API tools faq
paste
James_inthe_box

September Campaigns

James_inthe_box
Oct 2nd, 2017
620
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.99 KB | None | 0 0
raw download clone embed print report
  1. Date Summary Details Email Payload Type Users Targeted
  2. 9/1/2017 Malicious email campaign, morning "New voice message <digits> in mailbox <digits> from "<digits>" <<digits>>" 7z -> vbs -> locky ransomware Attachment 2513
  3. 9/1/2017 Malicious email campaign, afternoon "Paypal Security", doc -> trickbot banking trojan Attachment 31
  4. 9/4/2017 Malicious email campaign, morning "<digits> - True Telecom Invoice for August 2017", link, 7z -> vbs -> locky ransomware Attachment 614
  5. 9/4/2017 Malicious email campaign, morning "Invoice INV-000868 from Property Lagoon Limited for Gleneagles", 7z -> vbs -> locky and globeimposter ransomware Attachment 349
  6. 9/5/2017 Malicious email campaign, morning "Scanning", 7z -> vbs -> locky ransomware Attachment 209
  7. 9/5/2017 Malicious email campaign, morning "New voice message digits in mailbox digits from "digits" <digits>", 7z -> vbs -> locky ransomware Attachment 25
  8. 9/5/2017 Malicious email campaign, morning "Invoice INV-000338 from Verizon", 7z -> vbs -> locky ransomware Attachment 22
  9. 9/5/2017 Malicious email campaign, morning "USPS - Holdmail|Confirmation|Document <digits>", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 878
  10. 9/5/2017 Malicious email campaign, morning "eFax", doc -> trickbot banking trojan, continued into 09/08/2017 Attachment 60
  11. 9/5/2017 Malicious email campaign, afternoon "Voice Message from <digits> - name unavailable", link -> js -> locky ransomware, continued into 09/07/2017 Link 8806
  12. 9/5/2017 Malicious email campaign, morning "Eviction warning #<digits>, link -> js -> zeuspanda Link 5
  13. 9/6/2017 Malicious email campaign, morning "Your invoice for eBay purchases (<digits>#)", link -> js -> locky ransomware Link 621
  14. 9/6/2017 Malicious email campaign, morning "Your Bill <digits> for domain Document is Ready for Signature", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 901
  15. 9/6/2017 Malicious email campaign, afternoon "Canadian Imperial Bank of Commerce", doc -> trickbot trojan Attachment 11
  16. 9/7/2017 Malicious email campaign, morning "FreeFax From:<digits>", link -> js -> locky ransomware Link 198
  17. 9/7/2017 Malicious email campaign, afternoon "Microsoft Store E-invoice for your order #<digits>", link and 7z -> vbs -> locky ransomware Attachment, link 1554
  18. 9/8/2017 Malicious email campaign, morning "Emailed Invoice - <digits>", html -> js -> locky ransomware and trickbot Attachment 252
  19. 9/11/2017 Malicious email campaign, morning "Please verify your email address user@domain", link -> js -> trickbot and locky ransomware Link 2666
  20. 9/11/2017 Malicious email campaign, morning "Missed delivery notification for tracking <characters>", link -> doc -> hancitor -> pony -> evilony -> zloader trojans Link 834
  21. 9/11/2017 Malicious email campaign, morning "FreeFax From:<digits>", link -> js -> trickbot and locky ransomware Link 2186
  22. 9/12/2017 Malicious email campaign, morning "FW: Invoice <digits> for accounting services", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 793
  23. 9/13/2017 Malicious email campaign, morning "Incoming RingCentral fax from <digits>", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 834
  24. 9/14/2017 Malicious email campaign, morning "Copy of Invoice <digits>|Voice Message from <digits>- name unavailable", link -> js -> locky ransomware Link 271
  25. 9/14/2017 Malicious email campaign, morning "Voice Message from <digits>- name unavailable", link -> js -> locky ransomware Link 2890
