New Danabot Campaign

Main sample:
15fe51b93401fcf1ef6856e9d43504d8
https://www.virustotal.com/gui/file/57ef3ade1c05b895779e1d79a7886c318d243d2ed567c1bf3656823cf9225bf3/details

domain	derikaosos.info
domain	sinoposdssf.info
domain	statusnim.info
domain	tefidnsops.info

A large spam campaign is targeting clients of Polish banks impersonating the invoice from Orange.
Malware #brushaloader is attached, which will download #danabot banking Trojan.

Polska CERT Alert:
https://twitter.com/CERT_Polska/status/1145989658213539840?s=20