via a link and executing the Trojan-type malware it contains on their device.
The subject line used in these emails is as follows:
National Police Complaint - Request to Summon the Defendant xxxxxxx, Electronic Summons ID xxxx
The use of other subject lines for distributing this phishing scam cannot be ruled out.
Some indicators that lead us to suspect this is a fraudulent email include: the email domains have no connection to the National Police, and the body of the email does not follow the format of an official police notification.
To pressure the user into acting urgently without verifying the email’s authenticity, the date and time of the summons are set close to the current date.
If the user follows the instructions in the email and clicks on the supposed link to download an app, they will be redirected to a website that downloads a .zip file. We should always be wary of links that do not download apps from official app stores.
When unzipped, there will be two files: a .txt file and an .hta (executable) file; the latter contains malicious code that, when executed, will infect the device, compromising its security.
When we scan the file using malware detection tools such as VirusTotal and URLhaus, they provide information about the downloaded .hta file, identifying it as a Trojan.
Related articles
Security Alert: AnyDesk Detects a Critical Vulnerability That Allows Remote Code Execution on Linux
What is the scam in which people pose as hitmen or pimps?