  26. 9/14/2017 Malicious email campaign, morning "[Factura: FACV<digits>]", xls -> ursnif/ifsb trojan Attachment 51
  27. 9/18/2017 Malicious email campaign, morning All subjects contain "invoice", link -> emotet trojan Link 30
  28. 9/18/2017 Malicious email campaign, morning "Message from KM_C224e",7z -> vbs -> locky ransomware, continued into 09/19/2017 Attachment 2928
  29. 9/19/2017 Malicious email campaign, morning "HERBALIFE Order Number: <digits>", 7z -> vbs -> locky ransomware Attachment 1312
  30. 9/19/2017 Malicious email campaign, morning "RE: RE: subpoena", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 1110
  31. 9/19/2017 Malicious email campaign, morning "Emailing - <digits>", 7z -> vbs -> locky ransomware, continued into 09/20/2017 Attachment 2444
  32. 9/20/2017 Malicious email campaign, morning "Your payment #<digits>", 7z -> vbs -> locky ransomware Attachment 1068
  33. 9/20/2017 Malicious email campaign, morning "Status of Invoice <digits>", rar -> vbs -> locky ransomware Attachment 275
  34. 9/20/2017 Malicious email campaign, morning "RE: RE: shipping inquiry regarding order", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 781
  35. 9/20/2017 Malicious email campaign, morning "New voice message <digits> in mailbox <digits> from "<digits" <<digits>>", link and 7z -> vbs locky ransomware Attachment, link 2666
  36. 9/21/2017 Malicious email campaign, morning "Invoice RE-2017-09-21-<digits>, 7z -> vbs -> locky ransomware Attachment 1119
  37. 9/21/2017 Malicious email campaign, morning "FW: Your Invoice I<digits> from Advanced Maintenance", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 639
  38. 9/21/2017 Malicious email campaign, afternoon Subect contains PIC|IMG|JPG|SCAN, 7z -> vbs -> locky ransomware, continued into 09/22/2017 Attachment 2438
  39. 9/22/2017 Malicious email campaign, morning "Your Invoice # <digits>", 7z -> vbs -> locky ransomware Attachment 1464
  40. 9/25/2017 Malicious email campaign, morning "Message from <digits>", 7z -> vbs -> locky ransomware Attachment 4206
  41. 9/25/2017 Malicious email campaign, morning "<digits>_Invoice_<digits>", 7z -> vbs -> locky ransomware Attachment 4756
  42. 9/25/2017 Malicious email campaign, afternoon "eFax", doc -> trickbot banking trojan, continued into 09/26/2017, 09/27/2016 Attachment 11
  43. 9/26/2017 Malicious email campaign, morning "INVOICE", 7z -> vbs -> locky ransomware, continued into 09/27/2017 Attachment 4388
  44. 9/26/2017 Malicious email campaign, morning "Delivery status change", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 782
  45. 9/26/2017 Malicious email campaign, morning "Invoice PIS<digits>", 7z -> vbs -> locky ransomware, continued into 09/27/2017 Attachment 3249
  46. 9/27/2017 Malicious email campaign, morning "Your Invoice <digits> for user@domain Document is Ready for Signature", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 614
  47. 9/27/2017 Malicious email campaign, morning "Scanned image from MX-2600N", 7z -> vbs -> locky ransomware, continued into 09/28/2017 Attachment 3777
  48. 9/27/2017 Malicious email campaign, morning "Your <domain> BALANCE PAYMENT", r00 -> lokibot Attachment 10
  49. 9/28/2017 Malicious email campaign, morning "Emailing: Scan<digits>", 7z -> vbs -> trickbot and locky ransomware Attachment 1875
  50. 9/28/2017 Malicious email campaign, morning "Scan Data", 7z -> vbs -> locky ransomware, continued into 09/28/2017 Attachment 3542
  51. 9/28/2017 Malicious email campaign, morning "RE: invoice <digits> debit", link -> doc -> hancitor -> pony -> evilpony -> zloader trojans Link 272
  52. 9/29/2017 Malicious email campaign, morning "Invoice", 7z -> vbs -> locky ransomware Attachment 4074
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!