Malicious text message (USPS) Information only

[xrobwx71]

I received a text message today copied below.

From a phone number with an Indonesian exchange of +62

It's supposedly from the USPS (United States Postal Service) ((with an Indonesian exchange))

U‏S‏‏‏‏PS Noti‏fication: Your par‏cel is temporar‏ily on hold at our facil‏ity due to insuffic‏ient ad‏dr‏ess infor‏mation. Please provide a valid de‏‏livery‏ addre‏ss to avoid returning the packa‏ge.
URL:Removed
Wishing you an exceptional day from the US‏‏‏P‏S tea‏m.

---

Congratulations! Your analysis is done and available at: https://www.hybrid-analysis.com/sam...6c061263802cf5a58fec28fedbb?environmentId=160



--- Falcon Sandbox Analysis Overview ---



https://www.hybrid-analysis.com/sam...f295b81bfcfb4318b46c061263802cf5a58fec28fedbb



--- Falcon Sandbox Analysis Summary ---



Analysis State: SUCCESS

Threat Verdict: malicious

Threat Score: 82/100

AV Detection Ratio: n/a

AV Family Name: n/a

Time of analysis: 2024-06-26 16:58:38

Contacted Domains: a.nel.cloudflare.com, cutt.ly, usom.mzlrpdma.top Contacted Hosts: 104.22.0.232, 172.67.189.63, 172.67.189.63, 35.190.80.1, 35.190.80.1

Environment: Windows 10 64 bit (ID: 160)

 

[R0H1T]

You can remove the url in the OP? Didn't check it here but what's malicious in it?

 

[Bill_Bright]

I am assuming you are not expecting a package from Indonesia.

I would have immediately blocked the number and deleted the message.

 

[Double-Click]

Just block it, I was getting bogus UPS texts for months a while back.

 

[xrobwx71]

I've posted this experience on about 7 sites I'm a member of in the hopes it will help steer at least one person clear of being phished.

I am assuming you are not expecting a package from Indonesia.

I would have immediately blocked the number and deleted the message.

I am not and I did.

 

[dirtyferret]

Maybe it's that Nigerian prince finally sending you that check by way of Indonesia? You should definitely contact it.

I've received BS texts from UPS & USPS.
I've even received BS phone calls from Amazon that had the Washington state area code as Amazon corporate calls do. Thing is I work with them and I know their security questions they ask when they do call me. I asked them to verify the email address on my account (basic question) and the lady just hung up on me.

 

[JIWIL]

The chances of someone accidentally clicking that url are much higher than the chances of someone being saved by this thread. Just.. you know.

 

[xrobwx71]

You can remove the url in the OP? Didn't check it here but what's malicious in it?

Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'https://cutt.ly/repmWkJb?BKK=FH5CsqGHpl%3Fbqy%3DcypMvfnNhc'

Submit malware for free analysis with Falcon Sandbox and Hybrid Analysis technology. Hybrid Analysis develops and licenses analysis tools to fight malware.

www.hybrid-analysis.com

 

[Ivan Bliminse]

I get those texts and emails at least three times a month, i just ignore & delete them..!

 

[Toothless]

If someone clicks a link from a sketch text that's their fault. The best protection is common sense.

 

[Bill_Bright]

I am not and I did.

 

[A Computer Guy]

Just block it, I was getting bogus UPS texts for months a while back.

Same here.

 

[Bill_Bright]

I think we all - me included - missed the point @xrobwx71 was making - even though it is right there in the title of this thread.

He knew it was a scam. He did not and was not tempted to fall for it. He did NOT follow the links. He demonstrated how he used Hybrid Analysis to breakdown and analyze the message, confirming what he already knew - that it was indeed, malicious and not just a "wrong number". Then he deleted it.

The point was, xrobwe71 took the opportunity to remind us all, including the newest, the less experienced and future readers too, that these scams are out there. And I thank you for that!

My personal apologies in particular to xrobwx71 since I've known you for years from another site where we are both on the staff - and where I know your advanced expertise. I should have picked right away that you were alerting readers to these threats - and not inquiring about them.

 

[dirtyferret]

Appreciate the warning, unfortunately scamming people has a very long history and technology simply allows new scams to appear and target people from all over the world.

Now if you excuse me there is a guy in van in our parking lot who needs to get rid of pair of speakers someone refused to buy on delivery and his boss will be really mad if he comes back with them. I think I may get a great deal on them!

 

[bonehead123]

Now if you excuse me there is a guy in van in our parking lot who needs to get rid of pair of speakers someone refused to buy on delivery and his boss will be really mad if he comes back with them. I think I may get a great deal on them!

Yep, just like that fella that tried to sell me a $3k set of 4 flashy new bling bling 32" rims for my SUV, for ONLY $500....

And guess what.... My son & I grabbed them off the ground & ran away without paying him a dime, hahahaha..

n.O.t... j/k



Actually we just said no thanks, walked away, & called the polizei as soon as we were out of sight !

Also just wondering if any of you who received these texts have reported this scam attempt to the carriers/companies etc ?

I certainly do, even though I realize it will probably get lost in the mountains of garbaggio that they get every day...

 

[xrobwx71]

I think we all - me included - missed the point @xrobwx71 was making - even though it is right there in the title of this thread.

He knew it was a scam. He did not and was not tempted to fall for it. He did NOT follow the links. He demonstrated how he used Hybrid Analysis to breakdown and analyze the message, confirming what he already knew - that it was indeed, malicious and not just a "wrong number". Then he deleted it.

The point was, xrobwe71 took the opportunity to remind us all, including the newest, the less experienced and future readers too, that these scams are out there. And I thank you for that!

My personal apologies in particular to xrobwx71 since I've known you for years from another site where we are both on the staff - and where I know your advanced expertise. I should have picked right away that you were alerting readers to these threats - and not inquiring about them.

No apology is ever necessary Bill. But Thanks anyway.

 

[Count von Schwalbe]

I have one from Myanmar and one from Vietnam; no luck yet getting one from Indonesia.