API tools faq
paste
James_inthe_box

csv

James_inthe_box
Nov 3rd, 2017
547
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.45 KB | None | 0 0
raw download clone embed print report
  1. Date ,Summary, Details, Email, Payload, Type, Users Targeted
  2. 10/2/2017,Malicious email campaign, morning, "New Doc 2017-10-01 - Page 1", 7z -> js -> locky ransomware, Attachment, 931
  3. 10/2/2017,Malicious email campaign, morning, "Emailed Invoice - <digits>", 7z -> js -> locky ransomware, continued into 10/3/2017, Attachment, 3067
  4. 10/2/2017,Malicious email campaign, morning, "Delivery complete for parcel # 28616837", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 1115
  5. 10/3/2017,Malicious email campaign, morning, "INVOICE", 7z -> js -> locky ransomware, Attachment, 819
  6. 10/3/2017,Malicious email campaign, morning, "Emailing - PDF|DOC<digits>", 7z -> js -> locky ransomware, continued into 10/4/2017, Attachment, 2897
  7. 10/3/2017,Malicious email campaign, morning, "New incoming fax from <digits>-<digits>-<digits>", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 201
  8. 10/4/2017,Malicious email campaign, morning, "Copy of invoice A<digits> Please find your invoice attached.", 7z -> js -> locky ransomware, Attachment, 1098
  9. 10/4/2017,Malicious email campaign, morning, "RE: FW: bill for september", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 885
  10. 10/4/2017,Malicious email campaign, morning, "Message from <digits>", 7z -> js -> locky ransomware, continued into 10/5/2017, Attachment, 3273
  11. 10/4/2017,Malicious email campaign, afternoon, "Important - Payment Advice", doc -> trickbot banking trojan, Attachment, 37
  12. 10/5/2017,Malicious email campaign, morning, "Invoice", 7z -> js -> locky ransomware, Attachment, 1033
  13. 10/5/2017,Malicious email campaign, morning, "Make Hacking Difficult", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 289
  14. 10/5/2017,Malicious email campaign, morning, "FW: IRS", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 140
  15. 10/5/2017,Malicious email campaign, morning, "Invoice INV<digits>", 7z -> js -> locky ransomware, continued into 10/6/2017, Attachment, 3523
  16. 10/6/2017,Malicious email campaign, morning, "Your Remittance Advice", 7z file was actally base64, bad guys made a mistake, was going to be 7z -> js -> locky ransomware, Attachment, 1878
  17. 10/9/2017,Malicious email campaign, morning, "Invoice IP<digits>", 7z -> js -> locky ransomware, Attachment, 1266
  18. 10/9/2017,Malicious email campaign, morning, "New voice message <digits> in mailbox <digits> from "<digits>" <digits>", 7z -> js -> locky ransomware, continued into 10/10/2017, Attachment, 3322
  19. 10/10/2017,Malicious email campaign, morning, "Status of invoice A<digits>-<digits>", html -> js -> trickbot , Attachment, 146
  20. 10/10/2017,Malicious email campaign, morning, "Voicemail From <digits>-<digits>-<digits>", 7z -> vbs -> locky ransomware, Attachment, 850
  21. 10/10/2017,Malicious email campaign, morning, "Document invoice_<digits>_sign_and_return.pdf is complete", 7z file format fail, was going to be 7z -> js -> locky ransomware, Attachment, 80
  22. 10/10/2017,Malicious email campaign, afternoon, "Invoice INV<digits>", 7z -> js -> locky ransomware, Attachment, 512
  23. 10/11/2017,Malicious email campaign, morning, "Supplement payment <digits>", 7z file format fail, was going to be 7z -> js -> locky ransomware, Attachment, 953
