API tools faq
paste
James_inthe_box

Malicious email campaigns for October

James_inthe_box
Nov 1st, 2017
806
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.33 KB | None | 0 0
raw download clone embed print report
  1. Date Summary Details Email Payload Type Users Targeted
  2. 10/2/2017 Malicious email campaign, morning "New Doc 2017-10-01 - Page 1", 7z -> js -> locky ransomware Attachment 931
  3. 10/2/2017 Malicious email campaign, morning "Emailed Invoice - <digits>", 7z -> js -> locky ransomware, continued into 10/3/2017 Attachment 3067
  4. 10/2/2017 Malicious email campaign, morning "Delivery complete for parcel # 28616837", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 1115
  5. 10/3/2017 Malicious email campaign, morning "INVOICE", 7z -> js -> locky ransomware Attachment 819
  6. 10/3/2017 Malicious email campaign, morning ""Emailing - PDF|DOC<digits>", 7z -> js -> locky ransomware, continued into 10/4/2017 Attachment 2897
  7. 10/3/2017 Malicious email campaign, morning "New incoming fax from <digits>-<digits>-<digits>", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 201
  8. 10/4/2017 Malicious email campaign, morning "Copy of invoice A<digits> Please find your invoice attached.", 7z -> js -> locky ransomware Attachment 1098
  9. 10/4/2017 Malicious email campaign, morning "RE: FW: bill for september", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 885
  10. 10/4/2017 Malicious email campaign, morning "Message from <digits>", 7z -> js -> locky ransomware, continued into 10/5/2017 Attachment 3273
  11. 10/4/2017 Malicious email campaign, afternoon "Important - Payment Advice", doc -> trickbot banking trojan Attachment 37
  12. 10/5/2017 Malicious email campaign, morning "Invoice", 7z -> js -> locky ransomware Attachment 1033
  13. 10/5/2017 Malicious email campaign, morning "Make Hacking Difficult", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 289
  14. 10/5/2017 Malicious email campaign, morning "FW: IRS", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 140
  15. 10/5/2017 Malicious email campaign, morning "Invoice INV<digits>", 7z -> js -> locky ransomware, continued into 10/6/2017 Attachment 3,523
  16. 10/6/2017 Malicious email campaign, morning "Your Remittance Advice", 7z file was actally base64, bad guys made a mistake, was going to be 7z -> js -> locky ransomware Attachment 1878
  17. 10/9/2017 Malicious email campaign, morning "Invoice IP<digits>", 7z -> js -> locky ransomware Attachment 1266
  18. 10/9/2017 Malicious email campaign, morning "New voice message <digits> in mailbox <digits> from "<digits>" <digits>", 7z -> js -> locky ransomware, continued into 10/10/2017 Attachment 3322
  19. 10/10/2017 Malicious email campaign, morning "Status of invoice A<digits>-<digits>", html -> js -> trickbot Attachment 146
  20. 10/10/2017 Malicious email campaign, morning "Voicemail From <digits>-<digits>-<digits>", 7z -> vbs -> locky ransomware Attachment 850
  21. 10/10/2017 Malicious email campaign, morning "Document invoice_<digits>_sign_and_return.pdf is complete", 7z file format fail, was going to be 7z -> js -> locky ransomware Attachment 80
  22. 10/10/2017 Malicious email campaign, afternoon "Invoice INV<digits>", 7z -> js -> locky ransomware Attachment 512
  23. 10/11/2017 Malicious email campaign, morning "Supplement payment <digits>", 7z file format fail, was going to be 7z -> js -> locky ransomware Attachment 953
  24. 10/11/2017 Malicious email campaign, morning "Emaliling: <digits>", 7z -> vbs -> locky ransomware Attachment 12
  25. 10/11/2017 Malicious email campaign, morning "Payment has been made", doc -> trickbot trojan Attachment 31
  26. 10/16/2017 Malicious email campaign, morning "Your document Receipt <digits> for <username> is ready for signature!", link -> doc -> hancitor -> pony -> zloader trojans Link 891
  27. 10/17/2017 Ongoing Emotet Campaign Various subjects, doc -> emotet banking trojan Link
  28. 10/18/2017 Malicious email campaign, morning "Message from <digits>", 7z -> js -> locky ransomware, continued into 10/19/2017 Attachment 3,385
  29. 10/18/2017 Malicious email campaign, morning "Invoice <digits> 10.18.2017", 7z -> js -> locky ransomware Attachment 2,594
  30. 10/19/2017 Malicious email campaign, morning "Emailed Invoice - <digits>", 7z -> js -> locky ransomware Attachment 2,176
  31. 10/19/2017 Malicious email campaign, morning "Invoice|Scanned|Dccument", doc -> locky ransomware, continued into 10/20/2017 Attachment 3,261
  32. 10/20/2017 Malicious email campaign, morning "Scanned image from MX-2600N", doc -> locky/trickbot Attachment 611
  33. 10/23/2017 Malicious email campaign, afternoon "Important - PayPal Appeal", doc -> trickbot Attachment 46
  34. 10/24/2017 Malicious email campaign, morning "Your Invoice <digits>, doc -> locky/trickbot Attachment 536
  35. 10/24/2017 Malicious email campaign, morning "Scan data", doc -> locky/trickbot, continued into 10/25/2017 Attachment 2,590
  36. 10/24/2017 Malicious email campaign, afternoon "Payment has been made", doc -> trickbot trojan Attachment 7
  37. 10/25/2017 Malicious email campaign, morning "Invoice [A-Z]{2,3}[0-9]{6}", doc -> ps -> locky transomware Attachment 34
  38. 10/25/2017 Malicious email campaign, morning "[MACRO WARNING] ACH Transaction", doc -> trickbot, continued into 10/31/2017 Attachment 21
  39. 10/26/2017 Malicious email campaign, morning "Missed shipping|delivery notification for tracking <random>", link -> doc -> hancitor -> pony -> pandabanker trojans Link 1,100
  40. 10/26/2017 Malicious email campaign, afternoon "Re: Payment|Invoice for Payment", gz|rar -> exe -> pony, continued into 10/30/2017 Attachment 25
  41. 10/27/2017 Malicious email campaign, afternoon "INVOICE", r00 -> exe -> pony Attachment 11
  42. 10/30/2017 Malicious email campaign, morning "Scanned document from HP ePrint user", doc -> locky ransomware Attachment 1,630
  43. 10/30/2017 Malicious email campaign, morning "eFax", doc -> trickbot Attachment 5
  44. 10/30/2017 Malicious email campaign, morning "View your Office 365 Business billing statement for ", link -> doc -> hancitor -> pony -> pandabanker trojans Link 756
  45. 10/30/2017 Malicious email campaign, afternoon "Invoice <digits> 10.30.2017", doc -> ps1 -> locky ransomware, continued into 10/31/2017 Attachment 2869
  46. 10/31/2017 Malicious email campaign, morning "Invoice INV<digits>", doc -> locky ransomware Attachment 1,005
  47. 10/31/2017 Malicious email campaign, morning "Payment notice for invoice #<digits>", link -> doc -> hancitor -> pony -> pandabanker trojans Link 775
  48. 10/31/2017 Malicious email campaign, afternoon "Invoice <digits>", zip -> exe -> browser & email stealer Attachment 4
  49. 10/31/2017 Malicious email campaign, afternoon "Emailing: <digits>.doc", doc -> exe -> qtloader -> locky ransomware Attachment 1,633
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!