June 2018 Email Campaigns

6/4/2018,"PAYMENT DOCUMENT - PO # 31052018", doc -> lokibot bundle,attachment,10
6/5/2018,"Invoice T/T|Re: Signed Order", doc -> lokibot,attachment,5
6/5/2018,All subjects contain "DocuSign", link -> doc -> pony -> evilpony -> panda banker, link, 8394
6/6/2018,All subjects contain "Intuit", link -> doc -> pony -> evilpony -> panda banker, link, 6660
6/6/2018,All subjects contain "RICEVUTA PAGAMENTO", xls -> smokeloader -> pandabanker,attachment,2
6/6/2018,"RFQ # Order No 807414122",attachment,2
6/7/2018,All subjects contain two _ characters as well as words like "Invoice|Order|Sales|Discount|coupon", iqy -> flawedammyy rat,attachment,62
6/7/2018,"RE:QUOTE REQUIRMENT|ABOUT NEW ORDERS|Re: quote", r00 -> isrstealer,attachment,4
6/7/2018,"Important : Please update your company information", doc -> trickbot,attachment,5
6/7/2018,All subjects contain "HCM/BND", doc -> exe,attachment,12
6/8/2018,All subjects relate to photos and images, zip -> js -> coinminer continued into 6/12,attachment,70
6/12/2018,All subjects start with "CP|CPY|COPY", iqy -> flawedammyy rat,attachment,89
6/13/2018,Highjacked subjects, doc -> ursnif,attachment,4
6/14/2018,All subjects relate to photos and images, zip -> js -> gandcrab,attachment,39
6/16/2018,"generalismade", zip -> hawkeye continuted into 6/17,attachment,67
6/18/2018,All subjects are hijacked threads, doc -> ursnif,attachment,3
6/18/2018,"plexium", zip -> hawkeye,attachment,48
6/19/2018,All subjects contain "fattura", xls -> smokeloader,attachment,2
6/21/2018,All subjects are hijacked threads, doc -> ursnif,attachment,3
6/22/2018,"Purchase Order", doc -> ,attachment,3
6/24/2018,"RE:TENDER AND REQUEST FOR QUOTE:", doc -> lokibot,attachment,2
6/25/2018,"New voiсemаil messаge.", link -> zip -> js, link, 10
6/25/2018,"ACH/WIRE FORM (JBS IMPORT)", iso -> formbook,attachment,5
6/26/2018,"Important Documents", doc -> trickbot,attachment,5
6/26/2018,"INV#57/18.06.2018 - SHIPPING DOCS", xlsx -> formbook,attachment,3
6/27/2018,All subjects contain "F24", xls -> smokeloader,attachment,2
6/27/2018,All subjects start with "PayPal", link -> doc -> hancitor -> evilpony -> pandbanker, link, 3769
6/28/2018,All subjects contain "写真", xls -> ursnif,attachment,42
6/28/2018,"FW: Invoice", doc -> trickbot,attachment,2
6/28/2018,"Invoice-005893784", doc -> loader -> hermes ransomware,attachment,7
6/28/2018,All subjects start with "OnlineInvoices ", link -> doc -> hancitor -> evilpony -> pandbanker, link, 5785
6/29/2018,"Re: New Order", pdf -> adwind -> lokibot,attachment,2
6/29/2018,"Statement", doc -> agenttesla,attachment,2