Advertisement
Guest User

2018-11-19 - Trickbot malspam targeting US (gtag: sat105)

a guest
Nov 19th, 2018
602
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 7.14 KB | None | 0 0
  1. 2018-11-19: MALSPAM PUSHING TRICKBOT (GTAG: SAT105) TARGETING US VICTIMS
  2.  
  3. EMAILS:
  4.  
  5. - 2018-11-19 17:08 UTC -- Attachment: invoice_no_370913.doc -- Subject: Detailed information for purchase order 16 Nov.
  6. - 2018-11-19 17:09 UTC -- Attachment: invoice_no_370913.doc -- Subject: Detailed information for purchase order 16/11/2018
  7. - 2018-11-19 17:10 UTC -- Attachment: invoice_no_370903.doc -- Subject: Detailed information for order 14/11/2018
  8. - 2018-11-19 17:10 UTC -- Attachment: invoice_no_370903.doc -- Subject: Detailed information for purchase order 14/11/2018
  9. - 2018-11-19 17:12 UTC -- Attachment: invoice_no_370903.doc -- Subject: Information for purchase order 14/11/2018
  10. - 2018-11-19 17:21 UTC -- Attachment: invoice_no_370907.doc -- Subject: Information for purchase order 15/11/2018
  11. - 2018-11-19 17:28 UTC -- Attachment: Receipt_No_610401.doc -- Subject: Detailed information for order November 14
  12. - 2018-11-19 17:28 UTC -- Attachment: Receipt_No_610401.doc -- Subject: Detailed information for purchase order November 14
  13. - 2018-11-19 17:28 UTC -- Attachment: Receipt_No_610401.doc -- Subject: Detailed information for purchase order 15 Nov.
  14. - 2018-11-19 17:29 UTC -- Attachment: Receipt_No_610414.doc -- Subject: Information for order 14 of November
  15. - 2018-11-19 17:31 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Details for purchase order 15/11/2018
  16. - 2018-11-19 17:32 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Detailed information for purchase order 15 of November
  17. - 2018-11-19 17:32 UTC -- Attachment: Receipt_No_610415.doc -- Subject: mation for purchase order november 14
  18. - 2018-11-19 17:32 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Additional information for purchase order 15/11/2018
  19. - 2018-11-19 17:32 UTC -- Attachment: Receipt_No_610418.doc -- Subject: Details for order 14/11/2018
  20. - 2018-11-19 17:32 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Information for order 15/11/2018
  21. - 2018-11-19 17:32 UTC -- Attachment: Receipt_No_610414.doc -- Subject: Details for order 15 of November
  22. - 2018-11-19 17:33 UTC -- Attachment: Receipt_No_610411.doc -- Subject: Detailed information for order November 16
  23. - 2018-11-19 17:33 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Additional information for purchase order 14/11/2018
  24. - 2018-11-19 17:33 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Additional information for purchase order 16 of November
  25. - 2018-11-19 17:33 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Information for purchase order November 15
  26. - 2018-11-19 17:33 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Additional information for order 14/11/2018
  27. - 2018-11-19 17:33 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Additional information for purchase order 14 Nov.
  28. - 2018-11-19 17:34 UTC -- Attachment: Receipt_No_610417.doc -- Subject: Details for order 15 of November
  29. - 2018-11-19 17:34 UTC -- Attachment: Receipt_No_610417.doc -- Subject: Additional information for order 16 Nov.
  30. - 2018-11-19 17:35 UTC -- Attachment: Receipt_No_610415.doc -- Subject: ional information for order november 15
  31. - 2018-11-19 17:36 UTC -- Attachment: Receipt_No_610417.doc -- Subject: Detailed information for purchase order 14 Nov.
  32. - 2018-11-19 17:37 UTC -- Attachment: Receipt_No_610412.doc -- Subject: Additional information for purchase order 15/11/2018
  33. - 2018-11-19 17:43 UTC -- Attachment: Receipt_No_610418.doc -- Subject: Detailed information for order 16 of November
  34. - 2018-11-19 18:04 UTC -- Attachment: Order_info760620.doc -- Subject: Information for purchase order 15 of November
  35. - 2018-11-19 18:20 UTC -- Attachment: Payment_Data_540307.doc -- Subject: Information for order 16 Nov.
  36. - 2018-11-19 18:20 UTC -- Attachment: Payment_Data_540310.doc -- Subject: Details for order 16 Nov.
  37. - 2018-11-19 18:23 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Information for purchase order 15 Nov.
