#rs6.net_230919

#IOC #OptiData #VR #ConstantContact #fakelinks #malware #pshishing

https://pastebin.com/0hUMMPXG

FAQ:
Energy Exemplar mailing was compromised to spread fake links.
Possible payloads (links was deactivated after ~3,5 hours after sending)

#phish
https://learningspanel.com/conference/draft-2020-form-w-4

#exploitkit (404, Morphine kit)
http://onevisionstudioslive.com/vendor

email headers
- - - - - - -
#1 (FAKE MESSAGE)

Received: from ccm32.constantcontact.com (unknown [208.75.123.228]) by srv88.victim0.org

Return-Path: APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
Received: from [10.252.0.105] ([10.252.0.105:53122] helo=p2-jbemailsyndicator17.ctct.net)
	by 10.249.244.10 (envelope-from <APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com>)
	(ecelerity 4.2.1.52273 r(Core:4.2.1.11)) with ESMTP id E1/E1-20094-4FCE88D5; Mon, 23 Sep 2019 12:04:04 -0400

DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=libwEuIzP7KTVwql2GX5o97zx0GNJbnyG3rP1dbX7RI=; b=J968k+AB85c1H9Zq8elA6ogoTaePa14/9A91Q3wS4unrvt2cRGTwElHTk7d50X0rciBYHSsy69/k74xfjOy3s1TuYepqx8Mtbt2naCrU6Hc5BiwsB+FgWVSbbqamkWJbBp9/PDDQbhbiQESLj6gnGoFYN7Dk2bCZQl60uAkmE2g=

Message-ID: <1133275543606.1126347936227.1850531310.0.161203JL.2002@scheduler.constantcontact.com>
Date: Mon, 23 Sep 2019 12:04:04 -0400 (EDT)
From: Energy Exemplar <george.anderson@energyexemplar.com>
Reply-To: george.anderson@energyexemplar.com
To: user1@victim01.org
Subject: Documents and Invoice for user1

X-Campaign-Activity-ID: 3f30b4fb-39e6-4675-933c-b118631156b4
X-Channel-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786
X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
X-Return-Path-Hint: APzC0+znmRnWTPLEYYxFWtA==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
X-Roving-Campaignid: 1133275543606
X-Roving-Id: 1126347936227.1850531310
X-Feedback-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786:3f30b4fb-39e6-4675-933c-b118631156b4:1126347936227:CTCT
# # # # # # # # #

#2 (REAL MESSAGE)

Received: from ccm182.constantcontact.com (ccm182.constantcontact.com [208.75.123.182]) by srv88.victim0.org

Return-Path: 	ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
Received: from [10.252.0.107] ([10.252.0.107:44993] helo=p2-jbemailsyndicator22.ctct.net)
	by 10.249.240.10 (envelope-from <ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com>)
	(ecelerity 4.2.38.62370 r(:)) with ESMTP id 3F/29-19489-88C198D5; Mon, 23 Sep 2019 15:27:04 -0400

DKIM-Signature: v=1; q=dns/txt; a=rsa-sha256; c=relaxed/relaxed; s=1000073432; d=auth.ccsend.com; h=date:mime-version:subject:X-Feedback-ID:message-id:from:reply-to:list-unsubscribe:list-unsubscribe-post:to; bh=qonukkQPz0sjMfWaGP/72tYBPJQcoq/5kZSIg4kCzxc=; b=YR0t/tI/yS7mraKMapBpoT3xU839daBRXv/PgSWYoHjXJ4J9Ycta6ISAPBi/sGiVW+RS3BQYap3Sbo/pm/G1+Wc7iT5/0cyo172DHxFActUk90PA4c1CswAo4V5RPfec5VdK0b17CeH4j5DNzPAMgHPYgsKIZae04NY/LGiTo/I=

Message-ID: <1133276817563.1126347936227.1850531310.0.221526JL.2002@scheduler.constantcontact.com>
Date: Mon, 23 Sep 2019 15:27:04 -0400 (EDT)
From: George Anderson <george.anderson@energyexemplar.com>
Reply-To: george.anderson@energyexemplar.com
To: user1@victim01.org
Subject: Unannounced Email:  "Documents and Invoice"

X-Campaign-Activity-ID: 4cfe46c8-d1df-4548-a391-f9a1d92617c5
X-Channel-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786
X-Mailer: Roving Constant Contact 2012 (http://www.constantcontact.com)
X-Return-Path-Hint: ATP5GyNHfRUijkfmh2SYXxQ==_1126347936227_kYSuQC2rEem5sdSuUpqHhg==@in.constantcontact.com
X-Roving-Campaignid: 1133276817563
X-Roving-Id: 1126347936227.1850531310
X-Feedback-ID: 9184ae40-2dab-11e9-b9b1-d4ae529a8786:4cfe46c8-d1df-4548-a391-f9a1d92617c5:1126347936227:CTCT
# # # # # # # # #

VR

@