FRAUDE - Boleto
Assunto da mensagem: Boleto Atualizado Sujeito a Protesto após o Vencimento. n° (398542)
Data de inclusão: 25/10/18
O usuário recebe uma mensagem contendo um boleto disponível para download, no entanto o arquivo originado é malicioso criado para roubar informações da vítima e instalar outros arquivos fraudulentos com o nome de LNK/Autorun.Gen.
Conteúdo da mensagem
###############################################################################
# !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! ATENCAO !!! #
# #
# O TEXTO ABAIXO FOI TRANSCRITO A PARTIR DE UMA FRAUDE CADASTRADA EM NOSSOS #
# SISTEMAS ATRAVES DA COLETA DE DADOS NA INTERNET E/OU CONTRIBUICAO DE #
# PARCEIROS E/OU USUARIOS. #
# #
# EM CASO DE DUVIDAS ENTRE EM CONTATO ATRAVES DO EMAIL: cais@cais.rnp.br #
# #
# OBRIGADO. #
# #
# CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS) #
# REDE NACIONAL DE ENSINO E PESQUISA (RNP) #
###############################################################################
Return-Path: <ubuntu@xlt5.construrh.com.br>
Received: from mail.pop-ba.rnp.br (LHLO mail.pop-ba.rnp.br)
(2801:86:0:4:0:0:0:16) by mail.pop-ba.rnp.br with LMTP; Thu, 25 Oct 2018
02:03:07 -0300 (BRT)
Received: from mx0.pop-ba.rnp.br (mx0.pop-ba.rnp.br [IPv6:2801:86:0:4::24])
by mail.pop-ba.rnp.br (Postfix) with ESMTP id 1F499EE3364
for <fraudes@pop-ba.rnp.br>; Thu, 25 Oct 2018 02:03:07 -0300 (-03)
Received: from mx2.rnp.br (mail-mx-out-06.rnp.br [200.130.35.10])
by mx0.pop-ba.rnp.br (Postfix) with ESMTP id 871CDA0F3F
for <fraudes@pop-ba.rnp.br>; Thu, 25 Oct 2018 02:03:05 -0300 (-03)
Received: from mail-mtaout-proxy-02.rnp.br (mail-mtaout-proxy-02.rnp.br [200.130.35.127])
by mx2.rnp.br (8.14.4/8.14.4/Debian-8+deb8u2) with ESMTP id w9P536rx118626
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)
for <fraudes@pop-ba.rnp.br>; Thu, 25 Oct 2018 03:03:06 -0200
Received: from localhost (localhost [127.0.0.1])
by mail-mtaout-proxy-02.rnp.br (Postfix) with ESMTP id B92E83353C
for <fraudes@pop-ba.rnp.br>; Thu, 25 Oct 2018 02:03:05 -0300 (BRT)
X-Quarantine-ID: <b9YrYYnhxB5w>
X-Amavis-Alert: BAD HEADER SECTION, Non-encoded non-ASCII data (and not UTF-8)
(char F3 hex): Subject: ...ado Sujeito a Protesto ap\x{F3}s o
Vencimento.[...]
Received: from mail-mtaout-proxy-02.rnp.br ([127.0.0.1])
by localhost (mail-mtaout-proxy-02.rnp.br [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id b9YrYYnhxB5w for <fraudes@pop-ba.rnp.br>;
Thu, 25 Oct 2018 02:03:05 -0300 (BRT)
Received: from mail-mtain-01.rnp.br (mail-mtain-01.rnp.br [200.130.35.124])
by mail-mtaout-proxy-02.rnp.br (Postfix) with ESMTPS id A25FD334A5
for <fraudes@pop-ba.rnp.br>; Thu, 25 Oct 2018 02:03:05 -0300 (BRT)
Received: from localhost (localhost [127.0.0.1])
by mail-mtain-01.rnp.br (Postfix) with ESMTP id D079A1CD4FD;
Thu, 25 Oct 2018 02:03:04 -0300 (BRT)
X-Quarantine-ID: <9UbcnZvKbhbQ>
X-Amavis-Alert: BAD HEADER SECTION, Non-encoded non-ASCII data (and not UTF-8)
(char F3 hex): Subject: ...ado Sujeito a Protesto ap\x{F3}s o
Vencimento.[...]
Received: from mail-mtain-01.rnp.br ([127.0.0.1])
by localhost (mail-mtain-01.rnp.br [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 9UbcnZvKbhbQ; Thu, 25 Oct 2018 02:03:04 -0300 (BRT)
Received: from mx0.rnp.br (mx0.rnp.br [200.130.35.135])
by mail-mtain-01.rnp.br (Postfix) with ESMTP id BE0621CD4F0
for <artefatos@cais.rnp.br>; Thu, 25 Oct 2018 02:03:04 -0300 (BRT)
Received: from xlt5.construrh.com.br (xlt5.construrh.com.br [51.68.144.111])
by mx0.rnp.br (8.14.4/8.14.4/Debian-8+deb8u2) with ESMTP id w9P534aA023321
for <artefatos@cais.rnp.br>; Thu, 25 Oct 2018 03:03:05 -0200
Received: by xlt5.construrh.com.br (Postfix, from userid 1000)
id AC2B834EB4; Thu, 25 Oct 2018 02:01:07 -0300 (-03)
To: artefatos@cais.rnp.br
Subject: ENC: Boleto Atualizado Sujeito a Protesto após o Vencimento. n° (398542)
X-PHP-Originating-Script: 1000:javali.php
X-Mailer: Microsoft Office Outlook, Build 17.551210
From: Protesto do Titulo <imprensa@correios.com.br>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="cecda004dd57d0edc384c51715f81900"
Message-Id: <20181025050107.AC2B834EB4@xlt5.construrh.com.br>
Date: Thu, 25 Oct 2018 02:01:07 -0300 (-03)
X-Spam-Score: undef - relay 200.130.35.127 marked with skip_spam_scan
X-CanIt-Geo: =?UTF-8?Q?ip=3D200.130.35.127;_country=3DBR;_region=3DFederal_District;_city=3DBras=C3=ADlia;_latitude=3D-15.7833;_longitude=3D-47.9167;_http://maps.google.com/maps=3Fq=3D-15.7833,-47.9167&z=3D6?=
X-CanItPRO-Stream: base:zimbra (inherits from base:default)
X-Canit-Stats-ID: Bayes signature not available
Received-SPF: none (mx0.rnp.br: domain of ubuntu@xlt5.construrh.com.br
does not designate permitted sender hosts)
receiver=mx0.rnp.br; client-ip=51.68.144.111;
envelope-from=<ubuntu@xlt5.construrh.com.br>; helo=xlt5.construrh.com.br;
identity=mailfrom
X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.168.35.133
X-Scanned-By: CanIt (www . roaringpenguin . com) on 200.130.35.135
Authentication-Results: mx0.pop-ba.rnp.br
X-Spamd-Result: default: False [0.00 / 150.00]
Imagens