  24. 10/11/2017,Malicious email campaign, morning, "Emaliling: <digits>", 7z -> vbs -> locky ransomware, Attachment, 12
  25. 10/11/2017,Malicious email campaign, morning, "Payment has been made", doc -> trickbot trojan, Attachment, 31
  26. 10/16/2017,Malicious email campaign, morning, "Your document Receipt <digits> for <username> is ready for signature!", link -> doc -> hancitor -> pony -> zloader trojans Link 891
  27. 10/17/2017,Ongoing Emotet Campaign, Various subjects, doc -> emotet banking trojan Link
  28. 10/18/2017,Malicious email campaign, morning, "Message from <digits>", 7z -> js -> locky ransomware, continued into 10/19/2017, Attachment, 3385
  29. 10/18/2017,Malicious email campaign, morning, "Invoice <digits> 10.18.2017", 7z -> js -> locky ransomware, Attachment, 2594
  30. 10/19/2017,Malicious email campaign, morning, "Emailed Invoice - <digits>", 7z -> js -> locky ransomware, Attachment, 2176
  31. 10/19/2017,Malicious email campaign, morning, "Invoice|Scanned|Dccument", doc -> locky ransomware, continued into 10/20/2017, Attachment, 3261
  32. 10/20/2017,Malicious email campaign, morning, "Scanned image from MX-2600N", doc -> locky/trickbot, Attachment, 611
  33. 10/23/2017,Malicious email campaign, afternoon, "Important - PayPal Appeal", doc -> trickbot, Attachment, 46
  34. 10/24/2017,Malicious email campaign, morning, "Your Invoice <digits>, doc -> locky/trickbot, Attachment, 536
  35. 10/24/2017,Malicious email campaign, morning, "Scan data", doc -> locky/trickbot, continued into 10/25/2017, Attachment, 2590
  36. 10/24/2017,Malicious email campaign, afternoon, "Payment has been made", doc -> trickbot trojan, Attachment, 7
  37. 10/25/2017,Malicious email campaign, morning, "Invoice [A-Z]{2,3}[0-9]{6}", doc -> ps -> locky transomware, Attachment, 34
  38. 10/25/2017,Malicious email campaign, morning, "[MACRO WARNING] ACH Transaction", doc -> trickbot, continued into 10/31/2017, Attachment, 21
  39. 10/26/2017,Malicious email campaign, morning, "Missed shipping|delivery notification for tracking <random>", link -> doc -> hancitor -> pony -> pandabanker trojans Link 1100
  40. 10/26/2017,Malicious email campaign, afternoon, "Re: Payment|Invoice for Payment", gz|rar -> exe -> pony, continued into 10/30/2017, Attachment, 25
  41. 10/27/2017,Malicious email campaign, afternoon, "INVOICE", r00 -> exe -> pony , Attachment, 11
  42. 10/30/2017,Malicious email campaign, morning, "Scanned document from HP ePrint user", doc -> locky ransomware, Attachment, 1630
  43. 10/30/2017,Malicious email campaign, morning, "eFax", doc -> trickbot, Attachment, 5
  44. 10/30/2017,Malicious email campaign, morning, "View your Office 365 Business billing statement for ", link -> doc -> hancitor -> pony -> pandabanker trojans Link 756
  45. 10/30/2017,Malicious email campaign, afternoon, "Invoice <digits> 10.30.2017", doc -> ps1 -> locky ransomware, continued into 10/31/2017, Attachment, 2869
  46. 10/31/2017,Malicious email campaign, morning, "Invoice INV<digits>", doc -> locky ransomware, Attachment, 1,005
  47. 10/31/2017,Malicious email campaign, morning, "Payment notice for invoice #<digits>", link -> doc -> hancitor -> pony -> pandabanker trojans Link 775
  48. 10/31/2017,Malicious email campaign, afternoon, "Invoice <digits>", zip -> exe -> browser & email stealer, Attachment, 4
  49. 10/31/2017,Malicious email campaign, afternoon, "Emailing: <digits>.doc", doc -> exe -> qtloader -> locky ransomware, Attachment, 1233
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!