Fake WhatsApp ‘Voice Message Notification/1 New Voicemail’ themed emails lead to malware

Fake WhatsApp ‘Voice Message Notification/1 New Voicemail’ themed emails lead to malware

by | Oct 28, 2013 | Industry Intel, Threat Lab

Reading Time: ~ < 1 min.

WhatsApp users, watch out! The cybercriminal(s) behind the most recently profiled campaigns impersonating T-Mobile, and Sky, have just launched yet another malicious spam campaign, this time targeting WhatsApp users with fake “Voice Message Notification/1 New Voicemail” themed emails. Once unsuspecting users execute the fake voice mail attachment, their PCs will attempt to drop additional malware on the hosts. The good news? We’ve got you (proactively) covered.

Sample screenshot of the spamvertised email:

WhatsApp_Email_Spam_Malware_Malicious_Software_Social_Engineering_Cybercrime

Detection rate for the malicious attachment: MD5: 0458a01e42544eacf00e6f2b39b788e0 – detected by 31 out of 48 antivirus scanners as Trojan.Win32.Sharik.qhd

Once executed, the sample creates the following Registry Keys on the affected hosts:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sewwe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sewwe\ShellNew
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell\print
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell\print\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell\printto
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\S6.Document\shell\printto\command
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\S6
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\S6\Settings

It then attempts to download additional malware from the well known C&C server at networksecurityx.hopto.org

Webroot SecureAnywhere users are proactively protected from this threat.

Blog Staff

About the Author

Blog Staff

The Webroot blog offers expert insights and analysis into the latest cybersecurity trends. Whether you’re a home or business user, we’re dedicated to giving you the awareness and knowledge needed to stay ahead of today’s cyber threats.

7 Comments

  1. Gianteagle008
    Gianteagle008 on February 26, 2015 at 10:44 pm

    Ok so I actually got a fake whatsapp email and they used one of my phone contacts so it looked like it was from her. I click on the sender and it takes me to her contact information on my phone.

  2. JOAN H SIEMANN
    JOAN H SIEMANN on July 29, 2016 at 10:22 am

    i have a voicemail on my WhatsApp and i don’t know how to check it. Can you please email those steps to me please?

  3. Haroon William
    Haroon William on September 20, 2016 at 10:32 am

    Share good information very helpful.

  4. bella cyrus
    bella cyrus on March 24, 2017 at 6:04 am

    thanxx for sharing a great post!!

  5. steve cook
    steve cook on April 12, 2017 at 6:11 am

    Thanks a lot for this very very important information about the fake voicemail notification on whatsapp . Cyber criminals always do something like this but thank god for the websites and the technology geeks who always aware us regarding these attacks and stuffs.
    Thanks again

  6. Mick Reilly
    Mick Reilly on May 9, 2017 at 12:54 am

    I get one of these two or three times a week… I keep blocking them but they just keep springing up again… I feel like I am in a never ending conflict with the scammers…!

Share This