  38. - 2018-11-19 18:23 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Detailed information for order 16 of November
  39. - 2018-11-19 18:23 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Information for purchase order November 16
  40. - 2018-11-19 18:24 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Information for purchase order 14 of November
  41. - 2018-11-19 18:25 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Detailed information for order 16 of November
  42. - 2018-11-19 18:27 UTC -- Attachment: Payment_Data_540310.doc -- Subject: Detailed information for order 16 of November
  43. - 2018-11-19 18:29 UTC -- Attachment: Payment_Data_540310.doc -- Subject: Details for purchase order November 15
  44. - 2018-11-19 18:32 UTC -- Attachment: Payment_Data_540310.doc -- Subject: Information for purchase order 15/11/2018
  45. - 2018-11-19 18:33 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Detailed information for purchase order 14 of November
  46. - 2018-11-19 18:33 UTC -- Attachment: Payment_Data_540309.doc -- Subject: Details for order 14 Nov.
  47. - 2018-11-19 18:34 UTC -- Attachment: Payment_Data_540308.doc -- Subject: Information for purchase order 14 Nov.
  48. - 2018-11-19 18:38 UTC -- Attachment: Payment_Data_540308.doc -- Subject: Details for order 16 of November
  49. - 2018-11-19 18:38 UTC -- Attachment: Payment_Data_540308.doc -- Subject: Information for order 16 of November
  50.  
  51. SHA256 HASHES FOR THE ATTACHED WORD DOCS:
  52.  
  53. - 077ac03bf9097e570cc68805577fe6696644b297b9b8d3c78ab2639a77851ae3 - 210,432 bytes
  54. - 1e0a7ad16c15d385e7f49b51cead37da643c38593b3c280a08d12717f6db04fb - 210,432 bytes
  55. - 2ae3129faf5144276acc2e6133ac8804aaf4734b498d72ec896e4504bb389d74 - 210,432 bytes
  56. - 2b8fb17e6b43f257e4161d839638c8fd3723b986c660ff59ec8b0285d2d82da7 - 210,432 bytes
  57. - 2c10fc77ce65e461a88bcb7446cfa723c13ec1271d65c6d0ed280b32e722ab84 - 210,432 bytes
  58. - 43d2c7f5effb358971b3cb2025219f9cf946d3d65f760900a48744ec2deb3c27 - 210,432 bytes
  59. - 545a562b3ce69d65d5035f046530b64fb4513f69adf7e81b018e4796026bde58 - 210,432 bytes
  60. - 818fb5296dfe483ef7d7f6e51d3e758123d926c6149d8c615f984a3b6dea4b08 - 210,432 bytes
  61. - 90a95d1de78def9daabd3e007630afeb23c9a0cd3fe8b726f8ef7e0de630cda4 - 210,432 bytes
  62. - 9c52920a6d453dc18067729f4f3146b1e9c69706798505982cba4289bff2066a - 210,432 bytes
  63. - a7f6e3af8b864fb94929ecc94e08699cc09465b61c8b1006ad7b425b7eed2282 - 210,432 bytes
  64. - bc0de89289694137347c8865940c3224e748def79c8526d626423e48e9e4b749 - 210,432 bytes
  65. - cb9c1f81c3a87ed8b3157763a84ab4723f27704fd6ae7de37fd671249cae683a - 210,432 bytes
  66. - d0f20ce14e989d9966958a34c88ead0af067d71eb0909a81e5f4dacc323b2159 - 210,432 bytes
  67. - d2726022d41488f3eda0700aa9253de79700e2c4f1d9d6c2b5d5368655393dd7 - 210,432 bytes
  68. - e1eee046110eb2797a821b01cfeffcf326bbb3394097e43ca063ea862a0e5c45 - 210,432 bytes
  69. - e7186b7d1c7342b318f0358950f1cc26b6469052dd303987eaa6cb0e6a5b5b0f - 210,432 bytes
  70. - ebe17bcf4852a9cbf2da8fb672b81ea3f6fcef0519ea1882f4fc3e084bf708c6 - 210,432 bytes
  71. - ed0b1f84f3a8e325b7221e4885de90905d73fd2269bf1eb6104dc4fcf8b4ad41 - 210,432 bytes
  72. - f850652eddc3e01b53d31686739fa0702f837e95a4a3de048c2b93ed2e644073 - 210,432 bytes
  73.  
  74. URLS GENERATED BY MACROS IN THE ATTACHED WORD DOCS:
  75.  
  76. - hxxp://46.173.213[.]211/stan.mil
  77. - hxxp://46.173.213[.]216/stan.mil
  78.  
  79. TRICKBOT MALWARE BINARY (GTAG: SAT105):
  80.  
  81. - d5ff76c19fccba3edce848f7a440688800c0439080ed13418b17034ab17bb3b3 - 427,090 bytes
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement