2020-04-30 - Link-based malspam pushing Dridex - 2 examples

2020-04-30 - LINK-BASED MALSPAM PUSHING DRIDEX - 2 EXAMPLES

DATE/TIME RANGE:

- Date: Thu, 30 Apr 2020 13:23:59 -0700
- Date: Thu, 30 Apr 2020 14:35:30 -0700

SENDING MAIL SERVERS:

- Received: from collahahhaged.us ([104.168.254.248])
- Received: from univerzamjw.us ([104.168.244.241])

SENDING EMAIL ADDRESSES:

- From: Bug Magazine <xutona@collahahhaged.us>
- From: Minimizer's <jiwijyty@univerzamjw.us>

SUBJECT LINES:

- Subject: Dear Customer your Booking N_6056AT142312
- Subject: Successful Payment Confirmation 92443TF81504

LINKS FROM THE MALSPAM:

- hxxp://aita.mrboatstudio[.]com/inc.php
- hxxp://wkcanisius[.]nl/wp-content/plugins/email-log/include/Addon/api.lib.php